start	end	text
760	2580	Hello, DEF CON!
2740	8640	As my late mother used to say, I know I'm running with the right crowd now.
8660	12580	Last year, I was able to attend DEF CON in person.
12780	16220	And back at that time, you could do that.
16220	20040	I'm proud that I was the first United States Senator to speak.
20060	25820	Now I'm proud to be the first United States Senator to speak remotely at DEF CON.
25820	33040	Last year, I was able to walk around the voting village and see hackers, young and old alike, taking voting machines apart.
33040	36060	They were learning and teaching each other.
36060	43300	I even saw one voting machine on which hackers had installed the video game Doom.
43640	47060	I sure wish Mitch McConnell could have seen that.
47180	54940	He'd have a lot harder time pretending that everything is just fine with election security.
54940	62920	I bet there are a whole lot of bad guys around the world who want to install their own version of Doom on our voting machines.
62920	69400	Except their version would be a lot less fun, and it wouldn't be a game at all.
69500	75820	A month before last year's DEF CON, the House of Representatives passed a historic election security bill.
75820	78060	It was called the SAFE Act.
78060	86580	I'm proud to say that I wrote portions of that bill, including parts of the bill that require risk-limiting audits for all federal elections
86580	99320	and created mandatory federal cybersecurity standards for voting machines, electronic poll books, voter registration databases, and election reporting websites.
99320	105420	The SAFE Act reflects the consensus view of election security experts.
105420	119560	It includes people from the DEF CON community who have said loud and clear that safe and secure elections depend on hand-marked paper ballots and routine risk-limiting audits.
119560	132620	While the House did its job and passed a good election security bill, our efforts to secure election reform has been stalled in the Senate.
132620	140120	Stalled because of Mitch McConnell, who has made it clear that he is going to block any election-related legislation.
140160	146320	Because of COVID-19, the world seems like it has turned upside down since last year.
146320	154340	One thing has stayed the same. Mitch McConnell still won't do a thing to make our elections more secure.
154340	165260	Last year, the top threat was electronic voting machines. They're still a problem, but now I'm especially concerned about Internet voting.
165260	179380	The coronavirus pandemic has presented extraordinary problems for state and local administrators and for American voters who justifiably don't want to have to put their health at risk to vote.
179380	189340	But it has also been a huge opportunity for snake oil salesmen peddling insecure Internet voting technology.
189340	196620	These companies have gone out and preyed on state and local officials who are desperate for options during this pandemic.
196620	210720	And what the snake oil salesmen have essentially been selling is kind of magic beans, promising that voters with disabilities and our men and women in uniform overseas can vote securely using their smartphones.
210720	219700	As this community knows, election security experts have been so clear that Internet voting is not secure.
219700	225580	Internet voting is dangerous and it's a threat to American democracy.
225580	234980	The allure of secure Internet voting is obviously understandable, particularly for officials who haven't had training in cybersecurity.
235220	250760	I'm sure you all by now have heard somebody say, well, if the tech companies can figure out a way to allow people to securely pay their bills online or transfer money from a smartphone, why can't they figure out the problem of Internet voting?
250760	256600	Coincidentally, this is similar to what FBI officials have said about encryption backdoors.
256960	272620	Their view is if America can put a man on the moon, why can't our technology companies build encryption backdoors that are secure against China and Russian hackers and allow law enforcement agencies to go after the bad guys?
272620	281980	What's needed, though, is for government to make sure that you don't see bad ideas advance.
281980	297740	And on both topics, I turn to actual cybersecurity experts, to cryptographers and computer scientists who've made it clear that secure encryption backdoors and insecure Internet voting are both beyond the realm of the possible right now.
297740	307100	The experts just don't know how to build these things safely, no matter how much government officials want them to exist.
307160	314500	So let me talk for just a brief few minutes about one Internet voting company named Votes.
314500	321300	This company convinced West Virginia to allow the use of their smartphone voting app.
321300	327460	After a pilot in West Virginia, the company expanded to Utah, Colorado and my home state of Oregon.
327460	332500	That's when I really started digging in to what this company was about.
332500	337300	The first thing I learned is that Votes had never been subjected to an independent audit.
337300	351140	The company was going out and about telling election officials that it had passed several audits with flying colors, but it never told those officials that the audits had been handpicked and paid for by Votes financial backers.
351140	356720	The people who conducted the audits had no experience at all with election security.
356720	362920	Officials in Oregon relied in good faith on the fact that they thought that Votes had been audited.
362920	366900	But state and local officials will tell you they're not cyber experts.
366900	378540	They don't have graduate degrees in cybersecurity, and so they didn't understand the difference between the bogus audits that Votes had passed and a rigorous independent audit by experts.
378540	382640	Of course, audits don't need to be a fancy official thing.
382640	392440	This community has demonstrated that individual researchers, college students, hobbyists can discover important security issues outside of a formal audit.
392440	399140	In 2018, a University of Michigan student as part of a class project decided to examine Votes.
399140	403300	That student was looking to see if the company's security claims held up.
403300	410020	The company's app called Home when the student tried to examine it is what was considered.
410020	417720	As media reports have confirmed, the company reported this directly to the West Virginia Secretary of State, who then called the FBI.
417740	427420	However, what hasn't been reported is the fact that Votes did not believe that hackers in China or Russia were attacking West Virginia's elections.
427420	440940	The company's CEO told my staff that he reported the incident to government officials specifically because the University of Michigan is home to researchers who have a long history of criticizing voting technology companies.
440940	443200	Let that sink in for a second.
443200	456260	The company reported a college student, a security researcher engaged in good faith security research to the government because the company had reason to believe that the researcher might be critical of the company.
456260	460240	This is absolutely outrageous conduct.
460240	466760	Security researchers perform an enormous public service by volunteering their time to find and report problems.
466760	480700	I for one would prefer that the first person to find a security problem in a voting system used in real elections is a researcher working in the public interest and not a hacker working for Russia or China.
480700	491360	Companies should be rolling out the red carpet for independent researchers, including the DEF CON voting village, instead of trying to bully them as Votes did.
491360	497340	Thankfully, Votes' scare tactics were not successful in scaring away other researchers.
497340	505600	Earlier this year, a team from MIT conducted a thorough audit of Votes' product and found it riddled with basic flaws.
505600	512980	That not only proved that the company's security claims were false, but that the company's prior hand-picked audits were a farce.
512980	520860	I commend the team at MIT for showing yet again that internet voting is dangerous.
520860	526920	This November, Americans will vote in what I believe is the most important election of our lifetimes.
526920	537080	Since Mitch McConnell has blocked several of my bills to secure our elections from cyber threats and ensure that every registered voter can vote safely in this pandemic,
537080	542740	let me close by mentioning just a few of the security issues that concern me the most.
542740	557420	E-poll book failures, particularly failures by states in checking voters in a polling booth, have repeatedly failed, leading to lengthy delays for in-person voting.
557420	572140	There are no federal cybersecurity standards for these devices, and I remain deeply concerned that e-poll book failures, whether caused by malfunctions, human error, or cyber attacks, could result in major problems.
572140	586940	Internet voting. While most officials now seem to realize that votes is insecure snake oil, 31 states continue to permit overseas and military voters to return marked ballots by email, fax, or over the internet.
586940	599340	As far as I'm concerned, this is the weakest link in our election infrastructure, as voters and election officials have no way of knowing if these electronically transmitted ballots have been tampered with by hackers.
599340	607380	In close races, email ballots can be the deciding factor, which is something that should worry everybody.
607380	620920	Election night reporting websites. There continue to be no cybersecurity standards for reporting websites, despite the fact that a hack could create massive chaos by misleading the public about the election winner.
620920	627060	Years ago, hackers went after reporting sites in the Ukraine, so it's not like this ought to be a surprise.
627060	637320	And finally, I'm worried that Donald Trump and his new political hack of a postmaster general are gunning for the U.S. Postal Service.
637320	647540	They want to make voting by mail less reliable, slow down election results, and allow Donald Trump to make baseless claims about the election being rigged.
647540	652800	So there are plenty of security issues for all of us to stay up late at night.
652800	664140	But there are still reasons for hope. First, the fact that all of you white hat hackers are willing to spend your time trying to make our elections safer is, in my view, an enormous asset.
664140	676620	I've been so impressed by the energy and creativity of the voting village and the young people who are working with Alex Halderman and Harry Hurst and Matt Blaze and everybody who makes this possible.
676620	685080	Second, there seems to be a gradual acceptance by the government and some vendors that security researchers are not the enemy.
685080	696400	Initiatives like the University of Chicago's election cyber surge, which aims to connect hackers with election officials, sound like promising ways to bring expertise to those who need it.
696400	709620	I'm also encouraged that the cybersecurity and the infrastructure security agency put out a very thoughtful guide for how election officials can work with security researchers when it comes to identifying and reporting vulnerabilities.
709960	720160	And God forbid I say anything complimentary about election vendors like ES and S after they lied to the public repeatedly about the security of their products.
720160	729660	But the fact is you do see them at black hat just two years after they asked the Senate Intelligence Committee to investigate the voting village.
729660	739720	That's a pretty stark contrast. Everybody is better off if government and election vendors see security researchers as a resource instead of a threat.
739720	753580	So it does give me some measure of hope that even though Donald Trump and too many in Congress still refuse to take election security seriously, that there are people doing good work to make a difference where they can.
753580	765720	And believe me, our elections need all the help they can get. And I just want to close by making it clear that we are going to keep up the fight for better election security in Washington, D.C.
765720	780480	And my view is that political change doesn't start in Washington, D.C. and trickle down. It basically bubbles up when the grassroots, particularly when it comes to technology, do the talking.
780480	790220	So don't stop fighting to secure our elections. Our democracy depends on it. And good luck to everybody in this crucial, crucial cause.