WEBVTT 00:00.000 --> 00:02.640 You've been working so hard. 00:02.860 --> 00:04.140 Thank you, thank you. 00:04.380 --> 00:05.640 All right, folks. 00:05.640 --> 00:12.000 Looks like the stream is active, and I'd like to thank our speaker again for this presentation. 00:12.000 --> 00:13.540 Take it away, Reem. 00:14.140 --> 00:16.440 Okay, thank you. 00:16.640 --> 00:26.000 So, I'm Reem Buznek, as Steve already said, and I will be talking about the security of Pennsylvania election systems. 00:26.000 --> 00:32.800 This was a project that I conducted under the supervision of Professor Andrea Mitwishin. 00:33.080 --> 00:38.160 Can you go to the next slide, Steve? 00:38.600 --> 00:40.160 Yep, I got you. 00:40.280 --> 00:40.900 Thank you. 00:40.900 --> 00:42.780 This is Professor Andrea Mitwishin. 00:42.780 --> 00:47.640 I believe that everyone knows her, but it was good to put that picture there. 00:47.640 --> 00:51.780 And then, if you hit again, Steve, you will find my face. 00:53.700 --> 00:55.440 There you go. 00:55.440 --> 00:57.580 And who am I? 00:57.580 --> 01:00.340 I'm a law graduate. 01:00.340 --> 01:02.420 I had two master's degrees. 01:02.420 --> 01:11.900 I focused on, in the first one, I focused on internet regulations and freedom of expression in the MENA region, the Middle East and North Africa. 01:11.900 --> 01:18.440 And in this second master's, I focused on national security law and information security law. 01:18.440 --> 01:22.960 And I was working with Professor Mitwishin as a research assistant. 01:23.020 --> 01:28.700 And hopefully, and very soon, I will be joining the pilot lab as a postdoctoral fellow. 01:30.040 --> 01:36.640 So, I'm going to tell you now what we're going to be talking exactly about. 01:36.720 --> 01:43.960 First of all, I will start with a brief introduction to the history of Pennsylvania election system security. 01:43.960 --> 02:03.800 I will tell you a little bit about some fraud cases, some problems in the information in the voting systems, et cetera, and how the new administration improved the current election system. 02:03.840 --> 02:18.860 Then I will tell you more about the core of the project, which is more about sending write-to-no requests to every county in Pennsylvania, all of the 67. 02:18.940 --> 02:26.760 And then asking for copies of election system vendor agreements, related documents, technical specificities, et cetera. 02:26.760 --> 02:44.900 And then in the third part of my speech, I will tell you about my preliminary findings based on the review of the agreements and I will tell you all about how many documents we received, what types of documents, et cetera. 02:45.720 --> 02:47.680 You go, Steve. 02:48.560 --> 02:49.960 Thank you. 02:49.960 --> 02:54.740 So, as I said, I will start with the election history in PA. 02:54.740 --> 03:01.960 So, according to the Heritage Foundation, there have been only 23 fraud cases in the history of elections. 03:01.960 --> 03:08.440 But when we say only 23, it doesn't mean that they're not important. 03:09.360 --> 03:16.320 So, I gathered some examples of fraud cases in Pennsylvania. 03:16.320 --> 03:19.160 The first one is about Robin. 03:19.160 --> 03:30.060 Robin is a judge of elections and with the help of Laura, who is an election inspector, she signed under her son's name and cast a ballot in his place. 03:30.060 --> 03:35.120 So, it's an impersonation fraud, as opposed. 03:35.120 --> 03:37.960 The second case is about this guy, Mr. 03:37.960 --> 03:43.560 Victor, who voted in both Philadelphia and Lehigh County. 03:43.560 --> 03:46.000 So, he casted two ballots. 03:46.160 --> 03:50.520 The third case is Mr. 03:50.520 --> 03:51.180 Richard. 03:51.180 --> 03:57.940 Actually, he's a former police chief of Harmon Township in Allegheny County. 03:57.940 --> 04:05.720 And he applied for absentee ballots and made people not eligible for the absentee ballot to cast them. 04:05.720 --> 04:12.320 And in a while, I will tell you about the absentee ballot and what it exactly means. 04:12.800 --> 04:21.100 A fourth example is the former congressman, Austin Murphy. 04:21.100 --> 04:26.040 He actually also committed absentee ballot fraud. 04:26.040 --> 04:32.580 He made senior citizens in nursing homes to vote in a certain way, the way he wanted. 04:32.580 --> 04:36.120 But he said that he was just helping them. 04:36.280 --> 04:37.980 So, we believe him. 04:38.000 --> 04:40.980 And the last case is Harry. 04:40.980 --> 04:43.520 It's a new one in 2019. 04:43.520 --> 04:45.820 And he actually picked up girls. 04:45.820 --> 05:13.140 He made girls sign absentee ballots in the names of deceased people, which makes me a little bit sorry because with the advanced systems of ensuring that there are no duplicate registration, there are still, until 2019, it is still possible to impersonate a deceased person. 05:15.640 --> 05:18.040 Next slide, please. 05:18.780 --> 05:29.580 So, the problems in the election system in Pennsylvania isn't only about fraud cases, but also about election system malfunctions. 05:29.580 --> 05:34.860 So, these are some examples prior to 2005 that I gathered. 05:34.860 --> 05:40.660 And they're mostly about the DRE malfunctions. 05:40.660 --> 05:51.820 DRE, it means direct recording electronic voting machines, which means that these voting machines do not use paper ballot systems. 05:51.820 --> 06:01.400 So, the only record of the votes that have been cast is electronic. 06:01.400 --> 06:05.380 That's why there was this case in 2004. 06:05.380 --> 06:14.380 DRE records 83% blank presidential votes, which doesn't make sense. 06:14.380 --> 06:19.020 And that's why they knew that there were these malfunctions. 06:19.040 --> 06:24.340 And this is a funny story, another one in 2012. 06:24.380 --> 06:31.740 There is this person who actually took a video with his smartphone of the malfunction. 06:31.740 --> 06:45.000 He made a video of the voting system, how it changed his vote from Obama to another candidate. 06:45.240 --> 06:47.830 Next slide, please. 06:51.160 --> 07:00.800 So, before the enactment of HAVA, Pennsylvania's election law provided new statewide guidelines. 07:00.800 --> 07:11.920 Basically, all the 67 counties were autonomous, and they had different election systems using a variety of voting machines. 07:11.920 --> 07:14.980 The HAVA is the Help America Vote Act. 07:14.980 --> 07:28.300 It was enacted in 2002, and it created a new mandatory minimum standards for states to follow in several key areas of election administration. 07:28.300 --> 07:56.580 It also required states to establish a statewide voter registration database, and it made the state follow certain systems over others and made high standards for the voting machines that can be used for elections. 07:56.600 --> 08:13.800 About the statewide voter registration base, Pennsylvania has a top-down system, which means that it makes a central platform at the state level that connects with all the local jurisdictions. 08:13.800 --> 08:15.680 So, it goes top to down. 08:15.680 --> 08:21.200 They gather information on a state level. 08:21.200 --> 08:30.920 Also, before, there weren't any information security training programs before 2018. 08:30.920 --> 09:08.840 And now, since many requirements became, like many things became required under Act 77, I will tell you about it in a while, companies started having the responsibilities and the obligations to provide their customers with training regarding the usage of the voting systems or how to maintain their security. 09:09.440 --> 09:21.300 The other thing is that, so, as I said, the DRE voting machines do not use paper ballots. 09:21.300 --> 09:27.040 So, the only records that are kept are electronic. 09:27.040 --> 09:33.940 And now, Pennsylvania has changed all its voting systems, voting machines. 09:33.940 --> 09:39.200 Over 25,000 voting machines have been replaced. 09:39.200 --> 09:46.740 And the governor made them use all voter-verifiable paper records. 09:46.740 --> 10:03.440 And actually, it helped, because I will tell you in a little bit about some cases in 2019 that some malfunctions happened in the voting machines and they had to turn to those paper ballots. 10:04.620 --> 10:07.020 Can we go to the next slide? 10:07.020 --> 10:08.260 Thank you. 10:08.260 --> 10:13.360 So, the new administration brought improvements. 10:13.360 --> 10:22.160 First, by purchasing new, more accessible, auditable, and secure voting systems. 10:22.160 --> 10:40.990 The second thing is that it enacted Act 77, which I will talk a little bit more about in a minute. 10:40.990 --> 10:55.270 But thanks to this Act, all Pennsylvanians can now vote by mailing ballots without having to provide an excuse, which helps people to register more. 10:55.270 --> 11:06.050 And because the way it used to be, it was that you can only cast your ballot through the mail if you have an excuse. 11:06.050 --> 11:07.850 Now, you don't need an excuse. 11:07.850 --> 11:10.250 You just apply for it. 11:11.490 --> 11:20.430 Also, now counties make election officials do random tests of voting machines on election days. 11:20.430 --> 11:30.290 And they incorporated added checks and other improvements into the SURE system to reduce data errors and improve accuracy. 11:30.290 --> 11:38.570 About the SURE system, so it's an abbreviation of Statewide Uniform Registry of Electors. 11:38.570 --> 11:49.310 And it's a system that Pennsylvania has to assist the counties with training and user development, continuous improvement, etc. 11:49.310 --> 12:15.290 And there were, so as we talked a little bit earlier about impersonating deceased people, so developing the SURE system helps minimize the number of duplicates or the use of registered deceased people. 12:15.450 --> 12:17.870 Next, please. 12:18.330 --> 12:19.430 So here you go. 12:19.430 --> 12:22.630 Act 77, election reform bill. 12:22.630 --> 12:32.890 It was enacted in 2019, so mainly the biggest thing about this bill is that it allows mail-in ballots. 12:32.890 --> 12:38.750 As I said, anyone can apply for a mail-in ballot. 12:38.750 --> 12:48.350 So basically, if you are eligible to vote, you are eligible to apply for a mail-in ballot. 12:48.350 --> 12:55.990 And you can apply for it until the Tuesday before the election. 12:55.990 --> 12:59.850 The absentee ballot is the same as it was. 12:59.850 --> 13:20.430 If you have a disability or illness, if you are in the military, if you have a religious celebration that conflicts with the date of the elections, you can apply for an absentee ballot. 13:20.430 --> 13:23.910 So this is for people with an excuse. 13:27.840 --> 13:42.700 And under Act 77, the shortcut straight party button, which is also known as the straight ticket to vote for all candidates of one party, is no longer available. 13:42.700 --> 14:02.000 And there was a lot of tension about this because both sides say that it will make the voter reluctant as to vote for all candidates and look for who is Republican, who is Democrat. 14:02.160 --> 14:04.360 But it was taken off. 14:04.360 --> 14:12.220 And also, another thing that was prohibited is the use of stickers for writing candidates. 14:12.360 --> 14:21.800 Writing candidates are people who you may vote for despite not being in the ballot. 14:21.800 --> 14:34.520 And what I mean by sticker is that in their campaigns, these people can distribute some stickers to the people having their names on. 14:34.520 --> 14:46.620 And it used to be that the voters can just put the sticker on the paper ballot and it will be counted. 14:46.620 --> 14:57.820 Now, the stickers are prohibited to be used and the stamps are very discouraged to be used because of the wet ink. 14:57.820 --> 15:00.800 But it's not prohibited under Act 77. 15:02.160 --> 15:04.280 Next slide. 15:08.070 --> 15:17.170 So the use of mail-in ballots and this new Act encouraged more people to enroll in the elections. 15:17.170 --> 15:31.090 So this year, 1.8 million Pennsylvanians applied for mail-in ballots and it is 17 times more than the elections of 2016. 15:31.790 --> 15:41.170 But there is a problem with that, is that the current election code doesn't allow election officials to begin counting ballots until 7 a.m. 15:41.170 --> 15:42.750 on the election day. 15:42.750 --> 15:55.730 And election officers are worried that they wouldn't be able to meet the deadline and to announce the results the night of November 3. 15:55.730 --> 16:08.590 And even the former governor is calling the election officials to make it possible to start counting the ballots earlier. 16:08.590 --> 16:11.270 But we will see what happens. 16:11.350 --> 16:26.870 And even with all these improvements, some counties still experience election system malfunctions in this June elections. 16:26.870 --> 16:28.670 The next, please. 16:29.670 --> 16:35.730 So many problems, many malfunctions were reported. 16:35.810 --> 16:38.430 I will give you three examples. 16:38.430 --> 16:43.630 York County, Northampton County and Bucks County. 16:43.630 --> 16:59.970 In York County, the paper ballot system was defective because the ballots were printed on shorter paper and the scanners could not read those ballots. 16:59.970 --> 17:06.840 And for some papers, some other papers, it took longer than it should be to read those ballots. 17:06.840 --> 17:18.660 The case is worse in Northampton County, because in this case, there was a problem with the tabulation in some of the precincts. 17:18.660 --> 17:26.640 And the state ordered the county to count the paper ballots rather than rely on machine totals. 17:26.640 --> 17:47.360 And why it says human error late, it's because... so the manufacturer later explained and told everyone that 50% of the machines were actually improperly manufactured. 17:48.680 --> 17:51.680 So who to blame? 17:51.900 --> 17:55.240 And the last example is Bucks County. 17:55.240 --> 18:02.440 In Bucks County, there was also a problem with the paper ballots because of the irregularities. 18:02.440 --> 18:12.540 And the irregularities made the papers a fraction of an inch too wide to fit into the new built-in machine scanners. 18:13.540 --> 18:21.800 So before, the problem was we do not have paper ballot machines. 18:21.800 --> 18:31.260 Now we have them, but the papers they used, they didn't make sure that the paper ballots fit the scanners. 18:31.260 --> 18:36.720 Now whose problem is this? 18:36.720 --> 18:53.940 It should be the manufacturer, because they should provide the counties with all the systems and everything that goes with them to perform as expected. 18:57.550 --> 19:00.310 Can I have the next, please? 19:01.090 --> 19:14.630 So I told why I talked in the beginning about this in order to tell you a little bit why we made this project, why we started this project. 19:14.630 --> 19:19.250 Because there is a natural problem in the election system. 19:19.250 --> 19:26.150 There are malfunctions and they are affecting the polls and the counts. 19:26.150 --> 19:29.150 So we decided to do this project. 19:29.150 --> 19:30.850 Next slide, please. 19:30.850 --> 19:47.550 We decided to do this project and to have an idea about the contracts that have been signed between the counties and the voting system companies. 19:47.550 --> 19:58.690 We also wanted to have a sense of which systems are used in which counties, because there are a lot of different systems used. 19:58.690 --> 20:17.570 And we also wanted to have a closer read on the agreements in order to see what are the system vendors' duties towards the counties and how would they assure maintaining the information security of the systems. 20:17.890 --> 20:19.750 That's our background. 20:20.210 --> 20:21.770 Next, please. 20:22.330 --> 20:25.610 So how we started doing this? 20:26.290 --> 20:39.250 Pennsylvania has a right to know law, number 65, and it provides for access to public information obtained from local government or state agencies. 20:39.250 --> 20:44.990 Pursuant to this law, we sent 67 requests, one to each county. 20:44.990 --> 20:56.090 We started on the 15th of April, 2020, and most counties invoked the 30 days extension. 20:56.230 --> 21:06.450 And we are still waiting for many counties to respond and to provide us with the documents we requested. 21:06.450 --> 21:11.090 And in a little bit, I will give you the exact numbers. 21:11.620 --> 21:14.990 So here are the responses we got. 21:15.190 --> 21:19.950 The counties varied in dealing with our right to know request. 21:20.170 --> 21:34.130 44 out of 67 counties provided us with the documents, but they also varied in what documents they provided us with. 21:35.030 --> 21:47.810 And 14 counties invoked the 30 days extension, but they still didn't provide us with the documents. 21:47.810 --> 21:54.970 And it has been three months now, so maybe we should re-request. 21:57.130 --> 22:02.270 So seven counties didn't respond at all to our request. 22:02.270 --> 22:08.710 And let me, just to clarify, all the requests were sent by email, online. 22:08.710 --> 22:17.150 And we made sure, and I made sure, that we contacted the right people, the open records officers. 22:18.750 --> 22:24.470 And then two counties were hard to reach. 22:24.470 --> 22:34.290 One didn't have online applications, so we will have to send them a mail or a fax. 22:35.250 --> 22:37.650 Yeah, they still use that. 22:37.650 --> 22:43.130 And two counties, only two counties requested payments. 22:43.130 --> 22:51.250 So these counties requested payment for printing and for the flash drives, not for anything else. 22:51.250 --> 22:57.070 All the other counties were nice enough to send us everything without requiring any payment. 22:57.750 --> 22:59.550 Next please. 23:00.550 --> 23:06.590 So as I said, now I was talking about 67 counties. 23:06.590 --> 23:20.590 Now I'm only going to talk about 44 counties, the counties that provided us with the documents and the ones that responded to our requests. 23:20.590 --> 23:28.310 I noticed that there are four companies the counties have been dealing with. 23:28.310 --> 23:34.910 Dominion Voting Systems Incorporated, 10 counties signed with them. 23:34.910 --> 23:41.430 Election Systems and Software, ES&S, 25 counties signed with them. 23:41.430 --> 23:46.870 Clear Ballot Group, seven counties signed with them. 23:46.870 --> 23:52.570 And Election IQ, two counties signed with them. 23:53.450 --> 24:04.090 And let me say that the terms of the contracts that we receive vary from a company to another. 24:04.250 --> 24:07.430 They don't all have the same terms. 24:07.430 --> 24:11.330 And I will be talking about the terms in a little bit. 24:11.330 --> 24:14.070 Can we have the next slide, please? 24:14.070 --> 24:15.210 And here we go. 24:15.210 --> 24:17.770 The documents received in total. 24:17.770 --> 24:28.070 As I said, each county sent us the documents they assumed fit. 24:28.070 --> 24:37.870 So we received 40 sales agreements, 14 sales orders, 11 purchase orders, four invoices, 10 bids. 24:37.870 --> 24:44.830 About the bids, some counties sent us only the bid of the company they signed with. 24:44.830 --> 24:52.370 And some counties sent us all the bids they received from all companies and the agreement. 24:52.670 --> 24:56.210 Six counties sent us the manuals. 24:56.210 --> 25:09.030 By manuals, I mean the documents containing technical specifications about the system, the voting system used. 25:09.310 --> 25:14.350 14 counties sent us marketing materials. 25:14.350 --> 25:26.910 Marketing materials are mostly flyers and papers showing how exactly as a voter you use the election system. 25:26.910 --> 25:28.730 So nothing elaborate. 25:28.730 --> 25:32.210 Two reports, interior reports. 25:32.210 --> 25:39.630 So they made a diagnosis before the usage of the voting machines. 25:42.210 --> 25:44.790 So they sent us the reports. 25:45.090 --> 25:47.350 Two counties sent us their loan agreements. 25:47.350 --> 25:55.710 So they had loan agreements in order to be able to buy and purchase the new voting systems. 25:55.710 --> 26:01.130 Two counties sent us their codes and two counties sent us product schedule. 26:01.690 --> 26:08.330 So we were lucky enough to have at least 40 agreements at hand. 26:08.530 --> 26:17.830 Now, about the NDA, 18 counties invoked NDA. 26:17.830 --> 26:27.750 And it was mainly about the technical specifications of the voting machines. 26:27.750 --> 26:31.750 They mostly, they all provided us with the agreement. 26:32.270 --> 26:49.090 But some, so 18 of them didn't provide us, said that they cannot provide us with the technical specificities because of a non-disclosure agreement. 26:49.270 --> 26:58.910 16 did not invoke NDAs, but that doesn't mean that they provided us with all the documents we asked for. 26:58.910 --> 27:02.410 They just didn't invoke it and didn't send us. 27:02.410 --> 27:07.850 But the good thing is that they say we can appeal, but we didn't appeal. 27:09.170 --> 27:19.970 And 8 counties did not invoke NDAs, but they just said we do not have those documents. 27:19.970 --> 27:25.730 And as you see here, the language varies from a county to another. 27:25.730 --> 27:34.030 Some counties made an effort to provide us with elaborate responses with legal explanation. 27:34.290 --> 27:49.870 Other counties, for example, they said the company had us read up the information or we cannot, the information you're asking for or the documents requested are not public records and that's it. 27:52.550 --> 28:02.070 And so all counties that provided manuals, you know, remember the six manuals we received, did not invoke NDAs. 28:02.070 --> 28:19.550 And even though they did not deny providing documents pursuant to an NDA provision, counties varied in the number of documents they provided and they mostly did not provide us with technical specifications. 28:21.350 --> 28:21.650 Yeah. 28:21.650 --> 28:24.090 Can we go to the next slide, please? 28:24.290 --> 28:25.250 Thank you. 28:25.250 --> 28:30.710 And now, so that's about the project. 28:30.750 --> 28:45.530 Now to be more specific and to have preliminary comparisons between the terms of contracts from the different, the four companies the counties were dealing with. 28:45.530 --> 28:47.030 The next, please. 28:48.530 --> 28:56.010 So as you see in the first slide, I just put some different pricings. 28:56.010 --> 28:58.690 Each company had a different price. 28:58.690 --> 29:07.330 The prices varied from 450,000 to 700 and so thousands. 29:07.330 --> 29:09.910 Next, please. 29:11.450 --> 29:24.830 But the thing that mostly all counties agreed upon in all their different companies, in all their different agreements, were the company's responsibilities. 29:24.830 --> 29:53.430 So each company is obliged to deliver a complete voting system, having the hardware and the software, according to the agreed upon project schedule, install the hardware and the software for the county, provide a user license, assign a project manager to help with, 29:53.430 --> 30:04.310 to enable all services and to make sure that all deliverables have been sent in a proper way and according to the agreement. 30:05.710 --> 30:17.310 Also, they are bound to provide customers with all product documentations, architecture and technical specifications, et cetera. 30:17.310 --> 30:37.690 And they are required to provide the necessary training materials to the counties and, I mean, the election officials and provide access to training videos if they are available and or provide trainings on site if they were required. 30:38.210 --> 30:42.890 And also, they would assist in the acceptance testing process. 30:42.890 --> 31:03.210 But one vendor, though, stated an additional responsibility and it was that they will have to remove and securely destroy all voting machines currently owned by the client and the certificate of destruction shall be issued to the client. 31:03.210 --> 31:08.070 That was one vendor that was required to do that. 31:09.250 --> 31:11.950 Back to the NDA. 31:11.950 --> 31:44.150 So, the NDA clause in the agreement, all the companies included a confidentiality clause and all companies included a definition of either confidential information or proprietary information, which is good from a lawyer perspective because these terms are pretty vague and if you do not include them and if you don't include the definition, 31:44.150 --> 31:58.950 basically, if one party discloses certain information, it will be hard to prove that it was confidential information in the sense of the agreement. 32:01.430 --> 32:19.740 So, basically, it says that neither party shall disclose to any third party any proprietary or confidential information of the other party and the information should be used by parties with reasonable care not to allow disclosure. 32:21.340 --> 32:49.650 One vendor indicated that this agreement, the confidentiality agreement, is binding even after the term of the sales agreement and two vendors stated that if the customer was asked to disclose certain information, they must notify the company and request their consent and I actually saw that in many emails between me and the accountant, 32:49.650 --> 33:14.470 they stated in the email that we provide you these documents but I will be contacting the company and asking whether it is possible to share other information with you and they wait for their consent and then they get back to me with the documents if the company accepts. 33:15.310 --> 33:32.810 But one remark here is that the six counties that provided us with manuals were also bound by such confidentiality agreements but they still provided the documents, the technical specificities. 33:32.810 --> 33:36.570 So, to what extent are the counties respecting such NDAs? 33:36.570 --> 33:37.370 I don't know. 33:37.370 --> 33:39.190 But personally, I'm happy. 33:39.190 --> 33:49.110 At least we got six examples of technical specifications to revise, to review. 33:49.810 --> 33:52.870 Can you have the next slide, please? 33:53.510 --> 33:55.930 About first measure. 33:55.930 --> 34:07.390 So, first measure is mainly not being able to deliver product, hardware, software, etc. 34:07.390 --> 34:15.310 as a result of acts of God, weather, unforeseeable circumstances, fire, war, anything you can imagine. 34:15.310 --> 34:31.170 As long as it's not, it's beyond the control of the party that could not meet their duty or obligation to deliver such products. 34:31.170 --> 34:43.460 So, in the agreements, we reviewed, only two vendors had first measure clause. 34:43.460 --> 34:52.860 And they state that neither party shall be liable in case first measure things happen. 34:52.860 --> 34:58.560 But for the other two vendors, it was a bit different. 34:58.560 --> 35:06.240 Because one vendor did not state, did not include a first measure clause on its own. 35:06.240 --> 35:21.820 But under limitation of remedies, they said that the vendor assumes no liabilities, no liability for delays as a result of acts of God, weather, unforeseeable circumstances, etc. 35:21.820 --> 35:26.640 So, they included the first measure clause. 35:26.640 --> 35:38.180 They excluded themselves from liability, but the clause doesn't say anything about the customer. 35:38.360 --> 35:50.400 The first vendor, though, included a first measure clause under another clause, which is defects due to customer actions or omissions. 35:50.700 --> 36:06.060 And in this case, they actually state that the customer shall pay for any loss caused by acts of God, fire, flooding, riots, acts of war, etc. 36:06.060 --> 36:12.080 So, they are making the customer liable, which is a peril to the customer. 36:12.760 --> 36:14.720 This is about first measure. 36:14.720 --> 36:16.140 Next, please. 36:17.620 --> 36:21.000 Next is the indemnification clause. 36:21.000 --> 36:37.580 So, an indemnity clause is a contractual transfer of risk between two contractual parties, generally to prevent loss or compensate for a loss, which may occur as a result of specified events. 36:38.500 --> 37:00.200 Here, in the agreement, we had only two vendors have included indemnification clauses, but the other two vendors remained silent on the matter, which means that in case such problems occur, the issue will have to be disputed. 37:01.260 --> 37:03.220 Next, please. 37:04.360 --> 37:07.340 So, limitation of liability. 37:07.440 --> 37:19.280 Here, I provided three sample clauses of the limitation of liability clauses we found in the various agreements we had. 37:22.020 --> 37:30.260 So, two vendors limit the liability for the company only. 37:31.000 --> 37:35.720 And two vendors limit the liability for both parties. 37:37.420 --> 37:49.740 And all companies, for all companies, the liability, they state that the liability shall in no event exceed the total amount of the agreement. 37:49.740 --> 37:57.800 And two vendors stated that the limitation of liability clause does not limit the indemnification obligation. 38:02.340 --> 38:04.280 Next, please. 38:06.000 --> 38:08.040 About the license and use. 38:08.040 --> 38:19.480 So, all companies state that they have to grant the customer a non-exclusive, non-transferable license to use the system they provided them with. 38:19.480 --> 38:35.040 And they only can use it with a licensed software on licenses we have in the course of operating the equipment and solely for the purposes of the elections. 38:35.280 --> 38:43.480 Any other use would be considered breach of contract and the companies assert sole rights in the software. 38:43.850 --> 39:10.600 And certain companies included in their agreement that reverse engineering, so, they were more specified, specific, and they said reverse engineering, reengineering, duplicating the source code or any other thing to replicate the source code is prohibited. 39:10.600 --> 39:14.300 Which is under the terms of a license. 39:14.940 --> 39:16.820 About the warranties. 39:16.820 --> 39:28.200 So, the companies warrant that the software they are providing is original and will operate in substantial performance and that the hardware is free from defects. 39:29.360 --> 39:36.440 Three vendors warranted hardware between one year and five years. 39:36.440 --> 39:39.760 So, there is a variation there. 39:39.760 --> 39:43.710 And, of course, a vendor did not specify the duration. 39:44.900 --> 39:50.960 Which can be interpreted that they will be warranted for life. 39:50.960 --> 39:53.880 And that's not good for the companies. 39:55.020 --> 39:58.980 But that's just a preliminary reading. 40:00.820 --> 40:13.580 So, what they warrant is that the warranty is to fix or replace the defective hardware or malware. 40:14.780 --> 40:17.940 About the updates and upgrades. 40:17.940 --> 40:29.080 Here, if you follow with me the language, some vendors say that they may provide new releases, upgrades, updates, et cetera. 40:29.080 --> 40:35.860 And other vendors say they will make certified software upgrades available. 40:35.860 --> 40:45.800 So, for certain companies, they are not required or obligated to make upgrades to their systems. 40:46.060 --> 40:47.860 And here is a problem. 40:47.860 --> 41:05.620 If they're not updating their systems, they can make new systems and then the counties will have to buy the new systems because their old systems are no longer okay to run. 41:05.940 --> 41:11.800 So, this obligation versus possibility dilemma, there it exists. 41:12.400 --> 41:14.360 Next, please. 41:14.620 --> 41:26.680 So, here's all the information I wanted to share with you about the project, about the process, and about preliminary reading of the agreement. 41:26.680 --> 41:31.220 And please, if you have any questions, just give them to me. 41:31.960 --> 41:39.560 So, it looks like... well, before we continue, we would like to thank our speaker again for giving us this awesome talk. 41:39.940 --> 41:45.880 It's actually kind of interesting how... a little sketchy how it is with some of these devices and some of the manufacturers. 41:46.620 --> 41:48.140 A little eye-opening, I would say. 41:48.780 --> 41:55.500 But it looks like we have a talk in the channel that says, how many different vendors did you see in total? 41:56.480 --> 41:59.240 In total, we had four. 41:59.240 --> 42:05.460 So, as I told you, out of 67 counties, only 44 provided us