start	end	text
880	6700	Good afternoon, ladies and gentlemen. My name is Sanghoon Lee. I'm an Applied Data Fellow at the
6700	13200	University of Chicago. Today I want to present about my paper, Vote From Home, Evaluation
13200	20640	Framework for Election Security on Remote Voting in Response to COVID-19. So because it's my first
20640	27220	time to present in DEF CON, I just wanted to give some brief intro about myself. I am a recent
27220	34320	policy degree graduate with both engineering and economics background. I was born and lived in
34320	40480	South Korea, and I lived in Japan and the United States as well. And in the United States, I used
40480	45940	to live in Illinois, New Hampshire, and now in Wisconsin. I worked in the South Korean government
45940	52640	agencies in cybersecurity, namely Korea Internet and Security Agency and National Security Research
52640	60980	Institute. I'm a member of ITUT study group 17 security, so I used to make some recommendations
60980	68480	and also I reviewed the standardization recommendations from others. And well,
68480	75860	recently I am not joining very actively. However, it was one of the good part of my job as well.
76580	80640	I'm interested in cybersecurity, quantitative methods,
80640	87240	and global conflict, especially cyber conflict. Well, maybe that's because I'm from South Korea
87240	93640	because we have a North Korea facing. But still, this is my interest and it's a short intro about
93640	104880	myself. So let's talk about COVID-19. As of 28th of July, total confirmed COVID-19 cases
104880	111400	marked more than 60.5 million, while the United States having the highest number of cases.
111780	118320	Global deaths caused by this infectious disease, infectious virus, are more than half million,
118540	124980	while the United States have the highest death toll. Regardless of having been contained or not,
124980	130120	the deadly virus spread by human contact has changed our daily so differently.
131200	137240	So as a grad student, I had to see my graduation ceremony. As a former graduate student,
137240	146180	I had to see my graduation ceremony on YouTube. And a number of workplaces had shifted to work
146180	154820	from home. So some of them are working like this, or like this, and your office is closed like this.
155660	161120	We found a number of possibilities and threats at the same time while working from home,
161120	164360	including cyber threats. Then how about the democracy?
166040	172220	On April 7th, the state of Wisconsin held its in-person primary election as a preparation
172220	182440	for the presidential elections scheduled on November. However, because of the public health
182440	190180	concerns, 14 other states have postponed their elections, the primary elections. And here you
190180	196720	can see the United States is not the only country to postpone the election. A lot of countries all
196720	202900	over the world have postponed indefinitely or rescheduled their elections due to COVID-19
202900	211160	outbreak. Meanwhile, you could see a number of alternative methods to vote, so vote from home.
211680	219920	And to vote from home, there are a number of suggestions how to vote from home. First is about
219920	227440	mail, vote by mail. Second is about voting online. And third, well, this is also part of voting
227440	237640	online, but because a lot of public perception of blockchain seems to have a transparency and
237640	245940	accuracy, I also included blockchain here. However, we need to ask a question, are they
245940	251780	trustworthy? I already know that history of voting village starts from the questioning
251780	257740	cybersecurity of election infrastructure. Not only such cases of voting machine hacking,
257740	263840	disinformation, I wanted to emphasize how the remote voting method involving technology and
263840	269200	not involving technology as well is vulnerable, while more public interest and research is
269200	276240	required in this field with cross-disciplinary approach, like what I've done right now.
276340	284920	So first, let's talk about elections, democracy, and COVID-19. Election is a cornerstone of
284920	291460	democracy, and it's a central feature and a basic predicate of democracy. The primary mechanism to
291460	297600	select and to check, so check and balance the political leader, and it allows electors to
297600	306640	participate in the governance of the country and also the municipality. And COVID-19, because the
306640	313820	COVID-19 outbreak is a very serious issue in public health, government responses usually involve
313820	319200	mobility restriction, social distancing, and restrictions on economic freedom, business
319200	328180	operations, and organizational activities. As a result, the state stay-at-home restriction
328180	336620	orders affected to reduce mobility by 7.87%, and we've seen a lot of civil unrest against the
336620	343000	government orders, and it's happening right now as well. And we also see a lot of cases
343000	348460	of disinformation campaigns to install the public distrust within the society.
349920	356780	On elections, first, it discourages voters from casting a vote because it's dangerous for you to
356780	363880	cast a vote in person. Second, that there is a varied impact which induces the postponement
363880	371300	putting off the election. Third, electoral cycle as a whole can be posed with various types of risk.
371300	379740	Electoral cycle here, in the table below, I mentioned about the three different electoral
379740	385640	cycle, which is pre-electoral, electoral, and post-electoral. They all has a risk due to the
385640	394680	COVID-19, and usually the risk is about limits on fiscal meetings. And in this paper, not my own
394680	402000	paper, the paper which I referenced, he suggests that most of the mitigation method would be
402000	410120	online. So access to the internet and have a meeting at there, have a training at there,
410120	418040	and diffuse the information at there. And there is a way of voting online, and there's a postal
418040	426380	voting. And at the same time, after the election, there is online review, online meeting sessions,
426380	432080	and documentations can be transferred online, and we can have even online parliaments, just like we
432080	442690	have seen recent testimony of the big techs. So what I wanted to deliver is the assessment
442690	451550	framework on remote voting security. The framework evaluates in-person voter verifiable
451550	458790	voting versus remote voting methods. The criteria is software independence, accuracy, fairness,
458790	466070	trustworthiness, and secret vote. The software independence here is defined as a voting system
466070	471810	is software independent if an undetected change or error in its software cannot cause an undetectable
471810	478090	change or error in an election outcome. And it's defined in 2008 by Professor Rivest.
479710	489710	And here, during the evaluation, first, I didn't distinguish between the internet and mobile
489710	498350	voting, because they're both basically both of them are network method of voting. And vote by
498350	504010	mail is defined as a voting method using paper ballots casted by a mailing service.
504290	511130	The traditional voting is in-person method with paper ballots. However, I did not consider DREs,
511130	517430	because you know what? We already have plenty of knowledge of how DREs are exposed to cyber
517430	525070	threats. And this research only considers the electoral cycle, so the election itself.
527440	535420	The criteria for the criteria are first, software independence. I measured this yes or no.
535420	541840	Second, accuracy, whether the vote is accurate or not by three different levels. Third, fairness,
541840	549320	whether the vote has a fair chance to cast a vote by the electorates by three different levels.
549320	555060	Fourth, trustworthiness, it's also about whether the vote is trustworthy,
555800	562100	and especially whether the results are trustworthy. Fifth, the secrecy is about
562100	569020	whether the casting of votes is assured with the secret vote principle.
571360	578080	And the criteria measures of in-person voting with three different voting methods,
578080	585140	remote voting methods. First, online voting. Second, vote by mail. And third, blockchain.
585140	592580	Because blockchain, as I mentioned before, is considered as they're very safe and transparent
593080	602600	because the blocks are distributed. So I included this as a method to evaluate within my framework.
603400	611180	And the evaluation results are like this. As I mentioned, I evaluated internet voting,
611180	616140	blockchain, vote by mail, and traditional method. In terms of software independence,
616140	622200	because internet and blockchain both involve software, it is not independent. However,
622200	628180	vote by mail is software independent. And in traditional method, it is yes, it is indeed
628180	634100	independent. Accuracy, internet voting, blockchain voting, we already found the
634100	640560	vulnerabilities that may change the results of the voting. So it's not assured. While vote by
640560	646940	mail is partially assured. However, we also need to consider the other points apart from the
646940	655400	cybersecurity. So I cannot say this is fully assured. And about the traditional, yes, it's
655400	664600	assured. Under the consideration that the vote is fairly administered. And fairness,
664600	671260	internet and blockchain, it's partially fair because apart from cybersecurity, not a lot of
671260	676040	people may have access to internet or blockchain technology. So that's why I mentioned, I'll
676040	684640	explain this some more later. Vote by mail, it's seemingly fair. And traditional method, I think
684640	690640	it's the most fair method. And trustworthiness, it's vulnerable for both internet and blockchain
690640	698340	method. And vote by mail is less vulnerable. It cannot, it cannot say it's fully editable.
698440	706300	However, in traditional method, it is editable and safe. And for the secret vote principle,
706300	712580	it's also safe. Internet and blockchains are vulnerable. And vote by mail is less vulnerable.
712580	721020	And traditional method is editable and safe. This measurement, this measurement evaluation
721020	729020	was provided by all the research referenced by myself. So if you see the, if you read the paper,
729020	737080	you can see the references from this all results. And to make some points, first,
737080	743700	voting and internet voting vulnerabilities are not zero-day. They have, I can, even at
744340	750900	a non-cybersecurity technology professional, a non-hacking professional as me, can, could find
751700	759380	a number of vulnerabilities are listed from academic papers. And also some corporate reports
759380	766360	as well. And vote by mail is exposed to such issues as vote for sale, identification issue,
767080	772700	which may undermine its credibility. And as I just mentioned, involving technological
772700	780600	equipment is not free from digital divide. Well, a lot of researchers, a lot of researchers
780600	788060	tell that, tell that the use of, the increased use of technology and division of technology,
788060	793240	especially the information of communications technology, leads to a better human progress,
793240	800420	enhanced opportunity, more freedom and more civil rights. However, still, because it's not
800420	807820	affordable to everyone, it is likely to face a digital divide in there. And this may be an
807820	813660	international issue, but it also could be a domestic issue, which is very critical to,
814280	819440	critical to consider while administering the election. At the same time, not everyone is
819440	826540	digitally literate. So, for me, if I am provided with some guidelines, I can cast a vote by
826540	834120	blockchain applications or internet. However, it is not, it is not fully possible to
834820	842220	give proper explanation at the different literacy levels over the age groups. So,
842220	847220	not everyone is digitally literate. So, this is the thing that we should consider further.
848160	854500	And to make some remarks here, paper ballots are seemingly invincible towards cyber threats
854500	860920	posed on remote voting by a cheap software independence. However, we also need to require
860920	867260	operational transparency while administering the election. Second, unlike other features of the
867260	875880	internet, blockchain, remote voting is essentially exposed to cyber threats. And third, the results
875880	884020	suggest that further concerns on administering election remotely, so such as like a digital
884020	892800	divide, and we also need to be aware of some terrorist groups who want to undermine the
892800	901180	election credibility. So, hijack the transportation methods or something. We have a lot of risk,
901180	905680	not only cyber risk, but also physical risk here. So, we need to consider those kind of
905680	910700	as well. Fourth, the levels determined on the evaluation criteria are not contending
910700	916720	immunity of safety, reliability, or auditability beyond the codes and packets. So, it has a room
916720	923420	to develop, and it's a room to consider for more, and more discussions, more research should be
923420	931380	involved in here. So, not because I'm from South Korea, I wanted to introduce one best practice
931920	939120	from South Korea for election. South Korea was also not free from COVID-19 at the moment
939120	947020	of election, April. South Korea was one of the top 10 countries with its numbers of infected people.
947020	951600	At the same time, South Korea also had its national election to vote for the members
951600	957660	of the National Assembly. Interestingly, the election results on April 15 to 2020
957660	964940	turned out to show no new domestic coronavirus cases related to the election. So, how is this
964940	971700	possible? The voting does not involve voting machines in Korea, so we don't use DREs. It is
971700	978240	fully traditional in-person paper ballot voting. With further resources, South Korea was one of
978240	983940	most available to administer its election safely, not by special recipe, but by very
983940	996140	principle basics. Masks being required, gloves were handed to the voters by the election
996140	1003960	administration, and they had to keep the distance, social distancing, and the temperatures were
1003960	1011760	checked for all the voters who participated the election. It was simple but effective method to
1011760	1018900	contain the virus from spreading. So, what I want to deliver from this practice is that regardless
1018900	1025560	of how the virus is out there, still in-person traditional voting is available. And we also
1025560	1032340	need to consider about that. So, in conclusion, without paper ballots, online voting is very
1032340	1038840	vulnerable, as we all know. And if and only if in-person voting is unavailable, our second best
1038840	1045660	option is the vote by mail. And in-person with paper ballot election is not an impossible option
1045660	1054040	as we've seen from South Korea and a nationwide election. And the further thing that I want to
1054040	1060200	mention is first, we need to have a better operational capacity in administering the election.
1060840	1068320	Second, we need to recall the higher interest by the electorates, the voters. And finally,
1068700	1074420	we also need not only the general interest, but further research is required. Not only
1074420	1080800	cybersecurity, but also fiscal security, operational security, and how to optimize the
1080800	1089240	voting process. All of them are required and should be considered multidisciplinary. So,
1089240	1094940	thank you for your time and I'm open to questions. So, please send me an email or
1094940	1101240	talk, shoot me a message through discord and any other method. Thank you for listening.