[00:00.000 --> 00:07.440]  You've been working so hard. Thank you, thank you. All right, folks. Looks like the stream is
[00:07.440 --> 00:13.540]  active, and I'd like to thank our speaker again for this presentation. Take it away, Reem.
[00:14.140 --> 00:22.880]  Okay, thank you. So, I'm Reem Buznek, as Steve already said, and I will be talking about the
[00:22.880 --> 00:29.160]  security of Pennsylvania election systems. This was a project that I conducted under
[00:29.160 --> 00:38.160]  the supervision of Professor Andrea Mitwishin. Can you go to the next slide, Steve?
[00:38.600 --> 00:44.240]  Yep, I got you. Thank you. This is Professor Andrea Mitwishin. I believe that everyone knows
[00:44.240 --> 00:50.360]  her, but it was good to put that picture there. And then, if you hit again, Steve, you will find
[00:50.360 --> 01:02.960]  my face. There you go. And who am I? I'm a law graduate. I had two master's degrees. I focused
[01:02.960 --> 01:08.900]  on, in the first one, I focused on internet regulations and freedom of expression in the
[01:08.900 --> 01:15.560]  MENA region, the Middle East and North Africa. And in this second master's, I focused on national
[01:15.560 --> 01:21.160]  security law and information security law. And I was working with Professor Mitwishin
[01:21.160 --> 01:26.360]  as a research assistant. And hopefully, and very soon, I will be joining the pilot lab
[01:26.360 --> 01:35.580]  as a postdoctoral fellow. So, I'm going to tell you now what we're going to be talking exactly
[01:35.580 --> 01:42.100]  about. First of all, I will start with a brief introduction to the history of Pennsylvania
[01:42.100 --> 01:49.160]  election system security. I will tell you a little bit about some fraud cases, some
[01:50.420 --> 01:59.140]  problems in the information in the voting systems, et cetera, and how the new administration
[02:00.280 --> 02:08.180]  improved the current election system. Then I will tell you more about the core of the project,
[02:08.180 --> 02:18.860]  which is more about sending write-to-no requests to every county in Pennsylvania, all of the 67.
[02:18.940 --> 02:24.320]  And then asking for copies of election system vendor agreements, related documents,
[02:24.320 --> 02:29.620]  technical specificities, et cetera. And then in the third part of my speech, I will
[02:30.680 --> 02:36.220]  tell you about my preliminary findings based on the review of the agreements
[02:36.220 --> 02:44.900]  and I will tell you all about how many documents we received, what types of documents, et cetera.
[02:45.720 --> 02:54.740]  You go, Steve. Thank you. So, as I said, I will start with the election history in PA.
[02:54.740 --> 03:01.280]  So, according to the Heritage Foundation, there have been only 23 fraud cases in the history of
[03:01.280 --> 03:08.440]  elections. But when we say only 23, it doesn't mean that they're not important.
[03:09.360 --> 03:19.440]  So, I gathered some examples of fraud cases in Pennsylvania. The first one is about Robin. Robin
[03:19.440 --> 03:25.940]  is a judge of elections and with the help of Laura, who is an election inspector, she signed
[03:25.940 --> 03:35.120]  under her son's name and cast a ballot in his place. So, it's an impersonation fraud, as opposed.
[03:35.120 --> 03:43.560]  The second case is about this guy, Mr. Victor, who voted in both Philadelphia and Lehigh County.
[03:43.560 --> 03:53.540]  So, he casted two ballots. The third case is Mr. Richard. Actually, he's a former police chief
[03:53.540 --> 04:02.220]  of Harmon Township in Allegheny County. And he applied for absentee ballots and made people not
[04:02.220 --> 04:09.120]  eligible for the absentee ballot to cast them. And in a while, I will tell you about the absentee
[04:09.120 --> 04:17.640]  ballot and what it exactly means. A fourth example is the former congressman,
[04:19.060 --> 04:28.120]  Austin Murphy. He actually also committed absentee ballot fraud. He made senior citizens in nursing
[04:28.120 --> 04:36.120]  homes to vote in a certain way, the way he wanted. But he said that he was just helping them.
[04:36.280 --> 04:44.960]  So, we believe him. And the last case is Harry. It's a new one in 2019. And he actually picked
[04:44.960 --> 04:53.160]  up girls. He made girls sign absentee ballots in the names of deceased people, which makes me a
[04:53.160 --> 05:05.020]  little bit sorry because with the advanced systems of ensuring that there are no duplicate registration,
[05:05.020 --> 05:13.140]  there are still, until 2019, it is still possible to impersonate a deceased person.
[05:15.640 --> 05:23.360]  Next slide, please. So, the problems in the election system in Pennsylvania
[05:23.360 --> 05:29.820]  isn't only about fraud cases, but also about election system malfunctions. So,
[05:29.820 --> 05:38.620]  these are some examples prior to 2005 that I gathered. And they're mostly about the DRE
[05:39.660 --> 05:46.780]  malfunctions. DRE, it means direct recording electronic voting machines, which means that
[05:46.780 --> 05:56.600]  these voting machines do not use paper ballot systems. So, the only record of the votes that
[05:56.600 --> 06:08.360]  have been cast is electronic. That's why there was this case in 2004. DRE records 83% blank
[06:08.360 --> 06:17.560]  presidential votes, which doesn't make sense. And that's why they knew that there were these
[06:17.560 --> 06:26.700]  malfunctions. And this is a funny story, another one in 2012. There is this person who actually
[06:27.240 --> 06:35.260]  took a video with his smartphone of the malfunction. He made a video of the voting system,
[06:35.260 --> 06:47.830]  how it changed his vote from Obama to another candidate. Next slide, please.
[06:51.160 --> 07:00.800]  So, before the enactment of HAVA, Pennsylvania's election law provided new statewide guidelines.
[07:00.800 --> 07:09.080]  Basically, all the 67 counties were autonomous, and they had different election systems
[07:09.080 --> 07:17.800]  using a variety of voting machines. The HAVA is the Help America Vote Act. It was enacted in 2002,
[07:17.800 --> 07:25.760]  and it created a new mandatory minimum standards for states to follow in several key areas of
[07:25.760 --> 07:33.360]  election administration. It also required states to establish a statewide voter registration
[07:33.360 --> 07:49.140]  database, and it made the state follow certain systems over others and made high standards for
[07:49.140 --> 08:00.080]  the voting machines that can be used for elections. About the statewide voter registration
[08:00.080 --> 08:08.020]  base, Pennsylvania has a top-down system, which means that it makes a central platform
[08:08.020 --> 08:15.680]  at the state level that connects with all the local jurisdictions. So, it goes top to down.
[08:15.680 --> 08:26.040]  They gather information on a state level. Also, before, there weren't any information
[08:26.040 --> 08:37.980]  security training programs before 2018. And now, since many requirements became,
[08:37.980 --> 08:45.180]  like many things became required under Act 77, I will tell you about it in a while,
[08:46.640 --> 08:54.980]  companies started having the responsibilities and the obligations to provide their customers
[08:54.980 --> 09:08.840]  with training regarding the usage of the voting systems or how to maintain their security.
[09:09.440 --> 09:21.300]  The other thing is that, so, as I said, the DRE voting machines do not use paper ballots.
[09:21.300 --> 09:30.760]  So, the only records that are kept are electronic. And now, Pennsylvania has changed all its
[09:31.480 --> 09:40.060]  voting systems, voting machines. Over 25,000 voting machines have been replaced. And the
[09:40.060 --> 09:48.940]  governor made them use all voter-verifiable paper records. And actually, it helped, because I will
[09:48.940 --> 09:57.520]  tell you in a little bit about some cases in 2019 that some malfunctions happened in the voting
[09:57.520 --> 10:08.260]  machines and they had to turn to those paper ballots. Can we go to the next slide? Thank you.
[10:08.260 --> 10:18.540]  So, the new administration brought improvements. First, by purchasing new, more accessible,
[10:18.540 --> 10:35.170]  auditable, and secure voting systems. The second thing is that it enacted Act 77,
[10:35.170 --> 10:43.350]  which I will talk a little bit more about in a minute. But thanks to this Act,
[10:43.350 --> 10:49.170]  all Pennsylvanians can now vote by mailing ballots without having to provide an excuse,
[10:49.170 --> 11:00.710]  which helps people to register more. And because the way it used to be, it was that you can only
[11:00.710 --> 11:08.290]  cast your ballot through the mail if you have an excuse. Now, you don't need an excuse. You just
[11:08.290 --> 11:19.090]  apply for it. Also, now counties make election officials do random tests of voting machines on
[11:19.090 --> 11:27.130]  election days. And they incorporated added checks and other improvements into the SURE system to
[11:27.130 --> 11:35.150]  reduce data errors and improve accuracy. About the SURE system, so it's an abbreviation of Statewide
[11:35.150 --> 11:44.450]  Uniform Registry of Electors. And it's a system that Pennsylvania has to assist the counties with
[11:44.450 --> 11:54.310]  training and user development, continuous improvement, etc. And there were, so as we
[11:54.310 --> 12:02.050]  talked a little bit earlier about impersonating deceased people, so developing the SURE system
[12:02.050 --> 12:15.290]  helps minimize the number of duplicates or the use of registered deceased people.
[12:15.450 --> 12:26.170]  Next, please. So here you go. Act 77, election reform bill. It was enacted in 2019, so mainly
[12:26.170 --> 12:35.250]  the biggest thing about this bill is that it allows mail-in ballots. As I said,
[12:35.250 --> 12:45.050]  anyone can apply for a mail-in ballot. So basically, if you are eligible to vote,
[12:45.050 --> 12:52.910]  you are eligible to apply for a mail-in ballot. And you can apply for it until
[12:53.310 --> 13:00.990]  the Tuesday before the election. The absentee ballot is the same as it was. If you have
[13:01.550 --> 13:12.130]  a disability or illness, if you are in the military, if you have a religious celebration
[13:12.130 --> 13:21.230]  that conflicts with the date of the elections, you can apply for an absentee ballot. So this is
[13:21.230 --> 13:34.880]  for people with an excuse. And under Act 77, the shortcut straight party button,
[13:34.880 --> 13:40.840]  which is also known as the straight ticket to vote for all candidates of one party,
[13:40.840 --> 13:49.740]  is no longer available. And there was a lot of tension about this because both sides say that
[13:49.740 --> 14:00.280]  it will make the voter reluctant as to vote for all candidates and look for who is Republican,
[14:00.280 --> 14:08.820]  who is Democrat. But it was taken off. And also, another thing that was prohibited is the use of
[14:08.820 --> 14:19.020]  stickers for writing candidates. Writing candidates are people who you may vote for
[14:19.020 --> 14:28.080]  despite not being in the ballot. And what I mean by sticker is that in their campaigns, these
[14:28.780 --> 14:36.300]  people can distribute some stickers to the people having their names on. And it used to be
[14:36.300 --> 14:46.620]  that the voters can just put the sticker on the paper ballot and it will be counted.
[14:46.620 --> 14:54.800]  Now, the stickers are prohibited to be used and the stamps are very discouraged to be used
[14:54.800 --> 15:04.280]  because of the wet ink. But it's not prohibited under Act 77. Next slide.
[15:08.070 --> 15:16.050]  So the use of mail-in ballots and this new Act encouraged more people to enroll in the
[15:16.050 --> 15:23.270]  elections. So this year, 1.8 million Pennsylvanians applied for mail-in ballots
[15:23.270 --> 15:34.130]  and it is 17 times more than the elections of 2016. But there is a problem with that,
[15:34.130 --> 15:40.410]  is that the current election code doesn't allow election officials to begin counting ballots until
[15:40.410 --> 15:48.510]  7 a.m. on the election day. And election officers are worried that they wouldn't be able to meet the
[15:48.510 --> 15:59.770]  deadline and to announce the results the night of November 3. And even the former governor is calling
[15:59.770 --> 16:09.390]  the election officials to make it possible to start counting the ballots earlier. But we will
[16:09.390 --> 16:20.010]  see what happens. And even with all these improvements, some counties still experience
[16:20.010 --> 16:28.670]  election system malfunctions in this June elections. The next, please.
[16:29.670 --> 16:38.650]  So many problems, many malfunctions were reported. I will give you three examples. York
[16:38.650 --> 16:48.450]  County, Northampton County and Bucks County. In York County, the paper ballot system was defective
[16:48.450 --> 16:59.970]  because the ballots were printed on shorter paper and the scanners could not read those ballots.
[16:59.970 --> 17:06.840]  And for some papers, some other papers, it took longer than it should be to read those ballots.
[17:06.840 --> 17:16.000]  The case is worse in Northampton County, because in this case, there was a problem with the
[17:16.000 --> 17:23.180]  tabulation in some of the precincts. And the state ordered the county to count the paper ballots
[17:23.180 --> 17:31.820]  rather than rely on machine totals. And why it says human error late, it's because... so the
[17:31.820 --> 17:41.580]  manufacturer later explained and told everyone that 50% of the machines were actually
[17:44.360 --> 17:56.720]  improperly manufactured. So who to blame? And the last example is Bucks County. In Bucks County,
[17:56.720 --> 18:03.960]  there was also a problem with the paper ballots because of the irregularities. And the irregularities
[18:03.960 --> 18:12.540]  made the papers a fraction of an inch too wide to fit into the new built-in machine scanners.
[18:13.540 --> 18:24.980]  So before, the problem was we do not have paper ballot machines. Now we have them, but the papers
[18:24.980 --> 18:32.160]  they used, they didn't make sure that the paper ballots fit the scanners. Now whose
[18:34.520 --> 18:43.260]  problem is this? It should be the manufacturer, because they should provide the counties with all
[18:46.190 --> 18:53.940]  the systems and everything that goes with them to perform as expected.
[18:57.550 --> 19:07.150]  Can I have the next, please? So I told why I talked in the beginning about this in order to
[19:07.670 --> 19:15.410]  tell you a little bit why we made this project, why we started this project. Because there is
[19:15.610 --> 19:21.870]  a natural problem in the election system. There are malfunctions and they are affecting
[19:21.870 --> 19:30.850]  the polls and the counts. So we decided to do this project. Next slide, please.
[19:30.850 --> 19:38.830]  We decided to do this project and to have an idea about the contracts that have been signed
[19:38.830 --> 19:50.990]  between the counties and the voting system companies. We also wanted to have a sense of
[19:50.990 --> 19:58.690]  which systems are used in which counties, because there are a lot of different systems used.
[19:58.690 --> 20:07.630]  And we also wanted to have a closer read on the agreements in order to see what are the system
[20:07.630 --> 20:15.250]  vendors' duties towards the counties and how would they assure maintaining the information
[20:15.250 --> 20:25.610]  security of the systems. That's our background. Next, please. So how we started doing this?
[20:26.290 --> 20:34.870]  Pennsylvania has a right to know law, number 65, and it provides for access to public information
[20:34.870 --> 20:43.210]  obtained from local government or state agencies. Pursuant to this law, we sent 67 requests,
[20:43.210 --> 20:53.890]  one to each county. We started on the 15th of April, 2020, and most counties invoked the 30
[20:53.890 --> 21:03.570]  days extension. And we are still waiting for many counties to respond and to provide us with
[21:04.020 --> 21:11.090]  the documents we requested. And in a little bit, I will give you the exact numbers.
[21:11.620 --> 21:19.950]  So here are the responses we got. The counties varied in dealing with our right to know request.
[21:20.170 --> 21:32.010]  44 out of 67 counties provided us with the documents, but they also varied in what documents
[21:32.010 --> 21:44.850]  they provided us with. And 14 counties invoked the 30 days extension, but they still didn't
[21:45.610 --> 21:54.970]  provide us with the documents. And it has been three months now, so maybe we should re-request.
[21:57.130 --> 22:04.130]  So seven counties didn't respond at all to our request. And let me, just to clarify,
[22:04.130 --> 22:11.870]  all the requests were sent by email, online. And we made sure, and I made sure,
[22:11.870 --> 22:17.150]  that we contacted the right people, the open records officers.
[22:18.750 --> 22:28.690]  And then two counties were hard to reach. One didn't have online applications, so we will
[22:28.690 --> 22:40.970]  have to send them a mail or a fax. Yeah, they still use that. And two counties, only two
[22:40.970 --> 22:47.610]  counties requested payments. So these counties requested payment for printing and for the
[22:47.610 --> 22:54.390]  flash drives, not for anything else. All the other counties were nice enough to send us everything
[22:54.390 --> 23:06.590]  without requiring any payment. Next please. So as I said, now I was talking about 67 counties.
[23:06.590 --> 23:13.290]  Now I'm only going to talk about 44 counties, the counties that provided us with the documents
[23:13.290 --> 23:25.910]  and the ones that responded to our requests. I noticed that there are four companies the
[23:25.910 --> 23:33.230]  counties have been dealing with. Dominion Voting Systems Incorporated, 10 counties
[23:33.230 --> 23:41.430]  signed with them. Election Systems and Software, ES&S, 25 counties signed with them.
[23:41.430 --> 23:51.490]  Clear Ballot Group, seven counties signed with them. And Election IQ, two counties signed with
[23:51.490 --> 24:02.470]  them. And let me say that the terms of the contracts that we receive vary from a company
[24:02.470 --> 24:10.510]  to another. They don't all have the same terms. And I will be talking about the terms in a little
[24:10.510 --> 24:17.770]  bit. Can we have the next slide, please? And here we go. The documents received in total.
[24:17.770 --> 24:31.390]  As I said, each county sent us the documents they assumed fit. So we received 40 sales agreements,
[24:31.390 --> 24:39.290]  14 sales orders, 11 purchase orders, four invoices, 10 bids. About the bids,
[24:39.290 --> 24:47.210]  some counties sent us only the bid of the company they signed with. And some counties sent us all
[24:47.210 --> 24:56.210]  the bids they received from all companies and the agreement. Six counties sent us the manuals.
[24:56.210 --> 25:06.650]  By manuals, I mean the documents containing technical specifications about the system,
[25:06.650 --> 25:15.750]  the voting system used. 14 counties sent us marketing materials. Marketing materials are
[25:15.750 --> 25:27.170]  mostly flyers and papers showing how exactly as a voter you use the election system. So nothing
[25:27.170 --> 25:36.610]  elaborate. Two reports, interior reports. So they made a diagnosis before the usage of
[25:37.390 --> 25:47.550]  the voting machines. So they sent us the reports. Two counties sent us their loan agreements. So
[25:47.550 --> 25:55.710]  they had loan agreements in order to be able to buy and purchase the new voting systems.
[25:55.710 --> 26:01.130]  Two counties sent us their codes and two counties sent us product schedule.
[26:01.690 --> 26:12.470]  So we were lucky enough to have at least 40 agreements at hand. Now, about the NDA,
[26:13.850 --> 26:23.830]  18 counties invoked NDA. And it was mainly about the technical specifications
[26:23.830 --> 26:31.750]  of the voting machines. They mostly, they all provided us with the agreement.
[26:32.270 --> 26:42.670]  But some, so 18 of them didn't provide us, said that they cannot provide us with the
[26:42.670 --> 26:52.270]  technical specificities because of a non-disclosure agreement. 16 did not invoke NDAs,
[26:52.270 --> 26:59.330]  but that doesn't mean that they provided us with all the documents we asked for. They just
[26:59.330 --> 27:05.730]  didn't invoke it and didn't send us. But the good thing is that they say we can appeal,
[27:05.730 --> 27:18.390]  but we didn't appeal. And 8 counties did not invoke NDAs, but they just said we do not have
[27:18.390 --> 27:26.490]  those documents. And as you see here, the language varies from a county to another. Some counties
[27:26.490 --> 27:35.990]  made an effort to provide us with elaborate responses with legal explanation. Other counties,
[27:36.490 --> 27:43.430]  for example, they said the company had us read up the information or we cannot, the information
[27:44.050 --> 27:49.870]  you're asking for or the documents requested are not public records and that's it.
[27:52.550 --> 27:59.670]  And so all counties that provided manuals, you know, remember the six manuals we received,
[27:59.670 --> 28:09.610]  did not invoke NDAs. And even though they did not deny providing documents pursuant to an NDA
[28:09.610 --> 28:15.410]  provision, counties varied in the number of documents they provided and they mostly did
[28:15.410 --> 28:24.090]  not provide us with technical specifications. Yeah. Can we go to the next slide, please?
[28:24.290 --> 28:33.190]  Thank you. And now, so that's about the project. Now to be more specific and to have
[28:33.910 --> 28:42.450]  preliminary comparisons between the terms of contracts from the different, the four companies
[28:43.310 --> 28:47.030]  the counties were dealing with. The next, please.
[28:48.530 --> 28:57.750]  So as you see in the first slide, I just put some different pricings. Each company had a
[28:57.750 --> 29:09.910]  different price. The prices varied from 450,000 to 700 and so thousands. Next, please.
[29:11.450 --> 29:19.730]  But the thing that mostly all counties agreed upon in all their different companies,
[29:19.730 --> 29:26.050]  in all their different agreements, were the company's responsibilities. So each company
[29:27.750 --> 29:35.690]  is obliged to deliver a complete voting system, having the hardware and the software,
[29:35.690 --> 29:43.510]  according to the agreed upon project schedule, install the hardware and the software for the
[29:43.510 --> 29:57.190]  county, provide a user license, assign a project manager to help with, to enable all services and
[29:57.190 --> 30:04.310]  to make sure that all deliverables have been sent in a proper way and according to the agreement.
[30:05.710 --> 30:14.690]  Also, they are bound to provide customers with all product documentations, architecture and
[30:14.690 --> 30:21.430]  technical specifications, et cetera. And they are required to provide the necessary training
[30:21.430 --> 30:29.690]  materials to the counties and, I mean, the election officials and provide access to
[30:29.690 --> 30:37.690]  training videos if they are available and or provide trainings on site if they were required.
[30:38.210 --> 30:44.830]  And also, they would assist in the acceptance testing process. But one vendor, though,
[30:44.830 --> 30:54.230]  stated an additional responsibility and it was that they will have to remove and securely destroy
[30:54.230 --> 31:01.030]  all voting machines currently owned by the client and the certificate of destruction
[31:01.030 --> 31:08.070]  shall be issued to the client. That was one vendor that was required to do that.
[31:09.250 --> 31:20.950]  Back to the NDA. So, the NDA clause in the agreement, all the companies included a
[31:20.950 --> 31:29.090]  confidentiality clause and all companies included a definition of either confidential information
[31:29.090 --> 31:36.970]  or proprietary information, which is good from a lawyer perspective because these terms are pretty
[31:36.970 --> 31:45.130]  vague and if you do not include them and if you don't include the definition, basically,
[31:45.130 --> 31:54.510]  if one party discloses certain information, it will be hard to prove that it was confidential
[31:54.510 --> 32:06.430]  information in the sense of the agreement. So, basically, it says that neither party
[32:06.430 --> 32:13.110]  shall disclose to any third party any proprietary or confidential information of the other party
[32:13.630 --> 32:19.740]  and the information should be used by parties with reasonable care not to allow disclosure.
[32:21.340 --> 32:29.550]  One vendor indicated that this agreement, the confidentiality agreement, is binding even after
[32:30.170 --> 32:39.890]  the term of the sales agreement and two vendors stated that if the customer was asked to disclose
[32:39.890 --> 32:46.430]  certain information, they must notify the company and request their consent and I actually saw that
[32:46.430 --> 32:54.410]  in many emails between me and the accountant, they stated in the email that we provide you
[32:54.410 --> 33:04.330]  these documents but I will be contacting the company and asking whether it is possible to
[33:04.330 --> 33:10.050]  share other information with you and they wait for their consent and then they get back to me
[33:10.050 --> 33:19.410]  with the documents if the company accepts. But one remark here is that the six counties
[33:20.010 --> 33:27.130]  that provided us with manuals were also bound by such confidentiality agreements
[33:27.130 --> 33:33.990]  but they still provided the documents, the technical specificities. So, to what extent
[33:33.990 --> 33:40.030]  are the counties respecting such NDAs? I don't know. But personally, I'm happy. At least we
[33:40.030 --> 33:51.690]  got six examples of technical specifications to revise, to review. Can you have the next slide,
[33:51.690 --> 34:05.290]  please? About first measure. So, first measure is mainly not being able to deliver product,
[34:05.290 --> 34:12.230]  hardware, software, etc. as a result of acts of God, weather, unforeseeable circumstances,
[34:12.230 --> 34:23.070]  fire, war, anything you can imagine. As long as it's not, it's beyond the control of the party
[34:23.070 --> 34:33.720]  that could not meet their duty or obligation to deliver such products. So, in the agreements,
[34:34.290 --> 34:45.240]  we reviewed, only two vendors had first measure clause. And they state that
[34:45.240 --> 34:56.480]  neither party shall be liable in case first measure things happen. But for the other two
[34:56.480 --> 35:03.400]  vendors, it was a bit different. Because one vendor did not state, did not include a first
[35:03.400 --> 35:13.020]  measure clause on its own. But under limitation of remedies, they said that the vendor assumes
[35:13.020 --> 35:20.340]  no liabilities, no liability for delays as a result of acts of God, weather, unforeseeable
[35:20.340 --> 35:32.740]  circumstances, etc. So, they included the first measure clause. They excluded themselves from
[35:32.740 --> 35:40.760]  liability, but the clause doesn't say anything about the customer. The first vendor, though,
[35:40.760 --> 35:48.880]  included a first measure clause under another clause, which is defects due to customer actions
[35:48.880 --> 35:58.460]  or omissions. And in this case, they actually state that the customer shall pay for any loss
[35:59.660 --> 36:08.400]  caused by acts of God, fire, flooding, riots, acts of war, etc. So, they are making the customer
[36:08.400 --> 36:16.140]  liable, which is a peril to the customer. This is about first measure. Next, please.
[36:17.620 --> 36:26.400]  Next is the indemnification clause. So, an indemnity clause is a contractual transfer of risk
[36:26.400 --> 36:33.600]  between two contractual parties, generally to prevent loss or compensate for a loss,
[36:33.600 --> 36:43.240]  which may occur as a result of specified events. Here, in the agreement, we had only two vendors
[36:43.240 --> 36:51.400]  have included indemnification clauses, but the other two vendors remained silent on the matter,
[36:52.400 --> 37:00.200]  which means that in case such problems occur, the issue will have to be disputed.
[37:01.260 --> 37:12.540]  Next, please. So, limitation of liability. Here, I provided three sample clauses of
[37:13.440 --> 37:19.280]  the limitation of liability clauses we found in the various agreements we had.
[37:22.020 --> 37:30.260]  So, two vendors limit the liability for the company only.
[37:31.000 --> 37:35.720]  And two vendors limit the liability for both parties.
[37:37.420 --> 37:44.040]  And all companies, for all companies, the liability, they state that the liability
[37:44.040 --> 37:49.740]  shall in no event exceed the total amount of the agreement.
[37:49.740 --> 37:56.180]  And two vendors stated that the limitation of liability clause does not limit the indemnification
[37:56.180 --> 38:10.280]  obligation. Next, please. About the license and use. So, all companies state that they
[38:10.280 --> 38:17.380]  have to grant the customer a non-exclusive, non-transferable license to use the system
[38:17.380 --> 38:27.400]  they provided them with. And they only can use it with a licensed software on licenses we have in
[38:27.400 --> 38:36.280]  the course of operating the equipment and solely for the purposes of the elections. Any other use
[38:36.280 --> 38:43.480]  would be considered breach of contract and the companies assert sole rights in the software.
[38:43.850 --> 38:50.320]  And certain companies included in their agreement that reverse engineering, so,
[38:50.320 --> 38:59.860]  they were more specified, specific, and they said reverse engineering, reengineering, duplicating
[38:59.860 --> 39:11.640]  the source code or any other thing to replicate the source code is prohibited. Which is under
[39:11.640 --> 39:19.580]  the terms of a license. About the warranties. So, the companies warrant that the software
[39:19.580 --> 39:25.880]  they are providing is original and will operate in substantial performance and that the hardware
[39:25.880 --> 39:36.920]  is free from defects. Three vendors warranted hardware between one year and five years. So,
[39:36.920 --> 39:43.710]  there is a variation there. And, of course, a vendor did not specify the duration.
[39:44.900 --> 39:52.100]  Which can be interpreted that they will be warranted for life. And that's not good for
[39:52.100 --> 40:04.720]  the companies. But that's just a preliminary reading. So, what they warrant is that the
[40:04.720 --> 40:16.660]  warranty is to fix or replace the defective hardware or malware. About the updates and
[40:16.660 --> 40:25.340]  upgrades. Here, if you follow with me the language, some vendors say that they may provide
[40:25.340 --> 40:32.760]  new releases, upgrades, updates, et cetera. And other vendors say they will make certified
[40:32.760 --> 40:41.060]  software upgrades available. So, for certain companies, they are not required or obligated
[40:41.060 --> 40:50.960]  to make upgrades to their systems. And here is a problem. If they're not updating their systems,
[40:50.960 --> 40:58.360]  they can make new systems and then the counties will have to buy the new systems because their
[40:58.360 --> 41:10.000]  old systems are no longer okay to run. So, this obligation versus possibility dilemma,
[41:10.000 --> 41:19.980]  there it exists. Next, please. So, here's all the information I wanted to share with you about
[41:19.980 --> 41:26.940]  the project, about the process, and about preliminary reading of the agreement. And
[41:26.940 --> 41:31.220]  please, if you have any questions, just give them to me.
[41:31.960 --> 41:37.440]  So, it looks like... well, before we continue, we would like to thank our speaker again for giving
[41:37.440 --> 41:42.940]  us this awesome talk. It's actually kind of interesting how... a little sketchy how it is
[41:42.940 --> 41:48.140]  with some of these devices and some of the manufacturers. A little eye-opening, I would say.
[41:48.780 --> 41:54.180]  But it looks like we have a talk in the channel that says, how many different vendors did you
[41:54.180 --> 42:05.460]  see in total? In total, we had four. So, as I told you, out of 67 counties, only 44 provided us