1
00:00:05,000 --> 00:00:09,860
Hi, welcome to Election Security Part Two, The Infrastructure Strikes Back.

2
00:00:09,860 --> 00:00:10,880
My name is Amelie Coran.

3
00:00:10,880 --> 00:00:14,660
I will be your panel moderator for this session here.

4
00:00:14,800 --> 00:00:25,600
Little did we suspect that this set of panelists would be back together six months later to discuss where we are versus where we were when it came to election security in the upcoming November general election.

5
00:00:25,640 --> 00:00:32,680
Since then, to say it lightly, things have gone off the rails, given that you now see us via video in our pandemic past.

6
00:00:32,720 --> 00:00:44,060
We've had a highly contentious Democratic primary season, some technical glitches supporting such primaries, court cases regarding in-person voting, and enough various disinformation campaigns to last another election.

7
00:00:44,080 --> 00:00:48,060
One thing that hasn't changed is the lineup of our esteemed panel from ShmoopCon.

8
00:00:48,480 --> 00:00:54,000
And tonight we have Kimber Dowsett, Casey John Ellis, Jack Cable, and Todd Beardsley.

9
00:00:54,000 --> 00:00:57,440
I will then let them introduce themselves with a short intro.

10
00:00:58,480 --> 00:00:59,560
I am Kimber.

11
00:00:59,560 --> 00:01:03,060
I am the director of security engineering at Trust.

12
00:01:03,060 --> 00:01:12,180
That's Trust.Works, a software infrastructure company based out of San Francisco that works with both the public and private sectors.

13
00:01:12,180 --> 00:01:14,140
Hi, my name is Casey Ellis.

14
00:01:14,140 --> 00:01:16,760
I'm the founder, chairman, and CTO of BugCrowd.

15
00:01:16,760 --> 00:01:25,640
We run crowdsource security as a service programs, including vuln disclosure, bug bounties, crowdsource pentest, and so on.

16
00:01:25,640 --> 00:01:32,820
And yeah, great to be... unusual to be talking about this with all the additional content, but very good to be talking about it again.

17
00:01:32,900 --> 00:01:35,420
Everyone, my name is Jack Cable.

18
00:01:35,420 --> 00:01:39,040
I am an election security technical advisor for the U.S.

19
00:01:39,080 --> 00:01:45,380
Cybersecurity and Infrastructure Security Agency, which is essentially the nation's risk advisors.

20
00:01:45,380 --> 00:01:57,940
We advise states and localities on the risks associated with different technologies, provide cybersecurity assessment services, so that they can make the best decisions to have a safe and secure election.

21
00:01:58,440 --> 00:02:04,420
Besides my work at CISA, I am a student at Stanford and a security researcher.

22
00:02:04,500 --> 00:02:04,740
Cool.

23
00:02:04,740 --> 00:02:06,180
And hi, I'm Todd Beardsley.

24
00:02:06,180 --> 00:02:11,000
I'm a director of research at Rapid7, a U.S.-based cybersecurity company.

25
00:02:11,260 --> 00:02:14,280
I personally care a lot about elections.

26
00:02:14,280 --> 00:02:26,440
I am usually an election judge in Texas, and I have a deep background in hacking, offensive security, research, vulnerability analysis, stuff like that.

27
00:02:26,740 --> 00:02:31,800
And congrats to Jack for the level up since our last meeting.

28
00:02:32,500 --> 00:02:35,340
He gets a bunch of power-up points on that one.

29
00:02:35,340 --> 00:02:36,300
That's awesome.

30
00:02:36,540 --> 00:02:45,580
So we're going to break this down into two sections, I believe, unlike last time, but mainly kind of a catch-up, a first section here about what has happened since February.

31
00:02:47,380 --> 00:03:05,160
So obviously a section B, we're coming up on about 90 days until the general election, and what we can do between now and then, since the timeline is definitely shorter, but also what kind of activities are going to be carried forward from them to the next election,

32
00:03:05,160 --> 00:03:09,080
next primaries, or just in general, lessons kind of learned.

33
00:03:09,080 --> 00:03:12,380
So with that, we have ourselves a first question here.

34
00:03:12,540 --> 00:03:18,100
So we find ourselves here again after six months, and there's been a lot going on that we didn't cover back in February.

35
00:03:18,360 --> 00:03:24,260
However, regarding one of the last takeaways from closing that panel, we noted it was important to engage your local board of elections.

36
00:03:24,320 --> 00:03:27,220
And with that, where do we stand?

37
00:03:30,260 --> 00:03:30,980
Wow.

38
00:03:31,060 --> 00:03:33,820
Well, let me start this off.

39
00:03:34,280 --> 00:03:37,420
I engage with my local board of elections by being an election judge.

40
00:03:37,420 --> 00:03:44,140
I ran a polling place not too long ago about, we're recording this on end of July.

41
00:03:44,520 --> 00:03:55,080
So for me in this time stream, this is about three weeks ago, there was a special election and a runoff election combined here in Texas.

42
00:03:56,360 --> 00:03:58,420
It was pretty fun.

43
00:03:59,220 --> 00:04:05,740
I never knew that, like, wiping down voting, you know, polling places would be so rewarding.

44
00:04:05,740 --> 00:04:18,900
I got to feel like I was battling COVID, like, every five minutes, you know, helping people out, and so like, and for that, at least for me, like, I felt like I was really, I was doing something.

45
00:04:18,900 --> 00:04:29,980
I did notice through training and then on election day, you know, the demographics have switched over quite a bit on who is working in the polls.

46
00:04:29,980 --> 00:04:40,760
Like, it is very common normally to see a lot of retirees and just, you know, older people who are there to help out and help out their communities in this way.

47
00:04:41,200 --> 00:04:45,660
I was not the youngest person at this polling place, which was first for me.

48
00:04:46,460 --> 00:04:59,140
So if you have the opportunity and the inclination, and don't mind doing a whole lot of cleaning all day long, you know, maybe volunteer to work in a polling place come November .

49
00:04:59,220 --> 00:05:00,340
Anybody else?

50
00:05:00,460 --> 00:05:17,060
Yeah, I mean, what has happened since then, I think, you know, in terms of rocking up and helping out, it's fair to say that any intention to do that would have been a little distracted by, you know, March and so on.

51
00:05:17,060 --> 00:05:29,400
But I think, you know, Todd's example of just doing what's needed, especially with the pandemic and, you know, the changes in operational considerations around actually running an election, still true.

52
00:05:29,400 --> 00:05:31,620
It's even more true now, than it was.

53
00:05:32,400 --> 00:05:43,640
As the token non-citizen on the talk, I mean, this is even more foreign interference now than it was when we gave the talk, because I'm actually in Sydney at the moment.

54
00:05:44,760 --> 00:05:59,120
But, you know, part of what we've been working on, what I've been working on, and a bunch of other people have been working on is, you know, standardization of, like, how do we make adoption of vulnerability disclosure programs and the implementation of policy,

55
00:05:59,120 --> 00:06:07,000
specifically for 2020, with all of the, you know, unique considerations this year has, how do we make that as easy as possible for the states and counties?

56
00:06:07,700 --> 00:06:19,340
So we updated a version of the language on disclose.io, which is an open source initiative to basically make it easy and make it as standardized as possible.

57
00:06:19,400 --> 00:06:22,240
That came out after the talk, and it's been good.

58
00:06:22,240 --> 00:06:35,280
I think, you know, at the very least, that's actually served to get a lot more people thinking about doing that, that maybe weren't before, because that kind of blocking function of how do I even engage with the hacker community in the first place was,

59
00:06:35,280 --> 00:06:37,680
I think, pretty difficult for a lot of people to even consider.

60
00:06:37,680 --> 00:06:51,180
Early to echo, yeah, Casey's point there, I think, yeah, something I've been involved with and pushing for is states and vendors to establish these vulnerability disclosure policies.

61
00:06:51,180 --> 00:07:04,360
On the CISA side, we are releasing guidance to election officials in order to establish vulnerability disclosure policies, essentially saying, if you want to do this, this is the best practices that you can follow.

62
00:07:04,440 --> 00:07:16,260
A lot of that is drawn from CISA's directive, the Binding Operational Directive 2001, which is a draft directive that will require all federal agencies to start a vulnerability disclosure policy.

63
00:07:16,260 --> 00:07:18,220
Yeah, that was a good deal, by the way.

64
00:07:18,740 --> 00:07:26,520
Yeah, I think, yeah, really looking forward to see that come out and see the positive security effects that can have all across the federal government.

65
00:07:26,520 --> 00:07:30,600
But of course, CISA doesn't have that same authority over states.

66
00:07:30,720 --> 00:07:39,980
So we're essentially putting out guidance, giving them the best practices and the resources they need to start this themselves if they want that.

67
00:07:40,060 --> 00:07:50,280
And then, of course, yeah, besides that, just phone work I've been doing, yeah, clearly I'm not at the local level, but the federal level.

68
00:07:50,280 --> 00:08:04,180
And I think that there's really a lot of ability there to kind of have an impact at scale of working with all 50 states, working with a significant portion of the localities of the counties that are out there.

69
00:08:04,240 --> 00:08:14,680
So I think that's a really great opportunity to be at CISA and have this kind of wide-ranging effort, wide-ranging effects that I'm not sure you can have anywhere else with election security.

70
00:08:14,680 --> 00:08:15,620
Kimber?

71
00:08:16,340 --> 00:08:17,780
Yeah, I'll jump in.

72
00:08:17,780 --> 00:08:21,440
It works out well since Jack touched on Casey's point.

73
00:08:21,440 --> 00:08:23,620
I'm going to touch on Todd's point.

74
00:08:23,760 --> 00:08:27,080
The prompt was, you know, what's happened since February?

75
00:08:27,340 --> 00:08:29,560
And the answer is a pandemic.

76
00:08:29,880 --> 00:08:48,880
So the reality of a lot of the election security things that we would normally talk about and that we will touch on today still rely on people being able to actually get to the polls to vote in states that aren't going to allow mail-in ballots.

77
00:08:49,320 --> 00:08:57,500
So I think it'll be a nice segue into a lot of the misinformation we're hearing about mail-in ballots.

78
00:08:57,500 --> 00:09:11,120
But to Todd's point, we can scream to the skies that mail-in ballots are perfectly safe and reasonable and actually help disenfranchise voters however voice.

79
00:09:11,480 --> 00:09:28,680
But there are going to be some places that insist that folks go to the polls and somebody's got to be there to man the polls or we're going to end up in a different type of disenfranchisement, right, where people are lined up for 20 hours because there's three poll workers,

80
00:09:28,680 --> 00:09:31,400
you know, for thousands of people who want to vote.

81
00:09:31,400 --> 00:09:42,200
So it's important to know what's going on in your voting district and if your voting district allows mail-in voting, great, cool.

82
00:09:42,200 --> 00:09:46,280
But if they don't, like, that's a perfect opportunity to get involved.

83
00:09:46,280 --> 00:09:52,800
And I understand that it's asking you to put yourself at risk, too, and that sucks, right?

84
00:09:52,800 --> 00:09:53,600
It is, yeah.

85
00:09:53,680 --> 00:09:54,600
That's where we're at.

86
00:09:54,600 --> 00:09:56,060
I am shocked.

87
00:09:56,060 --> 00:10:03,620
I had a COVID test about four days after election day and I am shocked I did not come up positive.

88
00:10:03,620 --> 00:10:08,700
But hey, you know, turns out masks and hand cleaning and surface cleaning works, though.

89
00:10:09,160 --> 00:10:27,500
Yeah, you know, kind of the follow-up on this, too, is, I mean, obviously, the curveball that we're thrown was the pandemic and, you know, as Todd mentioned that, you know, primarily a lot of the election workers, you know, that were counted on by various precincts and states in general were retirees and those who,

90
00:10:27,500 --> 00:10:30,340
you know, I hate to say it, have more time on their hands.

91
00:10:31,020 --> 00:10:40,100
You know, this is obviously going to be proving a challenge for staffing and it runs headlong into the issues, you know, obviously some of the disinformation that's been spread about mail-in voting.

92
00:10:40,360 --> 00:10:46,660
You know, are there any particular ways that we can kind of mitigate or address any of these issues that are novel?

93
00:10:46,740 --> 00:10:56,480
Obviously, we're running, you know, headlong against, you know, people pushing back on the mail-ins, but then we have the reality of, you know, folks potentially exposing them to a deadly virus.

94
00:10:56,800 --> 00:11:11,100
I hate to run the gambit of talking about, like, e-voting, but obviously there are other ways to, you know, look at, you know, potentially extending voting times, alternating places where people can vote to reduce exposure.

95
00:11:11,100 --> 00:11:17,720
Are there any other, you know, methods that, you know, potentially the EAC and others can address in this case?

96
00:11:18,340 --> 00:11:19,560
In before blockchain?

97
00:11:21,000 --> 00:11:22,160
Yeah, I wasn't there.

98
00:11:22,160 --> 00:11:23,480
You have to drink now.

99
00:11:23,780 --> 00:11:27,700
So, I mean, e-voting is a non-starter, right?

100
00:11:27,700 --> 00:11:35,940
Like, we're recording this and it is today, 97 days, by the time this airs, it'll be about 90 days before the election.

101
00:11:36,780 --> 00:11:45,320
And, you know, West Virginia is doing their thing and good for them, but no one else is.

102
00:11:45,320 --> 00:11:48,080
I don't see anybody having any plans for that right now.

103
00:11:48,660 --> 00:12:03,120
Maybe someday in the future, you know, e-voting will be a thing, but I don't, I don't, I think the easiest way to get people to the polls in states that don't have mail-in ballots is extending, you know, early voting.

104
00:12:03,120 --> 00:12:04,200
I mean, that's a thing.

105
00:12:04,200 --> 00:12:07,800
Texas, I'm in Texas right now, so great, Texas.

106
00:12:08,240 --> 00:12:12,580
We're bad at mail-in ballots, but we're apparently really good at early voting.

107
00:12:12,580 --> 00:12:20,560
My voting, my first day to vote in November will be October 13th, so that's a stupendous amount of time, way longer.

108
00:12:20,560 --> 00:12:27,060
And so that'll be, that will help at least give people an opportunity to get into a polling place where maybe it's not so crowded.

109
00:12:27,300 --> 00:12:30,800
Last day of early voting is super crowded and election day will be super crowded.

110
00:12:30,800 --> 00:12:37,560
So, you know, if you can vote in that early voting period, I strongly suggest you do.

111
00:12:37,620 --> 00:12:40,980
That, you know, it doesn't help any of the I.T.

112
00:12:40,980 --> 00:12:49,020
problems that we talk about and that nominally this panel is supposed to be about, but it does help the, like, not getting COVID.

113
00:12:49,180 --> 00:12:51,860
So, which, you know, might be a little more important.

114
00:12:52,500 --> 00:12:53,140
Amber?

115
00:12:53,140 --> 00:13:05,840
I want to, plus one to the adding more polling places because we know social distancing is huge to prevent the spread of COVID.

116
00:13:06,260 --> 00:13:19,680
When we have communities like mine where there's one polling place downtown and then one local school, then we have basically the town split in half to go to these two polling places and it gets kind of crazy.

117
00:13:21,620 --> 00:13:25,920
Holding people to districts, we see some gerrymandering, right?

118
00:13:25,920 --> 00:13:35,580
They'll draw a line right through the middle of the university so that half the university students think that they're supposed to vote at one place and it's really the other.

119
00:13:35,640 --> 00:13:52,580
So, you know, if they're going to say no mail-in ballots, then why not say, but all the schools in a single district can vote and if you're eligible to vote in one, you can vote in any of them so that folks can at least get to the closest, you know, place.

120
00:13:52,580 --> 00:14:00,980
And we do our best to, like, disperse the population, but a lot of towns have a couple polling places.

121
00:14:00,980 --> 00:14:14,720
They're almost always schools, which who knows if schools will even be open, but if they are, you sure don't want to have a hundred thousand people rolling through a school that children are going to be at the next day, right?

122
00:14:14,720 --> 00:14:27,940
Like, so there's physical considerations that certainly were not part of our equation in what, February 1st, when we jammed through all the things we think could go wrong.

123
00:14:27,940 --> 00:14:29,900
This was not on my bingo card.

124
00:14:29,900 --> 00:14:32,380
No, no, no.

125
00:14:32,380 --> 00:14:47,080
So the thing that's, to me, that's new is, and I've actually, I've heard Todd say this in a panel on this before, you know, democracy does rely on the peaceful concession of whoever loses.

126
00:14:47,440 --> 00:15:07,740
So the increased likelihood of a hanging count because of mail-in voting and the changes in the process and different things like that, I think there was a lot of conversation back in January and prior around the role of risk-limiting audits to basically,

127
00:15:07,740 --> 00:15:15,600
you know, say, no, this is not like any accusation of fraud can be basically confirmed or denied at that point.

128
00:15:16,640 --> 00:15:19,920
Projects, you know, to give a shout out to is Arlo.

129
00:15:21,560 --> 00:15:28,620
ARLO, which is essentially a framework for that, that I believe is funded by CISA and is open source.

130
00:15:28,680 --> 00:15:46,920
And something that I've been trying to encourage people in the security research community to do is to go bang on that, actually go look at it from a security standpoint, because ideally if there's any point in time over the next six months where Arlo itself gets called into question as a tool to rebuff,

131
00:15:46,920 --> 00:15:51,360
at least at that point we can say, no, we actually went through this and it seems legit.

132
00:15:51,620 --> 00:15:57,180
So that to me is new, like that was always going to be some, to some degree of risk, as it always is.

133
00:15:57,180 --> 00:16:05,320
But I think that's actually a far, that's going to play a far greater role actually post-election, on election day and post-election day in 2020.

134
00:16:05,760 --> 00:16:15,940
Yeah, I think they covered a little bit of that on the HBO special of Hari, as well as, you know, I think it was the second half of the documentary was regarding the risk-limiting audits.

135
00:16:15,940 --> 00:16:19,540
I don't know if they necessarily had a really good explanation of how it all works.

136
00:16:20,060 --> 00:16:25,780
That is a little extra math for most folks, but, you know, it's one of those good things that can be put in.

137
00:16:25,780 --> 00:16:37,960
I think, and looking at, looking at, so, you know, calling myself out as this was a theme, and the last time we got together as well, acronym, de-acronyming stuff.

138
00:16:37,960 --> 00:16:41,060
So risk-limiting audit is what RLA stands for.

139
00:16:41,120 --> 00:17:01,740
I think it's verified voting, who are running point on it, and they've done some pretty, I think, good work on explainer videos that take some, you know, fairly complicated math and kind of simplify the concept to the point where a non-technical potential voter can actually consume it and understand what's going on.

140
00:17:01,740 --> 00:17:15,480
It's essentially, you know, a cryptographically determined sample, random sample set that's then paired with verification of the outcome compared to what's recorded.

141
00:17:15,560 --> 00:17:23,320
And if there's any sort of deviational margin of error within that sample set, then it goes again and goes again and goes again until it can work out the scope of that.

142
00:17:24,040 --> 00:17:29,000
Or, you know, if everything checks out, then everything checks out and things are okay at that point.

143
00:17:29,000 --> 00:17:40,220
It's the randomization and the process around it that I think is, to your point, difficult to explain on a technical level to most people, but I think the concept itself is actually fairly easy to grow.

144
00:17:41,700 --> 00:17:42,400
Great.

145
00:17:42,400 --> 00:17:54,180
And just to kind of go back a little to our discussion on the different kinds of voting options that there are, it's clear that the election is going to be run a little differently this year.

146
00:17:54,180 --> 00:18:02,360
Just with the constraints we face, election officials have to provide an accessible and safe method of voting for their voters.

147
00:18:02,360 --> 00:18:09,760
And what this means is essentially from CISA's perspective, we want to limit the risk as much as possible with these options.

148
00:18:09,760 --> 00:18:16,780
So, for instance, talking about online voting, also called electronic ballot returns, CISA has assessed that that is high risk.

149
00:18:16,780 --> 00:18:20,980
Even with controls in place, the risk there still cannot be controlled.

150
00:18:21,060 --> 00:18:33,140
And it's not CISA's job to decide whether these are deployed, but it's our belief that the risk on these is much higher than, say, compared to in-person voting or mail-in ballots.

151
00:18:33,140 --> 00:18:52,300
So on that end, CISA has put out a series of documents essentially describing, from a procedural sense, what kinds of options election officials have, both to ensure safe in-person voting and then also to make sure that mail-in balloting process goes smoothly.

152
00:18:52,440 --> 00:19:07,520
And just to touch on some of the in-person voting options there, it is very true, like Todd was saying, that the truth is a lot of these poll workers are older and they face a higher risk of being impacted by the virus.

153
00:19:07,520 --> 00:19:10,960
So there's going to be very high poll worker shortages.

154
00:19:11,040 --> 00:19:16,860
And in a lot of cases, that means consolidation of polling places because they can't staff that many.

155
00:19:16,860 --> 00:19:22,680
And that, of course, can lead to problems because then you have more people in fewer places.

156
00:19:22,740 --> 00:19:25,420
With a pandemic, that's, of course, not ideal.

157
00:19:25,720 --> 00:19:27,580
But we have to make it work.

158
00:19:27,580 --> 00:19:37,020
So one option there is vote centers, for instance, where larger physical polling places that make it easier to maintain physical distance.

159
00:19:37,140 --> 00:19:40,140
There's, of course, still a polling shortage.

160
00:19:40,780 --> 00:19:51,000
I guess here I'll say to everyone who is young and healthy, the best thing you can do is serve as a poll worker and make sure that on a local level your elections run smoothly.

161
00:19:51,200 --> 00:20:01,080
But yes, it is going to be a challenge just because, yeah, of course, in-person voting carries some risks with it from a health perspective.

162
00:20:01,480 --> 00:20:06,960
So we encourage states to make the decisions that best fit them.

163
00:20:06,960 --> 00:20:17,820
But both mail invalidating and in-person voting we view as being low-risk options given that there's a paper trail and you can run, say, risk-only audits on those.

164
00:20:17,880 --> 00:20:20,440
Well, so I'm going to take kind of a little bit of a left turn.

165
00:20:20,440 --> 00:20:29,120
I know, you know, we just full transparency for folks who are watching this, like we have a list of questions that we've agreed on, but I'm going to kind of combine this because of the way the flow is.

166
00:20:29,900 --> 00:20:38,020
You know, one of the things that's amazing about, like, where we live, we're in the United States here, and Casey accepted, but yeah, we will adopt you on this one.

167
00:20:38,020 --> 00:20:38,680
Most of the time.

168
00:20:38,920 --> 00:20:44,900
You know, is the freedom of speech, you know, it's part of the our own constitution and whatnot.

169
00:20:44,900 --> 00:21:01,760
But, you know, as we mentioned in February, you know, one of the critical things about this election is how we talk about it, whether it be through discourse about outcomes, whether it be the primaries or the general election, the methodologies we use to do that.

170
00:21:01,760 --> 00:21:08,180
So we, you know, talk about the press about, like, how things have gone, the process of, you know, how we go about voting.

171
00:21:08,220 --> 00:21:28,320
But also, you know, it's another thing called disinformation or misinformation where, you know, what we talk about is willingly bad, essentially not right when fact-checked, or in some cases, is disinformation provided by an actual entity.

172
00:21:28,320 --> 00:21:37,160
I know, you know, with the 2016 and earlier, the recent, the midterms, we had influence from outside sources.

173
00:21:37,580 --> 00:21:52,500
And obviously, you know, Washington Post just recently kind of covered that we're potentially seeing some influence from China and Iran and some of our other, you know, would classically qualify them as adversaries, but yet we still find some ways to deal with them.

174
00:21:52,640 --> 00:21:55,900
You know, where do we kind of find ourselves in this case right now?

175
00:21:55,940 --> 00:22:12,740
Obviously, you know, six months later, you know, we had a little bit of a kind of, I wouldn't say necessarily contentious Democratic primary, but, you know, it was a lot more graceful when people, you know, basically, you know, said, yeah, I'm out, and let people carry forward.

176
00:22:12,740 --> 00:22:23,080
But also, you know, in recent news about how people are talking about, you know, the legitimacy of the methods that we're using, where do you kind of see ourselves now?

177
00:22:23,080 --> 00:22:39,140
And what can we do in the future here, as folks who are attendees to this video, but also, you know, as responsible citizens to kind of educate others, your parents, your friends, your peers, your neighbors, and so forth to be on the lookout for this?

178
00:22:39,860 --> 00:22:41,860
I'll rush into the fire.

179
00:22:42,840 --> 00:23:01,600
I think an interesting thing that I've seen is that, yes, when we did our panel back in early February, which seems like so long ago now, I think that we could pretty clearly say, like, Russia.

180
00:23:02,320 --> 00:23:11,380
We're seeing the Twitter bots, the farms, we're seeing, like, the disinformation campaigns on Facebook, Twitter, IG.

181
00:23:12,140 --> 00:23:16,140
Now, it's much more complicated.

182
00:23:16,600 --> 00:23:26,180
So, the interesting thing that we've seen now are, well, I feel like it's interesting, because I'm a, you know, social media nerd.

183
00:23:26,180 --> 00:23:32,180
The QAnon accounts that have popped up seem to span the gamut of countries.

184
00:23:33,080 --> 00:23:37,720
And you see a lot of activity from these QAnon accounts just coming from the U.S.

185
00:23:37,720 --> 00:23:44,580
And they're not, like, some, you know, complex, combative nation state, right?

186
00:23:44,580 --> 00:23:54,560
They're from just, like, diehard MAGA people who are like, I'm going to do my duty, and this is patriotic, and they are figuring out how to spin up bots.

187
00:23:54,560 --> 00:23:57,560
And so, that's pretty interesting.

188
00:23:57,700 --> 00:24:06,260
And then to see bots that will respond to Trump accounts, right?

189
00:24:06,360 --> 00:24:15,680
Or the interesting thing that I see a lot, too, are accounts that get a lot of followers because they'll post pornography, right?

190
00:24:15,680 --> 00:24:17,960
And then they get, like, loads of followers.

191
00:24:17,980 --> 00:24:20,920
And then they get verified in some cases.

192
00:24:20,920 --> 00:24:29,700
And then as soon as they get the checkmark, they switch to, like, QAnon accounts that have given themselves some name that you can recognize in the media.

193
00:24:29,700 --> 00:24:33,680
And all of a sudden, you think you're engaging with someone that you're not engaging with.

194
00:24:33,680 --> 00:24:41,400
But what that does is have this, like, celebrity or verified boost of this misinformation.

195
00:24:41,640 --> 00:24:51,620
So, for me, as a person who has a blue checkmark, I want to say, I don't know anything.

196
00:24:51,840 --> 00:24:54,360
I'm not an expert on any fucking thing.

197
00:24:54,360 --> 00:25:01,340
And I'm going to tell you flat out that, like, you'd be hard-pressed to find a blue checkmark that is an expert on everything.

198
00:25:01,380 --> 00:25:12,960
So, if someone gets their blue checkmark for being an actress, like, maybe don't just immediately trust that they're an expert on vaccination protocol, right?

199
00:25:12,960 --> 00:25:32,000
So, I think that it's really fascinating how the floods are coming and the stuff that Cambridge Analytica did, it's all still happening under a different name, a different company, but it's all still out there on Facebook and Twitter.

200
00:25:32,240 --> 00:25:40,820
It's just, like, now more people from different countries, including our own, are able to participate in the disinformation process.

201
00:25:41,240 --> 00:25:43,560
Yeah, I'll tag in on that.

202
00:25:43,560 --> 00:25:53,660
Just confirm what you're saying, like, the QAnon stuff and things of that nature, they're happening on the ground here in Australia.

203
00:25:53,800 --> 00:26:03,300
I think for, you know, for ostensibly different reasons from a partisan political standpoint, but it's kind of coming from the same mindset.

204
00:26:03,300 --> 00:26:07,620
And I think in part, like, we're all going a bit stir-crazy right now.

205
00:26:07,620 --> 00:26:18,960
It's good not to ignore the fact that society just in general is dealing with mental stress that we've not seen collectively for as long as Twitter's been around, definitely.

206
00:26:18,960 --> 00:26:20,880
So weird shit happens.

207
00:26:21,720 --> 00:26:23,920
But yeah, there's that piece of it.

208
00:26:23,920 --> 00:26:26,460
I think, Kimber, you touched on a really good point.

209
00:26:26,460 --> 00:26:34,200
I actually got invited to talk about disinformation on a friend who has a cooking channel.

210
00:26:34,220 --> 00:26:53,880
She's got, like, millions and millions of subscribers, but she saw basically bot, like, advertising-focused bot-generated content, ripping off her stuff, and then noticed that there was subversion starting to creep into that, and then the ability for that type of channel to be used.

211
00:26:54,200 --> 00:26:55,240
That's so crazy.

212
00:26:55,680 --> 00:26:56,860
It's nuts, man.

213
00:26:57,120 --> 00:26:59,060
And I'm like, what am I doing on a cooking channel?

214
00:26:59,060 --> 00:26:59,880
This is crazy.

215
00:26:59,880 --> 00:27:07,940
No, they have an entire channel on this, like, basically debunking some of these bots or the content farms.

216
00:27:08,380 --> 00:27:16,060
So it's a real thing, and I think the ability for that sort of thing to be deployed very rapidly, because these are businesses.

217
00:27:16,060 --> 00:27:30,660
It's businesses that exploit the things that are exploitable to build following on social media in some of the ways that Kimber just described, but then they sell that or rent that, or if they're owned, you know, potentially by, you know, an actor that can go hostile,

218
00:27:30,660 --> 00:27:31,700
it's redeployed into that.

219
00:27:31,700 --> 00:27:34,260
And that's happening across all sorts of different channels.

220
00:27:34,260 --> 00:27:38,200
The one you asked, Amelie, about, you know, things that we can do.

221
00:27:38,900 --> 00:27:41,260
I think something that we can all agree on.

222
00:27:42,440 --> 00:27:52,080
The great hack, for example, just as a, you know, a way to get people that aren't necessarily technical in a context that's apolitical.

223
00:27:52,080 --> 00:27:55,140
So you're not sort of going one way or the other too much.

224
00:27:55,140 --> 00:28:02,620
You're just explaining to them this general idea that, like, social media is a constructed reality that's been built just for you.

225
00:28:03,100 --> 00:28:06,980
And you actually need to be observing it like that.

226
00:28:06,980 --> 00:28:13,680
I think, you know, for the hackers that are kind of watching this, that's probably a thesis and something that's important that we could all agree on.

227
00:28:13,680 --> 00:28:15,700
And I found that to be fairly helpful.

228
00:28:15,700 --> 00:28:15,920
Great.

229
00:28:15,920 --> 00:28:22,280
And just to talk briefly on foreign disinformation, of course, that's a very large concern.

230
00:28:22,280 --> 00:28:27,920
We've seen in 2016 what happened, and in 2020, it seems to be shaping up again.

231
00:28:27,920 --> 00:28:35,360
We know, yes, our nation's adversaries, Russia, Trump, China, Iran, are all targeting, trying to interfere in our democratic processes.

232
00:28:35,620 --> 00:28:42,020
So from CIS's perspective, our number one priority is to ensure that Americans decide American elections.

233
00:28:42,060 --> 00:28:54,900
So that means ensuring that foreign adversaries are not able to interfere, whether that's by actually targeting election systems, whether that's disinformation campaigns, all that.

234
00:28:55,160 --> 00:28:58,780
It should be Americans who are deciding American elections.

235
00:28:59,060 --> 00:29:11,900
So that kind of leads us to the point, then, what steps can Americans take to mitigate the impact, say, of disinformation or just general confusion, say, on election night?

236
00:29:11,900 --> 00:29:17,100
I think the most important thing here is just to understand that elections are going to be different this year.

237
00:29:17,120 --> 00:29:33,820
Election night, November 3rd, is not going to be the same as election night in the past, because with many more mail-in ballots, they're going to take much longer to count, just due to state laws and processes around that, as well as just technical constraints,

238
00:29:33,820 --> 00:29:42,720
since some states are rapidly scaling out mail-in ballots at a scale that is maybe tenfold from what they previously had operated.

239
00:29:42,840 --> 00:29:51,800
So with that perspective, election night, it is entirely possible that it just isn't what the election results are.

240
00:29:51,800 --> 00:29:57,380
And it may take a week, it may take several weeks to actually learn what the final results are.

241
00:29:57,380 --> 00:30:05,260
So the best thing that Americans do is to just internalize this to understand that election results are not going to come out immediately.

242
00:30:05,280 --> 00:30:14,460
Media has an important role in this, that it can't just be election night, the final results, declare who won, because we have to acknowledge that might not be the case.

243
00:30:14,600 --> 00:30:33,080
So I think that if we all are on the same page, expecting this to be a slower process, and keeping in mind that a slower process means that there's more time to actually verify that results are correct, and to ensure that the final count is ultimately the right one.

244
00:30:33,260 --> 00:30:45,200
So I think just understanding that patience is needed here, and that election night, not going to know who won, may take some time, but we'll get there, and we can be confident then in the outcome of the election.

245
00:30:45,200 --> 00:30:46,420
That's the important thing.

246
00:30:47,300 --> 00:30:52,700
Yeah, and just to follow up on what Jack said, is like, election night is not the end of this, right?

247
00:30:52,700 --> 00:31:01,520
Like, for starters, like any kind of disinformation campaign that we've been talking about, that's going to happen way before election day.

248
00:31:01,520 --> 00:31:11,020
Like I mentioned, I get to vote on October 13th, so, you know, look for something exciting happening around, I don't know, first or second week of October.

249
00:31:12,460 --> 00:31:24,580
Almost, like, that's the time when your fear ganglia should flare up around what's going to be happening around disinformation.

250
00:31:24,580 --> 00:31:33,620
And just one other super quick point, Jack is also totally correct that I would be shocked if we had results election night.

251
00:31:33,620 --> 00:31:35,540
Now, it doesn't mean it's the end of democracy.

252
00:31:35,540 --> 00:31:37,440
Like, there will not be rioting in the streets over this.

253
00:31:37,440 --> 00:31:38,380
We've done this before.

254
00:31:38,380 --> 00:31:43,440
Like, the 2000... some people on this call are old enough to remember the 2000 election.

255
00:31:44,100 --> 00:31:52,680
And we remember that, like, that was weeks and weeks and weeks of will they, won't they, which ended up in the Supreme Court decision.

256
00:31:52,840 --> 00:31:55,460
So, like, that did not destroy America.

257
00:31:55,460 --> 00:32:03,040
And not having election results at, you know, 1am on November 4th is not going to, it's not going to kill everybody.

258
00:32:03,040 --> 00:32:03,800
Like, we'll be fine.

259
00:32:03,800 --> 00:32:04,580
We'll be fine.

260
00:32:05,280 --> 00:32:11,060
Yeah, that does bring up a good point, you know, or subsequent question here, you know, it's kind of talking some of the logistical errors.

261
00:32:11,600 --> 00:32:16,100
You know, just to put on an election is not as easy as everybody kind of thinks.

262
00:32:16,100 --> 00:32:20,640
Like, you just go in there and pull the handle if you're a manual or you... It is way more complicated.

263
00:32:20,680 --> 00:32:22,080
It is way more complicated.

264
00:32:22,080 --> 00:32:29,120
I mean, you know, just watching Matt Blaze's Twitter feed sometimes and just how simplistic some of the suggestions are.

265
00:32:29,180 --> 00:32:34,540
And then, of course, Matt being Matt kind of fires back in Matt's way and whatnot.

266
00:32:34,540 --> 00:32:35,600
And that's not a knock on him.

267
00:32:35,600 --> 00:32:39,640
It's just a try to educate people that, yeah, this this shit ain't simple.

268
00:32:40,140 --> 00:32:48,640
You know, as much as I railed on my trip to the DMV recently, you know, I sat in the car and kind of pondered everything required to kind of make my trip better.

269
00:32:48,640 --> 00:32:51,220
And I'm just like, oh, my God, that's that's a lot to move.

270
00:32:51,320 --> 00:32:53,420
That's Sisyphean in a way.

271
00:32:54,220 --> 00:33:04,520
But, you know, obviously, one of our one of our bigger challenges, obviously, the thing that made the biggest press right after our February conclave here was the Iowa caucus.

272
00:33:04,520 --> 00:33:09,740
And I wrote a long paper on this about the whole DevOps process in regards to how it was developed.

273
00:33:09,800 --> 00:33:18,960
But, you know, the Iowa caucus with the Georgia primaries, which, you know, some would say was kind of a predictable outcome of, you know, what kind of a clusterfuck it would be.

274
00:33:19,500 --> 00:33:33,060
But, you know, that's the other the other issues underscore the potential about how trust is eroded through procedural process error by no fault or intent of the creator of that error.

275
00:33:33,060 --> 00:33:41,280
It was more or less like we're forging new areas of election things we can do and mistakes will be made.

276
00:33:41,680 --> 00:33:47,340
You know, there was no necessarily evidence when one looked at that, you know, interference necessarily occurred.

277
00:33:47,340 --> 00:34:05,900
But, you know, when you know, basically, these things that we do in so nice a word, shit the bed, you know, what are the different ways that we can as professionals in the security and election security arena kind of capture the discussion and say, you know,

278
00:34:05,900 --> 00:34:07,680
this shouldn't erode trust.

279
00:34:08,080 --> 00:34:10,980
This is us trying something new.

280
00:34:11,580 --> 00:34:13,220
Mistakes will be made.

281
00:34:14,200 --> 00:34:16,440
Morale will be, you know, lowered.

282
00:34:16,440 --> 00:34:29,380
But, you know, what are some things at the technical level to kind of, as I mentioned, you know, you have a lot of technical people that will swoop in and say, oh, we can fix this with blockchain, for instance, as Casey so lightly joked about.

283
00:34:29,720 --> 00:34:45,120
But, you know, what are some practical techniques we can have to kind of educate some people on like, no, no, no, this is a big ship to steer, you know, this is what you can expect and, you know, don't lose trust in this.

284
00:34:45,920 --> 00:34:46,540
Great.

285
00:34:46,540 --> 00:34:51,760
So first, just to really underscore the point that running elections is incredibly hard.

286
00:34:51,760 --> 00:34:59,860
There's so much more than just kind of from a voter's perspective showing up to, say, a polling place, casting your ballot.

287
00:34:59,860 --> 00:35:02,320
There's so much more that goes into this process.

288
00:35:02,320 --> 00:35:04,100
So many months of preparation.

289
00:35:04,100 --> 00:35:06,460
That's a difficult task.

290
00:35:06,460 --> 00:35:36,760
And every single election official I've talked to is incredibly motivated and wants to make sure that elections run smoothly and that their people can, so just thinking about going back to February, say, was already shaping up to be perhaps one of the hardest elections that an election official has had to run just because we are in an incredibly polarized environment.

291
00:35:36,760 --> 00:35:42,000
We know that there is foreign interference that occurred in 2016 and we can expect again in 2020.

292
00:35:42,000 --> 00:35:46,700
So even from that perspective, this was a hard task.

293
00:35:46,700 --> 00:35:57,660
And then you add the pandemic and everything becomes so much more complicated because suddenly we can't vote entirely in the same way as we're used to voting and all of these processes have to change.

294
00:35:57,660 --> 00:36:04,760
In a lot of cases, like I said, election officials now have to scale out mail-in ballots at 10 times the capacity.

295
00:36:04,900 --> 00:36:13,300
And when your machines process those, we're only intended to do, say, a small percentage of voters in your jurisdiction.

296
00:36:13,320 --> 00:36:24,520
From a technical perspective, that can be very difficult and things can break because we're rapidly scaling out these technologies and things can and likely will go wrong.

297
00:36:25,560 --> 00:36:28,920
So from that perspective, what should voters expect?

298
00:36:28,960 --> 00:36:30,740
So I said before, be patient.

299
00:36:30,740 --> 00:36:34,360
Election results may not come in immediately and that's fine.

300
00:36:34,360 --> 00:36:51,660
I think the second point there is really to expect things to go wrong, but don't immediately believe that that is a result of interference of any kind because the most likely explanation is that's just some routine error that occurred and that will be worked through.

301
00:36:51,660 --> 00:36:57,260
There's processes in place in order to handle these types of failures.

302
00:36:57,260 --> 00:37:01,700
We have, for the most part, paper trails that allow verifying elections.

303
00:37:02,360 --> 00:37:05,280
So from that perspective, we have controls in place.

304
00:37:05,280 --> 00:37:21,480
And yes, technology can be brittle and stuff can break down, but a lot of times just look for the most likely explanation that, of course, interference is still possible and we should be very concerned if that does happen.

305
00:37:21,600 --> 00:37:40,520
But just looking from kind of what is most likely to happen, it's more likely that, I mean, we can almost assume that some technical failure in some capacity will occur, but that doesn't mean that's malicious and the people just have to view it as that way and understand that there are still controls in place.

306
00:37:40,680 --> 00:37:42,380
Yeah, Occam's razor is good.

307
00:37:42,380 --> 00:37:45,720
I can't remember if it's Hanlon's razor or Occam's razor, but it's one of the razors.

308
00:37:45,720 --> 00:37:47,000
I think it's Hanlon's.

309
00:37:49,180 --> 00:37:50,360
Yeah, anyway.

310
00:37:51,420 --> 00:37:53,780
Yeah, well, simple ends malice.

311
00:37:53,780 --> 00:38:00,740
Anyway, whatever, because we can probably look that one up after the fact and I'm outing myself for not knowing which razor is which right now.

312
00:38:01,860 --> 00:38:13,000
I'd add to that, no new stuff in 2020, like timeout, you know, like there's a whole bunch of innovation happening in the election space, which I think is fantastic.

313
00:38:13,000 --> 00:38:14,240
And I think it's important.

314
00:38:14,240 --> 00:38:17,800
It's going to be critical after this is done.

315
00:38:18,420 --> 00:38:37,940
But, you know, the addition of variables, you know, the idea that there's like software fails, which is the second point I'm going to make, but like it's the failure rate of software is directly proportional to how quickly it's been brought to market and oftentimes how mature it is.

316
00:38:38,060 --> 00:38:44,660
So this idea of like, cool, let's just blast 2020 with a whole bunch of brand new stuff that we haven't really tested.

317
00:38:44,660 --> 00:38:51,680
You know, ultimately, when you go back to Iowa and do a bit of a root cause analysis, that's sort of most of what happened there.

318
00:38:51,680 --> 00:38:53,820
It was less than six weeks of the analysis.

319
00:38:53,820 --> 00:38:54,420
Yeah.

320
00:38:55,320 --> 00:38:56,080
Yeah, it was.

321
00:38:56,080 --> 00:38:58,580
And it's logically what would happen again if we do it with other stuff.

322
00:38:58,580 --> 00:38:59,460
So no new stuff.

323
00:38:59,460 --> 00:39:08,360
But then this other idea of like software, you know, in terms of, again, coming back to how we can help, like humans aren't humans make mistakes, period.

324
00:39:08,380 --> 00:39:21,380
Like this is why, you know, we've got an industry is because, you know, while we come up with all these incredible ways to do stuff, including democracy itself, we do make the occasional spelling error.

325
00:39:21,380 --> 00:39:24,500
And then there's bad people that want to manipulate that to get what they want.

326
00:39:24,520 --> 00:39:28,280
So this idea of like to err is human, it's more about how you respond.

327
00:39:29,080 --> 00:39:41,920
Again, it's part of what I like so much about, you know, vulnerability disclosure as a process, but also as this like leading indicator of maturity when it comes to security of an organization that can translate to trust.

328
00:39:41,920 --> 00:39:45,660
I think that's a concept that isn't very well understood.

329
00:39:45,800 --> 00:39:54,680
And I think a lot of the time people, you know, on the operations side would prefer to do ostrich risk management and pretend it didn't exist.

330
00:39:54,680 --> 00:40:03,220
But I think it's going to become pretty important in context of all of the stuff that can and probably will go a bit funky this year.

331
00:40:03,560 --> 00:40:07,480
Casey, you have some of the best vuln disclosure jargon around.

332
00:40:08,980 --> 00:40:11,900
I've been practicing.

333
00:40:11,900 --> 00:40:12,920
Yeah, a little.

334
00:40:13,900 --> 00:40:29,660
Yeah, like I guess I would just say as technical people who are probably the only people watching this, you know, I think what you can you can do your part by not freaking the hell out when you see something that goes wrong.

335
00:40:29,660 --> 00:40:35,980
Like, you know, just to echo, you know, Jack and Casey, it's like it is it is a hand lens razor kind of thing.

336
00:40:35,980 --> 00:40:37,800
There will probably be mistakes.

337
00:40:38,720 --> 00:40:44,300
You know, I don't I don't think I would go so far as to say like it's super I've got the Metasploit shirt on.

338
00:40:44,300 --> 00:40:47,380
It's very hard for me to say like don't disclose vulnerabilities.

339
00:40:48,100 --> 00:40:56,240
But, you know, maybe not on Election Day and maybe not make a bunch of hay about like hackable voting machines.

340
00:40:56,240 --> 00:40:57,840
Like that is kind of the least of our worries.

341
00:40:57,840 --> 00:41:11,280
If all we had to worry about was a hackable voting machine like that physical device, boy, that would imply that we've fixed so many other problems in infrastructure, in disinformation, in everything up and down the line.

342
00:41:11,280 --> 00:41:29,060
So, you know, I would hope that, you know, the folks that work in the space who pay attention to things in Voting Village, you know, maybe not completely lose your cool over a, you know, a voting machine that can be hacked in person.

343
00:41:29,820 --> 00:41:34,840
So I'll do a quick response and I'm sure Amelie wants to move on.

344
00:41:34,840 --> 00:41:39,000
But this goes back to something that I said in February.

345
00:41:39,060 --> 00:41:43,260
And it's a recurring thing because I feel like I say it a lot.

346
00:41:43,380 --> 00:41:46,160
So if you've heard it before, suck it because I'm going to say it again.

347
00:41:46,420 --> 00:41:56,180
But the biggest disservice that we can do to the American people as security professionals is somehow convincing them that their votes don't count.

348
00:41:56,180 --> 00:42:11,920
And we do that by constantly preaching that the system's broken, the voting machines are hackable, the infrastructure's flawed, the voter registration system is, you know, something that can be tampered with.

349
00:42:11,920 --> 00:42:15,400
It's not to say these things aren't true.

350
00:42:16,040 --> 00:42:29,980
But also, like, you have to qualify those ramblings and announcements with how often that actually happens and what the likelihood of that happening actually is.

351
00:42:29,980 --> 00:42:42,200
And the idea that, you know, hacking 20 voting machines is going to sway an election without even, like, acknowledging what it would take to actually hack the voting machine, right?

352
00:42:42,260 --> 00:42:54,220
Or to tamper with the voter registration system without acknowledging that, like, you know, states do have some IDS systems in place.

353
00:42:54,220 --> 00:42:55,940
Like, sure, could it happen?

354
00:42:55,940 --> 00:42:58,400
Yeah, we can, like, what if all day long?

355
00:42:58,400 --> 00:43:09,140
But if we're, if we're putting information out there, that even makes one person think, well, my vote can just be changed anyway, so why would I bother voting?

356
00:43:09,140 --> 00:43:17,960
Like, then we've fucked up, like, bad, because we've kind of, we, like, shot ourselves in the foot with the thing that we were trying to make better.

357
00:43:18,260 --> 00:43:20,140
So we're now into Section B.

358
00:43:20,140 --> 00:43:26,200
So we've now pivoted from where we were six months ago to where we find ourselves in the last 90 days here.

359
00:43:26,500 --> 00:43:34,060
90 days scares me, because, you know, coming from the federal government, it takes longer than that, mainly to fill out the paperwork for something.

360
00:43:34,060 --> 00:43:39,400
So 90 days for us in the real world, if in the commercial sector, will be totally interesting.

361
00:43:39,400 --> 00:43:49,020
But obviously, I'm going to highlight the fact that, you know, as Jack leveled up here, CISA has taken more of an active policy and assistance role for states.

362
00:43:49,020 --> 00:43:54,880
The Election Assistance Commission Committee has hired some really great new staff.

363
00:43:54,880 --> 00:44:05,480
In fact, some folks, I believe, Kimber and I were on the panel many years ago with, and, you know, the feeling that, while it's awesome, they hired these people.

364
00:44:05,480 --> 00:44:12,760
I don't know, I've tweeted out about it, it's a little too late in certain cases, but, you know, they hire great people.

365
00:44:12,760 --> 00:44:17,900
What is the feeling right now that these folks can actually make a difference between now and the election?

366
00:44:17,900 --> 00:44:27,080
Or, obviously, if we can't do it by then, what are the, what is the change that can be made for further elections, provided that the world isn't going to melt down?

367
00:44:27,080 --> 00:44:30,620
So yeah, I think, yeah, I can take this to start.

368
00:44:30,620 --> 00:44:31,500
Yeah, so it's true.

369
00:44:31,500 --> 00:44:36,020
Yes, CISA has brought on some more people to help out with election security.

370
00:44:36,020 --> 00:44:44,540
I'm part of a group of me and four other Stanford students who all came to CISA to work specifically on election security.

371
00:44:44,540 --> 00:45:04,160
And we've been having a lot of fun being able to work essentially on both the infrastructure component, building tools to allow organizations to better secure their systems, and allow CISA to say, aid and assessments to state and local election officials,

372
00:45:04,160 --> 00:45:09,340
as well as working on some that's a foreign disinformation component.

373
00:45:09,600 --> 00:45:18,520
So in terms of what both, say, CISA and EAC can do by November, I think there's a lot that can still be done.

374
00:45:18,520 --> 00:45:32,360
Of course, yes, we have, I believe, calculated this, I think it's 89 days from the time the talk this is airing until the election, and that's very little time, almost nothing, but we still can do a lot.

375
00:45:32,360 --> 00:45:37,340
We can help, say, states identify vulnerabilities in their systems.

376
00:45:37,340 --> 00:45:43,120
We continue to offer services that assess these systems and give guidance.

377
00:45:43,120 --> 00:45:56,260
I mentioned before, we have documents that we published along with the Election Assistance Commission, and we're working to support states in the capacity that we can.

378
00:45:56,300 --> 00:46:03,500
So I think that there's a lot that still, of course, needs to be improved, but we're getting there.

379
00:46:03,780 --> 00:46:10,140
And from my perspective, yes, the government plays a large role in this, the federal government.

380
00:46:10,240 --> 00:46:17,660
And I really do think that states, this is, I'd say, one of the major improvements since 2016.

381
00:46:17,660 --> 00:46:23,240
In 2016, the federal government's involvement with the states was not at all near where it was today.

382
00:46:23,240 --> 00:46:29,560
So much has improved since then that we are now working with each of the 50 states.

383
00:46:29,560 --> 00:46:40,900
We're working with a significant portion of the local election offices, and we're in a much better place, both to be protecting systems and then monitoring in case stuff does go wrong.

384
00:46:40,900 --> 00:46:52,220
So, you know, you speak to, obviously, kind of the involvement with CISA and, you know, kind of the states taking a more active role in their own survival in a way.

385
00:46:52,220 --> 00:47:09,920
You know, have any of the vendors, either of the e-poll books or the election systems, been more willing to kind of come forward and work proactively with the government or, you know, say any of the companies represented on here to kind of solve the problems?

386
00:47:09,920 --> 00:47:19,580
I know, you know, I've recently been involved with some workshopping with OECD on regards to vulnerability disclosure policies and digital product security.

387
00:47:19,840 --> 00:47:25,580
And one of those cases is finding a good mediator sometimes to kind of do that.

388
00:47:25,580 --> 00:47:32,520
Has anybody kind of moved that way, or are we still kind of like, you know, kind of finger pointing and moving forward there?

389
00:47:32,520 --> 00:47:43,620
So in terms of CISA's involvement with this, of course, CISA's preference is for vulnerabilities to be disclosed either directly to the state or to vendors when that is possible.

390
00:47:43,720 --> 00:47:49,300
And it is our view that, of course, vulnerability disclosure policies can be very helpful in this process.

391
00:47:49,620 --> 00:48:03,460
I'm not aware of any vendors that at the time of recording, or states for that matter, that have come up with vulnerability disclosure policies that could very well change between the two weeks when this airs.

392
00:48:03,720 --> 00:48:10,060
But what we do offer is resources for those that want to implement vulnerability disclosure policies to do so.

393
00:48:10,060 --> 00:48:26,020
So like I mentioned, we have our guide on vulnerability disclosure that will be live by the time this panel airs, as well as the fact that we do serve as a last resort for people who are unable to disclose vulnerabilities.

394
00:48:26,100 --> 00:48:37,720
For any reason, they can report it to US CERT, which is under CISA, and we will work to get that disclosed to the vendor in order to mitigate that vulnerability.

395
00:48:37,740 --> 00:48:40,180
So CISA does play an important role here.

396
00:48:40,200 --> 00:48:50,660
And yeah, it is our hope that of course, yes, that any vulnerabilities that either people come to vendors with, or come to us with, that they will be addressed.

397
00:48:50,720 --> 00:48:59,220
So I mean, and just to follow up on that, I mean, we're getting under the wire, at the wire, right, for the November 2020 election.

398
00:48:59,220 --> 00:49:17,580
If I were the king of vuln disclosure, I think I would direct people to disclose to you personally, and, you know, by extension to CISA, before vendors and states, like, I mean, I think that's kind of the way, like, let's say I'm sitting on a vulnerability,

399
00:49:17,580 --> 00:49:23,560
or I find a vulnerability in some election system or whatever, like, and I'm a, I'm a hacker guy, who wears bedspread to do this.

400
00:49:24,480 --> 00:49:34,520
Like, I have it, I don't want to not tell anyone about it, you know, there is this, like, it's okay to yell fire in a credit theater, if the theater is actually a fire business.

401
00:49:34,520 --> 00:49:41,040
Um, I think it's, it's probably not great to, like, drop that on Twitter and just full disclose and do that.

402
00:49:41,040 --> 00:49:45,040
I mean, that's not helpful, I don't think in, in, in the slightest.

403
00:49:45,280 --> 00:49:58,040
But I do think, like, you tell me, like, I, my, my instinct is, you know, tell CISA and hope for the best, and keep my mouth shut until November, I don't know, 10th, 15th or something.

404
00:49:58,380 --> 00:50:03,440
You know, so at least this is where they can do, I'm describing your job at you.

405
00:50:04,060 --> 00:50:05,820
Yeah, you can do instrumentation, right?

406
00:50:05,820 --> 00:50:11,680
Like, so even if there's no fixes, there's still ways to, to track the vulnerability.

407
00:50:11,780 --> 00:50:12,140
Yeah, yeah.

408
00:50:12,140 --> 00:50:20,140
And you're exactly right there that yes, the priority is for the vulnerability to get fixed as quickly as possible.

409
00:50:20,140 --> 00:50:26,300
And we want to support whatever will make that happen as efficiently and smoothly.

410
00:50:26,300 --> 00:50:35,360
So of course, it's ideal if it is possible to disclose directly to vendors, but that is hard when there are no policies today.

411
00:50:36,120 --> 00:50:37,940
Yes, exactly.

412
00:50:38,920 --> 00:50:45,280
So given that, yeah, the current landscape, yes, CISA does serve as a coordinating role there.

413
00:50:45,280 --> 00:50:57,060
For people who, yeah, can't really find the contact to disclose, they can come to CISA and CISA will work to make sure that the vendor or the state is made aware and that the vulnerability can be fixed.

414
00:50:57,280 --> 00:51:02,960
Yeah, I mean, hard, hard agree with, with Todd's suggestion of going to CISA, especially at this point.

415
00:51:03,600 --> 00:51:23,100
You know, keeping in mind as well that like with the 90 day kind of lead time that we've got, the vendors are very likely to be distracted and have lots of other things on their plate, just from a pure logistical standpoint, before you go layering on the pandemic and the fact that 2020 is generally a bit of a shit show.

416
00:51:24,260 --> 00:51:35,680
Yeah, the thing that I wanted to double click on is actually around basically non-disclosure of findings ahead of November at this point.

417
00:51:35,680 --> 00:51:42,160
And this is very much opposed to how I normally talk about non-disclosure.

418
00:51:42,780 --> 00:51:46,040
Yeah, it's really, it's a really, it's a really difficult thing to say.

419
00:51:46,040 --> 00:51:52,060
We actually talked about this in terms of the boilerplate election policy that we put up on Disclose.io.

420
00:51:52,200 --> 00:51:53,420
And we've got it in there.

421
00:51:53,420 --> 00:51:59,620
It's like, you know, basically the agreement is not to disclose until after the election is finished.

422
00:52:00,280 --> 00:52:05,320
Ordinarily, that timeline would serve as back pressure on the vendors to fix.

423
00:52:05,320 --> 00:52:08,920
And I think that's a really good and important thing for accountability and transparency.

424
00:52:08,940 --> 00:52:22,660
But the risk of frightening a non-technical voter into just giving up and not showing up to the poll booth as a product of trying to do something good, I think is extremely high on this particular topic at this particular point in time.

425
00:52:22,660 --> 00:52:25,520
So yeah, it's a hard pill to swallow.

426
00:52:25,520 --> 00:52:34,920
I think for security researchers in general, it was definitely, you know, from where I, from what we do and where I sit, it's a hard thing to say, but I actually do think it's the right thing for this year.

427
00:52:35,440 --> 00:52:36,000
Yeah.

428
00:52:36,240 --> 00:52:36,940
Yeah, I know.

429
00:52:36,940 --> 00:52:43,020
That's one of those things we've kind of, you know, as I mentioned with some of the policymaking, you know, obviously federal, international and whatnot.

430
00:52:43,020 --> 00:52:58,140
You know, we've set the, I wouldn't say necessarily artificial 90 day deadline, but obviously for inside the 90 days, it does kind of create an unworkable framework with both in the timing, I think the regulatory environment for whatever folks need to do for certifications,

431
00:52:58,140 --> 00:53:01,560
plus loading all the election information and the logistics of that.

432
00:53:01,560 --> 00:53:06,600
So, you know, it just creates this, this whirlwind of not a good situation for us to be in.

433
00:53:06,600 --> 00:53:07,700
So yeah.

434
00:53:07,960 --> 00:53:22,540
So yeah, we, we talked about this, you know, earlier in regards to kind of the effect that COVID-19 has had on how we staff the election, how we are attending the election and participating in it, obviously with retirees and whatnot.

435
00:53:22,680 --> 00:53:27,600
There is so much dumpster fires being poured into the alley right now.

436
00:53:27,600 --> 00:53:29,220
It's not even funny.

437
00:53:29,560 --> 00:53:46,200
And obviously with the disinformation and just all the stuff we talked about, if you were all betting people, and if we were in Las Vegas this year, instead of doing this virtual, what would you bet to be the first thing to crumble out of all of this?

438
00:53:46,200 --> 00:53:52,420
What do you think is the first thing that is just like, you know, the guy from Oz comes out behind the sheet and says, yep, everybody go home.

439
00:53:52,420 --> 00:53:53,300
We're fucked.

440
00:53:54,020 --> 00:54:06,220
If I was a gambling person, which I'm not, I think it would be if we're talking about the first thing to just go like shithouse on fire.

441
00:54:06,220 --> 00:54:07,660
What do we do?

442
00:54:07,940 --> 00:54:34,860
Is a bunch of maybe rebellious folks who would show up at polling places without masks and like fake cough and just make a big to do and just try to disrupt, you know, the peaceful line at the voting place, like, I think that, sure, I think we'll see people tweeting,

443
00:54:34,860 --> 00:54:44,060
oh, I got a mail-in ballot for my uncle who died last year, and then it gets 10,000 retweets and then somebody else tweets something similar.

444
00:54:44,060 --> 00:54:52,040
Like, I think we'll see that, but like just for shithouse election day, like, what are we going to see on the news?

445
00:54:52,040 --> 00:55:02,020
I think like polling places being disbanded for like civil unrest and not from the folks who are there just to vote peacefully.

446
00:55:02,080 --> 00:55:06,780
So this is starting to form like a John Carpenter movie in the worst way possible then.

447
00:55:06,780 --> 00:55:11,160
Well, I am a horror fan, so of course that's where I go.

448
00:55:11,160 --> 00:55:23,220
My hope is that people respect democracy, regardless of which side of the line you fall on, and just let people have their constitutional right to participate in the electoral process.

449
00:55:23,280 --> 00:55:30,280
However, I am currently disenchanted by the state of the country right now.

450
00:55:30,280 --> 00:55:31,160
I don't know.

451
00:55:31,160 --> 00:55:39,240
I think that your first sign of everything going to hell is going to be on like in the neighborhood of October 13th, October 14th.

452
00:55:39,620 --> 00:55:47,420
That's going to be where you have your last big push of whatever disinformation campaign is going on.

453
00:55:47,420 --> 00:55:54,520
I'm not a disinfo expert by any means, but if I were going to own stuff, I would definitely want to tell people.

454
00:55:54,520 --> 00:56:04,520
But like one of the tactics we've seen over and over again of people who are attacking election systems is that it's no good unless you tell people about it, unless you get noticed.

455
00:56:04,520 --> 00:56:13,800
And so you got to get noticed like early enough to sway elections, but not so early that, you know, there's enough from, you know, that Jack can fix it for us.

456
00:56:14,600 --> 00:56:18,460
So like October 15th, I think is the sweet spot for that.

457
00:56:18,460 --> 00:56:18,860
What is that?

458
00:56:18,860 --> 00:56:20,960
That's like Wednesday, I think, or Thursday.

459
00:56:22,040 --> 00:56:32,800
Non-Friday, non-Monday, early October, I would expect to see, I would expect to see big news to try to have that last push of, hey guys, don't bother voting.

460
00:56:32,880 --> 00:56:38,500
And you think that because that's when the mail-in voting window opens.

461
00:56:38,500 --> 00:56:45,980
That's when most states, in many states, absentee ballots are starting to get filled out then.

462
00:56:45,980 --> 00:56:47,540
Early voting starts then.

463
00:56:48,160 --> 00:56:52,980
And it's still early enough that you can make hay about it for the following two weeks.

464
00:56:52,980 --> 00:57:03,180
Like a losing side can call cyberfowl, pointing at that thing for, you know, and just eat up, eat up news for the rest of October.

465
00:57:03,660 --> 00:57:09,880
Just this is, you know, it's a bit personal, but it goes to one of the reasons that I'm not in the U.S.

466
00:57:09,880 --> 00:57:10,500
right now.

467
00:57:10,500 --> 00:57:16,840
I think, you know, we had the option to be near family and ride out the pandemic.

468
00:57:16,980 --> 00:57:32,240
You know, part of the concern that was in the back of my mind was how, you know, the potential for civil unrest and those sorts of things are amplified by the backdrop of the pandemic and economic depression, a lot of other stuff.

469
00:57:32,260 --> 00:57:51,500
So I think the number of things that are available for an actor to tweak on and the amount of leverage that's present, you know, as we do version two of this panel is radically different to what it was, you know, last time we got together and spoke.

470
00:57:51,500 --> 00:58:02,740
So, you know, from a mitigation standpoint, it really does come back, you know, for the typical audience of this panel in DEF CON is making sure that you're not adding to the problem.

471
00:58:02,980 --> 00:58:10,060
You know, the whole idea of, like, polarization, of just general distrust, like, nihilism, all of that sort of stuff.

472
00:58:10,060 --> 00:58:22,420
And I do believe, like, we are talking, you know, Armageddon-ish type stuff at the moment, but I do believe fundamentally in, like, working back from the worst case scenario and optimizing the critical path from there.

473
00:58:22,420 --> 00:58:24,640
So it's an important conversation to have.

474
00:58:25,380 --> 00:58:29,900
Yeah, that's a good segue into the last question we're going to do today.

475
00:58:30,640 --> 00:58:48,060
So, you know, obviously, we talked about mail-in voting as the next best mitigation for forcing people to kind of show up in person, and definitely a better alternative than, I'd say, any potential half-baked e-voting solution at the last minute that would come in and swoop.

476
00:58:48,100 --> 00:59:07,000
But obviously, with the rhetoric that's been, you know, spoken by various folks in the press from various levels of government and elsewhere about the validity and trustability of the Postal Service, as well as their own financial woes imposed upon them by Congress and pre-funding and so forth and so on,

477
00:59:07,000 --> 00:59:13,540
you know, it was just announced today that they had worked out a deal with a massive infusion slash loan from the U.S.

478
00:59:13,540 --> 00:59:13,960
Treasury.

479
00:59:13,960 --> 00:59:18,620
I think it was, like, 15 billion dollars, which is a huge chunk of change.

480
00:59:18,680 --> 00:59:23,540
It does keep people from necessarily having to rush out and, you know, running for stamps.

481
00:59:23,540 --> 00:59:28,040
But obviously, I have reports from some of the locals here in the D.C.

482
00:59:28,040 --> 00:59:38,140
area, specifically Baltimore, about potential fallout from the recent Postmaster General coming in and saying, please delay first-class mail.

483
00:59:38,680 --> 00:59:47,420
Obviously, that puts a downward pressure on delivery of mail-in voting, as well as, you know, returning that and making sure that everyone hits with the deadlines with the postmarks.

484
00:59:47,440 --> 00:59:54,080
So where we sit here is our last best effort to run a secure election as a Postal Service.

485
00:59:54,080 --> 00:59:55,220
It is in dire straits.

486
00:59:55,220 --> 01:00:06,480
It has potential leadership that is working antithetically against the essentially constitutionally or, you know, state that the, you know, the Postal Service exists in.

487
01:00:06,480 --> 01:00:13,280
You know, what are the last bits here that we can ensure that that is functioning for us to go forward?

488
01:00:13,620 --> 01:00:23,840
Are there ways that maybe we move up early voting even sooner so that we kind of play into the logistics of extended timelines?

489
01:00:24,020 --> 01:00:30,620
Is it write your senators and make sure that, you know, mail is delivered in a timely fashion?

490
01:00:31,100 --> 01:00:43,160
Or, you know, some other aspect of it, you know, with that, and especially, you know, as you mentioned earlier, too, I think it was Todd talking about the expected timelines being a lot longer for us to hear the outcomes.

491
01:00:43,420 --> 01:00:50,320
You know, if we have this extended timeline, what's our expectations to actually, you know, hear what the outcomes are going to be given this?

492
01:00:50,320 --> 01:00:54,200
It would be great if states would extend their deadlines.

493
01:00:54,200 --> 01:01:10,300
Like, I was shocked to see that Texas, for all the hand-wringing Texas has been doing about mail-in ballots and, like, trying to make that hard, the fact that Texas then turned around and extended early voting was was a sweet surprise.

494
01:01:11,020 --> 01:01:12,000
You know, I don't know.

495
01:01:12,000 --> 01:01:13,860
We do things randomly here in Texas.

496
01:01:13,860 --> 01:01:14,640
Some things are great.

497
01:01:14,640 --> 01:01:16,000
Some things are not so much.

498
01:01:16,820 --> 01:01:20,420
But I guess that's, I guess that's just here local in Texas.

499
01:01:21,860 --> 01:01:22,460
I don't know.

500
01:01:22,460 --> 01:01:28,300
Like, I feel like everyone should, you know, mentally hug a postal worker today.

501
01:01:28,300 --> 01:01:30,140
They do a lot of really hard work.

502
01:01:30,140 --> 01:01:32,380
A lot of people depend on them for a lot of things.

503
01:01:33,500 --> 01:01:36,220
You know, they are, in fact, constitutionally enshrined.

504
01:01:36,220 --> 01:01:39,960
It's an Article I power of Congress to establish the post office.

505
01:01:40,500 --> 01:01:50,440
And the fact that it became a target for disenfranchisement is just mind-boggling to me.

506
01:01:50,440 --> 01:01:59,100
But I think that we can all agree that the post office is kind of a wonderful Americanism, really.

507
01:01:59,100 --> 01:02:07,420
Like, it was a largely, this notion of a single stamp that carries something across the country.

508
01:02:07,420 --> 01:02:09,360
Like, that is, I'm not really sure.

509
01:02:09,360 --> 01:02:11,000
It might be an English thing.

510
01:02:11,000 --> 01:02:12,300
It might be a British thing.

511
01:02:12,580 --> 01:02:17,240
But one or the other, it's pretty great.

512
01:02:17,240 --> 01:02:24,060
So yeah, like, I mean, if you have the opportunity to vote absentee, absolutely do it.

513
01:02:24,400 --> 01:02:38,980
You know, absentee voting, you can get all nerdy about it and say, like, well, technically you're violating, like, the secrecy of the ballot by doing that because someone can watch you vote and direct you vote and see that you vote correctly and see that you put the thing in and mail it away.

514
01:02:38,980 --> 01:02:47,560
Like, but that's almost a, like, that is so low on my list of problems when it comes to democracy is vote selling.

515
01:02:48,020 --> 01:02:51,120
You know, if it turns out that's a big deal, great.

516
01:02:51,120 --> 01:02:52,680
Like, let's go tackle that.

517
01:02:52,680 --> 01:02:56,740
But it is, it is not, that has not been a problem since, like, the 19th century, so.

518
01:02:56,740 --> 01:03:12,540
Yeah, I want to say, too, we've seen the current administration, we've seen the current administration actively attack the Postal Service on social media.

519
01:03:13,320 --> 01:03:30,540
And so, you know, I would ask folks to understand that I don't think there was a long game there, but I don't think that it's going to be unreasonable to see more attacks on the Postal Service from the current administration.

520
01:03:31,180 --> 01:03:46,380
The unreliability, the conspiracies about deals with Amazon, and then how Jeff Bezos ties into Amazon, and then with the Clintons, like, there's a lot of, there's a lot of stuff to unpack there.

521
01:03:46,480 --> 01:03:56,820
But I would say, you know, at the end of the day, like, these are feds, these folks are feds, they took the same oath to the Constitution that other feds take.

522
01:03:56,820 --> 01:04:00,040
They're there to just do their jobs every day.

523
01:04:00,040 --> 01:04:09,660
And the idea that postal workers themselves would be tampering with mail-in ballots is just kind of ridiculous.

524
01:04:09,660 --> 01:04:11,120
And it's completely insane.

525
01:04:11,120 --> 01:04:13,500
It really is ridiculous.

526
01:04:13,500 --> 01:04:20,280
And, and if there were one, it's a blip on the radar if the numbers are out there of folks voting, right?

527
01:04:20,280 --> 01:04:24,540
So, so let's just keep it all in perspective.

528
01:04:24,540 --> 01:04:40,780
And to understand the importance of the Postal Service, when I was younger, the DMV test had a question that said, if you get to a four-way stop, and there's a fire truck, an ambulance, a police car, and a mail truck, who has the right of way?

529
01:04:40,980 --> 01:04:51,400
And everyone assumed, like, the ambulance or the fire truck, but it was, in fact, the mail truck, because they are protected under, you know, the, the guys of the federal government.

530
01:04:51,400 --> 01:04:55,380
Certainly mail truck wouldn't go first, but they could.

531
01:04:55,380 --> 01:05:00,620
And also, if you hit a mail truck, you get into a lot of trouble, too, because you've damaged federal property.

532
01:05:00,620 --> 01:05:08,560
So, you know, you probably don't want to go out and take your angst out on vandalizing mail trucks or bothering postal workers.

533
01:05:08,560 --> 01:05:10,720
So I just... That is a hot tip.

534
01:05:11,360 --> 01:05:15,960
I feel like... Robbing post offices used to be a hangin' crime.

535
01:05:15,960 --> 01:05:20,200
Yeah, well, they've also got that Crime a Day book that just came out from the Twitter feed.

536
01:05:20,200 --> 01:05:24,200
I would hope that there's a chapter in there about weird stuff like that.

537
01:05:24,200 --> 01:05:30,680
So, all right, then last thoughts on what we see as our future here.

538
01:05:31,120 --> 01:05:36,560
What you'll be doing, what you hope others will be doing, and then where do you hope we will be?

539
01:05:37,140 --> 01:05:39,360
I can go and take this first.

540
01:05:39,420 --> 01:05:45,680
So, yeah, nothing I'm gonna say here, really, is anything new, I would say, that I haven't said.

541
01:05:45,960 --> 01:06:01,220
But, yes, in terms of what I'm doing, what CIS is doing, we are going to be working through and after the election to support election offices at the state and local level to ensure that they have what they need from a security perspective.

542
01:06:01,580 --> 01:06:04,860
And we're committed to doing that.

543
01:06:04,880 --> 01:06:15,080
In terms of, I think, what's maybe more valuable is what people watching this, what steps they can take and what steps they can recommend others to take.

544
01:06:15,080 --> 01:06:22,240
And this goes back to the two points that you have to be patient and you have to expect that things may go wrong.

545
01:06:22,240 --> 01:06:28,520
But that doesn't necessarily mean there has been interference and that doesn't mean that the election is invalid.

546
01:06:28,520 --> 01:06:29,980
So, be patient.

547
01:06:29,980 --> 01:06:33,840
Do not assume that results will come out on election day.

548
01:06:33,840 --> 01:06:48,520
It may take some time, but have faith that election officials are doing their best to have an accurate result, that we have process in place, that if interference does occur, we can identify it.

549
01:06:48,520 --> 01:07:02,640
And just, yeah, ultimately the main thing is that the people of America need to have faith in their own elections and that can go away without any actual tampering occurring, without any interference.

550
01:07:02,740 --> 01:07:08,660
Just if the people do not believe that their result was valid, then the result is not valid.

551
01:07:08,660 --> 01:07:27,100
So, I think to everyone watching this, just to understand that what you believe happened matters and just to understand their process in place, their committed election officials, the federal government is here to support that process and, yeah, let's hope that we have a smooth,

552
01:07:27,100 --> 01:07:30,400
free, and fair election in November.

553
01:07:33,360 --> 01:07:34,220
Sure.

554
01:07:34,220 --> 01:07:50,180
So, I mean, I guess, like, to just kind of reiterate what, you know, everyone else says, like, you know, the best defense against any election shenanigans is voting and voting in numbers that are too hard to push one way or the other.

555
01:07:50,180 --> 01:08:04,980
If people go and they vote, especially people who have historically been disenfranchised or haven't felt the need to go vote, you know, it is here at every election, but this election is literally the most important election of your life so far.

556
01:08:05,020 --> 01:08:15,700
And so, go vote and hopefully if enough people do that, you know, any kind of shenanigans will be drowned out by the overwhelming signal that we have.

557
01:08:15,740 --> 01:08:22,680
Me personally, not only am I going to vote early, I'm very excited to do that, but I'll be working the polls.

558
01:08:23,120 --> 01:08:25,100
It's gonna be crazy.

559
01:08:25,160 --> 01:08:28,220
It'll be November and there will be no vaccine.

560
01:08:28,340 --> 01:08:34,800
And so, I will be doing a lot of cleaning and hoping that not too many polls close that day.

561
01:08:35,280 --> 01:08:37,660
You know, there were poll closures.

562
01:08:37,660 --> 01:08:43,940
In our last election here in Texas, there weren't any poll closures like on the day of.

563
01:08:44,580 --> 01:08:46,140
You know, people did show up.

564
01:08:46,140 --> 01:08:48,340
They got enough recruits to come and do the thing.

565
01:08:48,340 --> 01:08:53,660
I did have a couple poll workers not come to my polling place, but we had enough people to pull it off.

566
01:08:53,660 --> 01:09:00,160
So, hopefully that will remain the case, you know, but that's gonna be November.

567
01:09:00,160 --> 01:09:03,400
So, who knows like what the pandemic will bring us.

568
01:09:03,500 --> 01:09:11,900
If it becomes impossible to vote in person in any kind of crowded way, then, you know, we'll just have to deal with that as it comes.

569
01:09:11,900 --> 01:09:26,560
But if you have the bandwidth and the health to throw in for a, what is a super fun, sounds boring, but it's actually pretty fun, like 14-hour day, go with the polling place.

570
01:09:26,780 --> 01:09:28,240
I'll go next.

571
01:09:28,940 --> 01:09:34,680
You know, I will say that I'm very much looking forward to returning to the U.S.

572
01:09:34,680 --> 01:09:36,640
And this is honestly a part of that.

573
01:09:36,640 --> 01:09:45,900
So, again, on a, you know, speaking to the subject matter, but speaking to it from a very personal standpoint, it's like my adopted country is trying to figure all this stuff out.

574
01:09:46,320 --> 01:09:52,900
And I'm looking forward to being past it is something that, you know, it's heavy.

575
01:09:52,900 --> 01:09:53,840
It's everything.

576
01:09:54,920 --> 01:10:01,860
So, aside from that, practically, you know, for the hackers, find out where people are asking for help.

577
01:10:02,280 --> 01:10:03,580
Go help them.

578
01:10:04,140 --> 01:10:06,580
Like, look for the stuff that people have already volunteered.

579
01:10:06,580 --> 01:10:09,800
You know, the volunteering stuff that we talked about at the start, just to reiterate that.

580
01:10:09,800 --> 01:10:11,320
Some of that help might be IT.

581
01:10:11,340 --> 01:10:12,140
Go looking for it.

582
01:10:12,140 --> 01:10:16,680
See if you can find opportunities to provide your skills into those different areas.

583
01:10:17,780 --> 01:10:23,420
Help out on the open-source projects and some of the other things that are going on that have been volunteered.

584
01:10:23,420 --> 01:10:26,560
So, Arlo, we mentioned before, verified voting.

585
01:10:26,560 --> 01:10:27,200
It's up on GitHub.

586
01:10:27,260 --> 01:10:28,900
Go bang on the source code.

587
01:10:28,900 --> 01:10:30,620
And if it's legit, say so.

588
01:10:30,760 --> 01:10:32,900
If there's a problem, submit a PR.

589
01:10:32,900 --> 01:10:34,000
Help make it better.

590
01:10:34,040 --> 01:10:43,760
If these audits are a part of how we have a peaceful kind of acknowledgment of the count after the fact, then you'll have played a pretty big role in that, I think.

591
01:10:43,900 --> 01:10:48,040
And then, finally, you know, don't scare your grandma between now and November.

592
01:10:48,040 --> 01:10:54,940
If you're doing security research and you find something, you know, talk to Jack and the crew at CSIR and CERT.

593
01:10:54,940 --> 01:10:56,100
Try to talk to the vendor.

594
01:10:56,180 --> 01:11:09,400
Just be very mindful of the fact that dropping any kind of anything that looks like a vulnerability on the internet right now is highly, highly exploitable from actors, from a disinformation standpoint, and you don't want to be a part of the problem.

595
01:11:09,860 --> 01:11:16,680
Technically, over the last couple days, because July sucked when it came to VOMS, or at least people had to clean up after VOMS.

596
01:11:16,680 --> 01:11:18,660
So, let's make August better.

597
01:11:19,960 --> 01:11:25,120
It's DEF CON month, so the internet's on fire this month anyway, but maybe after that, I don't know.

598
01:11:25,120 --> 01:11:28,080
October, let October be quiet then, that's cool.

599
01:11:28,240 --> 01:11:29,540
Kimber, any last?

600
01:11:33,020 --> 01:11:43,840
It's unprecedented, so it's anyone's guess what actually happens on Election Day and the months following.

601
01:11:47,080 --> 01:11:49,540
Vote, just vote.

602
01:11:50,560 --> 01:11:54,380
Tell your friends, tell your family, vote.

603
01:11:54,380 --> 01:11:55,860
Vote safely.

604
01:11:56,460 --> 01:11:58,440
Vote mail-in if you can.

605
01:11:58,940 --> 01:12:08,880
If you pay attention, your state may have deadlines or your district on when you have to let them know that you're going to be voting by mail-in ballot.

606
01:12:08,880 --> 01:12:14,120
Some folks here didn't understand there was a two-part process to mail-in ballot.

607
01:12:14,120 --> 01:12:16,660
You had to request one to receive one.

608
01:12:16,660 --> 01:12:19,440
It didn't automatically get sent to you.

609
01:12:19,520 --> 01:12:28,040
So, just being aware of how your local districts work when it comes to mail-in ballots so that you can participate.

610
01:12:28,120 --> 01:12:46,940
And if you have to go to the polls, wear a mask, social distance if you can, and you don't have high-risk folks at home, volunteer at your local polling places and do what you can to make it safe for our most vulnerable populations to be able to get out and have their voices heard.

611
01:12:48,300 --> 01:12:51,960
Well, yeah, that's a great thing to end on.

612
01:12:52,060 --> 01:13:00,400
Obviously, I have a spouse who's immunocompromised, so I've preemptively requested a mail-in ballot.

613
01:13:00,400 --> 01:13:13,340
I know some states require an extenuating excuse in order to get an absentee ballot, so please check with your local officials on what you can do to do that.

614
01:13:13,660 --> 01:13:20,680
Obviously, you know, a safe and secure voting is important, but safe and secure also means individuals as well.

615
01:13:21,080 --> 01:13:23,060
With that, I'll close out our panel.

616
01:13:23,060 --> 01:13:29,540
I do appreciate Kimber, Jack, Casey, and Todd for joining us this evening for the recording.

617
01:13:29,740 --> 01:13:31,920
Again, this was the election security part two.

618
01:13:31,920 --> 01:13:34,260
The infrastructure strikes back.

619
01:13:34,260 --> 01:13:43,220
While I can't necessarily drop in some John Williams here, use your mind's eye as well as the Starfield background to kind of get it through.

620
01:13:43,440 --> 01:13:47,980
And hopefully, come November, we'll see what kind of shakes out.

621
01:13:47,980 --> 01:13:53,020
And geez, maybe next February we'll have a cleanup on this, maybe a part three.

622
01:13:53,180 --> 01:13:56,400
Hopefully, it doesn't end up with a bunch of Ewoks running around saying ugnug.

623
01:13:56,400 --> 01:14:00,180
But anyhow, once again, thank you very much and thank you for your time.

624
01:14:00,460 --> 01:14:01,140
Take care.