All right, so the next section is how do we get here history of voting technology hanging chads and help America vote act
Matt blaze
Cryptographer and associate professor of computing and information science at the University of Pennsylvania
We'll take it from here
So welcome congratulations on lasting this long
So I'm going to step back a little bit. So a little bit about me. I'm a
computer scientist I focus on computer security and cryptography stuff and I've been working
partly on
voting technology and other kinds of
related systems
probably for about a dozen
years now and
one of the things that
I've been very lucky enough to do is that I've been working on
is participate in
several of the state
top-to-bottom reviews of voting technology that were done ahead of the 2008 election where a
few people were given access to the source code and the hardware and so on of the most of the
electronic voting systems discovered in the country and we were asked, you know, our task was to basically say are these things secure and
the first question you ask is
You should ask when given that task is
Well, what's secure me?
What what are the requirements of this system that we're trying to measure against it?
And so for a voting system one question at a very high level is
What are the requirements for a voting system? That is how do you tell if a voting system is serving?
Democracy whatever that means and as far as I can tell the requirements
for a
democracies voting system is
These four words right one person one vote. Where do these four words come from?
These are in the Constitution, right?
for the Declaration of Independence or
Something no, who knows it's a slogan, right?
So one person one vote. What does that actually?
Mean and that's a good question. So first of all voting for what right most of?
Most of our voting is for officials rather than
Issues, although in California you are asked to make about six thousand decisions about
Various initiatives that's kind of an exception. Mostly. We're asking other people to make our day-to-day
governmental decisions for us and that's who we're voting for but even those officials are appointing other people
So we have a kind of representative democracy or a republic or something along those lines that isn't precisely
one person one vote on every single thing government does so it's already kind of fuzzy right there
The second is that, you know now we can look a little bit
Well, what is person mean?
and I think what that means is that the influence of your vote is supposed to be based on
whether or not you're a person and
You get if you are your personhood entitles you to as many votes as other people's personhoods
do and not
some other qualifications so it's not money or land ownership or noble birth even though in early
U.S. democracy we certainly cared a lot about those things but once you figured out who is a
person every person is supposed to have the same influence and eligibility and by the way we have
the electoral college in this country which also affects that so we're already kind of qualifying
this a lot and we're only kind of halfway through this has evolved over time in the United States
you know the expression used to be one man one vote and you know it took until the 20th century
before we realized that we were kind of a priori excluding half of voters in the United States
you know we had this concept of slavery and automatically disenfranchised citizens
who didn't get to vote for the longest time until the 14th amendment and we used to have in many
places tests for eligibility to vote illiteracy tests and so on so again personhood has has had
asterisks next to it throughout this history and it also involves more than merely your eligibility
to vote but your access to voting as well as some assurance that you're that you don't merely
get to vote but you get a vote that counts and so we want some concept of fairness in the elections
well what does fairness in the election mean well we can come up with some requirements and as soon
as you you're a technologist it becomes really easy to add new requirements to this as soon as you
start listing them you know you're you you can't even write them down as quickly as you can think of
of them
so we want things like equal access to the ballot to be able to run for office to being on the voter rolls to being able to cast ballots so you don't want people to be disadvantaged in any of those things
in the United States almost all adult citizens are eligible to vote is voting optional or is it mandatory that's a question in the United States it's optional there are other countries where voting that we would consider voting that we would consider democracies where voting is mandatory Australia for example
public graduation can affect Learn I unchecked
people too many weeks about
that
to be positive
out of voting
no one can find out
how who voted that's mean your best
could either reward you or punish you depending on how your vote happened. We don't want there to be
transferability. You don't want to be able to transfer your ability to vote to another person.
In the last talk we heard about somebody who has their lawyer vote for them for some reason and
that's not supposed to be allowed in our system. And then we have ultimately public confidence in
the outcome. We want not only this to be true, but we want people to believe that it's been true.
Now, if you are a computer scientist, one of the things you do is you look at the requirements and
you say, well, the best thing I can possibly do when given a set of requirements is show that
there's no point in even trying to build a system that meets them because it's theoretically
impossible. And this is the sort of set of requirements that lends itself to that very
quickly because we can kind of see.
That some of these requirements kind of contradict each other,
that you might have to choose between one or the other or make some kind of compromises
down the line among them. So the one that I want to focus on is secrecy versus transparency.
We want everybody to be confident in the outcome. We want everybody to be confident
that their particular vote is counted, but we don't want to be able to prove how any individual
voted or allow somebody else to be able to find out how it was.
That's pretty hard and it leads to lots of
difficulty in designing very heavily constrained systems. One of the things we hear
over and over again is, well, hey, we have secure ATM machines. Why cannot we have secure
Well, in an ATM machine you kind of get a receipt of how much money you withdrew.
And we really don't want, because of one of the requirements,
to give people a receipt showing how they voted.
And so on and so on.
So this is kind of difficult.
So the best slogan I can come up with is,
one adult citizen, one easily exercised but non-transferable option
to cast a secret accurately counted vote after a fairly conducted public campaign
that will determine their representative for certain issues.
And that's kind of the computer scientist version of one person, one vote.
Okay, so there's technology involved here.
We have been increasingly using technology to conduct elections,
although that has not been true since the beginning.
Early elections in the US, as I think a number of speakers in this track have pointed out,
basically consisted of a bunch of rich dudes
showing up in a room and raising their hands on election day.
And everybody could kind of agree on what the outcome was from that.
But that has the problem that it's not secret.
So we didn't have ballot secrecy from the very beginning in the United States.
And it probably doesn't scale very well.
Asking people to all show up in the same room and raise their hand and count
is probably not something that could scale up to kind of modern population density.
So what that means is not just the principles have become important,
but the mechanisms with which we implement these principles have become really important.
And so technologies for voting have evolved over time
to increasingly allow, to take advantage of new advances in technology,
to allow voting to scale up,
and to try to bolster
one or another of the kind of informally stated requirements that elections have.
So we have paper ballots.
Mark something and put it into a box.
We have machine-counted ballots.
Mark something in some way and drop it into a box
so that it can then be counted and tabulated by some sort of machinery.
We have direct recording
of voting machines.
Interact with a machine that mechanically will mark a ballot
that is then stored inside the machine itself.
Those were the machines I grew up on.
New York State had them.
These machines with these levers,
you would flick the little levers.
What they would really do is mark a little advancing piece of paper
for each poll.
When you pull this big lever, a ker-chunk happens.
That's the sound of democracy in action.
The curtain opens, and then you can leave the room.
Those machines were in use since the late 1930s
through around 2000 throughout much of the country.
Another type of machine is replacing that,
but with modern computer technology.
So instead of a lever, you touch a screen,
and instead of marking on a piece of paper,
you store it on a memory card.
And because the voting community is great at catchy names,
those are called direct recording electronic voting machines.
They're direct recording because they record directly inside the machine.
They're electronic because they're computers.
I prefer to call them, as many people in the electronic voting community
prefer to remind us that that means they're voting computers.
And that means that understanding what they do
is as easy or hard
as understanding what any general-purpose computing device does,
and whether or not it actually works faithfully
is as hard or as easy as building bug-free software.
Now, perception and reality are linked here.
Public confidence in elections
is what gives government legitimacy.
And now public confidence in elections
is not just a matter of whether or not we trust the vote,
but whether or not we trust
all of the technology
that led to the ultimate tabulation of the vote.
So in other words, computer science
and building reliable computing systems
as we use computers for this
is actually kind of central
to whether or not we regard
the government we have
as legitimately being allowed to govern.
In other words, you should be in this room thinking about this.
You should be engaged in this issue, as you all are.
And you should scold people who aren't here
for not showing up, right?
Okay, so what's the threat model
is the first question
a computer science security type would ask.
And the traditional threat model
for an election is what?
It's the traditional thing
that we have to defend an election against.
What?
Well, so we wanted to...
What would you be trying to do?
What would an attacker be trying to do?
Fraudulently vote.
We want to stop people
from casting more than one vote per person.
We want to stop people
from being able to sell or buy votes.
We want to prevent ballot stuffing
to prevent somebody
from getting elected to dog catcher
without actually the will of the people
being behind that.
Yeah?
Mm-hmm.
So absolutely.
But the threat is ultimately
in the service of cheating on the election.
That's kind of the traditional threat model
that we all are trying to think of.
And I'm sure you have a lot to say,
but I get to talk.
The traditional threat model is cheating, right?
Trying to alter the outcome to serve you
because either you think
you get to vote more times than you should
or because you're the candidate
and you really want this office
instead of that other jerk.
And in fact, there's a long history
of this sort of...
this sort of fraud in U.S. elections.
We've had, you know, people being sent
into polling stations to vote
by candidates and vote buying
and ballot stuffing
and a number of ingenious ways,
many of which have interacted
in remarkably quick ways
with a new voting technology
where somebody has figured out
how to exploit a flaw
in some new voting technology
that has come out.
And so almost all of the laws
and procedures and so on
have been looking at this threat model.
And one question you have to ask
about any new technology
is whether it can become easily unplugged
and stop the video from going through.
And...
Let's see.
And that'll show up in a second.
So the thing you have to ask
about any new technology
is compared to
the technology that preceded it,
does this make that threat
easier or harder, right?
Does the next technology
that comes along
make us better off or worse off
against this threat?
And the electronic voting community
at the time that I've worked in it
has largely, you know,
asked the question,
are DRE machines better against
this sort of traditional threat?
Than the paper systems
or what have you
that they had before.
There's also another threat.
And this is a threat
that we haven't...
We've kind of understood,
but we haven't understood it
in quite the sharp way
that we understand it now
until the most recent
national election.
And that's the threat
of hostile state actors.
That is, someone who's not
necessarily interested
in stealing a local office,
but rather interested in doing that
or perhaps other things.
Perhaps disrupting the vote itself
to create disorder
or casting doubt
on the legitimacy
of the winner to govern
as a hostile state action,
as an act of state aggression.
And this is a very different
class of threat.
This is a class of threat
in which, first of all,
the attacker is trying to do...
May be satisfied
with many more different
kinds of outcomes
than someone trying to steal
a specific office
who's focused on one thing.
And is also an attacker
who's likely to have
vastly greater resources,
both to understand
the underlying technology
as well as to carry out the attack.
And so a question
we also have to ask is,
does whatever the technology
we're using,
make this threat
an easier threat
or a tougher threat?
And that's a question
we haven't really been sharply asking
for very long.
Okay, voting in the US,
everybody knows,
voting in the US
is highly decentralized.
Federal government only sets
kind of broad standards.
Each state has its own laws,
but elections are run
at the local level,
mostly run by counties.
There are over 3,000 counties
in the United States.
And then,
in places where you vote in person,
election takes place
in neighborhood voting precincts,
which might serve,
you know,
hundreds of voters
within that precinct
and there might be tens,
hundreds,
or thousands of those precincts
per county itself.
US elections are more complex
than almost anywhere in the world.
We make more decisions.
We have more races.
And within precincts,
there may be multiple
different kinds of ballots
because you might be voting
not just for president,
but also for, like,
who represents you
on the school board.
And that might be different
from other people voting
in the same precinct.
So we have really complicated elections
and that very much means
that computers have a natural role
in simplifying the tabulation process.
It's, you know,
it's not nefarious
that people have thought
of the idea
of using computers for this
because it's a pretty natural consequence
of just how complex
and large-scale US elections are.
Does anyone recognize this photo?
So this is...
What was this photo of?
Hanging Chad.
So that man was named Chad?
Or...
So this was one
of the Florida recount judges
in a remarkably fortunate
capture-the-moment pose
looking at a ballot
and examining it
from the 2000 Florida election.
A question for you,
and people have different answers
to this question.
How many people
look at this picture
and say what an embarrassment
that technology is?
Versus how many of you
look at that picture
and say what a great thing
that technology was?
How many think
what an embarrassment
that technology is?
In this room,
not that many.
How many people think
what a great thing
that technology was?
Yeah, I'm probably
in that category too.
Why?
Those are the only two
in this room.
That is not...
Yeah, you can rant at me
after the talk.
Okay.
The...
Okay.
So...
So I happen to have one here.
So this is an example
of one of these machines.
Because...
Okay.
So this is an example
of one of these machines.
And I have a photo of it,
which I will put up.
But while that's going,
I can just show you
what the photo is of.
This is a punch card
voting machine.
And this is the type
used in Florida.
This particular one
was from Wisconsin.
And it has the ballot in it
from...
The ballot card in it
from the 2000 election.
And it's a really
interesting thing
about this technology.
Because the first thing
you will notice
about this technology
is there is no...
There are no electronics
involved in this at all.
The...
This is 1960s technology.
These started to be produced
in the 1960s.
They were used
through about 2000.
And then something
mysteriously happened
to make people not like them.
And the voting experience
does not involve
any electronics
at the polling place.
There are electronics
involved in the tabulating.
And what do you do?
Well, how do you vote?
Well, what you do
is you take a ballot,
which are given
by your poll worker.
And this is usually
contained in a booth.
The booth does have
electricity involved.
You...
It's for the light
above the thing
that illuminates it.
And that's about it.
You take your ballot
and you insert it
into the machine.
And you push it down
a little bit.
There's a little spring
that makes sure
you line it up properly
on these two little
red knobs.
And now,
you can flip through
your voting instructions.
And when you want to vote,
you pick your candidate.
I'm going to vote down
the straight
Wisconsin Greens ticket.
I have no idea
what they stand for.
I presume it has to do
with moldy cheese.
And I'm going to vote
for them.
And now,
I voted.
And now,
what have I done?
Well,
I pulled my ballot out.
And you will notice,
you can see a little hole
in there
that I have made.
It's punched out.
These are perforated
little rectangles
associated with
each possible
position here.
And so,
if you voted
for somebody,
one of those little holes
would get punched out.
And you can,
if you're a suspicious type,
you might imagine
that,
hey,
wait a minute.
How do I know
I actually marked
the correct position?
Well,
you would notice that,
well,
my candidate was number 68.
And oh,
look,
it's box number 68
that's been punched out.
And now,
you take your ballot,
you rip it apart,
you put it in the ballot box
or wherever it goes.
And they take a stack
of these
and they put them through
a typical,
like,
IBM-style punch card,
Hollerith card reader.
And it shines
a little light
through each card
one at a time
and produces
a result.
So,
all of the technology,
all of the computer type
technology
and the electronics
are on the back end
of the system.
The voting itself
is actually
a pretty
low-tech process.
So,
there's an interesting
property
of these machines
that
is
really
quite
remarkable,
which is that
in spite of the fact
that there are no computers
involved
at the polling place,
there is,
and I can't decide
whether to call it
a memory leak
or a buffer overflow
attack
in the vote casting process.
And anyone who was alive
during late 2000
learned all about this technology.
What would happen?
Well,
at the beginning of the day,
you put your card in
and you punch holes in it.
And the holes get punched in
pretty easily.
Now,
I want us to move
from Wisconsin
where people are very hardy
to Florida
where people are old
and have arthritis.
And imagine that you're
kind of old
and arthritic.
You're being asked
to perform a little bit
of a physical feat
in voting.
You have to take
this little stylus,
line it up,
and punch through
the card.
But it's actually
fairly easy to do.
You know,
there's a little
perforation in here.
It's actually fairly easy
to punch through
the card.
But what happens
is because
of conservation
of matter,
the little pieces
of paper
that you are
punching
out
go somewhere.
And where do
they go?
Well,
this is the machine.
Well,
there's a little
kind of piece
of rubber
with little slits
in it
behind each
of the holes
in this.
And you're basically
kind of just
stuffing
the pieces
of paper
into this
little piece
of rubber
and it's about
that thick.
So it's,
you know,
you're just kind of
pushing this
into this rubber
thing.
It gives a tiny
little bit
of resistance.
As the day
goes on,
the really
popular
candidate
accumulates
more of these
little bits
of paper
called
chad
behind their
little hole
where you would
vote for them.
And in a
typical election
where,
you know,
maybe 100 people
show up
in a polling
place,
that's fine.
There isn't enough
to make a difference.
But if there's
a really big
turnout,
like, say,
Bush versus
Gore,
right,
where people
really cared
about the outcome
and they knew
it was going
to be close,
lots of people
show up
at the polling
place.
So these machines
are designed
to serve
maybe 150 people
across the course
of the day
before you have
to open up
the machine
and kind of
vacuum it out.
But in the
2000 election,
it was a pretty
popular race.
And so what
happened is
that the really
popular candidate
in any precinct
got physically
harder to vote
for
as the day
went on.
And we have
a population
of people,
many of whom
aren't all
that physically
strong
to begin
with,
right?
This is where
your grandparents
go to retire.
And so,
the people
showing up
late in the day,
if they wanted,
if they were
in a precinct
where Bush was
really popular,
it was hard
to vote for Bush.
If Gore was
really popular,
it was hard
to vote for Gore.
And in
Miami-Dade
County,
that happened
a lot.
So a normal ballot
kind of looks
through like this,
you have a really
strong hole.
You look at
a ballot
when this has
happened,
we might have
for the less
straightforward
hole in it,
but for the
more popular
candidates,
they might not
succeed in
pushing that
through all
the way.
They might only
kind of dimple
it down
a little bit,
but not
push it
through
completely.
So what would
happen there?
Well,
anybody who
examines it
with their eyes
would say someone
was clearly
trying to vote
for somebody
there.
You can kind of
clearly do
that.
But if you
run it through
an optical
scan reader
that's just
throwing light
through this,
that's going
to be opaque
and it's going
to look as if
they didn't
vote for anybody.
And that's called
a dimpled
Chad,
a term
that did not
exist prior
to the 2000
election.
Another possibility
is that they'll
push it through
but not enough
to actually
dislodge the
piece of
paper from
the ballot
and create
like a little
flap.
And that is
called a
hanging
Chad.
So these terms
go from kind
of cute
sounding
dimpled
Chad to a
little bit
dirty
sounding
hanging
Chad as
you look at
the two
possible
failures.
Now if you
think about
using
something
haven't
garbage
collected
the result
that just
looks like
a memory
leak problem
in computer
science.
And they
managed to
implement
a technology
with a
memory
leak without
malloc
involved at
all.
It's really
quite impressive.
So what did
we have
to do?
Well,
that's
what led
us to
come up
that
was
designed
to
be
be
able
to
be
able
able
be
able
to
be
able
to
be
able
to
be
be able
to
to
turn
on
the
light
of
the
broken
And what did it do?
Well, it provided a giant pile of money for the states to shift to accessible voting technology.
That is, voting technology that would be easy for the disabled to use, that could be adaptive, and so on.
Now, mostly, that technology at the time Help America Vote Act was passed did not exist on the market, right?
You couldn't just buy them.
There were some machines that met this requirement, but not really very many.
What it effectively mandated was the rapid development and deployment of computerized voting technology
that was adaptable enough to be useful for the disabled.
And that basically means touchscreen voting machines in most cases.
Why touchscreen voting machines?
Well, it can be adapted to multiple languages very easily.
You can select which language you want to vote in.
Very easily.
It can have a little audio interface so that if you're blind, you can get instructions.
For the profoundly mobility impaired, there are things like sip and puff interfaces that can be used to navigate the screens.
It's actually genuinely better for people who are visually impaired, mobility impaired, and so on,
than almost any manual technology.
But it largely kind of didn't exist on any kind of large scale.
At the time the Help America Vote Act passed.
Now, it also provided substantial funding for states to buy this by a certain deadline.
And so, what would you imagine if you were an entrepreneur around that time?
You know, this looks like a pretty great business opportunity to meet this newly created demand
that the federal government has provided money for, for all of the various states.
And, you know, the market succeeded.
And, you know, there was a significant meeting demand for this.
Unfortunately, security requirements weren't really meaningfully represented
in the standards that were mandated by Help America Vote Act.
Basically, they had to have some relatively minimal checklist of reliability testing.
It was kind of left to the states to say what those particular standards were.
And, ultimately, a few vendors emerged to have these products that were sold to the states.
And this money has been essentially spent at this point.
So, we saw this very rapid shift to touch screen computerized voting since that election.
Okay. Now, let's...
This has been covered a lot earlier.
Today in other talks and, you know, we have examples of this out in the hacking village.
But I just want to talk a little bit about what the technologies are.
The most common after Help America Vote Act was the direct recording electronic voting machine.
That's the voting computer that stores its results internally,
typically uses a touch screen with an adaptable interface for voting.
There are other types of technologies that were permitted under Help America Vote Act.
One is precinct-counted optical scan, which basically is an optical scan,
like exams, standardized tests back in the 1990s, fill it in with a number two pencil,
and then put it through something that looks like either a fax machine or a shredder,
and reads your ballot and tabulates it internally, and then stores the paper ballot.
How is that an accessible technology?
Well, you can build batches.
There are ballot printer devices, ballot marking devices,
that use the touch screen interface for the visually impaired and for the mobility impaired.
The country was roughly split, and in some states they use both of these technologies.
And then for absentee ballots, they generally use optical scan,
centrally counted when you mail your ballot in.
But in all cases, computers are very heavily involved,
not just for the tabulation, but at the polling place itself.
So this essentially mandated pushing computer voting technology out into the field.
You know, hundreds of these specialized devices out at every of the tens of thousands,
hundreds of thousands of polling places in the U.S.
Okay, now the security here now depends.
We've now added the software and hardware of all of these voting computers
to the security of the election.
The correctness of the software depends a lot,
is depended on for the integrity of the election.
And of course, compromise of software might be subtle,
and we don't know what we're doing when it comes to producing large-scale software that actually works.
Hence Patch Tuesday, which is actually every day of the week now.
And, you know, these are no exception.
In fact, many of these machines are running, under the hood,
the same platforms that you get urgent security updates for every day.
So we have no general technique to determine whether software is correct.
We have no general technique to even determine how a program behaves under all circumstances.
And by the way, we can even prove
that we don't know this.
You know, this is one of the very few things software correctness knows,
which is that general-purpose hardware is impossible to say anything reliable about.
Complexity kind of makes building correct systems harder,
and these systems are very, very complex.
It's easy to hide malicious behavior,
and it's easy to even hide the audit
that the system maintains.
Okay, so people have been worried about this for a while,
and the question of whether these machines are secure
is one that has been the focus of
many computer scientists and election integrity advocates
since
these machines got introduced
about 15 years ago on a large scale.
But we've had a focus very heavily
on the voting machines themselves.
And I think one of the most important things
to keep in mind is that
the voting machines themselves are kind of the shiny, attractive target.
These are electronic voting machines.
They might be able to be easily compromised,
and we worry a lot about whether or not they have been hacked
or have malicious back doors.
And a lot of our focus is looked at these.
I've been fortunate enough to participate in a number of studies
of these systems in which we've discovered horrific vulnerabilities
where we were literally limited by our typing speed
in writing them down.
And pretty much everybody who's looked at these
has had kind of the same experience.
You open them out of the box and they hit you in the face
with some of their vulnerabilities.
But in fact, in 2016,
we saw what was probably the first
in the United States large-scale attempt to disrupt an election.
And interestingly, it appears not to have involved voting machines themselves
at all.
It involved instead the back-end voting systems
used by voting officials to register voters,
to tally ballots, to create the ballot definitions,
and to manage the day-to-day election operations.
Why, given that these machines are so vulnerable,
would an attacker not use that as an attack vector,
but instead would do what looks to be
pretty garden-variety fishing and Trojan horse attacks
against election officials to get to their back-ends?
Why would they do that?
Well, the reason is, as easy as it is to attack a voting system,
it's even easier to just mail your malware to a voting official
wrapped inside an ostensible doc file
and have them open it and install it on the back-end system themselves.
And so, narrowly focusing on the voting machines
as the only part of this voting technology
is probably missing a large fraction of the attack surface
of these machines generally.
So I'm not going to go through all of the different things
that we've discovered with the existing technology,
except to say that four major vendors
of voting systems emerged after the Help America Vote Act.
One is called ES&S,
and another was called Diebold.
Diebold got some bad press very early on
about the security of its voting technology,
and so they fixed that by changing their name to Premier,
and then being bought by ES&S.
So the four became three.
And then there is Hart InterCivic and Sequoia.
Each of these vendors produces both DRE and optical scan systems,
as well as the back-end provisioning and tallying software
that runs on the network within a county.
And between ES&S and Premier,
which are now ultimately owned by the same place,
that serves kind of 80% of the voting market in the United States.
So there have been many questions raised
about the security of these systems.
Partly because the software and the firmware running on them
is closely held as a trade secret.
And so they're not open to public inspection.
States had to put a lot of pressure on the vendors
to allow independent reviews to happen.
Now, fortunately, in the most recent round
of exemptions to the Digital Millennium Copyright Act,
the Librarian of Congress,
granted a very broad exemption
to the primary law against reverse engineering these systems
without permission.
A general exemption for good faith security testing.
And specifically called out voting technology
as being one of the important areas
that this exemption would apply to.
So something that would have been very, very difficult to do legally
has now been largely blessed
as being an important public good
if it's done in good faith for the purpose of improving security.
So one of the things that I would encourage everybody to do this weekend
is spend some time applying your talents in the hacking room.
Learn how these machines work and go wild on them.
Take them apart because we have a kind of rare opportunity
to open up the community of talent
looking at these machines
orders of magnitude broader
than it's been open ever before.
And we're going to learn new things about it.
But I will point out,
the exemption only applies to you if it's done in good faith.
If you're trying to steal an election,
it does not apply to you.
So please tell us about and publish your results.
And I think I have a little bit more time for questions.
Thanks.
So, yeah.
What exactly was the butterfly ballot?
Okay, so the butterfly ballot is the question.
So on ballots with a lot of different races,
this unfortunately is not a butterfly ballot, but it could be.
What they would generally do is have every other hole
on opposite sides of the page.
So the even numbers would be on this side
and the odd numbers would be on this side.
And so one would be, you know,
Nader would be here and then Bush would be here
and then Gore would be here and so on.
And so you'd have to keep looking across the page
to see where your hole was.
That's really confusing from a usability point of view.
And the Florida ballot in Dade County
for the presidential race was a butterfly ballot,
called butterfly because it uses kind of both sides of the paper
and you can, if you use your imagination
and pretend this is a butterfly.
Yeah.
You mentioned you can't verify
if there's a problem with the holding problem.
But to me, the problem really would be
with the finite data.
Well, you can't actually verify
if there was special hardware.
Sure.
I mean, we could.
Look, formal verification has a role here.
You know, absolutely.
But it's really important not to look at formal verification
and see it as a panacea because, first of all,
we don't really know how to build systems
at the scale of the entire closed loop of an election system
in a formally verified way in practice.
And secondly, it essentially precludes
using any off-the-shelf software for anything
in any part of the system.
And then, of course, if any aspect of the system
changes out from under you, like the platform,
because new hardware becomes available,
that may break all of the things
that you're formally verified for.
So, you know, this is important.
It absolutely has an important role
in improving reliability, but it's by no means, you know,
we don't get to say formal verification
and declare victory.
You know, I think Rivest's idea of software independence
is really important here.
What we should try to do is aim to make little or nothing
in the system depend on the correctness of software.
So, for example, a ballot marked by the voter
that might be tabulated by computer
but that artifact stays behind
has the property that even if the tabulation software is bad,
if you get enough of a clue that it might be bad,
you can go back and count the paper.
And that's a really, really important property.
I've been ignoring this side. Sorry.
Yeah?
.
.
.
So, you know, I would look at what happened
after Help America Vote Act as, you know, capitalism worked.
The market, you know, built what the market demanded.
And, you know, what voting officials wanted
was to be able to buy new voting machines
according to whatever their state's requirements were.
And different states have...
There are 50 different sets of requirements,
all slightly different.
In some states, it requires a paper artifact.
So some states would have a paper,
something called a VVPAT,
Voter Verified Paper Audit Trail,
which is a little piece of paper
that would print out what your selection is.
And if you were a conscientious voter,
you could look at that and see
that the touchscreen thing that I touched
is actually being printed.
And in the event of a recount,
the paper would be what's counted.
Even that, they would get wrong sometimes.
In the machines that we looked at for one state,
the way the VVPAT worked was
it would print that out,
but it would also then print a barcode
with what your vote was.
And in the event of a recount,
what they would count was the barcodes.
And so, you know, unless you have a barcode reader
with you in the voting booth,
you have no way of actually verifying that.
So, yeah. Yeah.
This must baffle you terribly
at how stupid we're being.
Well, so, you know, I mean,
I can't speak to the entirety of U.S. politics.
But, you know, the short answer is
we could automate a lot less than we do.
But, you know, the scale of U.S. elections
is like no other in any other country in the world.
We just vote on more issues.
We have more different kinds of ballots.
You know, the pressure to automate
components of U.S. elections
is higher than probably anywhere else in the world.
But, you know, I'm obviously sympathetic
to the point of view that, you know,
the first requirement is that we should
have high confidence in the outcome.
So, you had your hand up. Yeah.
Compared to what followed.
Yeah. Yes.
Yeah.
Yeah.
Given the influx of money
that's available to the global government
is after the Holocaust,
without the supply,
the D.R.A. mission,
and that money is not available now,
and what will entities be looking for
for a $10 million spend
for going to conversations about people,
how many entities have that money?
Well, this is a terribly difficult problem, right?
One consequence of federalism is,
we push this down to the state level.
The states generally push the purchasing decisions
down to the local level.
You know, so that mostly means counties in the U.S.
Essentially, it means that the election budget
is competing with building fire stations and roads
and, you know, sewers that don't clog up
and other things people want.
You know, if you're a county official,
you know, do you want to go to your constituents
and say, hey, I got us great new voting machines,
or, you know, I paved that road
with all the damn potholes on it?
So it's, you know, that's what the political reality is
in most of the U.S.
Yeah?
So I actually have two questions.
One is, real quick,
where is the weak link in the ecosystem?
Is it the machine itself, or is it the...
So I think the competition
for where the weak link is is fierce.
The competition...
The competition for where the weak link is here is fierce.
It's fierce.
Yes.
Very...
A lot of weak links.
Yeah?
The notion that there is so much diversity
within machines and within the different
and different technologies
within the sort of the voting process
and the general election, can you speak to that?
So one of the...
You know, an argument that's made,
and this argument is a double-edged sword,
is that we have high diversity here
in both the operational places that are running elections
as well as the technologies that are used, right?
We have 3,000 counties in the U.S.,
which means 3,000 different offices,
all a little bit different,
running, you know, machines from four vendors
of which there are multiple versions of them.
And, you know, one thing you could...
A kind of trite conclusion you could reach
is that it would be really hard
to cover all of this if an attacker wanted
to completely alter the U.S. election.
But unfortunately, what this means is that,
first of all, an attacker doesn't necessarily
have to cover all of them.
They have to cover enough of them to achieve their outcome.
And their outcome might simply be
casting doubt on the ultimate result,
casting doubt on the legitimacy of whoever is elected.
It's sufficient to do that to show
that at least one of them has been compromised
and leave the question about whether the others have been
compromised.
So that diversity doesn't necessarily
buy us everything we need.
The second is, as a cryptographer,
you know, we have this kind of strong idea,
you know, when somebody says,
well, what block cipher should I be using?
We just say, use AES.
And then they say, but, wait a minute,
if AES is broken, you know, what if AES is broken?
That would just be terrible and it would have
a horribly disruptive effect on everything.
But the nice thing about this is now we've had
one system that's been scrutinized so heavily
that, you know, if you discover a flaw in AES,
you get to be cryptographer of the century.
And it's a heavily rewarded thing that, you know,
enormous intellectual effort has gone into
understanding what the properties are.
If there were 3,000 different versions of it,
no one of them would have the level of scrutiny
that the really heavily looked for one was.
So that's kind of the counterpoint to that.
Okay, I think we have time for, like,
two more questions if you're quick.
So one of the best things that happened
to concerns about this was when, you know,
once somebody from both parties has lost an election,
it stops being a partisan issue.
And hopefully, you know, we'll remember that, you know,
that we've had, you know, both Democrat and Republican
losers of elections since these machines have been introduced.
And that will help turn this into a less fiercely partisan issue.
But my ability to predict the future is sadly limited
on how this will go.
Hopefully, you know, but I can be hopeful and optimistic.
Okay, yeah.
.
So I'm not personally familiar.
I mean, they're using some quantum communication channel.
As a cryptographer, this quantum thing is terribly confusing
because we have quantum computers and quantum communication,
and they're totally different things.
And one affects cryptanalysis,
and the other affects communication.
But the, you know, there are certainly ways to use technologies
that are better than the way we're using them.
But I think our issues, we have to look at the kind of architectural issues
first before we can, if we're going to start from scratch,
I think we have to look at the architectural issues first.
So you add your hand up.
I think you get the last word.
.
.
I mean, certainly having multiple vendors and so on
is absolutely a reasonable thing to be thinking about.
But when I think about architectural issues,
I think about questions of things like software independence
and really fundamental questions
of what the model is.
And I think those will deserve quite a bit of attention
as we move forward on this.
So thanks very much, everyone.
And we have a great panel coming up.