WEBVTT 00:01.550 --> 00:08.930 Hello, everyone, and welcome to Trust but Verify, Maintaining Democracy in Spite of Information Countermeasures. 00:09.910 --> 00:11.690 My name is Allie Mellon. 00:11.690 --> 00:16.190 I'm a security strategist in the office of the CISO at Cyber Reason. 00:16.190 --> 00:20.330 A little bit about me, I'm a computer engineer at heart. 00:20.350 --> 00:25.290 I've been in various engineering and development roles for the past 10 years. 00:25.690 --> 00:30.810 Previous security researcher and now security strategist at Cyber Reason. 00:30.830 --> 00:36.610 I am a frequent presenter on different topics, including election security. 00:37.210 --> 00:52.750 And before we jump into the voting aspects of this talk, what I really want to talk about is something very important and related, which is what is truly critical to our daily life? 00:52.790 --> 00:58.810 And the way that I immediately think about this is through Maslow's hierarchy of needs. 00:59.450 --> 01:07.090 At the base of Maslow's hierarchy of needs, you have the physiological needs, things like air, water, and food. 01:07.090 --> 01:09.130 It's critical to daily life. 01:09.210 --> 01:18.910 At the next level, you have things like personal security, employment, resources, these things that are a complete requirement if you're going to continue to survive. 01:20.030 --> 01:25.470 And then you get into the more psychological side of things with things like belonging. 01:25.470 --> 01:34.630 The majority of first world countries, we have safety and the physiological needs relatively covered. 01:34.630 --> 01:45.130 But once you get to this level of belonging and that psychological element, you start to get into something that I think a lot of people are under constant development with. 01:45.130 --> 01:50.510 And it's not a given that you're going to have these things just because you're in a first world country. 01:50.770 --> 01:55.890 Similarly, esteem, things like respect, self-esteem, status. 01:55.890 --> 02:05.770 These are things that you need on this path towards what is ultimately self-actualization and the desire to become the most one can be. 02:05.790 --> 02:08.990 And you can be taking steps at each of these levels. 02:08.990 --> 02:16.870 But the idea is that in order to reach the top of the pyramid, you need to have all of these different levels met. 02:17.110 --> 02:26.590 So the reason that I talk about this is because I think that it plays an important role in voting and in election security as well. 02:26.590 --> 02:30.910 And it raises the question of where does voting fit into this? 02:31.510 --> 02:34.690 Now, a little bit of background. 02:35.010 --> 02:59.810 The original, the start of this idea came from a series of exercises we did at Cyber Reason called Operation Blackout Protect the Vote, where we worked with local and federal law enforcement officers to host tabletop exercises, where we had one red team of hackers and cybersecurity experts and a blue team of local and federal law enforcement from DHS, 02:59.810 --> 03:01.930 FBI, and the Secret Service. 03:02.250 --> 03:05.730 And then we also had a white team set up for adjudication. 03:05.770 --> 03:21.830 And it was basically a turn-based tabletop exercise so that we could ultimately identify gaps in law enforcement's ability to protect Election Day with a fictional country known as Adversaria. 03:22.270 --> 03:32.390 And we actually held these exercises in Washington, D.C., in Boston, in San Francisco, in London, in Tel Aviv, and Paris. 03:32.390 --> 03:47.570 And what we learned from them is that even when you're not actually hacking, even when this is just a thought experiment, you can see a lot of potential for different ways to attack an election that isn't just limited to those voting machines. 03:47.890 --> 03:50.030 And so that's what I'm going to be talking about today. 03:50.730 --> 03:58.830 We're going to start with the defender perspective and really getting into the daily life of a voter before jumping into the attacker perspective. 03:58.830 --> 04:06.930 And then we're going to start brainstorming what you could do to stop an election in order to understand better how we can actually defend it. 04:07.250 --> 04:18.750 And so throughout this talk, I want you guys to be brainstorming and thinking about the different things that you would do to stop an election or to cause chaos during an election day. 04:20.410 --> 04:23.050 So let's jump into the defender perspective. 04:24.830 --> 04:36.530 According to the DHS, election infrastructure includes things like voter registration databases, IT infrastructure, voting systems, storage facilities, and polling places. 04:36.530 --> 04:40.490 Okay, this is very classical definition, totally understandable. 04:40.490 --> 04:44.390 These are all the things that have to do with actually submitting your vote. 04:44.470 --> 04:48.930 But I don't think that that's all that we need to consider. 04:48.990 --> 04:57.350 I think that there's a lot more that we need to consider before the voter is actually able to go to the polling place and put in their ballot. 04:57.850 --> 05:02.070 And the way that I like to talk about this is through the voter hierarchy of needs. 05:02.070 --> 05:12.690 These are, much like Maslow's hierarchy, a set of different things that voters need before they're actually comfortable going out to vote. 05:14.110 --> 05:21.110 We can see the parallels with Maslow's hierarchy of needs with things like the physiological needs. 05:21.110 --> 05:23.030 Life and death, very important. 05:23.290 --> 05:29.910 Property, having a place to live, having a place to do your daily activities. 05:29.910 --> 05:32.530 Those things are automatically going to come before voting. 05:32.530 --> 05:37.050 If you are afraid for your life, you're probably not going to take the time to vote. 05:37.050 --> 05:42.090 For those who do, it's going to be much less than it would if they weren't afraid for their lives. 05:43.150 --> 05:54.350 And that also plays into the safety concept, but it can be extended to things like family health or job safety, financial security. 05:54.410 --> 06:01.270 People, when they don't feel financially secure, are they going to want to spend the extra money to get to the polling place? 06:01.630 --> 06:02.930 Some will not. 06:04.050 --> 06:07.110 And then also that belonging aspect. 06:07.110 --> 06:14.310 If you don't feel like you're a part of a country, a part of a culture, you're not going to want to contribute to it by giving back your vote. 06:15.910 --> 06:26.890 And then esteem, feeling like your vote matters, feeling like you matter in the grand scheme of things, feeling like it's worth it to vote because you think that you're making something a better place. 06:28.130 --> 06:42.370 And then, of course, being all that you can be and really being able to feel good about that as you move forward and also feel good about your voting and that contributing to your country being the best that it can be. 06:43.150 --> 06:52.670 So this is how I like to talk about the voter hierarchy of needs and all of the levels that we have to consider as different places that can be attacked. 06:52.950 --> 07:00.430 And that's why I question if election infrastructure is really just limited to the ways that you submit your ballots. 07:00.590 --> 07:15.100 And I think it's important to say that I'm not suggesting that election commissions need to control all of these levels, but they need to be considered as we look to secure our elections and protect our democracy. 07:16.910 --> 07:25.410 Because these systems that we've identified that we need to protect are also systems that can become a target. 07:26.210 --> 07:35.670 And you might think that this would be a small impact on an election, but take the United States, where 40% of eligible U.S. 07:35.670 --> 07:42.090 citizens do not vote at all, and any kind of voter suppression will have an impact on the election. 07:44.210 --> 07:55.050 So when we're thinking about election security and election infrastructure, we need to think about things that relate to voter suppression and faith in the government. 07:55.530 --> 08:02.590 There are ways to influence an election outside of attacking the actual polling places. 08:04.330 --> 08:13.170 So let's jump into the attacker perspective and talk about a more historical approach and modern day what we're seeing, as well as motivations and things like that. 08:13.890 --> 08:25.610 So on the motivation side, these nation-state attackers, they're looking to either gain power, a particular ideology, or maintain global recognition and support. 08:25.610 --> 08:31.410 And for any of you who were able to attend some of the Black Hat keynotes, we saw this as a common thread. 08:31.870 --> 08:47.190 These countries are looking to make sure that their particular belief system is spread across the world, that they maintain their status as a superpower, whatever the case may be, or that they get to the point of a superpower. 08:48.970 --> 09:02.370 And when I'm thinking about the different types of attacks, the different types of cyber attacks that we can see, I like to use a way of describing it that our CISO Sam Curry talks about, which is three different layers. 09:02.370 --> 09:05.850 The infrastructure layer, the information layer, and the ethos layer. 09:05.850 --> 09:19.230 The infrastructure layer, that's that physical objects like the electric grid, things like that, misinformation or disinformation. 09:19.230 --> 09:23.830 And the ethos layer, that's all about the core belief system of the country. 09:24.710 --> 09:35.690 So we're going to start with that belief system and delve into some historical examples, and then get to some modern day examples that incorporate a lot more of the cybersecurity aspect. 09:35.690 --> 09:49.170 The historical examples don't as much, however, they give us a really good baseline to understand that this is not a new problem, and that the way that we're seeing people do it digitally is just a new approach to that problem. 09:50.510 --> 09:54.870 So let's take the Italian elections of 1948. 09:55.610 --> 09:58.910 At the time, it was right after World War II, the U.S. 09:58.910 --> 10:01.970 government was intent on psychological warfare. 10:02.250 --> 10:10.730 They were obsessed with spreading democracy, and they were putting millions of dollars towards Christian, Democratic, and right-wing socialist parties. 10:10.830 --> 10:16.520 In effect, they were spreading a massive propaganda campaign against communist socialist coalitions. 10:17.010 --> 10:36.490 And the goal was to change the perception in that election specifically to a conversation about democracy versus totalitarianism, Christianity versus atheism, America versus the Soviet Union, and of course, abundance versus starvation, trying to draw that contrast. 10:36.490 --> 10:40.950 And they ended up successfully swaying the votes in the election. 10:41.270 --> 10:53.830 And so they repeated that process in places like Guatemala, in South Vietnam, in Afghanistan, and Indonesia, as well as many, many more. 10:54.150 --> 10:58.730 And this was without having the digital component at all, without having to do any hacking. 10:59.150 --> 11:04.170 But it was the start of something that we're seeing take shape even more now. 11:05.050 --> 11:06.910 Another example. 11:07.350 --> 11:19.110 Moscow founded the communist international group Comintern in 1919, and they urged the American Communist Party to pursue revolutionary regime change. 11:19.110 --> 11:31.250 This was very similar to democracy promotion, which was, again, later pursued by Washington, all with the purpose of spreading their point of view within America. 11:33.270 --> 11:37.850 And of course, the 1996 Chinese influence on the U.S. 11:37.850 --> 11:43.650 election, where a Chinese general sent $300,000 to influence a U.S. 11:43.650 --> 11:47.750 presidential election by funneling money to the Clinton campaign. 11:49.830 --> 11:57.630 So let's look at the cyber equivalent of these things that's happening right now, and has been happening for some time. 11:58.830 --> 12:01.270 A good example of this is social media attacks. 12:01.270 --> 12:17.270 So on the left, you can see this ad, which is meant to persuade voters to vote ahead by voting from home, and saying that you can text Hillary to a certain number to vote, which is obviously not true. 12:17.270 --> 12:29.290 But especially right now, it might be something that people would find really appealing, not having to worry about any mail-in voting, just having to text a name to a certain number. 12:29.290 --> 12:30.910 But of course, it doesn't work. 12:33.560 --> 12:51.640 So that's kind of a double-edged attack, because it's not just targeting that belief system, and that belief in your government, and their ability to actually protect you from these types of things, but it's also targeting that information layer, and making it so that your vote doesn't actually count, 12:51.640 --> 12:52.840 even though you think that it did. 12:52.860 --> 13:07.260 And then on the right-hand side, you can see an advertisement, also not from someone in the U.S., but aimed at highlighting divisions within the U.S., and also creating them, depending on the case. 13:09.320 --> 13:25.520 And an important part of this talk is recognizing that there are other organizations than the government that have a role in election security, even if they choose not to. 13:25.940 --> 13:39.820 And that through actions that certain social media organizations have taken, they have set up governments to spread this type of attack more easily. 13:39.960 --> 13:58.160 And that's not to say that these organizations should be controlled, or anything like that, but to some extent, they do have a responsibility as American citizens, as people in the United States, to consider this, and to consider the implications of these types of attacks, 13:58.160 --> 14:05.740 and to try to build a stronger foundation for democracy within their own organizations. 14:06.940 --> 14:10.780 So now let's look at the information plane. 14:11.620 --> 14:14.640 And remember, this is all of the communication. 14:14.640 --> 14:18.000 This is where we get into the real misinformation and disinformation. 14:18.160 --> 14:26.600 And I want to start with a really baffling example that highlights that, you know, this is not a new thing. 14:26.980 --> 14:36.840 And as much as we are recognizing disinformation and misinformation right now in American culture, America was really founded on this. 14:36.980 --> 14:42.800 It was founded on the premise of a conspiracy theory where the British were trying to enslave us. 14:42.800 --> 14:52.380 Sam Adams argued that Britain's taxations before the Revolutionary War were part of an elaborate conspiracy to eventually enslave American colonists. 14:52.480 --> 15:03.760 He actually spread that and other early disinformation through pamphlets and speeches that he would hand out that contained information that he knew was not true. 15:04.140 --> 15:16.960 And he used the Boston Massacre as a tool in order to continue to spread that disinformation and to continue to cause chaos within America leading to the American Revolution. 15:18.240 --> 15:30.120 So we have this foundation in the U.S., for those of you who are from the U.S., of disinformation and of misinformation from our very earliest days. 15:32.120 --> 15:39.180 And then, of course, you can consider things like the CIA and the infamous propaganda asset inventory. 15:39.180 --> 15:57.800 During the Cold War era in the 1950s and 60s, the CIA had a huge number of radio stations and newspapers and magazines across the globe that they were using to push the United States agenda. 15:57.800 --> 16:14.580 In one very interesting instance, they had control of a program called Radio Free Asia, but they realized that the average Taiwanese person, individual, would not actually have a radio. 16:14.580 --> 16:20.470 So they strapped small radios to balloons and sent them flying to try and get them to Taiwan. 16:21.040 --> 16:27.040 Needless to say, the wind took them in the wrong direction, but the idea was very interesting nonetheless. 16:28.620 --> 16:41.980 In another interesting little tidbit, they had control of a magazine, but the magazine became so popular that it was actually also began being distributed to the United States. 16:41.980 --> 16:47.280 And so they had to be very careful to only put the propaganda in the ones that were not going to the U.S. 16:51.260 --> 17:00.680 Similarly, in the 50s, 60s, and 70s, left-wing newspapers in Europe were pretty much all financed directly from Moscow, pushing Moscow's agenda. 17:01.880 --> 17:03.520 And then the U.S. 17:03.520 --> 17:19.500 radio, also in Moscow, which would play rock music like Elton John and the Beatles that they couldn't get anywhere else, but it was always followed by short segments of what they called editorial content, which Soviet authorities considered disinformation, 17:19.500 --> 17:22.680 which was giving that American perspective. 17:24.560 --> 17:31.140 One that's more focused on the cyber realm is the 2014 Ukraine elections. 17:31.220 --> 17:39.200 On May 21st of 2014, attackers compromised the CEC network and actually disabled the vote counting. 17:39.440 --> 17:48.860 Now, this would automatically attack that ethos layer, and you start to lose faith in your government to actually be able to accurately count your votes and the validity of the election. 17:49.240 --> 17:53.260 But then they managed to get it back up after, I think, like 12 hours. 17:53.340 --> 17:57.020 And four days later was the actual election day. 17:57.740 --> 18:06.680 At the time, the same CEC website was under constant DDoS attack. 18:06.920 --> 18:16.380 And 12 minutes before the polls closed, attackers actually posted a picture of a former leader to the right sector on the CEC website claiming he won the election. 18:16.380 --> 18:21.980 What's really interesting about this is it was immediately shared by Russian media. 18:22.800 --> 18:25.100 Almost as if it was coordinated. 18:26.020 --> 18:26.880 Almost. 18:28.740 --> 18:32.400 And let's also look at the communication plane. 18:32.540 --> 18:41.240 This is very interesting, and it really makes it so that people are confused about what to do, where to go. 18:41.240 --> 18:43.140 It's a direct line to the voters. 18:44.140 --> 18:45.900 And here are two examples of that. 18:45.900 --> 18:56.020 On the left, you have an example of a text that is supposedly from President Trump shaming someone into voting, saying your ballot hasn't been submitted, what are you still doing? 18:56.360 --> 18:59.960 In reality, this is not from the campaign, this is not from Trump. 19:00.400 --> 19:03.600 And they would not be able to track this type of information. 19:03.880 --> 19:07.280 But they even got an interesting URL, vote.gop. 19:07.720 --> 19:20.780 And then on the right-hand side, you can see an example that's supposed to be a very helpful message from the government telling you your polling location and what the hours are and where to go. 19:20.780 --> 19:23.700 In reality, that's not a real polling location. 19:23.700 --> 19:36.800 That's someone sending a message that purports to be from the government as a helpful reminder to go vote, when in reality, there's nothing there and the voter will go, get there, and not be able to vote. 19:36.800 --> 19:45.640 And at that point, you're either one, late for work if you go into work, or two, you're frustrated and less likely to vote. 19:48.750 --> 19:50.810 Now let's look at the infrastructure plane. 19:51.590 --> 20:08.390 And this one is really interesting because it's that physical layer, which I think that a lot of times, especially more broadly, we don't think about or more broadly, I mean, the world instead of just the cybersecurity community doesn't think of cyber attacks in this infrastructure plane as much. 20:08.650 --> 20:17.610 And we're going to go back to those historical examples that don't incorporate a cybersecurity component, but lay the groundwork for where this can go in the future. 20:17.970 --> 20:21.650 Starting with the assassination of Lumumba. 20:22.770 --> 20:28.730 In 1960, the Democratic Republic of Congo gained its independence. 20:28.770 --> 20:32.610 And Lumumba was the prime minister of the DRC. 20:32.610 --> 20:35.470 He was also elected that year. 20:35.470 --> 20:40.210 And then he was subsequently assassinated one year later in 1961. 20:40.610 --> 20:47.090 Now, this was immediately politically fracturing for this very, very new independent nation. 20:47.210 --> 20:52.690 And it turns out that the groups behind it were American and Belgian. 20:52.690 --> 20:56.710 And they were actually from the US government and the Belgian government. 20:56.710 --> 21:00.990 And they had worked together to plan this assassination. 21:00.990 --> 21:07.750 And this is the type of thing that can really be destructive to such a new nation. 21:07.750 --> 21:20.210 It would be the equivalent in the US is George Washington being assassinated a year after American independence, which would have, who would have, who knows what would have happened in that instance. 21:22.250 --> 21:30.790 And then there's also the 1965 Indonesian elections and subsequent massacre. 21:31.010 --> 21:39.670 The Communist Party finished fourth in an Indonesian elections, and they were offered a proportional representation in the government. 21:40.510 --> 21:45.690 Now, this was not aligned to US interests, needless to say. 21:45.690 --> 22:01.930 And for fear of how this would impact US interests in the region, the US secretly supported the purge of suspected communists, causing thousands to millions, they're not entirely sure how many, to die over the course of months. 22:01.930 --> 22:05.790 And the military took over as the most powerful institution. 22:06.030 --> 22:17.450 So this is not only direct impact, because they have supported and pushed for the death and the massacre of these many, many people. 22:17.450 --> 22:30.530 But it's also something that I deeply believe would terrify the public, who is going to be voting and speaking about their beliefs freely after this type of thing happens in their country. 22:34.420 --> 22:41.620 And now this one isn't an example of election day, but it's a good representation, again, and it does involve that cyber component. 22:41.620 --> 22:50.480 So the Bronze Night in Estonia in 2007, this was really a combination of an infrastructure attack and an information attack. 22:51.080 --> 23:03.380 In 2007, Estonians made the decision to move a Red Army soldier statue to a Soviet cemetery, because needless to say, they did not want a Red Army soldier in the middle of their country. 23:04.180 --> 23:07.180 Not exactly a fan favorite there. 23:07.680 --> 23:20.180 So the night that it was being moved, fake news started to spread with Russian news reports claiming that the statue and the Soviet war graves were being destroyed. 23:20.460 --> 23:23.880 And this resulted in two nights straight of riots and looting. 23:24.360 --> 23:29.200 156 people were injured, one person was left dead, and a thousand were detained. 23:29.520 --> 23:46.740 But at the exact same time, there were a ton of denial of service attacks going on inside Estonia across banks, media outlets, governments, cash machines, things like online banking was out of service, government employees couldn't communicate over email, 23:46.740 --> 23:50.140 and newspapers and broadcasters couldn't deliver the news. 23:50.140 --> 23:57.180 So all they were left with was the Russian news reports that were spreading this fake news. 24:00.800 --> 24:14.280 And this quote, I really like this quote, because it talks a little bit about this with, in all of these historical examples, these campaigns were done covertly. 24:14.280 --> 24:22.660 And cyber aggression really gives us the ability to have these type of campaigns very covertly. 24:22.680 --> 24:37.660 And it leaves us really vulnerable to these types of attacks, and to really sowing chaos internally in the country, with people believing conspiracy theories about the situation, with people not knowing what's true and what isn't. 24:37.660 --> 24:48.080 And that's why I think it's so scary, the potential, not just on the misinformation and disinformation side, but also on that belief system layer, and even that infrastructure layer. 24:50.900 --> 25:04.640 So some examples of things that we talked about during these tabletop exercises that I think could have a huge impact on election day come to things like the electric grid. 25:05.060 --> 25:11.740 So in 2003, a four-day power outage left at least 100 people in the United States and Canada dead. 25:12.460 --> 25:20.080 Now imagine there's a power outage on election day, and you have yet to leave your house. 25:20.080 --> 25:21.780 Are you going to be worried about voting? 25:21.780 --> 25:27.220 Or are you going to be worried about making sure that whatever's in your fridge doesn't go bad? 25:27.820 --> 25:30.240 Are you going to be worried about your family? 25:30.360 --> 25:38.320 Maybe you know someone who needs the type of care that requires electricity to be available? 25:38.700 --> 25:51.080 There are a lot of factors here that will immediately, just like with those voter hierarchy of needs, that will immediately come before you're actually willing to vote when something sporadic happens, like losing power. 25:52.400 --> 25:55.380 And we're also going to talk about transit. 25:55.640 --> 26:03.500 So in 2016, San Francisco's transit system was infected with ransomware. 26:03.820 --> 26:08.460 Now imagine a scenario, a lot of people go to vote after work. 26:08.720 --> 26:15.920 So you go to work, you spend your day on Twitter, probably seeing some disinformation. 26:16.560 --> 26:25.280 You get to the end of the day, you've taken the train into work, and you go to take the train to the polling station and then back home, and it's down. 26:25.400 --> 26:27.180 And you can't access it. 26:27.420 --> 26:29.260 Are you going to be thinking about voting now? 26:29.260 --> 26:35.120 Or are you going to be thinking about how you're going to get home and potentially being a little annoyed that the train is down? 26:38.180 --> 26:46.180 So we can see that these attacks go across layers, but also across all the layers of the pyramid. 26:46.200 --> 26:48.300 And they're just a few examples. 26:48.300 --> 26:52.260 There are way more that we can look at through our own tabletop exercises. 26:54.180 --> 26:59.640 So let's jump back into the defender perspective before we really get to that brainstorming part. 27:00.460 --> 27:02.280 Where does this leave us? 27:02.800 --> 27:12.680 We have this small view of election security, just with voter registration, just with databases, IT infrastructure, things like that. 27:13.980 --> 27:20.460 And we end up with quotes like these from leaders in different countries. 27:20.460 --> 27:23.440 We cannot exclude such activities in Germany either. 27:23.440 --> 27:28.200 In the election campaign, we'll also have to confront distortions and fake stories. 27:28.200 --> 27:36.780 Now, it's great that they're being honest about it, but where does this leave a citizen when knowing what's fake, what's real? 27:36.980 --> 27:39.560 When knowing how to actually combat this? 27:40.480 --> 27:56.140 Similarly, we have representatives saying that people are trying to steal another election, that it's all rigged, that it's a scam, pushing this same narrative that these countries want other countries to believe in. 27:57.520 --> 28:06.380 And then, of course, just from a couple of weeks ago, congressional Democrats talking about how they were gravely concerned about foreign interference in an election. 28:06.900 --> 28:10.420 Now, I think the recognition, again, the recognition is good. 28:10.600 --> 28:17.420 It's just a matter of giving us the tools to combat what they're seeing that we're missing here. 28:17.420 --> 28:19.340 We're missing the leadership part. 28:21.040 --> 28:37.340 So where should we really be going in order to create a different reality for ourselves, where we have a more well-rounded view of election security, where we understand the problem and where we, not just the government, but also the citizens and the private sector, 28:37.340 --> 28:39.900 can affect change? 28:41.120 --> 28:54.000 And this is what it should look like, where we have all of those different aspects that are front and center, and that we're thinking about, and that we're making clear these are the things that are going to be under attack. 28:54.000 --> 28:55.720 These are the things that you need to look out for. 28:55.720 --> 29:04.820 Having that communication, because in reality, as I've mentioned before, a lot of these channels are not government-owned entities. 29:04.820 --> 29:12.800 A lot of them are privately held, which means that election security cannot just be the government's problem. 29:12.940 --> 29:15.700 It has to be something considered by the private sector. 29:15.700 --> 29:22.720 It has to be something that we work together as a community, as a society, to help stop. 29:25.600 --> 29:34.340 So I want you guys... the goal of this was, if we were in person, to do a small tabletop exercise together. 29:34.340 --> 29:43.940 But since we can't really do that, I want you guys to imagine how this scenario would go, what you would do from either perspective. 29:44.280 --> 29:48.400 And just start by thinking about, do you vote before work? 29:48.400 --> 29:49.960 Do you mail in your ballot? 29:49.960 --> 29:55.820 How do modern events, like the pandemic that we're going through right now, change all of that? 29:55.820 --> 29:56.840 Are you on Twitter? 29:56.840 --> 29:58.220 Do you fact check? 29:58.400 --> 30:04.160 I typically do, or would, vote before work, if we were still going into the office. 30:04.160 --> 30:06.220 I am doing a mail -in ballot. 30:06.220 --> 30:14.540 I think that mail-in ballots are critical right now, given the current situation, and because it really takes away those time-based attacks that we're seeing. 30:15.620 --> 30:30.000 If the day of the election you lose power, but you already voted three weeks ago, then you're not actually going to be part of the voter suppression problem, and it's already taken care of. 30:30.000 --> 30:32.320 And that's a huge positive, that's a huge benefit. 30:32.320 --> 30:41.260 Not to say that mail-in voting doesn't have its own issues, but that's at least a start to removing some of those time-based barriers. 30:42.460 --> 30:44.440 How do modern events change this? 30:44.440 --> 30:46.820 Are you considering things like mail-in voting? 30:46.820 --> 30:47.800 Are you on Twitter? 30:47.800 --> 30:49.220 I know a lot of us are. 30:49.220 --> 30:55.080 InfoSec Twitter is great and terrible, but it raises the question of, do you fact check? 30:55.080 --> 30:56.840 Are you checking the things that you see? 30:56.840 --> 31:00.080 Are you sharing articles without actually reading them? 31:00.080 --> 31:04.980 These are important, and they tend to get lost in the even though people talk about them. 31:06.380 --> 31:13.960 And then take a look at how would you attack your life of a voter , your typical day? 31:13.960 --> 31:20.820 What would you do that would make you stop and think, I'm going to take care of this problem and I'm not going to go vote today? 31:22.340 --> 31:23.840 That's what's critical. 31:24.180 --> 31:36.480 And some of the things that we saw in these tabletop exercises to affect an election were things like attackers creating deepfakes of certain candidates. 31:36.840 --> 31:46.500 And the thing is, if you release a deepfake of a candidate on the day of the election on that morning, there really isn't enough time for the candidate to react. 31:46.500 --> 31:50.140 And maybe they'll issue a statement, but the damage will have been done. 31:50.280 --> 31:55.040 And it's not something you can fix over the course of eight hours. 31:56.000 --> 32:00.600 So these are the types of questions like, how does that time-based element affect things? 32:00.600 --> 32:08.460 If you took out the electric grid exclusively in regions that are known to be very conservative, how would that look to people? 32:08.580 --> 32:10.400 What would they take away from that? 32:10.400 --> 32:17.140 Would they take away that it was just a random power outage or would they suspect that there was foul play from the other side? 32:20.000 --> 32:26.160 And then take those ideas and think about what you can do for your country instead. 32:26.180 --> 32:32.800 Because at the end of the day, as we know with red teaming, all of this is working towards stronger security. 32:32.800 --> 32:41.120 And that's what's important, is that we come out of this considering how to make security stronger, how to make election security stronger, the whole thing. 32:41.120 --> 32:42.960 So how do you defend? 32:42.960 --> 32:45.140 Are you involved in any of these sectors? 32:45.140 --> 32:47.620 Are you in the transit sector or communication sector? 32:47.620 --> 32:49.540 Do you work at a social media company? 32:49.660 --> 32:52.260 How can you affect change within these organizations? 32:52.260 --> 32:59.400 Because at the end of the day, we all have to do our part in order to protect our system. 33:02.180 --> 33:08.680 So this kind of left me with a lot of questions because it feels like an insurmountable problem. 33:08.680 --> 33:10.620 It's this huge, huge problem. 33:10.820 --> 33:28.280 But at the end of the day, what I think is the most important and what we can take away from this is the first thing is to, whether you work at a private company or a government entity, work to improve your security, your personal security, your enterprise security, 33:28.280 --> 33:30.700 whatever the case may be, we need it. 33:30.700 --> 33:35.980 Because all of these different elements can be used in a way that they're not supposed to be used. 33:35.980 --> 33:46.960 And you just don't know what creative method an attacker is going to use in order to affect the belief system of the country. 33:47.180 --> 33:51.680 So really focus on, of course, having good security measures. 33:51.680 --> 33:54.740 The second is to work with the government. 33:55.640 --> 33:58.000 I know, like, build partnerships with the government. 33:58.000 --> 33:59.260 I'm a part of InfraGard. 33:59.260 --> 34:04.060 It's the government group for infrastructure security. 34:04.060 --> 34:05.120 I think that that's great. 34:05.120 --> 34:10.300 It's a great way to share and give back, not just to the community, but also to the government. 34:10.960 --> 34:21.500 So I highly recommend just finding different avenues and different partnerships that you can have to make security stronger in the government space, even if you don't work there directly. 34:22.060 --> 34:23.920 And also to spread awareness. 34:24.360 --> 34:27.440 And then the last one is to work to fight misinformation. 34:27.920 --> 34:32.320 Because I think that's a continuous struggle that we all have to consider. 34:32.320 --> 34:36.320 And the more that we work at it, the better off we will be inevitably. 34:36.680 --> 34:41.740 I mean, it's a lot of work, but that's how it is. 34:42.860 --> 34:45.300 I also wrote a white paper on this. 34:45.520 --> 34:47.060 Feel free to download. 34:47.060 --> 34:50.120 You don't need to put it in email or anything like that. 34:50.120 --> 34:52.540 It's totally free if you go to this link. 34:52.600 --> 34:55.380 And it elaborates on a lot of what I've talked about here. 34:55.880 --> 34:57.620 So feel free to download that. 34:57.620 --> 34:59.740 And also message me if you have any questions. 34:59.740 --> 35:00.920 I'm happy to help. 35:02.820 --> 35:04.420 Thank you so much for attending. 35:04.420 --> 35:07.840 I hope you guys have a great rest of DEF CON Red Team Village. 35:07.960 --> 35:10.120 And if you have any questions, feel free to reach out. 35:10.120 --> 35:13.660 I will respond to all the comments in Discord. 35:13.720 --> 35:15.360 And feel free to ask me any questions. 35:15.360 --> 35:17.480 HackerBella on Discord. 35:17.560 --> 35:19.300 So thank you so much. 35:19.420 --> 35:20.080 Awesome. 35:20.080 --> 35:20.440 Thank you. 35:20.440 --> 35:21.520 Amazing presentation. 35:21.520 --> 35:25.680 Thank you so much for supporting us, supporting DEF CON Red Team Village. 35:25.760 --> 35:33.200 And again, as we said before, please look at all the talks and activities that are happening right now in the bottom of the screen. 35:33.340 --> 35:35.760 You should have a link to our website. 35:36.000 --> 35:39.320 We're streaming on Twitch and YouTube and so on. 35:39.320 --> 35:43.920 And please, as Ali mentioned, please join the conversation on Discord. 35:43.920 --> 35:47.960 We're going to take a small break and the next presenter will be here in about a minute.