1
00:00:00,000 --> 00:00:00,800
Thank you, everybody.

2
00:00:01,040 --> 00:00:06,000
So our next speakers are from NIST, which is the National Institute of Standards and Technology.

3
00:00:07,500 --> 00:00:14,380
These are the folks who help set national standards for a whole host of things, in this case elections.

4
00:00:14,860 --> 00:00:22,360
And so we've got both Mary Brady, who's the voting program manager and works on voting-specific standards and things like that,

5
00:00:22,440 --> 00:00:29,760
and Josh Franklin, who is a security engineer at NIST and works on security-related things.

6
00:00:30,000 --> 00:00:30,560
Including voting.

7
00:00:30,860 --> 00:00:32,480
And with that, I'll turn it over to you guys.

8
00:00:34,100 --> 00:00:34,500
Okay.

9
00:00:40,260 --> 00:00:41,240
Thank you, everybody.

10
00:00:41,400 --> 00:00:45,720
I'm also – I like to roam, so I can't actually speak in front of a podium.

11
00:00:45,940 --> 00:00:52,920
But I just want to say thanks to the organizing committee for inviting us to give this presentation.

12
00:00:53,260 --> 00:00:57,640
I'm really not going to say much other than I'm really excited to be here.

13
00:00:57,740 --> 00:00:59,260
I'm looking for meaningful ways to engage.

14
00:00:59,260 --> 00:01:01,100
I'm really excited to be able to engage with the cybersecurity experts here.

15
00:01:01,440 --> 00:01:06,700
Josh will talk a little bit about some public working groups that we've established at NIST, one of them on cybersecurity.

16
00:01:07,240 --> 00:01:09,340
Some of you I know are already members of that group.

17
00:01:09,420 --> 00:01:11,300
We sure could use a lot more help.

18
00:01:12,360 --> 00:01:18,640
I'd be interested in some of your thoughts about meaningful ways in which we can engage with the community.

19
00:01:18,820 --> 00:01:26,780
And we're here to tell you a little bit about the work that we're doing, get some feedback from you, and look for ways to learn from the community.

20
00:01:26,780 --> 00:01:29,820
With that, let me hand it all over to Josh.

21
00:01:30,200 --> 00:01:31,180
Are you roaming?

22
00:01:31,320 --> 00:01:32,400
I guess I'll roam.

23
00:01:32,540 --> 00:01:34,420
Born to roam.

24
00:01:34,680 --> 00:01:35,460
Howdy, everyone.

25
00:01:35,600 --> 00:01:37,140
My name is Joshua Franklin.

26
00:01:38,380 --> 00:01:40,220
Welcome to Hacker Summer Camp.

27
00:01:41,220 --> 00:01:42,980
It's been fun so far.

28
00:01:44,140 --> 00:01:53,520
Today I'm going to talk a little bit about my experiences in the election community for the past 10, 12 years.

29
00:01:55,640 --> 00:01:56,760
A lot of people have been asking me about my experience in the election community.

30
00:01:56,780 --> 00:02:01,580
A little bit about how we got here, where we are going.

31
00:02:03,000 --> 00:02:05,480
First off, I'm going to start with this slide.

32
00:02:05,740 --> 00:02:10,680
There was a man named Dr. Joseph Harris back in 1934.

33
00:02:11,260 --> 00:02:15,840
And he was basically looking at how elections are run in the U.S. back then.

34
00:02:16,100 --> 00:02:22,860
And he actually found these various election fraud types, as he called them.

35
00:02:23,160 --> 00:02:25,520
And it's really interesting looking at this list.

36
00:02:25,520 --> 00:02:28,940
Because we're still really, really worried about many of these issues today.

37
00:02:30,260 --> 00:02:38,180
We have, since 1934, learned a little bit about how computers work.

38
00:02:38,400 --> 00:02:40,540
And we've introduced e-voting.

39
00:02:41,300 --> 00:02:53,240
And what we've really seen is that now we have these same issues, but also modern electronic analogs to some of these same things.

40
00:02:53,420 --> 00:02:55,500
And so keep these in the back of your mind.

41
00:02:55,520 --> 00:02:56,820
As we go through some of this.

42
00:02:57,880 --> 00:02:59,300
So, who am I?

43
00:02:59,440 --> 00:03:04,180
Josh Franklin, IT security engineer at NIST.

44
00:03:04,360 --> 00:03:10,240
I typically do enterprise mobility, LTE security.

45
00:03:11,000 --> 00:03:12,520
I also do electronic voting.

46
00:03:13,220 --> 00:03:19,020
I've been in this area since probably 2004, working in voting off and on.

47
00:03:22,520 --> 00:03:25,500
I currently co-chair the NIST election committee.

48
00:03:25,500 --> 00:03:31,700
The NIST EAC election cybersecurity working group.

49
00:03:32,400 --> 00:03:37,800
Prior to NIST, I was working at the U.S. election assistance commission.

50
00:03:38,200 --> 00:03:40,700
Helping to test and certify voting systems.

51
00:03:41,040 --> 00:03:47,700
I got to travel the U.S. and really understand what the elections landscape looks like there.

52
00:03:49,340 --> 00:03:54,800
Previous to that, I was working at KSU's center for election systems.

53
00:03:54,800 --> 00:03:57,120
In Georgia.

54
00:03:58,280 --> 00:03:59,540
Learned a lot of things there.

55
00:03:59,660 --> 00:04:05,500
Helped install and maintain probably 22,000 voting systems there.

56
00:04:06,040 --> 00:04:10,980
I have been a poll worker in more states than anyone, I think, has.

57
00:04:11,460 --> 00:04:14,740
And I will keep saying that until someone proves me otherwise.

58
00:04:15,900 --> 00:04:16,560
So, yeah.

59
00:04:16,680 --> 00:04:19,060
And I have a master's in infosec from Mason.

60
00:04:20,900 --> 00:04:22,600
So, you know, get to know it.

61
00:04:22,600 --> 00:04:25,440
Get to know an agency.

62
00:04:25,800 --> 00:04:29,000
What big federal agencies are out there?

63
00:04:29,660 --> 00:04:36,020
Believe it or not, the federal election commission has little to no role to play here.

64
00:04:36,520 --> 00:04:43,200
They are primarily focused on campaign finance law.

65
00:04:44,120 --> 00:04:49,120
The election assistance commission is what you really want to be looking at here.

66
00:04:49,280 --> 00:04:51,610
They are charged with providing.

67
00:04:51,610 --> 00:04:55,450
Providing assistance to local election officials.

68
00:04:56,490 --> 00:05:00,170
Adopting the voluntary voting system guidelines.

69
00:05:00,670 --> 00:05:07,490
And running a testing and certification program for U.S. voting machines.

70
00:05:08,170 --> 00:05:10,230
NIST is in this space.

71
00:05:10,470 --> 00:05:16,070
We provide the scientific and engineering backing for the voluntary voting system guidelines.

72
00:05:16,510 --> 00:05:20,050
DHS is a brand new entrant into this area.

73
00:05:20,050 --> 00:05:27,030
They are basically helping local and state election officials with cyber related issues.

74
00:05:27,350 --> 00:05:30,270
And then, of course, the good old FBI.

75
00:05:30,430 --> 00:05:34,690
They essentially prosecute domestic election crimes.

76
00:05:35,130 --> 00:05:40,790
At the state level, you have the secretary of state's office.

77
00:05:40,850 --> 00:05:46,210
They are primarily the lead election officer.

78
00:05:46,390 --> 00:05:49,710
First and foremost, deciding how elections are run.

79
00:05:49,710 --> 00:05:51,790
In their given state or territory.

80
00:05:53,010 --> 00:05:57,390
They are typically third in line in session in a state.

81
00:05:57,570 --> 00:06:00,730
So it's a fairly powerful elected position.

82
00:06:01,330 --> 00:06:08,970
And then at the local level, this is where basically elections are actually run.

83
00:06:09,230 --> 00:06:13,210
You have counties, cities, townships, parishes, hamlets.

84
00:06:13,390 --> 00:06:18,110
All these different really small geographical entities.

85
00:06:18,110 --> 00:06:22,710
That really, you know, actually know how elections operate.

86
00:06:22,930 --> 00:06:24,310
Because they actually do them.

87
00:06:25,710 --> 00:06:27,850
So it's a little bit blurry.

88
00:06:28,150 --> 00:06:29,870
That wasn't just my pencil.

89
00:06:30,970 --> 00:06:38,270
On the right side, we actually have, you know, the voting machines that we all know and love.

90
00:06:39,950 --> 00:06:42,110
DREs, op scans, ballot marking devices.

91
00:06:43,150 --> 00:06:46,830
These are the voting systems that are actually in the voting hacking village.

92
00:06:46,970 --> 00:06:48,090
I was planning on putting them in.

93
00:06:48,110 --> 00:06:49,010
I'm pointing at them right now.

94
00:06:49,110 --> 00:06:49,590
But they're not here.

95
00:06:50,590 --> 00:06:55,270
So we have in the top right, we have DREs.

96
00:06:55,290 --> 00:07:00,410
These are, you know, basically voting systems that store ballot selections electronically.

97
00:07:01,030 --> 00:07:09,430
We have optical scan systems which, you know, read paper, you know, paper ballot selections.

98
00:07:09,770 --> 00:07:11,150
Typically Scantron machines.

99
00:07:11,350 --> 00:07:17,830
But, you know, modern ones are actually using computer vision algorithms to, you know, figure out what's at, you know, what's a vote.

100
00:07:18,110 --> 00:07:20,790
And then we have ballot marking devices.

101
00:07:21,230 --> 00:07:25,610
These are a nice hybrid between the two systems.

102
00:07:25,790 --> 00:07:26,990
They actually have a touch screen interface.

103
00:07:27,230 --> 00:07:29,890
Extremely usable.

104
00:07:30,250 --> 00:07:36,310
But they also have nice security properties of, you know, actually printing out a paper ballot.

105
00:07:36,650 --> 00:07:43,550
On the left side are basically all these other supporting election systems.

106
00:07:43,690 --> 00:07:47,150
These are things that there are not really best practices.

107
00:07:48,110 --> 00:07:50,390
And guidelines and standards about.

108
00:07:50,710 --> 00:07:54,970
But they're, you know, they're very, very instrumental in the election process.

109
00:07:55,270 --> 00:07:58,750
You have, you know, local and online voter registration systems.

110
00:07:59,050 --> 00:08:00,230
Electronic poll books.

111
00:08:00,450 --> 00:08:05,930
These are the things that you'll, you know, check in with at your polling place.

112
00:08:06,130 --> 00:08:07,450
You have candidate filing systems.

113
00:08:07,630 --> 00:08:15,470
If you're going to, you know, run for governor, you have to file your information with your state at these candidate filing systems.

114
00:08:16,330 --> 00:08:18,510
There's, you know, also ballot tracking.

115
00:08:18,810 --> 00:08:20,290
There's poll worker tracking.

116
00:08:20,510 --> 00:08:25,010
There's just a whole slew of other supporting election systems.

117
00:08:25,670 --> 00:08:30,130
Here you also have, you know, campaign voter information databases.

118
00:08:30,570 --> 00:08:39,370
These are, you know, fairly large scale, you know, information and data collection, you know, efforts.

119
00:08:39,630 --> 00:08:43,230
And they're actually holding a lot of really interesting information about all of us.

120
00:08:43,230 --> 00:08:52,570
And so when we're, you know, thinking about curing the election eco, you know, ecosystem, we actually need to have a larger pallet there.

121
00:08:52,750 --> 00:08:54,570
This is just for people reading these slides later.

122
00:08:54,770 --> 00:08:55,250
Cool.

123
00:08:55,410 --> 00:08:57,070
So Mapblaze is right.

124
00:08:57,250 --> 00:09:04,550
We, you know, our whole threat model has changed since the, you know, 2016 general.

125
00:09:06,950 --> 00:09:13,130
Previously we had a threat, a threat model that would, you know, at least election officially.

126
00:09:13,230 --> 00:09:17,350
There was a threat, a threat model about, you know, physically proximate attackers.

127
00:09:17,770 --> 00:09:22,570
In terms of intelligent adversaries, they're extremely worried about poll workers.

128
00:09:22,870 --> 00:09:29,990
Poll workers are the, you know, one of the nation's largest temporary workforces.

129
00:09:30,890 --> 00:09:34,710
And, you know, poll workers aren't necessarily vetted.

130
00:09:34,830 --> 00:09:40,130
They, you know, to the degree that you would want.

131
00:09:40,670 --> 00:09:43,070
They often have privileged systems.

132
00:09:43,230 --> 00:09:46,690
They have access, passwords, and they have time to actually play around with these systems.

133
00:09:47,370 --> 00:09:53,110
Election officials are also extremely worried about accidental errors and, you know, events such as that.

134
00:09:53,230 --> 00:10:00,310
These are the things that more often than not will actually lead to an election, sorry, to an incorrect election outcome.

135
00:10:01,730 --> 00:10:04,970
So elections officials are extremely worried about accidental errors.

136
00:10:05,250 --> 00:10:10,390
Natural disasters such as the 2012 hurricane Sandy, I think it was 2012,

137
00:10:10,390 --> 00:10:13,390
that happened on the, you know, east coast.

138
00:10:13,790 --> 00:10:16,490
Definitely affected elections there.

139
00:10:16,650 --> 00:10:23,070
And just, you know, any real event that would, that would impact public confidence and trust in the election system.

140
00:10:23,430 --> 00:10:35,850
But since 2016, we, you know, we got the intelligence community report about, you know, meddling in our, in our elections.

141
00:10:36,270 --> 00:10:40,370
And what we're, you know, what we actually have evidence of now is basically, you know,

142
00:10:40,390 --> 00:10:46,110
basically nation state attackers, you know, hitting our election systems.

143
00:10:46,290 --> 00:10:52,210
We haven't yet seen attacks against vote capture and tabulation systems.

144
00:10:53,070 --> 00:10:55,390
At least, you know, documented by the IC.

145
00:10:55,690 --> 00:11:02,690
But, yeah, we also saw issues of phishing of both election officials and voting system vendors.

146
00:11:04,190 --> 00:11:09,050
And the new threat model is really everything in the old threat model plus cyber.

147
00:11:09,210 --> 00:11:09,690
Right?

148
00:11:12,190 --> 00:11:14,950
Yeah, so what do these voting systems actually look like?

149
00:11:15,190 --> 00:11:17,770
They are, you know, embedded legacy systems.

150
00:11:17,910 --> 00:11:20,710
That's how I would, you know, talk to someone about them today.

151
00:11:21,230 --> 00:11:24,590
They are typically running some Unix or Linux variant.

152
00:11:24,790 --> 00:11:29,730
They might have a custom kernel for some reason.

153
00:11:30,130 --> 00:11:33,730
Some of them are, you know, running Windows CE 3.0.

154
00:11:34,210 --> 00:11:36,630
That's what was run in Georgia when I was there.

155
00:11:36,630 --> 00:11:44,910
Some of them have really old, you know, and proprietary physical media.

156
00:11:45,130 --> 00:11:45,950
I am 30.

157
00:11:46,110 --> 00:11:50,730
I should not, like, I should not know what a PCM CIA card is.

158
00:11:50,870 --> 00:11:51,710
But I do.

159
00:11:52,310 --> 00:11:56,690
You know, that could be a problem there.

160
00:11:57,150 --> 00:12:04,410
You know, so networking, wireless is a fairly common phenomenon.

161
00:12:05,370 --> 00:12:06,490
Infrared, Bluetooth.

162
00:12:06,630 --> 00:12:07,630
Wi-Fi, cellular.

163
00:12:07,870 --> 00:12:11,390
Those are definitely things deployed in U.S. voting systems.

164
00:12:11,950 --> 00:12:16,690
And these things are basically needed to last for a long time.

165
00:12:16,890 --> 00:12:20,210
Many states are still using systems purchased in 2002.

166
00:12:20,550 --> 00:12:22,910
And there's not really a clear upgrade path there.

167
00:12:23,670 --> 00:12:29,230
And these systems really receive one to five updates over that whole lifetime.

168
00:12:29,870 --> 00:12:34,170
And these, you know, these updates are extremely expensive when they have to update.

169
00:12:36,050 --> 00:12:42,290
I, like, for my first real, you know, job when I wasn't a student assistant anymore at KSU,

170
00:12:42,490 --> 00:12:51,170
I was, you know, basically made to go and physically insert a PCM CIA card into 6,000 touch screen units

171
00:12:51,170 --> 00:12:55,950
across the state of Georgia to update an expired X.509 cert.

172
00:12:57,110 --> 00:12:57,710
Yeah.

173
00:12:57,850 --> 00:13:00,250
And it was really interesting.

174
00:13:00,490 --> 00:13:02,390
I got some stories from that.

175
00:13:02,510 --> 00:13:04,150
I'll just stop there.

176
00:13:04,170 --> 00:13:04,290
I'll say that.

177
00:13:07,210 --> 00:13:13,550
So, you know, now that we've talked about what these, you know, what these systems actually look like,

178
00:13:13,970 --> 00:13:16,350
what sort of issues have we seen previously?

179
00:13:17,250 --> 00:13:23,110
You can look at some of the sources for our results at the very back of this.

180
00:13:23,230 --> 00:13:27,570
I will tweet out these slides after this presentation.

181
00:13:28,150 --> 00:13:32,950
But, you know, Barbara and David were, you know,

182
00:13:32,950 --> 00:13:34,150
talking about these independent systems.

183
00:13:34,170 --> 00:13:41,110
independent reviews that we saw of these, you know, of US voting systems.

184
00:13:41,290 --> 00:13:46,350
And it's really 15 to 20 independent reviews since probably 2004.

185
00:13:47,230 --> 00:13:50,450
So it's actually not a lot of outside scrutiny.

186
00:13:51,530 --> 00:13:56,710
And what NIST did recently is we went through all these different papers,

187
00:13:56,810 --> 00:13:59,630
did a, you know, a literature review

188
00:13:59,630 --> 00:14:01,770
and looked at some of

189
00:14:01,770 --> 00:14:07,570
of the various issues there and we then mapped them to common

190
00:14:07,570 --> 00:14:11,610
weakness enumeration types which is basically a standard for

191
00:14:11,610 --> 00:14:18,250
software bug types, go figure NIST like standards, right? And

192
00:14:18,250 --> 00:14:23,350
so these were the top five software bug types that we saw.

193
00:14:23,850 --> 00:14:27,270
These were fairly common issues, I would say very, very common

194
00:14:27,270 --> 00:14:35,330
issues in the papers that we reviewed. And then just to up

195
00:14:35,330 --> 00:14:38,310
level them a little bit, we basically saw a lot of input

196
00:14:38,310 --> 00:14:48,090
validation issues, you know, crypto and authentication. So

197
00:14:48,090 --> 00:14:52,250
it's, you know, everything's not on fire, right? There are, you

198
00:14:52,250 --> 00:14:57,130
know, good things happening in the voting arena. Risk limiting

199
00:14:57,270 --> 00:15:04,550
audits. There have been really I would, you know, go as far to

200
00:15:04,550 --> 00:15:08,490
say that this is the single best innovation we've had in election

201
00:15:08,490 --> 00:15:13,470
security since the year 2000. These are really meaningful

202
00:15:13,470 --> 00:15:18,330
statistical audits that are fairly efficient. They can be

203
00:15:18,330 --> 00:15:21,290
very, very practical and don't have to be extremely expensive.

204
00:15:21,970 --> 00:15:27,250
And so they can give an election official pretty good confidence in the election. You can say no, but

205
00:15:27,270 --> 00:15:33,370
election outcome without spending tons of money and time. Software independence. This is a

206
00:15:33,370 --> 00:15:43,250
concept championed in 2007, 08. Basically meaning that a bug in the software can't affect

207
00:15:43,250 --> 00:15:50,190
the election outcome. There's a better way to say it. But practically right now this means

208
00:15:50,190 --> 00:15:58,810
paper. Paper voting systems. But this is the up level concept that's more what desirable

209
00:15:58,810 --> 00:16:07,430
characteristics do we actually need in voting systems. There are proposals for completely

210
00:16:08,140 --> 00:16:15,250
software independent fully electronic voting systems. These are called ETE verifiable

211
00:16:15,250 --> 00:16:20,170
cryptographic protocols. These are really cool systems that have a lot of different

212
00:16:20,190 --> 00:16:25,930
applications. They have not really been used on large scales yet. But they essentially give a

213
00:16:25,930 --> 00:16:35,790
voter a receipt that guarantees them that their vote was included in the final tally. But they

214
00:16:35,790 --> 00:16:43,390
can't sell their vote with that receipt. So it's really cool. Essentially domain specific crypto.

215
00:16:43,770 --> 00:16:50,170
These things have been, they've been used in coma park, Maryland and a couple other areas. It's

216
00:16:51,670 --> 00:16:58,890
definitely arguing about what constitutes this type of system. But it's definitely a really

217
00:16:58,890 --> 00:17:04,370
interesting research area and potential path forward. And then finally recognition of usability

218
00:17:04,370 --> 00:17:12,210
as a security issue is a big, big problem. It's sort of a new thing in that, you know, the

219
00:17:12,210 --> 00:17:20,170
community finally said, well, you know what, if it's not usable, availability drops to zero. So

220
00:17:20,190 --> 00:17:28,450
that can definitely affect the outcome. Well, at least the security of the voting system. And so

221
00:17:28,450 --> 00:17:35,710
NIST really likes software ND pendants. We are including it in our recommendations for, you

222
00:17:35,710 --> 00:17:41,130
know, principles and guidelines for voting systems. But, you know, paper itself is not a panacea

223
00:17:41,130 --> 00:17:49,490
in elections. There are a number of physical security oriented issues that can really affect the

224
00:17:49,490 --> 00:17:57,050
election outcome. You know, paper primarily gives you tamper detection and auditability which is

225
00:17:57,050 --> 00:18:03,650
awesome. It's super, super great. But, you know, paper can be modified. It's a very common thing

226
00:18:03,650 --> 00:18:09,830
for a long time for whoever is counting ballots to put a little piece of lead underneath their

227
00:18:10,930 --> 00:18:16,890
fingernail. And if there's not a filled in, you know, bubble, fill in that bubble real, real fast.

228
00:18:16,890 --> 00:18:25,450
There are just, you know, non-cyber security related issues. Seals and chain of custody need to be

229
00:18:26,070 --> 00:18:31,730
verified. If you're not going to actually look at the paper trail, why have it? This routine, you

230
00:18:31,730 --> 00:18:37,230
know, meaningful audits need to be performed. You can't just have paper. You have to actually do

231
00:18:37,230 --> 00:18:43,310
something with it. And then, you know, just generally we need to, you know, up the level of

232
00:18:43,990 --> 00:18:51,330
яла in this area. I'm doing pretty good on time. Okay. Testing and certification, what does

233
00:18:51,330 --> 00:18:59,190
this process look like? Basically the election assistance commission runs a, a testing and

234
00:18:59,190 --> 00:19:05,270
certification program for voting systems. There are, there are multiple layers of testing and

235
00:19:05,270 --> 00:19:13,290
certification. The, the EAC performs a, a federal certification and then states have the full

236
00:19:13,310 --> 00:19:18,550
do their own testing for their own needs. Some states have

237
00:19:18,550 --> 00:19:22,410
rules that are like you should be able to click straight

238
00:19:22,850 --> 00:19:27,990
ticket. The whole system then selects all D or all R. But

239
00:19:27,990 --> 00:19:33,150
then you should be able to choose one other person in the

240
00:19:33,150 --> 00:19:38,890
other area. It's like the Pennsylvania cross vote is what

241
00:19:38,890 --> 00:19:42,750
people call it. And there's just tons of state specific voting

242
00:19:42,750 --> 00:19:47,890
logic issues that states are testing for. What does this

243
00:19:47,890 --> 00:19:56,190
actually look like? This is at a high level. Vendors submit an

244
00:19:56,190 --> 00:20:02,770
application to be tested. The EAC, a third party lab and then

245
00:20:02,770 --> 00:20:08,090
the manufacturer sit down. They figure out essentially a testing

246
00:20:08,090 --> 00:20:12,730
contract. That's a test plan. Testing occurs. And then the

247
00:20:12,750 --> 00:20:13,850
company is going to test the testing. If there are issues,

248
00:20:15,370 --> 00:20:18,630
I've never seen a testing campaign that doesn't have at

249
00:20:18,630 --> 00:20:23,770
least one issue, the vendor goes back and makes a change and then

250
00:20:23,770 --> 00:20:34,190
it gets tested again. There's a test report. The EAC says, yes.

251
00:20:34,190 --> 00:20:39,850
I would like to certify no I don't want to certify. If they do

252
00:20:39,850 --> 00:20:42,730
certify then a voting system is going to be established. If they

253
00:20:42,750 --> 00:20:47,650
system goes into their quality monitoring program where states and labs and manufacturers

254
00:20:47,650 --> 00:20:54,890
and everyone gives EAC information about how that performance, how that system is

255
00:20:54,890 --> 00:21:01,810
performing in the field. Yeah, I'm going to go back a slide for a second and say if you're

256
00:21:01,810 --> 00:21:08,390
really interested in knowing more technical information about voting systems, EAC.gov is

257
00:21:08,390 --> 00:21:14,490
literally the best place. They have a test plan and test reports section and they have

258
00:21:15,240 --> 00:21:19,450
information on new voting systems that aren't really out there yet. A lot of the systems that

259
00:21:19,970 --> 00:21:27,810
EAC has certified, at least to the newer standards, aren't necessarily deployed in the field

260
00:21:27,810 --> 00:21:34,150
yet or if they are, it's only in limited areas. But this is an excellent resource that they're

261
00:21:34,940 --> 00:21:37,290
doing a serious boon for this community.

262
00:21:38,390 --> 00:21:43,990
In terms of voting standards, the voluntary voting system guidelines, awesome name for a

263
00:21:43,990 --> 00:21:54,770
standard, right? VVSG. These standards are primarily for vote capture and tabulation

264
00:21:54,770 --> 00:21:59,450
systems. So nothing about voter registration, nothing about electronic poll books, election

265
00:21:59,450 --> 00:22:07,290
night reporting. There is no federal law mandating that every system come apply with these

266
00:22:07,290 --> 00:22:08,170
standards. I just.

267
00:22:08,390 --> 00:22:14,630
There just isn't. The way elections work in the U.S. is that it's, you know, typically the, you

268
00:22:14,630 --> 00:22:20,610
know, time and manner of choosing is left open to states. And so that's the same here in that

269
00:22:21,420 --> 00:22:28,350
states can use completely federally certified systems, systems that are only, you know,

270
00:22:28,350 --> 00:22:37,110
partially certified. There are, you know, there's tons of variations out there. In terms of security,

271
00:22:38,390 --> 00:22:49,170
well, just in general, these are the, you know, various voting standards as I see them. The 1990 VSS

272
00:22:49,170 --> 00:22:54,170
and 2002 voting system standards, these things were made not necessarily by the federal

273
00:22:54,170 --> 00:23:05,110
government. And it wasn't until the election assistance commission was created in 02, I think,

274
00:23:05,230 --> 00:23:08,370
that, that, you know, we actually got the modern VVSG, you know, we actually got the modern VVSG

275
00:23:08,390 --> 00:23:16,330
and the modern VVSG has a whole section on security. Didn't really even have that previously that

276
00:23:16,330 --> 00:23:25,830
much. And there's been large changes in security as, as new standards have been made. But most

277
00:23:25,830 --> 00:23:35,170
systems in the U.S. are still certified to the 2002 VSS or 2005 VVSG. And it's mostly 2002 VSS.

278
00:23:37,790 --> 00:23:47,650
In 2007 NIST made some recommendations for, next generation voting systems. There's a really

279
00:23:47,650 --> 00:23:54,710
robust security architecture that was recommended because of some various issues such as software

280
00:23:54,710 --> 00:24:05,150
independence and penetration testing. Those were not eventually adopted. And so, what folks did,

281
00:24:05,150 --> 00:24:10,490
is they took parts out of the 2007 and parts out of the 2005, smushed them together and got

282
00:24:10,490 --> 00:24:19,430
the 2015. And so yeah, that's the most recently adopted standard. NIST and EAC right now are

283
00:24:19,430 --> 00:24:24,930
actually working on a complete, you know, it's basically a completely different way of

284
00:24:24,930 --> 00:24:31,410
looking at election standards and we're, you know, basically having, you know, it's, you

285
00:24:31,410 --> 00:24:37,030
know, it's basically driven by, you know, outside input by, you know, voters and concerned

286
00:24:37,030 --> 00:24:44,430
citizens and we're, you know, putting together these next generation requirements. This, you

287
00:24:44,430 --> 00:24:49,870
know, this new structure is going to have principles, guidelines, requirements and test

288
00:24:49,870 --> 00:24:55,390
assertions. Principles and guidelines are ultimately going to be what's adopted by the

289
00:24:55,390 --> 00:25:01,130
federal government and then the requirements and test assertions are going to be a little

290
00:25:01,130 --> 00:25:08,370
more malleable because what we've really seen is that, you know, there's been a lot of changes

291
00:25:08,370 --> 00:25:13,550
and sometimes folks get really locked into certain requirements and it doesn't really help to be

292
00:25:13,550 --> 00:25:20,390
locked into requirements from five or ten years ago. From a security perspective, I'm, you

293
00:25:20,390 --> 00:25:28,950
know, I'm co-chairing this working group on, you know, in this area. These are the seven high

294
00:25:28,950 --> 00:25:34,990
level principles that we have listed. Each of these has a number of, you know, sub-guidelines.

295
00:25:35,290 --> 00:25:44,990
They're all available at the NIST and EAC voting Twiki. A couple of things I'll sort of point

296
00:25:44,990 --> 00:25:51,070
out. Under auditability, which is the single most important principle that the whole group felt

297
00:25:51,070 --> 00:25:58,770
really, really strongly about, software independence is included under that. Under

298
00:25:58,770 --> 00:26:03,050
access control, we have things like, you know, two-factor authentication for privileged

299
00:26:03,050 --> 00:26:13,810
election operations. For data protection, we have, you know, using well, well vetted, publicly

300
00:26:13,810 --> 00:26:18,970
available, you know, in standardized crypto, which is really, really nice. For software

301
00:26:18,970 --> 00:26:23,510
integrity, which we're changing to system integrity, we have, you know, things like only

302
00:26:23,510 --> 00:26:28,750
digitally signed code can actually run on a voting system. If you want to know more about the

303
00:26:28,750 --> 00:26:34,590
system, if you want to talk about these later, I'll be, I'll be, I'll be around. So just to, you

304
00:26:34,590 --> 00:26:40,210
know, before we get to questions and stuff, these are some of the big things that I think really

305
00:26:40,210 --> 00:26:46,210
need to be addressed. We need to routine meaningful audits. I think that is a really

306
00:26:46,210 --> 00:26:53,870
important concept that needs to be enshrined here. We need regular external scrutiny of voting

307
00:26:53,870 --> 00:26:58,730
systems. It is absolutely key. You know, the more folks, you know, the more, you know, the more

308
00:26:58,730 --> 00:27:04,970
people who can take a look at these, I am of the opinion, the better. But when folks do find

309
00:27:04,970 --> 00:27:13,410
issues, there needs to be responsible vulnerability disclosure, do not release a freaking zero day a

310
00:27:13,410 --> 00:27:20,630
week before the election. Just don't, don't, you know. There are, you know, there are well

311
00:27:20,630 --> 00:27:28,370
known, well, I mean, essentially if you have issues, if you find an issue, talk to the EAC, talk to DHS,

312
00:27:28,730 --> 00:27:35,210
and yes, if you want to make my, you know, Monday morning bad, you can send it to me, too. That's

313
00:27:35,210 --> 00:27:40,990
perfectly fine. So I think that we need to augment how we, you know, really manage election

314
00:27:41,490 --> 00:27:47,110
security. I think risk assessment threat modeling, contingency planning need to be common terms

315
00:27:47,110 --> 00:27:53,570
for, for elections officials. And I think that, you know, they need to be pretty, you know, pretty

316
00:27:53,570 --> 00:27:58,710
knowledgeable in these, you know, in these concepts. Voting systems are a very important tool. You know,

317
00:27:58,730 --> 00:28:04,290
voting systems need regular software updates, just like, just like anything. We need to figure out

318
00:28:04,290 --> 00:28:10,370
how to get voting systems regular software updates. I think it is untenable to have voting, voting

319
00:28:10,370 --> 00:28:18,070
systems with, you know, CVSS score 10, right, with, you know, 50 of those on a voting system.

320
00:28:18,190 --> 00:28:24,910
That is just, that's just, you know, unacceptable. We need to find a way how to fix that. And

321
00:28:24,910 --> 00:28:28,710
then election officials need actionable guidance. You can't, you know, you can't just, you know,

322
00:28:28,730 --> 00:28:33,230
you can't just go yell at them and say do this, do this. It's not really going to help any, you

323
00:28:33,230 --> 00:28:41,950
know, any, any body. They need to, you know, like, they need guidance in the language that they

324
00:28:41,950 --> 00:28:48,550
speak. And so you have to help speak their, their, their language. They are typically not

325
00:28:49,200 --> 00:28:56,970
cyber security experts. Election officials are, you know, basically low just champions. They do a

326
00:28:56,970 --> 00:28:58,710
really complex operation. And I think that's, I think that's, I think that's, I think that's a

327
00:29:00,270 --> 00:29:09,490
big thing. Again. So, in the sense that, it's, it's a really, really big question question.

328
00:29:09,490 --> 00:29:18,570
And it really, really important when you have to, you know, show the, the, the, you know,

329
00:29:18,590 --> 00:29:21,270
the strong suitability you have to be able to say, you know, you can't, you can't, you can't

330
00:29:21,270 --> 00:29:22,490
do that. I think that's, that's, that's, you know, that's art. That's, that's really important.

331
00:29:24,210 --> 00:29:25,510
And then, you know, eventually, it all of a sudden, you know, the, the, the, you know, a

332
00:29:25,510 --> 00:29:27,450
thing that I really do see is, you know, it takes a lot more than just the impact of a full

333
00:29:27,450 --> 00:29:28,710
foreign election. If anybody has any sort of, you know, development plan, you know, you сво

334
00:29:28,710 --> 00:29:30,990
how you can affect change in your local area.

335
00:29:31,210 --> 00:29:36,890
And local elections are the elections that will actually have an impact in your life

336
00:29:36,890 --> 00:29:39,530
in a fairly large way, fairly quickly.

337
00:29:41,150 --> 00:29:43,490
Work with your election official, not against them.

338
00:29:43,590 --> 00:29:45,450
Don't antagonize them. Help out.

339
00:29:45,690 --> 00:29:47,070
Be a force for good.

340
00:29:47,410 --> 00:29:51,530
And then just completely in a self-serving manner, join these public working groups.

341
00:29:51,690 --> 00:29:53,030
We're fairly nice people.

342
00:29:54,390 --> 00:29:57,330
Yeah, so thanks, everyone.

343
00:29:57,330 --> 00:29:59,210
Mary and I are here for questions.

344
00:30:09,330 --> 00:30:09,970
Hello.

345
00:30:14,290 --> 00:30:15,330
Yeah, definitely.

346
00:30:16,470 --> 00:30:19,030
Yeah, so the question was?

347
00:30:30,350 --> 00:30:34,950
You mentioned joining public working groups to help local election officials.

348
00:30:35,330 --> 00:30:37,730
If you could tell us how to access those.

349
00:30:44,110 --> 00:30:45,790
So are you bringing up the reference?

350
00:30:45,990 --> 00:30:50,030
So there's a set of seven working groups.

351
00:30:50,110 --> 00:30:51,310
There's three election groups.

352
00:30:51,470 --> 00:30:53,250
There's for pre-election, election, and post-election.

353
00:30:53,450 --> 00:30:56,510
And there's four, we call them constituency groups,

354
00:30:56,630 --> 00:30:57,110
because they're there.

355
00:30:57,110 --> 00:30:57,310
There's a set of seven working groups.

356
00:30:57,310 --> 00:30:59,290
They're sort of help support the elections,

357
00:30:59,550 --> 00:31:02,930
but they're human factors to usability, accessibility, cyber security,

358
00:31:03,670 --> 00:31:07,470
interoperability, where a lot of the common data format work

359
00:31:07,470 --> 00:31:09,130
is being played out, and testing.

360
00:31:09,490 --> 00:31:13,870
So you can follow a link that maybe is not coming up,

361
00:31:13,930 --> 00:31:18,190
or the easy way would be to go to vote.nist.gov,

362
00:31:18,350 --> 00:31:21,390
and there's a link off of that page to the working groups,

363
00:31:21,490 --> 00:31:23,090
to the Twiki itself.

364
00:31:23,310 --> 00:31:26,110
And on there, there's information about how to set up an account

365
00:31:26,110 --> 00:31:27,290
and how to vote.

366
00:31:27,290 --> 00:31:31,210
And there's information about how to actually join the mailing lists.

367
00:31:31,430 --> 00:31:34,870
And there's a bunch of pretty simple videos that you can follow.

368
00:31:35,070 --> 00:31:37,030
And if you have any questions, just ask us.

369
00:31:37,690 --> 00:31:39,150
Are you guys allowed to share the link?

370
00:31:39,450 --> 00:31:40,210
Yeah, yeah, definitely.

371
00:31:40,510 --> 00:31:41,930
I'll tweet them out in a moment.

372
00:31:42,130 --> 00:31:43,770
Yeah, I was going to say, we'll post them on Twitter.

373
00:31:44,130 --> 00:31:44,330
Cool.

374
00:31:44,390 --> 00:31:44,690
Right here.

375
00:31:45,150 --> 00:31:45,870
Thank you.

376
00:31:52,550 --> 00:31:56,030
So how are you addressing resiliency in terms of just,

377
00:31:56,030 --> 00:32:02,210
just maintainability and continued function as a security threat,

378
00:32:02,430 --> 00:32:04,990
and how you're setting up the standards,

379
00:32:05,070 --> 00:32:06,250
or how you're looking at these things?

380
00:32:06,310 --> 00:32:09,890
Because it seems like there's going to be a bigger threat from DDoS

381
00:32:09,890 --> 00:32:15,030
by device failure in elections than there is from actual tampering with machines.

382
00:32:16,030 --> 00:32:18,450
We encountered a lot of that in the last election in Maryland,

383
00:32:18,610 --> 00:32:22,410
where many of the optical scanners died during the election,

384
00:32:22,570 --> 00:32:24,950
and votes were left piled up.

385
00:32:25,150 --> 00:32:26,010
And in some places, there's a lot of that.

386
00:32:26,010 --> 00:32:29,350
Some cases unattended while voting machines, the scanners weren't working.

387
00:32:29,630 --> 00:32:35,510
So how do we address the actual ease of operation

388
00:32:35,510 --> 00:32:39,430
and continued use as part of the security model

389
00:32:39,430 --> 00:32:40,930
in putting these standards together?

390
00:32:45,770 --> 00:32:47,170
Yeah, that's a great question.

391
00:32:47,570 --> 00:32:51,530
So we do have a maintainability-oriented principle

392
00:32:51,530 --> 00:32:53,410
that is going to be in, you know,

393
00:32:54,290 --> 00:32:55,910
like we only saw seven.

394
00:32:56,010 --> 00:32:57,070
Of the actual principles,

395
00:32:57,270 --> 00:32:59,990
there's a whole list of other principles as well.

396
00:33:01,050 --> 00:33:03,990
A lot of, you know, the answers there are, you know,

397
00:33:04,450 --> 00:33:08,070
going to be about build quality, quality assurance.

398
00:33:08,630 --> 00:33:12,830
There are, you know, programs that the EAC has,

399
00:33:13,070 --> 00:33:14,690
you know, looking into quality assurance areas.

400
00:33:14,950 --> 00:33:17,310
But some of that is going to be on the election official themselves

401
00:33:17,830 --> 00:33:20,890
to make sure that they're taking, you know,

402
00:33:20,890 --> 00:33:24,250
good care of their election system.

403
00:33:24,250 --> 00:33:26,570
I definitely think that, you know,

404
00:33:26,590 --> 00:33:28,890
manufacturers play a role there as well

405
00:33:29,430 --> 00:33:32,350
in, you know, not using, you know,

406
00:33:32,350 --> 00:33:34,550
bottom of the barrel components.

407
00:33:37,470 --> 00:33:40,010
I, you know, personally think I'm a, you know,

408
00:33:40,030 --> 00:33:42,110
I'm a big fan of COTS in voting systems,

409
00:33:42,190 --> 00:33:44,690
commercial off the shelf.

410
00:33:45,430 --> 00:33:46,490
You know, I would be pretty,

411
00:33:47,070 --> 00:33:51,290
I would be a pretty big fan of like a non-networked voting system,

412
00:33:51,490 --> 00:33:53,930
you know, running on like a, you know,

413
00:33:53,930 --> 00:33:56,770
tablet or Raspberry Pi that just prints a ballot right there.

414
00:33:58,270 --> 00:34:01,990
And, you know, that way if the actual voting system breaks down,

415
00:34:02,090 --> 00:34:06,610
you can just go, you know, buy another one at Staples or something.

416
00:34:08,070 --> 00:34:11,470
Yeah, that's, you know, resiliency and maintainability

417
00:34:11,470 --> 00:34:13,090
are really important questions.

418
00:34:14,770 --> 00:34:18,990
Somehow these systems are still working for the most part since 2002.

419
00:34:19,250 --> 00:34:21,890
Always kind of, yeah, it is kind of amazing.

420
00:34:22,970 --> 00:34:23,810
Hope that helps.

421
00:34:31,110 --> 00:34:32,070
Thank you very much.

422
00:34:32,130 --> 00:34:33,130
Two very quick questions.

423
00:34:33,230 --> 00:34:36,650
Number one, are any of the efforts to update the VVSG

424
00:34:36,650 --> 00:34:39,450
going to take into account not just voting systems

425
00:34:39,450 --> 00:34:40,690
but also non-voting systems?

426
00:34:41,330 --> 00:34:42,370
No? Okay.

427
00:34:43,690 --> 00:34:46,530
Is EAC planning to address that issue as well?

428
00:34:48,670 --> 00:34:51,190
So the databases and the election management systems?

429
00:34:51,670 --> 00:34:53,850
I can't, I can't talk to the EAC.

430
00:34:53,930 --> 00:34:54,910
Is NIST?

431
00:34:56,430 --> 00:34:59,310
As of right now, we are focused on vote capture.

432
00:35:00,530 --> 00:35:00,930
Okay.

433
00:35:00,990 --> 00:35:04,330
And then to the extent that a lot of people,

434
00:35:04,410 --> 00:35:06,750
a lot of counties just aren't going to be able to replace their machines,

435
00:35:06,970 --> 00:35:11,690
is the problem that we cannot technically update these software systems

436
00:35:11,690 --> 00:35:14,070
or is the problem that we just don't do it?

437
00:35:15,970 --> 00:35:16,630
There you go.

438
00:35:20,490 --> 00:35:21,790
Do you want to take it?

439
00:35:21,850 --> 00:35:22,210
I can take it.

440
00:35:22,770 --> 00:35:23,670
Okay, yeah, I mean.

441
00:35:23,930 --> 00:35:25,490
I mean, there's not really anything in the VVSG.

442
00:35:25,610 --> 00:35:28,310
Yeah, there's, yeah, updating voting system software.

443
00:35:28,390 --> 00:35:32,430
I mean, it is, so it costs sometimes over a million dollars

444
00:35:32,430 --> 00:35:33,890
to get a voting system certified.

445
00:35:36,190 --> 00:35:39,050
Yes, and so if even one software update occurs,

446
00:35:39,650 --> 00:35:43,890
then there needs to be a new certification process.

447
00:35:44,090 --> 00:35:47,470
Now, the second layer certification process,

448
00:35:47,670 --> 00:35:51,050
that second order process doesn't have to be a full million dollar process.

449
00:35:51,250 --> 00:35:52,730
Typically, it can be really, really small.

450
00:35:52,930 --> 00:35:53,810
I think that the,

451
00:35:53,930 --> 00:35:58,030
that the EAC has gotten those done in like two or three months in my,

452
00:35:58,030 --> 00:35:59,530
in my experience.

453
00:36:01,470 --> 00:36:06,150
But then local election officials would have to pay for those software updates typically.

454
00:36:07,250 --> 00:36:09,570
You know, folks want you to, you know,

455
00:36:09,570 --> 00:36:14,250
buy the, you know, latest version of your, you know, of an app sometimes, right?

456
00:36:14,370 --> 00:36:17,070
I mean, that's a very common thing.

457
00:36:17,190 --> 00:36:21,090
And just elections aren't the most well-funded operations.

458
00:36:21,990 --> 00:36:23,890
Let me just add a little bit to that.

459
00:36:24,650 --> 00:36:30,790
The EAC, prior to embarking on this effort to update the voluntary voting system standards,

460
00:36:31,030 --> 00:36:36,430
led a group of, led a group of folks that came up with some principles moving forward,

461
00:36:36,490 --> 00:36:38,750
not to be confused with the principles and guidelines.

462
00:36:38,990 --> 00:36:43,250
And, you know, one of the areas that they really do want to figure out, you know,

463
00:36:43,250 --> 00:36:46,590
what to do about is how can we, you know, update the software.

464
00:36:46,770 --> 00:36:48,070
So it's in our minds.

465
00:36:48,150 --> 00:36:50,410
We don't yet have a solution because,

466
00:36:51,090 --> 00:36:53,810
it's, you know, we really sort of have to look at the testing process

467
00:36:53,810 --> 00:36:57,870
and how it would feed into the testing process and how much it would cost and,

468
00:36:57,930 --> 00:36:59,750
you know, like, how can this all work?

469
00:36:59,830 --> 00:37:02,430
So if you have ideas, we're certainly, you know.

470
00:37:02,710 --> 00:37:06,930
Thank you.

471
00:37:08,190 --> 00:37:13,930
The voting is the, is the domain of the states by constitution.

472
00:37:15,130 --> 00:37:19,010
So the best that NIST can do is to set standards, correct?

473
00:37:20,250 --> 00:37:21,070
Is to set standards.

474
00:37:21,090 --> 00:37:29,810
And then the federal government can provide to the states money to assist the voting system, correct?

475
00:37:31,550 --> 00:37:33,190
Am I talking into the mic?

476
00:37:34,870 --> 00:37:35,430
Okay.

477
00:37:37,850 --> 00:37:38,410
Okay.

478
00:37:39,710 --> 00:37:40,270
Okay.

479
00:37:40,310 --> 00:37:45,990
I just wanted to ask, though, you may not want to be speaking on behalf of NIST,

480
00:37:46,090 --> 00:37:50,850
but could you sort of share with us what your ideal,

481
00:37:51,090 --> 00:37:54,170
what your ideal voting system would be, given the constitution,

482
00:37:54,610 --> 00:37:57,790
the way that the state, the voting works in this country,

483
00:37:58,010 --> 00:38:02,190
and also part two of that, maybe not speaking for NIST again.

484
00:38:02,350 --> 00:38:07,930
Do you think that there has been widespread voter fraud, voter registration fraud?

485
00:38:11,290 --> 00:38:11,770
Okay.

486
00:38:11,930 --> 00:38:15,990
So for my ideal voting system, I'm going to have to say I'll see you after class

487
00:38:15,990 --> 00:38:18,370
because that hasn't been approved by NIST management.

488
00:38:19,610 --> 00:38:21,070
Happy to talk to you out there.

489
00:38:24,830 --> 00:38:28,810
Okay, so it was a multi-part question.

490
00:38:28,870 --> 00:38:29,610
Now, you're absolutely right.

491
00:38:29,730 --> 00:38:33,610
I mean, it's up to the states to determine whether or not they want to adopt the VVSG,

492
00:38:33,710 --> 00:38:37,550
and this is normally handled within the legislation within the state legislature.

493
00:38:37,890 --> 00:38:43,870
So some states, you know, require certification to require the use of certified systems.

494
00:38:44,050 --> 00:38:51,050
Some require the use of systems that are certified by lab, but not necessarily by EAC, that are TAC,

495
00:38:51,070 --> 00:38:53,630
tested by lab and certified, but not necessarily by the EAC.

496
00:38:53,850 --> 00:38:58,250
Some require you to, the certification to the VVSG,

497
00:38:58,370 --> 00:39:02,030
and they might run their own state-sponsored programs to do that.

498
00:39:02,270 --> 00:39:03,490
So you're absolutely right.

499
00:39:03,650 --> 00:39:06,310
I mean, we can set the standards, you know, but, you know,

500
00:39:06,730 --> 00:39:10,410
but we can't necessarily impose them, you know, on the states.

501
00:39:11,710 --> 00:39:14,710
I'm not really sure what to say about my ideal voting system

502
00:39:15,350 --> 00:39:20,870
because nothing's been approved by my management either, and I don't, I can't really comment on voter fraud.

503
00:39:20,870 --> 00:39:26,210
I mean, it's sort of kind of outside our, our area of expertise and the things that we look at, but, uh...

504
00:39:26,770 --> 00:39:29,330
I think I can just yell at the microphone and we'll reach it.

505
00:39:29,450 --> 00:39:29,930
Sure.

506
00:39:30,050 --> 00:39:33,250
Um, you've outlined some really good principles here.

507
00:39:33,310 --> 00:39:40,370
You've got, uh, patches and clients of open source, uh, you know, general public compliance,

508
00:39:41,090 --> 00:39:45,830
but if the states are not required to use them, if the states don't have to do anything,

509
00:39:46,190 --> 00:39:48,030
why does it matter at all?

510
00:39:48,190 --> 00:39:49,850
And how can we force them?

511
00:39:49,850 --> 00:39:52,050
How can we force them to have some model of compliance?

512
00:39:52,370 --> 00:39:53,830
What needs to be based on this?

513
00:39:55,370 --> 00:40:01,110
So, uh, let me just say that although the states are not required to use, uh, there, there was some, uh,

514
00:40:01,170 --> 00:40:05,650
recent study done by, uh, NCSL, the, and I always forget what that stands for,

515
00:40:05,690 --> 00:40:12,010
the National Council of, Conference of State Legislatures, that, uh, indicates that 47 out of the 50 states do,

516
00:40:12,150 --> 00:40:19,730
uh, actually, uh, adhere to one of those areas, either, you know, use, either certified systems, certified by lab,

517
00:40:19,730 --> 00:40:25,210
or, you know, to the VVSG, or, or, uh, somewhere, you know, even if they don't use those words,

518
00:40:25,310 --> 00:40:27,410
they use other words that, you know, that imply it.

519
00:40:27,670 --> 00:40:32,710
Uh, so I, I, I do think that, uh, the majority of the states do actually want help.

520
00:40:32,830 --> 00:40:33,630
They're looking for help.

521
00:40:33,730 --> 00:40:34,490
They're looking for advice.

522
00:40:34,770 --> 00:40:40,250
Uh, certainly there, there were quite a number of them that, uh, that voluntarily signed up for, uh,

523
00:40:40,470 --> 00:40:45,750
for some of the cyber hygiene services that were, uh, that were available via DHS.

524
00:40:46,190 --> 00:40:48,150
So I, I, I think they're listening.

525
00:40:48,290 --> 00:40:49,510
They, they, you know.

526
00:40:49,730 --> 00:40:52,290
They're, I mean, the election officials don't want to be hacked.

527
00:40:52,950 --> 00:40:56,170
They, they want to, the elections to be secure.

528
00:40:56,250 --> 00:41:05,670
They, they, they, they want to be assured that the integrity of, uh, of the election is, is, you know, is, is certainly, uh, withheld, you know.

529
00:41:09,930 --> 00:41:10,950
Can you yell as well?

530
00:41:11,090 --> 00:41:11,410
Yeah.

531
00:41:11,470 --> 00:41:11,870
Sure.

532
00:41:11,870 --> 00:41:15,830
Um, so in the public statements, we've been hearing about the security of money systems,

533
00:41:15,970 --> 00:41:19,150
but we've been hearing over and over again that they're not connected to the internet,

534
00:41:19,730 --> 00:41:21,430
or they're secure, and they can't be hacked.

535
00:41:21,770 --> 00:41:24,490
And you talked about wireless and other connectivity.

536
00:41:25,010 --> 00:41:33,830
Um, now, so that's, so just ignoring a stuffnet type of task, you, there's also acknowledgement of other types of connectivity,

537
00:41:33,990 --> 00:41:39,570
even if you, uh, cellular, if you bleed over to the, you know, to an, uh, an internet connection,

538
00:41:39,630 --> 00:41:40,830
which is common these days.

539
00:41:41,290 --> 00:41:44,290
So can you square that circle for me?

540
00:41:45,590 --> 00:41:46,990
Or can you be squared?

541
00:41:48,610 --> 00:41:52,490
Uh, we, what exactly are you trying to square there?

542
00:41:52,630 --> 00:41:54,190
I mean, like, uh, I don't think we've...

543
00:41:54,190 --> 00:41:57,850
I mean, we've heard a couple comments about this not being connected to the internet.

544
00:41:58,470 --> 00:41:59,370
Have we said that?

545
00:41:59,750 --> 00:42:00,330
No, no, no.

546
00:42:00,450 --> 00:42:00,750
Oh, okay.

547
00:42:01,050 --> 00:42:03,250
I'm not saying it, I'm not saying it, I'm sorry.

548
00:42:03,410 --> 00:42:04,330
No, it's fine, no, no, no.

549
00:42:04,350 --> 00:42:06,950
I'm not saying that the public statement is not connected to the internet.

550
00:42:08,050 --> 00:42:14,710
Yeah, I mean, so we can be, I mean, so, you know, an air gap is definitely a, you know, powerful, you know, mitigation, right?

551
00:42:14,770 --> 00:42:16,970
For preventing remote attention.

552
00:42:16,990 --> 00:42:23,310
Um, yeah, I mean, uh, states are, you know, going to have to make that sort of choice themselves.

553
00:42:24,170 --> 00:42:31,070
Uh, then, you know, if they actually want to have wireless or, you know, wired, you know, networking at all.

554
00:42:31,150 --> 00:42:32,870
That's going to be a choice up to them.

555
00:42:34,730 --> 00:42:37,050
Um, hmm, I mean, yeah.

556
00:42:38,590 --> 00:42:41,010
I, I, I'm not really sure what you're looking for us to say.

557
00:42:41,130 --> 00:42:45,850
I, I mean, I, I guess what you're saying is on the one hand there, there are public comments saying that we're not connected.

558
00:42:45,910 --> 00:42:46,970
And we're standing here in person.

559
00:42:46,990 --> 00:42:49,070
I'm just referring to you saying, you know, you got all of this.

560
00:42:49,210 --> 00:42:56,050
You know, it, uh, uh, yes, I, I mean, all, all of these, uh, you know, it, it's, uh, Josh is absolutely right.

561
00:42:56,150 --> 00:42:56,850
It depends on the state.

562
00:42:57,010 --> 00:43:02,230
It depends on, you know, is, is the state, you know, looking for a certified system?

563
00:43:02,290 --> 00:43:02,690
Are they not?

564
00:43:02,890 --> 00:43:08,930
I, you know, it's, you know, the way, the manner in which they, they conduct, conduct elections is really up to the state.

565
00:43:09,090 --> 00:43:11,830
We don't have any control over what's said in public.

566
00:43:12,150 --> 00:43:16,970
You know, you know, the, the only thing we can do is, is do our research and make it, uh.

567
00:43:16,990 --> 00:43:18,270
You know, make it available.

568
00:43:31,690 --> 00:43:35,450
So, um, we, we don't actually do the certification at NIST.

569
00:43:35,530 --> 00:43:42,590
The, the, uh, the voting system test laboratories go through, um, the, uh, the, the actual, uh, voting systems.

570
00:43:42,690 --> 00:43:44,790
And there's a series of tests that they run.

571
00:43:44,950 --> 00:43:46,970
The tests are developed by the voting system test laboratories.

572
00:43:46,970 --> 00:43:50,990
Although we provide, uh, guidance into what they should be.

573
00:43:51,070 --> 00:43:55,330
And one of the, the things that the voting system test laboratories do have is access to source code.

574
00:43:55,550 --> 00:44:01,150
And, you know, they, all of the systems that, you know, that undergo that testing, uh, undergo a source code review.

575
00:44:07,050 --> 00:44:13,190
To, to anticipate the next panel, I just wanted to verify a law that doesn't exist in election law.

576
00:44:13,590 --> 00:44:16,770
It is not true that the states constantly,

577
00:44:16,970 --> 00:44:20,670
have control over our election systems and operations.

578
00:44:21,210 --> 00:44:27,170
The U.S. Constitution provides that the states shall, until we left,

579
00:44:27,370 --> 00:44:31,710
Congress chooses to intrude and set color standards.

580
00:44:32,010 --> 00:44:39,230
So, in other words, it is a tradition, which we should rethink and re-evaluate.

581
00:44:39,350 --> 00:44:43,490
And don't you think any time we choose to do our electoral decisions.

582
00:44:43,790 --> 00:44:46,250
So, please, don't keep in mind that.

583
00:44:46,970 --> 00:44:47,630
Oh, thank you.

584
00:44:47,650 --> 00:44:48,590
That's, uh, that's interesting.

585
00:44:48,730 --> 00:44:48,910
Yeah.

586
00:44:48,930 --> 00:44:50,530
So, we'll, we'll wait and see what Congress does.

587
00:44:52,550 --> 00:44:52,950
Sorry.

588
00:44:53,490 --> 00:44:53,890
Um.

589
00:44:54,690 --> 00:44:55,490
I think there's.

590
00:44:55,650 --> 00:44:56,690
Oh, did she call somebody else?

591
00:44:57,170 --> 00:44:58,170
No, I, I didn't.

592
00:44:58,190 --> 00:44:58,390
I.

593
00:44:59,350 --> 00:44:59,750
Okay.

594
00:45:00,190 --> 00:45:01,530
If Mike can reach her, so.

595
00:45:03,330 --> 00:45:03,730
All right.

596
00:45:04,650 --> 00:45:05,050
Okay.

597
00:45:05,150 --> 00:45:11,330
So, since January, uh, the Department of Homeland Security's decision to, um, decide

598
00:45:11,330 --> 00:45:16,470
that election, uh, voting systems, sorry, are critical infrastructure.

599
00:45:16,470 --> 00:45:17,550
Right?

600
00:45:17,790 --> 00:45:21,990
So, January, they decided, okay, voting systems are now critical infrastructure.

601
00:45:22,550 --> 00:45:30,890
How is it that they're critical infrastructure, yet the EAC, the federal entity that oversees

602
00:45:31,420 --> 00:45:40,310
voting systems, has no teeth, in essence, and that some states still do not have to

603
00:45:40,310 --> 00:45:44,470
abide by the voluntary voting system guidelines?

604
00:45:44,470 --> 00:45:52,050
When will the voluntary, the first V in that VVSG be dropped, since we now know that they

605
00:45:52,050 --> 00:45:53,210
are critical infrastructure?

606
00:45:53,470 --> 00:45:59,670
Wisconsin is one of your three states that, in its statutes, says it does not have to

607
00:45:59,670 --> 00:46:04,950
and will not only use certified machines.

608
00:46:05,770 --> 00:46:08,850
So, it's a big issue, and Wisconsin's a swing state.

609
00:46:09,470 --> 00:46:12,850
And they're not interested in changing their voting systems.

610
00:46:13,270 --> 00:46:14,450
They like voting.

611
00:46:14,470 --> 00:46:15,850
They're not having that control.

612
00:46:16,690 --> 00:46:20,250
So, what's your opinion of when we'll drop that first V?

613
00:46:28,290 --> 00:46:31,190
I think, yeah, I think Candace is right.

614
00:46:31,250 --> 00:46:33,150
Talk to your congressman or woman.

615
00:46:33,650 --> 00:46:41,650
Uh, we have no control over, over dropping that, that, you know, that first V. Um, I

616
00:46:41,650 --> 00:46:44,450
haven't really heard serious pro-posals about it.

617
00:46:44,450 --> 00:46:45,910
I haven't heard anything about, about doing that either.

618
00:46:46,230 --> 00:46:49,070
I just haven't heard them, you know, discussed at all.

619
00:46:50,510 --> 00:46:51,710
We've got time for about two more.

620
00:46:57,270 --> 00:47:01,250
I'm an activist.

621
00:47:01,590 --> 00:47:03,550
And I've been doing it for many years.

622
00:47:03,790 --> 00:47:05,630
And I thank you for your presentation.

623
00:47:06,090 --> 00:47:08,170
But I take exception with a few things.

624
00:47:08,390 --> 00:47:08,830
Okay?

625
00:47:09,090 --> 00:47:14,430
I take exception with the EAC when they certify something like virtual voting systems.

626
00:47:14,430 --> 00:47:14,570
Okay?

627
00:47:14,570 --> 00:47:15,350
I go into virtual private networks.

628
00:47:15,510 --> 00:47:17,770
And I go into a court case.

629
00:47:18,050 --> 00:47:24,210
And the head guy of Wisconsin says, has, uh, gee, uh, how, I said, how could you let

630
00:47:24,210 --> 00:47:26,650
these virtual private networks be set up?

631
00:47:26,710 --> 00:47:29,350
Because we know most fraud is done by insiders.

632
00:47:29,470 --> 00:47:29,790
Okay?

633
00:47:29,930 --> 00:47:32,570
One person, and he says, I wasn't me.

634
00:47:32,670 --> 00:47:34,290
It was certified by the EAC.

635
00:47:34,870 --> 00:47:35,350
Okay?

636
00:47:35,470 --> 00:47:40,010
And when you look at those guidelines, okay, you know, when they passed the Help America

637
00:47:40,010 --> 00:47:43,530
Vote Act, there was no security standards until 2005.

638
00:47:43,530 --> 00:47:49,330
Two billion dollars is spent on these crap machines is what they really were.

639
00:47:49,550 --> 00:47:49,890
Okay?

640
00:47:50,030 --> 00:47:55,310
You know, I get very frustrated when an elections administrator says to me, we know it's working

641
00:47:55,310 --> 00:47:56,030
really well.

642
00:47:56,210 --> 00:48:00,150
We did a logic and accuracy test before and after.

643
00:48:00,390 --> 00:48:03,790
Well, I know when that test was done, it probably worked right.

644
00:48:03,990 --> 00:48:10,690
All you've got to remember is Volkswagen, my God, they passed 600,000 tests.

645
00:48:11,130 --> 00:48:12,770
The machine was built.

646
00:48:13,530 --> 00:48:15,690
It's rigged to pass.

647
00:48:16,130 --> 00:48:19,430
You buy a flat screen TV, says it's high energy efficient.

648
00:48:19,670 --> 00:48:19,890
Okay?

649
00:48:20,050 --> 00:48:23,010
You plug in the tester, the screen goes dim.

650
00:48:23,210 --> 00:48:23,710
It cheated.

651
00:48:24,450 --> 00:48:30,210
We need systems that are transparent, trackable, publicly verified.

652
00:48:31,150 --> 00:48:38,610
You know, the stuff that comes out of the EAC just blows my mind of how inept, you know,

653
00:48:38,610 --> 00:48:43,070
I don't think they even had a chair of that committee for what?

654
00:48:43,070 --> 00:48:44,910
Six years or something like that?

655
00:48:45,110 --> 00:48:46,810
I mean, what are we to do, the voters?

656
00:48:47,270 --> 00:48:52,290
To know that we live in a country that makes believe that we're that other country.

657
00:48:52,510 --> 00:48:54,550
We know how fraction magic works.

658
00:48:54,830 --> 00:48:57,170
We know how the systems are set up.

659
00:48:57,690 --> 00:49:02,890
And then to be insulted with these virtual private networks being set up and have somebody,

660
00:49:02,890 --> 00:49:06,750
like I said, in court stand up and said, well, gee, we didn't certify it.

661
00:49:06,830 --> 00:49:07,770
The EAC did.

662
00:49:08,310 --> 00:49:08,950
Thank you.

663
00:49:11,310 --> 00:49:11,950
All right.

664
00:49:13,030 --> 00:49:13,710
Yeah.

665
00:49:14,690 --> 00:49:20,230
So I think everything you just, you know, talked about is sort of really shows the need for,

666
00:49:20,290 --> 00:49:23,230
you know, outside external scrutiny, you know, regularly.

667
00:49:23,610 --> 00:49:26,170
I think that is a powerful force.

668
00:49:26,430 --> 00:49:33,330
This is a large collection of examples of basically outside of scrutiny.

669
00:49:34,890 --> 00:49:41,930
You know, it definitely provides a check against the, you know,

670
00:49:41,930 --> 00:49:42,890
the certification process.

671
00:49:44,930 --> 00:49:45,370
Yeah.

672
00:49:46,150 --> 00:49:47,130
One more question.

673
00:49:47,990 --> 00:49:48,530
Go ahead.

674
00:49:48,710 --> 00:49:49,590
Do you want to just yell?

675
00:49:49,850 --> 00:49:50,290
Yeah.

676
00:49:50,310 --> 00:49:55,270
A lot of people have said that because our collection voting system is so fractured,

677
00:49:55,750 --> 00:49:58,910
in a weird way, that's actually a cause of security.

678
00:49:59,390 --> 00:50:02,610
Because, yes, you have standardized vendors that are going to make the most of the machine,

679
00:50:02,810 --> 00:50:07,870
but the attack vector, somebody searching for attack vector doesn't know what state they're

680
00:50:07,870 --> 00:50:11,830
attaching their app, what security they're running, how they're actually going out, where they're

681
00:50:11,930 --> 00:50:13,450
at in their update process.

682
00:50:14,490 --> 00:50:19,670
If we go through a standardized process, are we creating a perverse chance of decreasing

683
00:50:19,670 --> 00:50:22,290
security by standardizing attack vectors?

684
00:50:25,890 --> 00:50:26,750
Good question.

685
00:50:26,910 --> 00:50:27,170
Yeah, yeah.

686
00:50:27,650 --> 00:50:33,150
So the actual standards that we're going to be, you know, making are basically, you know,

687
00:50:33,150 --> 00:50:34,290
going to be vendor agnostic.

688
00:50:34,450 --> 00:50:39,190
And so any number of vendors can, you know, submit their systems for certification.

689
00:50:39,690 --> 00:50:41,910
And so, you know, we would still have that.

690
00:50:42,890 --> 00:50:46,710
You know, you know, you know, that nice diversity.

691
00:50:48,090 --> 00:50:48,790
Yeah, yeah.

692
00:50:55,990 --> 00:50:56,830
Yeah, yeah.

693
00:50:57,050 --> 00:51:01,410
I mean, I do like the, you know, voting system diversity.

694
00:51:01,710 --> 00:51:03,890
I do think it is a serious boon.

695
00:51:04,010 --> 00:51:08,950
But, I mean, if you look on the Internet, I mean, you're going to be able to find operating

696
00:51:08,950 --> 00:51:11,910
system versions in patch levels and all that kind of stuff.

697
00:51:11,930 --> 00:51:14,550
And so I just don't want to put too much emphasis on that.

698
00:51:14,690 --> 00:51:20,430
I think, I think things like software independence and regular meaningful audits are a much more

699
00:51:20,930 --> 00:51:27,230
stronger security mechanism to make our, you know, overall system more secure, to be honest

700
00:51:27,230 --> 00:51:27,470
with you.

701
00:51:28,390 --> 00:51:28,950
Yeah, yeah.

702
00:51:31,090 --> 00:51:33,830
So one more thing after these guys wrap up.

703
00:51:33,910 --> 00:51:34,810
I do want to give them a round of applause.

704
00:51:35,030 --> 00:51:41,530
But so we've already had our first two successful breaches in the voting village.

705
00:51:41,530 --> 00:51:45,250
A win vote was wirelessly hacked with remote access already.

706
00:51:45,610 --> 00:51:48,890
And an e-poll book internal data structure was already hacked.

707
00:51:48,970 --> 00:51:50,750
And that was about 20 minutes ago.

708
00:51:50,870 --> 00:51:53,930
So an hour and 40 minutes in and we've already got our first two successful hacks.

709
00:51:54,650 --> 00:51:55,630
So, all right.