You've been working so hard. Thank you, thank you. All right, folks. Looks like the stream is
active, and I'd like to thank our speaker again for this presentation. Take it away, Reem.
Okay, thank you. So, I'm Reem Buznek, as Steve already said, and I will be talking about the
security of Pennsylvania election systems. This was a project that I conducted under
the supervision of Professor Andrea Mitwishin. Can you go to the next slide, Steve?
Yep, I got you. Thank you. This is Professor Andrea Mitwishin. I believe that everyone knows
her, but it was good to put that picture there. And then, if you hit again, Steve, you will find
my face. There you go. And who am I? I'm a law graduate. I had two master's degrees. I focused
on, in the first one, I focused on internet regulations and freedom of expression in the
MENA region, the Middle East and North Africa. And in this second master's, I focused on national
security law and information security law. And I was working with Professor Mitwishin
as a research assistant. And hopefully, and very soon, I will be joining the pilot lab
as a postdoctoral fellow. So, I'm going to tell you now what we're going to be talking exactly
about. First of all, I will start with a brief introduction to the history of Pennsylvania
election system security. I will tell you a little bit about some fraud cases, some
problems in the information in the voting systems, et cetera, and how the new administration
improved the current election system. Then I will tell you more about the core of the project,
which is more about sending write-to-no requests to every county in Pennsylvania, all of the 67.
And then asking for copies of election system vendor agreements, related documents,
technical specificities, et cetera. And then in the third part of my speech, I will
tell you about my preliminary findings based on the review of the agreements
and I will tell you all about how many documents we received, what types of documents, et cetera.
You go, Steve. Thank you. So, as I said, I will start with the election history in PA.
So, according to the Heritage Foundation, there have been only 23 fraud cases in the history of
elections. But when we say only 23, it doesn't mean that they're not important.
So, I gathered some examples of fraud cases in Pennsylvania. The first one is about Robin. Robin
is a judge of elections and with the help of Laura, who is an election inspector, she signed
under her son's name and cast a ballot in his place. So, it's an impersonation fraud, as opposed.
The second case is about this guy, Mr. Victor, who voted in both Philadelphia and Lehigh County.
So, he casted two ballots. The third case is Mr. Richard. Actually, he's a former police chief
of Harmon Township in Allegheny County. And he applied for absentee ballots and made people not
eligible for the absentee ballot to cast them. And in a while, I will tell you about the absentee
ballot and what it exactly means. A fourth example is the former congressman,
Austin Murphy. He actually also committed absentee ballot fraud. He made senior citizens in nursing
homes to vote in a certain way, the way he wanted. But he said that he was just helping them.
So, we believe him. And the last case is Harry. It's a new one in 2019. And he actually picked
up girls. He made girls sign absentee ballots in the names of deceased people, which makes me a
little bit sorry because with the advanced systems of ensuring that there are no duplicate registration,
there are still, until 2019, it is still possible to impersonate a deceased person.
Next slide, please. So, the problems in the election system in Pennsylvania
isn't only about fraud cases, but also about election system malfunctions. So,
these are some examples prior to 2005 that I gathered. And they're mostly about the DRE
malfunctions. DRE, it means direct recording electronic voting machines, which means that
these voting machines do not use paper ballot systems. So, the only record of the votes that
have been cast is electronic. That's why there was this case in 2004. DRE records 83% blank
presidential votes, which doesn't make sense. And that's why they knew that there were these
malfunctions. And this is a funny story, another one in 2012. There is this person who actually
took a video with his smartphone of the malfunction. He made a video of the voting system,
how it changed his vote from Obama to another candidate. Next slide, please.
So, before the enactment of HAVA, Pennsylvania's election law provided new statewide guidelines.
Basically, all the 67 counties were autonomous, and they had different election systems
using a variety of voting machines. The HAVA is the Help America Vote Act. It was enacted in 2002,
and it created a new mandatory minimum standards for states to follow in several key areas of
election administration. It also required states to establish a statewide voter registration
database, and it made the state follow certain systems over others and made high standards for
the voting machines that can be used for elections. About the statewide voter registration
base, Pennsylvania has a top-down system, which means that it makes a central platform
at the state level that connects with all the local jurisdictions. So, it goes top to down.
They gather information on a state level. Also, before, there weren't any information
security training programs before 2018. And now, since many requirements became,
like many things became required under Act 77, I will tell you about it in a while,
companies started having the responsibilities and the obligations to provide their customers
with training regarding the usage of the voting systems or how to maintain their security.
The other thing is that, so, as I said, the DRE voting machines do not use paper ballots.
So, the only records that are kept are electronic. And now, Pennsylvania has changed all its
voting systems, voting machines. Over 25,000 voting machines have been replaced. And the
governor made them use all voter-verifiable paper records. And actually, it helped, because I will
tell you in a little bit about some cases in 2019 that some malfunctions happened in the voting
machines and they had to turn to those paper ballots. Can we go to the next slide? Thank you.
So, the new administration brought improvements. First, by purchasing new, more accessible,
auditable, and secure voting systems. The second thing is that it enacted Act 77,
which I will talk a little bit more about in a minute. But thanks to this Act,
all Pennsylvanians can now vote by mailing ballots without having to provide an excuse,
which helps people to register more. And because the way it used to be, it was that you can only
cast your ballot through the mail if you have an excuse. Now, you don't need an excuse. You just
apply for it. Also, now counties make election officials do random tests of voting machines on
election days. And they incorporated added checks and other improvements into the SURE system to
reduce data errors and improve accuracy. About the SURE system, so it's an abbreviation of Statewide
Uniform Registry of Electors. And it's a system that Pennsylvania has to assist the counties with
training and user development, continuous improvement, etc. And there were, so as we
talked a little bit earlier about impersonating deceased people, so developing the SURE system
helps minimize the number of duplicates or the use of registered deceased people.
Next, please. So here you go. Act 77, election reform bill. It was enacted in 2019, so mainly
the biggest thing about this bill is that it allows mail-in ballots. As I said,
anyone can apply for a mail-in ballot. So basically, if you are eligible to vote,
you are eligible to apply for a mail-in ballot. And you can apply for it until
the Tuesday before the election. The absentee ballot is the same as it was. If you have
a disability or illness, if you are in the military, if you have a religious celebration
that conflicts with the date of the elections, you can apply for an absentee ballot. So this is
for people with an excuse. And under Act 77, the shortcut straight party button,
which is also known as the straight ticket to vote for all candidates of one party,
is no longer available. And there was a lot of tension about this because both sides say that
it will make the voter reluctant as to vote for all candidates and look for who is Republican,
who is Democrat. But it was taken off. And also, another thing that was prohibited is the use of
stickers for writing candidates. Writing candidates are people who you may vote for
despite not being in the ballot. And what I mean by sticker is that in their campaigns, these
people can distribute some stickers to the people having their names on. And it used to be
that the voters can just put the sticker on the paper ballot and it will be counted.
Now, the stickers are prohibited to be used and the stamps are very discouraged to be used
because of the wet ink. But it's not prohibited under Act 77. Next slide.
So the use of mail-in ballots and this new Act encouraged more people to enroll in the
elections. So this year, 1.8 million Pennsylvanians applied for mail-in ballots
and it is 17 times more than the elections of 2016. But there is a problem with that,
is that the current election code doesn't allow election officials to begin counting ballots until
7 a.m. on the election day. And election officers are worried that they wouldn't be able to meet the
deadline and to announce the results the night of November 3. And even the former governor is calling
the election officials to make it possible to start counting the ballots earlier. But we will
see what happens. And even with all these improvements, some counties still experience
election system malfunctions in this June elections. The next, please.
So many problems, many malfunctions were reported. I will give you three examples. York
County, Northampton County and Bucks County. In York County, the paper ballot system was defective
because the ballots were printed on shorter paper and the scanners could not read those ballots.
And for some papers, some other papers, it took longer than it should be to read those ballots.
The case is worse in Northampton County, because in this case, there was a problem with the
tabulation in some of the precincts. And the state ordered the county to count the paper ballots
rather than rely on machine totals. And why it says human error late, it's because... so the
manufacturer later explained and told everyone that 50% of the machines were actually
improperly manufactured. So who to blame? And the last example is Bucks County. In Bucks County,
there was also a problem with the paper ballots because of the irregularities. And the irregularities
made the papers a fraction of an inch too wide to fit into the new built-in machine scanners.
So before, the problem was we do not have paper ballot machines. Now we have them, but the papers
they used, they didn't make sure that the paper ballots fit the scanners. Now whose
problem is this? It should be the manufacturer, because they should provide the counties with all
the systems and everything that goes with them to perform as expected.
Can I have the next, please? So I told why I talked in the beginning about this in order to
tell you a little bit why we made this project, why we started this project. Because there is
a natural problem in the election system. There are malfunctions and they are affecting
the polls and the counts. So we decided to do this project. Next slide, please.
We decided to do this project and to have an idea about the contracts that have been signed
between the counties and the voting system companies. We also wanted to have a sense of
which systems are used in which counties, because there are a lot of different systems used.
And we also wanted to have a closer read on the agreements in order to see what are the system
vendors' duties towards the counties and how would they assure maintaining the information
security of the systems. That's our background. Next, please. So how we started doing this?
Pennsylvania has a right to know law, number 65, and it provides for access to public information
obtained from local government or state agencies. Pursuant to this law, we sent 67 requests,
one to each county. We started on the 15th of April, 2020, and most counties invoked the 30
days extension. And we are still waiting for many counties to respond and to provide us with
the documents we requested. And in a little bit, I will give you the exact numbers.
So here are the responses we got. The counties varied in dealing with our right to know request.
44 out of 67 counties provided us with the documents, but they also varied in what documents
they provided us with. And 14 counties invoked the 30 days extension, but they still didn't
provide us with the documents. And it has been three months now, so maybe we should re-request.
So seven counties didn't respond at all to our request. And let me, just to clarify,
all the requests were sent by email, online. And we made sure, and I made sure,
that we contacted the right people, the open records officers.
And then two counties were hard to reach. One didn't have online applications, so we will
have to send them a mail or a fax. Yeah, they still use that. And two counties, only two
counties requested payments. So these counties requested payment for printing and for the
flash drives, not for anything else. All the other counties were nice enough to send us everything
without requiring any payment. Next please. So as I said, now I was talking about 67 counties.
Now I'm only going to talk about 44 counties, the counties that provided us with the documents
and the ones that responded to our requests. I noticed that there are four companies the
counties have been dealing with. Dominion Voting Systems Incorporated, 10 counties
signed with them. Election Systems and Software, ES&S, 25 counties signed with them.
Clear Ballot Group, seven counties signed with them. And Election IQ, two counties signed with
them. And let me say that the terms of the contracts that we receive vary from a company
to another. They don't all have the same terms. And I will be talking about the terms in a little
bit. Can we have the next slide, please? And here we go. The documents received in total.
As I said, each county sent us the documents they assumed fit. So we received 40 sales agreements,
14 sales orders, 11 purchase orders, four invoices, 10 bids. About the bids,
some counties sent us only the bid of the company they signed with. And some counties sent us all
the bids they received from all companies and the agreement. Six counties sent us the manuals.
By manuals, I mean the documents containing technical specifications about the system,
the voting system used. 14 counties sent us marketing materials. Marketing materials are
mostly flyers and papers showing how exactly as a voter you use the election system. So nothing
elaborate. Two reports, interior reports. So they made a diagnosis before the usage of
the voting machines. So they sent us the reports. Two counties sent us their loan agreements. So
they had loan agreements in order to be able to buy and purchase the new voting systems.
Two counties sent us their codes and two counties sent us product schedule.
So we were lucky enough to have at least 40 agreements at hand. Now, about the NDA,
18 counties invoked NDA. And it was mainly about the technical specifications
of the voting machines. They mostly, they all provided us with the agreement.
But some, so 18 of them didn't provide us, said that they cannot provide us with the
technical specificities because of a non-disclosure agreement. 16 did not invoke NDAs,
but that doesn't mean that they provided us with all the documents we asked for. They just
didn't invoke it and didn't send us. But the good thing is that they say we can appeal,
but we didn't appeal. And 8 counties did not invoke NDAs, but they just said we do not have
those documents. And as you see here, the language varies from a county to another. Some counties
made an effort to provide us with elaborate responses with legal explanation. Other counties,
for example, they said the company had us read up the information or we cannot, the information
you're asking for or the documents requested are not public records and that's it.
And so all counties that provided manuals, you know, remember the six manuals we received,
did not invoke NDAs. And even though they did not deny providing documents pursuant to an NDA
provision, counties varied in the number of documents they provided and they mostly did
not provide us with technical specifications. Yeah. Can we go to the next slide, please?
Thank you. And now, so that's about the project. Now to be more specific and to have
preliminary comparisons between the terms of contracts from the different, the four companies
the counties were dealing with. The next, please.
So as you see in the first slide, I just put some different pricings. Each company had a
different price. The prices varied from 450,000 to 700 and so thousands. Next, please.
But the thing that mostly all counties agreed upon in all their different companies,
in all their different agreements, were the company's responsibilities. So each company
is obliged to deliver a complete voting system, having the hardware and the software,
according to the agreed upon project schedule, install the hardware and the software for the
county, provide a user license, assign a project manager to help with, to enable all services and
to make sure that all deliverables have been sent in a proper way and according to the agreement.
Also, they are bound to provide customers with all product documentations, architecture and
technical specifications, et cetera. And they are required to provide the necessary training
materials to the counties and, I mean, the election officials and provide access to
training videos if they are available and or provide trainings on site if they were required.
And also, they would assist in the acceptance testing process. But one vendor, though,
stated an additional responsibility and it was that they will have to remove and securely destroy
all voting machines currently owned by the client and the certificate of destruction
shall be issued to the client. That was one vendor that was required to do that.
Back to the NDA. So, the NDA clause in the agreement, all the companies included a
confidentiality clause and all companies included a definition of either confidential information
or proprietary information, which is good from a lawyer perspective because these terms are pretty
vague and if you do not include them and if you don't include the definition, basically,
if one party discloses certain information, it will be hard to prove that it was confidential
information in the sense of the agreement. So, basically, it says that neither party
shall disclose to any third party any proprietary or confidential information of the other party
and the information should be used by parties with reasonable care not to allow disclosure.
One vendor indicated that this agreement, the confidentiality agreement, is binding even after
the term of the sales agreement and two vendors stated that if the customer was asked to disclose
certain information, they must notify the company and request their consent and I actually saw that
in many emails between me and the accountant, they stated in the email that we provide you
these documents but I will be contacting the company and asking whether it is possible to
share other information with you and they wait for their consent and then they get back to me
with the documents if the company accepts. But one remark here is that the six counties
that provided us with manuals were also bound by such confidentiality agreements
but they still provided the documents, the technical specificities. So, to what extent
are the counties respecting such NDAs? I don't know. But personally, I'm happy. At least we
got six examples of technical specifications to revise, to review. Can you have the next slide,
please? About first measure. So, first measure is mainly not being able to deliver product,
hardware, software, etc. as a result of acts of God, weather, unforeseeable circumstances,
fire, war, anything you can imagine. As long as it's not, it's beyond the control of the party
that could not meet their duty or obligation to deliver such products. So, in the agreements,
we reviewed, only two vendors had first measure clause. And they state that
neither party shall be liable in case first measure things happen. But for the other two
vendors, it was a bit different. Because one vendor did not state, did not include a first
measure clause on its own. But under limitation of remedies, they said that the vendor assumes
no liabilities, no liability for delays as a result of acts of God, weather, unforeseeable
circumstances, etc. So, they included the first measure clause. They excluded themselves from
liability, but the clause doesn't say anything about the customer. The first vendor, though,
included a first measure clause under another clause, which is defects due to customer actions
or omissions. And in this case, they actually state that the customer shall pay for any loss
caused by acts of God, fire, flooding, riots, acts of war, etc. So, they are making the customer
liable, which is a peril to the customer. This is about first measure. Next, please.
Next is the indemnification clause. So, an indemnity clause is a contractual transfer of risk
between two contractual parties, generally to prevent loss or compensate for a loss,
which may occur as a result of specified events. Here, in the agreement, we had only two vendors
have included indemnification clauses, but the other two vendors remained silent on the matter,
which means that in case such problems occur, the issue will have to be disputed.
Next, please. So, limitation of liability. Here, I provided three sample clauses of
the limitation of liability clauses we found in the various agreements we had.
So, two vendors limit the liability for the company only.
And two vendors limit the liability for both parties.
And all companies, for all companies, the liability, they state that the liability
shall in no event exceed the total amount of the agreement.
And two vendors stated that the limitation of liability clause does not limit the indemnification
obligation. Next, please. About the license and use. So, all companies state that they
have to grant the customer a non-exclusive, non-transferable license to use the system
they provided them with. And they only can use it with a licensed software on licenses we have in
the course of operating the equipment and solely for the purposes of the elections. Any other use
would be considered breach of contract and the companies assert sole rights in the software.
And certain companies included in their agreement that reverse engineering, so,
they were more specified, specific, and they said reverse engineering, reengineering, duplicating
the source code or any other thing to replicate the source code is prohibited. Which is under
the terms of a license. About the warranties. So, the companies warrant that the software
they are providing is original and will operate in substantial performance and that the hardware
is free from defects. Three vendors warranted hardware between one year and five years. So,
there is a variation there. And, of course, a vendor did not specify the duration.
Which can be interpreted that they will be warranted for life. And that's not good for
the companies. But that's just a preliminary reading. So, what they warrant is that the
warranty is to fix or replace the defective hardware or malware. About the updates and
upgrades. Here, if you follow with me the language, some vendors say that they may provide
new releases, upgrades, updates, et cetera. And other vendors say they will make certified
software upgrades available. So, for certain companies, they are not required or obligated
to make upgrades to their systems. And here is a problem. If they're not updating their systems,
they can make new systems and then the counties will have to buy the new systems because their
old systems are no longer okay to run. So, this obligation versus possibility dilemma,
there it exists. Next, please. So, here's all the information I wanted to share with you about
the project, about the process, and about preliminary reading of the agreement. And
please, if you have any questions, just give them to me.
So, it looks like... well, before we continue, we would like to thank our speaker again for giving
us this awesome talk. It's actually kind of interesting how... a little sketchy how it is
with some of these devices and some of the manufacturers. A little eye-opening, I would say.
But it looks like we have a talk in the channel that says, how many different vendors did you
see in total? In total, we had four. So, as I told you, out of 67 counties, only 44 provided us