Thank you, everybody.
So our next speakers are from NIST, which is the National Institute of Standards and Technology.
These are the folks who help set national standards for a whole host of things, in this case elections.
And so we've got both Mary Brady, who's the voting program manager and works on voting-specific standards and things like that,
and Josh Franklin, who is a security engineer at NIST and works on security-related things.
Including voting.
And with that, I'll turn it over to you guys.
Okay.
Thank you, everybody.
I'm also – I like to roam, so I can't actually speak in front of a podium.
But I just want to say thanks to the organizing committee for inviting us to give this presentation.
I'm really not going to say much other than I'm really excited to be here.
I'm looking for meaningful ways to engage.
I'm really excited to be able to engage with the cybersecurity experts here.
Josh will talk a little bit about some public working groups that we've established at NIST, one of them on cybersecurity.
Some of you I know are already members of that group.
We sure could use a lot more help.
I'd be interested in some of your thoughts about meaningful ways in which we can engage with the community.
And we're here to tell you a little bit about the work that we're doing, get some feedback from you, and look for ways to learn from the community.
With that, let me hand it all over to Josh.
Are you roaming?
I guess I'll roam.
Born to roam.
Howdy, everyone.
My name is Joshua Franklin.
Welcome to Hacker Summer Camp.
It's been fun so far.
Today I'm going to talk a little bit about my experiences in the election community for the past 10, 12 years.
A lot of people have been asking me about my experience in the election community.
A little bit about how we got here, where we are going.
First off, I'm going to start with this slide.
There was a man named Dr. Joseph Harris back in 1934.
And he was basically looking at how elections are run in the U.S. back then.
And he actually found these various election fraud types, as he called them.
And it's really interesting looking at this list.
Because we're still really, really worried about many of these issues today.
We have, since 1934, learned a little bit about how computers work.
And we've introduced e-voting.
And what we've really seen is that now we have these same issues, but also modern electronic analogs to some of these same things.
And so keep these in the back of your mind.
As we go through some of this.
So, who am I?
Josh Franklin, IT security engineer at NIST.
I typically do enterprise mobility, LTE security.
I also do electronic voting.
I've been in this area since probably 2004, working in voting off and on.
I currently co-chair the NIST election committee.
The NIST EAC election cybersecurity working group.
Prior to NIST, I was working at the U.S. election assistance commission.
Helping to test and certify voting systems.
I got to travel the U.S. and really understand what the elections landscape looks like there.
Previous to that, I was working at KSU's center for election systems.
In Georgia.
Learned a lot of things there.
Helped install and maintain probably 22,000 voting systems there.
I have been a poll worker in more states than anyone, I think, has.
And I will keep saying that until someone proves me otherwise.
So, yeah.
And I have a master's in infosec from Mason.
So, you know, get to know it.
Get to know an agency.
What big federal agencies are out there?
Believe it or not, the federal election commission has little to no role to play here.
They are primarily focused on campaign finance law.
The election assistance commission is what you really want to be looking at here.
They are charged with providing.
Providing assistance to local election officials.
Adopting the voluntary voting system guidelines.
And running a testing and certification program for U.S. voting machines.
NIST is in this space.
We provide the scientific and engineering backing for the voluntary voting system guidelines.
DHS is a brand new entrant into this area.
They are basically helping local and state election officials with cyber related issues.
And then, of course, the good old FBI.
They essentially prosecute domestic election crimes.
At the state level, you have the secretary of state's office.
They are primarily the lead election officer.
First and foremost, deciding how elections are run.
In their given state or territory.
They are typically third in line in session in a state.
So it's a fairly powerful elected position.
And then at the local level, this is where basically elections are actually run.
You have counties, cities, townships, parishes, hamlets.
All these different really small geographical entities.
That really, you know, actually know how elections operate.
Because they actually do them.
So it's a little bit blurry.
That wasn't just my pencil.
On the right side, we actually have, you know, the voting machines that we all know and love.
DREs, op scans, ballot marking devices.
These are the voting systems that are actually in the voting hacking village.
I was planning on putting them in.
I'm pointing at them right now.
But they're not here.
So we have in the top right, we have DREs.
These are, you know, basically voting systems that store ballot selections electronically.
We have optical scan systems which, you know, read paper, you know, paper ballot selections.
Typically Scantron machines.
But, you know, modern ones are actually using computer vision algorithms to, you know, figure out what's at, you know, what's a vote.
And then we have ballot marking devices.
These are a nice hybrid between the two systems.
They actually have a touch screen interface.
Extremely usable.
But they also have nice security properties of, you know, actually printing out a paper ballot.
On the left side are basically all these other supporting election systems.
These are things that there are not really best practices.
And guidelines and standards about.
But they're, you know, they're very, very instrumental in the election process.
You have, you know, local and online voter registration systems.
Electronic poll books.
These are the things that you'll, you know, check in with at your polling place.
You have candidate filing systems.
If you're going to, you know, run for governor, you have to file your information with your state at these candidate filing systems.
There's, you know, also ballot tracking.
There's poll worker tracking.
There's just a whole slew of other supporting election systems.
Here you also have, you know, campaign voter information databases.
These are, you know, fairly large scale, you know, information and data collection, you know, efforts.
And they're actually holding a lot of really interesting information about all of us.
And so when we're, you know, thinking about curing the election eco, you know, ecosystem, we actually need to have a larger pallet there.
This is just for people reading these slides later.
Cool.
So Mapblaze is right.
We, you know, our whole threat model has changed since the, you know, 2016 general.
Previously we had a threat, a threat model that would, you know, at least election officially.
There was a threat, a threat model about, you know, physically proximate attackers.
In terms of intelligent adversaries, they're extremely worried about poll workers.
Poll workers are the, you know, one of the nation's largest temporary workforces.
And, you know, poll workers aren't necessarily vetted.
They, you know, to the degree that you would want.
They often have privileged systems.
They have access, passwords, and they have time to actually play around with these systems.
Election officials are also extremely worried about accidental errors and, you know, events such as that.
These are the things that more often than not will actually lead to an election, sorry, to an incorrect election outcome.
So elections officials are extremely worried about accidental errors.
Natural disasters such as the 2012 hurricane Sandy, I think it was 2012,
that happened on the, you know, east coast.
Definitely affected elections there.
And just, you know, any real event that would, that would impact public confidence and trust in the election system.
But since 2016, we, you know, we got the intelligence community report about, you know, meddling in our, in our elections.
And what we're, you know, what we actually have evidence of now is basically, you know,
basically nation state attackers, you know, hitting our election systems.
We haven't yet seen attacks against vote capture and tabulation systems.
At least, you know, documented by the IC.
But, yeah, we also saw issues of phishing of both election officials and voting system vendors.
And the new threat model is really everything in the old threat model plus cyber.
Right?
Yeah, so what do these voting systems actually look like?
They are, you know, embedded legacy systems.
That's how I would, you know, talk to someone about them today.
They are typically running some Unix or Linux variant.
They might have a custom kernel for some reason.
Some of them are, you know, running Windows CE 3.0.
That's what was run in Georgia when I was there.
Some of them have really old, you know, and proprietary physical media.
I am 30.
I should not, like, I should not know what a PCM CIA card is.
But I do.
You know, that could be a problem there.
You know, so networking, wireless is a fairly common phenomenon.
Infrared, Bluetooth.
Wi-Fi, cellular.
Those are definitely things deployed in U.S. voting systems.
And these things are basically needed to last for a long time.
Many states are still using systems purchased in 2002.
And there's not really a clear upgrade path there.
And these systems really receive one to five updates over that whole lifetime.
And these, you know, these updates are extremely expensive when they have to update.
I, like, for my first real, you know, job when I wasn't a student assistant anymore at KSU,
I was, you know, basically made to go and physically insert a PCM CIA card into 6,000 touch screen units
across the state of Georgia to update an expired X.509 cert.
Yeah.
And it was really interesting.
I got some stories from that.
I'll just stop there.
I'll say that.
So, you know, now that we've talked about what these, you know, what these systems actually look like,
what sort of issues have we seen previously?
You can look at some of the sources for our results at the very back of this.
I will tweet out these slides after this presentation.
But, you know, Barbara and David were, you know,
talking about these independent systems.
independent reviews that we saw of these, you know, of US voting systems.
And it's really 15 to 20 independent reviews since probably 2004.
So it's actually not a lot of outside scrutiny.
And what NIST did recently is we went through all these different papers,
did a, you know, a literature review
and looked at some of
of the various issues there and we then mapped them to common
weakness enumeration types which is basically a standard for
software bug types, go figure NIST like standards, right? And
so these were the top five software bug types that we saw.
These were fairly common issues, I would say very, very common
issues in the papers that we reviewed. And then just to up
level them a little bit, we basically saw a lot of input
validation issues, you know, crypto and authentication. So
it's, you know, everything's not on fire, right? There are, you
know, good things happening in the voting arena. Risk limiting
audits. There have been really I would, you know, go as far to
say that this is the single best innovation we've had in election
security since the year 2000. These are really meaningful
statistical audits that are fairly efficient. They can be
very, very practical and don't have to be extremely expensive.
And so they can give an election official pretty good confidence in the election. You can say no, but
election outcome without spending tons of money and time. Software independence. This is a
concept championed in 2007, 08. Basically meaning that a bug in the software can't affect
the election outcome. There's a better way to say it. But practically right now this means
paper. Paper voting systems. But this is the up level concept that's more what desirable
characteristics do we actually need in voting systems. There are proposals for completely
software independent fully electronic voting systems. These are called ETE verifiable
cryptographic protocols. These are really cool systems that have a lot of different
applications. They have not really been used on large scales yet. But they essentially give a
voter a receipt that guarantees them that their vote was included in the final tally. But they
can't sell their vote with that receipt. So it's really cool. Essentially domain specific crypto.
These things have been, they've been used in coma park, Maryland and a couple other areas. It's
definitely arguing about what constitutes this type of system. But it's definitely a really
interesting research area and potential path forward. And then finally recognition of usability
as a security issue is a big, big problem. It's sort of a new thing in that, you know, the
community finally said, well, you know what, if it's not usable, availability drops to zero. So
that can definitely affect the outcome. Well, at least the security of the voting system. And so
NIST really likes software ND pendants. We are including it in our recommendations for, you
know, principles and guidelines for voting systems. But, you know, paper itself is not a panacea
in elections. There are a number of physical security oriented issues that can really affect the
election outcome. You know, paper primarily gives you tamper detection and auditability which is
awesome. It's super, super great. But, you know, paper can be modified. It's a very common thing
for a long time for whoever is counting ballots to put a little piece of lead underneath their
fingernail. And if there's not a filled in, you know, bubble, fill in that bubble real, real fast.
There are just, you know, non-cyber security related issues. Seals and chain of custody need to be
verified. If you're not going to actually look at the paper trail, why have it? This routine, you
know, meaningful audits need to be performed. You can't just have paper. You have to actually do
something with it. And then, you know, just generally we need to, you know, up the level of
яла in this area. I'm doing pretty good on time. Okay. Testing and certification, what does
this process look like? Basically the election assistance commission runs a, a testing and
certification program for voting systems. There are, there are multiple layers of testing and
certification. The, the EAC performs a, a federal certification and then states have the full
do their own testing for their own needs. Some states have
rules that are like you should be able to click straight
ticket. The whole system then selects all D or all R. But
then you should be able to choose one other person in the
other area. It's like the Pennsylvania cross vote is what
people call it. And there's just tons of state specific voting
logic issues that states are testing for. What does this
actually look like? This is at a high level. Vendors submit an
application to be tested. The EAC, a third party lab and then
the manufacturer sit down. They figure out essentially a testing
contract. That's a test plan. Testing occurs. And then the
company is going to test the testing. If there are issues,
I've never seen a testing campaign that doesn't have at
least one issue, the vendor goes back and makes a change and then
it gets tested again. There's a test report. The EAC says, yes.
I would like to certify no I don't want to certify. If they do
certify then a voting system is going to be established. If they
system goes into their quality monitoring program where states and labs and manufacturers
and everyone gives EAC information about how that performance, how that system is
performing in the field. Yeah, I'm going to go back a slide for a second and say if you're
really interested in knowing more technical information about voting systems, EAC.gov is
literally the best place. They have a test plan and test reports section and they have
information on new voting systems that aren't really out there yet. A lot of the systems that
EAC has certified, at least to the newer standards, aren't necessarily deployed in the field
yet or if they are, it's only in limited areas. But this is an excellent resource that they're
doing a serious boon for this community.
In terms of voting standards, the voluntary voting system guidelines, awesome name for a
standard, right? VVSG. These standards are primarily for vote capture and tabulation
systems. So nothing about voter registration, nothing about electronic poll books, election
night reporting. There is no federal law mandating that every system come apply with these
standards. I just.
There just isn't. The way elections work in the U.S. is that it's, you know, typically the, you
know, time and manner of choosing is left open to states. And so that's the same here in that
states can use completely federally certified systems, systems that are only, you know,
partially certified. There are, you know, there's tons of variations out there. In terms of security,
well, just in general, these are the, you know, various voting standards as I see them. The 1990 VSS
and 2002 voting system standards, these things were made not necessarily by the federal
government. And it wasn't until the election assistance commission was created in 02, I think,
that, that, you know, we actually got the modern VVSG, you know, we actually got the modern VVSG
and the modern VVSG has a whole section on security. Didn't really even have that previously that
much. And there's been large changes in security as, as new standards have been made. But most
systems in the U.S. are still certified to the 2002 VSS or 2005 VVSG. And it's mostly 2002 VSS.
In 2007 NIST made some recommendations for, next generation voting systems. There's a really
robust security architecture that was recommended because of some various issues such as software
independence and penetration testing. Those were not eventually adopted. And so, what folks did,
is they took parts out of the 2007 and parts out of the 2005, smushed them together and got
the 2015. And so yeah, that's the most recently adopted standard. NIST and EAC right now are
actually working on a complete, you know, it's basically a completely different way of
looking at election standards and we're, you know, basically having, you know, it's, you
know, it's basically driven by, you know, outside input by, you know, voters and concerned
citizens and we're, you know, putting together these next generation requirements. This, you
know, this new structure is going to have principles, guidelines, requirements and test
assertions. Principles and guidelines are ultimately going to be what's adopted by the
federal government and then the requirements and test assertions are going to be a little
more malleable because what we've really seen is that, you know, there's been a lot of changes
and sometimes folks get really locked into certain requirements and it doesn't really help to be
locked into requirements from five or ten years ago. From a security perspective, I'm, you
know, I'm co-chairing this working group on, you know, in this area. These are the seven high
level principles that we have listed. Each of these has a number of, you know, sub-guidelines.
They're all available at the NIST and EAC voting Twiki. A couple of things I'll sort of point
out. Under auditability, which is the single most important principle that the whole group felt
really, really strongly about, software independence is included under that. Under
access control, we have things like, you know, two-factor authentication for privileged
election operations. For data protection, we have, you know, using well, well vetted, publicly
available, you know, in standardized crypto, which is really, really nice. For software
integrity, which we're changing to system integrity, we have, you know, things like only
digitally signed code can actually run on a voting system. If you want to know more about the
system, if you want to talk about these later, I'll be, I'll be, I'll be around. So just to, you
know, before we get to questions and stuff, these are some of the big things that I think really
need to be addressed. We need to routine meaningful audits. I think that is a really
important concept that needs to be enshrined here. We need regular external scrutiny of voting
systems. It is absolutely key. You know, the more folks, you know, the more, you know, the more
people who can take a look at these, I am of the opinion, the better. But when folks do find
issues, there needs to be responsible vulnerability disclosure, do not release a freaking zero day a
week before the election. Just don't, don't, you know. There are, you know, there are well
known, well, I mean, essentially if you have issues, if you find an issue, talk to the EAC, talk to DHS,
and yes, if you want to make my, you know, Monday morning bad, you can send it to me, too. That's
perfectly fine. So I think that we need to augment how we, you know, really manage election
security. I think risk assessment threat modeling, contingency planning need to be common terms
for, for elections officials. And I think that, you know, they need to be pretty, you know, pretty
knowledgeable in these, you know, in these concepts. Voting systems are a very important tool. You know,
voting systems need regular software updates, just like, just like anything. We need to figure out
how to get voting systems regular software updates. I think it is untenable to have voting, voting
systems with, you know, CVSS score 10, right, with, you know, 50 of those on a voting system.
That is just, that's just, you know, unacceptable. We need to find a way how to fix that. And
then election officials need actionable guidance. You can't, you know, you can't just, you know,
you can't just go yell at them and say do this, do this. It's not really going to help any, you
know, any, any body. They need to, you know, like, they need guidance in the language that they
speak. And so you have to help speak their, their, their language. They are typically not
cyber security experts. Election officials are, you know, basically low just champions. They do a
really complex operation. And I think that's, I think that's, I think that's, I think that's a
big thing. Again. So, in the sense that, it's, it's a really, really big question question.
And it really, really important when you have to, you know, show the, the, the, you know,
the strong suitability you have to be able to say, you know, you can't, you can't, you can't
do that. I think that's, that's, that's, you know, that's art. That's, that's really important.
And then, you know, eventually, it all of a sudden, you know, the, the, the, you know, a
thing that I really do see is, you know, it takes a lot more than just the impact of a full
foreign election. If anybody has any sort of, you know, development plan, you know, you сво
how you can affect change in your local area.
And local elections are the elections that will actually have an impact in your life
in a fairly large way, fairly quickly.
Work with your election official, not against them.
Don't antagonize them. Help out.
Be a force for good.
And then just completely in a self-serving manner, join these public working groups.
We're fairly nice people.
Yeah, so thanks, everyone.
Mary and I are here for questions.
Hello.
Yeah, definitely.
Yeah, so the question was?
You mentioned joining public working groups to help local election officials.
If you could tell us how to access those.
So are you bringing up the reference?
So there's a set of seven working groups.
There's three election groups.
There's for pre-election, election, and post-election.
And there's four, we call them constituency groups,
because they're there.
There's a set of seven working groups.
They're sort of help support the elections,
but they're human factors to usability, accessibility, cyber security,
interoperability, where a lot of the common data format work
is being played out, and testing.
So you can follow a link that maybe is not coming up,
or the easy way would be to go to vote.nist.gov,
and there's a link off of that page to the working groups,
to the Twiki itself.
And on there, there's information about how to set up an account
and how to vote.
And there's information about how to actually join the mailing lists.
And there's a bunch of pretty simple videos that you can follow.
And if you have any questions, just ask us.
Are you guys allowed to share the link?
Yeah, yeah, definitely.
I'll tweet them out in a moment.
Yeah, I was going to say, we'll post them on Twitter.
Cool.
Right here.
Thank you.
So how are you addressing resiliency in terms of just,
just maintainability and continued function as a security threat,
and how you're setting up the standards,
or how you're looking at these things?
Because it seems like there's going to be a bigger threat from DDoS
by device failure in elections than there is from actual tampering with machines.
We encountered a lot of that in the last election in Maryland,
where many of the optical scanners died during the election,
and votes were left piled up.
And in some places, there's a lot of that.
Some cases unattended while voting machines, the scanners weren't working.
So how do we address the actual ease of operation
and continued use as part of the security model
in putting these standards together?
Yeah, that's a great question.
So we do have a maintainability-oriented principle
that is going to be in, you know,
like we only saw seven.
Of the actual principles,
there's a whole list of other principles as well.
A lot of, you know, the answers there are, you know,
going to be about build quality, quality assurance.
There are, you know, programs that the EAC has,
you know, looking into quality assurance areas.
But some of that is going to be on the election official themselves
to make sure that they're taking, you know,
good care of their election system.
I definitely think that, you know,
manufacturers play a role there as well
in, you know, not using, you know,
bottom of the barrel components.
I, you know, personally think I'm a, you know,
I'm a big fan of COTS in voting systems,
commercial off the shelf.
You know, I would be pretty,
I would be a pretty big fan of like a non-networked voting system,
you know, running on like a, you know,
tablet or Raspberry Pi that just prints a ballot right there.
And, you know, that way if the actual voting system breaks down,
you can just go, you know, buy another one at Staples or something.
Yeah, that's, you know, resiliency and maintainability
are really important questions.
Somehow these systems are still working for the most part since 2002.
Always kind of, yeah, it is kind of amazing.
Hope that helps.
Thank you very much.
Two very quick questions.
Number one, are any of the efforts to update the VVSG
going to take into account not just voting systems
but also non-voting systems?
No? Okay.
Is EAC planning to address that issue as well?
So the databases and the election management systems?
I can't, I can't talk to the EAC.
Is NIST?
As of right now, we are focused on vote capture.
Okay.
And then to the extent that a lot of people,
a lot of counties just aren't going to be able to replace their machines,
is the problem that we cannot technically update these software systems
or is the problem that we just don't do it?
There you go.
Do you want to take it?
I can take it.
Okay, yeah, I mean.
I mean, there's not really anything in the VVSG.
Yeah, there's, yeah, updating voting system software.
I mean, it is, so it costs sometimes over a million dollars
to get a voting system certified.
Yes, and so if even one software update occurs,
then there needs to be a new certification process.
Now, the second layer certification process,
that second order process doesn't have to be a full million dollar process.
Typically, it can be really, really small.
I think that the,
that the EAC has gotten those done in like two or three months in my,
in my experience.
But then local election officials would have to pay for those software updates typically.
You know, folks want you to, you know,
buy the, you know, latest version of your, you know, of an app sometimes, right?
I mean, that's a very common thing.
And just elections aren't the most well-funded operations.
Let me just add a little bit to that.
The EAC, prior to embarking on this effort to update the voluntary voting system standards,
led a group of, led a group of folks that came up with some principles moving forward,
not to be confused with the principles and guidelines.
And, you know, one of the areas that they really do want to figure out, you know,
what to do about is how can we, you know, update the software.
So it's in our minds.
We don't yet have a solution because,
it's, you know, we really sort of have to look at the testing process
and how it would feed into the testing process and how much it would cost and,
you know, like, how can this all work?
So if you have ideas, we're certainly, you know.
Thank you.
The voting is the, is the domain of the states by constitution.
So the best that NIST can do is to set standards, correct?
Is to set standards.
And then the federal government can provide to the states money to assist the voting system, correct?
Am I talking into the mic?
Okay.
Okay.
Okay.
I just wanted to ask, though, you may not want to be speaking on behalf of NIST,
but could you sort of share with us what your ideal,
what your ideal voting system would be, given the constitution,
the way that the state, the voting works in this country,
and also part two of that, maybe not speaking for NIST again.
Do you think that there has been widespread voter fraud, voter registration fraud?
Okay.
So for my ideal voting system, I'm going to have to say I'll see you after class
because that hasn't been approved by NIST management.
Happy to talk to you out there.
Okay, so it was a multi-part question.
Now, you're absolutely right.
I mean, it's up to the states to determine whether or not they want to adopt the VVSG,
and this is normally handled within the legislation within the state legislature.
So some states, you know, require certification to require the use of certified systems.
Some require the use of systems that are certified by lab, but not necessarily by EAC, that are TAC,
tested by lab and certified, but not necessarily by the EAC.
Some require you to, the certification to the VVSG,
and they might run their own state-sponsored programs to do that.
So you're absolutely right.
I mean, we can set the standards, you know, but, you know,
but we can't necessarily impose them, you know, on the states.
I'm not really sure what to say about my ideal voting system
because nothing's been approved by my management either, and I don't, I can't really comment on voter fraud.
I mean, it's sort of kind of outside our, our area of expertise and the things that we look at, but, uh...
I think I can just yell at the microphone and we'll reach it.
Sure.
Um, you've outlined some really good principles here.
You've got, uh, patches and clients of open source, uh, you know, general public compliance,
but if the states are not required to use them, if the states don't have to do anything,
why does it matter at all?
And how can we force them?
How can we force them to have some model of compliance?
What needs to be based on this?
So, uh, let me just say that although the states are not required to use, uh, there, there was some, uh,
recent study done by, uh, NCSL, the, and I always forget what that stands for,
the National Council of, Conference of State Legislatures, that, uh, indicates that 47 out of the 50 states do,
uh, actually, uh, adhere to one of those areas, either, you know, use, either certified systems, certified by lab,
or, you know, to the VVSG, or, or, uh, somewhere, you know, even if they don't use those words,
they use other words that, you know, that imply it.
Uh, so I, I, I do think that, uh, the majority of the states do actually want help.
They're looking for help.
They're looking for advice.
Uh, certainly there, there were quite a number of them that, uh, that voluntarily signed up for, uh,
for some of the cyber hygiene services that were, uh, that were available via DHS.
So I, I, I think they're listening.
They, they, you know.
They're, I mean, the election officials don't want to be hacked.
They, they want to, the elections to be secure.
They, they, they, they want to be assured that the integrity of, uh, of the election is, is, you know, is, is certainly, uh, withheld, you know.
Can you yell as well?
Yeah.
Sure.
Um, so in the public statements, we've been hearing about the security of money systems,
but we've been hearing over and over again that they're not connected to the internet,
or they're secure, and they can't be hacked.
And you talked about wireless and other connectivity.
Um, now, so that's, so just ignoring a stuffnet type of task, you, there's also acknowledgement of other types of connectivity,
even if you, uh, cellular, if you bleed over to the, you know, to an, uh, an internet connection,
which is common these days.
So can you square that circle for me?
Or can you be squared?
Uh, we, what exactly are you trying to square there?
I mean, like, uh, I don't think we've...
I mean, we've heard a couple comments about this not being connected to the internet.
Have we said that?
No, no, no.
Oh, okay.
I'm not saying it, I'm not saying it, I'm sorry.
No, it's fine, no, no, no.
I'm not saying that the public statement is not connected to the internet.
Yeah, I mean, so we can be, I mean, so, you know, an air gap is definitely a, you know, powerful, you know, mitigation, right?
For preventing remote attention.
Um, yeah, I mean, uh, states are, you know, going to have to make that sort of choice themselves.
Uh, then, you know, if they actually want to have wireless or, you know, wired, you know, networking at all.
That's going to be a choice up to them.
Um, hmm, I mean, yeah.
I, I, I'm not really sure what you're looking for us to say.
I, I mean, I, I guess what you're saying is on the one hand there, there are public comments saying that we're not connected.
And we're standing here in person.
I'm just referring to you saying, you know, you got all of this.
You know, it, uh, uh, yes, I, I mean, all, all of these, uh, you know, it, it's, uh, Josh is absolutely right.
It depends on the state.
It depends on, you know, is, is the state, you know, looking for a certified system?
Are they not?
I, you know, it's, you know, the way, the manner in which they, they conduct, conduct elections is really up to the state.
We don't have any control over what's said in public.
You know, you know, the, the only thing we can do is, is do our research and make it, uh.
You know, make it available.
So, um, we, we don't actually do the certification at NIST.
The, the, uh, the voting system test laboratories go through, um, the, uh, the, the actual, uh, voting systems.
And there's a series of tests that they run.
The tests are developed by the voting system test laboratories.
Although we provide, uh, guidance into what they should be.
And one of the, the things that the voting system test laboratories do have is access to source code.
And, you know, they, all of the systems that, you know, that undergo that testing, uh, undergo a source code review.
To, to anticipate the next panel, I just wanted to verify a law that doesn't exist in election law.
It is not true that the states constantly,
have control over our election systems and operations.
The U.S. Constitution provides that the states shall, until we left,
Congress chooses to intrude and set color standards.
So, in other words, it is a tradition, which we should rethink and re-evaluate.
And don't you think any time we choose to do our electoral decisions.
So, please, don't keep in mind that.
Oh, thank you.
That's, uh, that's interesting.
Yeah.
So, we'll, we'll wait and see what Congress does.
Sorry.
Um.
I think there's.
Oh, did she call somebody else?
No, I, I didn't.
I.
Okay.
If Mike can reach her, so.
All right.
Okay.
So, since January, uh, the Department of Homeland Security's decision to, um, decide
that election, uh, voting systems, sorry, are critical infrastructure.
Right?
So, January, they decided, okay, voting systems are now critical infrastructure.
How is it that they're critical infrastructure, yet the EAC, the federal entity that oversees
voting systems, has no teeth, in essence, and that some states still do not have to
abide by the voluntary voting system guidelines?
When will the voluntary, the first V in that VVSG be dropped, since we now know that they
are critical infrastructure?
Wisconsin is one of your three states that, in its statutes, says it does not have to
and will not only use certified machines.
So, it's a big issue, and Wisconsin's a swing state.
And they're not interested in changing their voting systems.
They like voting.
They're not having that control.
So, what's your opinion of when we'll drop that first V?
I think, yeah, I think Candace is right.
Talk to your congressman or woman.
Uh, we have no control over, over dropping that, that, you know, that first V. Um, I
haven't really heard serious pro-posals about it.
I haven't heard anything about, about doing that either.
I just haven't heard them, you know, discussed at all.
We've got time for about two more.
I'm an activist.
And I've been doing it for many years.
And I thank you for your presentation.
But I take exception with a few things.
Okay?
I take exception with the EAC when they certify something like virtual voting systems.
Okay?
I go into virtual private networks.
And I go into a court case.
And the head guy of Wisconsin says, has, uh, gee, uh, how, I said, how could you let
these virtual private networks be set up?
Because we know most fraud is done by insiders.
Okay?
One person, and he says, I wasn't me.
It was certified by the EAC.
Okay?
And when you look at those guidelines, okay, you know, when they passed the Help America
Vote Act, there was no security standards until 2005.
Two billion dollars is spent on these crap machines is what they really were.
Okay?
You know, I get very frustrated when an elections administrator says to me, we know it's working
really well.
We did a logic and accuracy test before and after.
Well, I know when that test was done, it probably worked right.
All you've got to remember is Volkswagen, my God, they passed 600,000 tests.
The machine was built.
It's rigged to pass.
You buy a flat screen TV, says it's high energy efficient.
Okay?
You plug in the tester, the screen goes dim.
It cheated.
We need systems that are transparent, trackable, publicly verified.
You know, the stuff that comes out of the EAC just blows my mind of how inept, you know,
I don't think they even had a chair of that committee for what?
Six years or something like that?
I mean, what are we to do, the voters?
To know that we live in a country that makes believe that we're that other country.
We know how fraction magic works.
We know how the systems are set up.
And then to be insulted with these virtual private networks being set up and have somebody,
like I said, in court stand up and said, well, gee, we didn't certify it.
The EAC did.
Thank you.
All right.
Yeah.
So I think everything you just, you know, talked about is sort of really shows the need for,
you know, outside external scrutiny, you know, regularly.
I think that is a powerful force.
This is a large collection of examples of basically outside of scrutiny.
You know, it definitely provides a check against the, you know,
the certification process.
Yeah.
One more question.
Go ahead.
Do you want to just yell?
Yeah.
A lot of people have said that because our collection voting system is so fractured,
in a weird way, that's actually a cause of security.
Because, yes, you have standardized vendors that are going to make the most of the machine,
but the attack vector, somebody searching for attack vector doesn't know what state they're
attaching their app, what security they're running, how they're actually going out, where they're
at in their update process.
If we go through a standardized process, are we creating a perverse chance of decreasing
security by standardizing attack vectors?
Good question.
Yeah, yeah.
So the actual standards that we're going to be, you know, making are basically, you know,
going to be vendor agnostic.
And so any number of vendors can, you know, submit their systems for certification.
And so, you know, we would still have that.
You know, you know, you know, that nice diversity.
Yeah, yeah.
Yeah, yeah.
I mean, I do like the, you know, voting system diversity.
I do think it is a serious boon.
But, I mean, if you look on the Internet, I mean, you're going to be able to find operating
system versions in patch levels and all that kind of stuff.
And so I just don't want to put too much emphasis on that.
I think, I think things like software independence and regular meaningful audits are a much more
stronger security mechanism to make our, you know, overall system more secure, to be honest
with you.
Yeah, yeah.
So one more thing after these guys wrap up.
I do want to give them a round of applause.
But so we've already had our first two successful breaches in the voting village.
A win vote was wirelessly hacked with remote access already.
And an e-poll book internal data structure was already hacked.
And that was about 20 minutes ago.
So an hour and 40 minutes in and we've already got our first two successful hacks.
So, all right.