[00:02.460 --> 00:09.540]  Don't go postal over mail-in voting. A look into voting by mail with yours truly, The Asylum.
[00:10.100 --> 00:18.040]  First of all, who am I? I am a 13-year-old girl, and two years ago I was the youngest speaker at HOPE.
[00:18.040 --> 00:22.620]  And a lot has happened since then. I spoke three times at DEF CON.
[00:22.620 --> 00:27.960]  I spoke in the Roots Asylum, the Bipacking Village, and the Voting Village.
[00:27.960 --> 00:37.880]  I also gave a talk on election security in Romania at DEFCAMP, spreading the word about election security worldwide.
[00:37.940 --> 00:44.900]  My election hacking from the Roots Asylum was highlighted at a congressional hearing on election security.
[00:45.000 --> 00:49.000]  And I am the founder and CEO of Girls Who Hack.
[00:49.000 --> 00:53.680]  Our motto is teaching girls the skills of hacking so that they can change the future.
[00:53.680 --> 01:00.380]  I provide online and physical lessons to any girl who wants to start her journey in cyber security.
[01:00.960 --> 01:06.960]  Speaking of my startups, I also started SecureOpenVote.
[01:06.960 --> 01:11.080]  I am building my own end-to-end election system.
[01:11.080 --> 01:20.160]  This year at DEF CON, I have my reporting system running in the Voting Village so you can try to change the vote count.
[01:21.800 --> 01:23.980]  So let's jump in.
[01:23.980 --> 01:31.260]  Due to COVID-19, this year's 2020 election is going to be one of the hardest in history.
[01:31.580 --> 01:38.920]  More people than ever are switching to mail-in voting instead of voting in person.
[01:39.000 --> 01:47.340]  To give you an idea of how many people voted in the 2016 elections by mail, 25% voted by mail.
[01:47.340 --> 01:55.400]  So let's clarify how voting by mail works, dispel some rumors, and go over the pros and cons.
[01:56.620 --> 02:01.420]  Starting with a quote from a high-level politician.
[02:01.420 --> 02:11.240]  There is no way, zero, that mail-in ballots will be anything less than substantially fraudulent.
[02:11.260 --> 02:19.780]  Mailboxes will be robbed, ballots will be forged, and even illegally printed out and fraudulently signed.
[02:20.000 --> 02:24.420]  Whoa, there is a lot to unpack there.
[02:24.500 --> 02:29.380]  First of all, he said that mailboxes will be robbed.
[02:29.380 --> 02:39.660]  First of all, this is a federal crime, punishable by up to five years in jail and a quarter of a million dollars in fines.
[02:39.960 --> 02:46.120]  Stealing mail from someone's house to get their ballot would be difficult.
[02:46.120 --> 02:52.680]  You would have to know when the ballot was mailed out, and everyone is home these days anyway.
[02:53.080 --> 02:56.300]  The postal mailboxes are emptied daily.
[02:56.300 --> 03:08.840]  So, unless you are going to go out in broad daylight, pick the lock to a mailbox, and steal a bunch of mail-in ballots, pretty sure mailboxes are safe.
[03:08.840 --> 03:16.480]  If you did manage to get away with it, it is likely that the few ballots that you got will not tip the election.
[03:17.220 --> 03:23.920]  In May 2020, a big donor to the Trump campaign was appointed as Postmaster General.
[03:23.920 --> 03:33.180]  Since then, people have noticed that the mail has slowed significantly. Mail and packages have been returned.
[03:33.460 --> 03:43.800]  He has shut down the mail sorting machines, forcing mail to be sorted by hand, taking the postal service back to the 1950s.
[03:43.800 --> 03:50.040]  Even one of my Girls Who Hack soldering kits has come back to me. See?
[03:53.580 --> 04:02.060]  Anyway, but the good news is, you can always drop off your ballot in a ballot drop-off box.
[04:02.060 --> 04:08.120]  In fact, over 65% of all mail-in ballots are cast this way.
[04:08.120 --> 04:18.400]  With everything going on in the mail system, your best bet is to drop your vote off at a ballot drop-off box, or in person.
[04:18.400 --> 04:23.360]  But someone can just steal the entire ballot box.
[04:24.360 --> 04:32.700]  Not likely. Ballot boxes are kept at secure locations, such as police stations or municipal buildings.
[04:32.700 --> 04:38.380]  The boxes are emptied daily and have security cameras on them.
[04:38.380 --> 04:45.360]  Additional security features, such as unique keyed locks or tamper-evident seals, are also used.
[04:45.360 --> 04:54.620]  I know what you're thinking. But Bia, in your other election talk, you said tamper-evident seals can be undetectably opened and manipulated.
[04:56.100 --> 05:04.400]  Okay, you do that. Go to the police station with your lockpicks and your acetone and open the ballot box.
[05:04.400 --> 05:06.980]  Let me know how that works out for you.
[05:06.980 --> 05:16.380]  The penalty for mail ballot fraud is up to five years in prison and $10,000 in fines for each act of fraud.
[05:16.380 --> 05:19.340]  That is in addition to state penalties.
[05:21.080 --> 05:34.280]  If the postal system and the ballot boxes still scare you, you can always drop off your ballot off by hand to the county clerk's or election board office.
[05:34.280 --> 05:39.600]  You may be saying that people are just going to print out their own ballots.
[05:40.100 --> 05:44.500]  But the ballots themselves are very difficult to forge.
[05:44.500 --> 05:52.420]  They use many security features, including special papers with UV-sensitive markings and watermarks.
[05:52.420 --> 05:55.860]  You can't just run to Staples and buy this stuff.
[05:55.860 --> 06:02.580]  If you have ever held a piece of fake money, you know how it feels different than the real thing.
[06:02.580 --> 06:13.840]  When the election officials are opening the ballots, the one that Bob printed out on his inkjet at home will definitely stick out.
[06:13.840 --> 06:19.060]  Some ballots use color shift ink or magnetic printing ink.
[06:19.060 --> 06:25.940]  This ink is extremely difficult to source and is delivered by armored truck.
[06:25.940 --> 06:33.080]  It's also worth noting that you need an actual printing press to use these inks.
[06:33.080 --> 06:37.340]  Bob won't just be loading that into his inkjet.
[06:37.340 --> 06:42.880]  Many ballots have micro-printed unique security codes or barcodes.
[06:42.880 --> 06:50.860]  This prevents duplicates and allows voters to track their ballot as it travels through the system.
[06:53.490 --> 06:59.770]  Another thing that this high official said is, they will forge signatures.
[07:00.490 --> 07:05.870]  But the voter's signature is verified with their past signatures.
[07:05.870 --> 07:12.070]  Some states provide extra training for their election workers to spot forgeries.
[07:12.070 --> 07:17.930]  If an inconsistency is found, it is reported to the state prosecutor's office.
[07:19.630 --> 07:24.850]  But you can vote twice, once by mail and once in person.
[07:25.450 --> 07:29.070]  That's a big cup of NOPE!
[07:29.070 --> 07:33.190]  Mail-in ballots are due before the election.
[07:33.190 --> 07:39.210]  This gives election officials time to check the voter off the roll as voted.
[07:39.210 --> 07:45.990]  If the voter goes and tries to vote in person, the state prosecutor's office is notified.
[07:46.850 --> 07:52.770]  Occasionally, people have received two ballots in the mail with their name on it.
[07:52.770 --> 07:56.230]  No, this does not mean you can vote twice.
[07:56.230 --> 07:58.190]  But how does this happen?
[07:58.690 --> 08:02.810]  Okay, how many of you have ever merged two databases?
[08:02.890 --> 08:07.330]  Well, the computer sees these two names as unique.
[08:08.010 --> 08:14.390]  Marge Bouvier, the name she used when she first registered to vote at age 18,
[08:14.390 --> 08:20.710]  and Marge Bouvier Simpson, the name she took after she got married to the handsome Homer Simpson
[08:21.130 --> 08:24.470]  and what is in the DMV system.
[08:24.510 --> 08:32.530]  When this state merged the DMV database with the voter registration database,
[08:32.530 --> 08:34.590]  Marge showed up twice.
[08:34.590 --> 08:43.190]  The good news is humans check these names and signatures on the ballot to catch these kinds of errors.
[08:43.190 --> 08:50.770]  If you ever receive two ballots, simply call the election office and they can correct the error.
[08:50.770 --> 08:56.790]  Now that we've debunked some myths, let's talk about how voting by mail works.
[08:56.790 --> 09:03.630]  Every state is in charge of its own elections, so it differs slightly from state to state.
[09:03.630 --> 09:08.570]  Some states allow you to vote by mail without a specific reason.
[09:08.570 --> 09:12.370]  Others require a valid reason to vote by mail.
[09:12.370 --> 09:17.730]  A few do not consider COVID to be a valid reason.
[09:17.770 --> 09:23.830]  But this is changing day by day, so check vote.org to see what your state is doing.
[09:25.390 --> 09:29.070]  The first step is to register to vote.
[09:29.070 --> 09:35.050]  39 states and the District of Columbia allow their citizens to register online.
[09:35.050 --> 09:43.550]  Every state has a printable registration form, so you can print it out and either mail it in or deliver it in person.
[09:43.720 --> 09:46.930]  Make sure that you register by the deadline.
[09:46.930 --> 09:55.050]  If it is getting close, bring that registration form to the clerk's office or election office in person.
[09:55.050 --> 10:00.450]  If you have not registered to vote, do it after this talk. I'm serious.
[10:00.450 --> 10:04.450]  It takes only two minutes. Literally two minutes.
[10:04.450 --> 10:09.210]  And it's very important, because every vote counts.
[10:10.150 --> 10:13.350]  I made this really big so you can take a screenshot.
[10:13.670 --> 10:19.330]  Go to register.vote.org to register.
[10:19.330 --> 10:33.570]  Vote.org has tons of great voter resources, including checking if you are registered, how to get a mail-in ballot, and a polling place locator and election reminders.
[10:35.290 --> 10:39.090]  Next, make sure you're eligible to vote by mail.
[10:39.090 --> 10:43.550]  Currently, five states have an all-mail-in ballot election.
[10:43.550 --> 10:55.210]  28 states and the District of Columbia have a no-excuse absentee voting, which means you can just vote by mail without having to give a specific reason.
[10:55.210 --> 10:59.150]  In 17 states, you need a valid reason.
[10:59.150 --> 11:01.250]  This differs from state to state.
[11:01.250 --> 11:06.750]  Some reasons include old age, being infirmed, or out of state.
[11:06.750 --> 11:14.870]  To see if you are eligible to vote by mail, go to vote.org for your state and see if you are eligible.
[11:15.230 --> 11:24.610]  Here is a map, and again, things are constantly changing, so check online at vote.org to see where your state fits in.
[11:31.280 --> 11:35.100]  Next, you have to request an absentee ballot.
[11:35.200 --> 11:39.380]  If you have not done this, do it now.
[11:39.380 --> 11:43.820]  After my talk, go and request your absentee ballot.
[11:43.820 --> 11:49.480]  This will give them time to add you on the list and mail out your ballot.
[11:49.480 --> 11:53.640]  Guess what? You can do this at vote.org.
[11:56.400 --> 12:01.140]  When you finally receive your ballot, sit down and fill it out.
[12:01.140 --> 12:07.760]  Right away! Don't put it in a pile of bills and junk mail you are ignoring.
[12:07.760 --> 12:10.260]  Sit down and just fill it out.
[12:10.260 --> 12:15.320]  One of the great things with mail and ballots is you can research the candidates.
[12:15.320 --> 12:19.940]  Get your OSINT on and find out what each candidate is all about.
[12:19.940 --> 12:25.240]  Who knows, perhaps that school board member actually owns a chocolate factory.
[12:26.120 --> 12:35.220]  COVID is a valid reason for many to vote by mail, and should be considered valid by all states.
[12:35.220 --> 12:46.320]  If a voter is immune-compromised or lives with someone who is, not allowing them to vote by mail is a form of voter suppression.
[12:46.700 --> 13:00.980]  Voting in person also brings the risk of COVID to the election workers, many of which are elderly retirees, putting their lives in danger just so you can vote in person.
[13:00.980 --> 13:10.330]  The poll workers also have to clean the machines between each vote, slowing the process and lengthening the poll lines.
[13:11.520 --> 13:16.320]  It also forces people to go to extremes to protect themselves.
[13:16.320 --> 13:23.190]  This lady had to wear a trash bag. Now that's one fashion statement that should never be made.
[13:25.250 --> 13:32.990]  In many states, processing of mail-in ballots can begin as soon as they are received.
[13:32.990 --> 13:38.270]  Other states do this anywhere from one month to the day of the election.
[13:38.570 --> 13:48.030]  By permitting election officials to do a lot of the work ahead of time, the counting process on election day will be quicker.
[13:48.030 --> 13:58.250]  It's important to note that if ballots are counted ahead of time, the results are not released before election day.
[13:58.250 --> 14:05.370]  Regardless of how they are counted, this is a great opportunity to perform a risk-limiting audit.
[14:05.690 --> 14:14.290]  And every state should do this. You have everything you need, hand-marked paper ballots and people to count them.
[14:16.230 --> 14:21.030]  But mail-in voting has tons of fraud.
[14:21.030 --> 14:34.590]  Between 2000 and 2014, over a billion mail-in ballots were cast, and a professor at Loyola School of Law found only 31 cases of fraud.
[14:36.530 --> 14:40.250]  There are many benefits to mail-in voting.
[14:40.250 --> 14:46.530]  Voter turnout is 10% higher, and it does not seem to be one party or another.
[14:46.530 --> 14:55.990]  It reduces some voter suppression, like poll intimidation, or people who have to travel a great distance to vote and have no transportation.
[14:55.990 --> 15:02.510]  Or people who have to work on election day, which should be a national holiday, by the way.
[15:02.510 --> 15:11.330]  It also protects from attacks by foreign actors. Kind of hard to hack a piece of paper, isn't it, Putin?
[15:11.490 --> 15:17.370]  One of the biggest benefits is it speeds up the election process.
[15:17.370 --> 15:26.870]  No long lines at polls, or people not being able to vote because of crashing e-poll books or slow election machines.
[15:26.870 --> 15:36.150]  The two most important things are it's a hand-marked paper ballot, and it allows for better informed voting.
[15:36.150 --> 15:40.270]  No more just randomly picking school board members.
[15:41.730 --> 15:52.690]  Remember this guy? The high-ranking government official from earlier voted by mail in 2017, 18, and 20.
[15:52.690 --> 15:58.510]  I guess the system is good enough for him, so why shouldn't it be good enough for us?
[16:00.830 --> 16:04.730]  And remember, get involved. Become a poll worker.
[16:04.730 --> 16:12.830]  See how the system works first-hand and give those old retirees a break, especially during COVID.
[16:12.950 --> 16:17.110]  You can actually save a life by becoming a poll worker.
[16:17.110 --> 16:21.970]  Don't want to go outside and see people? I don't blame you. Not a problem.
[16:21.970 --> 16:30.170]  You can lend your cybersecurity knowledge and skills to those who need it most by becoming a CyberSurge volunteer.
[16:30.310 --> 16:36.190]  This can be done by remote. You can do this by contacting this email or going to this site.
[16:36.590 --> 16:43.890]  Most important thing you can do is vote. Register to vote at vote.org and be counted.
[16:44.550 --> 16:51.510]  Thank you for listening to my talk, and don't forget to vote BSI Lab for President in 2044.
[16:52.590 --> 16:56.130]  This message paid for by BSI Lab for President 2044.