start	end	text
1040	7940	Hi, my name is John Odom, and I'm currently the city clerk in Montpelier, Vermont.
8100	12060	In that capacity, I'm also the election administrator.
12300	15380	And, boy, has this been a year for that.
15380	20120	We've got our own statewide primary coming up in about a week and a half.
20120	24760	So, even taking a little time to record this is kind of challenging.
25680	30060	I'm also a certified ethical hacker.
30060	37900	I've been in charge of a couple networks and been a database administrator for various non-profits.
37980	45100	So, I tend to have a little more hands-on knowledge than most of my colleagues in the industry,
45100	53220	but not as much as you might think, because my life's a little busy and I don't get to practice this stuff very much.
53220	62480	Anyways, I want to bring something to folks who participate in the Voting Village's attention.
62480	68060	And it's not something that has been ignored, but I think it's something that deserves a little more attention.
69220	75320	To make the point about how concerned I am, I'm going to tell you a little story.
76020	81560	And this is not exactly on topic, but I want to use it to make a point.
81560	86560	Several years back in Memphis, and some of you may have heard this story,
87340	93260	there was a local election, the mayor was being elected, various local officials,
93260	100580	and one clever person decided to compare the turnout from the tape,
100580	107320	and most tabulators generate some sort of tape, some sort of physical record of the time listing the votes,
107320	113600	and compare that number with what was reported through the GEMS system.
113600	120620	And I know also a lot of folks who've been participating in Voting Village share some concerns about that system.
121380	130430	Well, the numbers did not add up. According to the tape, 546 people in this particular precinct had voted,
131670	137310	according to the tape, and the system only showed 330.
138010	142190	They looked at this, they looked at other precincts, they found the same problem,
142190	147550	especially in districts with heavy minority populations.
149010	156750	Big problem, it's the problem we talk about at DEFCON, but I want to present another scenario to you.
156750	165070	Consider this happening on a statewide level, not district by district, not precinct by precinct,
165070	172830	not through any one individual network of voting machines, but an entire state.
173730	181610	There are statewide systems that manage databases. This is mandated by the Help America Vote Act,
181610	188370	which came in the wake of the 2000 presidential election voting debacle.
188370	195330	You know, the hanging chads, the numbers that didn't add up, and it all went to the courts and it went to the Supreme Court.
195790	206830	After that, there was a bipartisan group that got together, federally mandated, and came up with several recommendations.
206830	213850	Now, generally, they were very good recommendations. I don't want to disrespect HAVA at all.
213850	226670	One of the recommendations, understandably, was that states should be working on their voter rolls through one centralized system,
226670	234670	one centralized statewide database that would contain all the voter registration information.
234670	244810	But obviously, you can see where I'm going with this. There are concerns about, or we have to be concerned, about the security of these systems.
244810	252550	So these statewide systems don't all necessarily just hold the voter registration information.
252550	258850	A lot of them, including in my home state of Vermont, are actually election management systems.
259750	268150	Election administrators will report their information for election night reporting.
268750	279750	Sometimes we will work directly into these systems to manage it, to create our reports, to create our elections and local elections, and manage them directly out of that.
279750	287710	So there's a lot going on with these systems. They are very important, and local administrators have come to really depend on them.
287710	295850	Well, how are they doing? Could be better. I want to talk about the famous Mueller Report.
295930	301830	Now, tucked away in that is this little gem that I'm going to read here, part of it.
301870	306710	It says, in addition to targeting individuals involved in the Clinton campaign,
307550	313830	Mueller's operation also targeted individuals and entities involved in the administration of the elections.
313830	324550	Victims included U.S. state and local entities, such as state boards of elections, secretaries of state, and county governments, as well as individuals that work for the entities.
324610	337570	They also targeted private technology firms responsible for manufacturing and administering election-related software and hardware, such as voter registration software and electronic polling stations.
337570	353690	Now, here's the scary part. The report says that foreign actors targeted state and local databases of registered voters using a technique known as SQL injection,
353690	359110	by which malicious code was sent to the state or local website in order to run commands.
359110	372910	In one instance, in approximately June of 2016, the working group was able to compromise the computer network of the Illinois State Board of Elections by exploiting a vulnerability,
372910	382770	presumably a SQL injection-related vulnerability. This gave them access to a database containing information on millions of registered Illinois voters.
382770	391010	The group extracted data related to thousands of U.S. voters before the malicious activity was identified.
391790	403450	Alright, so beyond just the obvious scary here, you know, okay, a lot of you folks will know that code injection is a very big deal.
403450	417730	Code injection is, you know, it's where most of the hacks come from these days. But SQL? SQL injection is something we have been aware of for many years.
417990	427170	We know how to harden against it. So my question is, why wasn't it already hardened against it?
427170	441510	SQL injection is very easy. One line fed through to a database from a simple login screen can get you in. We know input validation is the solution. So where the hell was the input validation?
442890	455870	What that says to me is, and you, again, to refer to Voting Village in the last few years, what's gotten a lot of attention was the simulation of the statewide voter database.
455870	466070	It's got national coverage that kids could sit down at this simulation and they could hack right into our dummy statewide voter registration system.
466070	475830	Well, of course, the pushback and all the yelling and hollering from the secretaries of state were that this was a phony simulation.
475830	481950	That their systems are actually far more secure. Somehow this was set up to be hacked to make their point.
481950	497170	Well, if SQL injection is a way to get into this stuff, I would argue that those systems, those dummy systems we made up, maybe were not loose and accessible enough.
497170	505370	So, all right, so let's talk about HAVA, the Help America Vote Act.
506630	509070	And I'm going to read a little bit from it.
509070	527150	Part of the mandate is each state acting through the chief state election official shall implement in a uniform and nondiscriminatory manner a single uniform official centralized interactive computerized statewide voter registration list defined, maintained and administered at the state level.
527150	536830	So states have no choice but to do this. And again, populations, what they are, it's completely understandable.
536990	542650	So what do states do? Well, several do in-house development.
543730	556530	In Vermont, we used to, our first database, our first election management system out of the box, out of HAVA was an internet facing FoxPro application.
557190	560170	It was pretty crude.
560770	571630	But these days, and other states currently are still doing in-house solutions, states like Colorado, Illinois, Kentucky.
571630	575650	You could put together something pretty nice if you knew what you were doing.
576990	582450	Obviously, then the networks they sit on, the municipal networks, are potentially vulnerable too.
582470	586030	But if you can get in by SQL injection, why bother?
586730	592410	Okay, but more and more often, you see these states using vendors.
592410	604890	And these are vendors, you know, it's like any niche application, any niche market, you're going to get niche vendors who pop up specifically to serve that market.
607010	613170	So before this, we had somebody call around. I wanted to know what states used what.
613170	618650	How many of them used one vendor versus another? How many of them were designing in-house?
618650	626230	I don't know if I can really say this, but word got out that we were calling around and there were people who were less than thrilled.
628630	634090	And defensiveness in public systems should really make us all uncomfortable.
634090	643370	Now, I want to look at one particular vendor right now, because I have a little more firsthand familiarity with it, called PCC.
644190	650530	Now, here's a list from their website of their current clients.
651130	663610	Okay, now factoring out for the consulting only options here, that's 15 states doing database management in election application hosting for voter registration, election night reporting.
664090	668990	So who is PCC? Well, this is part of the problem.
668990	677470	Who knows? Go to PCC's website and no staff is listed. Only board officers, not even the whole board.
677730	689670	Now, I didn't do research on people who did show up. I probably should have, I could have, but I didn't. I don't want to knock them without any basis or unnecessarily then.
690810	699430	And, you know, they seem to be perfectly reputable people. I didn't see any, the one I did look at, I didn't see any obvious big political connections.
700650	713570	CEO Tom Ambergy is a big, was a big shot at Central Square Technology, for example, and they were recently at a major hack, a Magecart attack.
713670	717750	Now, you know, I don't want to beat them up too much for a Magecart attack. They're good.
717750	724210	But Magecart attacks generally use JavaScript injections. So it's something that could be hardened for.
724370	731610	And with election systems, there's just no margin for error. You've got to be ahead of these games.
731610	737310	So I wouldn't say that was a big concern of mine, but it does raise my eyebrow a little bit.
738690	755150	But let's look at some of these proposals that PCC or organizations like PCC have put forward to the states to try to get their business.
755150	762730	I want to show you the one from Delaware and just pieces of it. It's, of course, very, very long.
762730	775130	But I'm going to show you here a typical page from the publicly posted proposal from PCC to run their election systems.
778160	785740	OK, when you look at this, this is what you'll see. Not much.
787080	797380	I, you know, I didn't do the measurement and everything, but from my glance, I would say at the most about 20 percent of this entire proposal is visible.
797380	805140	So that's me being generous. Now, of course, I understand companies have proprietary information.
805140	810640	They have proprietary stuff that's standard for any RFP. You expect that.
810640	820100	But come on. Why even post it at all? I mean, this is something made available to the public, you know, public records.
820280	827120	But it's not. I mean, it's it's it's almost a joke. If I didn't know better, I'd say it was almost passive aggressive.
827480	834980	But what bothers me the most in terms of the redactions is all the staff is redacted. And this is typical.
834980	839620	So just like the website, we don't know who's working on this.
839620	844300	And that bothers me a lot because people have their own interests.
844300	849720	They come from backgrounds, partisan backgrounds, nonprofit backgrounds.
849720	863140	I think it's reasonable. And I don't think it necessarily, you know, reveals any particular corporate secrets that we could have some idea who the people are doing this stuff,
863140	867580	either in an individual state or even at the company proper.
868400	876920	Now, financials are also redacted. I know that's a thing that's very standard, but I would argue that it shouldn't be.
877060	885540	I think our right to know trumps any embarrassment or discomfort of big companies.
885540	890240	And publicly, we might not want one that's on the edge of bankruptcy.
890240	894280	And we might want to see that. So so here is the problem.
894280	901240	There are very few companies doing this. And they are opaque.
901240	908500	We don't know who they are. And that's basically it. We don't know who they are. And that's scary.
908500	914520	That's very, very scary, at least to me. And it does matter.
914520	924980	In Georgia, they had a recent problem, a debacle involving their voter rolls, involving the voter registration.
924980	928180	Now, this wasn't exactly what I'm talking about.
928180	936500	But it makes the point about how badly you can screw up an election simply by screwing up voter rolls.
936500	939760	You can disenfranchise people in a big election crush.
939760	945780	They're just not going to get to vote or they're going to have to fill out an enormous amount of provisional ballots,
945780	952200	which honestly might not necessarily get counted the way they should be.
952240	959760	Now, during a court case involving this whole debacle, a lot of insecurities,
959860	966380	a lot of vulnerabilities in the PCC system was was brought to the attention of the court.
966380	973520	After that, Georgia decided to pull back. Their contract ran out and they decided to pull it back in-house.
973520	980200	So that's a pretty unusual step to take. And it shows you just how concerning those vulnerabilities were.
980980	984980	Now, you know, we've got our public officials doing this.
984980	991700	Can we count on our public officials to be straight with us about this stuff if there's a problem?
991700	1000480	Well, obviously not. And again, I don't mean to knock secretaries of states, but they have their own interest.
1000480	1006620	They have an interest in getting reelected, and that means they have interest in looking competent.
1006980	1012900	Now, some of them like to talk about internal security a lot. You know, we've upgraded this to make it better.
1012900	1015460	We've got better voting machines to make this better.
1015460	1026160	We're doing our due diligence within the sphere that we control in order to do a better job and get reelected.
1026160	1030540	They don't like to talk about the potential for things outside.
1030820	1037000	And that means they don't necessarily like to talk about the walls that they've built that they're responsible for
1037000	1049140	that are, you know, the dividing the firewall, pardon the expression, between the voters and the outside world where you could have malicious actors.
1049140	1052900	And again, with the Mueller report, we're talking about advanced persistent threats.
1052900	1057040	We're talking about state actors, but not necessarily.
1059520	1066480	So secretaries of state have a vested interest in saying everything's rosy and everything's wonderful.
1066480	1069260	So that, that is a problem.
1070020	1077220	So let's look at some of the other systems. I've been picking on PCC, but there are other systems out there.
1078700	1089060	And folks might recognize, Voting Village might recognize one of the other major, probably the other major election management system that's out there.
1089180	1091780	It's from ES&S.
1092420	1100500	ES&S are our old friends. For years, Voting Village has been hacking their machines.
1100620	1105520	And they, more than any of their companies, have been the most belligerent.
1106240	1117160	Last year, I believe it was, they actually had folks sort of roaming about trying to make people uncomfortable about hacking, suggesting they shouldn't.
1117160	1122760	These were the last folks to come around and say that Voting Village had a point.
1123120	1126860	And it was only after so much coverage. Again, I think it was last year.
1126860	1133240	These folks are not good partners. They are not reliable partners in our experience.
1133240	1140100	I don't want to get sued for slander here, but in my opinion, based on what we've seen, these are not good partners.
1140100	1156340	And we will remember how quickly the National Association of Secretaries of State last year was right there to defend them on their own terms, on ES&S's terms, and in some language that looked a little bit much like their own words sometimes.
1157140	1160120	So, scary. Scary stuff.
1160120	1163240	And are these things we can test in Voting Village?
1163240	1166040	The way we take apart the voting machines?
1166040	1167920	Of course not. Of course not.
1167920	1175000	We can make our own, you know, dummy systems like we have, and we should, and there's a lot to be made there.
1175000	1178940	But we can't go and test these systems. It's hacking. We can't hack, right?
1181520	1185420	So, I've thrown a bunch of terrible stuff at you here.
1186460	1191800	The question is, what do we need? Do I have any solutions here?
1191800	1198680	Well, first of all, transparency. Transparency, transparency, transparency.
1198680	1204060	We should know who these people are. We should know who runs them, what their interests are.
1204500	1207860	We should know what their background are.
1207860	1216380	We should know, we should need to know whether these folks even have the competence to do what they claim to do.
1216380	1221540	And I'm going to talk a little bit about the Iowa debacle,
1221540	1227940	where the, during the caucuses, or the primary caucuses this year,
1227940	1233660	the Democratic Party was using these little specially designed, custom designed apps, mobile apps,
1233660	1237220	to report the results of the caucuses to a central place.
1237740	1242940	You all probably heard about this. They were a disaster. They were a disaster.
1242940	1248820	It took a very long time to sort of rebuild the mess that they created,
1248820	1252840	and actually generate a final voting tally.
1252840	1255540	It was a big embarrassment to the Democratic Party.
1255540	1259980	They were going to be using the same systems in Nevada, and they pulled that out.
1262200	1270040	Now, what I would say, the biggest problem, conceptually, with that application,
1270040	1273360	was that it was made by, and you see this a lot,
1273360	1277880	made by folks in the industry who made a lot of personal connections.
1277880	1281400	You know, these were folks who had worked for the Democratic Party, done IT stuff,
1281400	1288240	and they decided to go out on their own, and they made a crappy product.
1288240	1292300	But the crappy product was bought up because, oh, we know these people.
1292300	1297680	These people are in our industry. They're in our world. We know them. We trust them.
1298020	1305020	So, I don't know if the same thing isn't going on with some of these voting applications.
1305020	1311120	PCC, who knows who ES&S hired? That is a real, real problem in this industry.
1311280	1316400	So, we need to know who's doing it, because we need to know if they're competent.
1316400	1322420	If they're reaching out for the best people, or if they're just reaching out for people who are connected with the company.
1323060	1327100	Which gets us back to another point. This needs to be opened up.
1327100	1335660	If we've got one, or two, or three companies doing this, that gives those one, or two, or three companies a lot of power.
1335660	1340620	We need to have more genuine RFPs get this out there.
1340620	1348360	I'm not saying there are angelic companies out there, but mixing it up a little would help.
1349240	1352340	Now, second, we've got to test this stuff.
1352340	1360580	I'm sure the Secretaries of State do pen tests on their systems, but it sure didn't help for 2016.
1360680	1365260	I don't know how a pen test misses a SQL injection attack.
1365520	1368160	There are pen tests, and there are pen tests.
1368160	1375040	And again, the Secretaries of State have a vested interest in not finding vulnerabilities.
1375320	1380720	So, and I've seen some of this, the pen tests tend to be minimal.
1380720	1383700	So, we talk about standards for voting machines.
1383700	1388900	We should have standards for these systems, and reports should be publicly available.
1388900	1391840	We need standards for penetration testing.
1391840	1398280	And that includes testing for social engineering all the way down to the user level.
1398280	1407680	All the way down to the level of the election administrator who, you know, has their own account and talks to this database system.
1407700	1414200	A thorough pen test is going to include tests for social engineering, and you don't generally see that.
1414200	1419300	Especially when you consider any kind of code injection.
1419380	1422820	Notwithstanding, the biggest problem will always be malware.
1423220	1425080	It will always be malware.
1425940	1428460	You can't really audit these systems.
1428480	1432400	So, we need those standards and, again, transparencies and transparency.
1433720	1436440	Yeah, you have to redact most of a pen test.
1436440	1438000	Sure, and that just makes sense.
1438000	1445380	But we could at least be able to see the executive summary of these pen tests as a public document.
1445380	1449020	So, I would argue standards. I would argue, again, transparency.
1449020	1452140	Those are the big two words. Standards, transparency.
1452920	1454840	That gets us a long way.
1455200	1459620	Now, I cannot stress how much of a problem this is.
1459700	1465780	You know, if we're talking about voting machines and systems, which we love to talk about and we need to talk about.
1465780	1472000	A presidential election on those terms would be hard to tank just by going after voting machines.
1472000	1474560	But not these systems.
1475160	1477440	There may be thousands.
1477580	1484040	I think 7,000 is what I read. Localized voting machine tabulation systems.
1484960	1488300	You know, that's a lot to get into and hack, although not for a local election.
1488300	1492680	And local elections are every bit as important as national elections. It's all democracy.
1493060	1494920	Although, again, not impossible.
1494920	1504440	But when you're talking about these online databases and these internet-facing user election management systems,
1504440	1510940	we go from 7,000 targets down to 50. 50 targets.
1511020	1514680	That's a lot more appealing. It's a lot more dangerous.
1514680	1517580	And these systems interact.
1518980	1526760	First of all, most states, you're going to see some kind of connection or some kind of ties to the DMVs, to the Department of Motor Vehicles.
1526760	1531980	You know, we always have to check off for, do I want to be registered to vote too?
1531980	1536880	There are states like Vermont, I'm proud to say, that have automatic voter registration.
1537040	1539980	So those systems have to talk to each other some ways.
1539980	1543020	There are safe ways to do it. There are unsafe ways to do it.
1543040	1546300	We don't know, again, how they're doing it.
1547520	1552640	Tax departments. Some states even connect to their tax departments.
1552700	1561800	So, obviously, any big extensive network-to-network, they're going to be as strong as their weakest links.
1562300	1567980	And those weakest links could be in the statewide networks talking to each other.
1567980	1571500	The weakest links, more often than not, are the users.
1571500	1582260	In New England, you can have election administrators running jurisdictions of as few as 70 people.
1582260	1592580	They don't have a lot of good equipment, and they don't necessarily have a lot of sophistication in how to do proper hygiene,
1592580	1600660	guard against social engineering, against spear phishing.
1600660	1606100	I mean, if I were somebody, I'd take aim at one of those folks, and I'd go right after them.
1606120	1612200	There's also ERIC, which is something I don't know about.
1612480	1617440	ERIC is a statewide system, which now covers about half of the states.
1617440	1627480	I think it's roughly 25, with more looking at it, whereby states interact their databases so they can track cross-state registrations.
1627480	1638820	As it is, it's been a challenge for those states to take someone off a roll in one state because they registered in another state.
1638820	1648980	That's a challenge. It's a weakness that a lot of folks have made a lot of fuss about, and honestly, they probably should.
1648980	1656060	That stuff has been a matter of sending a piece of paper or an email from one secretary of state's office to the other.
1656860	1660940	So, obviously, you're going to have systems like ERIC popping up.
1660940	1673060	Now, my understanding, which is limited, is that in ERIC, you're not having a situation where the statewide databases are talking directly to each other, which is great.
1673060	1682520	But, obviously, again, there is the malware issue. Malware can ride along with all kinds of things.
1682520	1688700	And at any given time, a third or more of the malware out there in the wild could be zero-day.
1688700	1697220	So, you know, it's the same problem we have with antivirus systems. They can only be so up-to-date. They can only be so current.
1698820	1704760	So, anyway, I'm not going to say, I hope I didn't scare you. I hope I did. That's why I'm here.
1704760	1712840	I think that's why a lot of us are here, are to scare people into action and to scare people into making things better.
1713280	1719720	Again, I'm not trying to knock anybody down. I'm just trying to draw a lot of attention to this problem.
1719720	1728800	And this is a problem we could go into a lot more technical detail on, and, you know, I could talk for, you know, an hour or two if I wanted to.
1728800	1737840	But I want to keep this accessible. I know for the election administrators who are watching this, and also I only have about 20 or 30 minutes to do it.
1737840	1743200	But it's a conversation I think we need to have a lot more of.
1743320	1751220	Thanks. Thanks very much for listening. Thanks for Voting Village for having me, and hopefully I'll see you next year, maybe even in person.