1
00:00:01,550 --> 00:00:08,930
Hello, everyone, and welcome to Trust but Verify, Maintaining Democracy in Spite of Information Countermeasures.

2
00:00:09,910 --> 00:00:11,690
My name is Allie Mellon.

3
00:00:11,690 --> 00:00:16,190
I'm a security strategist in the office of the CISO at Cyber Reason.

4
00:00:16,190 --> 00:00:20,330
A little bit about me, I'm a computer engineer at heart.

5
00:00:20,350 --> 00:00:25,290
I've been in various engineering and development roles for the past 10 years.

6
00:00:25,690 --> 00:00:30,810
Previous security researcher and now security strategist at Cyber Reason.

7
00:00:30,830 --> 00:00:36,610
I am a frequent presenter on different topics, including election security.

8
00:00:37,210 --> 00:00:52,750
And before we jump into the voting aspects of this talk, what I really want to talk about is something very important and related, which is what is truly critical to our daily life?

9
00:00:52,790 --> 00:00:58,810
And the way that I immediately think about this is through Maslow's hierarchy of needs.

10
00:00:59,450 --> 00:01:07,090
At the base of Maslow's hierarchy of needs, you have the physiological needs, things like air, water, and food.

11
00:01:07,090 --> 00:01:09,130
It's critical to daily life.

12
00:01:09,210 --> 00:01:18,910
At the next level, you have things like personal security, employment, resources, these things that are a complete requirement if you're going to continue to survive.

13
00:01:20,030 --> 00:01:25,470
And then you get into the more psychological side of things with things like belonging.

14
00:01:25,470 --> 00:01:34,630
The majority of first world countries, we have safety and the physiological needs relatively covered.

15
00:01:34,630 --> 00:01:45,130
But once you get to this level of belonging and that psychological element, you start to get into something that I think a lot of people are under constant development with.

16
00:01:45,130 --> 00:01:50,510
And it's not a given that you're going to have these things just because you're in a first world country.

17
00:01:50,770 --> 00:01:55,890
Similarly, esteem, things like respect, self-esteem, status.

18
00:01:55,890 --> 00:02:05,770
These are things that you need on this path towards what is ultimately self-actualization and the desire to become the most one can be.

19
00:02:05,790 --> 00:02:08,990
And you can be taking steps at each of these levels.

20
00:02:08,990 --> 00:02:16,870
But the idea is that in order to reach the top of the pyramid, you need to have all of these different levels met.

21
00:02:17,110 --> 00:02:26,590
So the reason that I talk about this is because I think that it plays an important role in voting and in election security as well.

22
00:02:26,590 --> 00:02:30,910
And it raises the question of where does voting fit into this?

23
00:02:31,510 --> 00:02:34,690
Now, a little bit of background.

24
00:02:35,010 --> 00:02:59,810
The original, the start of this idea came from a series of exercises we did at Cyber Reason called Operation Blackout Protect the Vote, where we worked with local and federal law enforcement officers to host tabletop exercises, where we had one red team of hackers and cybersecurity experts and a blue team of local and federal law enforcement from DHS,

25
00:02:59,810 --> 00:03:01,930
FBI, and the Secret Service.

26
00:03:02,250 --> 00:03:05,730
And then we also had a white team set up for adjudication.

27
00:03:05,770 --> 00:03:21,830
And it was basically a turn-based tabletop exercise so that we could ultimately identify gaps in law enforcement's ability to protect Election Day with a fictional country known as Adversaria.

28
00:03:22,270 --> 00:03:32,390
And we actually held these exercises in Washington, D.C., in Boston, in San Francisco, in London, in Tel Aviv, and Paris.

29
00:03:32,390 --> 00:03:47,570
And what we learned from them is that even when you're not actually hacking, even when this is just a thought experiment, you can see a lot of potential for different ways to attack an election that isn't just limited to those voting machines.

30
00:03:47,890 --> 00:03:50,030
And so that's what I'm going to be talking about today.

31
00:03:50,730 --> 00:03:58,830
We're going to start with the defender perspective and really getting into the daily life of a voter before jumping into the attacker perspective.

32
00:03:58,830 --> 00:04:06,930
And then we're going to start brainstorming what you could do to stop an election in order to understand better how we can actually defend it.

33
00:04:07,250 --> 00:04:18,750
And so throughout this talk, I want you guys to be brainstorming and thinking about the different things that you would do to stop an election or to cause chaos during an election day.

34
00:04:20,410 --> 00:04:23,050
So let's jump into the defender perspective.

35
00:04:24,830 --> 00:04:36,530
According to the DHS, election infrastructure includes things like voter registration databases, IT infrastructure, voting systems, storage facilities, and polling places.

36
00:04:36,530 --> 00:04:40,490
Okay, this is very classical definition, totally understandable.

37
00:04:40,490 --> 00:04:44,390
These are all the things that have to do with actually submitting your vote.

38
00:04:44,470 --> 00:04:48,930
But I don't think that that's all that we need to consider.

39
00:04:48,990 --> 00:04:57,350
I think that there's a lot more that we need to consider before the voter is actually able to go to the polling place and put in their ballot.

40
00:04:57,850 --> 00:05:02,070
And the way that I like to talk about this is through the voter hierarchy of needs.

41
00:05:02,070 --> 00:05:12,690
These are, much like Maslow's hierarchy, a set of different things that voters need before they're actually comfortable going out to vote.

42
00:05:14,110 --> 00:05:21,110
We can see the parallels with Maslow's hierarchy of needs with things like the physiological needs.

43
00:05:21,110 --> 00:05:23,030
Life and death, very important.

44
00:05:23,290 --> 00:05:29,910
Property, having a place to live, having a place to do your daily activities.

45
00:05:29,910 --> 00:05:32,530
Those things are automatically going to come before voting.

46
00:05:32,530 --> 00:05:37,050
If you are afraid for your life, you're probably not going to take the time to vote.

47
00:05:37,050 --> 00:05:42,090
For those who do, it's going to be much less than it would if they weren't afraid for their lives.

48
00:05:43,150 --> 00:05:54,350
And that also plays into the safety concept, but it can be extended to things like family health or job safety, financial security.

49
00:05:54,410 --> 00:06:01,270
People, when they don't feel financially secure, are they going to want to spend the extra money to get to the polling place?

50
00:06:01,630 --> 00:06:02,930
Some will not.

51
00:06:04,050 --> 00:06:07,110
And then also that belonging aspect.

52
00:06:07,110 --> 00:06:14,310
If you don't feel like you're a part of a country, a part of a culture, you're not going to want to contribute to it by giving back your vote.

53
00:06:15,910 --> 00:06:26,890
And then esteem, feeling like your vote matters, feeling like you matter in the grand scheme of things, feeling like it's worth it to vote because you think that you're making something a better place.

54
00:06:28,130 --> 00:06:42,370
And then, of course, being all that you can be and really being able to feel good about that as you move forward and also feel good about your voting and that contributing to your country being the best that it can be.

55
00:06:43,150 --> 00:06:52,670
So this is how I like to talk about the voter hierarchy of needs and all of the levels that we have to consider as different places that can be attacked.

56
00:06:52,950 --> 00:07:00,430
And that's why I question if election infrastructure is really just limited to the ways that you submit your ballots.

57
00:07:00,590 --> 00:07:15,100
And I think it's important to say that I'm not suggesting that election commissions need to control all of these levels, but they need to be considered as we look to secure our elections and protect our democracy.

58
00:07:16,910 --> 00:07:25,410
Because these systems that we've identified that we need to protect are also systems that can become a target.

59
00:07:26,210 --> 00:07:35,670
And you might think that this would be a small impact on an election, but take the United States, where 40% of eligible U.S.

60
00:07:35,670 --> 00:07:42,090
citizens do not vote at all, and any kind of voter suppression will have an impact on the election.

61
00:07:44,210 --> 00:07:55,050
So when we're thinking about election security and election infrastructure, we need to think about things that relate to voter suppression and faith in the government.

62
00:07:55,530 --> 00:08:02,590
There are ways to influence an election outside of attacking the actual polling places.

63
00:08:04,330 --> 00:08:13,170
So let's jump into the attacker perspective and talk about a more historical approach and modern day what we're seeing, as well as motivations and things like that.

64
00:08:13,890 --> 00:08:25,610
So on the motivation side, these nation-state attackers, they're looking to either gain power, a particular ideology, or maintain global recognition and support.

65
00:08:25,610 --> 00:08:31,410
And for any of you who were able to attend some of the Black Hat keynotes, we saw this as a common thread.

66
00:08:31,870 --> 00:08:47,190
These countries are looking to make sure that their particular belief system is spread across the world, that they maintain their status as a superpower, whatever the case may be, or that they get to the point of a superpower.

67
00:08:48,970 --> 00:09:02,370
And when I'm thinking about the different types of attacks, the different types of cyber attacks that we can see, I like to use a way of describing it that our CISO Sam Curry talks about, which is three different layers.

68
00:09:02,370 --> 00:09:05,850
The infrastructure layer, the information layer, and the ethos layer.

69
00:09:05,850 --> 00:09:19,230
The infrastructure layer, that's that physical objects like the electric grid, things like that, misinformation or disinformation.

70
00:09:19,230 --> 00:09:23,830
And the ethos layer, that's all about the core belief system of the country.

71
00:09:24,710 --> 00:09:35,690
So we're going to start with that belief system and delve into some historical examples, and then get to some modern day examples that incorporate a lot more of the cybersecurity aspect.

72
00:09:35,690 --> 00:09:49,170
The historical examples don't as much, however, they give us a really good baseline to understand that this is not a new problem, and that the way that we're seeing people do it digitally is just a new approach to that problem.

73
00:09:50,510 --> 00:09:54,870
So let's take the Italian elections of 1948.

74
00:09:55,610 --> 00:09:58,910
At the time, it was right after World War II, the U.S.

75
00:09:58,910 --> 00:10:01,970
government was intent on psychological warfare.

76
00:10:02,250 --> 00:10:10,730
They were obsessed with spreading democracy, and they were putting millions of dollars towards Christian, Democratic, and right-wing socialist parties.

77
00:10:10,830 --> 00:10:16,520
In effect, they were spreading a massive propaganda campaign against communist socialist coalitions.

78
00:10:17,010 --> 00:10:36,490
And the goal was to change the perception in that election specifically to a conversation about democracy versus totalitarianism, Christianity versus atheism, America versus the Soviet Union, and of course, abundance versus starvation, trying to draw that contrast.

79
00:10:36,490 --> 00:10:40,950
And they ended up successfully swaying the votes in the election.

80
00:10:41,270 --> 00:10:53,830
And so they repeated that process in places like Guatemala, in South Vietnam, in Afghanistan, and Indonesia, as well as many, many more.

81
00:10:54,150 --> 00:10:58,730
And this was without having the digital component at all, without having to do any hacking.

82
00:10:59,150 --> 00:11:04,170
But it was the start of something that we're seeing take shape even more now.

83
00:11:05,050 --> 00:11:06,910
Another example.

84
00:11:07,350 --> 00:11:19,110
Moscow founded the communist international group Comintern in 1919, and they urged the American Communist Party to pursue revolutionary regime change.

85
00:11:19,110 --> 00:11:31,250
This was very similar to democracy promotion, which was, again, later pursued by Washington, all with the purpose of spreading their point of view within America.

86
00:11:33,270 --> 00:11:37,850
And of course, the 1996 Chinese influence on the U.S.

87
00:11:37,850 --> 00:11:43,650
election, where a Chinese general sent $300,000 to influence a U.S.

88
00:11:43,650 --> 00:11:47,750
presidential election by funneling money to the Clinton campaign.

89
00:11:49,830 --> 00:11:57,630
So let's look at the cyber equivalent of these things that's happening right now, and has been happening for some time.

90
00:11:58,830 --> 00:12:01,270
A good example of this is social media attacks.

91
00:12:01,270 --> 00:12:17,270
So on the left, you can see this ad, which is meant to persuade voters to vote ahead by voting from home, and saying that you can text Hillary to a certain number to vote, which is obviously not true.

92
00:12:17,270 --> 00:12:29,290
But especially right now, it might be something that people would find really appealing, not having to worry about any mail-in voting, just having to text a name to a certain number.

93
00:12:29,290 --> 00:12:30,910
But of course, it doesn't work.

94
00:12:33,560 --> 00:12:51,640
So that's kind of a double-edged attack, because it's not just targeting that belief system, and that belief in your government, and their ability to actually protect you from these types of things, but it's also targeting that information layer, and making it so that your vote doesn't actually count,

95
00:12:51,640 --> 00:12:52,840
even though you think that it did.

96
00:12:52,860 --> 00:13:07,260
And then on the right-hand side, you can see an advertisement, also not from someone in the U.S., but aimed at highlighting divisions within the U.S., and also creating them, depending on the case.

97
00:13:09,320 --> 00:13:25,520
And an important part of this talk is recognizing that there are other organizations than the government that have a role in election security, even if they choose not to.

98
00:13:25,940 --> 00:13:39,820
And that through actions that certain social media organizations have taken, they have set up governments to spread this type of attack more easily.

99
00:13:39,960 --> 00:13:58,160
And that's not to say that these organizations should be controlled, or anything like that, but to some extent, they do have a responsibility as American citizens, as people in the United States, to consider this, and to consider the implications of these types of attacks,

100
00:13:58,160 --> 00:14:05,740
and to try to build a stronger foundation for democracy within their own organizations.

101
00:14:06,940 --> 00:14:10,780
So now let's look at the information plane.

102
00:14:11,620 --> 00:14:14,640
And remember, this is all of the communication.

103
00:14:14,640 --> 00:14:18,000
This is where we get into the real misinformation and disinformation.

104
00:14:18,160 --> 00:14:26,600
And I want to start with a really baffling example that highlights that, you know, this is not a new thing.

105
00:14:26,980 --> 00:14:36,840
And as much as we are recognizing disinformation and misinformation right now in American culture, America was really founded on this.

106
00:14:36,980 --> 00:14:42,800
It was founded on the premise of a conspiracy theory where the British were trying to enslave us.

107
00:14:42,800 --> 00:14:52,380
Sam Adams argued that Britain's taxations before the Revolutionary War were part of an elaborate conspiracy to eventually enslave American colonists.

108
00:14:52,480 --> 00:15:03,760
He actually spread that and other early disinformation through pamphlets and speeches that he would hand out that contained information that he knew was not true.

109
00:15:04,140 --> 00:15:16,960
And he used the Boston Massacre as a tool in order to continue to spread that disinformation and to continue to cause chaos within America leading to the American Revolution.

110
00:15:18,240 --> 00:15:30,120
So we have this foundation in the U.S., for those of you who are from the U.S., of disinformation and of misinformation from our very earliest days.

111
00:15:32,120 --> 00:15:39,180
And then, of course, you can consider things like the CIA and the infamous propaganda asset inventory.

112
00:15:39,180 --> 00:15:57,800
During the Cold War era in the 1950s and 60s, the CIA had a huge number of radio stations and newspapers and magazines across the globe that they were using to push the United States agenda.

113
00:15:57,800 --> 00:16:14,580
In one very interesting instance, they had control of a program called Radio Free Asia, but they realized that the average Taiwanese person, individual, would not actually have a radio.

114
00:16:14,580 --> 00:16:20,470
So they strapped small radios to balloons and sent them flying to try and get them to Taiwan.

115
00:16:21,040 --> 00:16:27,040
Needless to say, the wind took them in the wrong direction, but the idea was very interesting nonetheless.

116
00:16:28,620 --> 00:16:41,980
In another interesting little tidbit, they had control of a magazine, but the magazine became so popular that it was actually also began being distributed to the United States.

117
00:16:41,980 --> 00:16:47,280
And so they had to be very careful to only put the propaganda in the ones that were not going to the U.S.

118
00:16:51,260 --> 00:17:00,680
Similarly, in the 50s, 60s, and 70s, left-wing newspapers in Europe were pretty much all financed directly from Moscow, pushing Moscow's agenda.

119
00:17:01,880 --> 00:17:03,520
And then the U.S.

120
00:17:03,520 --> 00:17:19,500
radio, also in Moscow, which would play rock music like Elton John and the Beatles that they couldn't get anywhere else, but it was always followed by short segments of what they called editorial content, which Soviet authorities considered disinformation,

121
00:17:19,500 --> 00:17:22,680
which was giving that American perspective.

122
00:17:24,560 --> 00:17:31,140
One that's more focused on the cyber realm is the 2014 Ukraine elections.

123
00:17:31,220 --> 00:17:39,200
On May 21st of 2014, attackers compromised the CEC network and actually disabled the vote counting.

124
00:17:39,440 --> 00:17:48,860
Now, this would automatically attack that ethos layer, and you start to lose faith in your government to actually be able to accurately count your votes and the validity of the election.

125
00:17:49,240 --> 00:17:53,260
But then they managed to get it back up after, I think, like 12 hours.

126
00:17:53,340 --> 00:17:57,020
And four days later was the actual election day.

127
00:17:57,740 --> 00:18:06,680
At the time, the same CEC website was under constant DDoS attack.

128
00:18:06,920 --> 00:18:16,380
And 12 minutes before the polls closed, attackers actually posted a picture of a former leader to the right sector on the CEC website claiming he won the election.

129
00:18:16,380 --> 00:18:21,980
What's really interesting about this is it was immediately shared by Russian media.

130
00:18:22,800 --> 00:18:25,100
Almost as if it was coordinated.

131
00:18:26,020 --> 00:18:26,880
Almost.

132
00:18:28,740 --> 00:18:32,400
And let's also look at the communication plane.

133
00:18:32,540 --> 00:18:41,240
This is very interesting, and it really makes it so that people are confused about what to do, where to go.

134
00:18:41,240 --> 00:18:43,140
It's a direct line to the voters.

135
00:18:44,140 --> 00:18:45,900
And here are two examples of that.

136
00:18:45,900 --> 00:18:56,020
On the left, you have an example of a text that is supposedly from President Trump shaming someone into voting, saying your ballot hasn't been submitted, what are you still doing?

137
00:18:56,360 --> 00:18:59,960
In reality, this is not from the campaign, this is not from Trump.

138
00:19:00,400 --> 00:19:03,600
And they would not be able to track this type of information.

139
00:19:03,880 --> 00:19:07,280
But they even got an interesting URL, vote.gop.

140
00:19:07,720 --> 00:19:20,780
And then on the right-hand side, you can see an example that's supposed to be a very helpful message from the government telling you your polling location and what the hours are and where to go.

141
00:19:20,780 --> 00:19:23,700
In reality, that's not a real polling location.

142
00:19:23,700 --> 00:19:36,800
That's someone sending a message that purports to be from the government as a helpful reminder to go vote, when in reality, there's nothing there and the voter will go, get there, and not be able to vote.

143
00:19:36,800 --> 00:19:45,640
And at that point, you're either one, late for work if you go into work, or two, you're frustrated and less likely to vote.

144
00:19:48,750 --> 00:19:50,810
Now let's look at the infrastructure plane.

145
00:19:51,590 --> 00:20:08,390
And this one is really interesting because it's that physical layer, which I think that a lot of times, especially more broadly, we don't think about or more broadly, I mean, the world instead of just the cybersecurity community doesn't think of cyber attacks in this infrastructure plane as much.

146
00:20:08,650 --> 00:20:17,610
And we're going to go back to those historical examples that don't incorporate a cybersecurity component, but lay the groundwork for where this can go in the future.

147
00:20:17,970 --> 00:20:21,650
Starting with the assassination of Lumumba.

148
00:20:22,770 --> 00:20:28,730
In 1960, the Democratic Republic of Congo gained its independence.

149
00:20:28,770 --> 00:20:32,610
And Lumumba was the prime minister of the DRC.

150
00:20:32,610 --> 00:20:35,470
He was also elected that year.

151
00:20:35,470 --> 00:20:40,210
And then he was subsequently assassinated one year later in 1961.

152
00:20:40,610 --> 00:20:47,090
Now, this was immediately politically fracturing for this very, very new independent nation.

153
00:20:47,210 --> 00:20:52,690
And it turns out that the groups behind it were American and Belgian.

154
00:20:52,690 --> 00:20:56,710
And they were actually from the US government and the Belgian government.

155
00:20:56,710 --> 00:21:00,990
And they had worked together to plan this assassination.

156
00:21:00,990 --> 00:21:07,750
And this is the type of thing that can really be destructive to such a new nation.

157
00:21:07,750 --> 00:21:20,210
It would be the equivalent in the US is George Washington being assassinated a year after American independence, which would have, who would have, who knows what would have happened in that instance.

158
00:21:22,250 --> 00:21:30,790
And then there's also the 1965 Indonesian elections and subsequent massacre.

159
00:21:31,010 --> 00:21:39,670
The Communist Party finished fourth in an Indonesian elections, and they were offered a proportional representation in the government.

160
00:21:40,510 --> 00:21:45,690
Now, this was not aligned to US interests, needless to say.

161
00:21:45,690 --> 00:22:01,930
And for fear of how this would impact US interests in the region, the US secretly supported the purge of suspected communists, causing thousands to millions, they're not entirely sure how many, to die over the course of months.

162
00:22:01,930 --> 00:22:05,790
And the military took over as the most powerful institution.

163
00:22:06,030 --> 00:22:17,450
So this is not only direct impact, because they have supported and pushed for the death and the massacre of these many, many people.

164
00:22:17,450 --> 00:22:30,530
But it's also something that I deeply believe would terrify the public, who is going to be voting and speaking about their beliefs freely after this type of thing happens in their country.

165
00:22:34,420 --> 00:22:41,620
And now this one isn't an example of election day, but it's a good representation, again, and it does involve that cyber component.

166
00:22:41,620 --> 00:22:50,480
So the Bronze Night in Estonia in 2007, this was really a combination of an infrastructure attack and an information attack.

167
00:22:51,080 --> 00:23:03,380
In 2007, Estonians made the decision to move a Red Army soldier statue to a Soviet cemetery, because needless to say, they did not want a Red Army soldier in the middle of their country.

168
00:23:04,180 --> 00:23:07,180
Not exactly a fan favorite there.

169
00:23:07,680 --> 00:23:20,180
So the night that it was being moved, fake news started to spread with Russian news reports claiming that the statue and the Soviet war graves were being destroyed.

170
00:23:20,460 --> 00:23:23,880
And this resulted in two nights straight of riots and looting.

171
00:23:24,360 --> 00:23:29,200
156 people were injured, one person was left dead, and a thousand were detained.

172
00:23:29,520 --> 00:23:46,740
But at the exact same time, there were a ton of denial of service attacks going on inside Estonia across banks, media outlets, governments, cash machines, things like online banking was out of service, government employees couldn't communicate over email,

173
00:23:46,740 --> 00:23:50,140
and newspapers and broadcasters couldn't deliver the news.

174
00:23:50,140 --> 00:23:57,180
So all they were left with was the Russian news reports that were spreading this fake news.

175
00:24:00,800 --> 00:24:14,280
And this quote, I really like this quote, because it talks a little bit about this with, in all of these historical examples, these campaigns were done covertly.

176
00:24:14,280 --> 00:24:22,660
And cyber aggression really gives us the ability to have these type of campaigns very covertly.

177
00:24:22,680 --> 00:24:37,660
And it leaves us really vulnerable to these types of attacks, and to really sowing chaos internally in the country, with people believing conspiracy theories about the situation, with people not knowing what's true and what isn't.

178
00:24:37,660 --> 00:24:48,080
And that's why I think it's so scary, the potential, not just on the misinformation and disinformation side, but also on that belief system layer, and even that infrastructure layer.

179
00:24:50,900 --> 00:25:04,640
So some examples of things that we talked about during these tabletop exercises that I think could have a huge impact on election day come to things like the electric grid.

180
00:25:05,060 --> 00:25:11,740
So in 2003, a four-day power outage left at least 100 people in the United States and Canada dead.

181
00:25:12,460 --> 00:25:20,080
Now imagine there's a power outage on election day, and you have yet to leave your house.

182
00:25:20,080 --> 00:25:21,780
Are you going to be worried about voting?

183
00:25:21,780 --> 00:25:27,220
Or are you going to be worried about making sure that whatever's in your fridge doesn't go bad?

184
00:25:27,820 --> 00:25:30,240
Are you going to be worried about your family?

185
00:25:30,360 --> 00:25:38,320
Maybe you know someone who needs the type of care that requires electricity to be available?

186
00:25:38,700 --> 00:25:51,080
There are a lot of factors here that will immediately, just like with those voter hierarchy of needs, that will immediately come before you're actually willing to vote when something sporadic happens, like losing power.

187
00:25:52,400 --> 00:25:55,380
And we're also going to talk about transit.

188
00:25:55,640 --> 00:26:03,500
So in 2016, San Francisco's transit system was infected with ransomware.

189
00:26:03,820 --> 00:26:08,460
Now imagine a scenario, a lot of people go to vote after work.

190
00:26:08,720 --> 00:26:15,920
So you go to work, you spend your day on Twitter, probably seeing some disinformation.

191
00:26:16,560 --> 00:26:25,280
You get to the end of the day, you've taken the train into work, and you go to take the train to the polling station and then back home, and it's down.

192
00:26:25,400 --> 00:26:27,180
And you can't access it.

193
00:26:27,420 --> 00:26:29,260
Are you going to be thinking about voting now?

194
00:26:29,260 --> 00:26:35,120
Or are you going to be thinking about how you're going to get home and potentially being a little annoyed that the train is down?

195
00:26:38,180 --> 00:26:46,180
So we can see that these attacks go across layers, but also across all the layers of the pyramid.

196
00:26:46,200 --> 00:26:48,300
And they're just a few examples.

197
00:26:48,300 --> 00:26:52,260
There are way more that we can look at through our own tabletop exercises.

198
00:26:54,180 --> 00:26:59,640
So let's jump back into the defender perspective before we really get to that brainstorming part.

199
00:27:00,460 --> 00:27:02,280
Where does this leave us?

200
00:27:02,800 --> 00:27:12,680
We have this small view of election security, just with voter registration, just with databases, IT infrastructure, things like that.

201
00:27:13,980 --> 00:27:20,460
And we end up with quotes like these from leaders in different countries.

202
00:27:20,460 --> 00:27:23,440
We cannot exclude such activities in Germany either.

203
00:27:23,440 --> 00:27:28,200
In the election campaign, we'll also have to confront distortions and fake stories.

204
00:27:28,200 --> 00:27:36,780
Now, it's great that they're being honest about it, but where does this leave a citizen when knowing what's fake, what's real?

205
00:27:36,980 --> 00:27:39,560
When knowing how to actually combat this?

206
00:27:40,480 --> 00:27:56,140
Similarly, we have representatives saying that people are trying to steal another election, that it's all rigged, that it's a scam, pushing this same narrative that these countries want other countries to believe in.

207
00:27:57,520 --> 00:28:06,380
And then, of course, just from a couple of weeks ago, congressional Democrats talking about how they were gravely concerned about foreign interference in an election.

208
00:28:06,900 --> 00:28:10,420
Now, I think the recognition, again, the recognition is good.

209
00:28:10,600 --> 00:28:17,420
It's just a matter of giving us the tools to combat what they're seeing that we're missing here.

210
00:28:17,420 --> 00:28:19,340
We're missing the leadership part.

211
00:28:21,040 --> 00:28:37,340
So where should we really be going in order to create a different reality for ourselves, where we have a more well-rounded view of election security, where we understand the problem and where we, not just the government, but also the citizens and the private sector,

212
00:28:37,340 --> 00:28:39,900
can affect change?

213
00:28:41,120 --> 00:28:54,000
And this is what it should look like, where we have all of those different aspects that are front and center, and that we're thinking about, and that we're making clear these are the things that are going to be under attack.

214
00:28:54,000 --> 00:28:55,720
These are the things that you need to look out for.

215
00:28:55,720 --> 00:29:04,820
Having that communication, because in reality, as I've mentioned before, a lot of these channels are not government-owned entities.

216
00:29:04,820 --> 00:29:12,800
A lot of them are privately held, which means that election security cannot just be the government's problem.

217
00:29:12,940 --> 00:29:15,700
It has to be something considered by the private sector.

218
00:29:15,700 --> 00:29:22,720
It has to be something that we work together as a community, as a society, to help stop.

219
00:29:25,600 --> 00:29:34,340
So I want you guys... the goal of this was, if we were in person, to do a small tabletop exercise together.

220
00:29:34,340 --> 00:29:43,940
But since we can't really do that, I want you guys to imagine how this scenario would go, what you would do from either perspective.

221
00:29:44,280 --> 00:29:48,400
And just start by thinking about, do you vote before work?

222
00:29:48,400 --> 00:29:49,960
Do you mail in your ballot?

223
00:29:49,960 --> 00:29:55,820
How do modern events, like the pandemic that we're going through right now, change all of that?

224
00:29:55,820 --> 00:29:56,840
Are you on Twitter?

225
00:29:56,840 --> 00:29:58,220
Do you fact check?

226
00:29:58,400 --> 00:30:04,160
I typically do, or would, vote before work, if we were still going into the office.

227
00:30:04,160 --> 00:30:06,220
I am doing a mail -in ballot.

228
00:30:06,220 --> 00:30:14,540
I think that mail-in ballots are critical right now, given the current situation, and because it really takes away those time-based attacks that we're seeing.

229
00:30:15,620 --> 00:30:30,000
If the day of the election you lose power, but you already voted three weeks ago, then you're not actually going to be part of the voter suppression problem, and it's already taken care of.

230
00:30:30,000 --> 00:30:32,320
And that's a huge positive, that's a huge benefit.

231
00:30:32,320 --> 00:30:41,260
Not to say that mail-in voting doesn't have its own issues, but that's at least a start to removing some of those time-based barriers.

232
00:30:42,460 --> 00:30:44,440
How do modern events change this?

233
00:30:44,440 --> 00:30:46,820
Are you considering things like mail-in voting?

234
00:30:46,820 --> 00:30:47,800
Are you on Twitter?

235
00:30:47,800 --> 00:30:49,220
I know a lot of us are.

236
00:30:49,220 --> 00:30:55,080
InfoSec Twitter is great and terrible, but it raises the question of, do you fact check?

237
00:30:55,080 --> 00:30:56,840
Are you checking the things that you see?

238
00:30:56,840 --> 00:31:00,080
Are you sharing articles without actually reading them?

239
00:31:00,080 --> 00:31:04,980
These are important, and they tend to get lost in the even though people talk about them.

240
00:31:06,380 --> 00:31:13,960
And then take a look at how would you attack your life of a voter , your typical day?

241
00:31:13,960 --> 00:31:20,820
What would you do that would make you stop and think, I'm going to take care of this problem and I'm not going to go vote today?

242
00:31:22,340 --> 00:31:23,840
That's what's critical.

243
00:31:24,180 --> 00:31:36,480
And some of the things that we saw in these tabletop exercises to affect an election were things like attackers creating deepfakes of certain candidates.

244
00:31:36,840 --> 00:31:46,500
And the thing is, if you release a deepfake of a candidate on the day of the election on that morning, there really isn't enough time for the candidate to react.

245
00:31:46,500 --> 00:31:50,140
And maybe they'll issue a statement, but the damage will have been done.

246
00:31:50,280 --> 00:31:55,040
And it's not something you can fix over the course of eight hours.

247
00:31:56,000 --> 00:32:00,600
So these are the types of questions like, how does that time-based element affect things?

248
00:32:00,600 --> 00:32:08,460
If you took out the electric grid exclusively in regions that are known to be very conservative, how would that look to people?

249
00:32:08,580 --> 00:32:10,400
What would they take away from that?

250
00:32:10,400 --> 00:32:17,140
Would they take away that it was just a random power outage or would they suspect that there was foul play from the other side?

251
00:32:20,000 --> 00:32:26,160
And then take those ideas and think about what you can do for your country instead.

252
00:32:26,180 --> 00:32:32,800
Because at the end of the day, as we know with red teaming, all of this is working towards stronger security.

253
00:32:32,800 --> 00:32:41,120
And that's what's important, is that we come out of this considering how to make security stronger, how to make election security stronger, the whole thing.

254
00:32:41,120 --> 00:32:42,960
So how do you defend?

255
00:32:42,960 --> 00:32:45,140
Are you involved in any of these sectors?

256
00:32:45,140 --> 00:32:47,620
Are you in the transit sector or communication sector?

257
00:32:47,620 --> 00:32:49,540
Do you work at a social media company?

258
00:32:49,660 --> 00:32:52,260
How can you affect change within these organizations?

259
00:32:52,260 --> 00:32:59,400
Because at the end of the day, we all have to do our part in order to protect our system.

260
00:33:02,180 --> 00:33:08,680
So this kind of left me with a lot of questions because it feels like an insurmountable problem.

261
00:33:08,680 --> 00:33:10,620
It's this huge, huge problem.

262
00:33:10,820 --> 00:33:28,280
But at the end of the day, what I think is the most important and what we can take away from this is the first thing is to, whether you work at a private company or a government entity, work to improve your security, your personal security, your enterprise security,

263
00:33:28,280 --> 00:33:30,700
whatever the case may be, we need it.

264
00:33:30,700 --> 00:33:35,980
Because all of these different elements can be used in a way that they're not supposed to be used.

265
00:33:35,980 --> 00:33:46,960
And you just don't know what creative method an attacker is going to use in order to affect the belief system of the country.

266
00:33:47,180 --> 00:33:51,680
So really focus on, of course, having good security measures.

267
00:33:51,680 --> 00:33:54,740
The second is to work with the government.

268
00:33:55,640 --> 00:33:58,000
I know, like, build partnerships with the government.

269
00:33:58,000 --> 00:33:59,260
I'm a part of InfraGard.

270
00:33:59,260 --> 00:34:04,060
It's the government group for infrastructure security.

271
00:34:04,060 --> 00:34:05,120
I think that that's great.

272
00:34:05,120 --> 00:34:10,300
It's a great way to share and give back, not just to the community, but also to the government.

273
00:34:10,960 --> 00:34:21,500
So I highly recommend just finding different avenues and different partnerships that you can have to make security stronger in the government space, even if you don't work there directly.

274
00:34:22,060 --> 00:34:23,920
And also to spread awareness.

275
00:34:24,360 --> 00:34:27,440
And then the last one is to work to fight misinformation.

276
00:34:27,920 --> 00:34:32,320
Because I think that's a continuous struggle that we all have to consider.

277
00:34:32,320 --> 00:34:36,320
And the more that we work at it, the better off we will be inevitably.

278
00:34:36,680 --> 00:34:41,740
I mean, it's a lot of work, but that's how it is.

279
00:34:42,860 --> 00:34:45,300
I also wrote a white paper on this.

280
00:34:45,520 --> 00:34:47,060
Feel free to download.

281
00:34:47,060 --> 00:34:50,120
You don't need to put it in email or anything like that.

282
00:34:50,120 --> 00:34:52,540
It's totally free if you go to this link.

283
00:34:52,600 --> 00:34:55,380
And it elaborates on a lot of what I've talked about here.

284
00:34:55,880 --> 00:34:57,620
So feel free to download that.

285
00:34:57,620 --> 00:34:59,740
And also message me if you have any questions.

286
00:34:59,740 --> 00:35:00,920
I'm happy to help.

287
00:35:02,820 --> 00:35:04,420
Thank you so much for attending.

288
00:35:04,420 --> 00:35:07,840
I hope you guys have a great rest of DEF CON Red Team Village.

289
00:35:07,960 --> 00:35:10,120
And if you have any questions, feel free to reach out.

290
00:35:10,120 --> 00:35:13,660
I will respond to all the comments in Discord.

291
00:35:13,720 --> 00:35:15,360
And feel free to ask me any questions.

292
00:35:15,360 --> 00:35:17,480
HackerBella on Discord.

293
00:35:17,560 --> 00:35:19,300
So thank you so much.

294
00:35:19,420 --> 00:35:20,080
Awesome.

295
00:35:20,080 --> 00:35:20,440
Thank you.

296
00:35:20,440 --> 00:35:21,520
Amazing presentation.

297
00:35:21,520 --> 00:35:25,680
Thank you so much for supporting us, supporting DEF CON Red Team Village.

298
00:35:25,760 --> 00:35:33,200
And again, as we said before, please look at all the talks and activities that are happening right now in the bottom of the screen.

299
00:35:33,340 --> 00:35:35,760
You should have a link to our website.

300
00:35:36,000 --> 00:35:39,320
We're streaming on Twitch and YouTube and so on.

301
00:35:39,320 --> 00:35:43,920
And please, as Ali mentioned, please join the conversation on Discord.

302
00:35:43,920 --> 00:35:47,960
We're going to take a small break and the next presenter will be here in about a minute.