1 00:00:00,760 --> 00:00:02,580 Hello, DEF CON! 2 00:00:02,740 --> 00:00:08,640 As my late mother used to say, I know I'm running with the right crowd now. 3 00:00:08,660 --> 00:00:12,580 Last year, I was able to attend DEF CON in person. 4 00:00:12,780 --> 00:00:16,220 And back at that time, you could do that. 5 00:00:16,220 --> 00:00:20,040 I'm proud that I was the first United States Senator to speak. 6 00:00:20,060 --> 00:00:25,820 Now I'm proud to be the first United States Senator to speak remotely at DEF CON. 7 00:00:25,820 --> 00:00:33,040 Last year, I was able to walk around the voting village and see hackers, young and old alike, taking voting machines apart. 8 00:00:33,040 --> 00:00:36,060 They were learning and teaching each other. 9 00:00:36,060 --> 00:00:43,300 I even saw one voting machine on which hackers had installed the video game Doom. 10 00:00:43,640 --> 00:00:47,060 I sure wish Mitch McConnell could have seen that. 11 00:00:47,180 --> 00:00:54,940 He'd have a lot harder time pretending that everything is just fine with election security. 12 00:00:54,940 --> 00:01:02,920 I bet there are a whole lot of bad guys around the world who want to install their own version of Doom on our voting machines. 13 00:01:02,920 --> 00:01:09,400 Except their version would be a lot less fun, and it wouldn't be a game at all. 14 00:01:09,500 --> 00:01:15,820 A month before last year's DEF CON, the House of Representatives passed a historic election security bill. 15 00:01:15,820 --> 00:01:18,060 It was called the SAFE Act. 16 00:01:18,060 --> 00:01:36,300 I'm proud to say that I wrote portions of that bill, including parts of the bill that require risk-limiting audits for all federal elections and created mandatory federal cybersecurity standards for voting machines, electronic poll books, voter registration databases, 17 00:01:36,300 --> 00:01:39,320 and election reporting websites. 18 00:01:39,320 --> 00:01:45,420 The SAFE Act reflects the consensus view of election security experts. 19 00:01:45,420 --> 00:01:59,560 It includes people from the DEF CON community who have said loud and clear that safe and secure elections depend on hand-marked paper ballots and routine risk-limiting audits. 20 00:01:59,560 --> 00:02:12,620 While the House did its job and passed a good election security bill, our efforts to secure election reform has been stalled in the Senate. 21 00:02:12,620 --> 00:02:20,120 Stalled because of Mitch McConnell, who has made it clear that he is going to block any election-related legislation. 22 00:02:20,160 --> 00:02:26,320 Because of COVID-19, the world seems like it has turned upside down since last year. 23 00:02:26,320 --> 00:02:28,900 One thing has stayed the same. 24 00:02:28,900 --> 00:02:34,340 Mitch McConnell still won't do a thing to make our elections more secure. 25 00:02:34,340 --> 00:02:38,760 Last year, the top threat was electronic voting machines. 26 00:02:38,760 --> 00:02:45,260 They're still a problem, but now I'm especially concerned about Internet voting. 27 00:02:45,260 --> 00:02:59,380 The coronavirus pandemic has presented extraordinary problems for state and local administrators and for American voters who justifiably don't want to have to put their health at risk to vote. 28 00:02:59,380 --> 00:03:09,340 But it has also been a huge opportunity for snake oil salesmen peddling insecure Internet voting technology. 29 00:03:09,340 --> 00:03:16,620 These companies have gone out and preyed on state and local officials who are desperate for options during this pandemic. 30 00:03:16,620 --> 00:03:30,720 And what the snake oil salesmen have essentially been selling is kind of magic beans, promising that voters with disabilities and our men and women in uniform overseas can vote securely using their smartphones. 31 00:03:30,720 --> 00:03:39,700 As this community knows, election security experts have been so clear that Internet voting is not secure. 32 00:03:39,700 --> 00:03:45,580 Internet voting is dangerous and it's a threat to American democracy. 33 00:03:45,580 --> 00:03:54,980 The allure of secure Internet voting is obviously understandable, particularly for officials who haven't had training in cybersecurity. 34 00:03:55,220 --> 00:04:10,760 I'm sure you all by now have heard somebody say, well, if the tech companies can figure out a way to allow people to securely pay their bills online or transfer money from a smartphone, why can't they figure out the problem of Internet voting? 35 00:04:10,760 --> 00:04:16,600 Coincidentally, this is similar to what FBI officials have said about encryption backdoors. 36 00:04:16,960 --> 00:04:32,620 Their view is if America can put a man on the moon, why can't our technology companies build encryption backdoors that are secure against China and Russian hackers and allow law enforcement agencies to go after the bad guys? 37 00:04:32,620 --> 00:04:41,980 What's needed, though, is for government to make sure that you don't see bad ideas advance. 38 00:04:41,980 --> 00:04:57,740 And on both topics, I turn to actual cybersecurity experts, to cryptographers and computer scientists who've made it clear that secure encryption backdoors and insecure Internet voting are both beyond the realm of the possible right now. 39 00:04:57,740 --> 00:05:07,100 The experts just don't know how to build these things safely, no matter how much government officials want them to exist. 40 00:05:07,160 --> 00:05:14,500 So let me talk for just a brief few minutes about one Internet voting company named Votes. 41 00:05:14,500 --> 00:05:21,300 This company convinced West Virginia to allow the use of their smartphone voting app. 42 00:05:21,300 --> 00:05:27,460 After a pilot in West Virginia, the company expanded to Utah, Colorado and my home state of Oregon. 43 00:05:27,460 --> 00:05:32,500 That's when I really started digging in to what this company was about. 44 00:05:32,500 --> 00:05:37,300 The first thing I learned is that Votes had never been subjected to an independent audit. 45 00:05:37,300 --> 00:05:51,140 The company was going out and about telling election officials that it had passed several audits with flying colors, but it never told those officials that the audits had been handpicked and paid for by Votes financial backers. 46 00:05:51,140 --> 00:05:56,720 The people who conducted the audits had no experience at all with election security. 47 00:05:56,720 --> 00:06:02,920 Officials in Oregon relied in good faith on the fact that they thought that Votes had been audited. 48 00:06:02,920 --> 00:06:06,900 But state and local officials will tell you they're not cyber experts. 49 00:06:06,900 --> 00:06:18,540 They don't have graduate degrees in cybersecurity, and so they didn't understand the difference between the bogus audits that Votes had passed and a rigorous independent audit by experts. 50 00:06:18,540 --> 00:06:22,640 Of course, audits don't need to be a fancy official thing. 51 00:06:22,640 --> 00:06:32,440 This community has demonstrated that individual researchers, college students, hobbyists can discover important security issues outside of a formal audit. 52 00:06:32,440 --> 00:06:39,140 In 2018, a University of Michigan student as part of a class project decided to examine Votes. 53 00:06:39,140 --> 00:06:43,300 That student was looking to see if the company's security claims held up. 54 00:06:43,300 --> 00:06:50,020 The company's app called Home when the student tried to examine it is what was considered. 55 00:06:50,020 --> 00:06:57,720 As media reports have confirmed, the company reported this directly to the West Virginia Secretary of State, who then called the FBI. 56 00:06:57,740 --> 00:07:07,420 However, what hasn't been reported is the fact that Votes did not believe that hackers in China or Russia were attacking West Virginia's elections. 57 00:07:07,420 --> 00:07:20,940 The company's CEO told my staff that he reported the incident to government officials specifically because the University of Michigan is home to researchers who have a long history of criticizing voting technology companies. 58 00:07:20,940 --> 00:07:23,200 Let that sink in for a second. 59 00:07:23,200 --> 00:07:36,260 The company reported a college student, a security researcher engaged in good faith security research to the government because the company had reason to believe that the researcher might be critical of the company. 60 00:07:36,260 --> 00:07:40,240 This is absolutely outrageous conduct. 61 00:07:40,240 --> 00:07:46,760 Security researchers perform an enormous public service by volunteering their time to find and report problems. 62 00:07:46,760 --> 00:08:00,700 I for one would prefer that the first person to find a security problem in a voting system used in real elections is a researcher working in the public interest and not a hacker working for Russia or China. 63 00:08:00,700 --> 00:08:11,360 Companies should be rolling out the red carpet for independent researchers, including the DEF CON voting village, instead of trying to bully them as Votes did. 64 00:08:11,360 --> 00:08:17,340 Thankfully, Votes' scare tactics were not successful in scaring away other researchers. 65 00:08:17,340 --> 00:08:25,600 Earlier this year, a team from MIT conducted a thorough audit of Votes' product and found it riddled with basic flaws. 66 00:08:25,600 --> 00:08:32,980 That not only proved that the company's security claims were false, but that the company's prior hand-picked audits were a farce. 67 00:08:32,980 --> 00:08:40,860 I commend the team at MIT for showing yet again that internet voting is dangerous. 68 00:08:40,860 --> 00:08:46,920 This November, Americans will vote in what I believe is the most important election of our lifetimes. 69 00:08:46,920 --> 00:09:02,740 Since Mitch McConnell has blocked several of my bills to secure our elections from cyber threats and ensure that every registered voter can vote safely in this pandemic, let me close by mentioning just a few of the security issues that concern me the most. 70 00:09:02,740 --> 00:09:17,420 E-poll book failures, particularly failures by states in checking voters in a polling booth, have repeatedly failed, leading to lengthy delays for in-person voting. 71 00:09:17,420 --> 00:09:32,140 There are no federal cybersecurity standards for these devices, and I remain deeply concerned that e-poll book failures, whether caused by malfunctions, human error, or cyber attacks, could result in major problems. 72 00:09:32,140 --> 00:09:33,740 Internet voting. 73 00:09:33,740 --> 00:09:46,940 While most officials now seem to realize that votes is insecure snake oil, 31 states continue to permit overseas and military voters to return marked ballots by email, fax, or over the internet. 74 00:09:46,940 --> 00:09:59,340 As far as I'm concerned, this is the weakest link in our election infrastructure, as voters and election officials have no way of knowing if these electronically transmitted ballots have been tampered with by hackers. 75 00:09:59,340 --> 00:10:07,380 In close races, email ballots can be the deciding factor, which is something that should worry everybody. 76 00:10:07,380 --> 00:10:09,580 Election night reporting websites. 77 00:10:09,580 --> 00:10:20,920 There continue to be no cybersecurity standards for reporting websites, despite the fact that a hack could create massive chaos by misleading the public about the election winner. 78 00:10:20,920 --> 00:10:27,060 Years ago, hackers went after reporting sites in the Ukraine, so it's not like this ought to be a surprise. 79 00:10:27,060 --> 00:10:36,100 And finally, I'm worried that Donald Trump and his new political hack of a postmaster general are gunning for the U.S. 80 00:10:36,100 --> 00:10:37,320 Postal Service. 81 00:10:37,320 --> 00:10:47,540 They want to make voting by mail less reliable, slow down election results, and allow Donald Trump to make baseless claims about the election being rigged. 82 00:10:47,540 --> 00:10:52,800 So there are plenty of security issues for all of us to stay up late at night. 83 00:10:52,800 --> 00:10:55,300 But there are still reasons for hope. 84 00:10:55,300 --> 00:11:04,140 First, the fact that all of you white hat hackers are willing to spend your time trying to make our elections safer is, in my view, an enormous asset. 85 00:11:04,140 --> 00:11:16,620 I've been so impressed by the energy and creativity of the voting village and the young people who are working with Alex Halderman and Harry Hurst and Matt Blaze and everybody who makes this possible. 86 00:11:16,620 --> 00:11:25,080 Second, there seems to be a gradual acceptance by the government and some vendors that security researchers are not the enemy. 87 00:11:25,080 --> 00:11:36,400 Initiatives like the University of Chicago's election cyber surge, which aims to connect hackers with election officials, sound like promising ways to bring expertise to those who need it. 88 00:11:36,400 --> 00:11:49,620 I'm also encouraged that the cybersecurity and the infrastructure security agency put out a very thoughtful guide for how election officials can work with security researchers when it comes to identifying and reporting vulnerabilities. 89 00:11:49,960 --> 00:12:00,160 And God forbid I say anything complimentary about election vendors like ES and S after they lied to the public repeatedly about the security of their products. 90 00:12:00,160 --> 00:12:09,660 But the fact is you do see them at black hat just two years after they asked the Senate Intelligence Committee to investigate the voting village. 91 00:12:09,660 --> 00:12:12,040 That's a pretty stark contrast. 92 00:12:12,040 --> 00:12:19,720 Everybody is better off if government and election vendors see security researchers as a resource instead of a threat. 93 00:12:19,720 --> 00:12:33,580 So it does give me some measure of hope that even though Donald Trump and too many in Congress still refuse to take election security seriously, that there are people doing good work to make a difference where they can. 94 00:12:33,580 --> 00:12:37,600 And believe me, our elections need all the help they can get. 95 00:12:37,600 --> 00:12:45,720 And I just want to close by making it clear that we are going to keep up the fight for better election security in Washington, D.C. 96 00:12:45,720 --> 00:12:51,060 And my view is that political change doesn't start in Washington, D.C. 97 00:12:51,060 --> 00:12:52,380 and trickle down. 98 00:12:52,380 --> 00:13:00,480 It basically bubbles up when the grassroots, particularly when it comes to technology, do the talking. 99 00:13:00,480 --> 00:13:03,020 So don't stop fighting to secure our elections. 100 00:13:03,020 --> 00:13:05,780 Our democracy depends on it. 101 00:13:05,780 --> 00:13:10,220 And good luck to everybody in this crucial, crucial cause.