Closest friends of the voting village, this is Michael Moore, the CISO from the Secretary of State of Arizona, and we are so lucky to have him. We're so grateful for him to be here. He's going to be doing his presentation called Divided We Fall, and please give a warm, warm, warm welcome for Michael Moore. Hey everybody, how you doing? Everybody doing okay? Can everybody hear me okay? All right, we've got some audio stuff that we might work out. There might be a little bit of reverb at times. I'm going to be playing some audio for you later. It's going to be coming from that device, so please be patient if you can't hear it. We have some solutions in place. You may have to come forward and huddle and hear it, but I want to make sure that everybody can hear it. So this is Divided We Fall. Last year, united we stand. This is sort of the Empire Strikes Back of the conversation, right? I hope you're doing great today. We're going to bring it down a little bit and then hopefully above where you were. Also, my goal is wherever you are on the spectrum in your confidence in elections, I want to shift you towards more confident from the place where if you have threatened an election official, I'm not giving you legal advice, but please say you're sorry. It's for real. It's a detriment to democracy and it's just unacceptable. Also, if you're thinking about sending a death threat to an election official, I want you to understand there's repercussions for that. You could lose your freedom. Don't do it. It's an attack on democracy. It's completely unacceptable and it's cowardly. If you have your doubts about elections, I want you to feel more comfortable that there's people taking it seriously, that they are trying to implement solutions, that we're doing communications between different organizations, that we're taking security seriously. I'm here today. There's multiple people from my sector here today, both in the vendor space and election operations, talking with academics, talking with researchers. We care about the vulnerabilities being found in these systems. We're working with the vendors to make sure that patches are developed and implement them in a timely manner. So, this might be a sound check. That's going to be the audio. So, if you have some difficulties hearing it... all right. So, as Kat mentioned, I am the CISO with the Arizona Secretary of State's office. I'm also formally the information security officer for Maricopa County. I've gone from working there to now they're my biggest customer. Just a few stats real quick to give you an idea of the threat landscape here. So, Arizona has approximately 4.2 million voters. My party is the one who is in dominant control. That's the party of no affiliation. Shorthand is independents, but technically it's no party affiliation. It's the largest majority in Arizona with about 1.45 million. Next up is Republicans with 1.44 million. Democrats are at 1.26 million. And the new no labels party is 8.5 thousand. So, as you can see, it's about a third, third, third split there, right? Democrats, Republicans tied. Independents in the lead. We have become a purple state. People split their votes. I split my vote. When I see a Republican that I believe does a good job, I vote for them. When I see a Democrat that I believe does a good job, I vote for them. So, that has made elections a little bit more less predictable, let's say, right? So, we've seen a lot of conflicts, and I think this is part of it. Maricopa is large, right? It's 60% of the population of Arizona. Maricopa is bigger than the population of 24 states. It has more employees than the smallest county in Arizona has citizens. So, this means we are a large target, but we also have more resources in Maricopa County. Forgive me if I say we, I'm not the Secretary of State's office, but I just came from Maricopa. They were the only county that had a dedicated information security officer. They have a whole information security team at a central IT department that supports elections in the other county departments. Some counties are so small, they do not have a single IT person. Thank you. Also, Arizona has 15 counties, right? Versus, if you compare it against someone like Georgia, that is 159 counties. And just a quick audio check. Are you guys getting massive feedback, or am I just kind of, you're doing great. Awesome. Okay. So, moving on. I want to make sure that you understand this before we get going. I'm going to play live death threats for you. If that's not your jam, and you don't want to hear death threats, or you need to step out because it's too much, you've been forewarned, please come back, because I'm going to go into the controls and defenses that we have in place for this afterwards. But you're going to see explicit threats directed to election officials. You're going to hear voicemail directed to election officials. At a certain point, I'm going to be quoting people, and I'm going to start swearing. So, I don't think any of you are made of glass, but there's going to be a little bit of effing and juffing. So, after we go through the threats, go low, I want to bring you back up, we're going to go through all of the threat hunting, threat reporting, the intelligence sharing we're doing in our communities, talk about social media lockdown training that we're providing to our election officials, and the voter education that we're trying to get out to people to make them feel more confident in elections. And I'll leave you with my recommendations for you. Spoiler alert, top recommendation is be a poll worker. So, this is the one election threat that I'm going to show on this deck that is not relative to Arizona. Everything else is Arizona. This is from Caitlin Jones, 25. She sent a series of text messages to an official's personal cell phone containing threats to injure the official and the official's minor child. Her text messages to the official included graphic photographs of a bloody, deceased, nude, mutilated woman lying on the ground, as well as a photograph of the official's minor child. Quote, fucking with elections is terrorism, and us Americans clearly don't tolerate terrorists. So, yes, you should be afraid, your daughter should be afraid, and so should your husband. Jones also made posts on the Instagram account for the official that contains threats to injure the official and the official's minor child. For example, she posted it on the account that the official's minor child was beautiful, and it would be a shame if something happened to her. She could see up to 10 years in prison. Here is a particularly disturbing series of voicemails that my boss has received, Secretary Adrian Fontes. Yeah, audio problems. Yeah, do we have our IT guy ready to do audio? As you can't hear it? Do you want my audio? Wait till the first, the first day as a motherfucker. You should be shot in the head for being a traitor. Fuck you. Check, check, check. All right, testing. Are we good? No feedback? All right. While the office regularly receives threats, this is an example generating some of the most concern because it specifically involves members of the Secretary's family. So imagine if you were in his position. I don't want to speak for him, but if you're an elected official, are you getting feedback? Because I'm getting massive feedback. Check, test, test, test, test. Check, test, test, test. Microphone testing. One, two, three. Test, test, test. Check, test, test, test. Tell me what you want. Check, test, test, test, test. Test, test, test, test. One, two, three, four, five. One, two, three, four, five. Nice. So dipping and diving takes you a little bit out of the experience right there, but apologies. And just as an FYI, folks, there's also a pre-recorded version of this. So if there's any part of this that you want to share with other people or that you missed, you're going to be able to get to it on the Voting Villages website. So as I was saying, imagine you're an elected official. You did not sign up for this. You're receiving this level of hate. You know, would you want to do this job? Next up, we have Walter Lee Hunstra. He's a Missouri public school employee. He was the technology director there. I'm going to need the audio up front for the next piece, please. So I see you're for fair and competent elections. That's what it says here on your home page for your recorder position you're trying to fly here. But you call things unhinged and insane lies when there's a forensic audit going on. You need to check yourself. You need to do your fucking job right, because other people from other states are watching your ass. You fucking renege on this deal or give them any more troubles, your ass will never make it to your next little board meeting. Four or five. Check, check. Awesome. Here we go again. So this doesn't happen in isolation. Why did this gentleman call from the Missouri region, a recorder in Maricopa County, Arizona to threaten his life? This is a trend that we've seen. Many people say my elections are fine in my area. It's the other ones that I don't trust. So we see people threatening across borders. All right, we're good on audio. Thank you very much. I appreciate your help. We're good. Next up, we have Francis Frederick Goltz, aka Free Speech Master. An update on him. He's pled guilty and I believe he has been assigned five years in prison. He's a Canadian citizen living in the United States in Texas, and I believe it's being discussed if he's going to be deported for the threats that he's made. Here are some posts from him. He calls for a real holocaust. Hypothetically, a mass shooting of poll workers and election officials in these highly suspect precincts might be the way to go. It would be a shame if someone talked to his children. There are some crazies out there. This kind of info shouldn't be readily available on the internet. This is from the Gateway Pundit. If you don't know what the Gateway Pundit is, I envy you. It's an alternative news media that frequently posts articles that disparage elections, frequently with nothing resembling any kind of evidence or proof. They just make wild claims and harass election officials. So this article is Rogue Rhino. Maricopa County recorder Stephen Richer violated two laws, blah, blah, blah. And Gateway Pundit also does not, in any way it seems, moderate the comments section of their post. So a good half of the death threats that we see are just in these articles. It's a a place where this energy can feed off of each other. And you can see Free Speech Master posted, we need to get this fucker any way we can. Here is another series. He's got a wife that's a lawyer too. We need to find out her name and where she works. I don't think he has kids, but I'm not 100% sure on that. And then from someone else, Pelosi Stock, she says, kids are off limits. He responds, no, nothing is off limits. It's people like you that are supposedly with us. We don't have the stomach to do whatever it takes to get our country back. That's why we lose. They've come after our kids every way possible, and you have some aversion to targeting theirs? Thanks for letting me know, but foxhole, I don't want you in. She responds, okay, join me in Maricopa ASAP, let's go. So it's interesting that this second person has no problem with the idea of death threats to election officials and the idea of acting on them. It's just kids is an arbitrary line for them. We see this frequently, any type of cooling off, any type of like, hey, maybe we shouldn't do this. It's met with aggression. So here's another series that we found. I believe this one was on Telegram. Hang them all. This has to stop. Nothing changes if nothing changes. I think burning them at the stake is more appropriate. Unless people dangle from the rope, justice is not served. Treason, on live TV so all can see. Yes, a plan that includes kicking down some doors and crafting some skulls like the rotten eggshells they are. Fry them all. Corrupt elections equals treason. Treason is a frequent claim that's made. The implication there is always treason is punishable by death. So if you are continuously saying someone is guilty of treason, you're implying that they should be put to death. Traitors all need to pay a traitor's price. And if guilty, which I think these commies are, I want to see them dangle from a rope until their feet quit wriggling. And the gif you can see in the background was just the body of one of the posts as well. And this is from patriots.win. Why are you so negative? Nothing has changed except now they're exposed. They will lose. There's way, way more of us than them. We have several options. And each option should be explored. If none works, then we have the final solution. This is just the beginning. Here is Stephen Richer from Maricopa County Reporter's Office. From here on out, Stephen deserves to eat phlegm in his restaurant food. He deserves a lot more than that. He has a lead deficiency that needs to be remedied. So again, encoded speech. A lead deficiency. What do you guys think that means? Right? What's made of lead? Bullets. He should be shot. No jury box. No voting box. Where's the ammo box, you fucking pussies? Don't you realize you'll have a lot more to lose when the country is actually gone and you can't do shit about it? Fucking morons. Won't do it alone, brother. People gotta suffer before anyone gets used to the idea that we have to shoot our way out of this at some point. And this next one is a particular concern of me. The military, spec ops, have the training and resources, especially ex-members. They're the ones that should be doing this first period. This is a call to action from people, the military, former military veterans. We see that frequently. Veterans are targeted and called to action that they should do something about it. Why won't anyone do a thing about this? You know, the idea of why won't someone rid me of this meddlesome priest, right? Mob boss type speak. Calling for action. Needs to be arrested for treason and executed. This faggot will hang. Alright, next up. We had a former employee who no longer worked for us. She was named in an election conspiracy theory event. She's someone who oversaw signature verification, the process by which when you have an absentee ballot or a mail-in ballot, we review the signature. She's the one who oversaw the... They claimed that the signature verification process was compromised. Since she oversaw it and she left, she must either be complicit or paid or forced to disappear. As a direct result of this event in person, we saw this series of communications. So where is her name? Former election and her position of Maricopa County. Some claim that she's a former FBI agent. Could she be at home? And then you can see they doxed her. And this is her address. This is her information that we've redacted. Someone responds, is this for real? If so, this is the moment we've been waiting for. Once these scumbags start fleeing, we know for sure the good guys are kicking butt. And another response, bang bang. What do you think that means? That is an implied death threat. So it is trivial to find addresses online and it's something we're still working to respond. You guys getting feedback again? I don't know if it's, I'm too close. Can you hear me? Check, check, check, check, test, test, test. All right. So she reached out to us after the fact and she fortunately wasn't home, but there were people that were banging on her door in person at 3am in the morning and her nest camera picked this up, right? In person event, claiming that she committed crime, knocks on her home. So in 2022 at Maricopa, we processed 386 threats. Many of those were single threats. The FBI gets frustrated at us when we submit more than one threat at a time. However, there is a limit to how fast they allow us to report threats. So sometimes they're coming in too fast and we had provide them with a package of threats, right? Here's a type of event or interaction and here's the 10 or 20 threats that we saw on this platform. That's up from 2021 where we had 33. In 2020, we saw six. At the Arizona Secretary of State's office, we processed 66, but it wasn't being tracked until November. So beyond the humanitarian consideration, there's a very real cost to losing election officials. Out of the 15 counties in Arizona, we have reporters. Some people have clerks, some people have different things. The reporter is the highest election official that runs a county, right? Elections are run local. Out of 15 counties, seven reporters have retired since 2020, 13 election directors. And I believe that number is out of date. We've had a few more and there's another one who's retiring soon. Think about the loss of experience. We have skilled election workers who understand the process, who have, you know, they understand the community that they live in and it's being cycled out. We've had people standing outside of our election facility, filming people going in and out, taking pictures of license plates. What happens when they start pulling our workers home? Who wants to work at government wages and experience death threats? What's more, in 2022, we saw a surge in Dropbox watchers. What happens when citizens feel it's unsafe to return their ballot? So, low. Let's try to bring it back up. We've seen a direct correlation with comments made on social media and traditional media, anything online, and a kinetic threat, physical threats to election workers. So, previously, we were a bit reactive, right? If one of our staff was accused of breaking the law, they started seeing their social media flooded with threats, phone calls, etc. We would then go through their social media and try to help them lock it down. That's reactive. It's too slow. We need to be proactive. And I'm going to dig into that in just a little bit. What's more is we're seeing threats come directly to our office, but there's also threats that are occurring in public spaces, not private forums, not private communities. We're not snooping in people's homes or anything, but if you're making public statements out on the internet, whether that's Twitter, Facebook, Instagram, Telegram, Patriots.win, if you're in the comment sections of news sites that don't moderate them and you're making death threats, that is a public death threat. That is not legal. So, we do threat hunting and gathering. We do it inside of our department. We do it at the Arizona Secretary of State's office. Maricopa County does it. And the other counties do it as well. And we communicate with each other. We also have third-party vendors that are out there doing threat hunting and law enforcement as well. When people make threats, we have to take them seriously, right? The first step in someone being an active shooter is making some sort of claim, saying, I'm going to kill you. How did that feel? I didn't like it. Maybe they backed out. Maybe it emboldens them. Nobody stopped them. So, we can't report to law enforcement acts of free speech. If someone is calling and harassing, they're calling every day. They're saying how much they hate you very explicitly, describing how they think something bad should happen to you. Free speech. But we see a direct correlation and this harassing behavior escalating to threats. We can't report free speech acts to law enforcement, but it still needs to be tracked. And that's what we have implemented. We have a codified process that defines what threats are and are not. So, again, just saying, I hate you, you suck, that's harassment, right? That's not a reportable event to law enforcement. Instead, a threat is a statement or intention to inflict pain, injury, damage, or other hostile action to someone in retribution for something done or not done. It can be direct. I have a gun and I'm going to shoot you. It can be indirect. Somebody should shoot you. A threat can be encoded using slang or pop culture references or word games. And when we receive those, it's important that when we report it to law enforcement, we decode it for them. We want to make it as easy as possible for law enforcement to do their job. If you give them something and they're like, is this a threat? I don't know what this is. It's got a Star Wars reference in it or something. It's important to explain to them, not as if they're stupid, but this is exactly what's being said. This is why it's a threat. If there's any specific law being broken, it's also nice to point them to the law that they can act upon. So next, internal ticketing. It sounds kind of odd, but our solution to tracking these things, especially things that are not immediately reportable, is we create a ticket. Every single time there's harassment or threats, we make a ticket, just like it's an IT problem, and it's tracked in our system. And when it does escalate to the level of a threat, here is a package for law enforcement, here's the series of events, the 30 days of them calling and saying how much they hate us before they slipped up and accidentally said, I'm going to do something about it. So it's not just a one-off. Every time a staff member is specifically threatened, we make sure that they understand, here's the scope of the threat. If someone just mentioned your name online and you're just a staff member who knows why they're targeting you for some accusation of malfeasance, we let them know, that way people know, hey, there's a threat out against you, and we know the scope of it. If they just mentioned your name, they just mentioned your name, all the way up to they've mentioned a violent act against you, we've looped in law enforcement, and maybe we have to negotiate getting you some additional security. And as I mentioned, we also do threat intelligence sharing with our community. So if we see a threat, if it's not us, we're like, oh, it's not us, oh, well, I hope they find it. No, absolutely not. So it could be someone who is in a different county. It could be someone who's a judge. Judges are seeing lots of threats these days. We report all of them every single time. We also have the ACTIC, which is our state's fusion center. It's the Arizona Counterterrorism and Information Center. It's the one-stop shop where local, state, federal law enforcement communicate with each other. So every single time we get one of these threats, we create a tip with them, and it loops in the correct law enforcement to act on this. Intelligence sharing. So we have a community called AZ-ISAC. It's a mechanism for all Arizona government entities to communicate with each other rapidly. We're able to stand up temporary events. For example, when there's the primary or general election, we're able to get all the affected entities into one space and communicate rapidly for detecting any kind of threats, any kind of operational problems that anyone's experiencing. And we also do frequent statewide election security meetings, or CESMs. So this is an opportunity for all of the county's election officials, reporters, to get into one place. We present to them information on these are the threats we're seeing. Here are solutions. CISA, DHS are frequent presenters in this space to let our leadership know what's going on, what do you need to be worried about, what are the resources we have for you guys. We also have one that's technology focused, so we can get into the weeds, right? Elected officials don't always understand the security controls that we have, that we need to implement. So we have a technology version, we get real deep, dirty with it, we talk about findings that we have at DEF CON, things that people need to be concerned about, and we're able to share with each other. And we also do one with communications. Information security, election security, has become a communications issue. We have to make sure that we are doing everything we can to restore voter confidence, and we're seeing constant mis-dis, mal-information, and we have to respond to that. So how do we do that as a group, instead of reinventing the wheel in every single small entity? So I mentioned the social media lockdown training. Again, we used to be reactive, now we're proactive. This is a training that's assigned to all of our election officials, not just the people at the top, everybody, because everybody's being threatened. We focus on three things for all of your social media, and again, it's a hands-on keyboard thing that we do with staff. Privacy settings. Are you sharing with the people that you want to share, or are you sharing with the world? I'm assuming most of you, or many of you, are hackers, and you understand, right? Like, if you go to somebody's Facebook, and it's just, boop, it's just open. That's a bad idea for many reasons. Maybe you should only share with your friends and family, we help them with that. But in the instance where we have elected officials, they need to be able to broadcast to the community. So it's just understanding, this is your public account that you're communicating with the public with, versus this is your personal account, right? Keep those things separate. Security. Do you have a long, unique password, and are you using a password manager? That way you can have a different password for everything. And are you using multi-factor authentication for everything? Yes, everything, please. And then the very last thing, perception. The idea of, how would this look if it was printed in the newspaper, right? I'm sure you might have had conversations like this with your family. Is this a view that I no longer agree with, or want to express publicly? Did you write something 10, 20 years ago, maybe not 20 with social media, that you're like, oh, wow, I do not believe that anymore, that was a stupid thing to say. Go ahead and remove that. Because if you get targeted and doxed, if you said anything that's inappropriate or controversial, that's what they're going to glom onto. And related, is this overly personal and inappropriate for a wide audience? Okay, so as I mentioned, myth, dis, and malinformation, or MDM, it drives threats. So we have to combat that with the truth. Here's the problem. The lies are sexy, right? Some of you may have seen or heard of 2,000 mules. It's set to music, right? Nobody wants to read the election procedures manual, right? That's boring. Maybe hackers do. But we have to find a way to make the truth what's actually happening. Policies and procedures, somehow we have to make that sexy, right? So that's the extremely challenging, maybe not impossible mission of our communications team. How do we reach out to our constituents and make sure that they understand that that thing that was specifically crafted and targeted towards them to elicit an extreme negative response is complete nonsense, right? And here's a super happy, positive thing that is the truth that is accessible. So Maricopa County has JustTheFacts.Vote. They go through and pre-bunk and debunk a bunch of common misconceptions and conspiracy theories and they walk you through the full scale version, right? This is an incredibly useful resource. If you are having a conversation with someone and they're like, well, talk to me about the Sharpie gate problem that you may have heard about where there was bleed through on ballots. This goes into detail on that. CISA.gov has a whole bunch of useful content, you know, at the Secretary of State's office and Maricopa County. Again, apologies for focusing centric on Maricopa, but I just came from there. They do a whole bunch of voter outreach stuff. They go out to colleges, local events, recently a gun show, right? And when I found out like you're going to a gun show, okay, that makes me as a security person a little bit nervous, but we got to get out to the people where they are, right? And you want to make sure that you're getting out to everyone, not just left, right, center of the spectrum, everyone. We put out constant newsletters. Our Twitter, their Twitter, Maricopa Vote, is very prolific. If you've not taken a look at it, it's got this perfect blend of informative and sassy. I highly recommend it. It is not boring. Unfortunately, it does generate a decent amount of death threats in that people post death threats as a direct response to it. At Maricopa Vote, the election directors there, Ray and Scott, have something called election connection where they dig in deep to questions from the public and they explain how the process works. And presentations like this one. So we're getting towards the end here. I'm not going to tell you that elections are unhackable, right? There's no system that is perfect. And if someone tells you something, they're either a fool or they're trying to sell you something, maybe a vendor, right? But I will say that the principles of good security are baked into elections. Prevention, detection, recovery, separation of duties, and the principles of least privilege. Like anything, election security can be improved. I'm trying to push forward election security. I'm trying to reach out to researchers, academics, vendors, bridge the gap between them, right? When there's vulnerabilities in equipment, whenever possible, I firmly believe that we patching these vulnerabilities. But there also needs to be an understanding of physical security and control over these devices, right? Just because a vulnerability exists does not mean it's been exploited. If surely some of you have some experience on the blue team, perhaps you're information security professionals, you can understand probably pretty easily why you might not patch right before a major event. Sometimes patches break things. So if there was a vulnerability that's disclosed right before the general election, that's not a time to patch, right? You need to rely on your defense in depth. You need to rely on your controls. You need to make sure that you maintain physical security of things, have cameras on things, make sure you have a backup process in place. So how can you folks help? The number one thing you can do is please don't send death threats to election officials. Other than that, please vote. And I'm not going to tell you how to vote. I don't want to. It's not my place. I don't understand your regional election and who the candidates are. One piece of advice I would offer to you, if you follow someone and they say something that's wrong and it's been discovered that it's wrong and it's shown that it's clearly wrong, how do they respond? Do they double down and maintain this thing that's untrue? Or do they change course, correct themselves, admit that they were wrong, and move forward? The next thing is please, sincerely, please, if you care about elections, be a part of the process. Be a poll worker, especially if you have concerns about election security in your area. Be a part of it. If you see something that seems wrong, report it. Report it up the chain. Talk to whoever your supervisor is. Talk to your election official. If you feel like you're not being taken seriously, take it to law enforcement. If you think law enforcement's not taking it seriously, you can go to the media. But I would not recommend that you take it to an entity that is specifically trying to collect evidence to undermine elections that doesn't actually ask for evidence. Next, demand intellectual integrity of yourself and others. We all have our beliefs. We tend to pick evidence that backs up those beliefs. When you hear something bad about someone that you like, you don't want to believe it. And when you hear something good about someone that you don't like, you don't want to believe it. We have close friends and family, leaders that we trust, and they share our beliefs. And it can be difficult to challenge those that are around us. But if we don't, that's groupthink, right? That's what took down the challenger because people were afraid to speak up. And I realize what I'm asking, right? You can irreparably damage friendships by calling people out on things. You can estrange your family. But that's what we're up against. If something is wrong, you have to speak up. We can't just continue to be polarized. And then the last thing, Ikri, that's known as the Sagan Standard from astronomer Carl Sagan. Extraordinary claims require extraordinary evidence. Please be critical, especially the things that you want to be true. If you feel an extreme reaction to something that you read, hear, or see, ask yourself about the citations, the sources, the context. You all know generative language models, AI, that's blowing up right now, right? Synthetic content, deepfakes, for example, it's about to go nuts, right? Maybe I'm a pessimist in this, but next year, there's no reason that we shouldn't see absolutely insane content. If there's someone that you don't like, a video that uses their voice that looks like them can show them doing something, right? Imagine your most hated election official that you would never vote for, you're going to be able to have a video of them kicking a puppy or whatever, right? It's going to happen. You guys are hackers. You understand this. It's up to you to explain this to your friends, your family, the community. Don't let nefarious actors trick you into reacting exactly how they want you to. Nothing makes me angrier than when someone tries to trick my grandmother and she's sharing stuff on social media that's like... that's not true. Like, let's do some research together. Help people learn how to Google. And the last thing that I'll leave you with before I'll take some questions is please, again, be very careful about trusting things just because it's what you want to hear. So thank you very much, and if you have any questions, please. Any questions? Nice, I nailed it. But sincerely, if you don't want to ask a question now, I'm going to be here all day. I'm surrounded by other people that are election experts. We would love to answer your questions. So please, please come up.