WEBVTT 00:02.460 --> 00:05.220 Don't go postal over mail-in voting. 00:05.220 --> 00:09.540 A look into voting by mail with yours truly, The Asylum. 00:10.100 --> 00:11.800 First of all, who am I? 00:11.800 --> 00:18.040 I am a 13-year-old girl, and two years ago I was the youngest speaker at HOPE. 00:18.040 --> 00:20.620 And a lot has happened since then. 00:20.620 --> 00:22.620 I spoke three times at DEF CON. 00:22.620 --> 00:27.960 I spoke in the Roots Asylum, the Bipacking Village, and the Voting Village. 00:27.960 --> 00:37.880 I also gave a talk on election security in Romania at DEFCAMP, spreading the word about election security worldwide. 00:37.940 --> 00:44.900 My election hacking from the Roots Asylum was highlighted at a congressional hearing on election security. 00:45.000 --> 00:49.000 And I am the founder and CEO of Girls Who Hack. 00:49.000 --> 00:53.680 Our motto is teaching girls the skills of hacking so that they can change the future. 00:53.680 --> 01:00.380 I provide online and physical lessons to any girl who wants to start her journey in cyber security. 01:00.960 --> 01:06.960 Speaking of my startups, I also started SecureOpenVote. 01:06.960 --> 01:11.080 I am building my own end-to-end election system. 01:11.080 --> 01:20.160 This year at DEF CON, I have my reporting system running in the Voting Village so you can try to change the vote count. 01:21.800 --> 01:23.980 So let's jump in. 01:23.980 --> 01:31.260 Due to COVID-19, this year's 2020 election is going to be one of the hardest in history. 01:31.580 --> 01:38.920 More people than ever are switching to mail-in voting instead of voting in person. 01:39.000 --> 01:47.340 To give you an idea of how many people voted in the 2016 elections by mail, 25% voted by mail. 01:47.340 --> 01:55.400 So let's clarify how voting by mail works, dispel some rumors, and go over the pros and cons. 01:56.620 --> 02:01.420 Starting with a quote from a high-level politician. 02:01.420 --> 02:11.240 There is no way, zero, that mail-in ballots will be anything less than substantially fraudulent. 02:11.260 --> 02:19.780 Mailboxes will be robbed, ballots will be forged, and even illegally printed out and fraudulently signed. 02:20.000 --> 02:24.420 Whoa, there is a lot to unpack there. 02:24.500 --> 02:29.380 First of all, he said that mailboxes will be robbed. 02:29.380 --> 02:39.660 First of all, this is a federal crime, punishable by up to five years in jail and a quarter of a million dollars in fines. 02:39.960 --> 02:46.120 Stealing mail from someone's house to get their ballot would be difficult. 02:46.120 --> 02:52.680 You would have to know when the ballot was mailed out, and everyone is home these days anyway. 02:53.080 --> 02:56.300 The postal mailboxes are emptied daily. 02:56.300 --> 03:08.840 So, unless you are going to go out in broad daylight, pick the lock to a mailbox, and steal a bunch of mail-in ballots, pretty sure mailboxes are safe. 03:08.840 --> 03:16.480 If you did manage to get away with it, it is likely that the few ballots that you got will not tip the election. 03:17.220 --> 03:23.920 In May 2020, a big donor to the Trump campaign was appointed as Postmaster General. 03:23.920 --> 03:29.500 Since then, people have noticed that the mail has slowed significantly. 03:29.600 --> 03:33.180 Mail and packages have been returned. 03:33.460 --> 03:43.800 He has shut down the mail sorting machines, forcing mail to be sorted by hand, taking the postal service back to the 1950s. 03:43.800 --> 03:49.060 Even one of my Girls Who Hack soldering kits has come back to me. 03:49.060 --> 03:50.040 See? 03:53.580 --> 04:02.060 Anyway, but the good news is, you can always drop off your ballot in a ballot drop-off box. 04:02.060 --> 04:08.120 In fact, over 65% of all mail-in ballots are cast this way. 04:08.120 --> 04:18.400 With everything going on in the mail system, your best bet is to drop your vote off at a ballot drop-off box, or in person. 04:18.400 --> 04:23.360 But someone can just steal the entire ballot box. 04:24.360 --> 04:25.840 Not likely. 04:25.840 --> 04:32.700 Ballot boxes are kept at secure locations, such as police stations or municipal buildings. 04:32.700 --> 04:38.380 The boxes are emptied daily and have security cameras on them. 04:38.380 --> 04:45.360 Additional security features, such as unique keyed locks or tamper-evident seals, are also used. 04:45.360 --> 04:46.840 I know what you're thinking. 04:46.840 --> 04:54.620 But Bia, in your other election talk, you said tamper-evident seals can be undetectably opened and manipulated. 04:56.100 --> 04:57.960 Okay, you do that. 04:57.960 --> 05:04.400 Go to the police station with your lockpicks and your acetone and open the ballot box. 05:04.400 --> 05:06.980 Let me know how that works out for you. 05:06.980 --> 05:16.380 The penalty for mail ballot fraud is up to five years in prison and $10,000 in fines for each act of fraud. 05:16.380 --> 05:19.340 That is in addition to state penalties. 05:21.080 --> 05:34.280 If the postal system and the ballot boxes still scare you, you can always drop off your ballot off by hand to the county clerk's or election board office. 05:34.280 --> 05:39.600 You may be saying that people are just going to print out their own ballots. 05:40.100 --> 05:44.500 But the ballots themselves are very difficult to forge. 05:44.500 --> 05:52.420 They use many security features, including special papers with UV-sensitive markings and watermarks. 05:52.420 --> 05:55.860 You can't just run to Staples and buy this stuff. 05:55.860 --> 06:02.580 If you have ever held a piece of fake money, you know how it feels different than the real thing. 06:02.580 --> 06:13.840 When the election officials are opening the ballots, the one that Bob printed out on his inkjet at home will definitely stick out. 06:13.840 --> 06:19.060 Some ballots use color shift ink or magnetic printing ink. 06:19.060 --> 06:25.940 This ink is extremely difficult to source and is delivered by armored truck. 06:25.940 --> 06:33.080 It's also worth noting that you need an actual printing press to use these inks. 06:33.080 --> 06:37.340 Bob won't just be loading that into his inkjet. 06:37.340 --> 06:42.880 Many ballots have micro-printed unique security codes or barcodes. 06:42.880 --> 06:50.860 This prevents duplicates and allows voters to track their ballot as it travels through the system. 06:53.490 --> 06:59.770 Another thing that this high official said is, they will forge signatures. 07:00.490 --> 07:05.870 But the voter's signature is verified with their past signatures. 07:05.870 --> 07:12.070 Some states provide extra training for their election workers to spot forgeries. 07:12.070 --> 07:17.930 If an inconsistency is found, it is reported to the state prosecutor's office. 07:19.630 --> 07:24.850 But you can vote twice, once by mail and once in person. 07:25.450 --> 07:29.070 That's a big cup of NOPE! 07:29.070 --> 07:33.190 Mail-in ballots are due before the election. 07:33.190 --> 07:39.210 This gives election officials time to check the voter off the roll as voted. 07:39.210 --> 07:45.990 If the voter goes and tries to vote in person, the state prosecutor's office is notified. 07:46.850 --> 07:52.770 Occasionally, people have received two ballots in the mail with their name on it. 07:52.770 --> 07:56.230 No, this does not mean you can vote twice. 07:56.230 --> 07:58.190 But how does this happen? 07:58.690 --> 08:02.810 Okay, how many of you have ever merged two databases? 08:02.890 --> 08:07.330 Well, the computer sees these two names as unique. 08:08.010 --> 08:24.470 Marge Bouvier, the name she used when she first registered to vote at age 18, and Marge Bouvier Simpson, the name she took after she got married to the handsome Homer Simpson and what is in the DMV system. 08:24.510 --> 08:34.590 When this state merged the DMV database with the voter registration database, Marge showed up twice. 08:34.590 --> 08:43.190 The good news is humans check these names and signatures on the ballot to catch these kinds of errors. 08:43.190 --> 08:50.770 If you ever receive two ballots, simply call the election office and they can correct the error. 08:50.770 --> 08:56.790 Now that we've debunked some myths, let's talk about how voting by mail works. 08:56.790 --> 09:03.630 Every state is in charge of its own elections, so it differs slightly from state to state. 09:03.630 --> 09:08.570 Some states allow you to vote by mail without a specific reason. 09:08.570 --> 09:12.370 Others require a valid reason to vote by mail. 09:12.370 --> 09:17.730 A few do not consider COVID to be a valid reason. 09:17.770 --> 09:23.830 But this is changing day by day, so check vote.org to see what your state is doing. 09:25.390 --> 09:29.070 The first step is to register to vote. 09:29.070 --> 09:35.050 39 states and the District of Columbia allow their citizens to register online. 09:35.050 --> 09:43.550 Every state has a printable registration form, so you can print it out and either mail it in or deliver it in person. 09:43.720 --> 09:46.930 Make sure that you register by the deadline. 09:46.930 --> 09:55.050 If it is getting close, bring that registration form to the clerk's office or election office in person. 09:55.050 --> 09:59.310 If you have not registered to vote, do it after this talk. 09:59.310 --> 10:00.450 I'm serious. 10:00.450 --> 10:02.410 It takes only two minutes. 10:02.410 --> 10:04.450 Literally two minutes. 10:04.450 --> 10:09.210 And it's very important, because every vote counts. 10:10.150 --> 10:13.350 I made this really big so you can take a screenshot. 10:13.670 --> 10:19.330 Go to register.vote.org to register. 10:19.330 --> 10:33.570 Vote.org has tons of great voter resources, including checking if you are registered, how to get a mail-in ballot, and a polling place locator and election reminders. 10:35.290 --> 10:39.090 Next, make sure you're eligible to vote by mail. 10:39.090 --> 10:43.550 Currently, five states have an all-mail-in ballot election. 10:43.550 --> 10:55.210 28 states and the District of Columbia have a no-excuse absentee voting, which means you can just vote by mail without having to give a specific reason. 10:55.210 --> 10:59.150 In 17 states, you need a valid reason. 10:59.150 --> 11:01.250 This differs from state to state. 11:01.250 --> 11:06.750 Some reasons include old age, being infirmed, or out of state. 11:06.750 --> 11:14.870 To see if you are eligible to vote by mail, go to vote.org for your state and see if you are eligible. 11:15.230 --> 11:24.610 Here is a map, and again, things are constantly changing, so check online at vote.org to see where your state fits in. 11:31.280 --> 11:35.100 Next, you have to request an absentee ballot. 11:35.200 --> 11:39.380 If you have not done this, do it now. 11:39.380 --> 11:43.820 After my talk, go and request your absentee ballot. 11:43.820 --> 11:49.480 This will give them time to add you on the list and mail out your ballot. 11:49.480 --> 11:50.380 Guess what? 11:50.380 --> 11:53.640 You can do this at vote.org. 11:56.400 --> 12:01.140 When you finally receive your ballot, sit down and fill it out. 12:01.140 --> 12:02.620 Right away! 12:02.620 --> 12:07.760 Don't put it in a pile of bills and junk mail you are ignoring. 12:07.760 --> 12:10.260 Sit down and just fill it out. 12:10.260 --> 12:15.320 One of the great things with mail and ballots is you can research the candidates. 12:15.320 --> 12:19.940 Get your OSINT on and find out what each candidate is all about. 12:19.940 --> 12:25.240 Who knows, perhaps that school board member actually owns a chocolate factory. 12:26.120 --> 12:35.220 COVID is a valid reason for many to vote by mail, and should be considered valid by all states. 12:35.220 --> 12:46.320 If a voter is immune-compromised or lives with someone who is, not allowing them to vote by mail is a form of voter suppression. 12:46.700 --> 13:00.980 Voting in person also brings the risk of COVID to the election workers, many of which are elderly retirees, putting their lives in danger just so you can vote in person. 13:00.980 --> 13:10.330 The poll workers also have to clean the machines between each vote, slowing the process and lengthening the poll lines. 13:11.520 --> 13:16.320 It also forces people to go to extremes to protect themselves. 13:16.320 --> 13:19.100 This lady had to wear a trash bag. 13:19.100 --> 13:23.190 Now that's one fashion statement that should never be made. 13:25.250 --> 13:32.990 In many states, processing of mail-in ballots can begin as soon as they are received. 13:32.990 --> 13:38.270 Other states do this anywhere from one month to the day of the election. 13:38.570 --> 13:48.030 By permitting election officials to do a lot of the work ahead of time, the counting process on election day will be quicker. 13:48.030 --> 13:58.250 It's important to note that if ballots are counted ahead of time, the results are not released before election day. 13:58.250 --> 14:05.370 Regardless of how they are counted, this is a great opportunity to perform a risk-limiting audit. 14:05.690 --> 14:08.950 And every state should do this. 14:08.950 --> 14:14.290 You have everything you need, hand-marked paper ballots and people to count them. 14:16.230 --> 14:21.030 But mail-in voting has tons of fraud. 14:21.030 --> 14:34.590 Between 2000 and 2014, over a billion mail-in ballots were cast, and a professor at Loyola School of Law found only 31 cases of fraud. 14:36.530 --> 14:40.250 There are many benefits to mail-in voting. 14:40.250 --> 14:46.530 Voter turnout is 10% higher, and it does not seem to be one party or another. 14:46.530 --> 14:55.990 It reduces some voter suppression, like poll intimidation, or people who have to travel a great distance to vote and have no transportation. 14:55.990 --> 15:02.510 Or people who have to work on election day, which should be a national holiday, by the way. 15:02.510 --> 15:07.410 It also protects from attacks by foreign actors. 15:07.410 --> 15:11.330 Kind of hard to hack a piece of paper, isn't it, Putin? 15:11.490 --> 15:17.370 One of the biggest benefits is it speeds up the election process. 15:17.370 --> 15:26.870 No long lines at polls, or people not being able to vote because of crashing e-poll books or slow election machines. 15:26.870 --> 15:36.150 The two most important things are it's a hand-marked paper ballot, and it allows for better informed voting. 15:36.150 --> 15:40.270 No more just randomly picking school board members. 15:41.730 --> 15:43.830 Remember this guy? 15:43.830 --> 15:52.690 The high-ranking government official from earlier voted by mail in 2017, 18, and 20. 15:52.690 --> 15:58.510 I guess the system is good enough for him, so why shouldn't it be good enough for us? 16:00.830 --> 16:03.230 And remember, get involved. 16:03.230 --> 16:04.730 Become a poll worker. 16:04.730 --> 16:12.830 See how the system works first-hand and give those old retirees a break, especially during COVID. 16:12.950 --> 16:17.110 You can actually save a life by becoming a poll worker. 16:17.110 --> 16:19.350 Don't want to go outside and see people? 16:19.350 --> 16:20.550 I don't blame you. 16:20.550 --> 16:21.970 Not a problem. 16:21.970 --> 16:30.170 You can lend your cybersecurity knowledge and skills to those who need it most by becoming a CyberSurge volunteer. 16:30.310 --> 16:32.210 This can be done by remote. 16:32.210 --> 16:36.190 You can do this by contacting this email or going to this site. 16:36.590 --> 16:40.290 Most important thing you can do is vote. 16:40.290 --> 16:43.890 Register to vote at vote.org and be counted. 16:44.550 --> 16:51.510 Thank you for listening to my talk, and don't forget to vote BSI Lab for President in 2044. 16:52.590 --> 16:56.130 This message paid for by BSI Lab for President 2044.