start	end	text
10260	17000	Can everyone hear me? Oh, wow, it works. Hi, everybody. I'm Susan Greenhall. I'm the Senior
17000	21220	Advisor for Election Security at Free Speech for People. We are a national, nonpartisan,
21220	25120	not-for-profit legal advocacy organization that works to...
25120	29500	Susan, stay sitting down. Don't go in front of the speaker.
31640	36740	...that works to protect elections and democracy.
37260	39420	No, no, please don't touch anything back there.
39760	48520	Thank you. For all the people, we have a part of that program which focuses on election security.
48600	53700	And I've done a lot of work on internet voting for over 15 years, studying the policies
54170	60820	and practices, written several reports on it. And I'm here to talk about this issue
60820	65540	with our esteemed panel. First, starting with David Jefferson, Dr. David Jefferson,
65540	72420	who is a researcher from Lawrence Livermore Laboratories, retired. In 1999 to 2000, he was
72420	77660	the co-chair of the California Secretary of State's Task Force on Internet Voting. He'll
77660	92060	talk a little bit more about that. He was also the... He was one of the co-authors of the peer
92060	98320	review that was done on the Department of Defense's CERV internet voting system in 2004,
98320	105880	which ultimately resulted in the Department of Defense canceling the project. And he can talk a
105880	112780	little bit about that. It was a $22 million project that was ultimately shut down. And he's been
112780	119220	writing, speaking, and testifying in opposition to internet voting ever since. So that's David.
119220	125540	Next, we have Matt Blaze, professor at Georgetown University School of Computer
125540	130180	Science and Law. He is also co-founder of The Village. And he's
132820	138300	been working in election security for two decades, especially interested in the impact of complex
138300	144020	software systems on security and reliability. And Hari Hirstie, also co-founder of the
144020	151320	DEF CON Voting Village. He is the OG in election security reviews,
151320	158520	famously conducting the Hirstie hack back in the 2000s. He also was part of a team that reviewed
158520	164120	the Estonian online voting system for security and traveled to Estonia to present the findings
164120	168800	to people there. So we have an incredible panel. And I will turn it over to David.
172420	178800	David, are we using slides? No, I'm just... my notes. Yeah, I'm coming over here to avoid
178800	186620	the feedback and because I have my notes on my laptop, so... and I hope you can hear me.
187500	193240	And then I need my glasses. Okay.
193240	201540	All right. So first let me give you a summary up front of where I'm coming from, which is
202120	208160	that it isn't possible now or in the foreseeable future with any combination of technologies that
208160	215540	we can envision today to secure an online voting system. And thus, we shouldn't be instituting
215540	221560	internet voting anywhere in the U.S. and we should really stop using it where it's in use today.
221560	226740	Voting, of course, is a national security issue and the legitimacy of democratic government depends
226740	237240	on voting being secure and open. So we really... we cannot open our voting systems to the various
237240	243380	kinds of threats I'm about to describe to you, some of which... many of which are... would open
243380	250200	our elections to manipulation by foreign actors. So let me talk about what internet voting is,
250200	257720	first of all. What we mean by that is any voting system in which voted ballots are transmitted
257720	262720	over the internet. Maybe one hop of the communication is just over the internet,
262720	266500	but if it's... if voted ballots are ever transmitted over the internet in the course of
266500	271900	running an election, it's an internet voting system. It doesn't matter whether it's by email
271900	278560	or fax or web or mobile app, any scheme, doesn't matter what the protocol is, if it's transmitted
278560	282620	over the internet, it's going to be vulnerable to the kinds of threats I'm about to describe.
283760	287580	So let's talk about those threats. What are the threats that we're talking about?
288120	294200	There are many of them. The first one is authentication-related threats. When you...
294200	299540	when you vote online, of course, you have to identify yourself so that you can be checked
299540	306000	that you're registered and that you are... you haven't already voted, and so you have to actually
306000	312180	identify yourself. There are... that will have to be done online also, and an attacker can mess
312180	316940	with that system so that it makes it too difficult for people to authenticate themselves and they get
317620	322600	disenfranchised, or too easy for people to authenticate themselves, and phony voters can
323200	330700	can vote. So authentication threats, number one. Number two, and perhaps the most insidious, is
330700	337540	client-side malware. You're going to be voting from some device, a phone or a PC or other mobile
337540	344660	device, and that device might be infected with malware, and that malware might have the purpose
344660	351180	of interfering with your voting, either preventing you from voting or modifying your votes before your
351180	356060	votes are even... even get out of the device, before they're encrypted for transmission, your votes can
356060	360160	be modified. You wouldn't know if the election officials wouldn't know it. That's a profound
360160	366140	problem, the client malware problem. The third problem, the third kind of attack, would be network
366140	372380	attacks, attacking routers or DNS or other parts of the internet infrastructure, where even if your
372380	377860	ballots are transmitted in progress, they can still be stopped or redirected or otherwise
377860	387840	interfered with. There are spoofing attacks, where you are tricked into voting on...
388860	393960	to an incorrect site, a site which may look like the real site, but which you are...
396180	400760	which is not, and you think you voted, but you didn't, and you don't know whether
400760	406640	your vote was transmitted or modified or just thrown away. There are denial-of-service attacks,
406640	413460	where the server that receives votes is overwhelmed with a lot of fake ballots sent
413460	419840	to it by an attacker. It's so overwhelmed that the service slows down. It may slow down
420380	425080	to the point where voters get timeouts and they can't vote at all, or the system,
425080	432600	the server just crashes. There are server penetration attacks, where an attacker actually
432600	437960	gains control remotely of the servers that's accepting the ballots, and when he gains control,
437960	445560	he can do anything he wants. Many of these attacks can be insider-aided, but insiders
445560	450920	would include election officials and programmers and so on, and there are many variations of all
450920	458240	of these attacks. Now, there are no strong defenses to most of these attacks. There just
458240	465760	are no strong defenses. There are ameliorations, there are ways of handling certain special cases
465760	470360	of these attacks, but they're not general solutions with technologies that we have today.
470740	475000	And they rest on some profound problems in computer science, which Matt is going to tell
475000	485180	you about in the next talk. These are the same threats that we encountered 25 years ago when I
485180	491000	was the chair of the California Secretary of State's Internet Voting Task Force, and they're
491000	497660	why we recommended that California not institute internet voting in 1999. These threats haven't
497660	502980	really changed material in the last 25 years, and they may not change materially in the next 25
502980	511960	years. They are that intractable. Now, the problem is that all of these attacks that I mentioned can
511960	518540	be automated and scaled up to massive scale, depending upon technical details of the architecture
518540	524260	of the voting system. The attacks can come from anywhere on earth, including rival nation-states
524260	531700	or our own domestic partisans. Successful attacks may go completely undetected, but if they are
531700	537040	detected, they may be completely uncorrectable without running the election over again.
537300	542520	The perpetrators of the attack may never be identified, but even if they are identified,
542520	549840	they are likely to be out of reach of U.S. law, as the 12 Russians who are under indictment for
549840	557180	interfering with the 2020 election are out of reach of U.S. law. So the problems with internet
557180	565140	voting are profound. And I'm going to now turn it over to Matt, so he can talk more about that
565140	578510	subject. Thank you. So thanks, David. So I just want to expand on some of the stuff that David
578510	587730	was talking about. He mentioned fundamental problems. And as a scientist or as an engineer,
587730	595790	when somebody says, oh, that's a theoretical problem, we understand it to be different from
595790	602790	when the general public uses the term theoretical problem. A theoretical problem in normal life is
602790	606910	one you don't really have to worry about. A theoretical problem in science and engineering
606910	612990	is the worst possible kind, right? It's the kind that is fundamental to the system,
612990	617050	that it's something that you cannot do anything about without either changing the assumptions
617050	625010	or compromising on what the requirements are. And there are two sets of fundamental problems.
625010	629810	The first set of fundamental problems are computing problems, computer science problems.
629810	639990	And all of the problems in voting, in building a secure voting system that we encounter from an
639990	645770	engineering point of view, are problems that actually were around before voting was an
645770	651910	application people were even considering. There is a fundamental theorem in computer science
652810	659150	that essentially says it is impossible to compare a program with its specification
659690	666490	and understand whether it meets it. And this is not a problem that we simply haven't worked
666490	673030	hard enough to try to solve. It's a problem that we know that we cannot solve. We will never be
673030	681090	able to solve it. And the implication of that is that general purpose complex software can never
681090	689350	be assured to be completely correct. Now, that mostly doesn't bother us for all sorts of
689350	696770	applications of computing that we rely on for many things. In fact, the title of this panel,
696770	702710	I can bank online, why can't I vote online, is an example of that. We rely on the same
702710	709850	flawed computing systems for things like banking. So why is it we're able to get away with it? And
709850	716930	the short answer is we don't. Bank fraud is enormously common. Banks are robbed online
716930	723950	all the time. There is identity theft and so on constantly. The difference is a second set
723950	731170	of fundamental problems, which is the voting application itself has a set of incredibly
731170	739390	stringent and in fact somewhat contradictory requirements for building a voting system.
739390	747950	One of them is that your vote must be anonymous. And it must be anonymous to the point where you
747950	754570	can't even voluntarily prove who you voted for. And that requirement exists to prevent people
754570	760590	from being able to be coerced into voting a particular way or being able to sell their vote.
760590	767710	And there's a long history, even in the United States prior to that requirement existing,
767710	776150	of people having their franchise coerced away from them because it's possible to tell how
776150	782150	someone voted. Banking transactions don't have that requirement. A banking transaction is
782150	788250	reversible. If money disappears from your bank account, it's possible to be made whole again.
788250	795070	But if your vote is changed after it's been cast, we don't know whose it was. And you have no way
795070	803550	as a voter of proving how your particular vote was cast in order to be able to correct that.
803550	809710	And if that changed, you'd be able to prove how you voted. So we have these two sets of
809710	814930	fundamental problems clashing with each other. The first is we don't know how to build systems
814930	823510	that are reliable enough to avoid problems like this. And the second is voting requires us to
823510	830650	build systems that avoid problems like this rather than correct them after the fact. And this,
830650	837110	combined with the fact that an online voting system requires using complex computer technology,
837110	843710	means that this is a problem that we won't be able to solve, no matter how hard we work at it.
843710	850350	It's not that we're just not very smart. It's that these problems are beyond human capacity.
850870	858670	So where does that leave us? Where that leaves us is we have to recognize that online voting is
858670	869210	intrinsically very risky. That it will lead to elections that we will never be able to
869210	878410	satisfactorily show were conducted without fraud, without hacking, and that the outcome is genuinely
878410	885810	true. And that will always be with us when we do it that way, unless we relax some very important
885810	892550	requirements of voting systems. So, by the way, I'm not the only one saying this. There was a report
892550	900290	from the National Academy of Sciences called Securing the Vote, where the top experts in the
900290	904650	field got together and produced what's called a consensus report. It essentially makes a very
904650	911570	strong statement, you know, this is something we do not know how to do. And, you know, recommends
911570	920070	against it wholesale. So, you know, those who propose online voting systems are essentially
920070	928770	proposing something that the consensus of scientists is impossible. So we should understand
928770	931790	it in that context. So, thanks.
940660	949540	So, internet voting is a vacuum. It keeps on coming back. And the argument is very often say, well, we have this
949540	956020	excuse. Can we do just a little bit of internet voting? There's two reasons why that's not a good
956020	964900	idea. First of all, all the votes are one pool. The idea that I can vote insecurely myself
965620	972500	wouldn't disfranchise the other voters is logical fallacy. Because if there's only one result, and
972500	980940	if I'm choosing to make my own vote insecure, I'm also making everybody else's vote vulnerable.
980940	986980	But there's even more profound reason. A lot of nations, including United States, and a lot of
986980	991400	states in the United States, but other nations, have the same principle that all voters should
991400	998020	be voting with the same method. So once you are enabling the door that let's have a little bit
998020	1002740	of internet voting, the next step is to say, now everybody has to vote with internet voting
1002740	1009880	because we cannot have separate methods. The common ways we are hearing always to
1011000	1016580	give an excuse, what are the special groups who need to vote the internet? And one of these are
1016580	1021620	in America, it's called the UOCAVA voters, Unified Overseas Voters Empowerment Act.
1021640	1026720	So they are mainly the boys and girls in the military, who have a problem of getting the
1026720	1034560	ballots done on time. However, this same problem is everywhere else in the world. And the other
1034560	1041540	part is why UOCAVA is, or military voters in general, are a very good target for saying,
1041540	1046920	let's do internet voting, because in a lot of nations, military voters are not guaranteed to
1046920	1053820	have secret ballots. It's a best effort basis only. So military voters don't enjoy the same
1053820	1059780	legal protections as general public, and that also enables you to have a little bit more relaxed
1059780	1065940	voting system, because you don't have to guarantee a secret ballot. Another group is, and very powerful
1065940	1071740	lobbying groups, is disabled voters, and especially print disabled voters, so people who cannot read,
1071740	1078860	cannot write, cannot hold a pen in their hand. There are a lot of devices, for example ballot
1078860	1084580	marking devices, which are designed to access, but the idea is, okay, well let's do that at home.
1085100	1093600	Again, this is leading, this whole path leads to a dual language, where a constantly the attempt is
1093600	1099780	to call the voting to be not internet voting, but instead of calling it to be electronic return of
1099780	1106520	your ballot. It's the same thing, but the idea is, this is the way we sell the idea, without a
1107300	1113540	getting into the trap or informing people that this is the bad idea. Again, internet voting.
1114720	1123600	Internet voting has been claimed to be successful in Estonia. I went to Estonia with Professor
1123600	1129940	Arthur Haldeman and a couple of other folks. We took a look into the system, and it was a
1129940	1135500	fairly decent high school project. That was the quality of the code. However, there was a lot of
1135500	1141000	interesting things in operational side. For example, they rented the servers every year
1141000	1146700	separately. So from a supply chain point of view, this one agency is renting three computers.
1147660	1153880	That's your target. The lowest bidder, and you can poison all you want. There were a lot of
1153880	1161360	designs in that area. For example, they published a video where a code is signed cryptographically,
1161360	1166540	so that the voters will know this is an honest code. And they claim that this computer,
1166540	1171420	where the video is taken, has never been connected to internet. But it had a microtorrent,
1171420	1178440	and pirated movies, and pirated films, and online poker on the screen. So slightly
1178440	1186960	suspicious that it might have been in internet. In Finland, we tried internet voting, or online
1186960	1192300	voting. It was kiosk voting, but a system which can be used for internet voting too,
1192300	1198180	in three counties. And it was demonstrated that three and a half percent of the votes were lost,
1198180	1202380	and hence the vote, the election had to be reconducted. Because three and a half percent
1202380	1207740	in a, what you call Jefferson counting method, means that it's absolutely certain that the last
1207740	1216020	candidates in the city council will be awarded to the wrong people. The common excuse also is
1216020	1223560	to claim that we need internet voting to activate young voters. Young people like mobile phones.
1224480	1229280	Estonia is a brilliant country from the point of view that they publish at age brackets. And
1229280	1236800	when you look in Estonia, you see that the fastest growing group of voters online is over 65. And the
1236800	1243340	young voters are rejecting the idea of internet voting. The same was in Norway. So the actual
1243340	1249940	government public data doesn't support the common wisdom that young voters would be activated by
1249940	1258060	using internet voting. Last but not least, I want to touch a very big topic in, for example, Europe
1258060	1268160	and Germany. A lot of old democracies have a rule that common person has to understand how votes
1268160	1274460	are counted and have to be able to verify the vote counting process with no special tools and
1274460	1281000	education. Common man's common knowledge has to be enough. Now we are proposing very complex ideas
1281000	1289820	like homomorphic encryption, blockchain. The joke in the U.S. is that average age of poll worker is
1289820	1294360	one year older every year because we don't have enough young people coming to be a poll worker.
1294360	1303280	But until we live in a Star Trek universe where teenagers are casually talking about
1303280	1309000	quantum mechanics, who is going to be explaining to a 70-year-old normal person how homomorphic
1309000	1315700	encryption works? And in today's world, why anyone, why you believe that you could be ever getting
1315700	1321080	normal people to accept the idea that this is so complex idea that even most of the experts don't
1321080	1340680	know how it works. So let's keep it simple. Thank you. Okay. So after hearing all of that,
1340680	1346380	I'm guessing everyone probably think who would ever want to do internet voting for public
1346380	1352960	governmental elections. But unfortunately, right now, 32 states permit some subset of voters to
1352960	1361080	vote online either by email, fax, or some sort of online portal. And there's a lot of ballots coming
1361080	1367000	back online. In the 2020 election, there were over 300,000 ballots cast online. And in some states
1367000	1371480	with small margins, there were a significant number of ballots cast online. And this is a problem
1371480	1377040	because those ballots we know are not secure and they can't be audited. So I want to talk a little
1377040	1382300	bit about the policy and the history of how we got here and how it's playing out today to understand
1382980	1392260	our situation. So as I mentioned in the intro, back in 2004, David was part of a security study
1392260	1397740	that examined the system that was being put together by the Department of Defense to military
1397740	1402640	and overseas voters to vote online. This was something that was tasked by Congress, Congress
1402640	1410280	tasked them to do this. And they built a system, had a peer review of the security. The peer review
1410280	1415900	said this is not secure. You cannot ensure the legitimacy of ballots cast online. So the project
1415900	1420520	was scrapped. Congress turned around and said, okay, we'll have NIST, National Institute of
1420520	1425520	Standards and Technology, develop standards for a secure online voting system. And then we'll have
1425520	1430680	the Department of Defense build to those standards. So NIST spent the later part of the 2000s and
1430680	1436780	early 2010s studying the problem, writing several reports. And they came to the conclusion that the
1436780	1443060	all come to, that there's this broad scientific consensus, that these problems are really not
1443060	1447780	solvable with the security tools that we have today. And they wrote a statement saying,
1447780	1452160	we don't know how to write security standards because we don't know how to do internet voting
1452160	1459500	securely. It's not yet feasible. So we're not doing it. So Congress said, okay, a couple years later,
1459500	1465300	because Congress moved slowly between 2014 and 2015, Congress repealed the directive to the
1465300	1469540	Department of Defense to build an online voting system, essentially taking the federal government
1469540	1473560	out of it. We often hear, why isn't the federal government studying it? The answer is they already
1473560	1480360	did, asked and answered. So in the subsequent years, we've seen more reports come out in 2018.
1480360	1485720	The National Academy study came out that Matt mentioned. There's been numerous academic studies.
1485880	1489880	There's been some states have done their own studies. Time and again, when the computer
1489880	1495220	scientists and the security experts look at the problems, they realize that voting is not something
1495220	1502000	that you can apply today's security tools to in a sufficient way to secure it. So we've never
1502000	1506540	come up with anyone that says, here, this is a secure way to do it from a scientific perspective.
1506680	1512920	Yet, in that early 2000s period of time, and even the late 90s, there was a reasonable expectation
1512920	1517120	that we were going to have a secure online voting system from the Department of Defense.
1517120	1523940	So states passed laws to allow electronic ballot return. By 2010, I think there were 29 or 30
1523940	1531020	states already had electronic ballot return laws in place. So that was before NIST came up with
1531020	1537220	their statement saying we can't write security standards for this. And before the bulk of
1537220	1546980	the scientific research that's so conclusive had come out. So in the mid-2010s, we'd seen
1546980	1553220	kind of a slowdown in the movement for online voting. But now we're in the middle of an aggressive
1553220	1558120	push once again to have people vote online. And that's coming mainly from two places.
1558120	1563860	First, there's a guy named Bradley Tusk, who is an Uber multimillionaire, made a bunch of money
1563860	1569140	for Uber, and he helped change their policies. He's not a tech guy, he's a policy guy. And he
1569140	1576820	helped change state laws to allow Uber rideshare policies around the country. He also was responsible
1576820	1581400	for changing state laws to allow sports betting on the FanDuel app. So he knows what he's doing
1581400	1587280	as far as changing state laws. And he's decided that he's going to save American democracy by
1587280	1593200	getting everybody to vote on their phones by 2028. He said that on his podcast. He has also
1593200	1598400	said that he will do anything unethical short of committing a crime to get everyone voting
1598400	1604680	on their phone. So he's hired lobbyists, he's got public relations people, and he's introducing
1604680	1611460	bills in different states around the country to allow people to vote online, starting with
1611460	1616620	subsets of military and overseas voters for states that don't already have it, and then to expand it
1616620	1623160	to voters with disabilities, to expand it to voters with... to first responders who may be displaced,
1623160	1628260	and then ultimately with the goal of getting everybody to vote online. Now, the problem is...
1628260	1633780	oh, and one of the most definitive studies, or scientific studies that we saw, or I shouldn't
1633780	1638080	call it a study, it was a risk assessment that came from the Department of Homeland Security,
1638080	1647600	CISA, FBI, NIST, and EAC in 2020, which warned states, you don't probably want to do this,
1647600	1653120	because those ballots will be high risk of compromise, manipulation, deletion, or privacy
1653120	1660080	violations. Any ballots cast online via any method, even with security tools in place. So
1660800	1666280	even with this security, all this guidance coming from the federal agencies, those federal
1666280	1673720	agencies can't go into the states and lobby. They put out their risk assessment, hope the states
1673720	1681180	look at it. Instead, it's left to organizations like our organization. We work with Verified Voting,
1681180	1686080	with Brennan Center, with Public Citizen. These are all groups. We are very deeply committed to
1686080	1690860	ensuring access for all voters. My organization actually takes legal actions to ensure people's
1690860	1695460	access to the ballot. But we want to also protect that ballot and make sure that the election is
1695460	1701780	secure. So that's why we are going in and raising these security concerns in the state legislatures
1701780	1707360	and trying to keep states from introducing more bills to spread online voting. In the last year
1707360	1715100	and a half, we saw bills introduced in California, Washington, Maryland, Wisconsin, Michigan,
1715100	1724740	Illinois, Georgia, New York, New Jersey, and Washington, D.C. So we have that. That's one
1724740	1729380	aspect of the push for online voting. There's another aspect that comes from the vendors,
1729380	1734720	because this is an industry that is not regulated at all. The systems that are being sold
1734720	1741340	commercially don't undergo any sort of public testing that anyone else can review. The vendors
1741340	1748680	make claims of security or claims about the way the system operates that are unfounded, baseless.
1748680	1754600	Actually, our organization has written letters to attorneys general arguing that these could
1754600	1761180	constitute false claims and deceptive marketing and could be actionable in asking for investigations.
1761400	1770500	But there's nothing to counter it other than us bringing up the other side of it.
1770500	1776960	The vendors are also lobbying in state legislatures and promising state lawmakers that
1776960	1785280	these systems can be secured. And that's another aspect of it. So this is an ongoing problem that
1785280	1790380	we're going to continue to see because of these two forces pushing online voting at a time when
1790380	1795960	we really need to have auditable systems, transparent systems, secure systems that we
1795960	1800140	can ensure that all people can have confidence in the results of an election
1800880	1806400	and not expand an unsecure system that we know is insecure.
1807440	1811900	Internet voting has been glibly referred to as the Theranos of voting. And I think that's
1811900	1818080	actually a very apt analogy. Because I don't know if you're familiar with the Theranos story.
1818080	1825120	Theranos is the blood company that was founded that went to a billion dollars and they were
1825120	1829320	going to take a tiny pinprick of blood and be able to run a complete screen of every test that
1829320	1834460	you could ever possibly need and know your entire health history. And it would be cheap and everyone
1834460	1839300	would be able to do it at CVS or Walgreens. And it was a great idea. Who doesn't want that?
1839300	1844080	But the problem is the science didn't let you do it. You needed more blood to be able to run
1844080	1851080	certain tests. The blood needed to be centrifuged and separate out the cells and reagents put in
1851080	1856000	there. You can't do it all. But the idea is so great. Everybody wants to do it. Yes, it would
1856000	1861440	be really great if we could all vote on our phones. But the science isn't there. So I'm
1861440	1870000	going to wrap with that. And we're going to go to questions after. And I guess we lost Hari.
1870080	1874580	But I'm going to, as the moderator, I'm going to take prerogative and ask the first question of
1874580	1882100	David. So when I was talking, I was speaking about the importance of auditing elections,
1882100	1887960	especially everyone should have confidence. We don't want to just, you know, trust elections.
1887960	1894900	We want to verify elections. So how can you audit an online voting, an online system,
1894900	1899260	or can you audit an online voting system? So when you voted a precinct, or if you,
1899260	1903280	if you mail in a ballot, I'm going to step over here to get out of the feedback.
1906000	1910500	You, you have, well, that's not working.
1911560	1918420	You, you hand mark the ballot, and there is no question that the ballot actually reflects the
1918420	1924300	voter's intent. When you vote online from your phone, and sorry, and that ballot, that hand
1924300	1931500	marked ballot becomes a contemporaneous record of the voter intent. So that if those ballots
1931500	1937960	are later counted by machine and the, and the software in those machines is full of bugs and
1937960	1944900	is full of, of malware. And so the counts are wrong as produced by machine. You can always
1944900	1952000	go back. In fact, you should always go back to the original hand marked paper ballots and audit
1952000	1958020	the machine results using an RLA or risk limiting audit, for example, as was discussed at a panel
1958020	1965040	yesterday. And, and therefore you, you, you can determine that the machine counts were wrong and
1965040	1970640	you can, you can correct the outcome of the election. Now with a, with any kind of online
1970640	1977140	voting system, if you are voting from your phone or your personal computer, there is no indelible
1977820	1983160	contemporaneous record of how the voter voted. I mean, what, what, what the voter's actual intent
1983160	1990840	was, there is no record from which to audit the election. So it's really not possible to
1990840	1995820	audit an online election. And that's just another reason why we shouldn't be doing it.
1997000	2005900	And I'll just, oh, am I off? And I'll just add that one of the things we see the vendors say
2005900	2011460	is that we produce a voter verified paper ballot. Our system isn't online voting. It is an internet
2011460	2017980	voting. One of the, the CEOs of one of the vendors told a radio show that we don't use
2017980	2021880	the term internet voting because it's a loaded term. We say electronic ballot return. So it's
2022000	2027960	a little bit of this smoke and mirrors. And that they produce a voter verified paper ballot. Well,
2028160	2031880	a lot of times the digital record is sent to the elections office and then it's printed there.
2031880	2036420	But obviously that paper ballot has never been verified by the voter because the,
2036420	2041900	the digital record was what was sent. But to say it's a voter verified paper ballot is,
2041900	2048120	is highly misleading at best. So you don't have a voter verified paper ballot to audit the election.
2048820	2053500	So are there any questions? Do you want to use the microphone?
2054160	2060760	Oh, okay. I'll do that. You can talk in that.
2061920	2067540	Um, so, uh, purely from a technical perspective, uh, you folks were talking about the kind of
2067540	2072560	combating requirements of a secret ballot and a technically secure ballot. I vote for Mickey
2072560	2076740	Mouse every year. I don't care who knows that. From a purely technical perspective,
2076740	2081820	if you omit the requirement of secrecy, does online voting become much more viable?
2081820	2087920	There are all sorts of things that, all sorts of problems get easier if you, um,
2087920	2092560	reduce the requirements. And, you know, the requirement for a secret ballot isn't,
2092560	2096500	doesn't exist just because a bunch of technologists said it should. The requirement
2096500	2103160	for a secret ballot evolved over, you know, centuries of US law and centuries of experience
2103160	2110200	with fraud in democracies based on coercing votes from people. We could, as a society,
2110200	2117100	decide to eliminate the secret ballot, uh, and maybe we decide that we want to. But I think a
2117100	2124440	poor reason to eliminate the secret ballot is simply to accommodate some future voting technology
2124440	2130380	that finds it an inconvenient requirement. Um, so, you know, I think it's very important to,
2130380	2135560	to understand here, these requirements didn't come from us. These requirements are not
2135560	2141080	requirements that the technologists invented. These are requirements that society has decided
2141080	2147160	are important properties for voting systems. And, uh, you know, we can discuss whether those
2147160	2153760	requirements are good or not, but that discussion had nothing to do with technology. It's a, it's a
2154400	2159700	democracy requirement. Um, you know, and again, there are many, you know, when I hear about
2159700	2166360	internet voting, I find it helpful to substitute in my head perpetual motion machine, right? If we
2166360	2172300	had perpetual motion machines, it would be great. It would solve our energy problems. Everybody agrees
2172300	2179860	perpetual motion machines would be terrific. Unfortunately, a bunch of, you know, a bunch of
2179860	2189180	killjoy physicists tell us that we'll never be able to have them. Now, if you believe the killjoy
2189180	2196640	physicists, it would be a bad idea to create policy on the assumption that we're about to
2196640	2203680	build a perpetual motion machine because we're really not. And internet voting has many, many
2203680	2211260	of the same, uh, properties there. And I would like to add one thing before, before we go, uh, which is
2211900	2217980	I want to praise the secret ballot requirement. The secrecy of the ballot is the, is the strongest
2217980	2226140	defense by far we have against voter coercion, vote retaliation, and vote buying and selling.
2226140	2232300	Without the secret ballot, our elections could be irredeemably corrupted by those effects.
2233400	2239200	Thank you. Do we have a question? Yeah, I have more of a comment that I'd love to get our
2239200	2245960	moderator's, uh, response on here. Um, what really worries me more than anything about online voting
2245960	2252740	is much more lower tech actually, is that if it goes broad, large scale, it's subject to, uh,
2252740	2258340	phishing attacks, right? You could, uh, have very large scale voter suppression with fake emails
2258340	2263480	coming from secretaries of state, apparently, and you go and you lose your boat and maybe you get
2263480	2269980	your identity theft too. Now, phishing campaigns can be just, you know, 19, 20% effective, effective.
2269980	2277660	Targeted, they can be 70% effective. And who's going to get targeted in a voter suppression
2277660	2286360	campaign? The same people who always get targeted, communities of color. So I think this whole issue
2286360	2292360	very quickly becomes a racial justice issue, honestly. And that's, that's not even getting
2292360	2299830	into the stuff you all have been talking about that I firmly agree with. I, I, my comment is I
2299830	2305930	agree. I don't know. I don't have much more to add that was very well put. Um, any other?
2314510	2319750	Hi there. So just a quick question regarding authentication and biometric data. So can your
2319750	2325130	team speak to, um, the benefits of that? I know that the TSA, for example, is using biometric
2325130	2330590	data for authentication purposes for international travel, comparing your photo to your passport
2330590	2335010	photo to your face while you check in. Um, obviously having biometric data stored by the
2335010	2338630	government, maybe isn't the best idea, but you could do something like hashing or something
2338630	2342350	different like that. But can you speak to the advancements of biometric data and how it may
2342350	2349250	pertain to online voting in the future? So one property of biometrics is that, um,
2349250	2355230	there, there are two unfortunate properties about biometrics. Uh, the first is they're biometrics,
2355230	2359890	uh, they're tied to you as an individual. You can't change them if they're compromised.
2360010	2364610	Uh, so if something happens to your biometric data and other people learn about what it is,
2364610	2374030	they, uh, they know it and you're stuck. Um, the, uh, and that means that effectively
2375850	2380130	supervised biometric authentication, you know, you go into the kiosk, there's a guard,
2380130	2386390	you put your fingerprint on a reader, might be okay. Um, under, you know, because they know
2386390	2392490	that you're not bringing some equipment in to fake what the fingerprint is. But unsupervised
2392490	2398530	biometric authentication, I'm using my phone, it reads my biometric and sends that data somewhere
2398530	2404850	is something that's always going to be subject to compromise, uh, in that way. So biometrics,
2404850	2410290	you know, solve some problems for in-person authentication that work very poorly, uh,
2410290	2423090	in the online context. I think another issue that, that isn't really considered is the fact that,
2423090	2429210	you know, for instance, if Bia was going to vote and with her cell phone and she's asleep,
2429210	2435010	I can just pick up her cell phone, unlock it with her face and vote on it. Or, um, you know,
2435010	2440930	Bob over there wants me to vote for Pinkie Pie. So he gives me a thousand dollars to go vote for
2440930	2444930	Pinkie Pie, which, you know, we still have that problem in our regular elections. And those are
2444930	2452610	small, small little votes, but there's no privacy. You know, if, if you have a partner that's very
2452610	2457610	controlling and they're trying to force you to vote for somebody, when you walk into that voting
2457610	2463910	booth by yourself and you close that curtain, you can vote for whoever you want. You lose that a
2463910	2469910	hundred percent when you do online voting and vote by phone or any of this. Great for American Idol,
2469910	2484040	not great for elections. That was not a question. Any other questions?
2484040	2488060	Hi, so I have a general question about remote voting, which is not electronical,
2488060	2492800	such as postal voting, which is used in many countries to support, for example, disabled voters
2492800	2498780	or voters who are otherwise unable to go to the polling station. And postal voting has many risks
2498780	2503440	of the kind that you mentioned, such as the risk of coercion or the risk of not knowing that the
2503440	2508700	ballot that arrived was actually marked by a legitimate voter. So given all this, what kind
2508700	2516780	of secure enough options would you recommend for remote voting? So, I mean, one of the, you know,
2516780	2523620	one property of this is it's important not to confuse online voting with the general problem
2523620	2531320	of remote voting. Remote voting exists everywhere in the United States, at least as a special case
2531320	2539520	for absentee ballots, you know, people who can't travel and so on. It's generally done on paper and
2539520	2549580	by mail. That has some of the same problems as online voting, but not all of them. So it leaves
2549580	2556560	us with the one-on-one coercion problem, right, that if you're sent a paper ballot, it is possible
2556560	2564040	you could be coerced by a partner or an employer to vote in a particular way, but that has to be
2564040	2573980	done on a retail level, ballot by ballot. In an online voting system, that same type of
2573980	2581800	compromise can be done centrally. A piece of malware that's spread via phishing or any of the
2581800	2591800	other ways that malware spreads can be used to wholesale compromise many, many different ballots.
2591800	2598100	So my suggestion is that to accommodate voters who can't travel, we stick to the paper-by-mail
2598100	2607180	method and not introduce methods that also add the wholesale fraud and wholesale abuse
2607940	2616700	vector. But even, you know, even by-mail voting does compromise some of the properties of the
2616700	2623260	secret ballot, and we have to be very careful when we scale that up. I'll just add that
2623940	2629800	there are solutions that have been implemented. So when the Military and Overseas Voter Empowerment
2629800	2635600	Act was passed, it required that all counties or states send ballots to military and overseas
2635600	2641700	voters 45 days before the election. It also stipulated that they had to make the option
2641700	2647820	available to send the blank ballot electronically. Blank ballots can be sent with reasonable,
2647820	2652400	acceptable security electronically because they don't have the vote. They don't have the secret
2652400	2657120	value piece of data on them. Everybody knows what's going to be on the blank ballot.
2657440	2663080	So you get your blank ballot in 45 days and then still have 45 days. The military have access to
2663080	2669760	expedited free postal mail return that is provided to everyone, you know, in the military. And
2669760	2674880	the, what we see, as I mentioned, you know, there's 32 states that currently allow
2674880	2681200	electronic ballot return, 28 that do not. There, I'm sorry, 18 that do not. There are several
2681200	2685940	states that don't allow electronic ballot return that have higher rates of participation for
2685940	2692240	military and overseas voters because they have other, they have robust communications in place.
2692240	2697000	They're making sure that they get the information to those voters. So I don't think that we can
2697000	2700740	make a correlation that electronic ballot return is going to increase participation for those
2700740	2711320	voters based on that information. Any other? Hi. I have a couple. David, what is your last name?
2711920	2715360	Jefferson. Jefferson. Oh, I don't need any spelling on that one. Okay. Just like the
2715360	2721340	county. Got it. Just like the county, right. Yeah. And the name of your organization again is?
2721340	2726980	Free Speech for People. Free Speech for, I'm surprised I haven't heard from you. Free
2728100	2733060	Speech for People. So military ballots and voting is always kind of interesting on all the campaigns
2733060	2738060	I've worked on. And generally each county is autonomous in how they vote and yet you're
2738060	2742060	talking about military and state. So I'm really a novice. I really don't know what I'm doing on
2742060	2745980	this one. So you're saying the states have better things in place. So how does that work with the
2745980	2754400	counties being autonomous in how they do their voting? So it actually depends state by state
2754400	2761600	because some states have, some states run their UOCAVA outreach to those voters or military and
2761600	2766620	overseas. The outreach to those people at the state level and some places do it at the county level,
2766620	2772140	meaning that the county officials have to email the ballot or send the ballot to the people or
2772140	2777460	some places they do it from the state level. So it really depends on the state. Yeah, you have to go
2777460	2791280	state by state. Any other questions? Trying to minimize the feedback. So I don't really have a
2791280	2799100	question. I have a comment. I think it's important for people to be careful not to generalize
2799100	2805220	your personal experience of voting and think that's how it is throughout the United States.
2805220	2810560	It's easy to make blanket statements that don't apply. So for instance with respect to voting by
2810560	2817580	mail, if you live in the state of Georgia, the only way to be able to do a hand marked paper ballot
2818160	2825980	is if you vote by mail. The only way to have ballot secrecy is if you vote by mail. Because
2825980	2832200	if we go into a precinct, we have ballot marking devices that are huge, they're upright, they're lit
2832200	2839200	up and anyone can see how you're voting. So if you want ballot secrecy and hand marked paper ballots
2839200	2845640	in the state of Georgia, you have to be able to vote by mail. And the other thing to be aware of
2845640	2853860	in the state of Georgia is that the Secretary of State controls all counties. So we're required to
2853860	2860340	do everything the same way throughout the entire state. It's not county by county decisions. So I
2860340	2866080	just want to caution people, don't generalize based on your own experience because across the United
2866080	2871600	States, there are very different circumstances. Any other questions?
2873320	2876460	Going once, going twice.
2877740	2881140	All right, well thank you everybody and please help me. Thank you all.