[00:14.770 --> 00:18.170]  All right. Good morning. Wow, that's loud.
[00:18.850 --> 00:25.270]  Thank you for coming out to this talk. We're going to cover the DEF CON voting machine process of how we handle these unknown devices.
[00:25.270 --> 00:33.730]  This is a little bit different forensic process than what you might do for insider threat, what you might do for incident response or intelligence collection.
[00:34.130 --> 00:37.790]  So it's a little bit different. We'll step you through how we've done this the past few years.
[00:37.790 --> 00:45.510]  First we'll get to the Chinese machines, and then we'll get over to the latest machine we're working on, the one from Colfax County in Michigan.
[00:48.360 --> 00:50.540]  Let's see if this works. There we go.
[00:51.280 --> 00:58.300]  Okay, I'm Will Baggett, former from CIA Human Cyber Collection. I'm Director of Digital Forensics for Operation Safe Escape.
[00:58.300 --> 01:04.720]  We help domestic abuse victims. I have a day job. I'm a Cyber Threat Intelligence Manager at a redacted company.
[01:04.720 --> 01:09.300]  They didn't pay for the trip. They didn't authorize the speech. It's redacted.
[01:14.050 --> 01:16.350]  A little bit of a blag, bear with me here.
[01:16.470 --> 01:22.050]  So, being that we're back in the States and I'm giving this talk, I go with the Nick Saban college football approach.
[01:22.150 --> 01:26.030]  I don't discuss politics in the speech. We aim to be neutral.
[01:26.250 --> 01:30.910]  The goal is to be accurate in forensics, and our finding is not to have a bent either way.
[01:30.910 --> 01:35.730]  If we give a bias, then we poison our findings. We are not credible.
[01:40.690 --> 01:45.880]  Oh, come on. Really?
[01:49.070 --> 01:53.850]  The other caveat we're going to start with, as we work through the Apple Kluge-iness,
[01:53.850 --> 02:00.430]  the NCAA football model, coming from the southern part of the United States.
[02:00.430 --> 02:02.670]  I can't talk too much Red Bull, but not enough Red Bull.
[02:03.330 --> 02:07.010]  We've all had teams lose because of a poor referee call.
[02:07.030 --> 02:11.650]  We could probably sit here and talk the rest of the time, whether it's football, basketball, field hockey, whatever.
[02:11.650 --> 02:15.610]  We remember when the call went against us because of a bad referee.
[02:16.410 --> 02:22.430]  The goal here, what we're aiming for, is to show we have accurateness in our voting machines,
[02:22.430 --> 02:32.430]  so that if a candidate loses by a vote, they've lost by an honest vote, not because of what we currently have with the me, you, it's someone else's fault system.
[02:33.730 --> 02:39.190]  We're now cognizant, when we produce these reports with the scribes we have working,
[02:39.190 --> 02:45.050]  that after the 2019 conference, we had a report that went to the U.S. Congressional Committee on Voting,
[02:45.050 --> 02:51.580]  and there were 2.5 billion reads on that report, but not one with a single fault,
[02:53.370 --> 02:56.710]  criticizing how we handled this forensically. That's a win.
[02:56.710 --> 03:02.710]  And to contrast 2.5 billion reads on our reports,
[03:02.710 --> 03:09.050]  my Cyber Threat Intelligence team is excited if we hit 100 reads on the internal threat from the active ransomware groups.
[03:09.050 --> 03:11.270]  So this is a little bit different scale.
[03:12.470 --> 03:16.670]  The way we get the machines, we're starting low and we'll work up to the top.
[03:16.830 --> 03:21.690]  The machines are purchased off of eBay, off of Alibaba, by Harry Hearst.
[03:21.690 --> 03:25.470]  They are legally procured because if we don't follow the legal chain of custody,
[03:25.470 --> 03:30.330]  and we do find something, it's spoiled evidence that can't be used.
[03:31.590 --> 03:36.130]  The Chinese voting machine that came from Alibaba, we'll cover that more in depth.
[03:36.150 --> 03:43.610]  To start off, where we got here in 2017, I was out here for e-discovery for my private business after leaving the government.
[03:43.950 --> 03:46.950]  I had my full forensic kit with me. They're not cheap.
[03:46.950 --> 03:51.130]  I didn't leave it in the hotel room because it's five figures worth of gear.
[03:51.130 --> 03:54.530]  I don't want to see it walk off and pawn for $25 in a Red Bull.
[03:55.730 --> 03:59.730]  This is the original voting village we had over at Caesars Palace. It's a lot smaller.
[04:03.160 --> 04:08.420]  I approached Harry, told him I had a forensic kit. He gave me a device that hadn't been used yet.
[04:08.860 --> 04:15.140]  We found it was unpatched Windows XP, which is a conundrum. Most people say if it's unpatched, it's vulnerable.
[04:15.220 --> 04:19.640]  But in this world, it's a little bit different because they don't connect to the Internet, and I'm getting ahead of myself.
[04:19.640 --> 04:30.080]  If they don't connect to the Internet, and they're only used to vote with positive control, updating the CDEs, it's a different way to look at things.
[04:30.080 --> 04:38.680]  We found the Windows machine was running Microsoft Office 97 Access Database, unencrypted hard drive.
[04:38.680 --> 04:42.700]  The USB ports weren't accessible, and you were voting as the admin.
[04:43.080 --> 04:47.980]  The first major finding we had was one machine. It was the baseline machine.
[04:47.980 --> 04:59.400]  They had connections to the Internet over FTP log that was sending clear text versions of the voting device to a server in Canada.
[04:59.460 --> 05:05.920]  Infocom pivoted, had a friend working in a major news organization, not Fox. There's only two, you figure it out.
[05:06.860 --> 05:17.260]  While we were doing this over at Caesars Palace, he was doing OSINT, and he found that where the clear text information was being sent was Infocom based out of Canada.
[05:17.260 --> 05:23.300]  IP address. We're not really sure why it went there. We found it, we reported it, it went to the congressional report.
[05:23.320 --> 05:25.840]  We didn't chase the lead further, it was a one-off.
[05:28.040 --> 05:33.460]  2018 to now, we've worked with Hari to change the process.
[05:33.960 --> 05:37.140]  The devices are imaged before they're released to the public.
[05:37.140 --> 05:40.100]  The Chinese device has been imaged once again, I'm getting ahead of myself.
[05:40.100 --> 05:46.480]  We document everything, we have several scribes from law schools, we have cyber architectures, architects.
[05:46.480 --> 05:49.300]  So we're doing this professionally this time.
[05:49.520 --> 05:54.160]  As opposed to just letting someone come up and load something, it goes on the news.
[05:54.680 --> 05:56.820]  We've created order out of chaos.
[05:56.820 --> 06:06.220]  Because if someone loads Rick Astley on the video, that goes on YouTube, that goes on CNN, that spoils the forensic evidence we may work on.
[06:06.220 --> 06:11.100]  That's great, you had Rick Astley on a USB drive in the year of our Lord 2023, why?
[06:11.100 --> 06:14.400]  But people do, they load it and that spoils what we're doing.
[06:14.400 --> 06:24.100]  So we have the two machines, we have the one again from Michigan, the Chinese machine, that are untampered, so to speak, at this point.
[06:24.480 --> 06:28.680]  So we do collection, examination, analysis, and then the reporting.
[06:28.900 --> 06:32.580]  We pivot on the reporting, go back and begin the collection again.
[06:33.200 --> 06:36.160]  The basic forensic principles, and we're going to ramp up.
[06:36.160 --> 06:42.400]  A perpetrator will bring something to a crime scene and leave with something on him or her.
[06:44.900 --> 06:47.620]  We won't take any action to change any data.
[06:47.620 --> 06:52.580]  There have been, in the news I'm sure you've seen, there's a little bit of voting controversy in the past few years.
[06:53.180 --> 06:57.980]  People will get a voting device, load their biased data on there, and then say, look what I found.
[06:57.980 --> 07:01.700]  This exonerates or this proves this person has cheated out of the election.
[07:01.700 --> 07:09.680]  But because, you can see, they upload the USB drive well after the fact, it's not valid evidence.
[07:11.600 --> 07:17.360]  Pillar two of forensic examination is if you're going to work on the device, forensically you have to be qualified to do it.
[07:17.360 --> 07:21.300]  This isn't something you can pause, look at YouTube, go to TikTok, and figure it out on the fly.
[07:21.900 --> 07:25.620]  We keep a documented audit trail of how we're doing this.
[07:26.080 --> 07:32.100]  And Hari, Kat, Matt are overseeing the investigations of how we're doing this accurately.
[07:32.100 --> 07:35.620]  So if we have a finding, it's validated by other individuals.
[07:35.620 --> 07:41.260]  As you see, again, where we're working, we have a scribe, we have a team working on this, and we pause and write this down.
[07:45.170 --> 07:50.190]  Once we have a copy of this made, we make multiple copies, two is one, one is none.
[07:50.190 --> 07:55.850]  If the one device image of the Chinese machine is spoiled, we've lost access to that forever.
[07:57.230 --> 08:02.710]  The toolkit we're using is Macquisition, now it's Celebrite, also FTK Imager.
[08:02.710 --> 08:06.010]  I'm using a write blocker with an old-school Pelican kit.
[08:06.370 --> 08:13.650]  We're storing this either traditionally, when I train NATO Special Forces in cyber acquisition, Battlefield Forensics,
[08:13.650 --> 08:16.490]  stored to DMG, VHD, or to USB.
[08:16.710 --> 08:22.190]  We prefer to do DMG or VHD, Mac or Windows, that way it's a little bit cleaner, easier to pass around.
[08:23.270 --> 08:27.150]  They're written in a read-only format so that we do not alter the evidence.
[08:27.150 --> 08:35.530]  The current toolkit is the Freeware Autopsy, Blacklight, Disk Drills, and File Recovery Program, FTK Imager,
[08:35.530 --> 08:41.330]  Macquisition, Magnet Axiom, and RegRipper to examine the registry to see the last files added and updated.
[08:41.870 --> 08:45.230]  So you can begin to see some of the process, we load Blacklight.
[08:45.510 --> 08:50.910]  We have been able to recover some deleted files, and you can see here the loading machine cards of what we find.
[08:51.450 --> 08:57.590]  These are some of the compact flashcards we've imaged, and you can see some of the strings here.
[08:57.590 --> 09:04.010]  This machine was used September 21st, 2018, in Williamsburg, Virginia.
[09:05.970 --> 09:10.890]  The next one, we did find voting data, nothing, no personal data, no evidence of any tampering,
[09:10.890 --> 09:13.730]  but we did find deleted data on the compact flashcards.
[09:14.410 --> 09:20.150]  And also the ones here, we can see where the compact flashcards were used repeatedly instead of being wiped in format.
[09:20.150 --> 09:23.190]  That's good and bad. There's evidence, there's legacy issues, however.
[09:23.190 --> 09:29.610]  I personally prefer to have every voting machine with fresh media every time, just for best practices.
[09:30.830 --> 09:34.810]  So the analysis itself, we crack the box open, we image it.
[09:34.810 --> 09:40.190]  The one over here that looks like Uncle Owen and Aunt Beru are buying this for their farm on Tatooine,
[09:40.810 --> 09:44.490]  that's an election system software, M5650.
[09:44.490 --> 09:49.390]  It's programmed via ZipDisk. ZipDisk was a technology that could have kids by now.
[09:49.390 --> 09:55.870]  The operating system is a BlackBerry ClearTek system, it's a 128 megabyte hard drive.
[09:56.270 --> 09:58.790]  Let's see if this works, I feel like a talk show host here.
[09:59.990 --> 10:04.390]  So it's got a Ethernet port, we're not...
[10:06.190 --> 10:07.790]  We're going back over here.
[10:08.410 --> 10:13.370]  It's an Ethernet port to program DHCP, why? I don't know, but it does.
[10:13.450 --> 10:16.330]  10 horsepower motor to pull your vote through the system.
[10:17.430 --> 10:24.070]  So, in the Byzantine world of security, that would actually be a little bit more secure,
[10:24.070 --> 10:28.530]  because hacking into that is going to take an extraordinary effort to do that remotely,
[10:28.530 --> 10:31.370]  which, I don't know if that's possible.
[10:32.010 --> 10:35.790]  A lot of the machines are older, they rely on compact flashcards.
[10:36.670 --> 10:42.650]  Some of the machines, the Diebold election systems, are running on not just compact flashcards, but traditional flashcards.
[10:43.190 --> 10:49.010]  Previously, at DEFCON, we'd have a shuttle that would go from here to Fry's to buy the esoteric equipment that we need.
[10:51.150 --> 10:56.950]  Many of the findings are the machine username and password due to the Sunshine Laws, they are available online.
[10:56.950 --> 10:59.910]  Same for the machine admin name and password.
[11:00.030 --> 11:05.770]  This is in compliance with state Sunshine Laws, it's not really hacking, it's OSINT, but they're still available online.
[11:06.010 --> 11:11.110]  If this was my NATO classroom, and we were here for a week in beautiful Belgium for training,
[11:11.110 --> 11:17.110]  I would stop here, we'd pivot, pick a state, pick a country, doesn't matter any country, any state.
[11:17.130 --> 11:22.550]  Go online, look for the voting machines, look for the state, look for the usernames, passwords, machine type,
[11:22.550 --> 11:28.110]  just to show that a lot of this security is available.
[11:28.110 --> 11:33.430]  So a lot of the hacking we've done isn't so much cracking the passwords, it's just fancy Googling.
[11:34.670 --> 11:41.150]  The two premier voting systems over there, we imaged it, turned it back on,
[11:41.150 --> 11:45.970]  and we were looking and saw for the security that it does record the hash values of the files,
[11:45.970 --> 11:48.570]  we'll get more into depth as to what hash values are.
[11:48.810 --> 11:54.410]  So it does, yes, it does record the hash values, and now working in cyber threat intelligence,
[11:54.410 --> 11:59.070]  it does the worst thing possible, it prints them.
[11:59.070 --> 12:04.270]  You can't export the hashes to see and audit a baseline and then audit after the fact.
[12:04.270 --> 12:11.330]  It prints 56 pages of SHA-256 or SHA-5 encryption.
[12:12.490 --> 12:18.490]  You'd have to hand jam it, OCR, hope everything scans properly. This is security theater.
[12:21.920 --> 12:29.560]  We had a hypothesis, is this actually testing to see if the machine truly does have security controls, or is it just presentation?
[12:29.560 --> 12:33.960]  We took the header of that box, it's actually the one on the left closest to the wall.
[12:35.280 --> 12:37.100]  Let's see if the video runs here.
[12:42.680 --> 12:43.780]  Maybe not.
[12:45.080 --> 12:50.900]  So we changed the header to my friend's avatar from a football site, put the DEF CON logo.
[12:50.900 --> 12:56.320]  It does say this file has been altered, but you can click through and still vote on it.
[12:56.320 --> 13:01.400]  So it does say it's been tampered with, but you can vote. It's kind of good.
[13:04.610 --> 13:11.750]  And of course, that's what made the news. After the fact, after image, this is what was on Fox News.
[13:12.770 --> 13:21.390]  2021, nothing happened. Everything was fine in 2021. Everyone had a good time. We traveled. Nothing happened in the world.
[13:21.610 --> 13:27.970]  2022, conference started back up. We got this Chinese voting machine.
[13:27.970 --> 13:34.890]  Hari bought it off of Alibaba. $7,000 plus another $3,000 in shipping.
[13:35.690 --> 13:38.190]  Weighs roughly 150 pounds.
[13:43.120 --> 13:48.300]  As far as we know, this is the only version of this in the States, and that's a good thing.
[13:48.300 --> 13:51.760]  It's fantastic to illustrate the security flaws in the system.
[13:54.460 --> 13:59.360]  Usually I give a talk without the props, so this is nice. Let's see if I can do this without blowing everyone away with feedback.
[14:08.600 --> 14:11.500]  So, all right, we're good.
[14:11.600 --> 14:17.060]  It has 4G antenna, Bluetooth, Wi-Fi enabled.
[14:17.900 --> 14:25.120]  Tons of ports. It records your fingerprint, records your ID.
[14:26.560 --> 14:33.240]  The drive itself is an Android 2012 motherboard under here.
[14:34.040 --> 14:41.420]  To make it run, it took a team of us, being very honest, as opposed to most of my career where I lied for fun.
[14:41.920 --> 14:46.180]  You have to install the thermal paper at the top and the bottom for the machine to function.
[14:46.180 --> 14:51.580]  So if your precinct runs out of paper, you can't keep storing and voting without the paper.
[14:51.580 --> 14:54.740]  You must have the paper, just like you can't print without Cyan.
[14:54.740 --> 14:59.540]  What the heck is Cyan? I don't know, but you can't put Black and White without Cyan on HP.
[14:59.540 --> 15:02.540]  One copy of your vote drops here.
[15:02.760 --> 15:06.240]  You get one copy of the vote to keep for yourself.
[15:06.580 --> 15:09.480]  Where the votes are stored, that's something we're still working on forensically.
[15:09.480 --> 15:10.960]  We have a few more questions.
[15:12.920 --> 15:15.460]  This is interesting.
[15:17.040 --> 15:22.700]  And a camera, and a scanning spot. Why a scanning spot? Is that your crotch?
[15:22.700 --> 15:24.280]  I don't know, but there we are.
[15:27.890 --> 15:33.690]  So these images are from Alibaba. I didn't manipulate them. This isn't college football memes.
[15:33.690 --> 15:35.990]  I can't do that for fun. This is a serious presentation.
[15:36.390 --> 15:40.850]  I didn't put Trump and Hillary on here. That came from the Alibaba site.
[15:45.310 --> 15:46.970]  Where's the device manual?
[15:47.810 --> 15:53.840]  I see some people shaking their heads.
[15:56.620 --> 15:57.500]  Worse!
[15:58.580 --> 16:00.780]  How do you get software updates and patches?
[16:02.900 --> 16:03.700]  Where?
[16:05.120 --> 16:09.880]  You get them from your contact in China over the Alibaba link.
[16:10.480 --> 16:17.020]  There is no open source evaluation of the specific device itself.
[16:17.020 --> 16:20.460]  There is no manual. There is no RTFL.
[16:20.500 --> 16:24.000]  It's trust me, bro. Here are your drivers. Update it.
[16:26.200 --> 16:31.900]  So last year we unboxed it. We'll skip the unboxing ceremony. It's obviously unboxed. There we go.
[16:31.900 --> 16:34.100]  Oh, we are going to watch it.
[16:39.040 --> 16:44.900]  So last year as this device came in from the loading dock, we had to leave it overnight.
[16:44.900 --> 16:46.320]  We did image it.
[16:51.750 --> 16:59.270]  Knowing we had to leave it, we had positive chain of control of this since the device was delivered to Hari.
[16:59.570 --> 17:11.150]  We took note of specific ways the tape and other metal bands were configured.
[17:11.150 --> 17:20.350]  We didn't tell anyone what we were doing. That way if the machine was open and tampered with while we were back out of this glorious forum, we would know that something had happened.
[17:25.280 --> 17:31.400]  We used this glorious $3,000 voting machine kinetic tool available from China.
[17:32.440 --> 17:35.140]  We open it up. Obviously you can see that it's right here.
[17:37.240 --> 17:39.000]  Documented everything thoroughly.
[17:43.340 --> 17:49.800]  Because we have four days on target with the machine before we go back to the real world, so we document as much as we can while we are on site.
[17:59.280 --> 18:04.380]  First thing someone started doing was unplugging all the cables without noting where they went.
[18:05.620 --> 18:09.140]  Person was asked not to work further with this machine.
[18:14.340 --> 18:18.240]  The next step once we got the motherboard, someone had a great idea.
[18:18.240 --> 18:24.540]  Take the picture of the motherboard, do a reverse image search on OSINT to see what this is and if there is anything unique to it.
[18:24.540 --> 18:29.280]  We found this is a standard circuit board without any traditional means to image it.
[18:31.020 --> 18:34.120]  Luckily we were co-paired with the Internet of Things village.
[18:34.400 --> 18:40.680]  We walked over and offered them the opportunity to image this as we are all here for the same reason.
[18:40.680 --> 18:42.980]  We performed a chip off extraction.
[18:44.900 --> 18:48.920]  Meaning instead of traditional methods, they connected their leads to that.
[18:54.760 --> 19:00.900]  A little bit of experimentation and we were able to get a 123.8 gig file image of the drive.
[19:31.750 --> 19:38.870]  And from that, once we had the image, we used a write blocker kit.
[19:39.210 --> 19:42.210]  Going back to instructor mode, two is one, one is none.
[19:42.210 --> 19:46.550]  From Carver analysis, you look for the weak point in a system for exploitation.
[19:49.790 --> 19:59.810]  TSA found the weak point in this system was this USB type A to type B cable that was crushed during examination between Brockman, Wagyu, Joff, and Charlotte.
[19:59.810 --> 20:03.310]  And arriving here, which is the thing that makes the entire kit work.
[20:03.950 --> 20:06.530]  Note to self, next time have backup cables.
[20:06.530 --> 20:16.590]  We were able to rebuild that, but again, if you're working with something on a sensitive site, if you fail to plan, you plan to fail.
[20:21.310 --> 20:28.610]  And if you have something, limited access, limited target, take multiple methods to image it because you only have one shot.
[20:29.050 --> 20:31.350]  The odds of failure are extremely high.
[20:31.730 --> 20:36.190]  So we made copies, I had a copy, made a copy for Hari, made a copy for two other people.
[20:36.530 --> 20:42.230]  They're geographically dispersed. One went with me to Charlotte, one went to Hari in New York, and one went to someone in California.
[20:42.230 --> 20:47.770]  That way, we have three copies. If one thing went bad, we still had redundancy built in.
[20:48.750 --> 20:54.310]  There's a fantastic gadget company called Wardollar out of North Virginia made called the DopeScope.
[20:54.750 --> 21:04.870]  When we finally powered this on, it's a Kali Linux scope, and you can identify Wi-Fi networks, Bluetooth networks that are created.
[21:04.870 --> 21:09.570]  We didn't identify any networks created from that machine when it came on.
[21:09.950 --> 21:12.850]  So I think that's a pretty good win so far.
[21:14.850 --> 21:21.430]  Now that we have the image, first thing is, what's in the box? Now, what's in the image?
[21:21.690 --> 21:28.790]  With traditional methods, we use rep to see what Android version it was. We came out as an older version from, I believe, 2012.
[21:30.010 --> 21:31.770]  And from that, we pivot.
[21:33.030 --> 21:36.550]  There are known-knowns, non-unknowns, and unknown-unknowns.
[21:36.550 --> 21:46.770]  So the way we eliminate those in the forensic world, we went to the NIST database, downloaded the database of software reference files, NSRL files.
[21:47.210 --> 21:57.530]  And by eliminating the known good files based on the hash values, we're going to be able to sort out the malware, the unique proprietary files that China has on that machine.
[21:57.530 --> 22:02.850]  And of course, log files are always going to be unique, just because they're log files. They're unique because it's different.
[22:03.430 --> 22:08.230]  So once we have the unknown files, then we'll be able to reverse engineer what we've got.
[22:08.230 --> 22:14.410]  But this is a slow, deliberate process. It's not something looking for, were they on their phone at the time of the car crash?
[22:14.550 --> 22:18.790]  Did you send somebody a threatening text message? This takes a little bit more work and care.
[22:20.810 --> 22:25.230]  So hash values, if you're not familiar, it's a mathematical computation, the value of the file.
[22:25.230 --> 22:31.670]  Having identical hashes can happen, but mathematically, highly improbable.
[22:32.050 --> 22:38.150]  So visiting NSRL, we downloaded a 14-gig compressed file of all the known Android files.
[22:38.290 --> 22:42.250]  We're going to run that into Blacklight.
[22:42.290 --> 22:46.070]  So we're going to file manage, like I'm teaching a software course here, no offense.
[22:46.590 --> 22:53.150]  And we'll import those known good files into this, and we're going to filter out the unique files.
[22:53.150 --> 22:58.410]  This is common for most forensic practitioners. You want to see what's unique, not the common stuff.
[22:58.410 --> 23:03.710]  Congratulations, you have Solitaire on your phone and your laptop. Good job.
[23:04.110 --> 23:06.170]  Questions we've had this week.
[23:06.750 --> 23:14.310]  Does the voting machine work if you put it in airplane mode? Because I don't want this connected to the 4G network while we're voting.
[23:14.630 --> 23:17.910]  Does it have GPS data stored? We don't know yet.
[23:17.910 --> 23:21.010]  Where are the fingerprints, IDs, and votes stored?
[23:21.010 --> 23:26.870]  Because in theory, you'll be able to create, here's the fingerprint, here's the ID,
[23:26.870 --> 23:29.310]  and put you in the United States for that thing called the Constitution.
[23:29.670 --> 23:33.970]  We have private voting, as I heard Matt say earlier in one of his talks.
[23:35.250 --> 23:40.550]  So if we could possibly correlate the fingerprint ID, which I would never want to see,
[23:40.550 --> 23:45.190]  but the ID to the vote, that violates our private vote here.
[23:46.270 --> 23:52.360]  And what personal information is collected? Because if that is a driver's license reader,
[23:53.230 --> 23:57.390]  how are you validating it? Are you storing it?
[23:57.390 --> 24:00.050]  These are questions that we need to address now.
[24:00.930 --> 24:05.710]  And once we have a baseline image of the forensic device, then we can begin to do the experimentation.
[24:05.710 --> 24:07.470]  But this is where it sits.
[24:08.270 --> 24:14.350]  As we stand, the forensic findings are we have not found evidence of foreign interference.
[24:14.350 --> 24:21.930]  We haven't found evidence of domestic interference at this voting village, the devices we've looked at.
[24:21.930 --> 24:24.490]  We haven't found malware on the devices.
[24:25.530 --> 24:28.950]  Conversely, we haven't found any software updates ever.
[24:28.950 --> 24:32.030]  Again, this is a different type of security evaluation.
[24:32.030 --> 24:40.690]  The machine that was put in Fairfax County in 2003 is exactly like it was put in there with regards to the operating system.
[24:41.170 --> 24:45.210]  It could actually retire from Fairfax County this year with 20 years of service. Wow.
[24:45.990 --> 24:52.710]  There's no encryption of the output. The vote is written to vote.txt on some of the voting machines.
[24:53.010 --> 24:56.130]  You vote on the admin account. The USB ports are accessible.
[24:56.130 --> 25:02.450]  Now that said, time on target to, not that I'd ever do anything like this,
[25:02.450 --> 25:08.910]  but if you're given an operational mission to go in, upload software on a thing,
[25:08.910 --> 25:17.690]  you have the poll watchers, your ability to come in, load this ancient script on the Windows CE machine, Windows 95 machine,
[25:17.690 --> 25:23.450]  upload it, put the malware on there, have the machine reboot, get off the X,
[25:23.450 --> 25:27.950]  and leave the voting area before you're noticed by a poll watcher that the machine doesn't work.
[25:27.950 --> 25:31.050]  The probability of that happening is extremely low.
[25:31.770 --> 25:39.150]  I honestly, maybe North Korea, but as that would be a nation state event to send an actor in to manipulate a machine,
[25:39.810 --> 25:44.270]  the risk versus gain just isn't there unless people wanted to start.
[25:44.270 --> 25:49.270]  It's just, I can't see a rational operations manager approving this.
[25:50.030 --> 25:55.210]  There's no firewall. There's no AAV programs. There's no audit trail for the USB drives.
[25:55.210 --> 25:57.990]  We can see what's plugged in, but we can't see what's copied.
[25:57.990 --> 26:03.250]  No voting information has been found. No evidence of tampering has been found.
[26:05.710 --> 26:08.210]  Traditionally, things may have changed.
[26:08.210 --> 26:15.410]  If you put special software on something, the glorious, they want that software back.
[26:15.410 --> 26:22.010]  You can't upload vote manipulation software on a device and leave it out there in masses, quantities,
[26:23.010 --> 26:27.890]  in storage rooms and cafeterias and churches, and not assume that's going to be found and compromised.
[26:27.890 --> 26:29.190]  That's not happening.
[26:30.730 --> 26:37.290]  A two-person handling rule, and by that, being a former banker right out of college,
[26:37.290 --> 26:41.870]  you would get your cash, put it in your lock bag, lock it,
[26:41.870 --> 26:46.410]  walk from the back to your cash registry, to your terminal, walk back.
[26:46.410 --> 26:48.850]  Put the voting chip in the bag, lock it.
[26:48.850 --> 26:52.610]  The key would go to the deputy. The bag would go to another poll watcher.
[26:52.610 --> 26:55.670]  One party here, one party there. What parties? I don't care.
[26:55.670 --> 26:57.430]  It could be the Mickey Mouse for President party.
[26:57.430 --> 27:01.610]  But as long as you have multiple sets of eyes watching that bag,
[27:01.610 --> 27:04.890]  that's a higher step of the physical encryption and voter integrity,
[27:04.890 --> 27:07.230]  and it shows that we are taking this seriously.
[27:07.230 --> 27:11.630]  It won't solve everything, but it will stop some of the disinformation that things could have.
[27:11.630 --> 27:14.890]  A pivot here, and...
[27:16.730 --> 27:20.570]  This Russia-Ukraine thing, you may have also seen that in the news.
[27:21.390 --> 27:24.850]  A big hallmark, what we're seeing is a lot of disinformation.
[27:26.590 --> 27:30.310]  When Russia invaded Ukraine, Conti ransomware group,
[27:30.310 --> 27:34.910]  they were clearing about $180 million a year, U.S.,
[27:34.910 --> 27:38.090]  just out of ransomware from their virus.
[27:38.090 --> 27:42.390]  They were found to be a fundraising arm of the Russian government.
[27:42.710 --> 27:46.590]  When they invaded Ukraine, one of the key members on their team, a Ukrainian,
[27:46.590 --> 27:50.990]  took a little bit of offense to this, and being the insider threat, or hero,
[27:50.990 --> 27:54.250]  depends on which way you look at them, he leaked out everything
[27:54.250 --> 27:57.390]  to include all their chat logs, their source code,
[27:57.390 --> 28:01.410]  absolutely everything of Conti. Conti's ransomware group is dead now.
[28:02.570 --> 28:07.050]  So, looking at this from my private corporation, or from my employer,
[28:07.050 --> 28:12.230]  we still have the data. And doing additional searches on data we already have,
[28:12.230 --> 28:15.530]  no big deal. We found there are a lot of credentials.
[28:16.570 --> 28:20.630]  We've all seen redacted username and passwords, there's a lot of them.
[28:21.610 --> 28:24.830]  But the bottom line, after multiple searches, multiple iterations
[28:24.830 --> 28:30.670]  of the gigabytes of data, there is zero, unless they're using special code phrases,
[28:30.670 --> 28:37.030]  like a legal student here, Conti ransomware group did not target U.S. elections.
[28:37.050 --> 28:43.470]  So, that's a good finding. So, the short version of the closing,
[28:43.470 --> 28:46.390]  machines are imaged before the public has access to them.
[28:46.390 --> 28:52.710]  We have not identified any tampering with the machines at the DEF CON voting villages.
[28:53.050 --> 28:56.910]  There are ways we could change the output immediately and secure the vote.
[28:56.910 --> 29:01.730]  Of course, there are people here who know far more about this.
[29:01.730 --> 29:05.010]  This is just a former CIA officer saying, hey, we did this, this would work,
[29:05.010 --> 29:08.710]  it's a $12 solution. Something's better than nothing.
[29:09.090 --> 29:14.190]  And we document findings as they occur, because if you don't document it,
[29:14.190 --> 29:18.910]  if it's not in cable traffic, it didn't happen. If you don't document it when it occurs, it doesn't happen.
[29:19.370 --> 29:23.870]  So, that's been a fast 75 slides. Any questions? Comments? Concerns?
[29:25.890 --> 29:28.730]  This one? Okay. Yes.
[29:37.440 --> 29:40.620]  He asked, where on the planet are the Chinese machines being used?
[29:40.620 --> 29:48.500]  As far as we know, because again, the unknowns, this is the only one in the U.S. as far as we know.
[29:48.580 --> 29:55.020]  Thank goodness. Unless it's on a boat anchor somewhere in the middle of Lake Mead, this is it.
[29:58.020 --> 30:01.460]  Questions? Comments? Concerns? Last rounds?
[30:05.800 --> 30:06.680]  Uh-oh.
[30:09.650 --> 30:14.410]  Do you have any speculation on what is this for?
[30:14.410 --> 30:24.990]  Is it in use in China? Is it they're trying to make really inexpensive election equipment that they can basically give out for cost or less?
[30:25.030 --> 30:26.730]  So, basically, it's a why.
[30:27.910 --> 30:36.250]  One of the U.S. politicians commissioned a, being apolitical, commissioned the design of a new voting machine,
[30:36.250 --> 30:39.190]  and they took input from people for what we thought it should be.
[30:39.190 --> 30:42.330]  So, it was a committee that helped design this.
[30:44.710 --> 30:45.370]  Pardon?
[30:45.370 --> 30:46.570]  A U.S. committee.
[30:46.710 --> 30:49.090]  A U.S. people said this is what we want.
[30:49.810 --> 30:54.870]  Now, that said, look at the awareness it has of these are the things we don't want.
[30:54.870 --> 31:01.150]  So, even though this is an abject failure as a voting machine, we're able to say, we can do better than this.
[31:01.150 --> 31:05.510]  And it gets the conversation going. There's generally always a positive in most things.
[31:11.120 --> 31:13.480]  Any other questions? Thank you for coming.
[31:13.920 --> 31:15.240]  Is that it?
[31:15.700 --> 31:16.820]  One more.
[31:19.700 --> 31:25.260]  You had mentioned that one of the machines were used in Williamsburg, Virginia. Which machine was that?
[31:26.200 --> 31:30.020]  You asked where one of the machines? It's hard. All this back talk, I'm sorry.
[31:30.020 --> 31:37.920]  Can you hear me like this? You said that one of the machines was used in Williamsburg, Virginia. Which machine was that?
[31:37.940 --> 31:42.780]  That was one of the Winvote machines that put the output to the compact flash card.
[31:43.940 --> 31:46.980]  That was... I don't think we have any of those here today.
[31:47.540 --> 31:51.100]  I mean, it's a compact flash card. I could hold it up and say it's a flash card.
[31:51.100 --> 31:54.520]  But we don't have the actual computer here.
[31:55.340 --> 31:56.000]  Thank you.
[31:58.950 --> 32:00.330]  Any other questions?
[32:02.190 --> 32:06.710]  Remember to drink plenty of water. It's a lot hotter than you think. You're drier than you think.
[32:06.710 --> 32:09.610]  You don't want to go to the ER before you go home. You don't need the paperwork.
[32:10.150 --> 32:11.690]  Take care of yourselves. Thank you.