start	end	text
5000	10500	Hi, welcome to Election Security Part Two, The Infrastructure Strikes Back. My name is Amelie
10500	16780	Coran. I will be your panel moderator for this session here. Little did we suspect that this
16780	22020	set of panelists would be back together six months later to discuss where we are versus where we were
22020	26640	when it came to election security in the upcoming November general election. Since then, to say it
26640	31680	lightly, things have gone off the rails, given that you now see us via video in our pandemic
31680	37360	past. We've had a highly contentious Democratic primary season, some technical glitches supporting
37360	41660	such primaries, court cases regarding in-person voting, and enough various disinformation
41660	46360	campaigns to last another election. One thing that hasn't changed is the lineup of our esteemed
46360	52960	panel from ShmoopCon. And tonight we have Kimber Dowsett, Casey John Ellis, Jack Cable, and Todd
52960	59980	Beardsley. I will then let them introduce themselves with a short intro. I am Kimber. I am
59980	65700	the director of security engineering at Trust. That's Trust.Works, a software infrastructure
65700	72780	company based out of San Francisco that works with both the public and private sectors. Hi,
72780	78960	my name is Casey Ellis. I'm the founder, chairman, and CTO of BugCrowd. We run crowdsource security
79500	85640	as a service programs, including vuln disclosure, bug bounties, crowdsource pentest, and so on.
85640	91200	And yeah, great to be... unusual to be talking about this with all the additional content,
91200	96460	but very good to be talking about it again. Everyone, my name is Jack Cable. I am an election
96460	102140	security technical advisor for the U.S. Cybersecurity and Infrastructure Security Agency,
102140	108540	which is essentially the nation's risk advisors. We advise states and localities on the risks
108540	113880	associated with different technologies, provide cybersecurity assessment services, so that they
113880	120400	can make the best decisions to have a safe and secure election. Besides my work at CISA,
120400	126180	I am a student at Stanford and a security researcher. Cool. And hi, I'm Todd Beardsley.
126180	133320	I'm a director of research at Rapid7, a U.S.-based cybersecurity company. I personally care a lot
133320	141560	about elections. I am usually an election judge in Texas, and I have a deep background in hacking,
141560	147620	offensive security, research, vulnerability analysis, stuff like that. And congrats to
147620	155340	Jack for the level up since our last meeting. He gets a bunch of power-up points on that one.
155340	161380	That's awesome. So we're going to break this down into two sections, I believe, unlike last time,
161380	167900	but mainly kind of a catch-up, a first section here about what has happened since February. So
167900	173500	obviously a section B, we're coming up on about 90 days until the general election,
173500	179000	and what we can do between now and then, since the timeline is definitely shorter,
179000	185160	but also what kind of activities are going to be carried forward from them to the next election,
185160	191340	next primaries, or just in general, lessons kind of learned. So with that, we have ourselves a
191340	195860	first question here. So we find ourselves here again after six months, and there's been a lot
195860	200440	going on that we didn't cover back in February. However, regarding one of the last takeaways from
200440	204740	closing that panel, we noted it was important to engage your local board of elections. And with
204740	216160	that, where do we stand? Wow. Well, let me start this off. I engage with my local board of elections
216160	222140	by being an election judge. I ran a polling place not too long ago about, we're recording this on
222720	230380	end of July. So for me in this time stream, this is about three weeks ago, there was a
230380	239780	special election and a runoff election combined here in Texas. It was pretty fun.
239780	245900	I never knew that, like, wiping down voting, you know, polling places would be so rewarding.
245900	250900	I got to feel like I was battling COVID, like, every five minutes, you know, helping people out,
250900	258900	and so like, and for that, at least for me, like, I felt like I was really, I was doing something.
258900	265100	I did notice through training and then on election day, you know, the demographics have
266140	272840	switched over quite a bit on who is working in the polls. Like, it is very common normally to
272840	277880	see a lot of retirees and just, you know, older people who are there to help out and help out
277880	284500	their communities in this way. I was not the youngest person at this polling place, which was
284500	292700	first for me. So if you have the opportunity and the inclination, and don't mind doing a
292700	298640	whole lot of cleaning all day long, you know, maybe volunteer to work in a polling place come
298640	305380	November. Anybody else? Yeah, I mean, what has happened since then, I think, you know, in terms
305380	313320	of rocking up and helping out, it's fair to say that any intention to do that would have been a
313320	319860	little distracted by, you know, March and so on. But I think, you know, Todd's example of
319860	326060	just doing what's needed, especially with the pandemic and, you know, the changes in
326060	330240	operational considerations around actually running an election, still true. It's even more true now,
330240	338400	than it was. As the token non-citizen on the talk, I mean, this is even more foreign
338400	343640	interference now than it was when we gave the talk, because I'm actually in Sydney at the moment.
344760	348880	But, you know, part of what we've been working on, what I've been working on, and a bunch of
348880	355100	other people have been working on is, you know, standardization of, like, how do we make adoption
355100	360380	of vulnerability disclosure programs and the implementation of policy, specifically for 2020,
360380	365400	with all of the, you know, unique considerations this year has, how do we make that as easy as
365400	372820	possible for the states and counties? So we updated a version of the language on disclose.io,
372820	378880	which is an open source initiative to basically make it easy and make it as standardized as
378880	384660	possible. That came out after the talk, and it's been good. I think, you know, at the very least,
384660	389660	that's actually served to get a lot more people thinking about doing that, that maybe weren't
389660	394140	before, because that kind of blocking function of how do I even engage with the hacker community
394140	397680	in the first place was, I think, pretty difficult for a lot of people to even consider.
397680	403180	Early to echo, yeah, Casey's point there, I think, yeah, something I've been involved with and
403180	411180	pushing for is states and vendors to establish these vulnerability disclosure policies.
411180	417320	On the CISA side, we are releasing guidance to election officials in order to establish
417320	422360	vulnerability disclosure policies, essentially saying, if you want to do this, this is the best
422360	428320	practices that you can follow. A lot of that is drawn from CISA's directive, the Binding
428320	433740	Operational Directive 2001, which is a draft directive that will require all federal agencies
433740	438220	to start a vulnerability disclosure policy. Yeah, that was a good deal, by the way.
438740	443420	Yeah, I think, yeah, really looking forward to see that come out and see the positive security
443420	448140	effects that can have all across the federal government. But of course, CISA doesn't have
448140	454280	that same authority over states. So we're essentially putting out guidance, giving them
454280	459980	the best practices and the resources they need to start this themselves if they want that.
460060	466340	And then, of course, yeah, besides that, just phone work I've been doing, yeah,
466960	471260	clearly I'm not at the local level, but the federal level. And I think that there's really
471380	477000	a lot of ability there to kind of have an impact at scale of working with all 50 states,
477000	484180	working with a significant portion of the localities of the counties that are out there.
484240	489320	So I think that's a really great opportunity to be at CISA and have this kind of wide-ranging
489320	494680	effort, wide-ranging effects that I'm not sure you can have anywhere else with election security.
494680	501660	Kimber? Yeah, I'll jump in. It works out well since Jack touched on Casey's point. I'm going
501660	507080	to touch on Todd's point. The prompt was, you know, what's happened since February?
507340	515600	And the answer is a pandemic. So the reality of a lot of the election security
516220	520340	things that we would normally talk about and that we will touch on today
521120	526920	still rely on people being able to actually get to the polls to vote in states that aren't going
526920	535520	to allow mail-in ballots. So I think it'll be a nice segue into a lot of the misinformation
535520	542680	we're hearing about mail-in ballots. But to Todd's point, we can scream to the skies that
542680	550320	mail-in ballots are perfectly safe and reasonable and actually help disenfranchise voters however
550320	556100	voice. But there are going to be some places that insist that folks go to the polls and somebody's
556100	562860	got to be there to man the polls or we're going to end up in a different type of disenfranchisement,
562860	569100	right, where people are lined up for 20 hours because there's three poll workers, you know,
569100	576200	for thousands of people who want to vote. So it's important to know what's going on in your
576200	583420	voting district and if your voting district allows mail-in voting, great, cool. But if they don't,
583420	589080	like, that's a perfect opportunity to get involved. And I understand that it's asking
589080	596060	you to put yourself at risk, too, and that sucks, right? It is, yeah. That's where we're at. I am shocked.
596060	603140	I had a COVID test about four days after election day and I am shocked I did not come up
603140	608700	positive. But hey, you know, turns out masks and hand cleaning and surface cleaning works, though.
609160	612680	Yeah, you know, kind of the follow-up on this, too, is, I mean, obviously,
613320	618780	the curveball that we're thrown was the pandemic and, you know, as Todd mentioned that, you know,
618780	623540	primarily a lot of the election workers, you know, that were counted on by various precincts
623540	629220	and states in general were retirees and those who, you know, I hate to say it, have more time
629220	634580	on their hands. You know, this is obviously going to be proving a challenge for staffing and it
634580	638980	runs headlong into the issues, you know, obviously some of the disinformation that's been spread about
638980	644380	mail-in voting. You know, are there any particular ways that we can kind of mitigate or address any
644380	649760	of these issues that are novel? Obviously, we're running, you know, headlong against, you know,
649760	654380	people pushing back on the mail-ins, but then we have the reality of, you know, folks potentially
654380	660260	exposing them to a deadly virus. I hate to run the gambit of talking about, like, e-voting,
660260	665940	but obviously there are other ways to, you know, look at, you know, potentially extending voting
665940	672680	times, alternating places where people can vote to reduce exposure. Are there any other, you know,
672680	678660	methods that, you know, potentially the EAC and others can address in this case? In before
678660	687360	blockchain? Yeah, I wasn't there. You have to drink now. So, I mean, e-voting is a non-starter,
687360	694480	right? Like, we're recording this and it is today, 97 days, by the time this airs, it'll be about 90
694480	702600	days before the election. And, you know, West Virginia is doing their thing and good for them,
702600	708080	but no one else is. I don't see anybody having any plans for that right now.
708660	714880	Maybe someday in the future, you know, e-voting will be a thing, but I don't, I don't, I think
714880	720520	the easiest way to get people to the polls in states that don't have mail-in ballots is
720520	727800	extending, you know, early voting. I mean, that's a thing. Texas, I'm in Texas right now, so great, Texas.
728240	732580	We're bad at mail-in ballots, but we're apparently really good at early voting.
732580	738920	My voting, my first day to vote in November will be October 13th, so that's a stupendous amount
738920	744880	of time, way longer. And so that'll be, that will help at least give people an opportunity to get
744880	749160	into a polling place where maybe it's not so crowded. Last day of early voting is super crowded
749160	755600	and election day will be super crowded. So, you know, if you can vote in that early voting period,
755600	761800	I strongly suggest you do. That, you know, it doesn't help any of the I.T. problems that we
761800	767680	talk about and that nominally this panel is supposed to be about, but it does help the, like,
767680	774700	not getting COVID. So, which, you know, might be a little more important. Amber? I want to, plus
774700	784640	one to the adding more polling places because we know social distancing is huge to prevent the
784640	791140	spread of COVID. When we have communities like mine where there's one polling place downtown
791140	797580	and then one local school, then we have basically the town split in half to go to these two polling
797580	805920	places and it gets kind of crazy. Holding people to districts, we see some gerrymandering, right?
805920	810900	They'll draw a line right through the middle of the university so that half the university
810900	817080	students think that they're supposed to vote at one place and it's really the other. So, you know,
817800	823860	if they're going to say no mail-in ballots, then why not say, but all the schools in a single
823860	827200	district can vote and if you're eligible to vote in one, you can vote in any of them
827200	835720	so that folks can at least get to the closest, you know, place. And we do our best to, like,
835720	841640	disperse the population, but a lot of towns have a couple polling places. They're almost always
841640	849700	schools, which who knows if schools will even be open, but if they are, you sure don't want to have
850420	854420	a hundred thousand people rolling through a school that children are going to be at the next day,
854420	861260	right? Like, so there's physical considerations that certainly were not part of our equation
862040	867940	in what, February 1st, when we jammed through all the things we think could go wrong.
867940	876360	This was not on my bingo card. No, no, no. So the thing that's, to me, that's new
877220	883240	is, and I've actually, I've heard Todd say this in a panel on this before, you know,
883240	891640	democracy does rely on the peaceful concession of whoever loses. So the increased likelihood of a
891640	898440	hanging count because of mail-in voting and the changes in the process and different things like
898440	904220	that, I think there was a lot of conversation back in January and prior around the role of
904220	912980	risk-limiting audits to basically, you know, say, no, this is not like any accusation of fraud can
912980	919040	be basically confirmed or denied at that point. Projects, you know, to give a shout out to is
919040	925720	Arlo. ARLO, which is essentially a framework for that, that I believe is funded by CISA
926440	931760	and is open source. And something that I've been trying to encourage people in the security
931760	937360	research community to do is to go bang on that, actually go look at it from a security standpoint,
937360	942820	because ideally if there's any point in time over the next six months where Arlo itself gets
942820	948800	called into question as a tool to rebuff, at least at that point we can say, no, we actually
948800	954680	went through this and it seems legit. So that to me is new, like that was always going to be some,
954680	960340	to some degree of risk, as it always is. But I think that's actually a far, that's going to play
960460	965320	a far greater role actually post-election, on election day and post-election day in 2020.
965760	971300	Yeah, I think they covered a little bit of that on the HBO special of Hari, as well as, you know,
971300	976220	I think it was the second half of the documentary was regarding the risk-limiting audits. I don't
976220	981140	know if they necessarily had a really good explanation of how it all works. That is a
981140	985780	little extra math for most folks, but, you know, it's one of those good things that can be put in.
985780	991620	I think, and looking at, looking at, so, you know, calling myself out as this was a theme,
991620	998960	and the last time we got together as well, acronym, de-acronyming stuff. So risk-limiting
998960	1005460	audit is what RLA stands for. I think it's verified voting, who are running point on it,
1005460	1011960	and they've done some pretty, I think, good work on explainer videos that take some, you know,
1011960	1018680	fairly complicated math and kind of simplify the concept to the point where a non-technical
1018680	1022760	potential voter can actually consume it and understand what's going on. It's essentially,
1023680	1031040	you know, a cryptographically determined sample, random sample set that's then paired with
1031040	1037200	verification of the outcome compared to what's recorded. And if there's any sort of deviational
1037200	1041440	margin of error within that sample set, then it goes again and goes again and goes again until
1041440	1046620	it can work out the scope of that. Or, you know, if everything checks out, then everything checks
1046620	1051960	out and things are okay at that point. It's the randomization and the process around it that I
1051960	1057440	think is, to your point, difficult to explain on a technical level to most people, but I think the
1057440	1064800	concept itself is actually fairly easy to grow. Great. And just to kind of go back a little to
1064800	1069840	our discussion on the different kinds of voting options that there are, it's clear that the
1069840	1076780	election is going to be run a little differently this year. Just with the constraints we face,
1076780	1082700	election officials have to provide an accessible and safe method of voting for their voters. And
1082700	1087820	what this means is essentially from CISA's perspective, we want to limit the risk as much
1087820	1092940	as possible with these options. So, for instance, talking about online voting, also called
1092940	1098540	electronic ballot returns, CISA has assessed that that is high risk. Even with controls in place,
1098540	1104140	the risk there still cannot be controlled. And it's not CISA's job to decide whether these are
1104140	1110820	deployed, but it's our belief that the risk on these is much higher than, say, compared to in-person
1110820	1116620	voting or mail-in ballots. So on that end, CISA has put out a series of documents essentially
1117320	1124800	describing, from a procedural sense, what kinds of options election officials have,
1124800	1130580	both to ensure safe in-person voting and then also to make sure that mail-in balloting process
1130580	1138440	goes smoothly. And just to touch on some of the in-person voting options there, it is very true,
1138840	1143800	like Todd was saying, that the truth is a lot of these poll workers are older and they face
1144220	1150020	a higher risk of being impacted by the virus. So there's going to be very high poll worker
1150020	1155360	shortages. And in a lot of cases, that means consolidation of polling places because they
1155360	1160500	can't staff that many. And that, of course, can lead to problems because then you have more people
1160500	1167580	in fewer places. With a pandemic, that's, of course, not ideal. But we have to make it work.
1167580	1174780	So one option there is vote centers, for instance, where larger physical polling places that make it
1174780	1181400	easier to maintain physical distance. There's, of course, still a polling shortage. I guess here
1181400	1186760	I'll say to everyone who is young and healthy, the best thing you can do is serve as a poll worker
1186760	1193180	and make sure that on a local level your elections run smoothly. But yes, it is going to be a
1193180	1200100	challenge just because, yeah, of course, in-person voting carries some risks with it from a health
1200100	1207960	perspective. So we encourage states to make the decisions that best fit them. But both mail
1207960	1214200	invalidating and in-person voting we view as being low-risk options given that there's a paper trail
1214780	1219800	and you can run, say, risk-only audits on those. Well, so I'm going to take kind of a little bit
1219800	1224240	of a left turn. I know, you know, we just full transparency for folks who are watching this,
1224240	1227440	like we have a list of questions that we've agreed on, but I'm going to kind of combine
1227440	1232500	this because of the way the flow is. You know, one of the things that's amazing about, like,
1232500	1237340	where we live, we're in the United States here, and Casey accepted, but yeah, we will adopt you
1237340	1242160	on this one. Most of the time. You know, is the freedom of speech, you know, it's part of the
1242160	1248360	our own constitution and whatnot. But, you know, as we mentioned in February, you know, one of the
1248360	1254260	critical things about this election is how we talk about it, whether it be through discourse
1254260	1261060	about outcomes, whether it be the primaries or the general election, the methodologies we use
1261060	1267000	to do that. So we, you know, talk about the press about, like, how things have gone, the process of,
1267000	1271980	you know, how we go about voting. But also, you know, it's another thing called disinformation
1271980	1281060	or misinformation where, you know, what we talk about is willingly bad, essentially not right
1281060	1288320	when fact-checked, or in some cases, is disinformation provided by an actual entity.
1288320	1295840	I know, you know, with the 2016 and earlier, the recent, the midterms, we had influence from
1295840	1301720	outside sources. And obviously, you know, Washington Post just recently kind of covered
1301720	1306780	that we're potentially seeing some influence from China and Iran and some of our other,
1306780	1311500	you know, would classically qualify them as adversaries, but yet we still find some ways
1311500	1316500	to deal with them. You know, where do we kind of find ourselves in this case right now? Obviously,
1316500	1321260	you know, six months later, you know, we had a little bit of a kind of, I wouldn't say necessarily
1321260	1328060	contentious Democratic primary, but, you know, it was a lot more graceful when people, you know,
1328600	1334160	basically, you know, said, yeah, I'm out, and let people carry forward. But also, you know,
1334160	1340400	in recent news about how people are talking about, you know, the legitimacy of the methods that we're
1340400	1345940	using, where do you kind of see ourselves now? And what can we do in the future here,
1345940	1352620	as folks who are attendees to this video, but also, you know, as responsible citizens to kind
1352620	1357340	of educate others, your parents, your friends, your peers, your neighbors, and so forth to
1357340	1368900	be on the lookout for this? I'll rush into the fire. I think an interesting thing that I've seen
1368900	1376900	is that, yes, when we did our panel back in early February, which seems like so long ago now,
1376900	1384720	I think that we could pretty clearly say, like, Russia. We're seeing the Twitter bots,
1384720	1391380	the farms, we're seeing, like, the disinformation campaigns on Facebook, Twitter, IG.
1392140	1400400	Now, it's much more complicated. So, the interesting thing that we've seen now are,
1400400	1407560	well, I feel like it's interesting, because I'm a, you know, social media nerd. The QAnon accounts
1407560	1415300	that have popped up seem to span the gamut of countries. And you see a lot of activity from
1415300	1422000	these QAnon accounts just coming from the U.S. And they're not, like, some, you know, complex,
1422860	1429280	combative nation state, right? They're from just, like, diehard MAGA people who are like,
1429280	1434560	I'm going to do my duty, and this is patriotic, and they are figuring out how to spin up bots.
1434560	1438980	And so, that's pretty interesting. And then to see
1441180	1449680	bots that will respond to Trump accounts, right? Or the interesting thing that I see a lot, too,
1449680	1456140	are accounts that get a lot of followers because they'll post pornography, right? And then they
1456140	1462000	get, like, loads of followers. And then they get verified in some cases. And then as soon as they
1462000	1467660	get the checkmark, they switch to, like, QAnon accounts that have given themselves some name
1467660	1472080	that you can recognize in the media. And all of a sudden, you think you're engaging with someone
1472080	1477520	that you're not engaging with. But what that does is have this, like, celebrity or verified
1478740	1487940	boost of this misinformation. So, for me, as a person who has a blue checkmark,
1487940	1494360	I want to say, I don't know anything. I'm not an expert on any fucking thing.
1494360	1499040	And I'm going to tell you flat out that, like, you'd be hard-pressed to find a blue checkmark
1499040	1506300	that is an expert on everything. So, if someone gets their blue checkmark for being an actress,
1506300	1512960	like, maybe don't just immediately trust that they're an expert on vaccination protocol, right?
1512960	1521120	So, I think that it's really fascinating how the floods are coming and the stuff that Cambridge
1521120	1528720	Analytica did, it's all still happening under a different name, a different company,
1528720	1534900	but it's all still out there on Facebook and Twitter. It's just, like, now more people from
1534900	1540820	different countries, including our own, are able to participate in the disinformation process.
1541240	1548060	Yeah, I'll tag in on that. Just confirm what you're saying, like, the QAnon stuff and things
1548060	1555280	of that nature, they're happening on the ground here in Australia. I think for, you know,
1555280	1561200	for ostensibly different reasons from a partisan political standpoint, but it's kind of coming from
1561200	1569240	the same mindset. And I think in part, like, we're all going a bit stir-crazy right now. It's good
1569240	1574800	not to ignore the fact that society just in general is dealing with mental stress that we've
1574800	1580880	not seen collectively for as long as Twitter's been around, definitely. So weird shit happens.
1581720	1586620	But yeah, there's that piece of it. I think, Kimber, you touched on a really good point. I
1586620	1594560	actually got invited to talk about disinformation on a friend who has a cooking channel. She's got,
1594560	1602200	like, millions and millions of subscribers, but she saw basically bot, like, advertising-focused
1602200	1609180	bot-generated content, ripping off her stuff, and then noticed that there was subversion starting
1609180	1615240	to creep into that, and then the ability for that type of channel to be used. That's so crazy.
1615680	1620500	It's nuts, man. And I'm like, what am I doing on a cooking channel? This is crazy. No, they have an
1620500	1627940	entire channel on this, like, basically debunking some of these bots or the content farms.
1628380	1634340	So it's a real thing, and I think the ability for that sort of thing to be deployed very rapidly,
1634340	1639900	because these are businesses. It's businesses that exploit the things that are exploitable to
1639900	1643640	build following on social media in some of the ways that Kimber just described, but then they
1643640	1649760	sell that or rent that, or if they're owned, you know, potentially by, you know, an actor that can
1649760	1654260	go hostile, it's redeployed into that. And that's happening across all sorts of different channels.
1654260	1659880	The one you asked, Amelie, about, you know, things that we can do. I think something that
1659880	1668500	we can all agree on. The great hack, for example, just as a, you know, a way to get people that
1668500	1674260	aren't necessarily technical in a context that's apolitical. So you're not sort of going one way
1674260	1678860	or the other too much. You're just explaining to them this general idea that, like, social media
1678860	1685260	is a constructed reality that's been built just for you. And you actually need to be
1685260	1690180	observing it like that. I think, you know, for the hackers that are kind of watching this,
1690180	1693680	that's probably a thesis and something that's important that we could all agree on.
1693680	1698620	And I found that to be fairly helpful. Great. And just to talk briefly on foreign
1698620	1704920	disinformation, of course, that's a very large concern. We've seen in 2016 what happened,
1704920	1710180	and in 2020, it seems to be shaping up again. We know, yes, our nation's adversaries, Russia,
1710180	1715360	Trump, China, Iran, are all targeting, trying to interfere in our democratic processes.
1715620	1720460	So from CIS's perspective, our number one priority is to ensure that Americans decide
1720460	1727700	American elections. So that means ensuring that foreign adversaries are not able to interfere,
1727700	1733700	whether that's by actually targeting election systems, whether that's disinformation campaigns,
1733700	1740220	all that. It should be Americans who are deciding American elections. So that kind of
1740220	1745780	leads us to the point, then, what steps can Americans take to mitigate the impact, say,
1745780	1752920	of disinformation or just general confusion, say, on election night? I think the most important
1752920	1757400	thing here is just to understand that elections are going to be different this year. Election
1757400	1763300	night, November 3rd, is not going to be the same as election night in the past, because with many
1763300	1769480	more mail-in ballots, they're going to take much longer to count, just due to state laws and
1769480	1775900	processes around that, as well as just technical constraints, since some states are rapidly
1775900	1781660	scaling out mail-in ballots at a scale that is maybe tenfold from what they previously had
1781660	1789660	operated. So with that perspective, election night, it is entirely possible that it just isn't
1789660	1795060	what the election results are. And it may take a week, it may take several weeks to actually
1795060	1800440	learn what the final results are. So the best thing that Americans do is to just internalize
1800440	1806020	this to understand that election results are not going to come out immediately. Media has
1806020	1811340	an important role in this, that it can't just be election night, the final results, declare who won,
1811340	1817320	because we have to acknowledge that might not be the case. So I think that if we all are on the
1817320	1823120	same page, expecting this to be a slower process, and keeping in mind that a slower process means
1823120	1828640	that there's more time to actually verify that results are correct, and to ensure that
1830020	1835960	the final count is ultimately the right one. So I think just understanding that patience is
1835960	1841520	needed here, and that election night, not going to know who won, may take some time,
1841520	1845360	but we'll get there, and we can be confident then in the outcome of the election. That's
1845360	1850360	the important thing. Yeah, and just to follow up on what Jack said, is like, election night is not
1851100	1858020	the end of this, right? Like, for starters, like any kind of disinformation campaign that we've been
1858020	1862920	talking about, that's going to happen way before election day. Like I mentioned, I get to vote on
1862920	1869620	October 13th, so, you know, look for something exciting happening around, I don't know, first or
1869620	1879720	second week of October. Almost, like, that's the time when your fear ganglia should flare up
1879720	1885760	around what's going to be happening around disinformation. And just one other
1885760	1892920	super quick point, Jack is also totally correct that I would be shocked if we had results
1892920	1896800	election night. Now, it doesn't mean it's the end of democracy. Like, there will not be rioting in
1896800	1901560	the streets over this. We've done this before. Like, the 2000... some people on this call are old
1901560	1907220	enough to remember the 2000 election. And we remember that, like, that was weeks and weeks
1907220	1914320	and weeks of will they, won't they, which ended up in the Supreme Court decision. So, like, that did
1914320	1920980	not destroy America. And not having election results at, you know, 1am on November 4th is not
1920980	1926060	going to, it's not going to kill everybody. Like, we'll be fine. We'll be fine. Yeah, that does bring
1926060	1929920	up a good point, you know, or subsequent question here, you know, it's kind of talking some of the
1929920	1935800	logistical errors. You know, just to put on an election is not as easy as everybody kind of
1935800	1939740	thinks. Like, you just go in there and pull the handle if you're a manual or you... It is way more
1939740	1945440	complicated. It is way more complicated. I mean, you know, just watching Matt Blaze's Twitter feed
1945440	1950640	sometimes and just how simplistic some of the suggestions are. And then, of course, Matt being
1950640	1956040	Matt kind of fires back in Matt's way and whatnot. And that's not a knock on him. It's just a
1956040	1962080	try to educate people that, yeah, this this shit ain't simple. You know, as much as I railed on my
1962080	1966360	trip to the DMV recently, you know, I sat in the car and kind of pondered everything required to
1966360	1971680	kind of make my trip better. And I'm just like, oh, my God, that's that's a lot to move. That's
1972140	1977280	Sisyphean in a way. But, you know, obviously, one of our one of our bigger challenges, obviously,
1977280	1984520	the thing that made the biggest press right after our February conclave here was the Iowa caucus.
1984520	1989740	And I wrote a long paper on this about the whole DevOps process in regards to how it was developed.
1989800	1994460	But, you know, the Iowa caucus with the Georgia primaries, which, you know, some would say was
1994460	2001160	kind of a predictable outcome of, you know, what kind of a clusterfuck it would be. But, you know,
2001160	2006620	that's the other the other issues underscore the potential about how trust is eroded through
2008240	2013800	procedural process error by no fault or intent of the creator of that error. It was more or less
2013800	2022020	like we're forging new areas of election things we can do and mistakes will be made. You know,
2022020	2026660	there was no necessarily evidence when one looked at that, you know, interference necessarily
2026660	2035200	occurred. But, you know, when you know, basically, these things that we do in so nice a word,
2035200	2040520	shit the bed, you know, what are the different ways that we can as professionals in the security
2040520	2046400	and election security arena kind of capture the discussion and say, you know, this shouldn't
2046400	2055860	erode trust. This is us trying something new. Mistakes will be made. Morale will be, you know,
2055860	2060420	lowered. But, you know, what are some things at the technical level to kind of, as I mentioned,
2060420	2064660	you know, you have a lot of technical people that will swoop in and say, oh, we can fix this with
2064660	2072560	blockchain, for instance, as Casey so lightly joked about. But, you know, what are some practical
2072560	2078040	techniques we can have to kind of educate some people on like, no, no, no, this is a big ship
2078040	2085120	to steer, you know, this is what you can expect and, you know, don't lose trust in this.
2085920	2091760	Great. So first, just to really underscore the point that running elections is incredibly hard.
2091760	2098300	There's so much more than just kind of from a voter's perspective showing up to, say, a polling
2098300	2103140	place, casting your ballot. There's so much more that goes into this process. So many months of
2103140	2109060	preparation. That's a difficult task. And every single election official I've talked to is
2109060	2120520	incredibly motivated and wants to make sure that elections run smoothly and that their people can,
2121160	2127420	so just thinking about going back to February, say, was already shaping up to be
2127960	2132460	perhaps one of the hardest elections that an election official has had to run just because
2133160	2138840	we are in an incredibly polarized environment. We know that there is foreign interference that
2138840	2144300	occurred in 2016 and we can expect again in 2020. So even from that perspective,
2144780	2149960	this was a hard task. And then you add the pandemic and everything becomes so much more
2149960	2154260	complicated because suddenly we can't vote entirely in the same way as we're used to voting
2154260	2160600	and all of these processes have to change. In a lot of cases, like I said, election officials now
2160600	2167820	have to scale out mail-in ballots at 10 times the capacity. And when your machines process those,
2167820	2173300	we're only intended to do, say, a small percentage of voters in your jurisdiction.
2173320	2179060	From a technical perspective, that can be very difficult and things can break because we're
2179060	2184520	rapidly scaling out these technologies and things can and likely will go wrong.
2185560	2190960	So from that perspective, what should voters expect? So I said before, be patient. Election
2190960	2195980	results may not come in immediately and that's fine. I think the second point there is really
2195980	2203360	to expect things to go wrong, but don't immediately believe that that is a result of interference of
2203360	2210540	any kind because the most likely explanation is that's just some routine error that occurred and
2210540	2217260	that will be worked through. There's processes in place in order to handle these types of failures.
2217260	2223500	We have, for the most part, paper trails that allow verifying elections. So from that perspective,
2223500	2229360	we have controls in place. And yes, technology can be brittle and stuff can break down,
2229360	2235140	but a lot of times just look for the most likely explanation that, of course,
2235140	2241480	interference is still possible and we should be very concerned if that does happen.
2241600	2249080	But just looking from kind of what is most likely to happen, it's more likely that, I mean, we can
2249080	2253460	almost assume that some technical failure in some capacity will occur, but that doesn't mean that's
2253460	2259140	malicious and the people just have to view it as that way and understand that there are still
2259140	2264500	controls in place. Yeah, Occam's razor is good. I can't remember if it's Hanlon's razor or Occam's
2264500	2273080	razor, but it's one of the razors. I think it's Hanlon's. Yeah, anyway. Yeah, well, simple ends
2273080	2278040	malice. Anyway, whatever, because we can probably look that one up after the fact and I'm outing
2278040	2285620	myself for not knowing which razor is which right now. I'd add to that, no new stuff in 2020, like
2285620	2291280	timeout, you know, like there's a whole bunch of innovation happening in the election space,
2291280	2295040	which I think is fantastic. And I think it's important. It's going to be critical
2296000	2303220	after this is done. But, you know, the addition of variables, you know, the idea that
2304100	2309580	there's like software fails, which is the second point I'm going to make, but like it's
2309580	2315500	the failure rate of software is directly proportional to how quickly it's been brought
2315500	2320920	to market and oftentimes how mature it is. So this idea of like, cool, let's just blast
2321620	2325260	2020 with a whole bunch of brand new stuff that we haven't really tested. You know, ultimately,
2325260	2330740	when you go back to Iowa and do a bit of a root cause analysis, that's sort of most of what
2330740	2336780	happened there. It was less than six weeks of the analysis. Yeah. Yeah, it was. And it's logically
2336780	2340400	what would happen again if we do it with other stuff. So no new stuff. But then this other idea
2340400	2345780	of like software, you know, in terms of, again, coming back to how we can help, like humans aren't
2346240	2352520	humans make mistakes, period. Like this is why, you know, we've got an industry is because,
2352520	2356680	you know, while we come up with all these incredible ways to do stuff, including democracy
2356680	2362580	itself, we do make the occasional spelling error. And then there's bad people that want to
2362580	2367560	manipulate that to get what they want. So this idea of like to err is human, it's more about how
2367560	2373460	you respond. Again, it's part of what I like so much about, you know, vulnerability disclosure
2374400	2379380	as a process, but also as this like leading indicator of maturity when it comes to security
2379380	2385340	of an organization that can translate to trust. I think that's a concept that isn't very well
2385340	2390920	understood. And I think a lot of the time people, you know, on the operations side would prefer to
2390920	2396280	do ostrich risk management and pretend it didn't exist. But I think it's going to become
2396280	2402440	pretty important in context of all of the stuff that can and probably will go a bit funky this
2402440	2411900	year. Casey, you have some of the best vuln disclosure jargon around. I've been practicing.
2411900	2419240	Yeah, a little. Yeah, like I guess I would just say as technical people who are probably
2419240	2425220	the only people watching this, you know, I think what you can you can do your part by
2425760	2431900	not freaking the hell out when you see something that goes wrong. Like, you know, just to echo,
2431900	2436300	you know, Jack and Casey, it's like it is it is a hand lens razor kind of thing. There will
2436300	2442880	probably be mistakes. You know, I don't I don't think I would go so far as to say like it's super
2442880	2447380	I've got the Metasploit shirt on. It's very hard for me to say like don't disclose vulnerabilities.
2448100	2455340	But, you know, maybe not on Election Day and maybe not make a bunch of hay about like hackable
2455340	2459440	voting machines. Like that is kind of the least of our worries. If all we had to worry about was
2459660	2464200	a hackable voting machine like that physical device, boy, that would imply that we've fixed
2464200	2471000	so many other problems in infrastructure, in disinformation, in everything up and down the
2471000	2479080	line. So, you know, I would hope that, you know, the folks that work in the space who pay attention
2479080	2487100	to things in Voting Village, you know, maybe not completely lose your cool over a, you know,
2487280	2493540	a voting machine that can be hacked in person. So I'll do a quick response and I'm sure Amelie
2493540	2500140	wants to move on. But this goes back to something that I said in February. And it's a recurring
2500140	2505300	thing because I feel like I say it a lot. So if you've heard it before, suck it because I'm going
2505300	2512040	to say it again. But the biggest disservice that we can do to the American people as security
2512040	2518400	professionals is somehow convincing them that their votes don't count. And we do that by
2519880	2525280	constantly preaching that the system's broken, the voting machines are hackable,
2525280	2530240	the infrastructure's flawed, the voter registration system is, you know,
2530240	2537580	something that can be tampered with. It's not to say these things aren't true. But also, like,
2537580	2545480	you have to qualify those ramblings and announcements with how often that actually
2545480	2553040	happens and what the likelihood of that happening actually is. And the idea that, you know,
2553040	2558720	hacking 20 voting machines is going to sway an election without even, like,
2558720	2565580	acknowledging what it would take to actually hack the voting machine, right? Or to tamper
2565580	2572100	with the voter registration system without acknowledging that, like, you know, states do
2572100	2577620	have some IDS systems in place. Like, sure, could it happen? Yeah, we can, like, what if all day
2577620	2585240	long? But if we're, if we're putting information out there, that even makes one person think, well,
2585240	2591700	my vote can just be changed anyway, so why would I bother voting? Like, then we've fucked up,
2591700	2596820	like, bad, because we've kind of, we, like, shot ourselves in the foot with the thing that we were
2596820	2602720	trying to make better. So we're now into Section B. So we've now pivoted from where we were six
2602720	2608320	months ago to where we find ourselves in the last 90 days here. 90 days scares me, because,
2608320	2612700	you know, coming from the federal government, it takes longer than that, mainly to fill out
2612700	2617980	the paperwork for something. So 90 days for us in the real world, if in the commercial sector,
2617980	2622700	will be totally interesting. But obviously, I'm going to highlight the fact that, you know,
2622700	2629020	as Jack leveled up here, CISA has taken more of an active policy and assistance role for states.
2629020	2635260	The Election Assistance Commission Committee has hired some really great new staff. In fact,
2635260	2642160	some folks, I believe, Kimber and I were on the panel many years ago with, and, you know, the
2642160	2647140	feeling that, while it's awesome, they hired these people. I don't know, I've tweeted out about it,
2647140	2653520	it's a little too late in certain cases, but, you know, they hire great people. What is the
2653520	2657900	feeling right now that these folks can actually make a difference between now and the election?
2657900	2662980	Or, obviously, if we can't do it by then, what are the, what is the change that can be made
2663580	2667080	for further elections, provided that the world isn't going to melt down?
2667080	2673000	So yeah, I think, yeah, I can take this to start. Yeah, so it's true. Yes, CISA has brought on
2673000	2679040	some more people to help out with election security. I'm part of a group of me and four
2679040	2684540	other Stanford students who all came to CISA to work specifically on election security.
2684540	2691620	And we've been having a lot of fun being able to work essentially on both the infrastructure
2691620	2699540	component, building tools to allow organizations to better secure their systems, and allow CISA to
2699540	2706520	say, aid and assessments to state and local election officials, as well as working on some
2706520	2715320	that's a foreign disinformation component. So in terms of what both, say, CISA and EAC can do
2715320	2721720	by November, I think there's a lot that can still be done. Of course, yes, we have, I believe,
2721720	2727260	calculated this, I think it's 89 days from the time the talk this is airing until the election,
2727260	2733700	and that's very little time, almost nothing, but we still can do a lot. We can help,
2734200	2740040	say, states identify vulnerabilities in their systems. We continue to offer services that assess
2740040	2746240	these systems and give guidance. I mentioned before, we have documents that we published
2746240	2754600	along with the Election Assistance Commission, and we're working to support states in the capacity
2754600	2762020	that we can. So I think that there's a lot that still, of course, needs to be improved,
2762020	2768880	but we're getting there. And from my perspective, yes, the government plays a large role in this,
2768880	2776060	the federal government. And I really do think that states, this is, I'd say, one of the major
2776060	2781160	improvements since 2016. In 2016, the federal government's involvement with the states was
2781160	2787380	not at all near where it was today. So much has improved since then that we are now working with
2787380	2793740	each of the 50 states. We're working with a significant portion of the local election offices,
2793740	2799500	and we're in a much better place, both to be protecting systems and then monitoring in case
2799500	2807280	stuff does go wrong. So, you know, you speak to, obviously, kind of the involvement with CISA and,
2807280	2812220	you know, kind of the states taking a more active role in their own survival in a way.
2812220	2819220	You know, have any of the vendors, either of the e-poll books or the election systems,
2819220	2825940	been more willing to kind of come forward and work proactively with the government or, you know,
2825940	2830620	say any of the companies represented on here to kind of solve the problems? I know, you know,
2830620	2836740	I've recently been involved with some workshopping with OECD on regards to vulnerability disclosure
2836740	2843840	policies and digital product security. And one of those cases is finding a good mediator sometimes
2843840	2849600	to kind of do that. Has anybody kind of moved that way, or are we still kind of like,
2849600	2852520	you know, kind of finger pointing and moving forward there?
2852520	2858600	So in terms of CISA's involvement with this, of course, CISA's preference is for vulnerabilities
2858600	2864800	to be disclosed either directly to the state or to vendors when that is possible. And it is our
2864800	2869300	view that, of course, vulnerability disclosure policies can be very helpful in this process.
2869620	2876820	I'm not aware of any vendors that at the time of recording, or states for that matter, that have
2876820	2882120	come up with vulnerability disclosure policies that could very well change between the two weeks
2882120	2888340	when this airs. But what we do offer is resources for those that want to implement vulnerability
2888340	2893540	disclosure policies to do so. So like I mentioned, we have our guide on vulnerability disclosure that
2893540	2903220	will be live by the time this panel airs, as well as the fact that we do serve as a last resort for
2903220	2909460	people who are unable to disclose vulnerabilities. For any reason, they can report it to US CERT,
2909460	2916600	which is under CISA, and we will work to get that disclosed to the vendor in order to mitigate that
2916600	2922080	vulnerability. So CISA does play an important role here. And yeah, it is our hope that
2923820	2927940	of course, yes, that any vulnerabilities that either people come to vendors with,
2927940	2933360	or come to us with, that they will be addressed. So I mean, and just to follow up on that, I mean,
2933360	2939280	we're getting under the wire, at the wire, right, for the November 2020 election. If
2940120	2946440	I were the king of vuln disclosure, I think I would direct people to disclose to you personally,
2947420	2953640	and, you know, by extension to CISA, before vendors and states, like, I mean, I think that's
2953640	2959020	kind of the way, like, let's say I'm sitting on a vulnerability, or I find a vulnerability in some
2959020	2963560	election system or whatever, like, and I'm a, I'm a hacker guy, who wears bedspread to do this.
2964480	2969940	Like, I have it, I don't want to not tell anyone about it, you know, there is this, like,
2969940	2974520	it's okay to yell fire in a credit theater, if the theater is actually a fire business.
2974520	2980240	Um, I think it's, it's probably not great to, like, drop that on Twitter and just full disclose
2980240	2986500	and do that. I mean, that's not helpful, I don't think in, in, in the slightest. But I do think,
2986500	2992660	like, you tell me, like, I, my, my instinct is, you know, tell CISA and hope for the best,
2992660	2999300	and keep my mouth shut until November, I don't know, 10th, 15th or something. You know, so at
2999300	3005540	least this is where they can do, I'm describing your job at you. Yeah, you can do instrumentation,
3005540	3011680	right? Like, so even if there's no fixes, there's still ways to, to track the vulnerability.
3011780	3016200	Yeah, yeah. And you're exactly right there that yes, the priority is for the vulnerability to
3016200	3023760	get fixed as quickly as possible. And we want to support whatever will make that happen
3024320	3030260	as efficiently and smoothly. So of course, it's ideal if it is possible to disclose directly to
3030260	3040960	vendors, but that is hard when there are no policies today. Yes, exactly. So given that,
3040960	3046840	yeah, the current landscape, yes, CISA does serve as a coordinating role there. For people who,
3046840	3052420	yeah, can't really find the contact to disclose, they can come to CISA and CISA will work to make
3052420	3057060	sure that the vendor or the state is made aware and that the vulnerability can be fixed.
3057280	3062380	Yeah, I mean, hard, hard agree with, with Todd's suggestion of going to CISA, especially at this
3062380	3069540	point. You know, keeping in mind as well that like with the 90 day kind of lead time that we've got,
3069540	3075780	the vendors are very likely to be distracted and have lots of other things on their plate,
3075780	3080500	just from a pure logistical standpoint, before you go layering on the pandemic and the fact that
3080500	3088800	2020 is generally a bit of a shit show. Yeah, the thing that I wanted to double click on
3089580	3095800	is actually around basically non-disclosure of findings ahead of November at this point. And
3095800	3104220	this is very much opposed to how I normally talk about non-disclosure. Yeah, it's really,
3104220	3107900	it's a really, it's a really difficult thing to say. We actually talked about this in terms of
3107900	3113560	the boilerplate election policy that we put up on Disclose.io. And we've got it in there. It's
3113560	3119620	like, you know, basically the agreement is not to disclose until after the election is finished.
3120280	3125660	Ordinarily, that timeline would serve as back pressure on the vendors to fix. And I think
3125660	3130840	that's a really good and important thing for accountability and transparency. But the risk of
3130840	3135100	frightening a non-technical voter into just giving up and not showing up to the poll booth
3135100	3141100	as a product of trying to do something good, I think is extremely high on this particular topic
3141100	3146420	at this particular point in time. So yeah, it's a hard pill to swallow. I think for security
3146420	3151200	researchers in general, it was definitely, you know, from where I, from what we do and
3151200	3154640	where I sit, it's a hard thing to say, but I actually do think it's the right thing for this
3154640	3159540	year. Yeah. Yeah, I know. That's one of those things we've kind of, you know, as I mentioned
3159540	3163020	with some of the policymaking, you know, obviously federal, international and whatnot.
3163020	3166700	You know, we've set the, I wouldn't say necessarily artificial 90 day deadline,
3166700	3173020	but obviously for inside the 90 days, it does kind of create an unworkable framework with both
3173020	3178140	in the timing, I think the regulatory environment for whatever folks need to do for certifications,
3178140	3182140	plus loading all the election information and the logistics of that. So, you know,
3182140	3187700	it just creates this, this whirlwind of not a good situation for us to be in. So yeah.
3187960	3192080	So yeah, we, we talked about this, you know, earlier in regards to kind of the effect that
3192080	3200020	COVID-19 has had on how we staff the election, how we are attending the election and participating
3200020	3206380	in it, obviously with retirees and whatnot. There is so much dumpster fires being poured
3206380	3213340	into the alley right now. It's not even funny. And obviously with the disinformation and just
3213340	3219180	all the stuff we talked about, if you were all betting people, and if we were in Las Vegas this
3219180	3225620	year, instead of doing this virtual, what would you bet to be the first thing to crumble out of
3225620	3230300	all of this? What do you think is the first thing that is just like, you know, the guy from Oz comes
3230300	3236740	out behind the sheet and says, yep, everybody go home. We're fucked. If I was a gambling person,
3236740	3244840	which I'm not, I think it would be if we're talking about the first thing to just go like
3244840	3251420	shithouse on fire. What do we do? Is a bunch of maybe
3253720	3262380	rebellious folks who would show up at polling places without masks and like fake cough and
3262380	3269360	just make a big to do and just try to disrupt, you know, the peaceful line at the voting place,
3269360	3277340	like, I think that, sure, I think we'll see people tweeting, oh, I got a mail-in ballot for my
3277340	3282940	uncle who died last year, and then it gets 10,000 retweets and then somebody else tweets
3282940	3290440	something similar. Like, I think we'll see that, but like just for shithouse election day, like,
3290440	3296080	what are we going to see on the news? I think like polling places being disbanded for like
3296080	3302020	civil unrest and not from the folks who are there just to vote peacefully.
3302080	3306780	So this is starting to form like a John Carpenter movie in the worst way possible then.
3306780	3315000	Well, I am a horror fan, so of course that's where I go. My hope is that people respect democracy,
3315000	3320060	regardless of which side of the line you fall on, and just let people have their constitutional
3320060	3328240	right to participate in the electoral process. However, I am currently disenchanted by the state
3328240	3335160	of the country right now. I don't know. I think that your first sign of everything going to hell
3335160	3340760	is going to be on like in the neighborhood of October 13th, October 14th. That's going to be
3340760	3348040	where you have your last big push of whatever disinformation campaign is going on. I'm not a
3348040	3354020	disinfo expert by any means, but if I were going to own stuff, I would definitely want to tell
3354020	3360120	people. But like one of the tactics we've seen over and over again of people who are attacking
3360120	3364520	election systems is that it's no good unless you tell people about it, unless you get noticed.
3364520	3369940	And so you got to get noticed like early enough to sway elections, but not so early that,
3369940	3376360	you know, there's enough from, you know, that Jack can fix it for us. So like October 15th,
3376360	3380960	I think is the sweet spot for that. What is that? That's like Wednesday, I think, or Thursday.
3382040	3388620	Non-Friday, non-Monday, early October, I would expect to see, I would expect to see big news to
3388620	3392800	try to have that last push of, hey guys, don't bother voting.
3392880	3398500	And you think that because that's when the mail-in voting window opens.
3398500	3405400	That's when most states, in many states, absentee ballots are starting to get filled
3405400	3411000	out then. Early voting starts then. And it's still early enough that you can make hay about it
3411000	3419080	for the following two weeks. Like a losing side can call cyberfowl, pointing at that thing for,
3419080	3423180	you know, and just eat up, eat up news for the rest of October.
3423660	3429880	Just this is, you know, it's a bit personal, but it goes to one of the reasons that I'm not in the U.S.
3429880	3436840	right now. I think, you know, we had the option to be near family and ride out the pandemic.
3436980	3442760	You know, part of the concern that was in the back of my mind was how, you know, the
3442760	3449200	potential for civil unrest and those sorts of things are amplified by the backdrop of the
3449200	3455840	pandemic and economic depression, a lot of other stuff. So I think the number of things that are
3455840	3462660	available for an actor to tweak on and the amount of leverage that's present, you know,
3463120	3470400	as we do version two of this panel is radically different to what it was, you know, last time we
3470400	3476540	got together and spoke. So, you know, from a mitigation standpoint, it really does come back,
3476540	3481420	you know, for the typical audience of this panel in DEF CON is making sure that you're not
3481420	3486740	adding to the problem. You know, the whole idea of, like, polarization, of just general
3487500	3491780	distrust, like, nihilism, all of that sort of stuff. And I do believe, like, we are talking,
3491780	3497200	you know, Armageddon-ish type stuff at the moment, but I do believe fundamentally in, like, working
3497720	3503180	back from the worst case scenario and optimizing the critical path from there. So it's an important
3503180	3509900	conversation to have. Yeah, that's a good segue into the last question we're going to do today.
3510640	3517920	So, you know, obviously, we talked about mail-in voting as the next best mitigation for forcing
3517920	3523140	people to kind of show up in person, and definitely a better alternative than, I'd say,
3523140	3528060	any potential half-baked e-voting solution at the last minute that would come in and swoop.
3528100	3533920	But obviously, with the rhetoric that's been, you know, spoken by various folks in the press
3533920	3539500	from various levels of government and elsewhere about the validity and trustability of the
3539500	3545080	Postal Service, as well as their own financial woes imposed upon them by Congress and pre-funding
3545080	3549880	and so forth and so on, you know, it was just announced today that they had worked out a deal
3549880	3556300	with a massive infusion slash loan from the U.S. Treasury. I think it was, like, 15 billion dollars,
3556300	3561840	which is a huge chunk of change. It does keep people from necessarily having to rush out and,
3561840	3567680	you know, running for stamps. But obviously, I have reports from some of the locals here in the
3567680	3575240	D.C. area, specifically Baltimore, about potential fallout from the recent Postmaster General coming
3575240	3581000	in and saying, please delay first-class mail. Obviously, that puts a downward pressure on
3581000	3585620	delivery of mail-in voting, as well as, you know, returning that and making sure that everyone hits
3585620	3592460	with the deadlines with the postmarks. So where we sit here is our last best effort to run a
3592460	3596920	secure election as a Postal Service. It is in dire straits. It has potential leadership that is
3596920	3604560	working antithetically against the essentially constitutionally or, you know, state that the,
3604560	3609840	you know, the Postal Service exists in. You know, what are the last bits here that we can ensure
3609840	3618420	that that is functioning for us to go forward? Are there ways that maybe we move up early voting
3618420	3625060	even sooner so that we kind of play into the logistics of extended timelines? Is it write your
3625060	3632400	senators and make sure that, you know, mail is delivered in a timely fashion? Or, you know,
3632400	3637200	some other aspect of it, you know, with that, and especially, you know, as you mentioned earlier,
3637200	3641440	too, I think it was Todd talking about the expected timelines being a lot longer for us to hear
3641960	3647860	the outcomes. You know, if we have this extended timeline, what's our expectations to actually,
3647860	3650320	you know, hear what the outcomes are going to be given this?
3650320	3656860	It would be great if states would extend their deadlines. Like, I was shocked to see that Texas,
3656860	3660680	for all the hand-wringing Texas has been doing about mail-in ballots and, like,
3660680	3668300	trying to make that hard, the fact that Texas then turned around and extended early voting was
3668300	3674280	was a sweet surprise. You know, I don't know. We do things randomly here in Texas. Some things are
3674280	3680420	great. Some things are not so much. But I guess that's, I guess that's just here local in Texas.
3681860	3688300	I don't know. Like, I feel like everyone should, you know, mentally hug a postal worker today.
3688300	3692380	They do a lot of really hard work. A lot of people depend on them for a lot of things.
3693500	3697920	You know, they are, in fact, constitutionally enshrined. It's an Article I power of Congress
3697920	3709360	to establish the post office. And the fact that it became a target for disenfranchisement is just
3709360	3717640	mind-boggling to me. But I think that we can all agree that the post office is kind of a wonderful
3717640	3726460	Americanism, really. Like, it was a largely, this notion of a single stamp that carries something
3726460	3731580	across the country. Like, that is, I'm not really sure. It might be an English thing. It might be a
3731580	3741080	British thing. But one or the other, it's pretty great. So yeah, like, I mean, if you have the
3741080	3747540	opportunity to vote absentee, absolutely do it. You know, absentee voting, you can get all nerdy
3747540	3753340	about it and say, like, well, technically you're violating, like, the secrecy of the ballot by
3753340	3756640	doing that because someone can watch you vote and direct you vote and see that you vote correctly
3756640	3762500	and see that you put the thing in and mail it away. Like, but that's almost a, like, that is
3762500	3769500	so low on my list of problems when it comes to democracy is vote selling. You know, if it turns
3769500	3774680	out that's a big deal, great. Like, let's go tackle that. But it is, it is not, that has not been a
3774680	3781200	problem since, like, the 19th century, so. Yeah, I want to say, too, we've seen
3782880	3787180	the current administration, we've seen the current administration
3788320	3795420	actively attack the Postal Service on social media. And so, you know, I would
3796040	3803220	ask folks to understand that I don't think there was a long game there, but I don't think that
3803220	3809400	it's going to be unreasonable to see more attacks on the Postal Service from the current
3809400	3818640	administration. The unreliability, the conspiracies about deals with Amazon, and then how Jeff Bezos
3819220	3824920	ties into Amazon, and then with the Clintons, like, there's a lot of, there's a lot of stuff
3824920	3831480	to unpack there. But I would say, you know, at the end of the day, like, these are feds,
3831480	3837360	these folks are feds, they took the same oath to the Constitution that other feds take. They're
3837360	3845320	there to just do their jobs every day. And the idea that postal workers themselves would be
3845320	3851120	tampering with mail-in ballots is just kind of ridiculous. And it's completely insane.
3851120	3857880	It really is ridiculous. And, and if there were one, it's a blip on the radar if the numbers
3857880	3864800	are out there of folks voting, right? So, so let's just keep it all in perspective. And to
3864800	3871360	understand the importance of the Postal Service, when I was younger, the DMV test had a question
3871360	3878420	that said, if you get to a four-way stop, and there's a fire truck, an ambulance, a police car,
3878420	3884160	and a mail truck, who has the right of way? And everyone assumed, like, the ambulance or the fire
3884160	3889960	truck, but it was, in fact, the mail truck, because they are protected under, you know, the,
3889960	3895760	the guys of the federal government. Certainly mail truck wouldn't go first, but they could. And also,
3895760	3900040	if you hit a mail truck, you get into a lot of trouble, too, because you've damaged federal
3900040	3905060	property. So, you know, you probably don't want to go out and take your angst out on vandalizing
3905060	3910720	mail trucks or bothering postal workers. So I just... That is a hot tip.
3911360	3917400	I feel like... Robbing post offices used to be a hangin' crime. Yeah, well, they've also got that
3917400	3921500	Crime a Day book that just came out from the Twitter feed. I would hope that there's a chapter
3921500	3929560	in there about weird stuff like that. So, all right, then last thoughts on what we see as our
3929560	3935560	future here. What you'll be doing, what you hope others will be doing, and then where do you hope
3935560	3941720	we will be? I can go and take this first. So, yeah, nothing I'm gonna say here, really,
3941720	3948260	is anything new, I would say, that I haven't said. But, yes, in terms of what I'm doing,
3948260	3953480	what CIS is doing, we are going to be working through and after the election to support
3954360	3959660	election offices at the state and local level to ensure that they have what they need from a
3959660	3967060	security perspective. And we're committed to doing that. In terms of, I think, what's maybe
3967060	3972820	more valuable is what people watching this, what steps they can take and what steps they can
3972820	3979660	recommend others to take. And this goes back to the two points that you have to be patient and
3979660	3984400	you have to expect that things may go wrong. But that doesn't necessarily mean there has been
3984400	3990440	interference and that doesn't mean that the election is invalid. So, be patient. Do not
3990440	3997420	assume that results will come out on election day. It may take some time, but have faith that
3997420	4003920	election officials are doing their best to have an accurate result, that we have process in place,
4003920	4012120	that if interference does occur, we can identify it. And just, yeah, ultimately the main thing is
4012120	4019140	that the people of America need to have faith in their own elections and that can go away without
4019140	4025160	any actual tampering occurring, without any interference. Just if the people do not believe
4025160	4030680	that their result was valid, then the result is not valid. So, I think to everyone watching this,
4030680	4037660	just to understand that what you believe happened matters and just to understand their process in
4037660	4043680	place, their committed election officials, the federal government is here to support that process
4043680	4050400	and, yeah, let's hope that we have a smooth, free, and fair election in November.
4053360	4059860	Sure. So, I mean, I guess, like, to just kind of reiterate what, you know, everyone else says,
4059860	4066680	like, you know, the best defense against any election shenanigans is voting and voting in
4066680	4072720	numbers that are too hard to push one way or the other. If people go and they vote, especially
4072720	4079300	people who have historically been disenfranchised or haven't felt the need to go vote, you know, it is
4080040	4083960	here at every election, but this election is literally the most important election of your life
4083960	4091340	so far. And so, go vote and hopefully if enough people do that, you know, any kind of shenanigans
4091340	4097860	will be drowned out by the overwhelming signal that we have. Me personally, not only am I going
4097860	4105100	to vote early, I'm very excited to do that, but I'll be working the polls. It's gonna be crazy.
4105160	4110340	It'll be November and there will be no vaccine. And so, I will be doing a lot of cleaning and
4110340	4117660	hoping that not too many polls close that day. You know, there were poll closures.
4117660	4123940	In our last election here in Texas, there weren't any poll closures like on the day of.
4124580	4128340	You know, people did show up. They got enough recruits to come and do the thing.
4128340	4132200	I did have a couple poll workers not come to my polling place, but we had enough people to
4132200	4140160	pull it off. So, hopefully that will remain the case, you know, but that's gonna be November.
4140160	4146240	So, who knows like what the pandemic will bring us. If it becomes impossible to vote in person
4146240	4151940	in any kind of crowded way, then, you know, we'll just have to deal with that as it comes. But
4153480	4160960	if you have the bandwidth and the health to throw in for a, what is a super fun,
4160960	4166560	sounds boring, but it's actually pretty fun, like 14-hour day, go with the polling place.
4166780	4172720	I'll go next. You know, I will say that I'm very much looking forward to returning
4172720	4179640	to the U.S. And this is honestly a part of that. So, again, on a, you know, speaking to the subject
4179640	4183980	matter, but speaking to it from a very personal standpoint, it's like my adopted country is
4183980	4190240	trying to figure all this stuff out. And I'm looking forward to being past it is something
4190240	4197040	that, you know, it's heavy. It's everything. So, aside from that, practically, you know,
4197560	4204720	for the hackers, find out where people are asking for help. Go help them. Like,
4204720	4207520	look for the stuff that people have already volunteered. You know, the volunteering stuff
4207520	4211320	that we talked about at the start, just to reiterate that. Some of that help might be IT.
4211340	4214680	Go looking for it. See if you can find opportunities to provide your skills
4214680	4221000	into those different areas. Help out on the open-source projects and some of the other
4221000	4225520	things that are going on that have been volunteered. So, Arlo, we mentioned before,
4225520	4230620	verified voting. It's up on GitHub. Go bang on the source code. And if it's legit, say so.
4230760	4237220	If there's a problem, submit a PR. Help make it better. If these audits are a part of how we have
4238080	4242260	a peaceful kind of acknowledgment of the count after the fact, then you'll have played a pretty
4242260	4247260	big role in that, I think. And then, finally, you know, don't scare your grandma between now
4247260	4253440	and November. If you're doing security research and you find something, you know, talk to Jack
4253440	4258080	and the crew at CSIR and CERT. Try to talk to the vendor. Just be very mindful of the fact that
4258080	4263100	dropping any kind of anything that looks like a vulnerability on the internet right now is
4263520	4268260	highly, highly exploitable from actors, from a disinformation standpoint, and you don't want
4268260	4272960	to be a part of the problem. Technically, over the last couple days, because July sucked when
4272960	4278660	it came to VOMS, or at least people had to clean up after VOMS. So, let's make August better.
4279960	4283300	It's DEF CON month, so the internet's on fire this month anyway, but
4283300	4289540	maybe after that, I don't know. October, let October be quiet then, that's cool. Kimber, any last?
4293020	4301340	It's unprecedented, so it's anyone's guess what actually happens on Election Day and
4301880	4315860	the months following. Vote, just vote. Tell your friends, tell your family, vote. Vote safely.
4316460	4323880	Vote mail-in if you can. If you pay attention, your state may have deadlines or your district on
4323880	4328880	when you have to let them know that you're going to be voting by mail-in ballot.
4328880	4334640	Some folks here didn't understand there was a two-part process to mail-in ballot. You had to
4334640	4341920	request one to receive one. It didn't automatically get sent to you. So, just being aware of how your
4342980	4348580	local districts work when it comes to mail-in ballots so that you can participate. And if you
4348580	4354900	have to go to the polls, wear a mask, social distance if you can, and you don't have high-risk
4354900	4361060	folks at home, volunteer at your local polling places and do what you can to make it safe for
4362120	4366940	our most vulnerable populations to be able to get out and have their voices heard.
4368300	4375160	Well, yeah, that's a great thing to end on. Obviously, I have a spouse who's immunocompromised,
4375160	4384700	so I've preemptively requested a mail-in ballot. I know some states require an extenuating excuse
4384700	4392120	in order to get an absentee ballot, so please check with your local officials on what you can
4392120	4397900	do to do that. Obviously, you know, a safe and secure voting is important, but safe and secure
4397900	4405340	also means individuals as well. With that, I'll close out our panel. I do appreciate Kimber, Jack,
4405340	4410800	Casey, and Todd for joining us this evening for the recording. Again, this was the election
4410800	4416480	security part two. The infrastructure strikes back. While I can't necessarily drop in some
4416480	4422440	John Williams here, use your mind's eye as well as the Starfield background to kind of get it
4422440	4429760	through. And hopefully, come November, we'll see what kind of shakes out. And geez, maybe next
4429760	4434260	February we'll have a cleanup on this, maybe a part three. Hopefully, it doesn't end up with
4434340	4439340	a bunch of Ewoks running around saying ugnug. But anyhow, once again, thank you very much and
4439340	4441140	thank you for your time. Take care.