start	end	text
4970	9390	Good morning, good afternoon, good evening, everybody.
10990	16610	It is a civic duty that if you see something, you say something.
17110	22250	That is the underlying principle behind vulnerability disclosure,
22250	24570	which I will talk about today.
24630	28330	Give me a second here as I turn on my slide deck.
58170	61210	As I said, I'm here to talk about vulnerability disclosure
61210	65310	for digital systems in vital use by society,
65310	67350	such as voting machines.
68090	72530	Vulnerability disclosure is the neighborhood watch of cybersecurity.
72770	75410	If you see something, say something.
75490	79350	When we surface the bad news to everyone,
79350	81530	we can take corrective action.
81890	85990	Vulnerability disclosure is the bad news that turns into good news.
85990	88910	Weaknesses you don't know of, you cannot fix.
88910	92590	When you know of them, you fix them and turn them into good news.
93370	97270	There are two critical legal aspects of vulnerability disclosure.
97670	102470	Number one, the right for anyone to look for vulnerabilities in systems.
102650	105830	And number two, the right to share the findings,
105830	109270	not just with the owner of the system, but with the public.
111600	113440	My name is Martin Mikkos.
113440	115500	I'm the CEO of HackerOne,
115500	118700	representing three quarters of a million ethical hackers
118700	120380	all over the world.
125800	129620	We're here today to talk about voting and voting machines.
130080	135410	And if you look at the word vote and the Latin translation of it,
135800	141920	it is the decision-making atom of nations and societies,
141920	144520	and has been so for thousands of years.
145080	149360	We have built our countries and our nations based on voting systems.
149620	152500	It is a fundamental piece of democracy.
152500	158000	And throughout history, we've made good use of the latest innovations,
158000	162660	such as paper, to build mechanisms and systems for voting.
162940	168020	But tragically, today, we have a world with digital capabilities
168020	170680	beyond our wildest dreams.
171100	175220	Yet, we have been unable to construct reliable and trustworthy
175220	177480	digital voting systems.
177600	179220	What's wrong here?
179220	181540	How could we allow this to happen?
181540	184040	And what is the fix?
186400	189380	There's a logical conclusion that has been missing.
189480	194180	If you believe in democracy, with one person, one vote,
194180	197100	and if you do believe in the freedom of speech,
197100	201440	which the U.S. does by means of its First Amendment,
201440	204420	there's just one logical conclusion for voting machines
204420	206160	and voting technology.
206320	209060	You must believe in vulnerability disclosure,
209060	213760	meaning the practice of inviting external, unbiased people
213760	217940	to test the security and validity of the system.
218000	222320	If you don't believe in this form of external and public scrutiny,
222320	226220	you are not believing in democracy or freedom of speech.
228460	233140	Let us think about how computer systems come to be.
233440	237560	Somebody designs a system, the design is approved,
237560	241060	product is developed and built, and it is tested.
241800	246280	To make something truly secure and worthy of the trust of everyone,
246280	250180	we must design security in from the start.
250560	253260	Security must be there from the get-go.
253920	258280	If you bolt it afterwards as an afterthought, it will never work.
258760	262200	It must be there. Security must be there from the first blueprint.
263280	267540	Then, secondly, once the system is ostensibly ready for public use,
267560	273960	you must turn around and let it undergo external, unbiased and unlimited vetting.
273960	277900	Now an inside-outside-in view is needed.
279240	282380	Journalists don't see their own typos.
282460	285200	Bookkeepers can't see their accounting mistakes.
285200	288380	So we need proofreaders and we need auditors.
288460	293420	These people come in with a fresh, objective mind and no bias of ownership.
293420	298600	They spot the flaws quickly and the flaws can be fixed.
298840	300840	It's the same with software.
300900	306600	We must subject software to external scrutiny by people who we do not personally know.
306860	313620	Ethical hackers, white hats, security researchers, they come by many names, but it is the same thing.
313720	317740	They are masters of detecting flaws in systems built by others.
317860	322140	Hackers are the best mechanism for finding vulnerabilities so they can be fixed.
322140	327400	In essence, hacking is the immune system of the Internet.
327920	329600	They are a vaccine.
330120	334000	They can think like an adversary, but they act in your benefit.
335040	343430	Too often, however, the simple principle of security designed from the inside-out and tested from the outside-in is not used.
343430	356210	We have voting machine bugs that have been known for several election cycles and are still there, unfixed, out there in the wild, ready to be exploited by people who do not believe in democracy.
356330	359650	We must fix this simple but fatal problem.
360530	370490	Governments should mandate vulnerability disclosure for every manufacturer and vendor of technology used for voting or any other vital societal function.
370490	376550	It's that easy and it's difficult, but yet it's easy and we should make that decision.
378270	381450	The principles I'm talking about here are not new.
381450	397110	Over 100 years ago, there was a Dutch scientist by the name of Kirchhoffs who postulated that when you are building a system intended to be safe and secure and maybe protect secrecy, the mechanism of the machine need not be kept secret.
397110	407910	On the contrary, if you make the blueprint open for anybody to test and study and vet, you have a better chance of making a secure system than if you don't.
407910	412690	It's only the keys that need to be secret, but not the mechanism of the system.
413070	418250	This is an important principle of openness of design that leads to better security.
419190	424950	Much later, a man called Shannon wrote the corollary of Kirchhoffs' principle.
424950	430070	He said, you must assume that your enemy will learn how your system was built.
430570	437910	Share the design with everybody and in that way you share it also with the good people who will help fix it, who will help improve it.
438110	445970	And by the way, there are many, many more good people than bad people in the world, maybe at a ratio of a thousand to one.
447410	464770	So to repeat and summarize, if we have a commitment to govern our nation so that every person has one vote, it logically follows that we must let each such person conduct their own validation of the system, the system of voting being used.
464810	469130	It's a very simple principle and it is very powerful.
469370	472350	Public scrutiny makes every system better.
472350	480630	The only reason to object to this principle would be extreme greed or disdain for democracy.
482250	487730	If we look at what's going on in society at large, it's in much better shape.
487730	499940	The National Institute of Science and Technology has long published the cybersecurity framework with very good advice and recommendations for large organizations.
500370	504130	And they define what vulnerability disclosure means.
504130	515770	They say, you need to have processes established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources.
515770	520730	Such as internal testing, security bulletins or security researchers.
521250	527670	When you follow the cybersecurity framework from NIST, your organization will be in much better shape.
529820	533200	The Department of Defense fully embraces this.
533300	541620	And they are, the Pentagon, by definition, have some of the most sensitive, secure, secretive, vital systems in the world.
541620	550420	And they have realized that to be fully secure, they need the help of the outside world, of hackers whom they don't even individually know.
550420	554920	But to help them report vulnerabilities so that the DOD can fix it.
554920	562340	They've been running a vulnerability disclosure program for over four years by now with amazing results, fantastic results.
564360	574740	The Department of Homeland Security, DHS, finds vulnerability disclosure so important that they are preparing a binding operational directive about it.
574740	581140	Under this BOD, civilian federal agencies will be required to invite good hackers to hack them.
581500	584520	It's the only logical thing to do in a democracy.
584520	590260	And it will improve the cybersecurity of all systems and increase trust among citizens.
592340	603800	And hot from the press, just in the last few days, the CISA agency within DHS delivered a terrific guide for election administrators.
603820	608740	The guide is called Guide to Vulnerability Reporting for America's Election Administrators.
608940	622080	And they say in their foreword that election administrators should know that the cybersecurity research community can help ensure these systems are safe so that the choices of the voting public can be clearly heard.
622340	630780	This guide offers a step-by-step guide for election administrators who seek to establish a successful vulnerability disclosure program.
632920	641240	Looking more broadly and into the future, I see three principles that will enable us to establish a true digital civilization.
641380	649740	One that actually works. A society that is well governed by digital mechanisms and which citizens can trust.
649740	658720	First, it will be seen as negligence to ignore the useful input from external security researchers. Yes, negligence.
658720	666620	Meaning you would be stupid not to listen to the amazing advice and input and vulnerability reports that you can get from the outside.
666940	671620	Number two, cybersecurity will be a collaborative effort.
672020	678640	With organizations pooling their defense to provide formidable obstacles to the adversaries.
678640	687860	And we have learned over thousands of years that whenever we face an asymmetric threat, the best defense is pooled defense. So we must do it.
688460	698420	Thirdly, the only way for any organization to achieve trust by customers, consumers, or citizens is through transparency.
698680	707420	Openness. By sharing vulnerability information and cybersecurity policies and practices publicly and with each other, trust will grow.
710810	719470	In summary, we have a system here for vulnerability disclosure where if you see something, you say something.
719470	730070	It has been rejected and avoided by many vendors, but it is the only practical thing to do in order to increase the security of any computer system.
730450	739100	Two legal rights are important here. The rights for the ethical hackers to do the testing and the rights for them to disclose their findings.
739720	747540	We know what to do. We should have done it a long time ago. We are tragically delayed. We just have to make the decision and start going.
747660	752940	We must listen to hackers. We must work together collaboratively on the defenses.
753240	761340	And we must build openness into the area of cybersecurity, sharing what we are finding, sharing the vulnerabilities and our fixes.
761340	768160	Because that is the only way to build trust with our citizens and with our constituent groups.
768160	774900	And when we do that, we will truly build a society that can function well in the digital world.
775860	778060	Thank you for listening to me today.