So my name is John Odom. I'm the city clerk in Montpelier, Vermont, and in that capacity
I'm also the election administrator.
I'm also a certified ethical hacker and a couple other certs, but that's the one that gives me a right to be here, I think.
So what I've got to present, based on the paper I put together, is
it was supposed to be a little techie, a little not techie, because most folks who come to Voting Village to hear the speakers
aren't generally tech-oriented.
Whoa!
What? Where's that? Okay.
So every time I've run this presentation, it's gone about 50 minutes. So that means
all the tech is going out of it. And it wasn't much. What I was going to present was basically... Oh, we're back.
All right. What I was going to present was basically some best practices. And these are best practices
hopefully everybody's already doing. I'm sorry. I don't get it. You can't hear?
Nope. All right.
Anyways.
So this is going to start a little techier, going to get into policy, hopefully not be very techie at all, and
let's get going here. Okay, just if I'm going to talk Top Ten anything,
I should mention that OWASP has its own Top Ten. You're all probably
familiar with it, or at least some of you. They're Top Ten threats. They sort of periodically update it,
but it's worth checking. You're going to hear a lot of a lot of repeats here.
But my concern as an election administrator is
strictly about what gets in my way for running my election.
Which nine times out of ten would be me losing contact with, or me losing contact with, a voter database system.
Where my poll, where my voters are listed.
Got to be able to check in voters, and got to make sure everybody's voted only once. So what I've got
is
in that direction.
Now ScriptKitty, for those of you who aren't techie, that's somebody...
Well, since I've been a clerk for 12 years now, and haven't done anything techie, that would be someone like me, probably, actually.
I'm a total Metasploit baby at this point.
I've completely lost track of the skills, so take what I say with a grain of salt.
But the point is, if you don't think I could do damage in an election as
atrophied as my skills are, you're mistaken.
This stuff is
not... I mean, to do it well, to do anything well, is hard. To hack well is
incredibly hard. But to hack good enough,
if you get over any intimidation you have about working with Linux and some basic understanding,
this stuff is not hard. And I want to make that clear to folks who don't, who don't get involved in this kind of stuff.
You've got worries of advanced persistent threats, sure, from Russia, from China, from Iran, from North Korea,
but nowadays there's enough
conspiracy in the air
that we have to worry, in some cases, about folks around the corner who are just going to cause mischief.
So you're going to see a couple of these hacks that worry me based on that. Now,
I'm going to try to fly through this. I'm already off to a very bad start.
Okay, the number 10. And these are arbitrary,
almost arbitrary. Bear in mind, if I did the top 10 today, it'd be totally different, probably.
But this is a cloud host attack, and I'm specifically talking about Amazon.
Okay,
Amazon, the civic system has been used to host as much as a quarter of voters in the country.
Now, I'm not going to beat anybody up for hosting their voter management system, their voter database, on Amazon.
There's a million reasons to do it. I would probably do it myself. I don't even have to go through. But
this is a target.
Okay, it was hit by a massive
distributed denial-of-service attack.
2.3 Tbps,
74% higher than anybody had ever seen just a few years ago. If somebody wanted to cause mischief,
they could take down that system on Election Day, and they could cause a lot of chaos.
What I've got is a list up here that I'll just let you, I'm not going to go through, of
you know, possible issues. It's stuff you'd expect. Insecure secret storage,
injection flaws, we're certainly going to talk more about injection in general.
Improper assets management,
and there's, of course, malware now. We've got things like
Denonia and
Lemonduck. You know, these are things for crypto jacking or crypto mining, but they're proof of concept,
basically. So there is the possibility for malware.
All right.
Mitigation.
What are you going to do, right? I would say we talk about paper backups for ballots all the time.
A lot of places are still using paper checklists. We do in Vermont.
Paper, paper, paper. If this goes down, if for any reason my connection to the voter database goes down,
if I've got paper checklists to check people in, I'm good.
If I've got
Election Day registration, which about 11 places have, I'm really good.
Because if somebody gets their name knocked off the rolls, come in,
register them, get them voting, you know. And we have to err on the side of letting people vote
until we see some evidence that fraud is an actual problem.
So,
anyways, backup, backup, paper, paper.
9. Mobile devices. Oh, I'd love to spend an hour talking about everything. I mean,
who isn't talking about mobile devices? SMS?
Forget it. Not secure. You have to use it, use an app. You have to use your phones.
Still, that does, there's, there's other ways to create man-in-the-middle attacks through SS7 attacks.
SS7 is the old
telephony,
telephony, telephony, going way back to the 70s that still about three-quarters of the world uses. All you need is an aggregator
and a global title,
which you could get from a phone company and you could create a man-in-the-middle attack.
So,
I know this is, I don't mean to scare people. There's a point. I'm going to get to something that's positive and, and
joyful and uplifting by the end of this, I swear. But,
so this is used for,
we already went over that,
it's used for multi-factor authentication.
Now, I'm going to beat up a little on my last,
my last Secretary of State. When they set up two-factor authentication with one factor being SMS. Oh,
he was so proud of himself. Oh my god.
It's like it was the end-all be-all of security. And honest to God, that's still what I'm using, is SMS.
I think that's going to change soon.
I did run for Secretary of State, got a whopping 16%, and I made a big deal about this.
But,
you know,
multi-factor can be three factors.
There's plenty of other factors we can use. If we're talking about dedicated workstations for election management, you can use
biometrics. You can have a token on a fob. Lots of things you can do. And I'm, I'm losing faith in passwords in general.
Honestly, I mean, I'm,
passwordless is more and more the way to go. Although, I'll tell you, my favorite password
trick is to take a couple verses of your favorite song or poem,
take the first letter from each one, mix in some special characters. Awesome password. I highly recommend it.
Okay.
Now, this is a surface, a threat surface, you don't hear much about.
Intragovernmental credential harvesting and escalation. Okay.
I'm going to do the quick version. I'm going to skip half of what I have up here because we're, we're short on time.
So, I don't know if you can see this,
but I wanted to put this up there just, this is an analysis that was done several years ago of
a lot of hacks, their sources, the motivations, the type of attack. I want to show you right here, public administration.
We got a big red dot on privilege misuse.
Okay, and that's what I'm about to talk about, and I'm going to talk about a lot, is privilege escalation.
Okay, and again, I don't know how technical anybody is,
privilege escalation, doing the best I can, sorry.
I don't have a microphone. No, I'm just...
What's that?
No, because I'm, I got my water up here. It's all good. I'll just yell.
So, you'll see a big red dot, which refers to espionage under privilege misuse.
So, this is going to be a major vector
for any potential hack for an election, is getting in there and
starting to work your way up in terms of privilege and login,
you know, authentication authority. Okay,
especially, especially when you consider
that, well, let me give you an example of New England, all right. New England voter jurisdictions are by town.
Okay, that means Boston is a voter jurisdiction. The Boston election
administrator, that's their responsibility. I'm an election administrator. My responsibility is about 8,000 people.
When I ran for Secretary of State, I won two towns,
my town and the town of Granby, Vermont. I won with a whopping three votes, the other two got one.
Okay, we're talking very small jurisdictions, and the election administrators in those
jurisdictions have the same rights to the voter management system, the voter rolls, as I do.
These are going to be some very
unsophisticated people.
Okay,
it's very easy to catch them on a phishing, and I talked about this a couple years ago when I was here.
They get into that system,
they have read-write to Granby, and
they can start looking around if they know what they're doing and getting read-write for the whole state, and they can cause a lot
of harm. So,
let's talk about one privilege that can be misused, and that's the other governmental vectors. Okay,
more times than not, I was talking about hosting an Amazon, more times than not, you'll see voter rolls
hosted by a third-party vendor.
Talked about these last year. These vendors are opaque.
They're not transparent.
There's a few of them, so they don't, there's not a lot of motivation to do a good job.
The one we're still using was tossed out of Georgia for election concerns.
But anyway, so you've got this read-write relationship
going back and forth between the Secretary of State. So here's your closed loop, and
security is all about that closed loop, right? Wrong! Because we also have motor voter.
Okay, motor voter allows folks to register to vote when they
get their driver's licenses, right? We all know what that is.
Well, we're past the days when we would exchange paper. I used to get paper stacks to update, right?
It's electronic. So what does that mean?
It means the DMV is
now also part of this closed loop because they're going to be writing into that master database.
They're not going to go through the Secretary of State. They're writing straight in.
In some cases, it's been discussed. I don't know if it's been done, but tax departments do.
So suddenly your closed loop
is only as closed as all this. I don't have a lot of faith in
the DMV and the tax departments, and this is from watching them over the years, with their security.
So this is a potential vector of attack that worries me a lot.
And
this is just how the loop would look like if you're one of these states that actually hosts the database
program yourself.
Again, we're talking database and election management.
Let's talk about defacement really quick.
I had this really entertaining
defacement model I had up there, but I realized it didn't really inform. So this is the website of the Alabama Secretary of State.
Here's a defaced version, and this is a message you're going to see me talk a lot about here.
What I've dummied up is something that says, important announcement, voting will be delayed one day due to terrorist threats on polling places.
These are messages that are already being pushed out there through robocalls.
A defacement attack. Now, how many people go and check the website before you go to vote? Not very many.
But it doesn't take very many before it becomes a point of discussion,
before it hits the media and people who aren't paying that much attention, or maybe aren't very sophisticated in understanding the media, start going,
wait, I heard there was a threat, should I be scared? And they don't go. So I worry about defacement. I'm trying to fly. I'm trying.
Whoo! Not too bad.
Okay. Now, defending against defacement is going to be defending against web server attacks. So I'll just,
I'll leave that. You want to know best practices for descending against web server attacks?
You probably already know, but you can check the white paper. It's all very simple.
But, I mean, all of this stuff, all of these best practices, I say they're simple, and I'm blowing them off. People don't do them.
And we're going to get to that. I'm going to talk a little bit about policies, too.
Wireless poll books. Wireless.
Wireless. What can I say about wireless, right? Wireless has all kinds of security issues. Poll books. Y'all know what poll books are?
Poll books are tablets that are used, that have the voter rolls on them, that are used to check in voters.
Okay?
For example, in Vermont, we don't have them, but I've dummied up my own on tablets.
But they're, they're, they're wired, and they're in a standalone network. I stay away from wireless as much as possible.
And this is just...
When I had great visions of going over the wireless a little more, particularly, you can see the history of it.
You go from open to WEP and WPA, and then TKIP pops up in AES.
Now we've got WPA3, which does away with the unencrypted sessions.
But, for those of you who are hackers, you'll hear that it's no longer susceptible to crack.
Don't believe it? It is. It's still got that four-way handshake. And it's still vulnerable.
So that worries me.
So what's the danger with wireless poll books? Well, it's the danger with wireless.
Particularly, the possibilities of man-in-the-middle attacks, and intercepting traffic, or just doing a denial-of-service attack.
Which would be plenty, right?
Now this is one of those that, you know, you're not going to have the Russians show up at your polling place
and mess up your wireless connection to your poll books, right?
This one in particular is one that concerns me about the sort of rogue local.
You know, someone who's an election conspiracy theorist,
who just wants to play that Joker thing, and cause havoc as much as they can,
because they think the system is corrupt, they think the system is out to get them,
and they're just going to be concerned with crashing it, because they're not going to trust anything that comes out of it anyways.
So, this is the kind of thing that worries me, that isn't going to worry, say, folks in Homeland Security.
But it could make my life very difficult.
Which is why I don't do it.
Cough, cough, cough.
Alright.
It's going to wreck my singing voice.
And this I just put up there for folks.
Entercap, Aircrack, Wireshark, Wash.
These are all, this goes to the script kiddie point, alright?
These are all things that, in one way or another, help you with a wireless hack.
Either by cracking passwords, or sniffing out information.
They're free.
They're easy to use.
They're everywhere.
So, you know, some of these are less applicable than others,
but I stretch out the definition a little bit to make my point.
Injection.
Alright.
Injection.
For those of you who don't know, injection refers, we're talking about a web application
for people like me to interface with my voter rolls and to run my election.
Injection would be an attack where you're sending commands behind that application.
You can send them behind the application to a database back there.
You can tell the database to delete data.
You can tell the database to drop data.
You can send commands to the OS.
You can send directory commands.
You can set up cross-site scripting and mess with other people's lives when they come up there.
SQL injection is the doozy here, and I'll tell you why.
It's a little bit ancient history now, but in 2016, when the Mueller report came out,
election mischief from the Russians in 2016,
there was a small part of it where they specifically cited SQL injection
as an attack that Russians had tried in every state,
and in at least one instance, I think it was a county in Florida,
successfully penetrated into the data behind the app.
Now, I'm going to beat up my old Secretary of State again,
because he used to talk about this.
And the reason I'm saying this is I think a lot of them do.
There's political motivation to not have problems in your system.
To say the other guy's got problems, we don't.
So he would brag that ours wasn't the one that got penetrated.
Well, how can he say that for sure, basically?
And I don't know how you get this sort of, let's say, a zero-trust mentality
that assumes a breach out to political interests.
It's very, very hard.
But if you deny there's a problem, and a lot of them do,
then you don't get to solve it.
This is an example of a login.
This is what we call the My Voter page.
I think all states have something like this.
You get your name in there, you can ask for an early ballot.
You can see the status of your ballot, if it's been counted yet, that kind of thing.
This is the kind of form that you could, this is just more examples,
pass information to the database behind it if it's not set up to block it,
or through the URL field.
Now, there are always new SQL attacks coming out,
but the fact is we know what to do about this.
Input validation, input sanitization.
We don't allow these single quotation marks, ampersands, asterisks.
You don't let them go in.
And yet, it was a vulnerability.
This is where I lose faith in those vendors even more.
They shouldn't have gotten that far.
If it was a SQL injection attack, they shouldn't have gotten that far.
Now, I'm sure it's much better now, but I still worry.
Now, one thing I'll say about this before I get lost, because I'm afraid I'm going to run out of time,
is we're going to talk about some ways, and this is the kind of thing that could have happened,
or that could happen with a mobile device hack, is simply intercepting login information.
And there's lots of ways you can intercept login information.
But if you do that, and I'm going to bring up that privilege escalation thing again.
I'm yelling so hard I'm forgetting my basic vocabulary. Bear with me.
That somebody who gets in there, just like somebody who gets into the Granby-Vermont voter system,
can potentially find ways to horizontally increase their privilege.
And that's stuff to worry about. Scary stuff, again.
We're not powerless with this stuff.
There are best practices that do a very good job, but I'm going to get to a little more of that.
This is just something I put up, if you're ever curious.
A guy named Shannon Wheeler did a graphic novel version of the Mueller Report.
It's brilliant. I love it.
Alright, number four. Online ballot hacking.
Who's got a state that does some kind of online voting?
Uh-oh. We got one. Got two.
We talked about it in Vermont this year. It didn't happen.
Now, the reasons for voting online are noble.
They tend to come down to the Uniformed and Overseas Citizens Absentee Voting Act.
You will call the voters.
This is the law set up to basically give service people deployed overseas, expats, a fair chance.
Because the mail is not reliable in a lot of these countries, right?
So you're supposed to allow enough time for them to receive the request in the mail, enough time to get it back.
It's problematic. Every election, I still get back.
I will get back ballots six months later for an election.
So it's a noble reason. You've also got disabled voters who have trouble getting to the polls.
And maybe didn't get their act together, get an early ballot. It happens.
So these are noble reasons to vote online.
But, there are obvious reasons not to.
And that's, once again, it's another opportunity to, especially if you're working from a mobile device,
it's another opportunity to intercept, grab somebody's session,
maybe get an open session cookie, stay in the system,
and do what you can in terms of escalating privileges, or just canceling out their vote.
But I'll tell you, that's not what really worries me.
What worries me is the much lower tech version, and that's large-scale voter suppression.
Okay, think for a moment here. You've got online voting in your state.
And the problem is, it's not going to stay at just UOCAVA voters.
Because what's sauce for the goose is sauce for the gander.
Eventually you get to a point where, if they can vote online, why can't I?
Right? So once we get to large-scale online voting,
you've got incredible opportunities for voter suppression.
Phishing emails generally are 19-20% effective.
Targeted phishing emails can be 70% effective.
Imagine targeted email to a particular demographic group,
based on older voters, younger voters, minorities,
basically crafted for that group, saying,
here's the link to go vote. Go do it.
All they know is, we've got online voting.
Look at this. It comes from the Secretary of State. Boom. Okay?
They've lost their vote. They may have also lost their ID in the process.
This would be very simple, and it could be in such numbers
that we're no longer talking about mischief and inconvenience.
You know, what we do here with Voting Village is amazing.
It's amazing stuff.
But if you really want to talk about changing a result of an election,
you're looking right at it.
That's the biggest concern, in my opinion, that exists for that kind of thing.
So, not a fan.
Now we're getting up to the stuff that's so generic,
but it has to be there, because it's so obvious, it's generic.
What are you going to do? Unpatched legacy or legacy software?
Unpatched software.
Why don't we patch software?
I don't understand this.
I mean, I'm not an admin.
Maybe it takes up more of your life than I think, right?
I'm just an elections guy.
And I license dogs, because I'm a city clerk, right?
But...
Starting to go.
So, it's one of the three or four broadest ones,
but I tell you, if you combine unpatched software with phishing,
you've got 95% of your hacks right there.
So we've got to be serious about this.
And again, I don't necessarily trust the vendors,
knowing that some of them, in my opinion,
the one I'm currently using, in my opinion, is kind of a slipshod product.
Now, mitigation...
Mitigation on the enterprise is going to be about policies.
It's another thing I don't trust.
I mean, any good enterprise has got to have...
got to have policies, got to have logging management policies,
incident management, change management, patch and vulnerability management.
Again, this is all best practices.
Also, I think just in general, I'm going to put in a pitch for Zero Day.
The Center for Internet Security, which is sort of a non-profit connective tissue
between the Department of Homeland Security and us locally,
is very much pushing a zero security model.
It assumes a breach.
It's got the principle of least privilege on steroids.
And it also has micro-segmentation.
It assumes anything anomalous is a breach.
And it acts in that way. It's a great thing there.
I've done my pitch. I would love to do a whole half an hour on Zero Trust.
So that's Zero Trust.
It talked about security. It talked about Zero Trust.
So we've got to be vigilant with these vendors.
And I didn't get to be Secretary of State, so I'm not sure how you do that.
Because these smaller states... well, no, I am sure I did.
I'm going to get to that in a minute. I do have an answer to that.
Local Secretaries of State just don't have the kind of pull in such a small marketplace
to have an impact on some of these vendors and make sure they're doing things right.
I suspect they are not necessarily creating their software in a responsible way.
Okay, number two. Physical security.
Physical social engineering, okay?
It's what we're doing over here.
Physical security, again, is not something that you're going to have to worry about from the Russians or the Chinese or the Iranians.
But I have to worry about it, and it's a big deal.
It can be a bigger deal if you're talking about network systems, but I'm not even going to go there.
So, examples of physical security.
Physical defense in depth, protecting ballots and tabulators, authorized personnel restrictions, gates, locked doors, vaults, even security personnel.
Because physical social engineering is a thing, okay?
I had a teacher who was so hardcore about this.
Oh, my God. He actually, when he was, he would pen test for real, right?
He wouldn't just do one of these out-of-the-box pen test things.
He'd go nuts with the physical stuff, too.
He actually built, created a card reader for his hand that he would try to get close to badges, access badges.
I don't know that it ever worked. I think it's brilliant.
I know he gave me a good story about how it was miserable.
Like falling, he was at a Starbucks and he tried to fake falling down.
It was hilarious.
But this is a message that needs to get out there.
And that I think folks in IT and information systems forget.
And that's that physical security is cyber security.
Physical security is cyber security.
I would have put this number one. I want to preach this so much.
Except that number one is too obvious.
I feel like I'd lose credibility if I didn't put number one at number one.
Number one! Woo!
All right, that got the room.
Social engineering. Fishing. Cross-site request forgery.
Spearfishing. Farming.
That's it. Raise your hand if you were surprised.
Yeah, all right. Everything we have talked about, just about,
can be perpetuated by social engineering.
So I'm not even going to spend so much time in that cross-site scripting.
If you want to know about it, check the paper.
Another type of social engineering we mentioned is phone spamming.
I already mentioned it because I'm trying to crowd it all together.
Phone spamming happens. This is not theoretical.
I take part in every election day, or at least the big elections,
I'll sit in a virtual war room that the EI Isaac puts together
that's got election administrators at all levels from across the country
all sort of reporting into each other.
You'd think it'd be chaos, but people have other things to do,
so they're not talking about what their kids are doing or anything.
But anyways, every time for the last few years,
I don't have to wait too long before somebody reports
there's robocalls going out into my jurisdiction telling people not to vote.
Telling people it's dangerous. Telling people the election has been delayed.
And how can we even tell how well that works?
It's another thing that could actually throw an election, but who would know?
So this stuff is very serious. These are all headlines, obviously,
so just to prove I'm not making it up, you've got Virginia, you've got North Carolina,
Florida, the one I know of was Idaho.
It's only going to increase. It was bigger this last general election than it was the time before.
I think it's going to be off the charts for this coming election.
A special mention. I've done my 10, but I can't stop with just 10,
even though I don't have time to go over 10.
I was involved in a tabletop exercise that included members of the military.
I was blue team, and I was really surprised how concerned they were with public infrastructure hacks.
A lot of them happen. I've got some examples up here.
Again, we're in a hurry. I won't go over them, but you can take a look.
There's a lot more. You see a lot of these in Europe that you don't see as many.
This is just the last year, really. You don't see as many of them in the U.S.,
but you do see them, and there's no reason we won't see more.
A public infrastructure attack would be, imagine in the middle of election day,
every stoplight in the city goes red.
That's a way to mess up an election.
Imagine it happened in multiple cities.
You could really, really choke things down. Choke things up. Shut things down.
My metaphors are losing me.
So, I didn't really go over best practices, but they're in here.
So, let's say we're doing everything right.
Mitigating everything, every way we should.
We're in the clear, right?
Yeah?
Well, being 100% secure is a fantasy.
It will always be a fantasy.
So, nothing is guaranteed unhackable, so should everybody freak out.
No. Okay? Absolutely not.
And this is what I tell people.
I tell people, look, there's going to be hacks.
It's going to happen occasionally. If nothing else, the phones.
But it's just the nature of the world.
But if we're doing everything right, if we're doing everything we should,
if we're following best practices,
then that doesn't have to do anything more
than slow down the final results for a few weeks.
You know, back in Vermont, it wasn't that long ago that we had to have a recount
because one of the town clerks found a bunch of boxes of uncounted votes.
And that slowed down the final results by a few weeks.
This can be the modern version of that.
If we're doing everything we should, with paper backups,
with responsible security, with responsible physical security,
we will get the answers of our elections and they will be correct.
But we just might have to cool our jets and wait a while to get them.
But that's the price you pay for getting it right.
I firmly believe this. And this is why I talk about this.
This is why we should talk about this.
This is what keeps this from all being a big exercise in nihilism.
Right? And this is also why people don't want to talk about it.
Because it's scary.
But if you get to the point of telling folks,
we're going to do everything right, let's shine the sunshine on everything
so you can see we're doing everything right.
Let's talk about it.
Then I think it's nothing but positive we should be getting out there.
All right, got a little time.
Some good ideas for secure election process.
Physically secure tabulators and ballots.
Minimal user access.
Dedicated election management workstations.
Shouldn't be doing anything on an election computer other than elections.
Election workstations with mission-critical websites.
Whitelisted, nothing else.
No email.
Multi-factor or passwordless encryption, obviously.
USB disabled unless that's where your token is.
Et cetera.
Paper ballot backup.
Paper ballot.
Paper checklist.
Now let me say something about open source.
I've been beating up the vendors
and I've been saying that a lot of these small states are hostages to these vendors.
Well, they don't have to be.
I mean, ideally, if you're going to have a vendor,
given that advanced persistent threats that move very slow, that move under IDSs,
given that the Russians and whoever are working 24-7,
what's the answer to 24-7 hackers?
It'd be 24-7 pen testing.
Which is something I've advocated for.
Buy pen testers. Get them on your staff.
Have them working constantly.
Is that going to happen? No.
So what should we do?
We should go to open source.
Open source, yes, I know it has its own challenges,
but the open source community for election management,
for election database systems, would be so robust.
I think the advantages to security would be enormous.
The cost would be better.
It's just all around.
I am a strong advocate of open source.
It's actually what I ran on for Secretary of State and got squashed,
but it was nice to be out there saying it.
Okay.
Honorable mentions.
Physical threats to election staff and voting places, including doxing and swatting.
Election administrator offices being compromised by bad actors.
Good election administrators getting run out of office
and being replaced by people who are not good election administrators.
And, of course, social media disinformation,
which is its own huge topic,
and folks will tell you that that is the number one problem with elections these days.
May or may not be.
I don't think, I don't know that I agree with that,
but if not, it's number two.
Now, conspiracy theories.
And this is what I'm going to end on.
We get accused here of promoting conspiracy theories,
and conspiracy theories are the things that, you know,
that are really screwing up a lot of our elections these days.
But the fact is what we're doing, what's happening over here,
what's happening with these talks, is sunlight.
Now you're starting to get the metaphor now, aren't you?
See where I'm going with this.
Sunlight.
Conspiracy theories thrive when people don't know and they don't understand.
I mean, there's always going to be people who don't believe.
There will always be conspiracy theories.
But they take hold in the dark.
In the shadow.
And sunlight is what makes conspiracy theories go away.
Once and for all.
So.
Oh my God.
I have never flown through,
in any practice, this presentation in less than 50 minutes,
and I think we're almost on track.
I've got about 10 minutes left.
I don't know if anybody has any questions or observations.
Don't make them too techy because I'm a script kiddie.
Anything?
Ah.
So some of the scenarios you've described are problems because we've got elections that are one day, you know.
Yeah.
It's, you know, you can tell people, hey, come back and vote tomorrow.
Or, hey, you know, we're going to stop up all the traffic so you can't get to your polling place, so you can't actually vote before the polling place is closed.
Right.
Would these problems that you've described, this class of problems, be mitigated by actually making elections, like, over a week or over a month?
Or would that just introduce new problems, new vectors for attack that wouldn't be effective in a one day election, that would be effective...
If we had more than one day.
Multi-day elections.
The question is, a lot of these vectors of attack look like they're particularly effective if you were talking a single election day.
And wouldn't it be safer, elections be more protected if we had an election season, basically.
Which, yes, absolutely. I'm a huge proponent of early voting. That's where you start with.
Have an election season.
Hopefully we don't all wait to the last minute to pay our bills. We have a bill-paying month. We have a bill-paying season.
So yes, a lot of these, if we can encourage people to vote early, they get around a lot of these problems.
You know, there are states that are doing just vote-by-mail. And whatever unique challenges there are to that, they avoid many, many, many of the challenges I brought up.
So yeah, election season, vote-by-mail, woo-hoo!
I can talk last.
Oh, I'll repeat it. I was going to repeat it because I have a big booming voice.
So you talked about CI0.
Trust.
How do other election officials, how are they accepting that?
Because that seems to be a very novel idea for a lot of election officials who don't want to accept that their systems could be breached.
That they kind of don't see that as a possibility.
And then I also did want to make a plug for the panel tomorrow on online voting because I know you talked about it.
If anybody wants to hear more about online voting, tomorrow at 10.30 we're doing a panel on online voting.
Uh-oh. I don't know if you want me there.
No, we can sit.
Oh, okay. I'll be there. Alright.
So the question was, in a nutshell, how do you get election administrators to accept a zero-trust, not just a model but an entire mentality, really, of assuming a breach?
I don't know, because it flies in the face of politics.
Politics, the political viewpoint at the top when you're talking elected secretaries of state, is to assure everybody at all costs there are no problems.
They're not going to want to hear about it.
So that's going to have to be... boy, that's a tough question.
But I have to say that's going to have to be more of a grassroots movement from the local election administrator level up.
We'd have to normalize that conversation.
And I may be being cynical, but I don't see secretaries of state doing that.
We're going to do something unusual and end on schedule.
So thank you so much, Don.
Thank you so much.
And in particular, thanks for a really terrific talk under terribly suboptimal conditions.
So an extra round of applause for that.
So thank you.