1
00:00:01,040 --> 00:00:07,940
Hi, my name is John Odom, and I'm currently the city clerk in Montpelier, Vermont.

2
00:00:08,100 --> 00:00:12,060
In that capacity, I'm also the election administrator.

3
00:00:12,300 --> 00:00:15,380
And, boy, has this been a year for that.

4
00:00:15,380 --> 00:00:20,120
We've got our own statewide primary coming up in about a week and a half.

5
00:00:20,120 --> 00:00:24,760
So, even taking a little time to record this is kind of challenging.

6
00:00:25,680 --> 00:00:30,060
I'm also a certified ethical hacker.

7
00:00:30,060 --> 00:00:37,900
I've been in charge of a couple networks and been a database administrator for various non-profits.

8
00:00:37,980 --> 00:00:53,220
So, I tend to have a little more hands-on knowledge than most of my colleagues in the industry, but not as much as you might think, because my life's a little busy and I don't get to practice this stuff very much.

9
00:00:53,220 --> 00:01:02,480
Anyways, I want to bring something to folks who participate in the Voting Village's attention.

10
00:01:02,480 --> 00:01:08,060
And it's not something that has been ignored, but I think it's something that deserves a little more attention.

11
00:01:09,220 --> 00:01:15,320
To make the point about how concerned I am, I'm going to tell you a little story.

12
00:01:16,020 --> 00:01:21,560
And this is not exactly on topic, but I want to use it to make a point.

13
00:01:21,560 --> 00:01:44,340
Several years back in Memphis, and some of you may have heard this story, there was a local election, the mayor was being elected, various local officials, and one clever person decided to compare the turnout from the tape, and most tabulators generate some sort of tape,

14
00:01:44,340 --> 00:01:53,600
some sort of physical record of the time listing the votes, and compare that number with what was reported through the GEMS system.

15
00:01:53,600 --> 00:02:00,620
And I know also a lot of folks who've been participating in Voting Village share some concerns about that system.

16
00:02:01,380 --> 00:02:04,460
Well, the numbers did not add up.

17
00:02:04,540 --> 00:02:17,310
According to the tape, 546 people in this particular precinct had voted, according to the tape, and the system only showed 330.

18
00:02:18,010 --> 00:02:27,550
They looked at this, they looked at other precincts, they found the same problem, especially in districts with heavy minority populations.

19
00:02:29,010 --> 00:02:36,750
Big problem, it's the problem we talk about at DEFCON, but I want to present another scenario to you.

20
00:02:36,750 --> 00:02:52,830
Consider this happening on a statewide level, not district by district, not precinct by precinct, not through any one individual network of voting machines, but an entire state.

21
00:02:53,730 --> 00:02:57,770
There are statewide systems that manage databases.

22
00:02:57,770 --> 00:03:08,370
This is mandated by the Help America Vote Act, which came in the wake of the 2000 presidential election voting debacle.

23
00:03:08,370 --> 00:03:15,330
You know, the hanging chads, the numbers that didn't add up, and it all went to the courts and it went to the Supreme Court.

24
00:03:15,790 --> 00:03:26,830
After that, there was a bipartisan group that got together, federally mandated, and came up with several recommendations.

25
00:03:26,830 --> 00:03:30,270
Now, generally, they were very good recommendations.

26
00:03:30,270 --> 00:03:33,850
I don't want to disrespect HAVA at all.

27
00:03:33,850 --> 00:03:54,670
One of the recommendations, understandably, was that states should be working on their voter rolls through one centralized system, one centralized statewide database that would contain all the voter registration information.

28
00:03:54,670 --> 00:03:57,630
But obviously, you can see where I'm going with this.

29
00:03:57,750 --> 00:04:04,810
There are concerns about, or we have to be concerned, about the security of these systems.

30
00:04:04,810 --> 00:04:12,550
So these statewide systems don't all necessarily just hold the voter registration information.

31
00:04:12,550 --> 00:04:18,850
A lot of them, including in my home state of Vermont, are actually election management systems.

32
00:04:19,750 --> 00:04:28,150
Election administrators will report their information for election night reporting.

33
00:04:28,750 --> 00:04:39,750
Sometimes we will work directly into these systems to manage it, to create our reports, to create our elections and local elections, and manage them directly out of that.

34
00:04:39,750 --> 00:04:42,430
So there's a lot going on with these systems.

35
00:04:42,430 --> 00:04:47,710
They are very important, and local administrators have come to really depend on them.

36
00:04:47,710 --> 00:04:49,770
Well, how are they doing?

37
00:04:49,990 --> 00:04:51,830
Could be better.

38
00:04:52,090 --> 00:04:55,850
I want to talk about the famous Mueller Report.

39
00:04:55,930 --> 00:05:01,830
Now, tucked away in that is this little gem that I'm going to read here, part of it.

40
00:05:01,870 --> 00:05:13,830
It says, in addition to targeting individuals involved in the Clinton campaign, Mueller's operation also targeted individuals and entities involved in the administration of the elections.

41
00:05:13,830 --> 00:05:15,250
Victims included U.S.

42
00:05:15,250 --> 00:05:24,550
state and local entities, such as state boards of elections, secretaries of state, and county governments, as well as individuals that work for the entities.

43
00:05:24,610 --> 00:05:37,570
They also targeted private technology firms responsible for manufacturing and administering election-related software and hardware, such as voter registration software and electronic polling stations.

44
00:05:37,570 --> 00:05:40,590
Now, here's the scary part.

45
00:05:40,590 --> 00:05:59,110
The report says that foreign actors targeted state and local databases of registered voters using a technique known as SQL injection, by which malicious code was sent to the state or local website in order to run commands.

46
00:05:59,110 --> 00:06:16,670
In one instance, in approximately June of 2016, the working group was able to compromise the computer network of the Illinois State Board of Elections by exploiting a vulnerability, presumably a SQL injection-related vulnerability.

47
00:06:16,670 --> 00:06:22,770
This gave them access to a database containing information on millions of registered Illinois voters.

48
00:06:22,770 --> 00:06:27,370
The group extracted data related to thousands of U.S.

49
00:06:27,370 --> 00:06:31,010
voters before the malicious activity was identified.

50
00:06:31,790 --> 00:06:43,450
Alright, so beyond just the obvious scary here, you know, okay, a lot of you folks will know that code injection is a very big deal.

51
00:06:43,450 --> 00:06:49,710
Code injection is, you know, it's where most of the hacks come from these days.

52
00:06:49,710 --> 00:06:50,950
But SQL?

53
00:06:52,110 --> 00:06:57,730
SQL injection is something we have been aware of for many years.

54
00:06:57,990 --> 00:07:00,470
We know how to harden against it.

55
00:07:00,610 --> 00:07:07,170
So my question is, why wasn't it already hardened against it?

56
00:07:07,170 --> 00:07:09,710
SQL injection is very easy.

57
00:07:09,710 --> 00:07:14,910
One line fed through to a database from a simple login screen can get you in.

58
00:07:15,530 --> 00:07:18,810
We know input validation is the solution.

59
00:07:18,870 --> 00:07:21,510
So where the hell was the input validation?

60
00:07:22,890 --> 00:07:35,870
What that says to me is, and you, again, to refer to Voting Village in the last few years, what's gotten a lot of attention was the simulation of the statewide voter database.

61
00:07:35,870 --> 00:07:46,070
It's got national coverage that kids could sit down at this simulation and they could hack right into our dummy statewide voter registration system.

62
00:07:46,070 --> 00:07:55,830
Well, of course, the pushback and all the yelling and hollering from the secretaries of state were that this was a phony simulation.

63
00:07:55,830 --> 00:07:58,770
That their systems are actually far more secure.

64
00:07:58,770 --> 00:08:01,950
Somehow this was set up to be hacked to make their point.

65
00:08:01,950 --> 00:08:17,170
Well, if SQL injection is a way to get into this stuff, I would argue that those systems, those dummy systems we made up, maybe were not loose and accessible enough.

66
00:08:17,170 --> 00:08:25,370
So, all right, so let's talk about HAVA, the Help America Vote Act.

67
00:08:26,630 --> 00:08:29,070
And I'm going to read a little bit from it.

68
00:08:29,070 --> 00:08:47,150
Part of the mandate is each state acting through the chief state election official shall implement in a uniform and nondiscriminatory manner a single uniform official centralized interactive computerized statewide voter registration list defined, maintained and administered at the state level.

69
00:08:47,150 --> 00:08:52,050
So states have no choice but to do this.

70
00:08:52,050 --> 00:08:56,830
And again, populations, what they are, it's completely understandable.

71
00:08:56,990 --> 00:08:59,130
So what do states do?

72
00:08:59,170 --> 00:09:02,650
Well, several do in-house development.

73
00:09:03,730 --> 00:09:16,530
In Vermont, we used to, our first database, our first election management system out of the box, out of HAVA was an internet facing FoxPro application.

74
00:09:17,190 --> 00:09:20,170
It was pretty crude.

75
00:09:20,770 --> 00:09:31,630
But these days, and other states currently are still doing in-house solutions, states like Colorado, Illinois, Kentucky.

76
00:09:31,630 --> 00:09:35,650
You could put together something pretty nice if you knew what you were doing.

77
00:09:36,990 --> 00:09:42,450
Obviously, then the networks they sit on, the municipal networks, are potentially vulnerable too.

78
00:09:42,470 --> 00:09:46,030
But if you can get in by SQL injection, why bother?

79
00:09:46,730 --> 00:09:52,410
Okay, but more and more often, you see these states using vendors.

80
00:09:52,410 --> 00:10:04,890
And these are vendors, you know, it's like any niche application, any niche market, you're going to get niche vendors who pop up specifically to serve that market.

81
00:10:07,010 --> 00:10:10,350
So before this, we had somebody call around.

82
00:10:10,350 --> 00:10:13,170
I wanted to know what states used what.

83
00:10:13,170 --> 00:10:16,190
How many of them used one vendor versus another?

84
00:10:16,190 --> 00:10:18,650
How many of them were designing in-house?

85
00:10:18,650 --> 00:10:26,230
I don't know if I can really say this, but word got out that we were calling around and there were people who were less than thrilled.

86
00:10:28,630 --> 00:10:34,090
And defensiveness in public systems should really make us all uncomfortable.

87
00:10:34,090 --> 00:10:43,370
Now, I want to look at one particular vendor right now, because I have a little more firsthand familiarity with it, called PCC.

88
00:10:44,190 --> 00:10:50,530
Now, here's a list from their website of their current clients.

89
00:10:51,130 --> 00:11:03,610
Okay, now factoring out for the consulting only options here, that's 15 states doing database management in election application hosting for voter registration, election night reporting.

90
00:11:04,090 --> 00:11:06,790
So who is PCC?

91
00:11:06,790 --> 00:11:08,990
Well, this is part of the problem.

92
00:11:08,990 --> 00:11:10,130
Who knows?

93
00:11:10,350 --> 00:11:14,130
Go to PCC's website and no staff is listed.

94
00:11:14,410 --> 00:11:17,470
Only board officers, not even the whole board.

95
00:11:17,730 --> 00:11:22,410
Now, I didn't do research on people who did show up.

96
00:11:22,410 --> 00:11:25,350
I probably should have, I could have, but I didn't.

97
00:11:25,350 --> 00:11:29,670
I don't want to knock them without any basis or unnecessarily then.

98
00:11:30,810 --> 00:11:34,590
And, you know, they seem to be perfectly reputable people.

99
00:11:34,590 --> 00:11:39,430
I didn't see any, the one I did look at, I didn't see any obvious big political connections.

100
00:11:40,650 --> 00:11:53,570
CEO Tom Ambergy is a big, was a big shot at Central Square Technology, for example, and they were recently at a major hack, a Magecart attack.

101
00:11:53,670 --> 00:11:56,750
Now, you know, I don't want to beat them up too much for a Magecart attack.

102
00:11:56,750 --> 00:11:57,750
They're good.

103
00:11:57,750 --> 00:12:02,150
But Magecart attacks generally use JavaScript injections.

104
00:12:02,150 --> 00:12:04,210
So it's something that could be hardened for.

105
00:12:04,370 --> 00:12:09,290
And with election systems, there's just no margin for error.

106
00:12:09,290 --> 00:12:11,610
You've got to be ahead of these games.

107
00:12:11,610 --> 00:12:17,310
So I wouldn't say that was a big concern of mine, but it does raise my eyebrow a little bit.

108
00:12:18,690 --> 00:12:35,150
But let's look at some of these proposals that PCC or organizations like PCC have put forward to the states to try to get their business.

109
00:12:35,150 --> 00:12:40,730
I want to show you the one from Delaware and just pieces of it.

110
00:12:40,730 --> 00:12:42,730
It's, of course, very, very long.

111
00:12:42,730 --> 00:12:55,130
But I'm going to show you here a typical page from the publicly posted proposal from PCC to run their election systems.

112
00:12:58,160 --> 00:13:02,660
OK, when you look at this, this is what you'll see.

113
00:13:03,340 --> 00:13:05,740
Not much.

114
00:13:07,080 --> 00:13:17,380
I, you know, I didn't do the measurement and everything, but from my glance, I would say at the most about 20 percent of this entire proposal is visible.

115
00:13:17,380 --> 00:13:19,400
So that's me being generous.

116
00:13:19,700 --> 00:13:25,140
Now, of course, I understand companies have proprietary information.

117
00:13:25,140 --> 00:13:28,620
They have proprietary stuff that's standard for any RFP.

118
00:13:28,620 --> 00:13:30,640
You expect that.

119
00:13:30,640 --> 00:13:32,280
But come on.

120
00:13:32,940 --> 00:13:34,820
Why even post it at all?

121
00:13:34,820 --> 00:13:40,100
I mean, this is something made available to the public, you know, public records.

122
00:13:40,280 --> 00:13:41,760
But it's not.

123
00:13:41,800 --> 00:13:44,120
I mean, it's it's it's almost a joke.

124
00:13:44,120 --> 00:13:47,120
If I didn't know better, I'd say it was almost passive aggressive.

125
00:13:47,480 --> 00:13:53,720
But what bothers me the most in terms of the redactions is all the staff is redacted.

126
00:13:53,720 --> 00:13:54,980
And this is typical.

127
00:13:54,980 --> 00:13:59,620
So just like the website, we don't know who's working on this.

128
00:13:59,620 --> 00:14:04,300
And that bothers me a lot because people have their own interests.

129
00:14:04,300 --> 00:14:09,720
They come from backgrounds, partisan backgrounds, nonprofit backgrounds.

130
00:14:09,720 --> 00:14:12,280
I think it's reasonable.

131
00:14:12,280 --> 00:14:27,580
And I don't think it necessarily, you know, reveals any particular corporate secrets that we could have some idea who the people are doing this stuff, either in an individual state or even at the company proper.

132
00:14:28,400 --> 00:14:32,420
Now, financials are also redacted.

133
00:14:32,420 --> 00:14:36,920
I know that's a thing that's very standard, but I would argue that it shouldn't be.

134
00:14:37,060 --> 00:14:45,540
I think our right to know trumps any embarrassment or discomfort of big companies.

135
00:14:45,540 --> 00:14:50,240
And publicly, we might not want one that's on the edge of bankruptcy.

136
00:14:50,240 --> 00:14:51,980
And we might want to see that.

137
00:14:51,980 --> 00:14:54,280
So so here is the problem.

138
00:14:54,280 --> 00:14:58,520
There are very few companies doing this.

139
00:14:59,480 --> 00:15:01,240
And they are opaque.

140
00:15:01,240 --> 00:15:03,400
We don't know who they are.

141
00:15:04,640 --> 00:15:06,120
And that's basically it.

142
00:15:06,120 --> 00:15:07,000
We don't know who they are.

143
00:15:07,000 --> 00:15:08,500
And that's scary.

144
00:15:08,500 --> 00:15:11,340
That's very, very scary, at least to me.

145
00:15:11,960 --> 00:15:14,520
And it does matter.

146
00:15:14,520 --> 00:15:24,980
In Georgia, they had a recent problem, a debacle involving their voter rolls, involving the voter registration.

147
00:15:24,980 --> 00:15:28,180
Now, this wasn't exactly what I'm talking about.

148
00:15:28,180 --> 00:15:36,500
But it makes the point about how badly you can screw up an election simply by screwing up voter rolls.

149
00:15:36,500 --> 00:15:39,760
You can disenfranchise people in a big election crush.

150
00:15:39,760 --> 00:15:52,200
They're just not going to get to vote or they're going to have to fill out an enormous amount of provisional ballots, which honestly might not necessarily get counted the way they should be.

151
00:15:52,240 --> 00:16:06,380
Now, during a court case involving this whole debacle, a lot of insecurities, a lot of vulnerabilities in the PCC system was was brought to the attention of the court.

152
00:16:06,380 --> 00:16:09,880
After that, Georgia decided to pull back.

153
00:16:09,880 --> 00:16:13,520
Their contract ran out and they decided to pull it back in-house.

154
00:16:13,520 --> 00:16:16,200
So that's a pretty unusual step to take.

155
00:16:16,200 --> 00:16:20,200
And it shows you just how concerning those vulnerabilities were.

156
00:16:20,980 --> 00:16:24,980
Now, you know, we've got our public officials doing this.

157
00:16:24,980 --> 00:16:31,700
Can we count on our public officials to be straight with us about this stuff if there's a problem?

158
00:16:31,700 --> 00:16:34,440
Well, obviously not.

159
00:16:34,440 --> 00:16:40,480
And again, I don't mean to knock secretaries of states, but they have their own interest.

160
00:16:40,480 --> 00:16:46,620
They have an interest in getting reelected, and that means they have interest in looking competent.

161
00:16:46,980 --> 00:16:50,560
Now, some of them like to talk about internal security a lot.

162
00:16:50,560 --> 00:16:52,900
You know, we've upgraded this to make it better.

163
00:16:52,900 --> 00:16:55,460
We've got better voting machines to make this better.

164
00:16:55,460 --> 00:17:06,160
We're doing our due diligence within the sphere that we control in order to do a better job and get reelected.

165
00:17:06,160 --> 00:17:10,540
They don't like to talk about the potential for things outside.

166
00:17:10,820 --> 00:17:29,140
And that means they don't necessarily like to talk about the walls that they've built that they're responsible for that are, you know, the dividing the firewall, pardon the expression, between the voters and the outside world where you could have malicious actors.

167
00:17:29,140 --> 00:17:32,900
And again, with the Mueller report, we're talking about advanced persistent threats.

168
00:17:32,900 --> 00:17:37,040
We're talking about state actors, but not necessarily.

169
00:17:39,520 --> 00:17:46,480
So secretaries of state have a vested interest in saying everything's rosy and everything's wonderful.

170
00:17:46,480 --> 00:17:49,260
So that, that is a problem.

171
00:17:50,020 --> 00:17:52,380
So let's look at some of the other systems.

172
00:17:52,380 --> 00:17:57,220
I've been picking on PCC, but there are other systems out there.

173
00:17:58,700 --> 00:18:09,060
And folks might recognize, Voting Village might recognize one of the other major, probably the other major election management system that's out there.

174
00:18:09,180 --> 00:18:11,780
It's from ES&S.

175
00:18:12,420 --> 00:18:15,640
ES&S are our old friends.

176
00:18:15,740 --> 00:18:20,500
For years, Voting Village has been hacking their machines.

177
00:18:20,620 --> 00:18:25,520
And they, more than any of their companies, have been the most belligerent.

178
00:18:26,240 --> 00:18:37,160
Last year, I believe it was, they actually had folks sort of roaming about trying to make people uncomfortable about hacking, suggesting they shouldn't.

179
00:18:37,160 --> 00:18:42,760
These were the last folks to come around and say that Voting Village had a point.

180
00:18:43,120 --> 00:18:45,320
And it was only after so much coverage.

181
00:18:45,320 --> 00:18:46,860
Again, I think it was last year.

182
00:18:46,860 --> 00:18:50,100
These folks are not good partners.

183
00:18:50,320 --> 00:18:53,240
They are not reliable partners in our experience.

184
00:18:53,240 --> 00:19:00,100
I don't want to get sued for slander here, but in my opinion, based on what we've seen, these are not good partners.

185
00:19:00,100 --> 00:19:16,340
And we will remember how quickly the National Association of Secretaries of State last year was right there to defend them on their own terms, on ES&S's terms, and in some language that looked a little bit much like their own words sometimes.

186
00:19:17,140 --> 00:19:19,180
So, scary.

187
00:19:19,180 --> 00:19:20,120
Scary stuff.

188
00:19:20,120 --> 00:19:23,240
And are these things we can test in Voting Village?

189
00:19:23,240 --> 00:19:26,040
The way we take apart the voting machines?

190
00:19:26,040 --> 00:19:27,060
Of course not.

191
00:19:27,060 --> 00:19:27,920
Of course not.

192
00:19:27,920 --> 00:19:35,000
We can make our own, you know, dummy systems like we have, and we should, and there's a lot to be made there.

193
00:19:35,000 --> 00:19:36,680
But we can't go and test these systems.

194
00:19:36,680 --> 00:19:37,280
It's hacking.

195
00:19:37,280 --> 00:19:38,940
We can't hack, right?

196
00:19:41,520 --> 00:19:45,420
So, I've thrown a bunch of terrible stuff at you here.

197
00:19:46,460 --> 00:19:49,380
The question is, what do we need?

198
00:19:49,380 --> 00:19:51,800
Do I have any solutions here?

199
00:19:51,800 --> 00:19:55,960
Well, first of all, transparency.

200
00:19:56,120 --> 00:19:58,680
Transparency, transparency, transparency.

201
00:19:58,680 --> 00:20:00,420
We should know who these people are.

202
00:20:00,420 --> 00:20:04,060
We should know who runs them, what their interests are.

203
00:20:04,500 --> 00:20:07,860
We should know what their background are.

204
00:20:07,860 --> 00:20:16,380
We should know, we should need to know whether these folks even have the competence to do what they claim to do.

205
00:20:16,380 --> 00:20:37,220
And I'm going to talk a little bit about the Iowa debacle, where the, during the caucuses, or the primary caucuses this year, the Democratic Party was using these little specially designed, custom designed apps, mobile apps, to report the results of the caucuses to a central place.

206
00:20:37,740 --> 00:20:39,820
You all probably heard about this.

207
00:20:39,820 --> 00:20:41,360
They were a disaster.

208
00:20:41,360 --> 00:20:42,940
They were a disaster.

209
00:20:42,940 --> 00:20:52,840
It took a very long time to sort of rebuild the mess that they created, and actually generate a final voting tally.

210
00:20:52,840 --> 00:20:55,540
It was a big embarrassment to the Democratic Party.

211
00:20:55,540 --> 00:20:59,980
They were going to be using the same systems in Nevada, and they pulled that out.

212
00:21:02,200 --> 00:21:17,880
Now, what I would say, the biggest problem, conceptually, with that application, was that it was made by, and you see this a lot, made by folks in the industry who made a lot of personal connections.

213
00:21:17,880 --> 00:21:28,240
You know, these were folks who had worked for the Democratic Party, done IT stuff, and they decided to go out on their own, and they made a crappy product.

214
00:21:28,240 --> 00:21:32,300
But the crappy product was bought up because, oh, we know these people.

215
00:21:32,300 --> 00:21:34,320
These people are in our industry.

216
00:21:34,320 --> 00:21:35,760
They're in our world.

217
00:21:35,760 --> 00:21:36,660
We know them.

218
00:21:36,660 --> 00:21:37,680
We trust them.

219
00:21:38,020 --> 00:21:45,020
So, I don't know if the same thing isn't going on with some of these voting applications.

220
00:21:45,020 --> 00:21:47,380
PCC, who knows who ES&S hired?

221
00:21:47,380 --> 00:21:51,120
That is a real, real problem in this industry.

222
00:21:51,280 --> 00:21:56,400
So, we need to know who's doing it, because we need to know if they're competent.

223
00:21:56,400 --> 00:22:02,420
If they're reaching out for the best people, or if they're just reaching out for people who are connected with the company.

224
00:22:03,060 --> 00:22:05,080
Which gets us back to another point.

225
00:22:05,080 --> 00:22:07,100
This needs to be opened up.

226
00:22:07,100 --> 00:22:15,660
If we've got one, or two, or three companies doing this, that gives those one, or two, or three companies a lot of power.

227
00:22:15,660 --> 00:22:20,620
We need to have more genuine RFPs get this out there.

228
00:22:20,620 --> 00:22:28,360
I'm not saying there are angelic companies out there, but mixing it up a little would help.

229
00:22:29,240 --> 00:22:32,340
Now, second, we've got to test this stuff.

230
00:22:32,340 --> 00:22:40,580
I'm sure the Secretaries of State do pen tests on their systems, but it sure didn't help for 2016.

231
00:22:40,680 --> 00:22:45,260
I don't know how a pen test misses a SQL injection attack.

232
00:22:45,520 --> 00:22:48,160
There are pen tests, and there are pen tests.

233
00:22:48,160 --> 00:22:55,040
And again, the Secretaries of State have a vested interest in not finding vulnerabilities.

234
00:22:55,320 --> 00:23:00,720
So, and I've seen some of this, the pen tests tend to be minimal.

235
00:23:00,720 --> 00:23:03,700
So, we talk about standards for voting machines.

236
00:23:03,700 --> 00:23:08,900
We should have standards for these systems, and reports should be publicly available.

237
00:23:08,900 --> 00:23:11,840
We need standards for penetration testing.

238
00:23:11,840 --> 00:23:18,280
And that includes testing for social engineering all the way down to the user level.

239
00:23:18,280 --> 00:23:27,680
All the way down to the level of the election administrator who, you know, has their own account and talks to this database system.

240
00:23:27,700 --> 00:23:34,200
A thorough pen test is going to include tests for social engineering, and you don't generally see that.

241
00:23:34,200 --> 00:23:39,300
Especially when you consider any kind of code injection.

242
00:23:39,380 --> 00:23:42,820
Notwithstanding, the biggest problem will always be malware.

243
00:23:43,220 --> 00:23:45,080
It will always be malware.

244
00:23:45,940 --> 00:23:48,460
You can't really audit these systems.

245
00:23:48,480 --> 00:23:52,400
So, we need those standards and, again, transparencies and transparency.

246
00:23:53,720 --> 00:23:56,440
Yeah, you have to redact most of a pen test.

247
00:23:56,440 --> 00:23:58,000
Sure, and that just makes sense.

248
00:23:58,000 --> 00:24:05,380
But we could at least be able to see the executive summary of these pen tests as a public document.

249
00:24:05,380 --> 00:24:07,340
So, I would argue standards.

250
00:24:07,340 --> 00:24:09,020
I would argue, again, transparency.

251
00:24:09,020 --> 00:24:10,440
Those are the big two words.

252
00:24:10,440 --> 00:24:12,140
Standards, transparency.

253
00:24:12,920 --> 00:24:14,840
That gets us a long way.

254
00:24:15,200 --> 00:24:19,620
Now, I cannot stress how much of a problem this is.

255
00:24:19,700 --> 00:24:25,780
You know, if we're talking about voting machines and systems, which we love to talk about and we need to talk about.

256
00:24:25,780 --> 00:24:32,000
A presidential election on those terms would be hard to tank just by going after voting machines.

257
00:24:32,000 --> 00:24:34,560
But not these systems.

258
00:24:35,160 --> 00:24:37,440
There may be thousands.

259
00:24:37,580 --> 00:24:40,120
I think 7,000 is what I read.

260
00:24:40,360 --> 00:24:44,040
Localized voting machine tabulation systems.

261
00:24:44,960 --> 00:24:48,300
You know, that's a lot to get into and hack, although not for a local election.

262
00:24:48,300 --> 00:24:51,340
And local elections are every bit as important as national elections.

263
00:24:51,340 --> 00:24:52,680
It's all democracy.

264
00:24:53,060 --> 00:24:54,920
Although, again, not impossible.

265
00:24:54,920 --> 00:25:08,720
But when you're talking about these online databases and these internet-facing user election management systems, we go from 7,000 targets down to 50.

266
00:25:08,720 --> 00:25:10,940
50 targets.

267
00:25:11,020 --> 00:25:13,240
That's a lot more appealing.

268
00:25:13,240 --> 00:25:14,680
It's a lot more dangerous.

269
00:25:14,680 --> 00:25:17,580
And these systems interact.

270
00:25:18,980 --> 00:25:26,760
First of all, most states, you're going to see some kind of connection or some kind of ties to the DMVs, to the Department of Motor Vehicles.

271
00:25:26,760 --> 00:25:31,980
You know, we always have to check off for, do I want to be registered to vote too?

272
00:25:31,980 --> 00:25:36,880
There are states like Vermont, I'm proud to say, that have automatic voter registration.

273
00:25:37,040 --> 00:25:39,980
So those systems have to talk to each other some ways.

274
00:25:39,980 --> 00:25:41,280
There are safe ways to do it.

275
00:25:41,280 --> 00:25:43,020
There are unsafe ways to do it.

276
00:25:43,040 --> 00:25:46,300
We don't know, again, how they're doing it.

277
00:25:47,520 --> 00:25:49,420
Tax departments.

278
00:25:49,420 --> 00:25:52,640
Some states even connect to their tax departments.

279
00:25:52,700 --> 00:26:01,800
So, obviously, any big extensive network-to-network, they're going to be as strong as their weakest links.

280
00:26:02,300 --> 00:26:07,980
And those weakest links could be in the statewide networks talking to each other.

281
00:26:07,980 --> 00:26:11,500
The weakest links, more often than not, are the users.

282
00:26:11,500 --> 00:26:22,260
In New England, you can have election administrators running jurisdictions of as few as 70 people.

283
00:26:22,260 --> 00:26:40,660
They don't have a lot of good equipment, and they don't necessarily have a lot of sophistication in how to do proper hygiene, guard against social engineering, against spear phishing.

284
00:26:40,660 --> 00:26:46,100
I mean, if I were somebody, I'd take aim at one of those folks, and I'd go right after them.

285
00:26:46,120 --> 00:26:52,200
There's also ERIC, which is something I don't know about.

286
00:26:52,480 --> 00:26:57,440
ERIC is a statewide system, which now covers about half of the states.

287
00:26:57,440 --> 00:27:07,480
I think it's roughly 25, with more looking at it, whereby states interact their databases so they can track cross-state registrations.

288
00:27:07,480 --> 00:27:18,820
As it is, it's been a challenge for those states to take someone off a roll in one state because they registered in another state.

289
00:27:18,820 --> 00:27:20,240
That's a challenge.

290
00:27:20,240 --> 00:27:28,980
It's a weakness that a lot of folks have made a lot of fuss about, and honestly, they probably should.

291
00:27:28,980 --> 00:27:36,060
That stuff has been a matter of sending a piece of paper or an email from one secretary of state's office to the other.

292
00:27:36,860 --> 00:27:40,940
So, obviously, you're going to have systems like ERIC popping up.

293
00:27:40,940 --> 00:27:53,060
Now, my understanding, which is limited, is that in ERIC, you're not having a situation where the statewide databases are talking directly to each other, which is great.

294
00:27:53,060 --> 00:27:57,740
But, obviously, again, there is the malware issue.

295
00:27:59,320 --> 00:28:02,520
Malware can ride along with all kinds of things.

296
00:28:02,520 --> 00:28:08,700
And at any given time, a third or more of the malware out there in the wild could be zero-day.

297
00:28:08,700 --> 00:28:13,780
So, you know, it's the same problem we have with antivirus systems.

298
00:28:13,780 --> 00:28:15,260
They can only be so up-to-date.

299
00:28:15,260 --> 00:28:17,220
They can only be so current.

300
00:28:18,820 --> 00:28:22,540
So, anyway, I'm not going to say, I hope I didn't scare you.

301
00:28:22,540 --> 00:28:23,540
I hope I did.

302
00:28:23,540 --> 00:28:24,760
That's why I'm here.

303
00:28:24,760 --> 00:28:32,840
I think that's why a lot of us are here, are to scare people into action and to scare people into making things better.

304
00:28:33,280 --> 00:28:36,240
Again, I'm not trying to knock anybody down.

305
00:28:36,240 --> 00:28:39,720
I'm just trying to draw a lot of attention to this problem.

306
00:28:39,720 --> 00:28:48,800
And this is a problem we could go into a lot more technical detail on, and, you know, I could talk for, you know, an hour or two if I wanted to.

307
00:28:48,800 --> 00:28:51,160
But I want to keep this accessible.

308
00:28:51,160 --> 00:28:57,840
I know for the election administrators who are watching this, and also I only have about 20 or 30 minutes to do it.

309
00:28:57,840 --> 00:29:03,200
But it's a conversation I think we need to have a lot more of.

310
00:29:03,320 --> 00:29:03,940
Thanks.

311
00:29:03,960 --> 00:29:05,520
Thanks very much for listening.

312
00:29:05,520 --> 00:29:11,220
Thanks for Voting Village for having me, and hopefully I'll see you next year, maybe even in person.