1
00:00:00,920 --> 00:00:05,620
So our next section is on legal considerations of election machine hacking.

2
00:00:06,760 --> 00:00:12,320
Joseph Lorenzo Hall is the Chief Technologist and Director of the Internet Architecture Project

3
00:00:12,320 --> 00:00:14,920
at the Center for Democracy and Technology.

4
00:00:15,300 --> 00:00:20,040
And Candace Hoke is a legal expert and founder of the Center for Election Integrity.

5
00:00:20,700 --> 00:00:23,500
And so with that, I will turn it over to you, Candace, to start.

6
00:00:23,580 --> 00:00:24,460
Thank you so much.

7
00:00:24,600 --> 00:00:25,340
Thanks so much, Jake.

8
00:00:26,620 --> 00:00:27,600
Welcome, everyone.

9
00:00:28,340 --> 00:00:29,300
I'll stay over here.

10
00:00:31,180 --> 00:00:34,420
It may seem strange to have a law professor here.

11
00:00:34,600 --> 00:00:41,140
I'm happy to also tell you that I hold an information security degree from Carnegie Mellon,

12
00:00:41,240 --> 00:00:45,960
and I've been working with this crowd for over 10 years on election security,

13
00:00:47,060 --> 00:00:51,180
which, as you've already discovered, leaves a great deal to be desired.

14
00:00:52,260 --> 00:00:54,040
You want to flip to my next?

15
00:00:55,120 --> 00:00:58,440
Part of what I want you to recognize, and maybe you already do,

16
00:00:58,580 --> 00:00:59,860
is that law is both.

17
00:01:00,000 --> 00:01:03,840
a cause and potentially a cure for election security.

18
00:01:04,260 --> 00:01:10,860
The way we got into this disaster with e-voting and election tech

19
00:01:10,860 --> 00:01:13,500
was from a legal mandate out of Washington,

20
00:01:13,700 --> 00:01:20,340
where those who did not understand security vulnerabilities at all

21
00:01:20,340 --> 00:01:24,260
assumed that we would solve the nation's problems in voting

22
00:01:24,260 --> 00:01:26,820
by simply moving to electronic voting.

23
00:01:27,040 --> 00:01:29,980
And it was basically a mandate to the state.

24
00:01:30,000 --> 00:01:33,000
And we could say much more in a complex way,

25
00:01:33,180 --> 00:01:37,460
but there will be more later this afternoon about that.

26
00:01:38,460 --> 00:01:41,980
And, of course, it is a matter of state as well as federal law.

27
00:01:42,160 --> 00:01:43,040
Let's go to...

28
00:01:43,040 --> 00:01:48,640
So first I'd like to just quickly flip through some of the consequences of election hacking

29
00:01:48,640 --> 00:01:51,000
just to remind us what's at stake.

30
00:01:51,180 --> 00:01:54,480
We probably all think we know what's at stake,

31
00:01:54,600 --> 00:01:55,860
but let me just remind you.

32
00:01:55,960 --> 00:01:58,060
So let's quickly move through these.

33
00:01:58,160 --> 00:01:59,160
At the federal level,

34
00:01:59,160 --> 00:02:01,080
we have not only Congress and the president,

35
00:02:01,200 --> 00:02:06,740
but also indirectly we have the whole judiciary,

36
00:02:06,920 --> 00:02:08,700
the U.S. Supreme Court, all the way down,

37
00:02:08,780 --> 00:02:11,480
affected by the election results.

38
00:02:12,420 --> 00:02:15,960
All 50 states, here are just a few state capitals,

39
00:02:16,000 --> 00:02:20,000
and, of course, all three branches of their state governments,

40
00:02:20,280 --> 00:02:25,040
plus then local governments such as these we know,

41
00:02:25,160 --> 00:02:28,360
but there are the Hamlets, the counties, et cetera.

42
00:02:29,680 --> 00:02:34,860
They are all directly affected by elections

43
00:02:34,860 --> 00:02:36,940
and whether they operate correctly.

44
00:02:38,160 --> 00:02:41,380
There's vast amounts of money at stake,

45
00:02:42,460 --> 00:02:47,660
as well as issues such as global warming and environmental policy,

46
00:02:48,910 --> 00:02:50,340
military and foreign affairs,

47
00:02:51,320 --> 00:02:53,820
health care delivery and health care systems,

48
00:02:54,640 --> 00:02:58,560
surveillance, something that many of us in this crowd care about greatly,

49
00:02:59,160 --> 00:03:03,760
and we're talking about trillions of dollars at stake,

50
00:03:03,940 --> 00:03:09,720
plus the greatest military power in the world directly affected

51
00:03:09,720 --> 00:03:12,020
by how our elections are conducted.

52
00:03:12,320 --> 00:03:15,400
So we do have legal complexity,

53
00:03:15,460 --> 00:03:18,100
as we saw from the prior panel's discussion.

54
00:03:18,840 --> 00:03:23,520
There are many who work under the misconception

55
00:03:24,220 --> 00:03:26,960
that the state governments actually control,

56
00:03:27,840 --> 00:03:29,060
under the U.S. Constitution,

57
00:03:29,060 --> 00:03:33,200
the entirety of election administration,

58
00:03:33,780 --> 00:03:38,400
meaning election tech, election management, et cetera.

59
00:03:38,640 --> 00:03:41,820
And the fact of the matter is that the U.S. Constitution,

60
00:03:42,240 --> 00:03:46,420
as I mentioned in the question period in the last session,

61
00:03:46,620 --> 00:03:49,560
is that the U.S. Constitution explicitly says

62
00:03:49,920 --> 00:03:55,540
that the states shall until Congress chooses to do otherwise.

63
00:03:56,060 --> 00:03:58,840
How broad congressional power is,

64
00:03:59,060 --> 00:04:01,400
it's really never been fathomed,

65
00:04:01,400 --> 00:04:05,920
because Congress has tended to be less than active over time.

66
00:04:06,840 --> 00:04:11,000
But it's not to say that dormant power could be exercised.

67
00:04:11,180 --> 00:04:17,160
And I do want to go on record urging you to understand

68
00:04:17,160 --> 00:04:20,580
that by no means do I think the feds are the smartest people

69
00:04:20,580 --> 00:04:23,860
in the room and that they can be trusted on election security.

70
00:04:24,740 --> 00:04:28,840
To the exclusion or to the detriment of the state officials,

71
00:04:29,060 --> 00:04:32,300
I think that there are smart people and dedicated people

72
00:04:32,300 --> 00:04:35,340
to election security and fairness at every level.

73
00:04:36,420 --> 00:04:42,320
The problem often is that we have laws and practices

74
00:04:42,320 --> 00:04:48,120
and customs and misunderstandings about technology

75
00:04:48,380 --> 00:04:51,000
and security at every level as well.

76
00:04:52,380 --> 00:04:57,420
So, I did want you to understand the core conflict behind a great deal

77
00:04:57,420 --> 00:04:59,040
of what's going on as far as election security and fairness.

78
00:04:59,040 --> 00:05:09,120
far as the legal framework for dealing with election security issues. Now, a principle

79
00:05:09,120 --> 00:05:16,840
in law that many do not recognize is the one on the right, and that is the goal of repose

80
00:05:16,840 --> 00:05:25,100
or finality. In law, in litigation, for instance, we recognize that we will not have a perfect

81
00:05:25,100 --> 00:05:33,080
system, that we will never be able to obtain 100% of the evidence that's relevant in the

82
00:05:33,080 --> 00:05:41,040
time periods as necessary, and we may not be able to produce, even if there were a theoretically

83
00:05:41,040 --> 00:05:47,560
perfect judgment. So we have to get as close as we can and then close the books and move

84
00:05:47,560 --> 00:05:53,420
on. Well, what if in a particular litigation, for instance, concerning, we'll just say,

85
00:05:53,500 --> 00:05:55,080
who rules?

86
00:05:55,100 --> 00:06:04,820
Who ran a red light and hit a bus, that after the judgment, we discovered some conclusive

87
00:06:04,820 --> 00:06:09,900
evidence that showed that the verdict was wrong? Can we come back in and reopen five

88
00:06:09,900 --> 00:06:15,840
years later and change that judgment? And the answer generally is no. We want to close.

89
00:06:16,140 --> 00:06:24,080
So finality is very important in the legal system, settled expectations, but it also,

90
00:06:24,140 --> 00:06:25,080
as you can see,

91
00:06:25,100 --> 00:06:33,120
and think, in the election context as well, it runs roughshod in opposition to accuracy,

92
00:06:33,320 --> 00:06:39,120
integrity, and sometimes justice. In the election situation, it could mean, for instance,

93
00:06:39,280 --> 00:06:49,060
that we choose or a state chooses to move forward into finality and governing and basically

94
00:06:49,960 --> 00:06:55,080
inaugurating its new governor or its new state legislature, or whatever it is that

95
00:06:55,080 --> 00:06:55,120
we're going to see in the election. So, in the election context, we're going to see

96
00:06:55,120 --> 00:06:55,160
that we're going to see these new governor or these new state legislature, the new state

97
00:06:55,160 --> 00:07:01,560
legislature being sworn in rather than having a process that would allow the investigation

98
00:07:02,000 --> 00:07:10,320
of the election technology, forensics, whatever that would then possibly cause the election

99
00:07:10,980 --> 00:07:17,620
conclusions to be in doubt. Keep going. So we have lots of threats. As we know, this

100
00:07:17,620 --> 00:07:23,020
is only a subsection. You're going to be hearing more about threats later in the day. Those

101
00:07:23,020 --> 00:07:24,900
of us in this room know the...

102
00:07:24,900 --> 00:07:31,700
a broad range of vulnerabilities. They're being exploited right now. One would think that if

103
00:07:31,700 --> 00:07:39,360
the election machinery is as vulnerable as it is, easily exploitable, easily hacked,

104
00:07:39,960 --> 00:07:46,600
that we would have processes for being able to ascertain, legal processes to be able to ascertain

105
00:07:46,600 --> 00:07:53,660
and correct for errors in the system. You would expect that, right? Companies have that. And in

106
00:07:53,660 --> 00:08:01,160
fact, we require under our health care law, the HIPAA law and our financial services laws,

107
00:08:01,480 --> 00:08:09,800
there are mandates for that, when I say mandates, regulatory mandates regarding security and

108
00:08:09,800 --> 00:08:17,740
also auditing throughout the systems and disclosure of breaches. None of that exists in the election

109
00:08:17,740 --> 00:08:23,640
systems. None. And the states differ substantially in the way that we do. And I think that's

110
00:08:23,640 --> 00:08:30,320
ways they proceed on particular questions or election challenges.

111
00:08:30,600 --> 00:08:39,200
So for instance, some states have an approach that requires in order to even bring a contest

112
00:08:39,200 --> 00:08:45,480
for an election where there is the perception or even some proof, reasonable proof of hacking

113
00:08:45,480 --> 00:08:55,420
of the election, they require actual proof before even filing or as a condition of filing

114
00:08:55,420 --> 00:09:02,740
the litigation. Most litigation, the way we proceed is by filing a lawsuit and then

115
00:09:02,740 --> 00:09:09,420
being able to develop the evidence. You can't do that in elections. For these states, you

116
00:09:09,420 --> 00:09:15,460
are required to actually have the proof in advance. And I ask you, how many of us are

117
00:09:15,460 --> 00:09:23,120
able to gather the proof of a hacked election in advance to be able to, as a condition precedent

118
00:09:23,120 --> 00:09:28,200
as we would say, to file the lawsuit and to proceed? So in other words, those states,

119
00:09:28,420 --> 00:09:35,320
we can go back to the, yeah, those states are much more about finality and throwing

120
00:09:35,320 --> 00:09:42,100
a cloak over the election process and just moving on. And you can imagine that that is

121
00:09:42,100 --> 00:09:45,440
actually, and I've written about this, that's actually an invitation to the state to file

122
00:09:45,440 --> 00:09:48,880
cases in place. Such an invitation to hackers. Come hack here because we aren't going to

123
00:09:48,880 --> 00:09:56,680
be watching. We aren't going to look. Have a field day. Because our laws are structured

124
00:09:56,680 --> 00:10:03,180
so we will not find out. And even if we do, we won't be able to proceed to correct in

125
00:10:03,180 --> 00:10:09,220
time. Then there are other states that actually have a different approach. And that is, typical

126
00:10:09,220 --> 00:10:15,420
litigation, you can file, you can challenge a particular office, it's one that's right,

127
00:10:15,420 --> 00:10:22,560
And that office will not be filled until the litigation has concluded and, of course, evidence has to be produced.

128
00:10:22,920 --> 00:10:33,300
But then the question becomes, can those challengers actually require the systems to be subject to a forensics analysis?

129
00:10:33,880 --> 00:10:40,100
And this is where some of the litigations for the 2016 election foundered.

130
00:10:40,100 --> 00:10:47,660
Because the answers frequently were, oh, no, you can't look and you can't make us look.

131
00:10:48,320 --> 00:10:53,260
So, again, it was, we'll throw a cloak over what happened.

132
00:10:53,320 --> 00:10:54,960
Nobody's going to look too closely.

133
00:10:56,100 --> 00:11:01,660
We all know in the security world you can't operate a secure system if no one's looking.

134
00:11:02,140 --> 00:11:09,400
And there are legal barriers to actually analyzing, assessing the conduct and the technology.

135
00:11:10,660 --> 00:11:15,240
So the law really is a problem when it comes to election security.

136
00:11:16,980 --> 00:11:32,520
At the state level, we have additional problems, some of which, for instance, Jake referred to when he said one of the goals is to erase the word unhackability from the election industry vocabulary.

137
00:11:33,780 --> 00:11:39,120
We hear it all the time that our systems are unhackable.

138
00:11:40,100 --> 00:11:41,900
Or we run secure systems.

139
00:11:42,220 --> 00:11:46,660
Trust us, you don't need to look.

140
00:11:46,860 --> 00:11:47,980
No one needs to look.

141
00:11:48,180 --> 00:11:55,900
We would actually endanger our system security by allowing forensics analysis or any other kind of analysis.

142
00:11:56,220 --> 00:12:05,480
Now, politically, those who are in charge of the election system by law are often ones who want to run for office again.

143
00:12:05,780 --> 00:12:09,980
And they, unfortunately, believe that if...

144
00:12:10,100 --> 00:12:17,720
If problems are found in the technology, it will then be attributed to them personally that they have failed.

145
00:12:17,980 --> 00:12:20,020
They're not running successful elections.

146
00:12:20,460 --> 00:12:22,260
Now, let me unpack that again.

147
00:12:23,440 --> 00:12:36,560
What happens at the Secretary of State level, and sometimes at the local level, is that the election officials sort of feel one with their technology.

148
00:12:36,820 --> 00:12:38,960
They identify with their technology.

149
00:12:39,200 --> 00:12:40,080
They're owned by them.

150
00:12:40,080 --> 00:12:51,020
Their own success, their own sort of integrity rests upon whether that technology is secure and trustworthy.

151
00:12:51,620 --> 00:12:54,300
And frankly, we all know it's not.

152
00:12:54,820 --> 00:13:04,840
And further, the last presentation and David Zimbarber's also showed you there's no reason for us to trust that technology.

153
00:13:05,040 --> 00:13:08,020
But it is not those election officials' fault.

154
00:13:08,020 --> 00:13:18,880
This is the only technology that was available and was certified by their predecessors to run and that was purchased using that $3 billion plus in federal funds.

155
00:13:19,340 --> 00:13:34,000
That, by the way, by law, by federal law, had to be used by the states to buy technology before the standards and testing system had actually been set up and produced standards.

156
00:13:34,720 --> 00:13:35,340
So, repeat.

157
00:13:35,340 --> 00:13:43,820
Congress required the $3 billion to be spent on legacy systems that we already knew were flawed.

158
00:13:44,100 --> 00:13:58,600
They were from the 1990s and the early 2000s with 2003 for $5 before the security standards and the testing apparatus had been set up.

159
00:13:59,840 --> 00:14:05,320
Roughly 85% of all votes in the United States are being cast.

160
00:14:05,320 --> 00:14:06,860
And that's a lot of money that's being cast on this technology today.

161
00:14:07,480 --> 00:14:25,440
The complicated and much more vigorous federal testing system, which is a third-party independent system now, plus the security standards, very little of our technology has run through that system at all.

162
00:14:25,500 --> 00:14:28,360
The certification, the qualification, the testing.

163
00:14:28,560 --> 00:14:35,240
And yes, although it's all been voluntary, at least that is some protection.

164
00:14:35,240 --> 00:14:35,300
Thank you.

165
00:14:35,320 --> 00:14:35,520
But it's not a protection.

166
00:14:36,270 --> 00:14:54,560
So what we end up with is a terrible situation with voting systems and we'll just say entire election technologies that do not deserve any, we'll say, respect as secure technologies.

167
00:14:55,340 --> 00:15:03,720
But election officials routinely consider themselves to be personally accused.

168
00:15:04,500 --> 00:15:07,100
of having lack of integrity

169
00:15:07,100 --> 00:15:09,320
and lack of faithfulness to the voters

170
00:15:09,320 --> 00:15:14,940
if the technology itself is being accused,

171
00:15:15,240 --> 00:15:17,480
being challenged for being insecure.

172
00:15:17,720 --> 00:15:20,640
So one of the techniques I would mention to you

173
00:15:20,640 --> 00:15:23,180
and underscore is it's very important

174
00:15:23,180 --> 00:15:25,880
to separate election officials from the technology

175
00:15:25,880 --> 00:15:30,080
and to remind them you were saddled with this.

176
00:15:30,080 --> 00:15:33,680
It's not you, the most important,

177
00:15:33,780 --> 00:15:34,960
meaning not your decision.

178
00:15:35,200 --> 00:15:39,780
The best you can do is to authorize the transparency,

179
00:15:40,040 --> 00:15:41,800
the accountability systems

180
00:15:41,800 --> 00:15:45,900
that we use in security operations generally,

181
00:15:46,560 --> 00:15:51,160
and that way you will be, we will applaud you,

182
00:15:51,300 --> 00:15:52,880
we will praise you publicly,

183
00:15:53,220 --> 00:15:55,440
but you have to work with this community

184
00:15:55,440 --> 00:15:58,040
because you have technologies

185
00:15:58,040 --> 00:15:59,940
that cannot otherwise be trusted.

186
00:16:00,980 --> 00:16:03,820
Let me see, a few other things.

187
00:16:04,600 --> 00:16:06,100
So, thank you.

188
00:16:06,580 --> 00:16:11,040
So the mistake in policy drivers in this field,

189
00:16:11,180 --> 00:16:14,440
the assumptions and frequent statements

190
00:16:14,440 --> 00:16:18,160
are that votes and registrations can't be easily modified,

191
00:16:18,440 --> 00:16:20,820
that any errors that occur in tabulations

192
00:16:20,820 --> 00:16:23,640
or voter registrations are small and insignificant,

193
00:16:24,180 --> 00:16:26,440
it would be way too expensive

194
00:16:26,440 --> 00:16:28,580
to examine elections too closely,

195
00:16:28,700 --> 00:16:29,860
so we're not going to do it,

196
00:16:30,080 --> 00:16:31,900
it would also take too long,

197
00:16:32,100 --> 00:16:36,680
and that would prevent the orderly process of the system

198
00:16:36,680 --> 00:16:39,920
as far as inaugurations and swearing into office,

199
00:16:40,780 --> 00:16:45,020
and also, again, that election officials are fearful

200
00:16:45,020 --> 00:16:50,280
of being held publicly and sometimes criminally responsible

201
00:16:51,340 --> 00:16:55,620
if the elections, if evidence is produced

202
00:16:55,620 --> 00:16:59,980
that the elections were not run in an accurate, secure manner.

203
00:17:00,080 --> 00:17:03,000
And it is true, there are some standards in some states

204
00:17:03,000 --> 00:17:05,140
that could be read that way,

205
00:17:06,340 --> 00:17:08,800
and election officials tend to believe

206
00:17:08,800 --> 00:17:11,780
that forensics analyses are only used

207
00:17:11,780 --> 00:17:13,980
when there is a criminal investigation.

208
00:17:14,620 --> 00:17:18,760
Joe's going to go into criminal consequences very shortly,

209
00:17:18,960 --> 00:17:21,340
but I do want to underscore again

210
00:17:21,340 --> 00:17:25,640
that there are a number of election officials

211
00:17:25,640 --> 00:17:28,480
who have set up forensics assessments,

212
00:17:28,820 --> 00:17:30,060
including some I've been involved with,

213
00:17:30,060 --> 00:17:30,700
and some I've been involved in,

214
00:17:30,780 --> 00:17:34,540
where important evidence has been produced

215
00:17:34,540 --> 00:17:36,700
of network connections, vote changes,

216
00:17:37,080 --> 00:17:38,920
other kinds of problems

217
00:17:38,920 --> 00:17:47,480
that would shock and disturb anybody

218
00:17:47,480 --> 00:17:50,160
who knows just a little about security.

219
00:17:53,040 --> 00:17:56,540
So we have at the state level

220
00:17:56,540 --> 00:17:59,800
a number of issues that need to be addressed,

221
00:18:00,060 --> 00:18:00,860
through the laws.

222
00:18:01,040 --> 00:18:03,080
I don't think they're going to be addressed

223
00:18:03,080 --> 00:18:04,300
at the federal level.

224
00:18:06,080 --> 00:18:08,320
We could, and I think we should,

225
00:18:08,400 --> 00:18:10,540
have laws for recounts

226
00:18:10,540 --> 00:18:14,640
that are going to support forensics assessments.

227
00:18:15,940 --> 00:18:17,400
And David and I,

228
00:18:17,560 --> 00:18:20,200
and I don't think anybody else on that team is here,

229
00:18:20,360 --> 00:18:23,700
we wrote a forensics guide for election officials

230
00:18:23,700 --> 00:18:26,780
back in 2008 that the American Bar Association published.

231
00:18:27,040 --> 00:18:28,100
It's still available.

232
00:18:29,820 --> 00:18:35,700
We do need to have routine post-election auditing.

233
00:18:36,280 --> 00:18:38,880
We need to have, I would say,

234
00:18:38,920 --> 00:18:42,300
even routine forensics assessments of elections.

235
00:18:42,560 --> 00:18:45,300
I worked with DHS last summer

236
00:18:45,300 --> 00:18:50,540
on developing some proposals for how DHS could be involved

237
00:18:50,540 --> 00:18:54,340
in network scanning for probes,

238
00:18:54,340 --> 00:18:56,700
particularly from outside the United States,

239
00:18:56,740 --> 00:18:58,000
into our election system.

240
00:18:58,000 --> 00:19:02,940
But overall, we should recognize

241
00:19:02,940 --> 00:19:05,840
our systems are vulnerable.

242
00:19:06,580 --> 00:19:08,200
They do need to be replaced.

243
00:19:08,580 --> 00:19:09,840
But in the meantime,

244
00:19:10,320 --> 00:19:13,880
there are multiple types of security activities

245
00:19:13,880 --> 00:19:19,080
that this community and the offices could engage in,

246
00:19:19,240 --> 00:19:21,540
and we should be working together on that.

247
00:19:21,820 --> 00:19:24,040
So, Joe?

248
00:19:24,760 --> 00:19:25,600
Joe?

249
00:19:28,040 --> 00:19:29,240
, thank you.

250
00:19:30,320 --> 00:19:31,120
Thank you.

251
00:19:34,440 --> 00:19:35,860
Thank you very much.

252
00:19:36,180 --> 00:19:37,920
Hi, everyone.

253
00:19:38,400 --> 00:19:39,360
My name is Joe.

254
00:19:40,600 --> 00:19:42,600
I'm from the Center for Democracy and Technology

255
00:19:42,600 --> 00:19:43,640
in Washington, D.C.

256
00:19:43,680 --> 00:19:46,980
I've been working on this stuff for a long time.

257
00:19:48,320 --> 00:19:50,660
And you can kind of think of me as half lawyer,

258
00:19:50,700 --> 00:19:51,760
half computer scientist,

259
00:19:52,020 --> 00:19:53,860
but not technically either of those,

260
00:19:54,000 --> 00:19:56,360
but it's complicated.

261
00:19:56,600 --> 00:19:57,680
You're welcome to look me up

262
00:19:57,680 --> 00:19:58,920
online and figure out the rest.

263
00:19:59,520 --> 00:20:02,380
Just to give you some quick words on motivation.

264
00:20:02,560 --> 00:20:03,860
I told Candace I wasn't gonna talk about this,

265
00:20:03,940 --> 00:20:04,240
but why not?

266
00:20:06,060 --> 00:20:07,260
Elections are really complicated,

267
00:20:07,400 --> 00:20:09,200
and hopefully if you've been here so far today,

268
00:20:09,280 --> 00:20:11,140
you've realized that it's a lot of stuff

269
00:20:11,860 --> 00:20:15,260
operating in very close proximity to each other

270
00:20:15,260 --> 00:20:16,260
and have to be connected well.

271
00:20:16,400 --> 00:20:17,860
So we always talk about them as being

272
00:20:18,460 --> 00:20:19,980
people, processes, and technology.

273
00:20:21,020 --> 00:20:23,740
And much of that process is the law.

274
00:20:23,940 --> 00:20:25,920
And so there are things that have to be done

275
00:20:25,920 --> 00:20:27,600
in certain ways because the law says it is.

276
00:20:27,680 --> 00:20:28,840
That doesn't mean we can't change the laws

277
00:20:28,840 --> 00:20:30,960
to do different things, and often we do,

278
00:20:31,060 --> 00:20:33,140
and I can talk about places where we have

279
00:20:34,120 --> 00:20:36,100
specifically sought to and changed the law

280
00:20:36,100 --> 00:20:39,360
to allow for higher security processes and technologies

281
00:20:39,360 --> 00:20:41,040
to be allowed to be used in elections.

282
00:20:42,160 --> 00:20:44,400
And so Candace just talked about a lot of

283
00:20:44,400 --> 00:20:45,760
this general legal landscape

284
00:20:45,760 --> 00:20:47,520
and some of the civil law considerations.

285
00:20:47,640 --> 00:20:49,940
I'm gonna talk about criminal law

286
00:20:49,940 --> 00:20:51,780
and some of the more tech law kinds of things

287
00:20:51,780 --> 00:20:53,220
that you might run into if you're gonna

288
00:20:53,220 --> 00:20:54,720
start playing with voting systems.

289
00:20:55,440 --> 00:20:57,460
So in terms of the general legal landscape here,

290
00:20:57,540 --> 00:20:57,660
I'm gonna talk about some of the more tech law kinds of things that you might run into if you're gonna start playing with voting systems. So in terms of the general legal landscape here,

291
00:20:57,680 --> 00:20:58,480
I'm gonna talk about some of the more tech law kinds of things that you might run into if you're gonna start playing with voting systems. So in terms of the general legal landscape here,

292
00:20:58,480 --> 00:20:59,060
Let me see if I can.

293
00:21:01,100 --> 00:21:02,700
As we've been talking about elections

294
00:21:02,700 --> 00:21:03,960
are mostly governed by states.

295
00:21:04,660 --> 00:21:08,020
All of them criminalize some form of tampering

296
00:21:08,020 --> 00:21:10,240
with voting equipment, voting supplies,

297
00:21:10,480 --> 00:21:12,840
voter ballots, and stuff like that, as they should.

298
00:21:13,100 --> 00:21:14,980
So in general, if you've ever been

299
00:21:14,980 --> 00:21:17,080
in the lock-picking village here at DEF CON,

300
00:21:17,200 --> 00:21:18,880
and if you haven't, you should go check it out.

301
00:21:18,940 --> 00:21:19,620
It's a lot of fun.

302
00:21:20,180 --> 00:21:22,940
They always talk about, the tool folks always talk about

303
00:21:22,940 --> 00:21:25,300
the first two rules of picking locks is

304
00:21:25,300 --> 00:21:27,520
you don't pick one that's in use and you don't pick one

305
00:21:27,520 --> 00:21:30,140
one you don't own and I think that goes for voting systems as

306
00:21:30,140 --> 00:21:34,280
well. They're hard to get your hands on which is why this is

307
00:21:34,280 --> 00:21:37,440
really awesome today. We have some here. Some of them are no

308
00:21:37,440 --> 00:21:39,880
longer used anymore. Some of them are still being used and

309
00:21:39,880 --> 00:21:43,240
some vendors have even been gracious enough to bring them

310
00:21:43,240 --> 00:21:45,900
and allow you to kick the tires. So please go and even if you've

311
00:21:45,900 --> 00:21:49,120
never done any hacking we can show you a little bit about what

312
00:21:49,120 --> 00:21:52,460
you can and cannot do with some of these systems. I really think

313
00:21:52,460 --> 00:21:55,980
that disclosure here is very different than disclosure in

314
00:21:55,980 --> 00:21:58,740
general purpose computing and what I mean by disclosure is

315
00:21:58,740 --> 00:22:05,300
vulnerability disclosure and so for example the there was the

316
00:22:05,300 --> 00:22:08,280
sequel injection which means someone put special characters

317
00:22:08,280 --> 00:22:11,740
into a form field on a voter registration website to get

318
00:22:11,740 --> 00:22:14,840
access to the underlying database and were able to get

319
00:22:14,840 --> 00:22:19,120
90,000 voter records out of that. That's a good example of

320
00:22:19,120 --> 00:22:23,320
one where the our intelligence community and the FBI noticed

321
00:22:23,320 --> 00:22:25,800
that and then sent a lot of the

322
00:22:25,980 --> 00:22:29,940
details of that particular attack to various other states.

323
00:22:30,060 --> 00:22:33,060
Some election officials never even heard about that so there's

324
00:22:33,060 --> 00:22:35,520
still a pretty big information sharing and communication

325
00:22:35,520 --> 00:22:39,260
problem here in terms of getting actionable intelligence

326
00:22:39,260 --> 00:22:42,100
down to the state and local entities and there's some work

327
00:22:42,100 --> 00:22:44,460
I'm going to be doing in the next two years. By the way if

328
00:22:44,460 --> 00:22:46,040
you're looking for a job and you know something about

329
00:22:46,040 --> 00:22:48,500
cybersecurity and election technology come talk to me. I

330
00:22:48,500 --> 00:22:53,460
have a job. And so I think that's a good that's one way

331
00:22:53,460 --> 00:22:55,420
disclosure work. The other way is exactly what

332
00:22:55,980 --> 00:22:58,820
Logan came up here and talked about when he was talking about

333
00:22:58,820 --> 00:23:02,940
you know poking around and then trying his damnedest to get

334
00:23:02,940 --> 00:23:06,440
Kennesaw State to recognize that the shortcomings in a

335
00:23:06,440 --> 00:23:09,460
misconfiguration of their own system and even took another

336
00:23:09,460 --> 00:23:12,120
person checking it again and telling them look it's still not

337
00:23:12,120 --> 00:23:15,300
fixed before that happened. I'd like to believe that it's it's

338
00:23:15,300 --> 00:23:19,160
better now but you know only only they will know and hopefully

339
00:23:19,160 --> 00:23:22,460
they're doing things that are sort of regular assessments of

340
00:23:22,460 --> 00:23:25,820
their infrastructure. But we'll have to ask Merle about that

341
00:23:25,980 --> 00:23:31,640
and I'm sure he has thoughts. So get into the good stuff. Some

342
00:23:31,640 --> 00:23:34,620
of the criminal stuff here that you could run into if you do

343
00:23:34,620 --> 00:23:37,940
things incorrectly you know actually messing with equipment

344
00:23:37,940 --> 00:23:40,960
that is going to be used in an election is a really bad idea.

345
00:23:41,200 --> 00:23:43,600
Just to give you an example and I can cite some of the stuff

346
00:23:43,600 --> 00:23:46,960
from other states but you know a lot of these things don't even

347
00:23:46,960 --> 00:23:51,400
require you to have an intent to commit fraud right. They just

348
00:23:51,940 --> 00:23:55,460
doing something to hack or tamper with the equipment itself

349
00:23:55,980 --> 00:23:58,420
is enough even if you didn't mean to and stuff. So for

350
00:23:58,420 --> 00:24:01,200
example in California you can check it out California

351
00:24:01,200 --> 00:24:05,500
elections code 18564 has this list of things that are

352
00:24:05,500 --> 00:24:08,760
criminally criminal offenses for voting equipment and voting

353
00:24:08,760 --> 00:24:11,960
supplies that will get you two to four years in prison at a

354
00:24:11,960 --> 00:24:15,640
minimum. So if you tamper with interfere with the correct

355
00:24:15,640 --> 00:24:19,460
operation or you willfully damage a voting machine voting

356
00:24:19,460 --> 00:24:22,320
device voting system vote tabulation device or ballot

357
00:24:22,320 --> 00:24:25,960
tally software you can get in trouble. If you if you have a

358
00:24:25,980 --> 00:24:28,400
need to interfere or attempt to interfere with the secrecy of

359
00:24:28,400 --> 00:24:32,340
voting or ballot tally software you can get in trouble. And then

360
00:24:32,340 --> 00:24:36,480
without authorization modulo who can give you authorization to do

361
00:24:36,480 --> 00:24:39,360
this makes or has in your possession a key to a voting

362
00:24:39,360 --> 00:24:42,320
machine and if you know about voting machines as Barbara

363
00:24:42,320 --> 00:24:46,020
mentioned earlier they are often not keyed in a way that

364
00:24:46,020 --> 00:24:48,460
are meant to keep people out of them very long. You know the

365
00:24:48,460 --> 00:24:52,980
proverbial voter excuse me hotel mini bar key is a good example

366
00:24:52,980 --> 00:24:55,960
or you can some of them are they are more like filing a

367
00:24:55,980 --> 00:24:59,840
cabinet locks but lately I've seen some vendors actually sort

368
00:24:59,840 --> 00:25:03,800
of put serious thought into keying their equipment to

369
00:25:03,800 --> 00:25:07,100
actually being difficult for someone like me who can you

370
00:25:07,100 --> 00:25:11,280
know throw a four pin lock pretty easily to get into.

371
00:25:11,720 --> 00:25:14,120
Anyway and actually putting things like sometimes you can

372
00:25:14,120 --> 00:25:16,760
actually move part of the plastic case aside without having

373
00:25:16,760 --> 00:25:20,740
to do anything with the lock. So putting a rigid borders and

374
00:25:20,740 --> 00:25:23,580
certain things have been a new thing. And then there's stuff

375
00:25:23,580 --> 00:25:25,960
like willfully substituting forged ballot tally software.

376
00:25:25,980 --> 00:25:30,400
That then ends up being used in an election. All those things can

377
00:25:30,400 --> 00:25:33,100
get you in pretty serious trouble and on the wrong end of a

378
00:25:33,100 --> 00:25:35,400
prosecutor in the state of California and many other

379
00:25:35,400 --> 00:25:38,440
states have things that are like this. Some of them are much

380
00:25:38,440 --> 00:25:40,340
vaguer which means they may have a little bit more

381
00:25:40,340 --> 00:25:43,840
discretion. Anyway and there's other there's other things this

382
00:25:43,840 --> 00:25:46,060
is just equipment right. There's other things that they could

383
00:25:46,060 --> 00:25:49,460
slap on to add to those charges if they really want to make an

384
00:25:49,460 --> 00:25:52,480
example of you should be careful and make sure you're talking to

385
00:25:52,480 --> 00:25:54,580
someone who knows about the law before you try and do any of

386
00:25:54,580 --> 00:25:55,900
this stuff. And hopefully you do it.

387
00:25:55,900 --> 00:25:59,480
In conjunction with an election official because you know we

388
00:26:00,000 --> 00:26:01,860
hackers are going to be election officials best friends

389
00:26:01,860 --> 00:26:05,640
and election officials love making their stuff better. At

390
00:26:05,640 --> 00:26:09,240
least the ones I talk to. The digital millennium digital

391
00:26:09,820 --> 00:26:11,960
millennium Copyright Act is something that Barbara

392
00:26:11,960 --> 00:26:16,300
mentioned that is is definitely a problem here in the sense that

393
00:26:16,300 --> 00:26:21,400
it it it makes it illegal and you can be criminally prosecuted

394
00:26:21,400 --> 00:26:24,940
or the the someone can bring a civil action against you. So

395
00:26:24,940 --> 00:26:25,880
the like a business.

396
00:26:25,900 --> 00:26:30,040
That makes voting machines for violating section twelve oh one

397
00:26:30,040 --> 00:26:34,060
of the DMCA and section twelve oh one basically says you cannot

398
00:26:34,060 --> 00:26:36,400
it's illegal to circumvent certain kinds of technical

399
00:26:36,400 --> 00:26:40,840
measures. So to de-scramble a scrambled work to decrypt and

400
00:26:40,840 --> 00:26:45,140
encrypted work or to otherwise avoid that's a horrible word

401
00:26:45,140 --> 00:26:48,560
bypass remove deactivate or impair a technological measure

402
00:26:48,960 --> 00:26:51,780
without authorization and there the authorization it's always

403
00:26:51,780 --> 00:26:53,880
been a little clear who it needs to be. Does it need to be

404
00:26:53,880 --> 00:26:55,880
the person who owns the system or does it need to be the person

405
00:26:55,900 --> 00:26:58,540
who owns the original manufacturer. You can imagine

406
00:26:58,540 --> 00:27:00,780
it's it's difficult to get permission from the original

407
00:27:00,780 --> 00:27:03,880
manufacturer to do some of this stuff. Although we have done it.

408
00:27:04,000 --> 00:27:07,960
This shirt as a matter of fact Ohio Ohio fixture voting system

409
00:27:07,960 --> 00:27:10,880
is from 2007 when we did the top to bottom review in the

410
00:27:10,880 --> 00:27:13,640
state of California along with a bunch of people here like Harry

411
00:27:13,640 --> 00:27:19,320
Hurst and Matt Blaze. Anyway Barbara did mention that there

412
00:27:19,320 --> 00:27:23,100
was an exemption granted from this part of the DMCA last year

413
00:27:24,080 --> 00:27:25,880
and that's actually that's that's what we're going to be

414
00:27:25,900 --> 00:27:26,800
talking about in a little bit. But it's wonderful and true and

415
00:27:26,800 --> 00:27:32,080
so the the copyright office granted exemptions from being

416
00:27:32,080 --> 00:27:36,080
able to circumvent technological measures for voting systems for

417
00:27:36,800 --> 00:27:40,720
land motorized vehicles. You can think of those as cars. And

418
00:27:40,720 --> 00:27:43,600
then something else that I forget medical devices. And so

419
00:27:44,180 --> 00:27:46,840
medical devices and vehicles they said oh we're going to give

420
00:27:46,840 --> 00:27:49,540
agencies 12 months before people can start hacking that so you

421
00:27:49,540 --> 00:27:53,120
can prepare for this onslaught of wonderful ownage you're

422
00:27:53,120 --> 00:27:55,880
going to have. But for voting machines you're going to have to

423
00:27:56,940 --> 00:27:57,920
get a license. And so they said well you can't do that. And so

424
00:27:57,920 --> 00:27:59,440
they said well you can just start hacking those now. And so

425
00:27:59,440 --> 00:28:01,500
this is something that's actually been alive for a while

426
00:28:01,500 --> 00:28:03,600
and it's one of the reasons we can do this here at DEFCON because

427
00:28:03,600 --> 00:28:07,100
we don't have to be so worried about people getting in trouble

428
00:28:07,100 --> 00:28:10,920
just because we have machines and they're getting around them.

429
00:28:11,260 --> 00:28:15,220
The trick here is that you know the circumvention there's a lot

430
00:28:15,220 --> 00:28:17,540
of words in that exemption. And the circumvention that you're

431
00:28:17,540 --> 00:28:21,680
doing to to get access to these machines has to be on a lawfully

432
00:28:21,680 --> 00:28:25,880
acquired device and it has to be where you do these things on a

433
00:28:25,900 --> 00:28:26,600
lawful basis. And so we're going to do it only for what's

434
00:28:26,600 --> 00:28:29,580
called good faith security research. And a lot of us that

435
00:28:29,580 --> 00:28:33,480
work on the policy side of security and security systems

436
00:28:33,960 --> 00:28:37,080
that word good faith makes us feel a little antsy. And the

437
00:28:37,080 --> 00:28:40,680
reason it makes us feel antsy is that one judge's idea of what

438
00:28:40,680 --> 00:28:44,540
good faith may be completely different than yours or another

439
00:28:45,220 --> 00:28:47,280
judge's for that matter. So you may actually have two different

440
00:28:47,280 --> 00:28:51,280
things going here. And here what they talk about in terms of good

441
00:28:51,280 --> 00:28:53,900
faith is actually kind of complicated and I'm actually

442
00:28:53,900 --> 00:28:55,880
going to read it. Sorry. Accessing a computer to

443
00:28:55,900 --> 00:28:59,260
program solely for the purposes of good faith testing. So they

444
00:28:59,260 --> 00:29:02,880
use the word good faith in the definition of good faith. Which

445
00:29:02,880 --> 00:29:06,000
is sort of a problem. Investigation and or

446
00:29:06,000 --> 00:29:08,640
correction of a security flaw or vulnerability where the

447
00:29:08,640 --> 00:29:11,020
information derived from the activity is used primarily to

448
00:29:11,020 --> 00:29:13,440
promote the security or safety of the classes of devices or

449
00:29:13,440 --> 00:29:16,340
machines. So if you're just doing it for fun that's not good

450
00:29:16,340 --> 00:29:22,860
faith. So you have to actually want to be sort of you know you

451
00:29:22,860 --> 00:29:25,700
actually want to try and help these systems and fix these

452
00:29:25,900 --> 00:29:28,200
systems. And so if they ask you why you're doing it tell them

453
00:29:28,200 --> 00:29:30,420
you want to help them fix the systems. But we're going to have

454
00:29:30,420 --> 00:29:33,460
to renew this exemption this year. So please contact me at

455
00:29:33,460 --> 00:29:37,000
CDT. There's a bunch of people from EFF here that are all

456
00:29:37,000 --> 00:29:40,480
working on making sure these exemptions are renewed. And call

457
00:29:40,480 --> 00:29:43,100
your congress critter and tell them that you want to see these

458
00:29:43,100 --> 00:29:45,580
things made permanent so that we always have the ability to do

459
00:29:45,580 --> 00:29:49,860
this kind of work. So and really quick and then we get to the fun

460
00:29:49,860 --> 00:29:53,500
part questions. The other big statute here that you may have

461
00:29:53,500 --> 00:29:55,880
heard of. If you haven't I'm going to talk about it. The

462
00:29:55,900 --> 00:29:58,900
computer fraud abuse act and it basically criminalizes gaining

463
00:29:58,900 --> 00:30:01,720
unauthorized access to certain kinds of computer systems and

464
00:30:01,720 --> 00:30:07,280
networks. Exactly. Boo. And one of the reasons this is such a

465
00:30:08,260 --> 00:30:10,880
I mean there's a lot of good done with this law I must say.

466
00:30:11,080 --> 00:30:14,460
You know recognizing that we want to fight crime online. Like

467
00:30:14,460 --> 00:30:17,800
people who leave their employer and take a bunch of credentials

468
00:30:17,800 --> 00:30:20,580
and hack back in and destroy the system just because they're mad.

469
00:30:20,760 --> 00:30:24,460
You know that's criminal behavior. But unauthorized access

470
00:30:24,460 --> 00:30:25,880
is not defined. And so if you're doing it for fun you're

471
00:30:25,900 --> 00:30:26,520
going to have to do it for fun. So I'm going to talk a little bit

472
00:30:26,520 --> 00:30:28,800
little bit more about the case of Weave. Not my favorite

473
00:30:28,800 --> 00:30:31,000
person in the world. He's now the system in for the Nazis.

474
00:30:31,620 --> 00:30:38,000
But anyway, Weave incremented a counter in the URL with a little

475
00:30:38,000 --> 00:30:41,340
program and that was considered enough to sort of trigger this.

476
00:30:41,420 --> 00:30:44,820
That's an older case and I think the DOJ folks if there's any in

477
00:30:44,820 --> 00:30:47,480
the room would recognize that they're trying not to do things

478
00:30:47,480 --> 00:30:50,360
like that anymore. But it has happened. It could happen again.

479
00:30:51,200 --> 00:30:53,860
The Illinois case from last year that I talked about where

480
00:30:53,860 --> 00:30:55,880
supposedly Russian intelligence did something wrong. I think

481
00:30:55,880 --> 00:31:01,200
it was the GRU or the FSB used a SQL injection to both exfiltrate

482
00:31:01,200 --> 00:31:05,320
90,000 voter records. So not all voters in the state of Illinois

483
00:31:05,320 --> 00:31:09,240
hopefully. But a good chunk of them. And then they actually

484
00:31:09,240 --> 00:31:12,500
tried to use their access to delete and alter tables in the

485
00:31:12,500 --> 00:31:15,740
database. And so it sounds like they may not have gotten a root

486
00:31:15,740 --> 00:31:18,240
shell through their SQL injection. But what they may have

487
00:31:18,240 --> 00:31:22,000
been able to do was do sort of arbitrary SQL commands on the

488
00:31:22,000 --> 00:31:25,600
data itself. And they found that they couldn't do certain things.

489
00:31:25,880 --> 00:31:27,680
And so I think it's important to remember that web process didn't

490
00:31:27,680 --> 00:31:31,500
have the privileges to drop tables luckily enough. I really

491
00:31:31,500 --> 00:31:33,920
like the Kennesaw State University story. So if you

492
00:31:33,920 --> 00:31:37,100
weren't here earlier and heard Logan Lamb talking about what he

493
00:31:37,100 --> 00:31:41,120
and Chris Grayson did, I think it's important because this is

494
00:31:41,120 --> 00:31:44,480
sort of things that you can do. You know, looking at election

495
00:31:44,480 --> 00:31:47,860
websites. Looking at what the Google cache may have grabbed

496
00:31:47,860 --> 00:31:51,560
from an election website. Writing scripts that try and see

497
00:31:51,560 --> 00:31:54,860
what the exposure, if there is exposure there is and then

498
00:31:54,860 --> 00:31:55,660
reporting it to people.

499
00:31:55,880 --> 00:31:59,200
It's all very important. And here not only did they have this

500
00:31:59,200 --> 00:32:04,120
Drupal get in a vulnerable version of the Drupal content

501
00:32:04,120 --> 00:32:08,420
management software. But they also had Wi-Fi access points

502
00:32:08,820 --> 00:32:13,700
that were attached to their internal air gap network. So an

503
00:32:13,700 --> 00:32:17,100
air gap is great until someone decides to put a Wi-Fi access

504
00:32:17,100 --> 00:32:19,700
point on your air gap network that you don't know about that's

505
00:32:19,700 --> 00:32:22,340
been there for years. And so there's a really good after

506
00:32:22,340 --> 00:32:25,860
action report by the Kennesaw State University IT people that

507
00:32:25,880 --> 00:32:29,380
basically says here's all the bad things that we found them

508
00:32:29,380 --> 00:32:32,780
doing. Here's how it's never going to happen again. And it's

509
00:32:32,780 --> 00:32:34,940
kind of a slap on the wrist. Pretty big slap on the wrist for

510
00:32:34,940 --> 00:32:39,260
Kennesaw State for the election people. But at the same time it

511
00:32:39,260 --> 00:32:42,300
shows here are all the things that you should never do with the

512
00:32:42,900 --> 00:32:45,940
quantity and quality of sensitive voter data and software.

513
00:32:46,180 --> 00:32:50,100
You know, actual software that Russians would love to grab and

514
00:32:50,100 --> 00:32:53,420
decompile and make tool chains for things that could, you know,

515
00:32:53,420 --> 00:32:55,860
successively just try things out until it's gone. So that's a

516
00:32:55,880 --> 00:32:57,940
great example of how they found the right thing to do. Anyway,

517
00:32:58,000 --> 00:33:01,380
that's all. I'd love to get your questions, Candace and I. I

518
00:33:01,380 --> 00:33:03,860
tried to think of some legal resources. There's a great

519
00:33:03,860 --> 00:33:07,160
election law list. It's mostly law, but they do entertain

520
00:33:07,160 --> 00:33:12,040
questions from novices like me. If you ever find yourself in

521
00:33:12,040 --> 00:33:15,640
trouble or getting close to being in trouble, I'd really

522
00:33:15,640 --> 00:33:18,120
recommend you talk to someone like me who has a lot of lawyer

523
00:33:18,120 --> 00:33:22,440
friends or the EFF's legal intake system is very well

524
00:33:22,440 --> 00:33:25,640
honed. It's a trouble ticketing system where they can get you

525
00:33:25,880 --> 00:33:29,720
some help, especially if you're a good defendant. So we'd really

526
00:33:29,720 --> 00:33:36,000
love to see some people that are good defendants to make some good

527
00:33:36,000 --> 00:33:38,960
precedent out here. Anyway, and I have my contact here, PGP signal

528
00:33:38,960 --> 00:33:43,420
stuff. If you don't want to talk directly, feel free to grab me

529
00:33:43,420 --> 00:33:47,340
any way like that. And we'd love to take your questions. Sir? You

530
00:33:47,340 --> 00:33:50,600
want to shout? Just shout. Yeah, I can shout. I'll repeat them. So

531
00:33:50,600 --> 00:33:55,440
a lot of states have, I mean, virtually all states have an

532
00:33:55,880 --> 00:33:58,680
amendment law to the CFAA. And some are actually kind of broad,

533
00:33:58,720 --> 00:34:03,380
like Massachusetts computer fraud law is really broad. Are you

534
00:34:03,380 --> 00:34:06,620
guys working with any state legislatures? I know they are,

535
00:34:06,700 --> 00:34:09,540
but every year there's some amendments. Are you working with

536
00:34:09,540 --> 00:34:12,420
any state legislatures? I'll just say, it's so hard to do

537
00:34:12,420 --> 00:34:14,680
state legislative work like we're doing it with the broadband

538
00:34:14,680 --> 00:34:17,400
privacy stuff now. And that's really sort of like putting out

539
00:34:17,400 --> 00:34:19,720
fires left and right that we haven't really spent a lot of

540
00:34:19,720 --> 00:34:22,920
time thinking about computer fraud at the state level. But

541
00:34:22,920 --> 00:34:25,800
yeah, you definitely let me know about ones that are

542
00:34:25,880 --> 00:34:28,480
either being used in ways that are overbroad or ways that you

543
00:34:28,480 --> 00:34:31,740
think there might be people who want to narrow them down a little

544
00:34:31,740 --> 00:34:35,140
bit. And it's not like we don't want to make sure the cops can't

545
00:34:36,640 --> 00:34:40,440
actually fight crime. It's just that these tend to be used in the

546
00:34:40,440 --> 00:34:44,040
ways where people who just don't understand the technology want to

547
00:34:44,040 --> 00:34:46,620
make an example of people like our dear friend Aaron Swartz,

548
00:34:46,760 --> 00:34:54,880
which is very unfortunate. That's fine. Other questions? Yes. So

549
00:34:55,880 --> 00:34:58,800
EFF has the Electronic Frontiers Alliance, which is a campus

550
00:34:58,800 --> 00:35:02,840
network organization. And info at EFF.org will get you through to

551
00:35:02,840 --> 00:35:06,720
them. It's one way that we can do state level work is through

552
00:35:06,720 --> 00:35:09,400
those campus organizations. There's full-time organizers at

553
00:35:09,400 --> 00:35:11,960
EFF to assist campus organizations to work on that.

554
00:35:12,120 --> 00:35:13,920
I didn't know that. That's awesome. I didn't either.

555
00:35:14,020 --> 00:35:18,380
Excellent to know. Thank you. Other questions? Comments?

556
00:35:18,440 --> 00:35:22,540
Yellow. Yes. I'm from California. I'm also, like you,

557
00:35:22,580 --> 00:35:25,860
a weird person. I have a great political science background. I'm

558
00:35:26,900 --> 00:35:32,300
actually worked in the election industry for about 20 years. On

559
00:35:32,300 --> 00:35:35,940
one year, I decided to volunteer to help run the voter person. So

560
00:35:35,940 --> 00:35:39,340
I was actually in charge of the voter person. Now, the way that

561
00:35:39,340 --> 00:35:42,260
this comes to my question, the thing I found to be interesting

562
00:35:42,260 --> 00:35:46,600
is they were all volunteers. I was special because I had had a

563
00:35:46,600 --> 00:35:49,520
great political science and working with new, now, their

564
00:35:50,500 --> 00:35:53,840
education on, like, for example, someone walked in with a Clinton

565
00:35:53,840 --> 00:35:55,860
badge. And you can't have a Clinton badge. You can't have a

566
00:35:55,880 --> 00:35:58,680
electionarian. It doesn't matter to me. And I told the person to

567
00:35:58,680 --> 00:36:00,640
take it off. And all the other workers were like, what are you

568
00:36:00,640 --> 00:36:03,440
talking about? Like, this is, like, one of the simplest laws.

569
00:36:03,860 --> 00:36:08,400
Now, my question is, how do you address the fact that the people

570
00:36:08,400 --> 00:36:12,020
who are in the trenches watching the voting movement are

571
00:36:12,020 --> 00:36:17,540
volunteers with really imperfect education? It's an ongoing

572
00:36:17,540 --> 00:36:22,120
problem. And you fingered it quite nicely. There are many

573
00:36:22,120 --> 00:36:25,540
worse abuses, as you know. There are, there are, so.

574
00:36:25,880 --> 00:36:29,900
But these are, they're largely volunteers. They're paid a per

575
00:36:29,900 --> 00:36:35,940
diem, which is trivial. They tend to be retirees. And they tend to

576
00:36:35,940 --> 00:36:42,180
operate on the basis of sort of custom rather than law. And many

577
00:36:42,180 --> 00:36:46,300
states don't even require them to go to a training session that is

578
00:36:46,300 --> 00:36:51,580
meaningful. When I was the public monitor of Cuyahoga County,

579
00:36:51,780 --> 00:36:55,780
Ohio's election reform, and I had been on the election review

580
00:36:55,880 --> 00:37:00,440
panel, one of the things we recommended was not only to beef

581
00:37:00,440 --> 00:37:05,660
up poll worker training, but also to have a test afterwards. And we

582
00:37:05,660 --> 00:37:09,960
were probably the first in the nation to do so. And it's still

583
00:37:09,960 --> 00:37:14,400
ongoing that way. And it did boost the morale, as well, because

584
00:37:14,400 --> 00:37:19,460
you can imagine how demoralizing it is for those who have, who know

585
00:37:19,460 --> 00:37:25,780
how the law operates to protect voters. And then others who are in

586
00:37:25,780 --> 00:37:29,060
the poll worker positions, and maybe even running the polling

587
00:37:29,780 --> 00:37:34,580
location, aren't implementing the law and are very cavalier about it.

588
00:37:34,840 --> 00:37:40,560
So it does provide some fodder for a new standard. And I incur,

589
00:37:40,740 --> 00:37:45,300
again, every, I think Joshua, where's Joshua? Is he still here?

590
00:37:45,420 --> 00:37:49,580
Joshua recommended that you sign up to be poll workers. We need more

591
00:37:49,580 --> 00:37:54,340
technically proficient people as poll workers. And many counties will

592
00:37:54,340 --> 00:37:55,320
have you actually.

593
00:37:55,340 --> 00:37:55,760
.

594
00:37:55,780 --> 00:37:57,640
So you know, we need to be the ones to set up the technology,

595
00:37:57,920 --> 00:38:03,060
sometimes to be the rover to help fix it, troubleshoot, to monitor

596
00:38:03,060 --> 00:38:07,800
the security operations in the precinct or several precincts, we

597
00:38:07,800 --> 00:38:11,480
need people with security backgrounds there. Right, Joshua?

598
00:38:11,740 --> 00:38:17,540
And also you can then contribute by helping often with poll worker

599
00:38:17,540 --> 00:38:21,060
training on some of the security issues, because these manuals are

600
00:38:21,060 --> 00:38:24,220
developed sometimes at the local level with not very much

601
00:38:24,220 --> 00:38:29,060
understanding of some of these points so so again there are many ways that you

602
00:38:29,060 --> 00:38:33,920
can be helpful yeah a couple other things at least during the general

603
00:38:33,920 --> 00:38:37,320
elections there's this massive nonpartisan effort called the election

604
00:38:37,320 --> 00:38:41,080
protection coalition and they often need people with different kinds of

605
00:38:41,080 --> 00:38:44,160
substantive knowledge either be a political science be a you know

606
00:38:44,160 --> 00:38:49,460
cybersecurity be whatever to basically be subject matter experts for when you

607
00:38:49,460 --> 00:38:54,500
get crazy calls from from Podunk Arkansas or something saying hey should

608
00:38:54,500 --> 00:38:58,900
we restart this machine that's actually a pretty hard question usually you know

609
00:38:58,900 --> 00:39:02,060
if you've done you know your family IT stuff that's the first thing you tell

610
00:39:02,060 --> 00:39:06,220
people to do but some of these machines can lose voter data if you turn them off

611
00:39:06,220 --> 00:39:09,900
and so there are you know we have what are called rap sheets for voting

612
00:39:09,900 --> 00:39:14,120
machines that basically tell you things about whether or not this machine can be

613
00:39:14,120 --> 00:39:18,280
treated like that and then the other thing I'll say is I have a mixed methods

614
00:39:18,280 --> 00:39:19,440
research background when I'm working with people who are working in the

615
00:39:19,440 --> 00:39:22,560
field and I was in academia before I used to think I could be a professor but

616
00:39:24,100 --> 00:39:29,940
anyway that that's long been dashed on the rocks but uh but one study we did

617
00:39:29,940 --> 00:39:34,280
that I can point you to was a qualitative study of poll workers in

618
00:39:34,280 --> 00:39:39,100
Marin I don't think I'm allowed to say well I just did sorry a county in

619
00:39:39,100 --> 00:39:42,940
California we did a qualitative study of their mental models of privacy and

620
00:39:42,940 --> 00:39:46,540
security so what did they think was particularly sensitive you know how did

621
00:39:46,540 --> 00:39:48,720
they approach it and we recommended a bunch of things

622
00:39:48,720 --> 00:39:49,300
um

623
00:39:49,440 --> 00:39:54,060
unfortunately there were a lot of of juicy but unfortunate tales for example

624
00:39:54,060 --> 00:39:59,320
there was one uh uh judge the one the person who runs the the polling place who

625
00:39:59,700 --> 00:40:04,600
there were so many jams with this optical scan machine that he kept the door to the

626
00:40:04,600 --> 00:40:09,760
the ballot uh uh box open all day long and the reason he did that because it was a pain

627
00:40:09,760 --> 00:40:14,780
in the butt for him with his arthritic fingers to turn the key because about 10 or 12

628
00:40:14,780 --> 00:40:18,960
times a day you had to clear a jam in the thing so he would just keep it open uh and I

629
00:40:19,440 --> 00:40:24,720
asked him as an observer I was like well what do you think that tamper tape you broke was for and he had to sit there and think

630
00:40:24,720 --> 00:40:29,880
about it and later he's like oh you know what I probably shouldn't have busted that until the end of the polls

631
00:40:29,880 --> 00:40:34,960
or at least without putting another one over it and he shut it and sealed it off and that's a more

632
00:40:34,960 --> 00:40:39,960
participant observation and so if you can keep your eyes open and you see something glaring like

633
00:40:39,960 --> 00:40:45,680
that happen even just you know asking an intuitive maybe yogic kind of question like hey why is

634
00:40:45,680 --> 00:40:49,420
that door open that looks pretty important you know that can often cause people to you know to be a bit more

635
00:40:49,420 --> 00:40:52,300
to think harder about it and maybe not change immediately.

636
00:40:52,560 --> 00:40:55,420
And if you have partisan poll watchers in the room,

637
00:40:55,500 --> 00:40:57,540
they may go file legal pleadings

638
00:40:57,540 --> 00:40:59,040
and actually force this to happen quicker.

639
00:40:59,640 --> 00:41:01,120
But yeah, I'll shut up.

640
00:41:01,160 --> 00:41:01,980
Any more questions?

641
00:41:02,480 --> 00:41:02,540
Yes.

642
00:41:02,700 --> 00:41:03,500
I have a question.

643
00:41:04,400 --> 00:41:05,300
In your,

644
00:41:05,900 --> 00:41:07,460
you've only really disclosed it really hard.

645
00:41:07,640 --> 00:41:08,080
Oh, yeah.

646
00:41:08,420 --> 00:41:10,980
Do you feel like Logan should have done something different

647
00:41:10,980 --> 00:41:11,980
and it would be more effective?

648
00:41:13,480 --> 00:41:16,200
So the best disclosures I've seen lately

649
00:41:16,200 --> 00:41:18,480
have been directly to CERT or the FBI.

650
00:41:18,480 --> 00:41:22,060
And, you know, if they,

651
00:41:22,720 --> 00:41:25,000
the hard part is you can't do everything through them

652
00:41:25,000 --> 00:41:26,200
because if we did everything through them,

653
00:41:26,280 --> 00:41:27,260
they would fall apart.

654
00:41:27,380 --> 00:41:28,100
We don't want them to fall apart.

655
00:41:28,280 --> 00:41:31,240
The other thing is we wouldn't have public knowledge.

656
00:41:31,280 --> 00:41:33,120
And part of the problem that we've had

657
00:41:33,120 --> 00:41:35,520
in the financial systems as well,

658
00:41:35,600 --> 00:41:38,200
until we started having breach disclosure laws,

659
00:41:38,480 --> 00:41:40,840
then the industry was able to say,

660
00:41:40,900 --> 00:41:41,880
we have no breaches.

661
00:41:42,140 --> 00:41:44,360
Your money is absolutely secure.

662
00:41:44,660 --> 00:41:48,060
And we will not obtain better technologies,

663
00:41:48,060 --> 00:41:50,880
more support for security in elections

664
00:41:50,880 --> 00:41:52,380
unless we know the vulnerabilities

665
00:41:52,380 --> 00:41:54,420
and the security exploits.

666
00:41:54,480 --> 00:41:57,740
So I'm a great fan of breach disclosure.

667
00:41:58,200 --> 00:42:00,440
Yeah, I do think that the one thing I would say

668
00:42:00,440 --> 00:42:02,580
is that it's a really interesting case study

669
00:42:02,580 --> 00:42:06,220
because if you look at what it took to get someone to care,

670
00:42:06,460 --> 00:42:08,860
it was notifying Kennesaw State's

671
00:42:08,860 --> 00:42:11,740
badass university information technology people

672
00:42:11,740 --> 00:42:15,320
who, like, they have, I don't know what it is.

673
00:42:15,800 --> 00:42:17,700
I should show you this after action report

674
00:42:17,700 --> 00:42:21,120
because they walk through with signal analyzers and stuff

675
00:42:21,120 --> 00:42:22,840
to see what's emanating what from where

676
00:42:22,840 --> 00:42:23,440
and all this kind of stuff.

677
00:42:23,720 --> 00:42:26,800
But that's kind of the case-by-case nature

678
00:42:26,800 --> 00:42:28,240
of some of this stuff is you have to find

679
00:42:28,240 --> 00:42:30,040
the one person who can, you know,

680
00:42:30,040 --> 00:42:31,840
care enough to make the change.

681
00:42:31,980 --> 00:42:33,140
And there it was someone who basically like,

682
00:42:33,200 --> 00:42:35,540
look, this is a rogue IT shop on our campus

683
00:42:35,540 --> 00:42:36,500
that's making us look bad.

684
00:42:36,640 --> 00:42:38,540
And that's what made it happen there.

685
00:42:38,660 --> 00:42:42,040
But the FBI or CERT are often a really good way to do that.

686
00:42:42,080 --> 00:42:44,020
Like, if you look at the stuff that Chris Vickery

687
00:42:44,020 --> 00:42:47,280
has done recently with abandoned S3 buckets,

688
00:42:47,700 --> 00:42:49,460
he often instantly just notifies the FBI

689
00:42:49,460 --> 00:42:50,340
and lets them take care of it

690
00:42:50,340 --> 00:42:52,480
because if the FBI comes to you and says,

691
00:42:52,540 --> 00:42:53,700
hey, you have a problem, you're going to,

692
00:42:53,700 --> 00:42:56,820
unless you're the DNC, pay attention most of the time.

693
00:42:57,000 --> 00:42:58,220
And I think they will in the future.

694
00:42:58,380 --> 00:42:59,720
We have one here and one here.

695
00:43:00,180 --> 00:43:03,500
So with regard to Trump's proposal

696
00:43:03,500 --> 00:43:06,580
about having all of the state elections

697
00:43:06,580 --> 00:43:09,920
centralized at a central location by the federal government

698
00:43:10,780 --> 00:43:13,180
without discussing, like, political ramifications

699
00:43:13,180 --> 00:43:14,440
or anything like that,

700
00:43:14,580 --> 00:43:17,180
what are the security risks for,

701
00:43:17,700 --> 00:43:19,180
do we need that kind of system

702
00:43:19,180 --> 00:43:20,480
to have a central line?

703
00:43:20,880 --> 00:43:22,840
That would take a long discussion,

704
00:43:23,080 --> 00:43:24,620
but we can say quickly,

705
00:43:24,940 --> 00:43:26,320
and I'll pass the mic to Joe,

706
00:43:26,460 --> 00:43:31,100
it would raise the security concerns substantially.

707
00:43:32,840 --> 00:43:34,520
And I'll pass to you.

708
00:43:34,720 --> 00:43:37,700
We really try not to put all the jewels in one place, right?

709
00:43:37,780 --> 00:43:40,000
And with this, with the voter data

710
00:43:40,000 --> 00:43:41,780
that the Kobach Commission had requested,

711
00:43:43,040 --> 00:43:45,600
not only is it putting a substantial amount

712
00:43:45,600 --> 00:43:47,240
of sensitive data in one place,

713
00:43:47,300 --> 00:43:47,680
and we have a lot of data in one place,

714
00:43:47,680 --> 00:43:49,520
and I'm happy to argue with any of you afterwards

715
00:43:49,520 --> 00:43:51,580
about whether or not voter files are sensitive data.

716
00:43:51,680 --> 00:43:52,180
I think they are.

717
00:43:53,440 --> 00:43:54,420
So there's that part.

718
00:43:54,540 --> 00:43:55,600
But there's also, in the letter,

719
00:43:55,680 --> 00:43:58,860
it was like, hey, email these records to us.

720
00:43:59,920 --> 00:44:01,500
And if, I mean,

721
00:44:03,160 --> 00:44:04,540
email is the worst,

722
00:44:04,560 --> 00:44:06,180
and I wish email would just die,

723
00:44:06,300 --> 00:44:08,060
but it's also one of the hardest things to secure.

724
00:44:08,420 --> 00:44:10,800
You know, there's very few ways to do it,

725
00:44:10,820 --> 00:44:12,400
and most of them are really hard to do correctly.

726
00:44:12,700 --> 00:44:13,760
And the other one was, hey,

727
00:44:13,780 --> 00:44:17,660
you could use this DOD upload site,

728
00:44:17,680 --> 00:44:19,960
that if you use in any browser,

729
00:44:20,220 --> 00:44:22,540
because the DOD uses a certificate

730
00:44:22,540 --> 00:44:25,760
that is not part of any of the browser's roots of trust,

731
00:44:26,000 --> 00:44:28,040
you would see this big red screen that said,

732
00:44:28,180 --> 00:44:29,800
hey, someone's trying to attack you.

733
00:44:29,980 --> 00:44:31,140
And then the only way to get around it

734
00:44:31,140 --> 00:44:32,460
was to click through this and say,

735
00:44:32,600 --> 00:44:34,260
oh, no, no, I was expecting that,

736
00:44:34,320 --> 00:44:36,920
which is just, there was a lot of bad security,

737
00:44:37,380 --> 00:44:41,300
what we would call bad design patterns

738
00:44:41,300 --> 00:44:43,820
and security there that were sort of working

739
00:44:43,820 --> 00:44:46,540
against anything there being particularly secure.

740
00:44:46,900 --> 00:44:47,440
And so,

741
00:44:47,680 --> 00:44:50,160
we don't want all our jewels in one place,

742
00:44:50,180 --> 00:44:52,520
and we also want the process of getting jewels

743
00:44:52,520 --> 00:44:54,980
to certain places to be highly secured.

744
00:44:55,220 --> 00:44:57,040
And so there's other groups like ERIC,

745
00:44:57,200 --> 00:44:59,000
the Electronic Registration Information Center,

746
00:44:59,120 --> 00:45:03,800
that does things with multi-state voter registration data

747
00:45:03,800 --> 00:45:07,820
in very careful ways using some more advanced cryptography,

748
00:45:07,980 --> 00:45:09,740
and so you're not actually transmitting anything

749
00:45:09,740 --> 00:45:10,560
that could be useful,

750
00:45:10,740 --> 00:45:12,400
but it's useful for matching and saying,

751
00:45:12,480 --> 00:45:14,240
hey, someone moved from this state to this state,

752
00:45:14,300 --> 00:45:16,080
you might want to send a postcard to their old address.

753
00:45:17,680 --> 00:45:20,380
And we would need more transparency and accountability

754
00:45:20,380 --> 00:45:23,460
for where that sensitive data is.

755
00:45:23,620 --> 00:45:24,020
Next.

756
00:45:24,300 --> 00:45:27,180
Speaking of insecure methods of transferring information,

757
00:45:28,080 --> 00:45:30,920
I serve as the Deputy CTO for one of the political parties

758
00:45:30,920 --> 00:45:31,400
in this election.

759
00:45:31,640 --> 00:45:32,780
I'm sorry, the Deputy?

760
00:45:33,020 --> 00:45:33,540
CTO.

761
00:45:33,720 --> 00:45:34,480
CTO, okay.

762
00:45:34,720 --> 00:45:36,880
One of the projects that we worked on

763
00:45:36,880 --> 00:45:40,040
in the aftermath of the November election

764
00:45:40,040 --> 00:45:42,600
was a commercial recount we were carrying out,

765
00:45:43,140 --> 00:45:45,360
and the technology that we built

766
00:45:45,360 --> 00:45:47,660
for facilitating legalized messaging,

767
00:45:47,680 --> 00:45:53,460
and running that recount was built quickly

768
00:45:53,460 --> 00:45:54,800
and didn't wind up being deployed.

769
00:45:55,180 --> 00:45:57,200
I'm curious as to what your thoughts are

770
00:45:57,200 --> 00:45:59,700
on state laws regarding recount elections

771
00:45:59,700 --> 00:46:01,340
and the procedure we're doing.

772
00:46:02,120 --> 00:46:03,960
I'll answer, and then I'll pass to Joe.

773
00:46:04,640 --> 00:46:06,700
I was born in North Carolina.

774
00:46:06,900 --> 00:46:08,100
I'm aware of the laws.

775
00:46:08,420 --> 00:46:10,760
Part of the history in North Carolina was,

776
00:46:10,960 --> 00:46:13,200
as you may recall, a prior election,

777
00:46:13,300 --> 00:46:16,580
I think in maybe 2006 or 2008,

778
00:46:16,880 --> 00:46:17,520
where there was,

779
00:46:17,680 --> 00:46:20,600
an election for Superintendent of Public Instruction

780
00:46:20,600 --> 00:46:22,160
or something that continued

781
00:46:22,160 --> 00:46:25,440
as far as recount processes for a month or two.

782
00:46:25,700 --> 00:46:27,840
So it was into January, maybe later.

783
00:46:28,340 --> 00:46:31,380
So the fear, again, as I was suggesting,

784
00:46:31,500 --> 00:46:33,160
is that we will not have repose,

785
00:46:33,160 --> 00:46:34,020
that it will keep going,

786
00:46:34,260 --> 00:46:37,280
and that people will never trust the result

787
00:46:37,280 --> 00:46:39,860
because it's taken us so long to get there.

788
00:46:40,160 --> 00:46:43,240
And another concern, frankly,

789
00:46:43,500 --> 00:46:47,020
is that if we continue to take a lot of time

790
00:46:47,020 --> 00:46:47,660
for recounting,

791
00:46:47,660 --> 00:46:48,240
recount process,

792
00:46:48,540 --> 00:46:50,860
the evidence may also change.

793
00:46:51,060 --> 00:46:53,780
Some of the votes may be tampered with.

794
00:46:53,960 --> 00:46:56,220
Some of the evidence, basically.

795
00:46:56,520 --> 00:46:59,280
And so there are a number of worries about it.

796
00:46:59,360 --> 00:47:01,540
My personal belief is that,

797
00:47:01,700 --> 00:47:04,220
and having studied these laws,

798
00:47:04,460 --> 00:47:08,520
is that A, the recount laws are highly antiquated.

799
00:47:08,580 --> 00:47:11,900
They were not structured for electronic voting

800
00:47:11,900 --> 00:47:13,560
and the needs that we have

801
00:47:13,560 --> 00:47:15,900
for protecting elections and assuring.

802
00:47:16,100 --> 00:47:17,260
And keep in mind,

803
00:47:17,260 --> 00:47:18,940
we do have a federal right,

804
00:47:19,160 --> 00:47:22,820
which is reiterated in many state constitutions as well,

805
00:47:22,960 --> 00:47:26,240
but a right to have our votes counted

806
00:47:26,240 --> 00:47:29,580
and recorded and counted accurately.

807
00:47:31,160 --> 00:47:32,120
Constitutional right.

808
00:47:32,620 --> 00:47:36,160
It has not been really vindicated through litigation

809
00:47:36,160 --> 00:47:38,100
the way it's gonna have to be,

810
00:47:38,340 --> 00:47:41,620
but we should have states conforming

811
00:47:41,620 --> 00:47:43,020
or updating their laws

812
00:47:43,020 --> 00:47:46,360
to facilitate the forensics analyses

813
00:47:46,360 --> 00:47:47,240
or some of the...

814
00:47:47,260 --> 00:47:52,180
other techniques that you're suggesting to support effective

815
00:47:52,180 --> 00:47:56,580
recounts. But we haven't even done the thinking about that.

816
00:47:56,840 --> 00:48:01,440
Instead, there's this push for throwing the cloak over it, get

817
00:48:01,440 --> 00:48:07,180
it over with, move on, let's not look too closely. I guess I'll

818
00:48:07,180 --> 00:48:10,860
talk to you offline because I'm already running in my head

819
00:48:10,860 --> 00:48:13,760
through like playbooks and configuration templates for

820
00:48:13,760 --> 00:48:16,880
standing up recount support structure, infrastructure, but I

821
00:48:17,520 --> 00:48:20,400
don't want to talk about that out loud. Maybe the last

822
00:48:20,400 --> 00:48:23,700
question? Just one more question. Do you have a question,

823
00:48:23,740 --> 00:48:24,880
sir? Oh, Larry.

824
00:48:49,880 --> 00:48:54,060
Yeah. And so Larry asked a question about a lot of the

825
00:48:54,060 --> 00:48:57,200
technology now is using ballot images and presenting ballot

826
00:48:57,200 --> 00:49:01,380
images as part of audits to election officials and to voters

827
00:49:01,380 --> 00:49:05,800
to show certain kinds of ballots that may be marginal or they have

828
00:49:05,800 --> 00:49:10,000
to adjudicate in order to be able to tell if it goes one way

829
00:49:10,000 --> 00:49:13,640
or another. And what's the law with being able to show ballots,

830
00:49:13,760 --> 00:49:17,720
to people? I don't have a real crisp answer for you other than it

831
00:49:17,720 --> 00:49:20,980
is sort of unsettled. Right now, you know, one of the main places

832
00:49:20,980 --> 00:49:27,380
this is happening is with the ACLU with law, with an ACLU has a

833
00:49:27,380 --> 00:49:30,460
number of ongoing sort of campaigns about ballot selfies.

834
00:49:30,900 --> 00:49:34,020
So can you take a picture of your face next to your ballot?

835
00:49:34,180 --> 00:49:37,920
They claim that's political free speech. I just disagree with

836
00:49:37,920 --> 00:49:42,160
that. I love my ACLU friends, but I think that there's a lot of

837
00:49:42,160 --> 00:49:43,740
value in having people do that. And I think it's important to

838
00:49:43,760 --> 00:49:46,160
be able to show people not being able to display how they voted to

839
00:49:46,160 --> 00:49:49,600
people on purpose. It may be a little better when it's not

840
00:49:49,600 --> 00:49:52,140
directly associated with the voter's identity, like in the

841
00:49:52,140 --> 00:49:54,520
case of in a recount. And I think it would be just totally

842
00:49:54,520 --> 00:49:56,920
different. I think we're going over, but thank you.

843
00:49:56,920 --> 00:49:57,380
Thank you so much.