WEBVTT 00:50.110 --> 00:50.870 Welcome! 00:50.870 --> 00:54.950 Welcome to the DEF CON 28 safe mode. 00:54.950 --> 00:59.550 And this is the lounge of Voting Machine Hacking Village at DEF CON. 00:59.750 --> 01:07.930 This is the fourth time we are at DEF CON and this has been... every year it is a hassle to get everything running. 01:07.930 --> 01:11.830 This year we have been doing something we have never done before. 01:11.830 --> 01:14.930 Trying to go virtual in just a few months time. 01:14.930 --> 01:22.190 It has been a tremendous amount of work and so many people have been helping us to get this done. 01:22.650 --> 01:31.550 We are here in Quantico and at Quantico Cyber Hub, Voting Village, along with ICS Village and a couple of other villages. 01:31.550 --> 01:39.770 We are operating our back end from the same central location so that we can help each other and support each other through this whole exercise. 01:40.530 --> 01:43.490 It's very nice, to be back in DEF CON. 01:43.490 --> 01:50.990 This is really a weird experience because we are not meeting in a meet space instead of in a virtual space. 01:51.050 --> 02:04.250 I certainly hope next year we will be able to again have our controversies, have our disagreements and our wonderful fears over physical space and do it that way. 02:04.290 --> 02:11.290 Before I start to introduce what this year is going to bring, let me first of all thank Mary Hamlin. 02:11.290 --> 02:15.490 She is behind the scenes helping to organize this whole thing. 02:15.610 --> 02:19.490 My two co-organizers will have a little bit of word. 02:19.610 --> 02:33.030 Unfortunately, I will need to speak on behalf of one of the co-organizers because he is home and unfortunately so ill that he felt that coming to video call is too much a hassle at the moment. 02:33.030 --> 02:39.690 But let's start from Maggie a member of MacAlpha and one of the co-organizers. 02:39.710 --> 02:41.350 Maggie, if you want to give a word. 02:42.490 --> 02:44.390 Yeah, thank you all so much for joining us. 02:44.390 --> 02:48.730 This is obviously a really crazy year, but maybe it's going to be a really good year. 02:48.730 --> 02:51.710 It's really interesting to see what DEF CON virtual is like. 02:51.710 --> 02:55.210 Obviously, this is a very important year from election perspective. 02:55.210 --> 02:58.110 You may have heard there's going to be an election later this year. 02:58.450 --> 03:05.570 So we hope that you will find our talks interesting and engaging and we hope they will make you want to vote even harder than ever. 03:05.890 --> 03:09.330 That is definitely going to be really important this year. 03:09.350 --> 03:11.310 So thank you so much for joining us. 03:11.310 --> 03:14.330 Please have patience as we build this airplane in the sky. 03:14.330 --> 03:25.070 We think we've got a really great lineup for you and we're just we're just really excited to have been able to meet you virtually this year and to just in general be able to share what we can of the voting village with you. 03:25.070 --> 03:26.590 And I'll turn it over to Dan. 03:26.590 --> 03:31.190 Well, the next person to be introduced is Dan Weber. 03:31.470 --> 03:40.870 Previous years we have been really running this mostly out of our own pocket and we haven't had a non-profit of our own to support our operation. 03:40.870 --> 03:42.790 This year it changed. 03:42.790 --> 03:48.990 We have finally completed incorporation of non-profits supporting the Voting Village Election Index Foundation. 03:48.990 --> 03:55.370 Dan Weber is a co-organizer of the Voting Village and also the CEO of our non-profit Election Index Foundation. 03:55.370 --> 03:55.830 Dan. 03:56.030 --> 03:57.490 Thank you, Laurie. 03:57.490 --> 03:58.530 Hey, guys. 03:58.530 --> 04:01.810 It's a pleasure and honor to be here and talk to you guys today. 04:02.030 --> 04:17.790 You know, it's really important this year from Election Integrity, not that it's more important any other year, but with everything going on in the world and such, you know, there's just a heightened sensitivity as well as a need to get out there and to volunteer, 04:17.790 --> 04:19.510 be part of the process. 04:19.690 --> 04:22.610 You know, if you can get people out to vote, that's great. 04:22.610 --> 04:31.010 If you can go and become a poll worker, that's even more important because, you know, with the aging population and folks and that, they're just not able to come out. 04:31.010 --> 04:34.250 And so, you know, get out there and volunteer for it. 04:34.250 --> 04:36.050 You know, we're very privileged. 04:37.050 --> 04:43.910 HBO, if you probably have seen it, is not go to at Voting Village DC and that you'll find the link. 04:44.510 --> 04:53.070 They've opened up the movie Kill Chain, of which both Hari and Maggie are part of and such, for a free viewing for all of DEF CON. 04:53.070 --> 04:58.750 So until Sunday night, 1159, you know what I'm saying, p.m., they've allowed us to go out and do that. 04:58.750 --> 05:05.210 You know, visit us at Election Integ, which is a Twitter hashtag for it and such, and be part of it. 05:05.210 --> 05:20.550 You know, part of our goal and mission is to continue to do these Voting Villages, to do education, get out there and teach folks about, you know, cyber security around the election and participate with other communities and such that are out there. 05:20.550 --> 05:30.570 And so, we really appreciate the support and you bearing with us this year as, you know, we've gone into safe mode with DEF CON here at the Voting Village. 05:30.570 --> 05:31.850 Thanks so much, guys. 05:32.350 --> 05:32.770 Hari? 05:32.770 --> 05:33.490 Yeah. 05:33.950 --> 05:44.230 So, as we are now official non-profit, we also are doing a little fundraising by selling swag. 05:44.230 --> 06:09.370 There's a link in our Discord where you can choose which kind of swag you might want to buy if you want to support our ongoing effort to educate people on cyber warfare and cyber security on election and election security on whole outside of cyber, because we're talking a lot about election security measurements and educating which are in the physical space instead of cyber space. 06:09.370 --> 06:12.110 And a huge shout out to Mara Williams for doing our art this year. 06:12.110 --> 06:14.530 It's really incredible, really beautiful stuff. 06:15.830 --> 06:23.490 And last but not least, I mean, the movie which I mentioned, it was filmed three years at DEF CON. 06:23.490 --> 06:27.050 So, you see a lot of familiar faces from Dark Tangents to Dr. 06:27.050 --> 06:28.550 Mouse in the movie. 06:28.550 --> 06:30.570 So, I hope you join in for us. 06:30.570 --> 06:38.910 And now, unfortunately, Matt Blaze, one of the co-founders and co-organizers that he is, he's very excited. 06:38.910 --> 06:40.950 We have worked very hard for this. 06:40.990 --> 07:06.590 He has been having a undespecified , hopefully not corona, and he is home in condition that he... I spoke with him just before this, and he wanted me to express how excited he is and how he's regretting that at this point of time, he didn't feel that doing a video call would be possible because of how ill he is. 07:06.590 --> 07:12.950 So, we certainly hope a speedy recovery and that everything turns out the best possible way. 07:12.970 --> 07:27.650 And we truly miss that he's not here with us because Matt has always been, not only for our village, but DEF CON and all the other conferences, such a huge amount of energy and encouragement and guidance, how to get these things done. 07:28.630 --> 07:37.890 So, this year, because it's election year, and this is an election year, not only in the United States of America, but in a number of other countries. 07:37.890 --> 07:56.510 So, we are so focused in the everything dominating cycle about US elections that we forgot there are a number of other important democracies who are equally having a shed water election this year, still this year. 07:56.510 --> 08:01.570 So, let's keep in mind, we are all in this together as a democracy. 08:01.570 --> 08:04.010 We all are facing similar challenges. 08:04.010 --> 08:09.490 We all have similar kind of attacks against our systems and our governance. 08:09.490 --> 08:12.550 So, whatever we have to do, 10:10.840 --> 10:15.800 we will have a few talks about that, but more about that later. 10:15.800 --> 10:24.460 First of all, I would like to introduce a follow-up of our last year started Unhack the Ballot initiative. 10:24.620 --> 10:28.920 Unhack the Ballot, which we started last year, was never intended to be a run-off. 10:28.920 --> 10:53.760 It was ongoing, and the concept in its heart is to provide election officials, local election officials, who are under-resourced and have limited access to knowledge and expertise, access to the local area, willingly patriotic wherever they are, hackers and security researchers who can provide them information, 10:53.760 --> 10:58.280 guidance, advice, valuation of what they have been proposed. 10:58.300 --> 11:00.600 So, we started that last year. 11:00.600 --> 11:10.840 Because 2020 is such an important election year for the U.S., and we are facing a unique set of problems, we were not preparing the coronavirus. 11:10.840 --> 11:22.560 We have to, right now, a lot of things have to be changed and implemented from practices from another state, have to be implemented over the board, see how that fits to the local laws and practices. 11:22.560 --> 11:26.860 We started an initiative called CyberSearch. 11:27.180 --> 11:32.560 CyberSearch, this year, is starting right now and ending up the election. 11:32.560 --> 11:42.840 This is a one-off initiative and project, making that Unhack the Ballot as efficient as possible for this election year. 11:42.840 --> 11:53.240 We have been calling volunteers, and we have in the Discord channels for the CyberSearch, both in text and in video. 11:53.640 --> 12:12.940 We have been calling volunteers who want to help their local election officials, and we have obviously offered also the local election officials who need to have help, to identify themselves and tell us what they think would be the best resources they would need to have, 12:12.940 --> 12:14.200 or want to have. 12:14.400 --> 12:19.900 Bearing in mind that sometimes they don't even know, unfortunately, exactly what they need. 12:19.900 --> 12:22.020 But that's part of the learning experience. 12:22.340 --> 12:26.120 We have in our head a false image. 12:26.260 --> 12:34.060 We think that there is an election office, and the election office has an IT department, and the IT department has a secretary of practice. 12:34.440 --> 12:41.700 That is very much not true with most of the United States, and most of the world actually, especially not most of the U.S. 12:42.480 --> 12:50.740 There is an election office, and they might have one or two IT people part-time, and volunteers. 12:50.740 --> 12:53.840 No secretary of practice whatsoever. 12:53.960 --> 12:56.280 Security, if it's existing, is outsourced. 12:56.280 --> 13:07.860 It comes from organizations who are volunteering help, like Department of Homeland Security, or volunteers and companies who are selling them services, but they really don't have expertise. 13:08.800 --> 13:20.620 And if you look, since help America, new technology has been pouring in, you really just have an IT department who happens to do elections, and not the other way around. 13:20.620 --> 13:30.180 So local election officials need help, and they don't have funds, they don't have resources, they don't have access to the expertise. 13:30.180 --> 13:38.720 So we are here to help and make sure that any way we can, we will pair knowledge to the people who need to have the knowledge. 13:38.720 --> 13:41.200 And local election officials, they're working really hard. 13:41.200 --> 13:42.460 They're good people. 13:42.580 --> 13:45.980 They are in an impossible situation. 13:46.260 --> 13:52.420 Impossible situation because of the asymmetric nature of cyber war. 13:52.420 --> 14:00.140 Every other war we've fought, land, sea, underwater, air, space, are natural domains with natural laws of physics. 14:00.300 --> 14:01.840 Cyber is a domain. 14:02.480 --> 14:06.820 Inherently asymmetric. 14:06.820 --> 14:11.240 And in that environment, they are fighting a war. 14:11.260 --> 14:20.720 If you, if a foreign nation would have a land invasion with the tanks coming to the U.S., you wouldn't ask the local sheriff, please stop them. 14:20.800 --> 14:23.480 In reality, that's what happens in local election officials. 14:23.480 --> 14:33.260 They are the last and only line of defense, massively out-of-pocket, and they are dealing with the nation-state highly-motivated attacks. 14:34.300 --> 14:39.660 So please join us in that initiative in Discord. 14:39.800 --> 14:50.400 Also, please join us in the Election Industry Foundation and tell what the Election Industry Foundation can do to help you, especially when we move to education, etc. 14:50.720 --> 14:56.480 Please join us with the Kilcheng movie on the movie night. 14:56.900 --> 14:59.940 Speaker track will start right after this talk. 15:00.460 --> 15:09.000 And speaker track this year, because we are virtual, we have turned this to be a little bit different tone than last year's. 15:09.000 --> 15:18.460 Last year's, because we, after the talks, we have been able to have a debate on the hallways and the room, and you can get feedback. 15:18.460 --> 15:19.600 There's a lot of opportunities. 15:19.600 --> 15:21.320 We don't have that this year. 15:21.340 --> 15:35.580 The speakers have no way of knowing whether the talk was well-received or not at the time the talk is over or immediately after that, because there's this one-way street right now in most cases. 15:36.060 --> 15:38.080 So we are here to help you. 15:38.360 --> 16:02.400 So this year, we have been deliberately inviting speakers who are proposing or asking comments for ideas, which has been partially rejected by security companies, controversial speakers who come with a package and are wanting to have a feedback or are offering a dataset for research. 16:02.480 --> 16:12.020 So what we want to do, we invite, the same way as in DEF CON, we are going to compile, normally at DEF CON, we are compiling annual report. 16:12.040 --> 16:18.740 And in this year, the annual report will have a bigger section about the speaker track talks than normally is. 16:18.740 --> 16:29.800 We are inviting feedback in short form or long form, with your name to be quoted, with your handle only, or completely anonymous. 16:30.360 --> 16:35.220 Feedback, comments, short form, long form, for all the talks. 16:35.220 --> 16:51.620 And from those, we will compile into the annual report for the speakers, for the community at large, what were the guidance, what were the thoughts from the greater security community around the world, and especially in the US. 16:52.120 --> 17:04.800 So we are welcoming that, and this is something which we saw the opportunity because we go to virtual, where we can do something which we wouldn't have been doing when we were in person. 17:05.720 --> 17:20.500 Again, since we are doing this this way, this year, as always, but especially this year, being selected as a speaker is not endorsement by us that we are behind the speaker or the ideas. 17:20.820 --> 17:24.580 We don't stand in that. 17:24.580 --> 17:33.080 Instead, we're saying there's a lot of things that we need to talk about and what we need to be educating each other. 17:33.600 --> 17:36.760 So please provide your feedback. 17:36.760 --> 17:40.140 In the case there's a research, please provide your research. 17:40.140 --> 17:49.220 We have given you all in the documentation, in the speaker track documentation, and our onboarding guide, links how to find everything. 17:49.220 --> 18:05.240 And the idea, again, is you can provide the feedback in any mode, long form, short form, anonymous, handle, or name, or background information without quotation at all. 18:05.240 --> 18:09.640 We are actually asking if you want to be quoted, even if you are anonymous. 18:09.640 --> 18:11.780 So please provide us feedback. 18:11.780 --> 18:12.900 We will compile it. 18:12.900 --> 18:19.700 And since we don't have the normal physical hacking going that much, the report will be more about that. 18:19.700 --> 18:33.560 We also encourage, because people have from last year, all the things and information which you have extracted from the physical devices we have, all that research is hopefully going to resume. 18:33.560 --> 18:44.300 And once there's outcomes of those research, we are more than willing, and we are welcoming, and we are almost begging, we send that information, and we will compile it to our annual report. 18:47.150 --> 19:01.610 Last but not least, this year, because of the nature of this pandemic, as it were, we are quickly changing the gears. 19:01.610 --> 19:09.410 There have been a lot of debate out on the media, a surge of interest. 19:09.410 --> 19:15.570 We have all probably been exposed about the controversy over mail-in balloting. 19:15.590 --> 19:34.870 There is, again, these ideas about internet voting, or mobile phone voting, or blockchain voting, ideas which are not only rejected by the security community, but also over and over demonstrated in academic papers and theoretical papers, why this is not an implementation issue, 19:34.870 --> 19:45.330 this is a fundamental issue, which we don't think there's a solution in the foreseeable future, how these technologies can be implemented. 19:45.330 --> 20:07.910 So we have talks which are explaining how you run elections in this environment, mechanically used to increase the trust, one of those being a paper last week published about how the ballot-marking devices are unauditable, so why that technology, even when it provides a piece of paper, 20:07.910 --> 20:10.190 actually is not trustworthy. 20:10.230 --> 20:20.970 That would have been a bigger part of the debate if we would be voting more in person, but nevertheless, that is a role in new technology. 20:20.970 --> 20:39.210 We will be having talks about tools, how you can check and communicate about your own elections with centralized resources, find out and validate if what you have seen is something which should be further investigated and should be further reported. 20:39.210 --> 20:49.690 We are always talking about risk-limiting audits as a method of validating that the outcome of the election has picked up the right winners. 20:49.690 --> 20:58.670 Risk-limiting audits is a low-labor mathematical method which allows a huge public participation and transparency. 20:58.950 --> 21:13.670 The method is about proving that the election outcome is right, not that every single last vote is counted accurately, because that never happens really, and it doesn't matter if the election is still proven to have right results. 21:14.210 --> 21:23.030 And as always, we are going to have conversations about what are all the ways we can do to improve and get this better. 21:24.210 --> 21:28.750 So, we have the channels open. 21:29.170 --> 21:33.810 I hope, since I'm on the podium, I can pretend 20 minutes ago. 21:35.010 --> 21:39.370 We have channels there to ask staff. 21:39.370 --> 21:41.110 We are here to help. 21:41.150 --> 21:51.110 We can make changes if you have an idea, if you have a project which you want to quickly introduce to other people. 21:51.110 --> 21:54.010 We do have a video and voice channels. 21:54.070 --> 22:04.350 Contact staff saying, I would like to make a mini-talk, and I have this research project, I have these results, I have this image file I want to look at. 22:04.350 --> 22:07.530 Whatever it is you want to do. 22:07.970 --> 22:10.170 Ask us, can we do this? 22:10.170 --> 22:12.610 Please send us a note. 22:12.710 --> 22:15.430 We will figure out the time slot. 22:15.450 --> 22:23.950 We will put you into one of the video channels, and we will make announcement on the announcement channel that this new activity is going to be in it. 22:24.090 --> 22:37.010 Whatever we can do to help make this more enjoyable for you, make more... leverage your knowledge, make this to be better experience, more educating experience, let us know. 22:37.230 --> 22:39.770 Whatever we can do, we are here to help. 22:42.750 --> 22:47.710 And again, this is... no one of us has been here before. 22:49.130 --> 22:52.130 One thing I can guarantee, this is not going to be a smooth ride. 22:53.570 --> 23:05.690 So, bear with us and forgive us in the head that there will be glitches, there will be something going wrong, and if you see something, say something, same as every year. 23:05.690 --> 23:10.990 Let us know what went wrong immediately, so that we can try to fix it as it happens. 23:10.990 --> 23:24.990 We have a back... hold back infrastructure, enabling us to, in a quite speedy manner, to address a lot of technical issues and address a lot of things which you might come up with. 23:24.990 --> 23:27.910 And of course, you know, you have new ideas. 23:29.050 --> 23:34.390 So, be active with us, because we want to be active with you, and we are here to help. 23:34.450 --> 23:47.630 Without further ado, I probably forgot something I shouldn't say, but without further ado, I hope you have a safe, and you stay safe, you have a safe 2028, safe month. 23:47.630 --> 23:48.710 Thank you.