1
00:00:00,000 --> 00:00:07,480
All right, so the next section is how do we get here history of voting technology hanging chads and help America vote act

2
00:00:08,660 --> 00:00:09,640
Matt blaze

3
00:00:10,740 --> 00:00:15,000
Cryptographer and associate professor of computing and information science at the University of Pennsylvania

4
00:00:17,700 --> 00:00:18,660
We'll take it from here

5
00:00:21,960 --> 00:00:25,460
So welcome congratulations on lasting this long

6
00:00:27,380 --> 00:00:32,280
So I'm going to step back a little bit. So a little bit about me. I'm a

7
00:00:32,280 --> 00:00:39,620
computer scientist I focus on computer security and cryptography stuff and I've been working

8
00:00:40,620 --> 00:00:41,860
partly on

9
00:00:41,860 --> 00:00:44,560
voting technology and other kinds of

10
00:00:44,560 --> 00:00:46,380
related systems

11
00:00:47,180 --> 00:00:48,660
probably for about a dozen

12
00:00:48,660 --> 00:00:50,580
years now and

13
00:00:50,580 --> 00:00:52,560
one of the things that

14
00:00:52,560 --> 00:00:55,440
I've been very lucky enough to do is that I've been working on

15
00:00:55,460 --> 00:00:57,100
is participate in

16
00:00:57,100 --> 00:00:59,440
several of the state

17
00:00:59,440 --> 00:01:06,620
top-to-bottom reviews of voting technology that were done ahead of the 2008 election where a

18
00:01:07,640 --> 00:01:14,180
few people were given access to the source code and the hardware and so on of the most of the

19
00:01:14,660 --> 00:01:22,860
electronic voting systems discovered in the country and we were asked, you know, our task was to basically say are these things secure and

20
00:01:23,660 --> 00:01:25,440
the first question you ask is

21
00:01:25,440 --> 00:01:29,060
You should ask when given that task is

22
00:01:29,920 --> 00:01:31,580
Well, what's secure me?

23
00:01:31,720 --> 00:01:36,340
What what are the requirements of this system that we're trying to measure against it?

24
00:01:36,460 --> 00:01:41,240
And so for a voting system one question at a very high level is

25
00:01:41,920 --> 00:01:48,760
What are the requirements for a voting system? That is how do you tell if a voting system is serving?

26
00:01:49,120 --> 00:01:54,840
Democracy whatever that means and as far as I can tell the requirements

27
00:01:55,440 --> 00:01:55,880
for a

28
00:01:56,640 --> 00:01:58,760
democracies voting system is

29
00:01:59,400 --> 00:02:04,800
These four words right one person one vote. Where do these four words come from?

30
00:02:05,440 --> 00:02:07,540
These are in the Constitution, right?

31
00:02:08,540 --> 00:02:10,940
for the Declaration of Independence or

32
00:02:11,680 --> 00:02:14,900
Something no, who knows it's a slogan, right?

33
00:02:15,840 --> 00:02:19,000
So one person one vote. What does that actually?

34
00:02:19,800 --> 00:02:25,140
Mean and that's a good question. So first of all voting for what right most of?

35
00:02:25,440 --> 00:02:28,900
Most of our voting is for officials rather than

36
00:02:29,540 --> 00:02:35,180
Issues, although in California you are asked to make about six thousand decisions about

37
00:02:35,940 --> 00:02:41,740
Various initiatives that's kind of an exception. Mostly. We're asking other people to make our day-to-day

38
00:02:42,520 --> 00:02:47,460
governmental decisions for us and that's who we're voting for but even those officials are appointing other people

39
00:02:48,160 --> 00:02:54,600
So we have a kind of representative democracy or a republic or something along those lines that isn't precisely

40
00:02:55,440 --> 00:03:00,320
one person one vote on every single thing government does so it's already kind of fuzzy right there

41
00:03:00,320 --> 00:03:04,220
The second is that, you know now we can look a little bit

42
00:03:04,220 --> 00:03:05,500
Well, what is person mean?

43
00:03:05,740 --> 00:03:12,000
and I think what that means is that the influence of your vote is supposed to be based on

44
00:03:12,600 --> 00:03:15,100
whether or not you're a person and

45
00:03:15,880 --> 00:03:23,400
You get if you are your personhood entitles you to as many votes as other people's personhoods

46
00:03:24,140 --> 00:03:25,420
do and not

47
00:03:25,420 --> 00:03:31,420
some other qualifications so it's not money or land ownership or noble birth even though in early

48
00:03:32,020 --> 00:03:39,660
U.S. democracy we certainly cared a lot about those things but once you figured out who is a

49
00:03:39,660 --> 00:03:45,920
person every person is supposed to have the same influence and eligibility and by the way we have

50
00:03:45,920 --> 00:03:55,020
the electoral college in this country which also affects that so we're already kind of qualifying

51
00:03:55,020 --> 00:03:59,740
this a lot and we're only kind of halfway through this has evolved over time in the United States

52
00:03:59,740 --> 00:04:06,660
you know the expression used to be one man one vote and you know it took until the 20th century

53
00:04:06,660 --> 00:04:16,740
before we realized that we were kind of a priori excluding half of voters in the United States

54
00:04:17,460 --> 00:04:25,000
you know we had this concept of slavery and automatically disenfranchised citizens

55
00:04:25,020 --> 00:04:32,400
who didn't get to vote for the longest time until the 14th amendment and we used to have in many

56
00:04:32,400 --> 00:04:41,620
places tests for eligibility to vote illiteracy tests and so on so again personhood has has had

57
00:04:42,400 --> 00:04:48,200
asterisks next to it throughout this history and it also involves more than merely your eligibility

58
00:04:48,200 --> 00:04:54,880
to vote but your access to voting as well as some assurance that you're that you don't merely

59
00:04:54,880 --> 00:05:02,920
get to vote but you get a vote that counts and so we want some concept of fairness in the elections

60
00:05:02,920 --> 00:05:09,360
well what does fairness in the election mean well we can come up with some requirements and as soon

61
00:05:09,360 --> 00:05:16,840
as you you're a technologist it becomes really easy to add new requirements to this as soon as you

62
00:05:16,840 --> 00:05:24,060
start listing them you know you're you you can't even write them down as quickly as you can think of

63
00:05:24,060 --> 00:05:24,720
of them

64
00:05:24,880 --> 00:05:36,620
so we want things like equal access to the ballot to be able to run for office to being on the voter rolls to being able to cast ballots so you don't want people to be disadvantaged in any of those things

65
00:05:36,620 --> 00:05:53,920
in the United States almost all adult citizens are eligible to vote is voting optional or is it mandatory that's a question in the United States it's optional there are other countries where voting that we would consider voting that we would consider democracies where voting is mandatory Australia for example

66
00:05:58,600 --> 00:06:00,120
public graduation can affect Learn I unchecked

67
00:06:00,120 --> 00:06:02,000
people too many weeks about

68
00:06:02,000 --> 00:06:03,140
that

69
00:06:03,140 --> 00:06:03,420
to be positive

70
00:06:03,420 --> 00:06:16,900
out of voting

71
00:06:16,900 --> 00:06:21,540
no one can find out

72
00:06:21,540 --> 00:06:23,900
how who voted that's mean your best

73
00:06:23,900 --> 00:06:31,280
could either reward you or punish you depending on how your vote happened. We don't want there to be

74
00:06:31,280 --> 00:06:35,700
transferability. You don't want to be able to transfer your ability to vote to another person.

75
00:06:35,820 --> 00:06:43,120
In the last talk we heard about somebody who has their lawyer vote for them for some reason and

76
00:06:44,240 --> 00:06:52,420
that's not supposed to be allowed in our system. And then we have ultimately public confidence in

77
00:06:52,420 --> 00:06:57,820
the outcome. We want not only this to be true, but we want people to believe that it's been true.

78
00:06:58,460 --> 00:07:06,100
Now, if you are a computer scientist, one of the things you do is you look at the requirements and

79
00:07:06,100 --> 00:07:11,780
you say, well, the best thing I can possibly do when given a set of requirements is show that

80
00:07:11,780 --> 00:07:14,980
there's no point in even trying to build a system that meets them because it's theoretically

81
00:07:14,980 --> 00:07:20,840
impossible. And this is the sort of set of requirements that lends itself to that very

82
00:07:20,840 --> 00:07:22,400
quickly because we can kind of see.

83
00:07:22,420 --> 00:07:26,520
That some of these requirements kind of contradict each other,

84
00:07:27,060 --> 00:07:31,500
that you might have to choose between one or the other or make some kind of compromises

85
00:07:32,320 --> 00:07:39,320
down the line among them. So the one that I want to focus on is secrecy versus transparency.

86
00:07:39,780 --> 00:07:44,260
We want everybody to be confident in the outcome. We want everybody to be confident

87
00:07:44,260 --> 00:07:51,820
that their particular vote is counted, but we don't want to be able to prove how any individual

88
00:07:52,420 --> 00:07:56,040
voted or allow somebody else to be able to find out how it was.

89
00:07:56,800 --> 00:08:03,200
That's pretty hard and it leads to lots of

90
00:08:05,480 --> 00:08:10,300
difficulty in designing very heavily constrained systems. One of the things we hear

91
00:08:10,300 --> 00:08:19,380
over and over again is, well, hey, we have secure ATM machines. Why cannot we have secure

92
00:08:19,380 --> 00:08:24,380
Well, in an ATM machine you kind of get a receipt of how much money you withdrew.

93
00:08:24,780 --> 00:08:28,500
And we really don't want, because of one of the requirements,

94
00:08:28,700 --> 00:08:31,300
to give people a receipt showing how they voted.

95
00:08:31,580 --> 00:08:33,480
And so on and so on.

96
00:08:33,580 --> 00:08:34,800
So this is kind of difficult.

97
00:08:35,000 --> 00:08:37,200
So the best slogan I can come up with is,

98
00:08:37,300 --> 00:08:41,640
one adult citizen, one easily exercised but non-transferable option

99
00:08:41,640 --> 00:08:45,360
to cast a secret accurately counted vote after a fairly conducted public campaign

100
00:08:45,360 --> 00:08:48,180
that will determine their representative for certain issues.

101
00:08:48,180 --> 00:08:55,600
And that's kind of the computer scientist version of one person, one vote.

102
00:08:55,900 --> 00:08:59,700
Okay, so there's technology involved here.

103
00:09:00,520 --> 00:09:05,800
We have been increasingly using technology to conduct elections,

104
00:09:06,080 --> 00:09:09,300
although that has not been true since the beginning.

105
00:09:09,560 --> 00:09:13,980
Early elections in the US, as I think a number of speakers in this track have pointed out,

106
00:09:14,040 --> 00:09:17,020
basically consisted of a bunch of rich dudes

107
00:09:18,180 --> 00:09:22,280
showing up in a room and raising their hands on election day.

108
00:09:22,380 --> 00:09:25,700
And everybody could kind of agree on what the outcome was from that.

109
00:09:25,900 --> 00:09:27,840
But that has the problem that it's not secret.

110
00:09:28,480 --> 00:09:32,300
So we didn't have ballot secrecy from the very beginning in the United States.

111
00:09:32,820 --> 00:09:36,560
And it probably doesn't scale very well.

112
00:09:36,880 --> 00:09:41,680
Asking people to all show up in the same room and raise their hand and count

113
00:09:43,260 --> 00:09:48,040
is probably not something that could scale up to kind of modern population density.

114
00:09:48,180 --> 00:09:53,720
So what that means is not just the principles have become important,

115
00:09:53,980 --> 00:10:01,840
but the mechanisms with which we implement these principles have become really important.

116
00:10:02,220 --> 00:10:07,820
And so technologies for voting have evolved over time

117
00:10:07,820 --> 00:10:14,040
to increasingly allow, to take advantage of new advances in technology,

118
00:10:14,320 --> 00:10:16,120
to allow voting to scale up,

119
00:10:16,260 --> 00:10:17,900
and to try to bolster

120
00:10:18,180 --> 00:10:26,620
one or another of the kind of informally stated requirements that elections have.

121
00:10:26,940 --> 00:10:28,480
So we have paper ballots.

122
00:10:28,820 --> 00:10:31,180
Mark something and put it into a box.

123
00:10:31,600 --> 00:10:33,820
We have machine-counted ballots.

124
00:10:34,980 --> 00:10:38,620
Mark something in some way and drop it into a box

125
00:10:38,620 --> 00:10:42,900
so that it can then be counted and tabulated by some sort of machinery.

126
00:10:43,940 --> 00:10:47,640
We have direct recording

127
00:10:48,180 --> 00:10:48,960
of voting machines.

128
00:10:49,840 --> 00:10:53,320
Interact with a machine that mechanically will mark a ballot

129
00:10:53,320 --> 00:10:56,620
that is then stored inside the machine itself.

130
00:10:57,160 --> 00:10:59,180
Those were the machines I grew up on.

131
00:10:59,460 --> 00:11:01,020
New York State had them.

132
00:11:01,500 --> 00:11:03,400
These machines with these levers,

133
00:11:03,600 --> 00:11:05,560
you would flick the little levers.

134
00:11:05,720 --> 00:11:10,200
What they would really do is mark a little advancing piece of paper

135
00:11:10,200 --> 00:11:11,720
for each poll.

136
00:11:11,900 --> 00:11:14,840
When you pull this big lever, a ker-chunk happens.

137
00:11:14,980 --> 00:11:16,940
That's the sound of democracy in action.

138
00:11:16,940 --> 00:11:21,040
The curtain opens, and then you can leave the room.

139
00:11:21,360 --> 00:11:25,400
Those machines were in use since the late 1930s

140
00:11:25,400 --> 00:11:30,300
through around 2000 throughout much of the country.

141
00:11:30,460 --> 00:11:36,300
Another type of machine is replacing that,

142
00:11:36,400 --> 00:11:38,480
but with modern computer technology.

143
00:11:38,800 --> 00:11:42,140
So instead of a lever, you touch a screen,

144
00:11:42,300 --> 00:11:44,280
and instead of marking on a piece of paper,

145
00:11:44,400 --> 00:11:45,920
you store it on a memory card.

146
00:11:45,920 --> 00:11:49,920
And because the voting community is great at catchy names,

147
00:11:50,240 --> 00:11:54,080
those are called direct recording electronic voting machines.

148
00:11:54,680 --> 00:11:58,780
They're direct recording because they record directly inside the machine.

149
00:11:58,980 --> 00:12:00,800
They're electronic because they're computers.

150
00:12:01,480 --> 00:12:06,560
I prefer to call them, as many people in the electronic voting community

151
00:12:06,560 --> 00:12:10,160
prefer to remind us that that means they're voting computers.

152
00:12:10,660 --> 00:12:13,820
And that means that understanding what they do

153
00:12:13,820 --> 00:12:15,900
is as easy or hard

154
00:12:15,920 --> 00:12:19,680
as understanding what any general-purpose computing device does,

155
00:12:19,960 --> 00:12:23,100
and whether or not it actually works faithfully

156
00:12:23,100 --> 00:12:26,540
is as hard or as easy as building bug-free software.

157
00:12:28,560 --> 00:12:31,940
Now, perception and reality are linked here.

158
00:12:32,080 --> 00:12:34,580
Public confidence in elections

159
00:12:35,560 --> 00:12:37,720
is what gives government legitimacy.

160
00:12:38,340 --> 00:12:40,500
And now public confidence in elections

161
00:12:40,500 --> 00:12:44,180
is not just a matter of whether or not we trust the vote,

162
00:12:44,340 --> 00:12:45,800
but whether or not we trust

163
00:12:45,920 --> 00:12:47,080
all of the technology

164
00:12:47,900 --> 00:12:50,920
that led to the ultimate tabulation of the vote.

165
00:12:51,160 --> 00:12:53,100
So in other words, computer science

166
00:12:53,960 --> 00:12:56,580
and building reliable computing systems

167
00:12:56,580 --> 00:12:58,480
as we use computers for this

168
00:12:59,400 --> 00:13:01,140
is actually kind of central

169
00:13:01,700 --> 00:13:03,580
to whether or not we regard

170
00:13:04,120 --> 00:13:05,780
the government we have

171
00:13:05,780 --> 00:13:07,940
as legitimately being allowed to govern.

172
00:13:08,520 --> 00:13:11,660
In other words, you should be in this room thinking about this.

173
00:13:11,740 --> 00:13:13,820
You should be engaged in this issue, as you all are.

174
00:13:13,880 --> 00:13:15,720
And you should scold people who aren't here

175
00:13:15,920 --> 00:13:17,080
for not showing up, right?

176
00:13:17,620 --> 00:13:21,000
Okay, so what's the threat model

177
00:13:21,000 --> 00:13:22,200
is the first question

178
00:13:22,200 --> 00:13:25,060
a computer science security type would ask.

179
00:13:25,600 --> 00:13:27,840
And the traditional threat model

180
00:13:27,840 --> 00:13:30,060
for an election is what?

181
00:13:31,000 --> 00:13:32,150
It's the traditional thing

182
00:13:32,520 --> 00:13:34,120
that we have to defend an election against.

183
00:13:36,280 --> 00:13:36,780
What?

184
00:13:37,700 --> 00:13:39,280
Well, so we wanted to...

185
00:13:39,280 --> 00:13:40,580
What would you be trying to do?

186
00:13:40,640 --> 00:13:41,920
What would an attacker be trying to do?

187
00:13:43,240 --> 00:13:44,240
Fraudulently vote.

188
00:13:44,440 --> 00:13:45,300
We want to stop people

189
00:13:45,300 --> 00:13:48,060
from casting more than one vote per person.

190
00:13:48,240 --> 00:13:49,800
We want to stop people

191
00:13:49,800 --> 00:13:52,920
from being able to sell or buy votes.

192
00:13:53,200 --> 00:13:54,740
We want to prevent ballot stuffing

193
00:13:54,740 --> 00:13:55,620
to prevent somebody

194
00:13:55,620 --> 00:13:57,540
from getting elected to dog catcher

195
00:13:57,540 --> 00:13:59,820
without actually the will of the people

196
00:13:59,820 --> 00:14:02,640
being behind that.

197
00:14:03,080 --> 00:14:03,100
Yeah?

198
00:14:05,160 --> 00:14:06,520
Mm-hmm.

199
00:14:06,600 --> 00:14:08,080
So absolutely.

200
00:14:08,320 --> 00:14:09,600
But the threat is ultimately

201
00:14:09,600 --> 00:14:13,060
in the service of cheating on the election.

202
00:14:13,360 --> 00:14:15,280
That's kind of the traditional threat model

203
00:14:15,300 --> 00:14:17,720
that we all are trying to think of.

204
00:14:17,820 --> 00:14:19,240
And I'm sure you have a lot to say,

205
00:14:19,360 --> 00:14:20,220
but I get to talk.

206
00:14:23,140 --> 00:14:27,180
The traditional threat model is cheating, right?

207
00:14:27,280 --> 00:14:30,680
Trying to alter the outcome to serve you

208
00:14:31,240 --> 00:14:32,320
because either you think

209
00:14:32,320 --> 00:14:34,220
you get to vote more times than you should

210
00:14:34,220 --> 00:14:36,100
or because you're the candidate

211
00:14:36,100 --> 00:14:37,940
and you really want this office

212
00:14:37,940 --> 00:14:39,300
instead of that other jerk.

213
00:14:39,560 --> 00:14:41,860
And in fact, there's a long history

214
00:14:41,860 --> 00:14:43,980
of this sort of...

215
00:14:43,980 --> 00:14:48,120
this sort of fraud in U.S. elections.

216
00:14:48,480 --> 00:14:50,980
We've had, you know, people being sent

217
00:14:51,520 --> 00:14:53,480
into polling stations to vote

218
00:14:53,480 --> 00:14:54,880
by candidates and vote buying

219
00:14:54,880 --> 00:14:56,760
and ballot stuffing

220
00:14:56,760 --> 00:14:58,860
and a number of ingenious ways,

221
00:14:59,120 --> 00:15:01,400
many of which have interacted

222
00:15:01,400 --> 00:15:04,160
in remarkably quick ways

223
00:15:04,160 --> 00:15:06,220
with a new voting technology

224
00:15:06,220 --> 00:15:07,800
where somebody has figured out

225
00:15:07,800 --> 00:15:09,900
how to exploit a flaw

226
00:15:09,900 --> 00:15:11,500
in some new voting technology

227
00:15:11,500 --> 00:15:12,780
that has come out.

228
00:15:12,780 --> 00:15:15,600
And so almost all of the laws

229
00:15:15,600 --> 00:15:17,100
and procedures and so on

230
00:15:17,100 --> 00:15:20,920
have been looking at this threat model.

231
00:15:21,140 --> 00:15:22,760
And one question you have to ask

232
00:15:22,760 --> 00:15:24,080
about any new technology

233
00:15:24,080 --> 00:15:26,280
is whether it can become easily unplugged

234
00:15:26,280 --> 00:15:28,300
and stop the video from going through.

235
00:15:30,160 --> 00:15:30,700
And...

236
00:15:32,740 --> 00:15:33,400
Let's see.

237
00:15:36,020 --> 00:15:37,580
And that'll show up in a second.

238
00:15:37,780 --> 00:15:39,060
So the thing you have to ask

239
00:15:39,060 --> 00:15:40,480
about any new technology

240
00:15:40,480 --> 00:15:42,760
is compared to

241
00:15:42,780 --> 00:15:45,540
the technology that preceded it,

242
00:15:45,640 --> 00:15:48,880
does this make that threat

243
00:15:49,800 --> 00:15:51,740
easier or harder, right?

244
00:15:51,780 --> 00:15:54,020
Does the next technology

245
00:15:54,020 --> 00:15:55,820
that comes along

246
00:15:56,660 --> 00:15:58,900
make us better off or worse off

247
00:15:58,900 --> 00:16:00,400
against this threat?

248
00:16:00,620 --> 00:16:02,760
And the electronic voting community

249
00:16:02,760 --> 00:16:04,580
at the time that I've worked in it

250
00:16:04,580 --> 00:16:05,660
has largely, you know,

251
00:16:05,660 --> 00:16:06,440
asked the question,

252
00:16:06,580 --> 00:16:09,820
are DRE machines better against

253
00:16:10,650 --> 00:16:12,100
this sort of traditional threat?

254
00:16:12,780 --> 00:16:15,520
Than the paper systems

255
00:16:15,520 --> 00:16:16,820
or what have you

256
00:16:16,820 --> 00:16:17,960
that they had before.

257
00:16:18,820 --> 00:16:20,360
There's also another threat.

258
00:16:20,480 --> 00:16:21,240
And this is a threat

259
00:16:21,240 --> 00:16:22,060
that we haven't...

260
00:16:22,060 --> 00:16:23,200
We've kind of understood,

261
00:16:23,480 --> 00:16:24,720
but we haven't understood it

262
00:16:24,720 --> 00:16:26,600
in quite the sharp way

263
00:16:26,600 --> 00:16:28,100
that we understand it now

264
00:16:30,020 --> 00:16:31,900
until the most recent

265
00:16:31,900 --> 00:16:32,940
national election.

266
00:16:33,240 --> 00:16:34,540
And that's the threat

267
00:16:34,540 --> 00:16:35,760
of hostile state actors.

268
00:16:36,040 --> 00:16:38,000
That is, someone who's not

269
00:16:38,000 --> 00:16:39,000
necessarily interested

270
00:16:39,000 --> 00:16:40,940
in stealing a local office,

271
00:16:40,940 --> 00:16:45,200
but rather interested in doing that

272
00:16:45,200 --> 00:16:46,620
or perhaps other things.

273
00:16:46,700 --> 00:16:49,300
Perhaps disrupting the vote itself

274
00:16:49,300 --> 00:16:51,120
to create disorder

275
00:16:51,120 --> 00:16:53,040
or casting doubt

276
00:16:53,040 --> 00:16:53,960
on the legitimacy

277
00:16:53,960 --> 00:16:55,560
of the winner to govern

278
00:16:55,560 --> 00:16:59,380
as a hostile state action,

279
00:16:59,520 --> 00:17:03,180
as an act of state aggression.

280
00:17:03,600 --> 00:17:06,280
And this is a very different

281
00:17:06,280 --> 00:17:07,900
class of threat.

282
00:17:08,700 --> 00:17:10,920
This is a class of threat

283
00:17:10,920 --> 00:17:12,000
in which, first of all,

284
00:17:12,040 --> 00:17:13,740
the attacker is trying to do...

285
00:17:13,740 --> 00:17:15,100
May be satisfied

286
00:17:16,060 --> 00:17:17,960
with many more different

287
00:17:17,960 --> 00:17:19,300
kinds of outcomes

288
00:17:19,920 --> 00:17:21,320
than someone trying to steal

289
00:17:21,320 --> 00:17:22,320
a specific office

290
00:17:22,320 --> 00:17:23,640
who's focused on one thing.

291
00:17:23,940 --> 00:17:25,420
And is also an attacker

292
00:17:25,420 --> 00:17:26,320
who's likely to have

293
00:17:26,320 --> 00:17:28,040
vastly greater resources,

294
00:17:28,260 --> 00:17:30,120
both to understand

295
00:17:30,120 --> 00:17:31,960
the underlying technology

296
00:17:31,960 --> 00:17:34,220
as well as to carry out the attack.

297
00:17:34,680 --> 00:17:35,720
And so a question

298
00:17:35,720 --> 00:17:37,260
we also have to ask is,

299
00:17:37,440 --> 00:17:39,360
does whatever the technology

300
00:17:39,360 --> 00:17:40,180
we're using,

301
00:17:40,180 --> 00:17:42,960
make this threat

302
00:17:42,960 --> 00:17:44,520
an easier threat

303
00:17:44,520 --> 00:17:46,580
or a tougher threat?

304
00:17:46,880 --> 00:17:48,000
And that's a question

305
00:17:48,000 --> 00:17:51,000
we haven't really been sharply asking

306
00:17:51,000 --> 00:17:53,080
for very long.

307
00:17:53,340 --> 00:17:54,600
Okay, voting in the US,

308
00:17:54,760 --> 00:17:55,440
everybody knows,

309
00:17:55,500 --> 00:17:56,180
voting in the US

310
00:17:56,180 --> 00:17:56,940
is highly decentralized.

311
00:17:58,060 --> 00:17:59,680
Federal government only sets

312
00:17:59,680 --> 00:18:00,760
kind of broad standards.

313
00:18:01,140 --> 00:18:02,740
Each state has its own laws,

314
00:18:03,040 --> 00:18:04,080
but elections are run

315
00:18:04,080 --> 00:18:04,920
at the local level,

316
00:18:05,000 --> 00:18:06,160
mostly run by counties.

317
00:18:06,340 --> 00:18:07,960
There are over 3,000 counties

318
00:18:07,960 --> 00:18:09,300
in the United States.

319
00:18:09,500 --> 00:18:10,080
And then,

320
00:18:10,180 --> 00:18:11,660
in places where you vote in person,

321
00:18:11,800 --> 00:18:12,880
election takes place

322
00:18:12,880 --> 00:18:14,760
in neighborhood voting precincts,

323
00:18:14,760 --> 00:18:15,900
which might serve,

324
00:18:16,020 --> 00:18:17,040
you know,

325
00:18:18,540 --> 00:18:20,220
hundreds of voters

326
00:18:20,220 --> 00:18:21,260
within that precinct

327
00:18:21,260 --> 00:18:22,200
and there might be tens,

328
00:18:22,280 --> 00:18:22,560
hundreds,

329
00:18:22,640 --> 00:18:24,380
or thousands of those precincts

330
00:18:24,380 --> 00:18:25,240
per county itself.

331
00:18:25,820 --> 00:18:27,640
US elections are more complex

332
00:18:27,640 --> 00:18:29,000
than almost anywhere in the world.

333
00:18:29,060 --> 00:18:29,880
We make more decisions.

334
00:18:30,020 --> 00:18:30,780
We have more races.

335
00:18:31,020 --> 00:18:32,980
And within precincts,

336
00:18:32,980 --> 00:18:33,600
there may be multiple

337
00:18:33,600 --> 00:18:34,900
different kinds of ballots

338
00:18:34,900 --> 00:18:36,380
because you might be voting

339
00:18:36,380 --> 00:18:37,240
not just for president,

340
00:18:37,380 --> 00:18:38,440
but also for, like,

341
00:18:38,500 --> 00:18:39,300
who represents you

342
00:18:39,300 --> 00:18:40,160
on the school board.

343
00:18:40,320 --> 00:18:41,160
And that might be different

344
00:18:41,160 --> 00:18:42,400
from other people voting

345
00:18:42,400 --> 00:18:43,400
in the same precinct.

346
00:18:43,520 --> 00:18:45,620
So we have really complicated elections

347
00:18:45,620 --> 00:18:48,300
and that very much means

348
00:18:48,860 --> 00:18:52,300
that computers have a natural role

349
00:18:52,300 --> 00:18:55,240
in simplifying the tabulation process.

350
00:18:55,560 --> 00:18:56,280
It's, you know,

351
00:18:56,280 --> 00:18:57,300
it's not nefarious

352
00:18:57,880 --> 00:18:59,080
that people have thought

353
00:18:59,080 --> 00:18:59,760
of the idea

354
00:18:59,760 --> 00:19:01,200
of using computers for this

355
00:19:01,200 --> 00:19:04,580
because it's a pretty natural consequence

356
00:19:04,580 --> 00:19:05,760
of just how complex

357
00:19:05,760 --> 00:19:09,280
and large-scale US elections are.

358
00:19:09,280 --> 00:19:12,660
Does anyone recognize this photo?

359
00:19:14,020 --> 00:19:15,580
So this is...

360
00:19:16,660 --> 00:19:18,820
What was this photo of?

361
00:19:19,960 --> 00:19:20,800
Hanging Chad.

362
00:19:20,940 --> 00:19:22,620
So that man was named Chad?

363
00:19:23,020 --> 00:19:23,320
Or...

364
00:19:23,320 --> 00:19:25,660
So this was one

365
00:19:25,660 --> 00:19:27,360
of the Florida recount judges

366
00:19:28,280 --> 00:19:31,380
in a remarkably fortunate

367
00:19:31,380 --> 00:19:32,740
capture-the-moment pose

368
00:19:33,280 --> 00:19:35,420
looking at a ballot

369
00:19:35,420 --> 00:19:36,520
and examining it

370
00:19:36,520 --> 00:19:39,260
from the 2000 Florida election.

371
00:19:39,280 --> 00:19:41,320
A question for you,

372
00:19:41,380 --> 00:19:43,680
and people have different answers

373
00:19:43,680 --> 00:19:44,460
to this question.

374
00:19:44,640 --> 00:19:45,520
How many people

375
00:19:45,520 --> 00:19:46,460
look at this picture

376
00:19:46,460 --> 00:19:48,360
and say what an embarrassment

377
00:19:49,040 --> 00:19:50,900
that technology is?

378
00:19:52,300 --> 00:19:54,100
Versus how many of you

379
00:19:54,100 --> 00:19:55,320
look at that picture

380
00:19:55,320 --> 00:19:56,500
and say what a great thing

381
00:19:56,500 --> 00:19:57,480
that technology was?

382
00:19:57,640 --> 00:19:58,100
How many think

383
00:19:58,100 --> 00:19:59,020
what an embarrassment

384
00:19:59,020 --> 00:20:00,140
that technology is?

385
00:20:00,600 --> 00:20:01,720
In this room,

386
00:20:01,780 --> 00:20:02,900
not that many.

387
00:20:03,280 --> 00:20:04,640
How many people think

388
00:20:04,640 --> 00:20:05,260
what a great thing

389
00:20:05,260 --> 00:20:06,100
that technology was?

390
00:20:06,700 --> 00:20:07,640
Yeah, I'm probably

391
00:20:07,640 --> 00:20:08,720
in that category too.

392
00:20:08,720 --> 00:20:09,180
Why?

393
00:20:10,960 --> 00:20:12,260
Those are the only two

394
00:20:12,260 --> 00:20:12,920
in this room.

395
00:20:16,980 --> 00:20:18,540
That is not...

396
00:20:18,540 --> 00:20:19,860
Yeah, you can rant at me

397
00:20:19,860 --> 00:20:20,460
after the talk.

398
00:20:20,680 --> 00:20:20,940
Okay.

399
00:20:21,180 --> 00:20:21,700
The...

400
00:20:21,700 --> 00:20:22,200
Okay.

401
00:20:22,380 --> 00:20:22,900
So...

402
00:20:23,620 --> 00:20:25,100
So I happen to have one here.

403
00:20:26,080 --> 00:20:30,440
So this is an example

404
00:20:30,440 --> 00:20:31,360
of one of these machines.

405
00:20:32,360 --> 00:20:32,880
Because...

406
00:20:33,540 --> 00:20:34,060
Okay.

407
00:20:35,520 --> 00:20:37,660
So this is an example

408
00:20:37,660 --> 00:20:38,600
of one of these machines.

409
00:20:38,720 --> 00:20:40,840
And I have a photo of it,

410
00:20:40,880 --> 00:20:42,220
which I will put up.

411
00:20:42,540 --> 00:20:45,320
But while that's going,

412
00:20:45,400 --> 00:20:46,300
I can just show you

413
00:20:46,300 --> 00:20:47,320
what the photo is of.

414
00:20:48,160 --> 00:20:50,160
This is a punch card

415
00:20:50,160 --> 00:20:50,760
voting machine.

416
00:20:51,500 --> 00:20:52,940
And this is the type

417
00:20:52,940 --> 00:20:53,800
used in Florida.

418
00:20:53,800 --> 00:20:54,760
This particular one

419
00:20:54,760 --> 00:20:57,300
was from Wisconsin.

420
00:20:57,700 --> 00:21:00,160
And it has the ballot in it

421
00:21:00,160 --> 00:21:00,920
from...

422
00:21:00,920 --> 00:21:02,260
The ballot card in it

423
00:21:02,260 --> 00:21:05,540
from the 2000 election.

424
00:21:05,980 --> 00:21:07,900
And it's a really

425
00:21:07,900 --> 00:21:08,700
interesting thing

426
00:21:08,720 --> 00:21:09,220
about this technology.

427
00:21:09,240 --> 00:21:10,140
Because the first thing

428
00:21:10,140 --> 00:21:10,560
you will notice

429
00:21:10,560 --> 00:21:11,300
about this technology

430
00:21:11,300 --> 00:21:13,000
is there is no...

431
00:21:13,000 --> 00:21:14,140
There are no electronics

432
00:21:14,140 --> 00:21:16,520
involved in this at all.

433
00:21:17,260 --> 00:21:17,900
The...

434
00:21:17,900 --> 00:21:20,480
This is 1960s technology.

435
00:21:21,740 --> 00:21:23,740
These started to be produced

436
00:21:23,740 --> 00:21:24,980
in the 1960s.

437
00:21:25,000 --> 00:21:25,520
They were used

438
00:21:25,520 --> 00:21:27,060
through about 2000.

439
00:21:27,380 --> 00:21:28,020
And then something

440
00:21:28,020 --> 00:21:28,980
mysteriously happened

441
00:21:28,980 --> 00:21:30,300
to make people not like them.

442
00:21:31,480 --> 00:21:33,240
And the voting experience

443
00:21:33,240 --> 00:21:34,860
does not involve

444
00:21:34,860 --> 00:21:35,700
any electronics

445
00:21:35,700 --> 00:21:36,920
at the polling place.

446
00:21:37,600 --> 00:21:38,700
There are electronics

447
00:21:38,720 --> 00:21:40,500
involved in the tabulating.

448
00:21:40,740 --> 00:21:41,700
And what do you do?

449
00:21:41,780 --> 00:21:42,480
Well, how do you vote?

450
00:21:42,780 --> 00:21:43,640
Well, what you do

451
00:21:44,180 --> 00:21:45,900
is you take a ballot,

452
00:21:46,020 --> 00:21:46,760
which are given

453
00:21:47,340 --> 00:21:48,200
by your poll worker.

454
00:21:48,700 --> 00:21:49,900
And this is usually

455
00:21:49,900 --> 00:21:51,080
contained in a booth.

456
00:21:51,340 --> 00:21:52,320
The booth does have

457
00:21:52,320 --> 00:21:53,300
electricity involved.

458
00:21:54,140 --> 00:21:54,580
You...

459
00:21:55,700 --> 00:21:56,700
It's for the light

460
00:21:56,700 --> 00:21:58,060
above the thing

461
00:21:58,060 --> 00:21:59,000
that illuminates it.

462
00:21:59,300 --> 00:22:00,460
And that's about it.

463
00:22:00,740 --> 00:22:01,840
You take your ballot

464
00:22:01,840 --> 00:22:03,400
and you insert it

465
00:22:03,400 --> 00:22:04,380
into the machine.

466
00:22:05,360 --> 00:22:06,620
And you push it down

467
00:22:06,620 --> 00:22:07,060
a little bit.

468
00:22:07,120 --> 00:22:07,740
There's a little spring

469
00:22:07,740 --> 00:22:08,540
that makes sure

470
00:22:08,720 --> 00:22:10,280
you line it up properly

471
00:22:10,280 --> 00:22:11,280
on these two little

472
00:22:12,980 --> 00:22:13,940
red knobs.

473
00:22:15,600 --> 00:22:16,560
And now,

474
00:22:17,480 --> 00:22:19,300
you can flip through

475
00:22:19,300 --> 00:22:20,780
your voting instructions.

476
00:22:21,400 --> 00:22:22,660
And when you want to vote,

477
00:22:22,820 --> 00:22:24,960
you pick your candidate.

478
00:22:25,080 --> 00:22:26,060
I'm going to vote down

479
00:22:26,060 --> 00:22:26,740
the straight

480
00:22:28,300 --> 00:22:30,920
Wisconsin Greens ticket.

481
00:22:31,120 --> 00:22:32,000
I have no idea

482
00:22:32,000 --> 00:22:32,840
what they stand for.

483
00:22:32,940 --> 00:22:34,000
I presume it has to do

484
00:22:34,000 --> 00:22:34,900
with moldy cheese.

485
00:22:36,020 --> 00:22:37,000
And I'm going to vote

486
00:22:37,000 --> 00:22:37,360
for them.

487
00:22:37,500 --> 00:22:37,900
And now,

488
00:22:37,940 --> 00:22:38,360
I voted.

489
00:22:38,460 --> 00:22:38,700
And now,

490
00:22:38,700 --> 00:22:39,400
what have I done?

491
00:22:39,660 --> 00:22:39,980
Well,

492
00:22:40,060 --> 00:22:41,160
I pulled my ballot out.

493
00:22:41,360 --> 00:22:42,340
And you will notice,

494
00:22:42,540 --> 00:22:44,060
you can see a little hole

495
00:22:44,060 --> 00:22:44,580
in there

496
00:22:45,120 --> 00:22:46,500
that I have made.

497
00:22:46,640 --> 00:22:47,480
It's punched out.

498
00:22:47,660 --> 00:22:49,300
These are perforated

499
00:22:49,300 --> 00:22:52,360
little rectangles

500
00:22:52,360 --> 00:22:53,520
associated with

501
00:22:53,520 --> 00:22:53,960
each possible

502
00:22:53,960 --> 00:22:55,380
position here.

503
00:22:56,060 --> 00:22:57,040
And so,

504
00:22:57,140 --> 00:22:57,860
if you voted

505
00:22:57,860 --> 00:22:59,240
for somebody,

506
00:22:59,460 --> 00:23:00,720
one of those little holes

507
00:23:00,720 --> 00:23:02,420
would get punched out.

508
00:23:02,540 --> 00:23:03,120
And you can,

509
00:23:03,240 --> 00:23:04,680
if you're a suspicious type,

510
00:23:04,880 --> 00:23:06,420
you might imagine

511
00:23:06,420 --> 00:23:07,260
that,

512
00:23:07,820 --> 00:23:08,340
hey,

513
00:23:08,420 --> 00:23:08,680
wait a minute.

514
00:23:08,700 --> 00:23:09,320
How do I know

515
00:23:09,320 --> 00:23:10,040
I actually marked

516
00:23:10,040 --> 00:23:10,720
the correct position?

517
00:23:11,080 --> 00:23:11,420
Well,

518
00:23:11,560 --> 00:23:12,680
you would notice that,

519
00:23:12,720 --> 00:23:12,880
well,

520
00:23:12,920 --> 00:23:14,340
my candidate was number 68.

521
00:23:14,580 --> 00:23:14,960
And oh,

522
00:23:14,980 --> 00:23:15,240
look,

523
00:23:15,260 --> 00:23:16,380
it's box number 68

524
00:23:16,380 --> 00:23:17,340
that's been punched out.

525
00:23:17,840 --> 00:23:18,500
And now,

526
00:23:18,560 --> 00:23:19,660
you take your ballot,

527
00:23:19,880 --> 00:23:20,900
you rip it apart,

528
00:23:21,080 --> 00:23:22,160
you put it in the ballot box

529
00:23:22,160 --> 00:23:23,220
or wherever it goes.

530
00:23:23,720 --> 00:23:24,960
And they take a stack

531
00:23:24,960 --> 00:23:25,320
of these

532
00:23:25,320 --> 00:23:26,180
and they put them through

533
00:23:26,180 --> 00:23:26,680
a typical,

534
00:23:26,760 --> 00:23:27,120
like,

535
00:23:27,120 --> 00:23:28,600
IBM-style punch card,

536
00:23:28,720 --> 00:23:29,620
Hollerith card reader.

537
00:23:29,880 --> 00:23:31,340
And it shines

538
00:23:31,340 --> 00:23:32,020
a little light

539
00:23:32,020 --> 00:23:33,080
through each card

540
00:23:33,080 --> 00:23:33,960
one at a time

541
00:23:33,960 --> 00:23:34,800
and produces

542
00:23:34,800 --> 00:23:37,120
a result.

543
00:23:37,460 --> 00:23:37,760
So,

544
00:23:38,700 --> 00:23:39,240
all of the technology,

545
00:23:39,240 --> 00:23:40,400
all of the computer type

546
00:23:40,400 --> 00:23:40,900
technology

547
00:23:40,900 --> 00:23:41,660
and the electronics

548
00:23:41,660 --> 00:23:43,160
are on the back end

549
00:23:43,160 --> 00:23:43,800
of the system.

550
00:23:43,940 --> 00:23:44,940
The voting itself

551
00:23:45,500 --> 00:23:46,160
is actually

552
00:23:46,160 --> 00:23:46,640
a pretty

553
00:23:46,640 --> 00:23:47,880
low-tech process.

554
00:23:48,500 --> 00:23:49,040
So,

555
00:23:49,560 --> 00:23:50,380
there's an interesting

556
00:23:50,380 --> 00:23:50,920
property

557
00:23:50,920 --> 00:23:52,300
of these machines

558
00:23:53,020 --> 00:23:53,580
that

559
00:23:53,580 --> 00:23:54,580
is

560
00:23:54,580 --> 00:23:55,600
really

561
00:23:55,600 --> 00:23:56,400
quite

562
00:23:57,100 --> 00:23:57,660
remarkable,

563
00:23:57,860 --> 00:23:58,560
which is that

564
00:23:58,560 --> 00:23:59,500
in spite of the fact

565
00:23:59,500 --> 00:24:00,480
that there are no computers

566
00:24:00,480 --> 00:24:00,900
involved

567
00:24:00,900 --> 00:24:01,980
at the polling place,

568
00:24:02,200 --> 00:24:02,980
there is,

569
00:24:03,140 --> 00:24:03,820
and I can't decide

570
00:24:03,820 --> 00:24:04,660
whether to call it

571
00:24:04,660 --> 00:24:05,440
a memory leak

572
00:24:05,440 --> 00:24:06,460
or a buffer overflow

573
00:24:07,080 --> 00:24:07,640
attack

574
00:24:08,700 --> 00:24:10,620
in the vote casting process.

575
00:24:11,200 --> 00:24:12,660
And anyone who was alive

576
00:24:12,660 --> 00:24:14,760
during late 2000

577
00:24:15,500 --> 00:24:17,980
learned all about this technology.

578
00:24:18,440 --> 00:24:19,360
What would happen?

579
00:24:19,860 --> 00:24:20,340
Well,

580
00:24:20,440 --> 00:24:22,360
at the beginning of the day,

581
00:24:22,520 --> 00:24:24,760
you put your card in

582
00:24:24,760 --> 00:24:27,360
and you punch holes in it.

583
00:24:28,440 --> 00:24:30,340
And the holes get punched in

584
00:24:30,340 --> 00:24:31,000
pretty easily.

585
00:24:31,360 --> 00:24:31,720
Now,

586
00:24:31,740 --> 00:24:32,820
I want us to move

587
00:24:32,820 --> 00:24:33,600
from Wisconsin

588
00:24:33,600 --> 00:24:35,140
where people are very hardy

589
00:24:35,140 --> 00:24:35,940
to Florida

590
00:24:35,940 --> 00:24:37,180
where people are old

591
00:24:37,180 --> 00:24:37,940
and have arthritis.

592
00:24:38,920 --> 00:24:40,260
And imagine that you're

593
00:24:40,260 --> 00:24:40,800
kind of old

594
00:24:40,800 --> 00:24:41,480
and arthritic.

595
00:24:41,560 --> 00:24:42,220
You're being asked

596
00:24:42,220 --> 00:24:43,160
to perform a little bit

597
00:24:43,160 --> 00:24:44,160
of a physical feat

598
00:24:44,160 --> 00:24:45,180
in voting.

599
00:24:45,300 --> 00:24:46,040
You have to take

600
00:24:46,040 --> 00:24:46,960
this little stylus,

601
00:24:47,020 --> 00:24:47,640
line it up,

602
00:24:47,660 --> 00:24:48,680
and punch through

603
00:24:48,680 --> 00:24:49,180
the card.

604
00:24:49,640 --> 00:24:50,620
But it's actually

605
00:24:50,620 --> 00:24:51,760
fairly easy to do.

606
00:24:52,320 --> 00:24:52,980
You know,

607
00:24:52,980 --> 00:24:53,740
there's a little

608
00:24:53,740 --> 00:24:54,600
perforation in here.

609
00:24:54,700 --> 00:24:55,920
It's actually fairly easy

610
00:24:55,920 --> 00:24:58,860
to punch through

611
00:24:58,860 --> 00:24:59,420
the card.

612
00:24:59,980 --> 00:25:01,200
But what happens

613
00:25:01,200 --> 00:25:01,720
is because

614
00:25:01,720 --> 00:25:02,460
of conservation

615
00:25:02,460 --> 00:25:03,300
of matter,

616
00:25:04,380 --> 00:25:05,620
the little pieces

617
00:25:05,620 --> 00:25:06,180
of paper

618
00:25:06,180 --> 00:25:06,860
that you are

619
00:25:06,860 --> 00:25:07,160
punching

620
00:25:07,160 --> 00:25:07,620
out

621
00:25:08,160 --> 00:25:09,220
go somewhere.

622
00:25:10,120 --> 00:25:11,380
And where do

623
00:25:11,380 --> 00:25:11,880
they go?

624
00:25:12,120 --> 00:25:12,560
Well,

625
00:25:12,620 --> 00:25:13,420
this is the machine.

626
00:25:14,160 --> 00:25:14,700
Well,

627
00:25:14,760 --> 00:25:15,160
there's a little

628
00:25:15,160 --> 00:25:15,800
kind of piece

629
00:25:15,800 --> 00:25:16,300
of rubber

630
00:25:16,300 --> 00:25:17,220
with little slits

631
00:25:17,220 --> 00:25:17,580
in it

632
00:25:17,580 --> 00:25:18,340
behind each

633
00:25:18,340 --> 00:25:20,960
of the holes

634
00:25:20,960 --> 00:25:22,180
in this.

635
00:25:22,380 --> 00:25:23,400
And you're basically

636
00:25:23,400 --> 00:25:24,060
kind of just

637
00:25:24,060 --> 00:25:24,680
stuffing

638
00:25:24,680 --> 00:25:25,640
the pieces

639
00:25:25,640 --> 00:25:26,220
of paper

640
00:25:27,080 --> 00:25:28,080
into this

641
00:25:28,080 --> 00:25:28,780
little piece

642
00:25:28,780 --> 00:25:29,360
of rubber

643
00:25:29,360 --> 00:25:29,940
and it's about

644
00:25:29,940 --> 00:25:30,500
that thick.

645
00:25:31,180 --> 00:25:32,260
So it's,

646
00:25:32,320 --> 00:25:32,640
you know,

647
00:25:32,660 --> 00:25:33,200
you're just kind of

648
00:25:33,200 --> 00:25:33,700
pushing this

649
00:25:33,700 --> 00:25:34,400
into this rubber

650
00:25:37,160 --> 00:25:37,620
thing.

651
00:25:37,640 --> 00:25:38,220
It gives a tiny

652
00:25:38,220 --> 00:25:38,800
little bit

653
00:25:38,800 --> 00:25:39,240
of resistance.

654
00:25:39,860 --> 00:25:41,140
As the day

655
00:25:41,140 --> 00:25:42,100
goes on,

656
00:25:42,920 --> 00:25:43,960
the really

657
00:25:43,960 --> 00:25:44,500
popular

658
00:25:45,160 --> 00:25:45,500
candidate

659
00:25:46,940 --> 00:25:47,540
accumulates

660
00:25:47,540 --> 00:25:48,480
more of these

661
00:25:48,480 --> 00:25:49,000
little bits

662
00:25:49,000 --> 00:25:49,580
of paper

663
00:25:49,580 --> 00:25:49,960
called

664
00:25:49,960 --> 00:25:50,520
chad

665
00:25:50,520 --> 00:25:52,240
behind their

666
00:25:52,240 --> 00:25:52,900
little hole

667
00:25:53,540 --> 00:25:54,640
where you would

668
00:25:54,640 --> 00:25:55,420
vote for them.

669
00:25:55,940 --> 00:25:56,980
And in a

670
00:25:56,980 --> 00:25:57,920
typical election

671
00:25:57,920 --> 00:25:58,480
where,

672
00:25:58,620 --> 00:25:58,840
you know,

673
00:25:58,840 --> 00:25:59,640
maybe 100 people

674
00:25:59,640 --> 00:26:00,220
show up

675
00:26:00,220 --> 00:26:00,920
in a polling

676
00:26:00,920 --> 00:26:01,280
place,

677
00:26:01,460 --> 00:26:02,760
that's fine.

678
00:26:03,040 --> 00:26:03,740
There isn't enough

679
00:26:03,740 --> 00:26:04,360
to make a difference.

680
00:26:04,520 --> 00:26:05,120
But if there's

681
00:26:05,120 --> 00:26:06,060
a really big

682
00:26:06,060 --> 00:26:06,640
turnout,

683
00:26:07,480 --> 00:26:08,240
like, say,

684
00:26:08,320 --> 00:26:08,980
Bush versus

685
00:26:09,600 --> 00:26:09,820
Gore,

686
00:26:10,420 --> 00:26:10,860
right,

687
00:26:10,920 --> 00:26:11,320
where people

688
00:26:11,320 --> 00:26:12,180
really cared

689
00:26:12,180 --> 00:26:12,880
about the outcome

690
00:26:12,880 --> 00:26:13,480
and they knew

691
00:26:13,480 --> 00:26:13,880
it was going

692
00:26:13,880 --> 00:26:14,400
to be close,

693
00:26:15,120 --> 00:26:16,240
lots of people

694
00:26:16,240 --> 00:26:16,900
show up

695
00:26:16,900 --> 00:26:17,340
at the polling

696
00:26:17,340 --> 00:26:17,680
place.

697
00:26:17,900 --> 00:26:18,620
So these machines

698
00:26:18,620 --> 00:26:19,200
are designed

699
00:26:19,200 --> 00:26:19,700
to serve

700
00:26:19,700 --> 00:26:21,060
maybe 150 people

701
00:26:22,640 --> 00:26:23,660
across the course

702
00:26:23,660 --> 00:26:24,060
of the day

703
00:26:24,060 --> 00:26:24,600
before you have

704
00:26:24,600 --> 00:26:25,180
to open up

705
00:26:25,180 --> 00:26:25,520
the machine

706
00:26:25,520 --> 00:26:25,920
and kind of

707
00:26:25,920 --> 00:26:26,560
vacuum it out.

708
00:26:26,560 --> 00:26:28,760
But in the

709
00:26:28,760 --> 00:26:29,540
2000 election,

710
00:26:29,820 --> 00:26:31,020
it was a pretty

711
00:26:31,020 --> 00:26:32,400
popular race.

712
00:26:32,760 --> 00:26:33,900
And so what

713
00:26:33,900 --> 00:26:34,540
happened is

714
00:26:34,540 --> 00:26:35,560
that the really

715
00:26:35,560 --> 00:26:36,540
popular candidate

716
00:26:36,540 --> 00:26:37,520
in any precinct

717
00:26:37,520 --> 00:26:38,880
got physically

718
00:26:38,880 --> 00:26:40,320
harder to vote

719
00:26:40,320 --> 00:26:40,680
for

720
00:26:40,680 --> 00:26:42,300
as the day

721
00:26:42,300 --> 00:26:42,980
went on.

722
00:26:43,200 --> 00:26:44,020
And we have

723
00:26:44,020 --> 00:26:44,520
a population

724
00:26:44,520 --> 00:26:45,200
of people,

725
00:26:45,340 --> 00:26:47,100
many of whom

726
00:26:47,840 --> 00:26:48,740
aren't all

727
00:26:48,740 --> 00:26:49,600
that physically

728
00:26:49,600 --> 00:26:50,160
strong

729
00:26:50,160 --> 00:26:50,960
to begin

730
00:26:50,960 --> 00:26:51,300
with,

731
00:26:51,520 --> 00:26:51,900
right?

732
00:26:51,980 --> 00:26:53,000
This is where

733
00:26:53,000 --> 00:26:53,740
your grandparents

734
00:26:53,740 --> 00:26:54,660
go to retire.

735
00:26:55,140 --> 00:26:56,380
And so,

736
00:26:56,560 --> 00:26:57,560
the people

737
00:26:58,120 --> 00:26:58,600
showing up

738
00:26:58,600 --> 00:26:59,400
late in the day,

739
00:26:59,880 --> 00:27:00,840
if they wanted,

740
00:27:01,000 --> 00:27:01,680
if they were

741
00:27:01,680 --> 00:27:02,420
in a precinct

742
00:27:02,420 --> 00:27:03,080
where Bush was

743
00:27:03,080 --> 00:27:03,720
really popular,

744
00:27:03,920 --> 00:27:04,520
it was hard

745
00:27:04,520 --> 00:27:05,300
to vote for Bush.

746
00:27:06,360 --> 00:27:07,340
If Gore was

747
00:27:07,340 --> 00:27:07,960
really popular,

748
00:27:08,580 --> 00:27:09,460
it was hard

749
00:27:09,460 --> 00:27:10,240
to vote for Gore.

750
00:27:11,100 --> 00:27:12,020
And in

751
00:27:12,020 --> 00:27:12,720
Miami-Dade

752
00:27:12,720 --> 00:27:12,980
County,

753
00:27:13,100 --> 00:27:13,500
that happened

754
00:27:13,500 --> 00:27:13,780
a lot.

755
00:27:14,020 --> 00:27:14,900
So a normal ballot

756
00:27:14,900 --> 00:27:15,360
kind of looks

757
00:27:15,360 --> 00:27:16,300
through like this,

758
00:27:16,760 --> 00:27:18,160
you have a really

759
00:27:18,160 --> 00:27:19,000
strong hole.

760
00:27:19,240 --> 00:27:19,940
You look at

761
00:27:19,940 --> 00:27:20,840
a ballot

762
00:27:20,840 --> 00:27:21,500
when this has

763
00:27:21,500 --> 00:27:21,880
happened,

764
00:27:22,640 --> 00:27:23,480
we might have

765
00:27:23,480 --> 00:27:23,900
for the less

766
00:27:26,560 --> 00:27:26,980
straightforward

767
00:27:26,980 --> 00:27:27,940
hole in it,

768
00:27:28,320 --> 00:27:29,240
but for the

769
00:27:29,240 --> 00:27:30,440
more popular

770
00:27:30,440 --> 00:27:31,020
candidates,

771
00:27:31,500 --> 00:27:32,420
they might not

772
00:27:32,420 --> 00:27:33,220
succeed in

773
00:27:33,220 --> 00:27:33,820
pushing that

774
00:27:33,820 --> 00:27:34,540
through all

775
00:27:34,540 --> 00:27:35,060
the way.

776
00:27:35,380 --> 00:27:36,500
They might only

777
00:27:36,500 --> 00:27:37,660
kind of dimple

778
00:27:37,660 --> 00:27:38,360
it down

779
00:27:38,360 --> 00:27:39,300
a little bit,

780
00:27:39,400 --> 00:27:40,040
but not

781
00:27:41,700 --> 00:27:42,440
push it

782
00:27:42,440 --> 00:27:42,600
through

783
00:27:42,600 --> 00:27:43,120
completely.

784
00:27:43,560 --> 00:27:44,420
So what would

785
00:27:44,420 --> 00:27:45,040
happen there?

786
00:27:45,240 --> 00:27:45,640
Well,

787
00:27:45,720 --> 00:27:46,780
anybody who

788
00:27:46,780 --> 00:27:47,540
examines it

789
00:27:47,540 --> 00:27:48,140
with their eyes

790
00:27:48,140 --> 00:27:48,760
would say someone

791
00:27:48,760 --> 00:27:49,200
was clearly

792
00:27:49,200 --> 00:27:49,820
trying to vote

793
00:27:49,820 --> 00:27:50,540
for somebody

794
00:27:50,540 --> 00:27:50,780
there.

795
00:27:50,780 --> 00:27:52,420
You can kind of

796
00:27:52,420 --> 00:27:52,980
clearly do

797
00:27:53,560 --> 00:27:53,780
that.

798
00:27:55,380 --> 00:27:56,800
But if you

799
00:27:56,800 --> 00:27:57,340
run it through

800
00:27:57,340 --> 00:27:57,940
an optical

801
00:27:57,940 --> 00:27:59,460
scan reader

802
00:27:59,460 --> 00:28:00,180
that's just

803
00:28:00,180 --> 00:28:01,040
throwing light

804
00:28:01,040 --> 00:28:01,680
through this,

805
00:28:01,820 --> 00:28:02,540
that's going

806
00:28:02,540 --> 00:28:03,080
to be opaque

807
00:28:03,080 --> 00:28:03,760
and it's going

808
00:28:03,760 --> 00:28:04,320
to look as if

809
00:28:04,320 --> 00:28:04,780
they didn't

810
00:28:04,780 --> 00:28:05,380
vote for anybody.

811
00:28:05,980 --> 00:28:07,120
And that's called

812
00:28:07,120 --> 00:28:08,000
a dimpled

813
00:28:08,000 --> 00:28:08,440
Chad,

814
00:28:08,900 --> 00:28:09,680
a term

815
00:28:09,680 --> 00:28:10,980
that did not

816
00:28:10,980 --> 00:28:11,840
exist prior

817
00:28:11,840 --> 00:28:12,540
to the 2000

818
00:28:12,540 --> 00:28:13,120
election.

819
00:28:14,880 --> 00:28:16,080
Another possibility

820
00:28:16,080 --> 00:28:17,160
is that they'll

821
00:28:17,160 --> 00:28:17,700
push it through

822
00:28:17,700 --> 00:28:18,560
but not enough

823
00:28:18,560 --> 00:28:19,380
to actually

824
00:28:19,380 --> 00:28:20,420
dislodge the

825
00:28:20,420 --> 00:28:20,760
piece of

826
00:28:20,760 --> 00:28:21,340
paper from

827
00:28:21,340 --> 00:28:21,880
the ballot

828
00:28:21,880 --> 00:28:22,580
and create

829
00:28:22,580 --> 00:28:23,160
like a little

830
00:28:23,160 --> 00:28:23,600
flap.

831
00:28:24,100 --> 00:28:25,300
And that is

832
00:28:25,300 --> 00:28:25,820
called a

833
00:28:25,820 --> 00:28:26,320
hanging

834
00:28:26,320 --> 00:28:26,940
Chad.

835
00:28:27,620 --> 00:28:28,920
So these terms

836
00:28:28,920 --> 00:28:29,620
go from kind

837
00:28:29,620 --> 00:28:30,040
of cute

838
00:28:30,040 --> 00:28:30,560
sounding

839
00:28:30,560 --> 00:28:31,160
dimpled

840
00:28:31,160 --> 00:28:32,120
Chad to a

841
00:28:32,120 --> 00:28:32,400
little bit

842
00:28:32,400 --> 00:28:32,840
dirty

843
00:28:32,840 --> 00:28:33,300
sounding

844
00:28:33,300 --> 00:28:33,800
hanging

845
00:28:33,800 --> 00:28:35,360
Chad as

846
00:28:35,360 --> 00:28:37,260
you look at

847
00:28:37,260 --> 00:28:37,760
the two

848
00:28:37,760 --> 00:28:38,100
possible

849
00:28:38,100 --> 00:28:38,620
failures.

850
00:28:39,100 --> 00:28:40,300
Now if you

851
00:28:40,300 --> 00:28:41,020
think about

852
00:28:41,020 --> 00:28:41,620
using

853
00:28:41,620 --> 00:28:42,560
something

854
00:28:49,380 --> 00:28:49,400
haven't

855
00:28:49,400 --> 00:28:49,860
garbage

856
00:28:49,860 --> 00:28:50,580
collected

857
00:28:50,580 --> 00:28:52,460
the result

858
00:28:52,460 --> 00:28:53,220
that just

859
00:28:53,220 --> 00:28:53,760
looks like

860
00:28:53,760 --> 00:28:55,300
a memory

861
00:28:56,200 --> 00:28:57,300
leak problem

862
00:28:57,300 --> 00:28:58,040
in computer

863
00:28:58,040 --> 00:28:58,480
science.

864
00:28:58,680 --> 00:28:59,060
And they

865
00:28:59,060 --> 00:28:59,560
managed to

866
00:28:59,560 --> 00:28:59,840
implement

867
00:28:59,840 --> 00:29:00,540
a technology

868
00:29:00,540 --> 00:29:01,620
with a

869
00:29:01,620 --> 00:29:01,900
memory

870
00:29:01,900 --> 00:29:02,660
leak without

871
00:29:02,660 --> 00:29:03,240
malloc

872
00:29:03,240 --> 00:29:03,980
involved at

873
00:29:03,980 --> 00:29:04,160
all.

874
00:29:04,300 --> 00:29:04,640
It's really

875
00:29:06,620 --> 00:29:07,740
quite impressive.

876
00:29:08,040 --> 00:29:08,740
So what did

877
00:29:08,740 --> 00:29:08,980
we have

878
00:29:08,980 --> 00:29:09,320
to do?

879
00:29:09,560 --> 00:29:09,920
Well,

880
00:29:10,100 --> 00:29:10,920
that's

881
00:29:10,920 --> 00:29:11,360
what led

882
00:29:27,240 --> 00:29:27,400
us to

883
00:29:27,400 --> 00:29:27,480
come up

884
00:29:28,880 --> 00:29:28,960
that

885
00:29:30,320 --> 00:29:30,400
was

886
00:29:33,380 --> 00:29:33,460
designed

887
00:29:33,460 --> 00:29:33,480
to

888
00:29:33,480 --> 00:29:33,600
be

889
00:29:33,600 --> 00:29:33,620
be

890
00:29:33,620 --> 00:29:33,640
able

891
00:29:33,640 --> 00:29:33,660
to

892
00:29:33,660 --> 00:29:33,680
be

893
00:29:33,680 --> 00:29:33,700
able

894
00:29:33,700 --> 00:29:33,720
able

895
00:29:33,720 --> 00:29:33,740
be

896
00:29:33,740 --> 00:29:33,760
able

897
00:29:33,920 --> 00:29:34,000
to

898
00:29:34,080 --> 00:29:34,160
be

899
00:29:34,160 --> 00:29:34,180
able

900
00:29:34,180 --> 00:29:34,240
to

901
00:29:34,240 --> 00:29:34,260
be

902
00:29:41,220 --> 00:29:41,300
able

903
00:29:42,660 --> 00:29:42,980
to

904
00:29:42,980 --> 00:29:43,140
be

905
00:29:43,140 --> 00:29:43,560
be able

906
00:29:43,920 --> 00:29:44,240
to

907
00:30:05,540 --> 00:30:05,860
to

908
00:30:05,860 --> 00:30:06,020
turn

909
00:30:08,440 --> 00:30:08,760
on

910
00:30:08,760 --> 00:30:08,780
the

911
00:30:08,780 --> 00:30:08,940
light

912
00:30:08,940 --> 00:30:09,040
of

913
00:30:10,180 --> 00:30:10,500
the

914
00:30:10,500 --> 00:30:10,560
broken

915
00:30:10,560 --> 00:30:12,600
And what did it do?

916
00:30:12,820 --> 00:30:24,640
Well, it provided a giant pile of money for the states to shift to accessible voting technology.

917
00:30:24,800 --> 00:30:30,860
That is, voting technology that would be easy for the disabled to use, that could be adaptive, and so on.

918
00:30:31,580 --> 00:30:39,520
Now, mostly, that technology at the time Help America Vote Act was passed did not exist on the market, right?

919
00:30:39,520 --> 00:30:40,880
You couldn't just buy them.

920
00:30:41,000 --> 00:30:45,360
There were some machines that met this requirement, but not really very many.

921
00:30:45,660 --> 00:30:53,260
What it effectively mandated was the rapid development and deployment of computerized voting technology

922
00:30:53,880 --> 00:30:57,180
that was adaptable enough to be useful for the disabled.

923
00:30:57,400 --> 00:31:01,740
And that basically means touchscreen voting machines in most cases.

924
00:31:01,980 --> 00:31:03,140
Why touchscreen voting machines?

925
00:31:03,460 --> 00:31:06,560
Well, it can be adapted to multiple languages very easily.

926
00:31:06,680 --> 00:31:08,760
You can select which language you want to vote in.

927
00:31:08,760 --> 00:31:09,920
Very easily.

928
00:31:10,060 --> 00:31:16,120
It can have a little audio interface so that if you're blind, you can get instructions.

929
00:31:16,660 --> 00:31:25,420
For the profoundly mobility impaired, there are things like sip and puff interfaces that can be used to navigate the screens.

930
00:31:25,560 --> 00:31:31,180
It's actually genuinely better for people who are visually impaired, mobility impaired, and so on,

931
00:31:31,260 --> 00:31:33,500
than almost any manual technology.

932
00:31:33,840 --> 00:31:38,080
But it largely kind of didn't exist on any kind of large scale.

933
00:31:38,760 --> 00:31:41,640
At the time the Help America Vote Act passed.

934
00:31:41,960 --> 00:31:48,040
Now, it also provided substantial funding for states to buy this by a certain deadline.

935
00:31:48,740 --> 00:31:53,060
And so, what would you imagine if you were an entrepreneur around that time?

936
00:31:53,720 --> 00:31:59,740
You know, this looks like a pretty great business opportunity to meet this newly created demand

937
00:32:00,040 --> 00:32:05,640
that the federal government has provided money for, for all of the various states.

938
00:32:05,960 --> 00:32:08,220
And, you know, the market succeeded.

939
00:32:08,760 --> 00:32:11,460
And, you know, there was a significant meeting demand for this.

940
00:32:11,800 --> 00:32:17,320
Unfortunately, security requirements weren't really meaningfully represented

941
00:32:17,320 --> 00:32:21,840
in the standards that were mandated by Help America Vote Act.

942
00:32:23,620 --> 00:32:32,440
Basically, they had to have some relatively minimal checklist of reliability testing.

943
00:32:32,940 --> 00:32:36,740
It was kind of left to the states to say what those particular standards were.

944
00:32:36,740 --> 00:32:46,480
And, ultimately, a few vendors emerged to have these products that were sold to the states.

945
00:32:46,660 --> 00:32:50,540
And this money has been essentially spent at this point.

946
00:32:50,740 --> 00:33:01,020
So, we saw this very rapid shift to touch screen computerized voting since that election.

947
00:33:01,280 --> 00:33:02,920
Okay. Now, let's...

948
00:33:02,920 --> 00:33:05,640
This has been covered a lot earlier.

949
00:33:06,740 --> 00:33:12,060
Today in other talks and, you know, we have examples of this out in the hacking village.

950
00:33:12,380 --> 00:33:17,140
But I just want to talk a little bit about what the technologies are.

951
00:33:17,580 --> 00:33:22,800
The most common after Help America Vote Act was the direct recording electronic voting machine.

952
00:33:23,540 --> 00:33:26,580
That's the voting computer that stores its results internally,

953
00:33:26,860 --> 00:33:31,620
typically uses a touch screen with an adaptable interface for voting.

954
00:33:31,820 --> 00:33:36,720
There are other types of technologies that were permitted under Help America Vote Act.

955
00:33:36,720 --> 00:33:44,000
One is precinct-counted optical scan, which basically is an optical scan,

956
00:33:44,140 --> 00:33:50,740
like exams, standardized tests back in the 1990s, fill it in with a number two pencil,

957
00:33:50,920 --> 00:33:56,600
and then put it through something that looks like either a fax machine or a shredder,

958
00:33:56,660 --> 00:34:03,060
and reads your ballot and tabulates it internally, and then stores the paper ballot.

959
00:34:03,380 --> 00:34:05,020
How is that an accessible technology?

960
00:34:05,720 --> 00:34:06,700
Well, you can build batches.

961
00:34:06,720 --> 00:34:09,500
There are ballot printer devices, ballot marking devices,

962
00:34:09,720 --> 00:34:15,260
that use the touch screen interface for the visually impaired and for the mobility impaired.

963
00:34:16,620 --> 00:34:21,720
The country was roughly split, and in some states they use both of these technologies.

964
00:34:22,100 --> 00:34:26,000
And then for absentee ballots, they generally use optical scan,

965
00:34:26,880 --> 00:34:29,860
centrally counted when you mail your ballot in.

966
00:34:30,540 --> 00:34:34,520
But in all cases, computers are very heavily involved,

967
00:34:34,520 --> 00:34:39,820
not just for the tabulation, but at the polling place itself.

968
00:34:40,300 --> 00:34:46,900
So this essentially mandated pushing computer voting technology out into the field.

969
00:34:47,280 --> 00:34:53,860
You know, hundreds of these specialized devices out at every of the tens of thousands,

970
00:34:54,000 --> 00:34:56,780
hundreds of thousands of polling places in the U.S.

971
00:34:58,040 --> 00:35:01,940
Okay, now the security here now depends.

972
00:35:01,940 --> 00:35:08,420
We've now added the software and hardware of all of these voting computers

973
00:35:08,940 --> 00:35:11,260
to the security of the election.

974
00:35:11,720 --> 00:35:16,240
The correctness of the software depends a lot,

975
00:35:18,120 --> 00:35:21,740
is depended on for the integrity of the election.

976
00:35:22,000 --> 00:35:24,380
And of course, compromise of software might be subtle,

977
00:35:24,540 --> 00:35:31,520
and we don't know what we're doing when it comes to producing large-scale software that actually works.

978
00:35:31,940 --> 00:35:36,200
Hence Patch Tuesday, which is actually every day of the week now.

979
00:35:36,940 --> 00:35:38,940
And, you know, these are no exception.

980
00:35:39,200 --> 00:35:42,080
In fact, many of these machines are running, under the hood,

981
00:35:42,200 --> 00:35:49,840
the same platforms that you get urgent security updates for every day.

982
00:35:50,120 --> 00:35:53,500
So we have no general technique to determine whether software is correct.

983
00:35:53,860 --> 00:35:58,740
We have no general technique to even determine how a program behaves under all circumstances.

984
00:35:59,100 --> 00:36:01,280
And by the way, we can even prove

985
00:36:01,280 --> 00:36:02,380
that we don't know this.

986
00:36:03,120 --> 00:36:07,740
You know, this is one of the very few things software correctness knows,

987
00:36:07,860 --> 00:36:12,380
which is that general-purpose hardware is impossible to say anything reliable about.

988
00:36:13,780 --> 00:36:16,120
Complexity kind of makes building correct systems harder,

989
00:36:16,220 --> 00:36:19,900
and these systems are very, very complex.

990
00:36:21,600 --> 00:36:23,640
It's easy to hide malicious behavior,

991
00:36:26,080 --> 00:36:30,640
and it's easy to even hide the audit

992
00:36:31,280 --> 00:36:34,900
that the system maintains.

993
00:36:35,540 --> 00:36:41,100
Okay, so people have been worried about this for a while,

994
00:36:41,300 --> 00:36:44,760
and the question of whether these machines are secure

995
00:36:45,210 --> 00:36:49,420
is one that has been the focus of

996
00:36:54,400 --> 00:36:58,140
many computer scientists and election integrity advocates

997
00:36:58,140 --> 00:36:58,880
since

998
00:36:58,880 --> 00:37:01,840
these machines got introduced

999
00:37:01,840 --> 00:37:05,100
about 15 years ago on a large scale.

1000
00:37:06,700 --> 00:37:09,460
But we've had a focus very heavily

1001
00:37:09,460 --> 00:37:12,840
on the voting machines themselves.

1002
00:37:13,420 --> 00:37:16,960
And I think one of the most important things

1003
00:37:16,960 --> 00:37:19,000
to keep in mind is that

1004
00:37:19,000 --> 00:37:23,100
the voting machines themselves are kind of the shiny, attractive target.

1005
00:37:24,060 --> 00:37:26,600
These are electronic voting machines.

1006
00:37:26,600 --> 00:37:29,340
They might be able to be easily compromised,

1007
00:37:29,820 --> 00:37:38,000
and we worry a lot about whether or not they have been hacked

1008
00:37:38,000 --> 00:37:39,580
or have malicious back doors.

1009
00:37:39,960 --> 00:37:42,580
And a lot of our focus is looked at these.

1010
00:37:42,680 --> 00:37:45,660
I've been fortunate enough to participate in a number of studies

1011
00:37:45,660 --> 00:37:50,060
of these systems in which we've discovered horrific vulnerabilities

1012
00:37:50,600 --> 00:37:54,720
where we were literally limited by our typing speed

1013
00:37:54,720 --> 00:37:56,080
in writing them down.

1014
00:37:57,360 --> 00:38:01,660
And pretty much everybody who's looked at these

1015
00:38:01,660 --> 00:38:03,400
has had kind of the same experience.

1016
00:38:03,520 --> 00:38:06,120
You open them out of the box and they hit you in the face

1017
00:38:06,120 --> 00:38:07,900
with some of their vulnerabilities.

1018
00:38:08,360 --> 00:38:10,580
But in fact, in 2016,

1019
00:38:11,360 --> 00:38:15,180
we saw what was probably the first

1020
00:38:16,400 --> 00:38:20,560
in the United States large-scale attempt to disrupt an election.

1021
00:38:20,920 --> 00:38:25,620
And interestingly, it appears not to have involved voting machines themselves

1022
00:38:25,620 --> 00:38:26,760
at all.

1023
00:38:27,220 --> 00:38:31,320
It involved instead the back-end voting systems

1024
00:38:31,320 --> 00:38:35,180
used by voting officials to register voters,

1025
00:38:35,440 --> 00:38:39,160
to tally ballots, to create the ballot definitions,

1026
00:38:39,260 --> 00:38:42,540
and to manage the day-to-day election operations.

1027
00:38:44,460 --> 00:38:47,500
Why, given that these machines are so vulnerable,

1028
00:38:47,760 --> 00:38:54,080
would an attacker not use that as an attack vector,

1029
00:38:54,080 --> 00:38:56,960
but instead would do what looks to be

1030
00:38:56,960 --> 00:39:01,440
pretty garden-variety fishing and Trojan horse attacks

1031
00:39:02,080 --> 00:39:04,880
against election officials to get to their back-ends?

1032
00:39:04,960 --> 00:39:06,020
Why would they do that?

1033
00:39:06,480 --> 00:39:10,000
Well, the reason is, as easy as it is to attack a voting system,

1034
00:39:10,220 --> 00:39:14,440
it's even easier to just mail your malware to a voting official

1035
00:39:14,960 --> 00:39:17,420
wrapped inside an ostensible doc file

1036
00:39:18,080 --> 00:39:23,060
and have them open it and install it on the back-end system themselves.

1037
00:39:24,080 --> 00:39:27,640
And so, narrowly focusing on the voting machines

1038
00:39:27,640 --> 00:39:29,840
as the only part of this voting technology

1039
00:39:29,840 --> 00:39:36,720
is probably missing a large fraction of the attack surface

1040
00:39:36,720 --> 00:39:38,900
of these machines generally.

1041
00:39:39,620 --> 00:39:45,360
So I'm not going to go through all of the different things

1042
00:39:45,360 --> 00:39:50,680
that we've discovered with the existing technology,

1043
00:39:50,920 --> 00:39:53,880
except to say that four major vendors

1044
00:39:54,080 --> 00:39:56,960
of voting systems emerged after the Help America Vote Act.

1045
00:39:57,160 --> 00:39:58,960
One is called ES&S,

1046
00:40:00,500 --> 00:40:03,240
and another was called Diebold.

1047
00:40:03,560 --> 00:40:07,500
Diebold got some bad press very early on

1048
00:40:07,500 --> 00:40:09,360
about the security of its voting technology,

1049
00:40:09,580 --> 00:40:12,420
and so they fixed that by changing their name to Premier,

1050
00:40:14,660 --> 00:40:18,720
and then being bought by ES&S.

1051
00:40:18,780 --> 00:40:20,060
So the four became three.

1052
00:40:20,360 --> 00:40:23,220
And then there is Hart InterCivic and Sequoia.

1053
00:40:23,220 --> 00:40:26,960
Each of these vendors produces both DRE and optical scan systems,

1054
00:40:27,360 --> 00:40:31,420
as well as the back-end provisioning and tallying software

1055
00:40:31,420 --> 00:40:34,260
that runs on the network within a county.

1056
00:40:35,080 --> 00:40:38,160
And between ES&S and Premier,

1057
00:40:38,360 --> 00:40:39,980
which are now ultimately owned by the same place,

1058
00:40:40,140 --> 00:40:45,140
that serves kind of 80% of the voting market in the United States.

1059
00:40:46,420 --> 00:40:49,280
So there have been many questions raised

1060
00:40:49,280 --> 00:40:51,940
about the security of these systems.

1061
00:40:52,980 --> 00:40:56,420
Partly because the software and the firmware running on them

1062
00:40:56,940 --> 00:41:00,120
is closely held as a trade secret.

1063
00:41:00,480 --> 00:41:03,260
And so they're not open to public inspection.

1064
00:41:04,400 --> 00:41:07,620
States had to put a lot of pressure on the vendors

1065
00:41:07,620 --> 00:41:09,500
to allow independent reviews to happen.

1066
00:41:10,000 --> 00:41:13,340
Now, fortunately, in the most recent round

1067
00:41:13,840 --> 00:41:18,560
of exemptions to the Digital Millennium Copyright Act,

1068
00:41:18,840 --> 00:41:21,320
the Librarian of Congress,

1069
00:41:21,320 --> 00:41:25,080
granted a very broad exemption

1070
00:41:25,080 --> 00:41:30,300
to the primary law against reverse engineering these systems

1071
00:41:30,300 --> 00:41:32,940
without permission.

1072
00:41:34,040 --> 00:41:38,020
A general exemption for good faith security testing.

1073
00:41:38,260 --> 00:41:41,300
And specifically called out voting technology

1074
00:41:41,300 --> 00:41:43,680
as being one of the important areas

1075
00:41:43,680 --> 00:41:46,120
that this exemption would apply to.

1076
00:41:46,340 --> 00:41:49,940
So something that would have been very, very difficult to do legally

1077
00:41:49,940 --> 00:41:54,780
has now been largely blessed

1078
00:41:54,780 --> 00:41:57,520
as being an important public good

1079
00:41:57,520 --> 00:42:02,120
if it's done in good faith for the purpose of improving security.

1080
00:42:02,620 --> 00:42:06,260
So one of the things that I would encourage everybody to do this weekend

1081
00:42:06,780 --> 00:42:12,420
is spend some time applying your talents in the hacking room.

1082
00:42:12,500 --> 00:42:15,840
Learn how these machines work and go wild on them.

1083
00:42:16,040 --> 00:42:19,660
Take them apart because we have a kind of rare opportunity

1084
00:42:19,940 --> 00:42:24,740
to open up the community of talent

1085
00:42:25,560 --> 00:42:26,940
looking at these machines

1086
00:42:27,720 --> 00:42:29,600
orders of magnitude broader

1087
00:42:29,600 --> 00:42:33,580
than it's been open ever before.

1088
00:42:33,900 --> 00:42:36,420
And we're going to learn new things about it.

1089
00:42:36,560 --> 00:42:37,520
But I will point out,

1090
00:42:37,560 --> 00:42:40,280
the exemption only applies to you if it's done in good faith.

1091
00:42:40,340 --> 00:42:41,560
If you're trying to steal an election,

1092
00:42:41,820 --> 00:42:42,880
it does not apply to you.

1093
00:42:43,040 --> 00:42:45,660
So please tell us about and publish your results.

1094
00:42:45,900 --> 00:42:47,960
And I think I have a little bit more time for questions.

1095
00:42:48,320 --> 00:42:48,800
Thanks.

1096
00:42:56,220 --> 00:42:57,120
So, yeah.

1097
00:42:57,380 --> 00:42:59,220
What exactly was the butterfly ballot?

1098
00:42:59,680 --> 00:43:02,900
Okay, so the butterfly ballot is the question.

1099
00:43:03,200 --> 00:43:06,260
So on ballots with a lot of different races,

1100
00:43:06,600 --> 00:43:09,280
this unfortunately is not a butterfly ballot, but it could be.

1101
00:43:09,740 --> 00:43:12,540
What they would generally do is have every other hole

1102
00:43:13,220 --> 00:43:15,320
on opposite sides of the page.

1103
00:43:15,480 --> 00:43:17,620
So the even numbers would be on this side

1104
00:43:17,620 --> 00:43:19,000
and the odd numbers would be on this side.

1105
00:43:19,000 --> 00:43:21,060
And so one would be, you know,

1106
00:43:21,060 --> 00:43:24,520
Nader would be here and then Bush would be here

1107
00:43:24,520 --> 00:43:27,260
and then Gore would be here and so on.

1108
00:43:27,360 --> 00:43:30,500
And so you'd have to keep looking across the page

1109
00:43:30,500 --> 00:43:32,120
to see where your hole was.

1110
00:43:32,240 --> 00:43:35,280
That's really confusing from a usability point of view.

1111
00:43:35,400 --> 00:43:38,320
And the Florida ballot in Dade County

1112
00:43:38,320 --> 00:43:42,120
for the presidential race was a butterfly ballot,

1113
00:43:42,280 --> 00:43:45,100
called butterfly because it uses kind of both sides of the paper

1114
00:43:45,100 --> 00:43:46,840
and you can, if you use your imagination

1115
00:43:46,840 --> 00:43:48,180
and pretend this is a butterfly.

1116
00:43:49,020 --> 00:43:49,580
Yeah.

1117
00:43:50,040 --> 00:43:52,580
You mentioned you can't verify

1118
00:43:52,580 --> 00:43:55,160
if there's a problem with the holding problem.

1119
00:43:55,800 --> 00:43:58,740
But to me, the problem really would be

1120
00:43:58,740 --> 00:43:59,820
with the finite data.

1121
00:44:00,440 --> 00:44:02,040
Well, you can't actually verify

1122
00:44:02,040 --> 00:44:03,440
if there was special hardware.

1123
00:44:03,800 --> 00:44:03,980
Sure.

1124
00:44:04,080 --> 00:44:04,760
I mean, we could.

1125
00:44:04,900 --> 00:44:08,160
Look, formal verification has a role here.

1126
00:44:08,940 --> 00:44:10,060
You know, absolutely.

1127
00:44:10,240 --> 00:44:14,420
But it's really important not to look at formal verification

1128
00:44:14,420 --> 00:44:18,120
and see it as a panacea because, first of all,

1129
00:44:18,120 --> 00:44:20,160
we don't really know how to build systems

1130
00:44:20,160 --> 00:44:23,460
at the scale of the entire closed loop of an election system

1131
00:44:24,120 --> 00:44:26,540
in a formally verified way in practice.

1132
00:44:27,080 --> 00:44:29,120
And secondly, it essentially precludes

1133
00:44:29,760 --> 00:44:32,360
using any off-the-shelf software for anything

1134
00:44:32,360 --> 00:44:34,560
in any part of the system.

1135
00:44:34,760 --> 00:44:37,200
And then, of course, if any aspect of the system

1136
00:44:37,200 --> 00:44:39,400
changes out from under you, like the platform,

1137
00:44:39,520 --> 00:44:41,140
because new hardware becomes available,

1138
00:44:41,440 --> 00:44:43,500
that may break all of the things

1139
00:44:43,500 --> 00:44:44,820
that you're formally verified for.

1140
00:44:44,940 --> 00:44:47,140
So, you know, this is important.

1141
00:44:47,140 --> 00:44:49,060
It absolutely has an important role

1142
00:44:49,060 --> 00:44:53,120
in improving reliability, but it's by no means, you know,

1143
00:44:53,140 --> 00:44:55,800
we don't get to say formal verification

1144
00:44:55,800 --> 00:44:56,760
and declare victory.

1145
00:44:57,830 --> 00:45:00,880
You know, I think Rivest's idea of software independence

1146
00:45:00,880 --> 00:45:03,060
is really important here.

1147
00:45:03,160 --> 00:45:06,700
What we should try to do is aim to make little or nothing

1148
00:45:06,700 --> 00:45:09,640
in the system depend on the correctness of software.

1149
00:45:09,880 --> 00:45:13,720
So, for example, a ballot marked by the voter

1150
00:45:13,720 --> 00:45:16,660
that might be tabulated by computer

1151
00:45:17,140 --> 00:45:19,320
but that artifact stays behind

1152
00:45:19,950 --> 00:45:22,760
has the property that even if the tabulation software is bad,

1153
00:45:22,940 --> 00:45:26,020
if you get enough of a clue that it might be bad,

1154
00:45:26,260 --> 00:45:28,620
you can go back and count the paper.

1155
00:45:28,760 --> 00:45:31,360
And that's a really, really important property.

1156
00:45:31,700 --> 00:45:33,320
I've been ignoring this side. Sorry.

1157
00:45:33,720 --> 00:45:34,220
Yeah?

1158
00:45:35,660 --> 00:45:36,160
.

1159
00:45:39,460 --> 00:45:39,960
.

1160
00:45:40,920 --> 00:45:41,380
.

1161
00:45:46,360 --> 00:45:49,080
So, you know, I would look at what happened

1162
00:45:49,080 --> 00:45:51,600
after Help America Vote Act as, you know, capitalism worked.

1163
00:45:51,740 --> 00:45:54,120
The market, you know, built what the market demanded.

1164
00:45:54,360 --> 00:45:57,060
And, you know, what voting officials wanted

1165
00:45:57,060 --> 00:45:58,880
was to be able to buy new voting machines

1166
00:45:58,880 --> 00:46:01,780
according to whatever their state's requirements were.

1167
00:46:01,940 --> 00:46:03,240
And different states have...

1168
00:46:04,580 --> 00:46:08,260
There are 50 different sets of requirements,

1169
00:46:08,560 --> 00:46:09,880
all slightly different.

1170
00:46:09,960 --> 00:46:12,680
In some states, it requires a paper artifact.

1171
00:46:12,980 --> 00:46:16,060
So some states would have a paper,

1172
00:46:16,880 --> 00:46:17,960
something called a VVPAT,

1173
00:46:18,580 --> 00:46:20,100
Voter Verified Paper Audit Trail,

1174
00:46:20,240 --> 00:46:21,480
which is a little piece of paper

1175
00:46:21,480 --> 00:46:23,380
that would print out what your selection is.

1176
00:46:23,520 --> 00:46:25,700
And if you were a conscientious voter,

1177
00:46:25,920 --> 00:46:27,240
you could look at that and see

1178
00:46:27,240 --> 00:46:30,900
that the touchscreen thing that I touched

1179
00:46:30,900 --> 00:46:32,220
is actually being printed.

1180
00:46:32,520 --> 00:46:34,200
And in the event of a recount,

1181
00:46:34,420 --> 00:46:36,900
the paper would be what's counted.

1182
00:46:37,040 --> 00:46:38,640
Even that, they would get wrong sometimes.

1183
00:46:38,640 --> 00:46:41,540
In the machines that we looked at for one state,

1184
00:46:41,720 --> 00:46:43,680
the way the VVPAT worked was

1185
00:46:43,680 --> 00:46:45,060
it would print that out,

1186
00:46:45,180 --> 00:46:47,080
but it would also then print a barcode

1187
00:46:47,640 --> 00:46:49,520
with what your vote was.

1188
00:46:49,800 --> 00:46:51,080
And in the event of a recount,

1189
00:46:51,260 --> 00:46:52,760
what they would count was the barcodes.

1190
00:46:53,340 --> 00:46:55,760
And so, you know, unless you have a barcode reader

1191
00:46:55,760 --> 00:46:57,060
with you in the voting booth,

1192
00:46:57,220 --> 00:46:59,780
you have no way of actually verifying that.

1193
00:46:59,920 --> 00:47:00,720
So, yeah. Yeah.

1194
00:47:05,640 --> 00:47:07,560
This must baffle you terribly

1195
00:47:07,560 --> 00:47:08,740
at how stupid we're being.

1196
00:47:35,780 --> 00:47:37,380
Well, so, you know, I mean,

1197
00:47:37,560 --> 00:47:40,960
I can't speak to the entirety of U.S. politics.

1198
00:47:42,060 --> 00:47:45,080
But, you know, the short answer is

1199
00:47:45,080 --> 00:47:47,920
we could automate a lot less than we do.

1200
00:47:48,840 --> 00:47:51,500
But, you know, the scale of U.S. elections

1201
00:47:51,500 --> 00:47:57,900
is like no other in any other country in the world.

1202
00:47:57,940 --> 00:47:59,380
We just vote on more issues.

1203
00:47:59,500 --> 00:48:01,460
We have more different kinds of ballots.

1204
00:48:01,820 --> 00:48:04,180
You know, the pressure to automate

1205
00:48:04,180 --> 00:48:05,860
components of U.S. elections

1206
00:48:05,860 --> 00:48:09,960
is higher than probably anywhere else in the world.

1207
00:48:10,160 --> 00:48:11,820
But, you know, I'm obviously sympathetic

1208
00:48:11,820 --> 00:48:14,480
to the point of view that, you know,

1209
00:48:14,480 --> 00:48:17,580
the first requirement is that we should

1210
00:48:17,580 --> 00:48:19,380
have high confidence in the outcome.

1211
00:48:20,020 --> 00:48:21,620
So, you had your hand up. Yeah.

1212
00:48:26,900 --> 00:48:28,820
Compared to what followed.

1213
00:48:30,140 --> 00:48:31,260
Yeah. Yes.

1214
00:48:31,880 --> 00:48:32,440
Yeah.

1215
00:48:32,440 --> 00:48:33,080
Yeah.

1216
00:48:33,080 --> 00:48:35,980
Given the influx of money

1217
00:48:35,980 --> 00:48:37,580
that's available to the global government

1218
00:48:37,580 --> 00:48:39,060
is after the Holocaust,

1219
00:48:39,340 --> 00:48:40,380
without the supply,

1220
00:48:40,660 --> 00:48:41,820
the D.R.A. mission,

1221
00:48:41,860 --> 00:48:44,820
and that money is not available now,

1222
00:48:45,120 --> 00:48:47,060
and what will entities be looking for

1223
00:48:47,060 --> 00:48:49,560
for a $10 million spend

1224
00:48:49,560 --> 00:48:53,000
for going to conversations about people,

1225
00:48:54,120 --> 00:48:56,240
how many entities have that money?

1226
00:48:56,400 --> 00:48:59,540
Well, this is a terribly difficult problem, right?

1227
00:48:59,600 --> 00:49:02,020
One consequence of federalism is,

1228
00:49:02,020 --> 00:49:04,220
we push this down to the state level.

1229
00:49:04,340 --> 00:49:06,760
The states generally push the purchasing decisions

1230
00:49:06,760 --> 00:49:08,160
down to the local level.

1231
00:49:08,720 --> 00:49:11,640
You know, so that mostly means counties in the U.S.

1232
00:49:11,800 --> 00:49:14,680
Essentially, it means that the election budget

1233
00:49:15,220 --> 00:49:19,580
is competing with building fire stations and roads

1234
00:49:19,580 --> 00:49:22,900
and, you know, sewers that don't clog up

1235
00:49:22,900 --> 00:49:24,140
and other things people want.

1236
00:49:24,320 --> 00:49:25,480
You know, if you're a county official,

1237
00:49:25,700 --> 00:49:28,820
you know, do you want to go to your constituents

1238
00:49:28,820 --> 00:49:31,240
and say, hey, I got us great new voting machines,

1239
00:49:31,240 --> 00:49:33,840
or, you know, I paved that road

1240
00:49:33,840 --> 00:49:35,380
with all the damn potholes on it?

1241
00:49:35,480 --> 00:49:40,640
So it's, you know, that's what the political reality is

1242
00:49:40,640 --> 00:49:41,620
in most of the U.S.

1243
00:49:41,660 --> 00:49:42,060
Yeah?

1244
00:49:42,180 --> 00:49:43,720
So I actually have two questions.

1245
00:49:43,880 --> 00:49:44,800
One is, real quick,

1246
00:49:45,060 --> 00:49:50,620
where is the weak link in the ecosystem?

1247
00:49:50,960 --> 00:49:54,280
Is it the machine itself, or is it the...

1248
00:49:54,280 --> 00:49:56,120
So I think the competition

1249
00:49:56,120 --> 00:49:58,500
for where the weak link is is fierce.

1250
00:50:00,180 --> 00:50:01,220
The competition...

1251
00:50:01,240 --> 00:50:03,680
The competition for where the weak link is here is fierce.

1252
00:50:04,080 --> 00:50:04,680
It's fierce.

1253
00:50:04,720 --> 00:50:05,020
Yes.

1254
00:50:05,140 --> 00:50:05,540
Very...

1255
00:50:05,540 --> 00:50:06,820
A lot of weak links.

1256
00:50:07,080 --> 00:50:07,520
Yeah?

1257
00:50:07,900 --> 00:50:11,780
The notion that there is so much diversity

1258
00:50:11,780 --> 00:50:14,500
within machines and within the different

1259
00:50:14,500 --> 00:50:16,780
and different technologies

1260
00:50:16,780 --> 00:50:20,200
within the sort of the voting process

1261
00:50:20,200 --> 00:50:23,320
and the general election, can you speak to that?

1262
00:50:23,440 --> 00:50:25,660
So one of the...

1263
00:50:25,660 --> 00:50:26,920
You know, an argument that's made,

1264
00:50:27,000 --> 00:50:29,520
and this argument is a double-edged sword,

1265
00:50:29,520 --> 00:50:33,380
is that we have high diversity here

1266
00:50:33,380 --> 00:50:38,740
in both the operational places that are running elections

1267
00:50:38,740 --> 00:50:41,780
as well as the technologies that are used, right?

1268
00:50:41,840 --> 00:50:44,220
We have 3,000 counties in the U.S.,

1269
00:50:44,220 --> 00:50:46,520
which means 3,000 different offices,

1270
00:50:47,480 --> 00:50:48,960
all a little bit different,

1271
00:50:49,120 --> 00:50:51,280
running, you know, machines from four vendors

1272
00:50:51,280 --> 00:50:53,200
of which there are multiple versions of them.

1273
00:50:53,280 --> 00:50:54,760
And, you know, one thing you could...

1274
00:50:54,760 --> 00:50:57,320
A kind of trite conclusion you could reach

1275
00:50:57,320 --> 00:50:59,500
is that it would be really hard

1276
00:50:59,500 --> 00:51:01,680
to cover all of this if an attacker wanted

1277
00:51:01,680 --> 00:51:03,600
to completely alter the U.S. election.

1278
00:51:03,880 --> 00:51:07,080
But unfortunately, what this means is that,

1279
00:51:07,120 --> 00:51:08,520
first of all, an attacker doesn't necessarily

1280
00:51:08,520 --> 00:51:10,100
have to cover all of them.

1281
00:51:10,180 --> 00:51:12,340
They have to cover enough of them to achieve their outcome.

1282
00:51:12,560 --> 00:51:14,680
And their outcome might simply be

1283
00:51:14,680 --> 00:51:17,520
casting doubt on the ultimate result,

1284
00:51:18,440 --> 00:51:21,160
casting doubt on the legitimacy of whoever is elected.

1285
00:51:21,880 --> 00:51:24,580
It's sufficient to do that to show

1286
00:51:24,580 --> 00:51:27,100
that at least one of them has been compromised

1287
00:51:27,100 --> 00:51:29,480
and leave the question about whether the others have been

1288
00:51:29,500 --> 00:51:29,820
compromised.

1289
00:51:30,040 --> 00:51:32,100
So that diversity doesn't necessarily

1290
00:51:33,560 --> 00:51:35,320
buy us everything we need.

1291
00:51:35,460 --> 00:51:37,060
The second is, as a cryptographer,

1292
00:51:37,640 --> 00:51:39,860
you know, we have this kind of strong idea,

1293
00:51:40,000 --> 00:51:41,220
you know, when somebody says,

1294
00:51:41,320 --> 00:51:43,440
well, what block cipher should I be using?

1295
00:51:43,560 --> 00:51:44,920
We just say, use AES.

1296
00:51:45,160 --> 00:51:47,580
And then they say, but, wait a minute,

1297
00:51:47,620 --> 00:51:51,120
if AES is broken, you know, what if AES is broken?

1298
00:51:51,320 --> 00:51:53,300
That would just be terrible and it would have

1299
00:51:53,300 --> 00:51:56,140
a horribly disruptive effect on everything.

1300
00:51:56,340 --> 00:51:58,540
But the nice thing about this is now we've had

1301
00:51:58,540 --> 00:52:02,420
one system that's been scrutinized so heavily

1302
00:52:02,420 --> 00:52:06,400
that, you know, if you discover a flaw in AES,

1303
00:52:06,760 --> 00:52:09,900
you get to be cryptographer of the century.

1304
00:52:10,440 --> 00:52:13,560
And it's a heavily rewarded thing that, you know,

1305
00:52:13,620 --> 00:52:16,800
enormous intellectual effort has gone into

1306
00:52:16,800 --> 00:52:19,540
understanding what the properties are.

1307
00:52:19,720 --> 00:52:22,420
If there were 3,000 different versions of it,

1308
00:52:22,500 --> 00:52:24,780
no one of them would have the level of scrutiny

1309
00:52:24,780 --> 00:52:27,500
that the really heavily looked for one was.

1310
00:52:27,500 --> 00:52:29,900
So that's kind of the counterpoint to that.

1311
00:52:31,340 --> 00:52:32,940
Okay, I think we have time for, like,

1312
00:52:32,960 --> 00:52:34,660
two more questions if you're quick.

1313
00:53:07,980 --> 00:53:11,300
So one of the best things that happened

1314
00:53:11,300 --> 00:53:15,140
to concerns about this was when, you know,

1315
00:53:15,140 --> 00:53:20,000
once somebody from both parties has lost an election,

1316
00:53:20,240 --> 00:53:22,720
it stops being a partisan issue.

1317
00:53:23,000 --> 00:53:27,200
And hopefully, you know, we'll remember that, you know,

1318
00:53:27,200 --> 00:53:30,500
that we've had, you know, both Democrat and Republican

1319
00:53:31,060 --> 00:53:35,560
losers of elections since these machines have been introduced.

1320
00:53:35,840 --> 00:53:40,220
And that will help turn this into a less fiercely partisan issue.

1321
00:53:40,380 --> 00:53:44,260
But my ability to predict the future is sadly limited

1322
00:53:44,260 --> 00:53:46,100
on how this will go.

1323
00:53:46,320 --> 00:53:49,080
Hopefully, you know, but I can be hopeful and optimistic.

1324
00:53:50,340 --> 00:53:51,460
Okay, yeah.

1325
00:53:58,280 --> 00:53:58,840
.

1326
00:54:12,260 --> 00:54:14,260
So I'm not personally familiar.

1327
00:54:14,480 --> 00:54:16,680
I mean, they're using some quantum communication channel.

1328
00:54:16,820 --> 00:54:19,340
As a cryptographer, this quantum thing is terribly confusing

1329
00:54:19,340 --> 00:54:22,800
because we have quantum computers and quantum communication,

1330
00:54:23,040 --> 00:54:24,620
and they're totally different things.

1331
00:54:24,740 --> 00:54:26,500
And one affects cryptanalysis,

1332
00:54:26,500 --> 00:54:27,480
and the other affects communication.

1333
00:54:29,080 --> 00:54:34,260
But the, you know, there are certainly ways to use technologies

1334
00:54:34,260 --> 00:54:36,760
that are better than the way we're using them.

1335
00:54:36,900 --> 00:54:39,980
But I think our issues, we have to look at the kind of architectural issues

1336
00:54:40,500 --> 00:54:43,760
first before we can, if we're going to start from scratch,

1337
00:54:44,240 --> 00:54:47,800
I think we have to look at the architectural issues first.

1338
00:54:48,200 --> 00:54:50,620
So you add your hand up.

1339
00:54:50,800 --> 00:54:52,140
I think you get the last word.

1340
00:54:52,660 --> 00:54:53,100
.

1341
00:54:53,100 --> 00:54:54,280
.

1342
00:55:07,860 --> 00:55:11,240
I mean, certainly having multiple vendors and so on

1343
00:55:11,240 --> 00:55:15,240
is absolutely a reasonable thing to be thinking about.

1344
00:55:15,400 --> 00:55:17,940
But when I think about architectural issues,

1345
00:55:18,120 --> 00:55:20,280
I think about questions of things like software independence

1346
00:55:20,280 --> 00:55:22,340
and really fundamental questions

1347
00:55:22,340 --> 00:55:23,720
of what the model is.

1348
00:55:23,840 --> 00:55:29,140
And I think those will deserve quite a bit of attention

1349
00:55:29,140 --> 00:55:31,220
as we move forward on this.

1350
00:55:31,320 --> 00:55:33,140
So thanks very much, everyone.

1351
00:55:33,320 --> 00:55:36,700
And we have a great panel coming up.