[00:10.260 --> 00:17.000]  Can everyone hear me? Oh, wow, it works. Hi, everybody. I'm Susan Greenhall. I'm the Senior
[00:17.000 --> 00:21.220]  Advisor for Election Security at Free Speech for People. We are a national, nonpartisan,
[00:21.220 --> 00:25.120]  not-for-profit legal advocacy organization that works to...
[00:25.120 --> 00:29.500]  Susan, stay sitting down. Don't go in front of the speaker.
[00:31.640 --> 00:36.740]  ...that works to protect elections and democracy.
[00:37.260 --> 00:39.420]  No, no, please don't touch anything back there.
[00:39.760 --> 00:48.520]  Thank you. For all the people, we have a part of that program which focuses on election security.
[00:48.600 --> 00:53.700]  And I've done a lot of work on internet voting for over 15 years, studying the policies
[00:54.170 --> 01:00.820]  and practices, written several reports on it. And I'm here to talk about this issue
[01:00.820 --> 01:05.540]  with our esteemed panel. First, starting with David Jefferson, Dr. David Jefferson,
[01:05.540 --> 01:12.420]  who is a researcher from Lawrence Livermore Laboratories, retired. In 1999 to 2000, he was
[01:12.420 --> 01:17.660]  the co-chair of the California Secretary of State's Task Force on Internet Voting. He'll
[01:17.660 --> 01:32.060]  talk a little bit more about that. He was also the... He was one of the co-authors of the peer
[01:32.060 --> 01:38.320]  review that was done on the Department of Defense's CERV internet voting system in 2004,
[01:38.320 --> 01:45.880]  which ultimately resulted in the Department of Defense canceling the project. And he can talk a
[01:45.880 --> 01:52.780]  little bit about that. It was a $22 million project that was ultimately shut down. And he's been
[01:52.780 --> 01:59.220]  writing, speaking, and testifying in opposition to internet voting ever since. So that's David.
[01:59.220 --> 02:05.540]  Next, we have Matt Blaze, professor at Georgetown University School of Computer
[02:05.540 --> 02:10.180]  Science and Law. He is also co-founder of The Village. And he's
[02:12.820 --> 02:18.300]  been working in election security for two decades, especially interested in the impact of complex
[02:18.300 --> 02:24.020]  software systems on security and reliability. And Hari Hirstie, also co-founder of the
[02:24.020 --> 02:31.320]  DEF CON Voting Village. He is the OG in election security reviews,
[02:31.320 --> 02:38.520]  famously conducting the Hirstie hack back in the 2000s. He also was part of a team that reviewed
[02:38.520 --> 02:44.120]  the Estonian online voting system for security and traveled to Estonia to present the findings
[02:44.120 --> 02:48.800]  to people there. So we have an incredible panel. And I will turn it over to David.
[02:52.420 --> 02:58.800]  David, are we using slides? No, I'm just... my notes. Yeah, I'm coming over here to avoid
[02:58.800 --> 03:06.620]  the feedback and because I have my notes on my laptop, so... and I hope you can hear me.
[03:07.500 --> 03:13.240]  And then I need my glasses. Okay.
[03:13.240 --> 03:21.540]  All right. So first let me give you a summary up front of where I'm coming from, which is
[03:22.120 --> 03:28.160]  that it isn't possible now or in the foreseeable future with any combination of technologies that
[03:28.160 --> 03:35.540]  we can envision today to secure an online voting system. And thus, we shouldn't be instituting
[03:35.540 --> 03:41.560]  internet voting anywhere in the U.S. and we should really stop using it where it's in use today.
[03:41.560 --> 03:46.740]  Voting, of course, is a national security issue and the legitimacy of democratic government depends
[03:46.740 --> 03:57.240]  on voting being secure and open. So we really... we cannot open our voting systems to the various
[03:57.240 --> 04:03.380]  kinds of threats I'm about to describe to you, some of which... many of which are... would open
[04:03.380 --> 04:10.200]  our elections to manipulation by foreign actors. So let me talk about what internet voting is,
[04:10.200 --> 04:17.720]  first of all. What we mean by that is any voting system in which voted ballots are transmitted
[04:17.720 --> 04:22.720]  over the internet. Maybe one hop of the communication is just over the internet,
[04:22.720 --> 04:26.500]  but if it's... if voted ballots are ever transmitted over the internet in the course of
[04:26.500 --> 04:31.900]  running an election, it's an internet voting system. It doesn't matter whether it's by email
[04:31.900 --> 04:38.560]  or fax or web or mobile app, any scheme, doesn't matter what the protocol is, if it's transmitted
[04:38.560 --> 04:42.620]  over the internet, it's going to be vulnerable to the kinds of threats I'm about to describe.
[04:43.760 --> 04:47.580]  So let's talk about those threats. What are the threats that we're talking about?
[04:48.120 --> 04:54.200]  There are many of them. The first one is authentication-related threats. When you...
[04:54.200 --> 04:59.540]  when you vote online, of course, you have to identify yourself so that you can be checked
[04:59.540 --> 05:06.000]  that you're registered and that you are... you haven't already voted, and so you have to actually
[05:06.000 --> 05:12.180]  identify yourself. There are... that will have to be done online also, and an attacker can mess
[05:12.180 --> 05:16.940]  with that system so that it makes it too difficult for people to authenticate themselves and they get
[05:17.620 --> 05:22.600]  disenfranchised, or too easy for people to authenticate themselves, and phony voters can
[05:23.200 --> 05:30.700]  can vote. So authentication threats, number one. Number two, and perhaps the most insidious, is
[05:30.700 --> 05:37.540]  client-side malware. You're going to be voting from some device, a phone or a PC or other mobile
[05:37.540 --> 05:44.660]  device, and that device might be infected with malware, and that malware might have the purpose
[05:44.660 --> 05:51.180]  of interfering with your voting, either preventing you from voting or modifying your votes before your
[05:51.180 --> 05:56.060]  votes are even... even get out of the device, before they're encrypted for transmission, your votes can
[05:56.060 --> 06:00.160]  be modified. You wouldn't know if the election officials wouldn't know it. That's a profound
[06:00.160 --> 06:06.140]  problem, the client malware problem. The third problem, the third kind of attack, would be network
[06:06.140 --> 06:12.380]  attacks, attacking routers or DNS or other parts of the internet infrastructure, where even if your
[06:12.380 --> 06:17.860]  ballots are transmitted in progress, they can still be stopped or redirected or otherwise
[06:17.860 --> 06:27.840]  interfered with. There are spoofing attacks, where you are tricked into voting on...
[06:28.860 --> 06:33.960]  to an incorrect site, a site which may look like the real site, but which you are...
[06:36.180 --> 06:40.760]  which is not, and you think you voted, but you didn't, and you don't know whether
[06:40.760 --> 06:46.640]  your vote was transmitted or modified or just thrown away. There are denial-of-service attacks,
[06:46.640 --> 06:53.460]  where the server that receives votes is overwhelmed with a lot of fake ballots sent
[06:53.460 --> 06:59.840]  to it by an attacker. It's so overwhelmed that the service slows down. It may slow down
[07:00.380 --> 07:05.080]  to the point where voters get timeouts and they can't vote at all, or the system,
[07:05.080 --> 07:12.600]  the server just crashes. There are server penetration attacks, where an attacker actually
[07:12.600 --> 07:17.960]  gains control remotely of the servers that's accepting the ballots, and when he gains control,
[07:17.960 --> 07:25.560]  he can do anything he wants. Many of these attacks can be insider-aided, but insiders
[07:25.560 --> 07:30.920]  would include election officials and programmers and so on, and there are many variations of all
[07:30.920 --> 07:38.240]  of these attacks. Now, there are no strong defenses to most of these attacks. There just
[07:38.240 --> 07:45.760]  are no strong defenses. There are ameliorations, there are ways of handling certain special cases
[07:45.760 --> 07:50.360]  of these attacks, but they're not general solutions with technologies that we have today.
[07:50.740 --> 07:55.000]  And they rest on some profound problems in computer science, which Matt is going to tell
[07:55.000 --> 08:05.180]  you about in the next talk. These are the same threats that we encountered 25 years ago when I
[08:05.180 --> 08:11.000]  was the chair of the California Secretary of State's Internet Voting Task Force, and they're
[08:11.000 --> 08:17.660]  why we recommended that California not institute internet voting in 1999. These threats haven't
[08:17.660 --> 08:22.980]  really changed material in the last 25 years, and they may not change materially in the next 25
[08:22.980 --> 08:31.960]  years. They are that intractable. Now, the problem is that all of these attacks that I mentioned can
[08:31.960 --> 08:38.540]  be automated and scaled up to massive scale, depending upon technical details of the architecture
[08:38.540 --> 08:44.260]  of the voting system. The attacks can come from anywhere on earth, including rival nation-states
[08:44.260 --> 08:51.700]  or our own domestic partisans. Successful attacks may go completely undetected, but if they are
[08:51.700 --> 08:57.040]  detected, they may be completely uncorrectable without running the election over again.
[08:57.300 --> 09:02.520]  The perpetrators of the attack may never be identified, but even if they are identified,
[09:02.520 --> 09:09.840]  they are likely to be out of reach of U.S. law, as the 12 Russians who are under indictment for
[09:09.840 --> 09:17.180]  interfering with the 2020 election are out of reach of U.S. law. So the problems with internet
[09:17.180 --> 09:25.140]  voting are profound. And I'm going to now turn it over to Matt, so he can talk more about that
[09:25.140 --> 09:38.510]  subject. Thank you. So thanks, David. So I just want to expand on some of the stuff that David
[09:38.510 --> 09:47.730]  was talking about. He mentioned fundamental problems. And as a scientist or as an engineer,
[09:47.730 --> 09:55.790]  when somebody says, oh, that's a theoretical problem, we understand it to be different from
[09:55.790 --> 10:02.790]  when the general public uses the term theoretical problem. A theoretical problem in normal life is
[10:02.790 --> 10:06.910]  one you don't really have to worry about. A theoretical problem in science and engineering
[10:06.910 --> 10:12.990]  is the worst possible kind, right? It's the kind that is fundamental to the system,
[10:12.990 --> 10:17.050]  that it's something that you cannot do anything about without either changing the assumptions
[10:17.050 --> 10:25.010]  or compromising on what the requirements are. And there are two sets of fundamental problems.
[10:25.010 --> 10:29.810]  The first set of fundamental problems are computing problems, computer science problems.
[10:29.810 --> 10:39.990]  And all of the problems in voting, in building a secure voting system that we encounter from an
[10:39.990 --> 10:45.770]  engineering point of view, are problems that actually were around before voting was an
[10:45.770 --> 10:51.910]  application people were even considering. There is a fundamental theorem in computer science
[10:52.810 --> 10:59.150]  that essentially says it is impossible to compare a program with its specification
[10:59.690 --> 11:06.490]  and understand whether it meets it. And this is not a problem that we simply haven't worked
[11:06.490 --> 11:13.030]  hard enough to try to solve. It's a problem that we know that we cannot solve. We will never be
[11:13.030 --> 11:21.090]  able to solve it. And the implication of that is that general purpose complex software can never
[11:21.090 --> 11:29.350]  be assured to be completely correct. Now, that mostly doesn't bother us for all sorts of
[11:29.350 --> 11:36.770]  applications of computing that we rely on for many things. In fact, the title of this panel,
[11:36.770 --> 11:42.710]  I can bank online, why can't I vote online, is an example of that. We rely on the same
[11:42.710 --> 11:49.850]  flawed computing systems for things like banking. So why is it we're able to get away with it? And
[11:49.850 --> 11:56.930]  the short answer is we don't. Bank fraud is enormously common. Banks are robbed online
[11:56.930 --> 12:03.950]  all the time. There is identity theft and so on constantly. The difference is a second set
[12:03.950 --> 12:11.170]  of fundamental problems, which is the voting application itself has a set of incredibly
[12:11.170 --> 12:19.390]  stringent and in fact somewhat contradictory requirements for building a voting system.
[12:19.390 --> 12:27.950]  One of them is that your vote must be anonymous. And it must be anonymous to the point where you
[12:27.950 --> 12:34.570]  can't even voluntarily prove who you voted for. And that requirement exists to prevent people
[12:34.570 --> 12:40.590]  from being able to be coerced into voting a particular way or being able to sell their vote.
[12:40.590 --> 12:47.710]  And there's a long history, even in the United States prior to that requirement existing,
[12:47.710 --> 12:56.150]  of people having their franchise coerced away from them because it's possible to tell how
[12:56.150 --> 13:02.150]  someone voted. Banking transactions don't have that requirement. A banking transaction is
[13:02.150 --> 13:08.250]  reversible. If money disappears from your bank account, it's possible to be made whole again.
[13:08.250 --> 13:15.070]  But if your vote is changed after it's been cast, we don't know whose it was. And you have no way
[13:15.070 --> 13:23.550]  as a voter of proving how your particular vote was cast in order to be able to correct that.
[13:23.550 --> 13:29.710]  And if that changed, you'd be able to prove how you voted. So we have these two sets of
[13:29.710 --> 13:34.930]  fundamental problems clashing with each other. The first is we don't know how to build systems
[13:34.930 --> 13:43.510]  that are reliable enough to avoid problems like this. And the second is voting requires us to
[13:43.510 --> 13:50.650]  build systems that avoid problems like this rather than correct them after the fact. And this,
[13:50.650 --> 13:57.110]  combined with the fact that an online voting system requires using complex computer technology,
[13:57.110 --> 14:03.710]  means that this is a problem that we won't be able to solve, no matter how hard we work at it.
[14:03.710 --> 14:10.350]  It's not that we're just not very smart. It's that these problems are beyond human capacity.
[14:10.870 --> 14:18.670]  So where does that leave us? Where that leaves us is we have to recognize that online voting is
[14:18.670 --> 14:29.210]  intrinsically very risky. That it will lead to elections that we will never be able to
[14:29.210 --> 14:38.410]  satisfactorily show were conducted without fraud, without hacking, and that the outcome is genuinely
[14:38.410 --> 14:45.810]  true. And that will always be with us when we do it that way, unless we relax some very important
[14:45.810 --> 14:52.550]  requirements of voting systems. So, by the way, I'm not the only one saying this. There was a report
[14:52.550 --> 15:00.290]  from the National Academy of Sciences called Securing the Vote, where the top experts in the
[15:00.290 --> 15:04.650]  field got together and produced what's called a consensus report. It essentially makes a very
[15:04.650 --> 15:11.570]  strong statement, you know, this is something we do not know how to do. And, you know, recommends
[15:11.570 --> 15:20.070]  against it wholesale. So, you know, those who propose online voting systems are essentially
[15:20.070 --> 15:28.770]  proposing something that the consensus of scientists is impossible. So we should understand
[15:28.770 --> 15:31.790]  it in that context. So, thanks.
[15:40.660 --> 15:49.540]  So, internet voting is a vacuum. It keeps on coming back. And the argument is very often say, well, we have this
[15:49.540 --> 15:56.020]  excuse. Can we do just a little bit of internet voting? There's two reasons why that's not a good
[15:56.020 --> 16:04.900]  idea. First of all, all the votes are one pool. The idea that I can vote insecurely myself
[16:05.620 --> 16:12.500]  wouldn't disfranchise the other voters is logical fallacy. Because if there's only one result, and
[16:12.500 --> 16:20.940]  if I'm choosing to make my own vote insecure, I'm also making everybody else's vote vulnerable.
[16:20.940 --> 16:26.980]  But there's even more profound reason. A lot of nations, including United States, and a lot of
[16:26.980 --> 16:31.400]  states in the United States, but other nations, have the same principle that all voters should
[16:31.400 --> 16:38.020]  be voting with the same method. So once you are enabling the door that let's have a little bit
[16:38.020 --> 16:42.740]  of internet voting, the next step is to say, now everybody has to vote with internet voting
[16:42.740 --> 16:49.880]  because we cannot have separate methods. The common ways we are hearing always to
[16:51.000 --> 16:56.580]  give an excuse, what are the special groups who need to vote the internet? And one of these are
[16:56.580 --> 17:01.620]  in America, it's called the UOCAVA voters, Unified Overseas Voters Empowerment Act.
[17:01.640 --> 17:06.720]  So they are mainly the boys and girls in the military, who have a problem of getting the
[17:06.720 --> 17:14.560]  ballots done on time. However, this same problem is everywhere else in the world. And the other
[17:14.560 --> 17:21.540]  part is why UOCAVA is, or military voters in general, are a very good target for saying,
[17:21.540 --> 17:26.920]  let's do internet voting, because in a lot of nations, military voters are not guaranteed to
[17:26.920 --> 17:33.820]  have secret ballots. It's a best effort basis only. So military voters don't enjoy the same
[17:33.820 --> 17:39.780]  legal protections as general public, and that also enables you to have a little bit more relaxed
[17:39.780 --> 17:45.940]  voting system, because you don't have to guarantee a secret ballot. Another group is, and very powerful
[17:45.940 --> 17:51.740]  lobbying groups, is disabled voters, and especially print disabled voters, so people who cannot read,
[17:51.740 --> 17:58.860]  cannot write, cannot hold a pen in their hand. There are a lot of devices, for example ballot
[17:58.860 --> 18:04.580]  marking devices, which are designed to access, but the idea is, okay, well let's do that at home.
[18:05.100 --> 18:13.600]  Again, this is leading, this whole path leads to a dual language, where a constantly the attempt is
[18:13.600 --> 18:19.780]  to call the voting to be not internet voting, but instead of calling it to be electronic return of
[18:19.780 --> 18:26.520]  your ballot. It's the same thing, but the idea is, this is the way we sell the idea, without a
[18:27.300 --> 18:33.540]  getting into the trap or informing people that this is the bad idea. Again, internet voting.
[18:34.720 --> 18:43.600]  Internet voting has been claimed to be successful in Estonia. I went to Estonia with Professor
[18:43.600 --> 18:49.940]  Arthur Haldeman and a couple of other folks. We took a look into the system, and it was a
[18:49.940 --> 18:55.500]  fairly decent high school project. That was the quality of the code. However, there was a lot of
[18:55.500 --> 19:01.000]  interesting things in operational side. For example, they rented the servers every year
[19:01.000 --> 19:06.700]  separately. So from a supply chain point of view, this one agency is renting three computers.
[19:07.660 --> 19:13.880]  That's your target. The lowest bidder, and you can poison all you want. There were a lot of
[19:13.880 --> 19:21.360]  designs in that area. For example, they published a video where a code is signed cryptographically,
[19:21.360 --> 19:26.540]  so that the voters will know this is an honest code. And they claim that this computer,
[19:26.540 --> 19:31.420]  where the video is taken, has never been connected to internet. But it had a microtorrent,
[19:31.420 --> 19:38.440]  and pirated movies, and pirated films, and online poker on the screen. So slightly
[19:38.440 --> 19:46.960]  suspicious that it might have been in internet. In Finland, we tried internet voting, or online
[19:46.960 --> 19:52.300]  voting. It was kiosk voting, but a system which can be used for internet voting too,
[19:52.300 --> 19:58.180]  in three counties. And it was demonstrated that three and a half percent of the votes were lost,
[19:58.180 --> 20:02.380]  and hence the vote, the election had to be reconducted. Because three and a half percent
[20:02.380 --> 20:07.740]  in a, what you call Jefferson counting method, means that it's absolutely certain that the last
[20:07.740 --> 20:16.020]  candidates in the city council will be awarded to the wrong people. The common excuse also is
[20:16.020 --> 20:23.560]  to claim that we need internet voting to activate young voters. Young people like mobile phones.
[20:24.480 --> 20:29.280]  Estonia is a brilliant country from the point of view that they publish at age brackets. And
[20:29.280 --> 20:36.800]  when you look in Estonia, you see that the fastest growing group of voters online is over 65. And the
[20:36.800 --> 20:43.340]  young voters are rejecting the idea of internet voting. The same was in Norway. So the actual
[20:43.340 --> 20:49.940]  government public data doesn't support the common wisdom that young voters would be activated by
[20:49.940 --> 20:58.060]  using internet voting. Last but not least, I want to touch a very big topic in, for example, Europe
[20:58.060 --> 21:08.160]  and Germany. A lot of old democracies have a rule that common person has to understand how votes
[21:08.160 --> 21:14.460]  are counted and have to be able to verify the vote counting process with no special tools and
[21:14.460 --> 21:21.000]  education. Common man's common knowledge has to be enough. Now we are proposing very complex ideas
[21:21.000 --> 21:29.820]  like homomorphic encryption, blockchain. The joke in the U.S. is that average age of poll worker is
[21:29.820 --> 21:34.360]  one year older every year because we don't have enough young people coming to be a poll worker.
[21:34.360 --> 21:43.280]  But until we live in a Star Trek universe where teenagers are casually talking about
[21:43.280 --> 21:49.000]  quantum mechanics, who is going to be explaining to a 70-year-old normal person how homomorphic
[21:49.000 --> 21:55.700]  encryption works? And in today's world, why anyone, why you believe that you could be ever getting
[21:55.700 --> 22:01.080]  normal people to accept the idea that this is so complex idea that even most of the experts don't
[22:01.080 --> 22:20.680]  know how it works. So let's keep it simple. Thank you. Okay. So after hearing all of that,
[22:20.680 --> 22:26.380]  I'm guessing everyone probably think who would ever want to do internet voting for public
[22:26.380 --> 22:32.960]  governmental elections. But unfortunately, right now, 32 states permit some subset of voters to
[22:32.960 --> 22:41.080]  vote online either by email, fax, or some sort of online portal. And there's a lot of ballots coming
[22:41.080 --> 22:47.000]  back online. In the 2020 election, there were over 300,000 ballots cast online. And in some states
[22:47.000 --> 22:51.480]  with small margins, there were a significant number of ballots cast online. And this is a problem
[22:51.480 --> 22:57.040]  because those ballots we know are not secure and they can't be audited. So I want to talk a little
[22:57.040 --> 23:02.300]  bit about the policy and the history of how we got here and how it's playing out today to understand
[23:02.980 --> 23:12.260]  our situation. So as I mentioned in the intro, back in 2004, David was part of a security study
[23:12.260 --> 23:17.740]  that examined the system that was being put together by the Department of Defense to military
[23:17.740 --> 23:22.640]  and overseas voters to vote online. This was something that was tasked by Congress, Congress
[23:22.640 --> 23:30.280]  tasked them to do this. And they built a system, had a peer review of the security. The peer review
[23:30.280 --> 23:35.900]  said this is not secure. You cannot ensure the legitimacy of ballots cast online. So the project
[23:35.900 --> 23:40.520]  was scrapped. Congress turned around and said, okay, we'll have NIST, National Institute of
[23:40.520 --> 23:45.520]  Standards and Technology, develop standards for a secure online voting system. And then we'll have
[23:45.520 --> 23:50.680]  the Department of Defense build to those standards. So NIST spent the later part of the 2000s and
[23:50.680 --> 23:56.780]  early 2010s studying the problem, writing several reports. And they came to the conclusion that the
[23:56.780 --> 24:03.060]  all come to, that there's this broad scientific consensus, that these problems are really not
[24:03.060 --> 24:07.780]  solvable with the security tools that we have today. And they wrote a statement saying,
[24:07.780 --> 24:12.160]  we don't know how to write security standards because we don't know how to do internet voting
[24:12.160 --> 24:19.500]  securely. It's not yet feasible. So we're not doing it. So Congress said, okay, a couple years later,
[24:19.500 --> 24:25.300]  because Congress moved slowly between 2014 and 2015, Congress repealed the directive to the
[24:25.300 --> 24:29.540]  Department of Defense to build an online voting system, essentially taking the federal government
[24:29.540 --> 24:33.560]  out of it. We often hear, why isn't the federal government studying it? The answer is they already
[24:33.560 --> 24:40.360]  did, asked and answered. So in the subsequent years, we've seen more reports come out in 2018.
[24:40.360 --> 24:45.720]  The National Academy study came out that Matt mentioned. There's been numerous academic studies.
[24:45.880 --> 24:49.880]  There's been some states have done their own studies. Time and again, when the computer
[24:49.880 --> 24:55.220]  scientists and the security experts look at the problems, they realize that voting is not something
[24:55.220 --> 25:02.000]  that you can apply today's security tools to in a sufficient way to secure it. So we've never
[25:02.000 --> 25:06.540]  come up with anyone that says, here, this is a secure way to do it from a scientific perspective.
[25:06.680 --> 25:12.920]  Yet, in that early 2000s period of time, and even the late 90s, there was a reasonable expectation
[25:12.920 --> 25:17.120]  that we were going to have a secure online voting system from the Department of Defense.
[25:17.120 --> 25:23.940]  So states passed laws to allow electronic ballot return. By 2010, I think there were 29 or 30
[25:23.940 --> 25:31.020]  states already had electronic ballot return laws in place. So that was before NIST came up with
[25:31.020 --> 25:37.220]  their statement saying we can't write security standards for this. And before the bulk of
[25:37.220 --> 25:46.980]  the scientific research that's so conclusive had come out. So in the mid-2010s, we'd seen
[25:46.980 --> 25:53.220]  kind of a slowdown in the movement for online voting. But now we're in the middle of an aggressive
[25:53.220 --> 25:58.120]  push once again to have people vote online. And that's coming mainly from two places.
[25:58.120 --> 26:03.860]  First, there's a guy named Bradley Tusk, who is an Uber multimillionaire, made a bunch of money
[26:03.860 --> 26:09.140]  for Uber, and he helped change their policies. He's not a tech guy, he's a policy guy. And he
[26:09.140 --> 26:16.820]  helped change state laws to allow Uber rideshare policies around the country. He also was responsible
[26:16.820 --> 26:21.400]  for changing state laws to allow sports betting on the FanDuel app. So he knows what he's doing
[26:21.400 --> 26:27.280]  as far as changing state laws. And he's decided that he's going to save American democracy by
[26:27.280 --> 26:33.200]  getting everybody to vote on their phones by 2028. He said that on his podcast. He has also
[26:33.200 --> 26:38.400]  said that he will do anything unethical short of committing a crime to get everyone voting
[26:38.400 --> 26:44.680]  on their phone. So he's hired lobbyists, he's got public relations people, and he's introducing
[26:44.680 --> 26:51.460]  bills in different states around the country to allow people to vote online, starting with
[26:51.460 --> 26:56.620]  subsets of military and overseas voters for states that don't already have it, and then to expand it
[26:56.620 --> 27:03.160]  to voters with disabilities, to expand it to voters with... to first responders who may be displaced,
[27:03.160 --> 27:08.260]  and then ultimately with the goal of getting everybody to vote online. Now, the problem is...
[27:08.260 --> 27:13.780]  oh, and one of the most definitive studies, or scientific studies that we saw, or I shouldn't
[27:13.780 --> 27:18.080]  call it a study, it was a risk assessment that came from the Department of Homeland Security,
[27:18.080 --> 27:27.600]  CISA, FBI, NIST, and EAC in 2020, which warned states, you don't probably want to do this,
[27:27.600 --> 27:33.120]  because those ballots will be high risk of compromise, manipulation, deletion, or privacy
[27:33.120 --> 27:40.080]  violations. Any ballots cast online via any method, even with security tools in place. So
[27:40.800 --> 27:46.280]  even with this security, all this guidance coming from the federal agencies, those federal
[27:46.280 --> 27:53.720]  agencies can't go into the states and lobby. They put out their risk assessment, hope the states
[27:53.720 --> 28:01.180]  look at it. Instead, it's left to organizations like our organization. We work with Verified Voting,
[28:01.180 --> 28:06.080]  with Brennan Center, with Public Citizen. These are all groups. We are very deeply committed to
[28:06.080 --> 28:10.860]  ensuring access for all voters. My organization actually takes legal actions to ensure people's
[28:10.860 --> 28:15.460]  access to the ballot. But we want to also protect that ballot and make sure that the election is
[28:15.460 --> 28:21.780]  secure. So that's why we are going in and raising these security concerns in the state legislatures
[28:21.780 --> 28:27.360]  and trying to keep states from introducing more bills to spread online voting. In the last year
[28:27.360 --> 28:35.100]  and a half, we saw bills introduced in California, Washington, Maryland, Wisconsin, Michigan,
[28:35.100 --> 28:44.740]  Illinois, Georgia, New York, New Jersey, and Washington, D.C. So we have that. That's one
[28:44.740 --> 28:49.380]  aspect of the push for online voting. There's another aspect that comes from the vendors,
[28:49.380 --> 28:54.720]  because this is an industry that is not regulated at all. The systems that are being sold
[28:54.720 --> 29:01.340]  commercially don't undergo any sort of public testing that anyone else can review. The vendors
[29:01.340 --> 29:08.680]  make claims of security or claims about the way the system operates that are unfounded, baseless.
[29:08.680 --> 29:14.600]  Actually, our organization has written letters to attorneys general arguing that these could
[29:14.600 --> 29:21.180]  constitute false claims and deceptive marketing and could be actionable in asking for investigations.
[29:21.400 --> 29:30.500]  But there's nothing to counter it other than us bringing up the other side of it.
[29:30.500 --> 29:36.960]  The vendors are also lobbying in state legislatures and promising state lawmakers that
[29:36.960 --> 29:45.280]  these systems can be secured. And that's another aspect of it. So this is an ongoing problem that
[29:45.280 --> 29:50.380]  we're going to continue to see because of these two forces pushing online voting at a time when
[29:50.380 --> 29:55.960]  we really need to have auditable systems, transparent systems, secure systems that we
[29:55.960 --> 30:00.140]  can ensure that all people can have confidence in the results of an election
[30:00.880 --> 30:06.400]  and not expand an unsecure system that we know is insecure.
[30:07.440 --> 30:11.900]  Internet voting has been glibly referred to as the Theranos of voting. And I think that's
[30:11.900 --> 30:18.080]  actually a very apt analogy. Because I don't know if you're familiar with the Theranos story.
[30:18.080 --> 30:25.120]  Theranos is the blood company that was founded that went to a billion dollars and they were
[30:25.120 --> 30:29.320]  going to take a tiny pinprick of blood and be able to run a complete screen of every test that
[30:29.320 --> 30:34.460]  you could ever possibly need and know your entire health history. And it would be cheap and everyone
[30:34.460 --> 30:39.300]  would be able to do it at CVS or Walgreens. And it was a great idea. Who doesn't want that?
[30:39.300 --> 30:44.080]  But the problem is the science didn't let you do it. You needed more blood to be able to run
[30:44.080 --> 30:51.080]  certain tests. The blood needed to be centrifuged and separate out the cells and reagents put in
[30:51.080 --> 30:56.000]  there. You can't do it all. But the idea is so great. Everybody wants to do it. Yes, it would
[30:56.000 --> 31:01.440]  be really great if we could all vote on our phones. But the science isn't there. So I'm
[31:01.440 --> 31:10.000]  going to wrap with that. And we're going to go to questions after. And I guess we lost Hari.
[31:10.080 --> 31:14.580]  But I'm going to, as the moderator, I'm going to take prerogative and ask the first question of
[31:14.580 --> 31:22.100]  David. So when I was talking, I was speaking about the importance of auditing elections,
[31:22.100 --> 31:27.960]  especially everyone should have confidence. We don't want to just, you know, trust elections.
[31:27.960 --> 31:34.900]  We want to verify elections. So how can you audit an online voting, an online system,
[31:34.900 --> 31:39.260]  or can you audit an online voting system? So when you voted a precinct, or if you,
[31:39.260 --> 31:43.280]  if you mail in a ballot, I'm going to step over here to get out of the feedback.
[31:46.000 --> 31:50.500]  You, you have, well, that's not working.
[31:51.560 --> 31:58.420]  You, you hand mark the ballot, and there is no question that the ballot actually reflects the
[31:58.420 --> 32:04.300]  voter's intent. When you vote online from your phone, and sorry, and that ballot, that hand
[32:04.300 --> 32:11.500]  marked ballot becomes a contemporaneous record of the voter intent. So that if those ballots
[32:11.500 --> 32:17.960]  are later counted by machine and the, and the software in those machines is full of bugs and
[32:17.960 --> 32:24.900]  is full of, of malware. And so the counts are wrong as produced by machine. You can always
[32:24.900 --> 32:32.000]  go back. In fact, you should always go back to the original hand marked paper ballots and audit
[32:32.000 --> 32:38.020]  the machine results using an RLA or risk limiting audit, for example, as was discussed at a panel
[32:38.020 --> 32:45.040]  yesterday. And, and therefore you, you, you can determine that the machine counts were wrong and
[32:45.040 --> 32:50.640]  you can, you can correct the outcome of the election. Now with a, with any kind of online
[32:50.640 --> 32:57.140]  voting system, if you are voting from your phone or your personal computer, there is no indelible
[32:57.820 --> 33:03.160]  contemporaneous record of how the voter voted. I mean, what, what, what the voter's actual intent
[33:03.160 --> 33:10.840]  was, there is no record from which to audit the election. So it's really not possible to
[33:10.840 --> 33:15.820]  audit an online election. And that's just another reason why we shouldn't be doing it.
[33:17.000 --> 33:25.900]  And I'll just, oh, am I off? And I'll just add that one of the things we see the vendors say
[33:25.900 --> 33:31.460]  is that we produce a voter verified paper ballot. Our system isn't online voting. It is an internet
[33:31.460 --> 33:37.980]  voting. One of the, the CEOs of one of the vendors told a radio show that we don't use
[33:37.980 --> 33:41.880]  the term internet voting because it's a loaded term. We say electronic ballot return. So it's
[33:42.000 --> 33:47.960]  a little bit of this smoke and mirrors. And that they produce a voter verified paper ballot. Well,
[33:48.160 --> 33:51.880]  a lot of times the digital record is sent to the elections office and then it's printed there.
[33:51.880 --> 33:56.420]  But obviously that paper ballot has never been verified by the voter because the,
[33:56.420 --> 34:01.900]  the digital record was what was sent. But to say it's a voter verified paper ballot is,
[34:01.900 --> 34:08.120]  is highly misleading at best. So you don't have a voter verified paper ballot to audit the election.
[34:08.820 --> 34:13.500]  So are there any questions? Do you want to use the microphone?
[34:14.160 --> 34:20.760]  Oh, okay. I'll do that. You can talk in that.
[34:21.920 --> 34:27.540]  Um, so, uh, purely from a technical perspective, uh, you folks were talking about the kind of
[34:27.540 --> 34:32.560]  combating requirements of a secret ballot and a technically secure ballot. I vote for Mickey
[34:32.560 --> 34:36.740]  Mouse every year. I don't care who knows that. From a purely technical perspective,
[34:36.740 --> 34:41.820]  if you omit the requirement of secrecy, does online voting become much more viable?
[34:41.820 --> 34:47.920]  There are all sorts of things that, all sorts of problems get easier if you, um,
[34:47.920 --> 34:52.560]  reduce the requirements. And, you know, the requirement for a secret ballot isn't,
[34:52.560 --> 34:56.500]  doesn't exist just because a bunch of technologists said it should. The requirement
[34:56.500 --> 35:03.160]  for a secret ballot evolved over, you know, centuries of US law and centuries of experience
[35:03.160 --> 35:10.200]  with fraud in democracies based on coercing votes from people. We could, as a society,
[35:10.200 --> 35:17.100]  decide to eliminate the secret ballot, uh, and maybe we decide that we want to. But I think a
[35:17.100 --> 35:24.440]  poor reason to eliminate the secret ballot is simply to accommodate some future voting technology
[35:24.440 --> 35:30.380]  that finds it an inconvenient requirement. Um, so, you know, I think it's very important to,
[35:30.380 --> 35:35.560]  to understand here, these requirements didn't come from us. These requirements are not
[35:35.560 --> 35:41.080]  requirements that the technologists invented. These are requirements that society has decided
[35:41.080 --> 35:47.160]  are important properties for voting systems. And, uh, you know, we can discuss whether those
[35:47.160 --> 35:53.760]  requirements are good or not, but that discussion had nothing to do with technology. It's a, it's a
[35:54.400 --> 35:59.700]  democracy requirement. Um, you know, and again, there are many, you know, when I hear about
[35:59.700 --> 36:06.360]  internet voting, I find it helpful to substitute in my head perpetual motion machine, right? If we
[36:06.360 --> 36:12.300]  had perpetual motion machines, it would be great. It would solve our energy problems. Everybody agrees
[36:12.300 --> 36:19.860]  perpetual motion machines would be terrific. Unfortunately, a bunch of, you know, a bunch of
[36:19.860 --> 36:29.180]  killjoy physicists tell us that we'll never be able to have them. Now, if you believe the killjoy
[36:29.180 --> 36:36.640]  physicists, it would be a bad idea to create policy on the assumption that we're about to
[36:36.640 --> 36:43.680]  build a perpetual motion machine because we're really not. And internet voting has many, many
[36:43.680 --> 36:51.260]  of the same, uh, properties there. And I would like to add one thing before, before we go, uh, which is
[36:51.900 --> 36:57.980]  I want to praise the secret ballot requirement. The secrecy of the ballot is the, is the strongest
[36:57.980 --> 37:06.140]  defense by far we have against voter coercion, vote retaliation, and vote buying and selling.
[37:06.140 --> 37:12.300]  Without the secret ballot, our elections could be irredeemably corrupted by those effects.
[37:13.400 --> 37:19.200]  Thank you. Do we have a question? Yeah, I have more of a comment that I'd love to get our
[37:19.200 --> 37:25.960]  moderator's, uh, response on here. Um, what really worries me more than anything about online voting
[37:25.960 --> 37:32.740]  is much more lower tech actually, is that if it goes broad, large scale, it's subject to, uh,
[37:32.740 --> 37:38.340]  phishing attacks, right? You could, uh, have very large scale voter suppression with fake emails
[37:38.340 --> 37:43.480]  coming from secretaries of state, apparently, and you go and you lose your boat and maybe you get
[37:43.480 --> 37:49.980]  your identity theft too. Now, phishing campaigns can be just, you know, 19, 20% effective, effective.
[37:49.980 --> 37:57.660]  Targeted, they can be 70% effective. And who's going to get targeted in a voter suppression
[37:57.660 --> 38:06.360]  campaign? The same people who always get targeted, communities of color. So I think this whole issue
[38:06.360 --> 38:12.360]  very quickly becomes a racial justice issue, honestly. And that's, that's not even getting
[38:12.360 --> 38:19.830]  into the stuff you all have been talking about that I firmly agree with. I, I, my comment is I
[38:19.830 --> 38:25.930]  agree. I don't know. I don't have much more to add that was very well put. Um, any other?
[38:34.510 --> 38:39.750]  Hi there. So just a quick question regarding authentication and biometric data. So can your
[38:39.750 --> 38:45.130]  team speak to, um, the benefits of that? I know that the TSA, for example, is using biometric
[38:45.130 --> 38:50.590]  data for authentication purposes for international travel, comparing your photo to your passport
[38:50.590 --> 38:55.010]  photo to your face while you check in. Um, obviously having biometric data stored by the
[38:55.010 --> 38:58.630]  government, maybe isn't the best idea, but you could do something like hashing or something
[38:58.630 --> 39:02.350]  different like that. But can you speak to the advancements of biometric data and how it may
[39:02.350 --> 39:09.250]  pertain to online voting in the future? So one property of biometrics is that, um,
[39:09.250 --> 39:15.230]  there, there are two unfortunate properties about biometrics. Uh, the first is they're biometrics,
[39:15.230 --> 39:19.890]  uh, they're tied to you as an individual. You can't change them if they're compromised.
[39:20.010 --> 39:24.610]  Uh, so if something happens to your biometric data and other people learn about what it is,
[39:24.610 --> 39:34.030]  they, uh, they know it and you're stuck. Um, the, uh, and that means that effectively
[39:35.850 --> 39:40.130]  supervised biometric authentication, you know, you go into the kiosk, there's a guard,
[39:40.130 --> 39:46.390]  you put your fingerprint on a reader, might be okay. Um, under, you know, because they know
[39:46.390 --> 39:52.490]  that you're not bringing some equipment in to fake what the fingerprint is. But unsupervised
[39:52.490 --> 39:58.530]  biometric authentication, I'm using my phone, it reads my biometric and sends that data somewhere
[39:58.530 --> 40:04.850]  is something that's always going to be subject to compromise, uh, in that way. So biometrics,
[40:04.850 --> 40:10.290]  you know, solve some problems for in-person authentication that work very poorly, uh,
[40:10.290 --> 40:23.090]  in the online context. I think another issue that, that isn't really considered is the fact that,
[40:23.090 --> 40:29.210]  you know, for instance, if Bia was going to vote and with her cell phone and she's asleep,
[40:29.210 --> 40:35.010]  I can just pick up her cell phone, unlock it with her face and vote on it. Or, um, you know,
[40:35.010 --> 40:40.930]  Bob over there wants me to vote for Pinkie Pie. So he gives me a thousand dollars to go vote for
[40:40.930 --> 40:44.930]  Pinkie Pie, which, you know, we still have that problem in our regular elections. And those are
[40:44.930 --> 40:52.610]  small, small little votes, but there's no privacy. You know, if, if you have a partner that's very
[40:52.610 --> 40:57.610]  controlling and they're trying to force you to vote for somebody, when you walk into that voting
[40:57.610 --> 41:03.910]  booth by yourself and you close that curtain, you can vote for whoever you want. You lose that a
[41:03.910 --> 41:09.910]  hundred percent when you do online voting and vote by phone or any of this. Great for American Idol,
[41:09.910 --> 41:24.040]  not great for elections. That was not a question. Any other questions?
[41:24.040 --> 41:28.060]  Hi, so I have a general question about remote voting, which is not electronical,
[41:28.060 --> 41:32.800]  such as postal voting, which is used in many countries to support, for example, disabled voters
[41:32.800 --> 41:38.780]  or voters who are otherwise unable to go to the polling station. And postal voting has many risks
[41:38.780 --> 41:43.440]  of the kind that you mentioned, such as the risk of coercion or the risk of not knowing that the
[41:43.440 --> 41:48.700]  ballot that arrived was actually marked by a legitimate voter. So given all this, what kind
[41:48.700 --> 41:56.780]  of secure enough options would you recommend for remote voting? So, I mean, one of the, you know,
[41:56.780 --> 42:03.620]  one property of this is it's important not to confuse online voting with the general problem
[42:03.620 --> 42:11.320]  of remote voting. Remote voting exists everywhere in the United States, at least as a special case
[42:11.320 --> 42:19.520]  for absentee ballots, you know, people who can't travel and so on. It's generally done on paper and
[42:19.520 --> 42:29.580]  by mail. That has some of the same problems as online voting, but not all of them. So it leaves
[42:29.580 --> 42:36.560]  us with the one-on-one coercion problem, right, that if you're sent a paper ballot, it is possible
[42:36.560 --> 42:44.040]  you could be coerced by a partner or an employer to vote in a particular way, but that has to be
[42:44.040 --> 42:53.980]  done on a retail level, ballot by ballot. In an online voting system, that same type of
[42:53.980 --> 43:01.800]  compromise can be done centrally. A piece of malware that's spread via phishing or any of the
[43:01.800 --> 43:11.800]  other ways that malware spreads can be used to wholesale compromise many, many different ballots.
[43:11.800 --> 43:18.100]  So my suggestion is that to accommodate voters who can't travel, we stick to the paper-by-mail
[43:18.100 --> 43:27.180]  method and not introduce methods that also add the wholesale fraud and wholesale abuse
[43:27.940 --> 43:36.700]  vector. But even, you know, even by-mail voting does compromise some of the properties of the
[43:36.700 --> 43:43.260]  secret ballot, and we have to be very careful when we scale that up. I'll just add that
[43:43.940 --> 43:49.800]  there are solutions that have been implemented. So when the Military and Overseas Voter Empowerment
[43:49.800 --> 43:55.600]  Act was passed, it required that all counties or states send ballots to military and overseas
[43:55.600 --> 44:01.700]  voters 45 days before the election. It also stipulated that they had to make the option
[44:01.700 --> 44:07.820]  available to send the blank ballot electronically. Blank ballots can be sent with reasonable,
[44:07.820 --> 44:12.400]  acceptable security electronically because they don't have the vote. They don't have the secret
[44:12.400 --> 44:17.120]  value piece of data on them. Everybody knows what's going to be on the blank ballot.
[44:17.440 --> 44:23.080]  So you get your blank ballot in 45 days and then still have 45 days. The military have access to
[44:23.080 --> 44:29.760]  expedited free postal mail return that is provided to everyone, you know, in the military. And
[44:29.760 --> 44:34.880]  the, what we see, as I mentioned, you know, there's 32 states that currently allow
[44:34.880 --> 44:41.200]  electronic ballot return, 28 that do not. There, I'm sorry, 18 that do not. There are several
[44:41.200 --> 44:45.940]  states that don't allow electronic ballot return that have higher rates of participation for
[44:45.940 --> 44:52.240]  military and overseas voters because they have other, they have robust communications in place.
[44:52.240 --> 44:57.000]  They're making sure that they get the information to those voters. So I don't think that we can
[44:57.000 --> 45:00.740]  make a correlation that electronic ballot return is going to increase participation for those
[45:00.740 --> 45:11.320]  voters based on that information. Any other? Hi. I have a couple. David, what is your last name?
[45:11.920 --> 45:15.360]  Jefferson. Jefferson. Oh, I don't need any spelling on that one. Okay. Just like the
[45:15.360 --> 45:21.340]  county. Got it. Just like the county, right. Yeah. And the name of your organization again is?
[45:21.340 --> 45:26.980]  Free Speech for People. Free Speech for, I'm surprised I haven't heard from you. Free
[45:28.100 --> 45:33.060]  Speech for People. So military ballots and voting is always kind of interesting on all the campaigns
[45:33.060 --> 45:38.060]  I've worked on. And generally each county is autonomous in how they vote and yet you're
[45:38.060 --> 45:42.060]  talking about military and state. So I'm really a novice. I really don't know what I'm doing on
[45:42.060 --> 45:45.980]  this one. So you're saying the states have better things in place. So how does that work with the
[45:45.980 --> 45:54.400]  counties being autonomous in how they do their voting? So it actually depends state by state
[45:54.400 --> 46:01.600]  because some states have, some states run their UOCAVA outreach to those voters or military and
[46:01.600 --> 46:06.620]  overseas. The outreach to those people at the state level and some places do it at the county level,
[46:06.620 --> 46:12.140]  meaning that the county officials have to email the ballot or send the ballot to the people or
[46:12.140 --> 46:17.460]  some places they do it from the state level. So it really depends on the state. Yeah, you have to go
[46:17.460 --> 46:31.280]  state by state. Any other questions? Trying to minimize the feedback. So I don't really have a
[46:31.280 --> 46:39.100]  question. I have a comment. I think it's important for people to be careful not to generalize
[46:39.100 --> 46:45.220]  your personal experience of voting and think that's how it is throughout the United States.
[46:45.220 --> 46:50.560]  It's easy to make blanket statements that don't apply. So for instance with respect to voting by
[46:50.560 --> 46:57.580]  mail, if you live in the state of Georgia, the only way to be able to do a hand marked paper ballot
[46:58.160 --> 47:05.980]  is if you vote by mail. The only way to have ballot secrecy is if you vote by mail. Because
[47:05.980 --> 47:12.200]  if we go into a precinct, we have ballot marking devices that are huge, they're upright, they're lit
[47:12.200 --> 47:19.200]  up and anyone can see how you're voting. So if you want ballot secrecy and hand marked paper ballots
[47:19.200 --> 47:25.640]  in the state of Georgia, you have to be able to vote by mail. And the other thing to be aware of
[47:25.640 --> 47:33.860]  in the state of Georgia is that the Secretary of State controls all counties. So we're required to
[47:33.860 --> 47:40.340]  do everything the same way throughout the entire state. It's not county by county decisions. So I
[47:40.340 --> 47:46.080]  just want to caution people, don't generalize based on your own experience because across the United
[47:46.080 --> 47:51.600]  States, there are very different circumstances. Any other questions?
[47:53.320 --> 47:56.460]  Going once, going twice.
[47:57.740 --> 48:01.140]  All right, well thank you everybody and please help me. Thank you all.