WEBVTT 00:10.320 --> 00:12.380 So my name is John Odom. 00:12.380 --> 00:18.300 I'm the city clerk in Montpelier, Vermont, and in that capacity I'm also the election administrator. 00:18.620 --> 00:25.180 I'm also a certified ethical hacker and a couple other certs, but that's the one that gives me a right to be here, I think. 00:25.480 --> 00:41.440 So what I've got to present, based on the paper I put together, is it was supposed to be a little techie, a little not techie, because most folks who come to Voting Village to hear the speakers aren't generally tech-oriented. 00:41.600 --> 00:42.380 Whoa! 00:42.940 --> 00:43.560 What? 00:43.560 --> 00:44.400 Where's that? 00:44.400 --> 00:45.180 Okay. 00:45.700 --> 00:50.360 So every time I've run this presentation, it's gone about 50 minutes. 00:50.360 --> 00:53.600 So that means all the tech is going out of it. 00:53.600 --> 00:54.560 And it wasn't much. 00:54.560 --> 00:57.020 What I was going to present was basically... Oh, we're back. 00:57.020 --> 00:57.800 All right. 00:57.800 --> 01:01.160 What I was going to present was basically some best practices. 01:01.160 --> 01:05.420 And these are best practices hopefully everybody's already doing. 01:05.500 --> 01:06.120 I'm sorry. 01:06.120 --> 01:06.740 I don't get it. 01:06.740 --> 01:07.460 You can't hear? 01:09.380 --> 01:10.260 Nope. 01:10.400 --> 01:11.260 All right. 01:11.760 --> 01:12.640 Anyways. 01:13.060 --> 01:21.200 So this is going to start a little techier, going to get into policy, hopefully not be very techie at all, and let's get going here. 01:21.200 --> 01:26.800 Okay, just if I'm going to talk Top Ten anything, I should mention that OWASP has its own Top Ten. 01:26.800 --> 01:30.200 You're all probably familiar with it, or at least some of you. 01:30.200 --> 01:31.400 They're Top Ten threats. 01:31.400 --> 01:35.040 They sort of periodically update it, but it's worth checking. 01:35.120 --> 01:37.780 You're going to hear a lot of a lot of repeats here. 01:37.780 --> 01:46.860 But my concern as an election administrator is strictly about what gets in my way for running my election. 01:47.060 --> 01:55.820 Which nine times out of ten would be me losing contact with, or me losing contact with, a voter database system. 01:55.820 --> 01:58.800 Where my poll, where my voters are listed. 01:59.120 --> 02:03.280 Got to be able to check in voters, and got to make sure everybody's voted only once. 02:03.280 --> 02:09.340 So what I've got is in that direction. 02:09.620 --> 02:13.260 Now ScriptKitty, for those of you who aren't techie, that's somebody... 02:14.160 --> 02:21.360 Well, since I've been a clerk for 12 years now, and haven't done anything techie, that would be someone like me, probably, actually. 02:21.360 --> 02:23.880 I'm a total Metasploit baby at this point. 02:24.100 --> 02:29.480 I've completely lost track of the skills, so take what I say with a grain of salt. 02:29.480 --> 02:37.720 But the point is, if you don't think I could do damage in an election as atrophied as my skills are, you're mistaken. 02:38.040 --> 02:43.720 This stuff is not... I mean, to do it well, to do anything well, is hard. 02:43.720 --> 02:46.420 To hack well is incredibly hard. 02:46.420 --> 02:57.580 But to hack good enough, if you get over any intimidation you have about working with Linux and some basic understanding, this stuff is not hard. 02:57.680 --> 03:02.500 And I want to make that clear to folks who don't, who don't get involved in this kind of stuff. 03:02.500 --> 03:20.700 You've got worries of advanced persistent threats, sure, from Russia, from China, from Iran, from North Korea, but nowadays there's enough conspiracy in the air that we have to worry, in some cases, about folks around the corner who are just going to cause mischief. 03:20.720 --> 03:24.300 So you're going to see a couple of these hacks that worry me based on that. 03:24.300 --> 03:26.080 Now, I'm going to try to fly through this. 03:26.080 --> 03:28.400 I'm already off to a very bad start. 03:29.120 --> 03:31.120 Okay, the number 10. 03:31.120 --> 03:34.380 And these are arbitrary, almost arbitrary. 03:34.380 --> 03:38.680 Bear in mind, if I did the top 10 today, it'd be totally different, probably. 03:38.680 --> 03:42.960 But this is a cloud host attack, and I'm specifically talking about Amazon. 03:43.580 --> 03:52.840 Okay, Amazon, the civic system has been used to host as much as a quarter of voters in the country. 03:53.960 --> 03:59.920 Now, I'm not going to beat anybody up for hosting their voter management system, their voter database, on Amazon. 03:59.920 --> 04:01.880 There's a million reasons to do it. 04:02.160 --> 04:04.220 I would probably do it myself. 04:04.280 --> 04:06.500 I don't even have to go through. 04:06.520 --> 04:09.480 But this is a target. 04:09.900 --> 04:15.300 Okay, it was hit by a massive distributed denial-of-service attack. 04:15.800 --> 04:22.280 2.3 Tbps, 74% higher than anybody had ever seen just a few years ago. 04:22.280 --> 04:30.060 If somebody wanted to cause mischief, they could take down that system on Election Day, and they could cause a lot of chaos. 04:30.160 --> 04:36.760 What I've got is a list up here that I'll just let you, I'm not going to go through, of you know, possible issues. 04:36.760 --> 04:38.800 It's stuff you'd expect. 04:38.800 --> 04:44.100 Insecure secret storage, injection flaws, we're certainly going to talk more about injection in general. 04:44.900 --> 04:50.720 Improper assets management, and there's, of course, malware now. 04:50.720 --> 04:56.400 We've got things like Denonia and Lemonduck. 04:56.400 --> 05:02.380 You know, these are things for crypto jacking or crypto mining, but they're proof of concept, basically. 05:02.380 --> 05:04.840 So there is the possibility for malware. 05:05.640 --> 05:06.540 All right. 05:07.360 --> 05:08.560 Mitigation. 05:08.680 --> 05:10.340 What are you going to do, right? 05:10.340 --> 05:15.380 I would say we talk about paper backups for ballots all the time. 05:15.380 --> 05:18.840 A lot of places are still using paper checklists. 05:18.840 --> 05:20.440 We do in Vermont. 05:21.020 --> 05:22.620 Paper, paper, paper. 05:22.620 --> 05:31.960 If this goes down, if for any reason my connection to the voter database goes down, if I've got paper checklists to check people in, I'm good. 05:32.280 --> 05:39.680 If I've got Election Day registration, which about 11 places have, I'm really good. 05:39.680 --> 05:46.840 Because if somebody gets their name knocked off the rolls, come in, register them, get them voting, you know. 05:46.840 --> 05:56.560 And we have to err on the side of letting people vote until we see some evidence that fraud is an actual problem. 05:56.920 --> 06:01.320 So, anyways, backup, backup, paper, paper. 06:01.320 --> 06:02.420 9. 06:02.420 --> 06:03.580 Mobile devices. 06:03.580 --> 06:06.120 Oh, I'd love to spend an hour talking about everything. 06:06.120 --> 06:09.420 I mean, who isn't talking about mobile devices? 06:09.420 --> 06:10.460 SMS? 06:11.140 --> 06:12.520 Forget it. 06:12.520 --> 06:13.660 Not secure. 06:13.660 --> 06:15.400 You have to use it, use an app. 06:15.400 --> 06:17.000 You have to use your phones. 06:17.080 --> 06:22.900 Still, that does, there's, there's other ways to create man-in-the-middle attacks through SS7 attacks. 06:23.060 --> 06:32.380 SS7 is the old telephony, telephony, telephony, going way back to the 70s that still about three-quarters of the world uses. 06:32.460 --> 06:41.420 All you need is an aggregator and a global title, which you could get from a phone company and you could create a man-in-the-middle attack. 06:42.240 --> 06:46.480 So, I know this is, I don't mean to scare people. 06:46.480 --> 06:47.300 There's a point. 06:47.300 --> 06:52.880 I'm going to get to something that's positive and, and joyful and uplifting by the end of this, I swear. 06:53.060 --> 07:04.140 But, so this is used for, we already went over that, it's used for multi-factor authentication. 07:04.280 --> 07:09.000 Now, I'm going to beat up a little on my last, my last Secretary of State. 07:09.000 --> 07:13.060 When they set up two-factor authentication with one factor being SMS. 07:13.440 --> 07:15.600 Oh, he was so proud of himself. 07:15.600 --> 07:16.860 Oh my god. 07:16.980 --> 07:19.740 It's like it was the end-all be-all of security. 07:19.800 --> 07:24.240 And honest to God, that's still what I'm using, is SMS. 07:25.140 --> 07:27.680 I think that's going to change soon. 07:27.680 --> 07:33.380 I did run for Secretary of State, got a whopping 16%, and I made a big deal about this. 07:34.820 --> 07:39.240 But, you know, multi-factor can be three factors. 07:39.240 --> 07:41.140 There's plenty of other factors we can use. 07:41.140 --> 07:47.800 If we're talking about dedicated workstations for election management, you can use biometrics. 07:47.800 --> 07:50.280 You can have a token on a fob. 07:50.280 --> 07:51.840 Lots of things you can do. 07:51.840 --> 07:54.960 And I'm, I'm losing faith in passwords in general. 07:55.000 --> 07:59.900 Honestly, I mean, I'm, passwordless is more and more the way to go. 07:59.900 --> 08:10.460 Although, I'll tell you, my favorite password trick is to take a couple verses of your favorite song or poem, take the first letter from each one, mix in some special characters. 08:10.460 --> 08:11.740 Awesome password. 08:11.940 --> 08:13.560 I highly recommend it. 08:13.820 --> 08:14.540 Okay. 08:15.300 --> 08:19.080 Now, this is a surface, a threat surface, you don't hear much about. 08:19.480 --> 08:22.280 Intragovernmental credential harvesting and escalation. 08:22.580 --> 08:23.360 Okay. 08:25.240 --> 08:26.900 I'm going to do the quick version. 08:26.900 --> 08:30.780 I'm going to skip half of what I have up here because we're, we're short on time. 08:31.120 --> 08:45.380 So, I don't know if you can see this, but I wanted to put this up there just, this is an analysis that was done several years ago of a lot of hacks, their sources, the motivations, the type of attack. 08:45.640 --> 08:48.880 I want to show you right here, public administration. 08:49.540 --> 08:52.640 We got a big red dot on privilege misuse. 08:52.640 --> 08:58.980 Okay, and that's what I'm about to talk about, and I'm going to talk about a lot, is privilege escalation. 08:59.380 --> 09:07.220 Okay, and again, I don't know how technical anybody is, privilege escalation, doing the best I can, sorry. 09:08.100 --> 09:10.180 I don't have a microphone. 09:10.220 --> 09:10.720 No, I'm just... 09:12.260 --> 09:13.200 What's that? 09:15.960 --> 09:19.540 No, because I'm, I got my water up here. 09:19.540 --> 09:20.760 It's all good. 09:20.960 --> 09:22.180 I'll just yell. 09:24.660 --> 09:31.300 So, you'll see a big red dot, which refers to espionage under privilege misuse. 09:31.400 --> 09:46.360 So, this is going to be a major vector for any potential hack for an election, is getting in there and starting to work your way up in terms of privilege and login, you know, authentication authority. 09:46.400 --> 09:53.880 Okay, especially, especially when you consider that, well, let me give you an example of New England, all right. 09:53.880 --> 09:57.760 New England voter jurisdictions are by town. 09:58.060 --> 10:01.500 Okay, that means Boston is a voter jurisdiction. 10:01.500 --> 10:06.620 The Boston election administrator, that's their responsibility. 10:06.780 --> 10:08.520 I'm an election administrator. 10:08.520 --> 10:11.500 My responsibility is about 8,000 people. 10:11.760 --> 10:18.720 When I ran for Secretary of State, I won two towns, my town and the town of Granby, Vermont. 10:18.720 --> 10:22.960 I won with a whopping three votes, the other two got one. 10:23.080 --> 10:37.440 Okay, we're talking very small jurisdictions, and the election administrators in those jurisdictions have the same rights to the voter management system, the voter rolls, as I do. 10:37.440 --> 10:41.660 These are going to be some very unsophisticated people. 10:41.720 --> 10:49.060 Okay, it's very easy to catch them on a phishing, and I talked about this a couple years ago when I was here. 10:49.060 --> 10:58.620 They get into that system, they have read-write to Granby, and they can start looking around if they know what they're doing and getting read-write for the whole state, and they can cause a lot of harm. 10:58.620 --> 11:06.040 So, let's talk about one privilege that can be misused, and that's the other governmental vectors. 11:06.240 --> 11:19.260 Okay, more times than not, I was talking about hosting an Amazon, more times than not, you'll see voter rolls hosted by a third-party vendor. 11:19.560 --> 11:21.100 Talked about these last year. 11:21.100 --> 11:23.020 These vendors are opaque. 11:23.080 --> 11:25.140 They're not transparent. 11:25.140 --> 11:29.920 There's a few of them, so they don't, there's not a lot of motivation to do a good job. 11:29.920 --> 11:33.840 The one we're still using was tossed out of Georgia for election concerns. 11:33.840 --> 11:40.340 But anyway, so you've got this read-write relationship going back and forth between the Secretary of State. 11:40.340 --> 11:45.620 So here's your closed loop, and security is all about that closed loop, right? 11:45.620 --> 11:46.400 Wrong! 11:46.400 --> 11:48.840 Because we also have motor voter. 11:49.080 --> 11:56.140 Okay, motor voter allows folks to register to vote when they get their driver's licenses, right? 11:56.140 --> 11:57.520 We all know what that is. 11:57.520 --> 11:59.980 Well, we're past the days when we would exchange paper. 11:59.980 --> 12:03.020 I used to get paper stacks to update, right? 12:03.020 --> 12:03.860 It's electronic. 12:03.860 --> 12:05.240 So what does that mean? 12:07.300 --> 12:15.660 It means the DMV is now also part of this closed loop because they're going to be writing into that master database. 12:15.660 --> 12:17.800 They're not going to go through the Secretary of State. 12:17.800 --> 12:19.600 They're writing straight in. 12:20.220 --> 12:22.760 In some cases, it's been discussed. 12:22.760 --> 12:26.460 I don't know if it's been done, but tax departments do. 12:26.700 --> 12:31.860 So suddenly your closed loop is only as closed as all this. 12:32.080 --> 12:41.160 I don't have a lot of faith in the DMV and the tax departments, and this is from watching them over the years, with their security. 12:41.740 --> 12:46.740 So this is a potential vector of attack that worries me a lot. 12:48.280 --> 12:56.600 And this is just how the loop would look like if you're one of these states that actually hosts the database program yourself. 12:56.600 --> 13:00.240 Again, we're talking database and election management. 13:00.840 --> 13:03.640 Let's talk about defacement really quick. 13:04.100 --> 13:10.960 I had this really entertaining defacement model I had up there, but I realized it didn't really inform. 13:10.960 --> 13:14.800 So this is the website of the Alabama Secretary of State. 13:15.000 --> 13:20.580 Here's a defaced version, and this is a message you're going to see me talk a lot about here. 13:20.580 --> 13:29.020 What I've dummied up is something that says, important announcement, voting will be delayed one day due to terrorist threats on polling places. 13:29.240 --> 13:33.640 These are messages that are already being pushed out there through robocalls. 13:33.880 --> 13:35.400 A defacement attack. 13:35.400 --> 13:38.500 Now, how many people go and check the website before you go to vote? 13:38.500 --> 13:39.480 Not very many. 13:39.480 --> 13:51.180 But it doesn't take very many before it becomes a point of discussion, before it hits the media and people who aren't paying that much attention, or maybe aren't very sophisticated in understanding the media, start going, wait, I heard there was a threat, 13:51.180 --> 13:51.880 should I be scared? 13:51.880 --> 13:52.900 And they don't go. 13:53.220 --> 13:54.900 So I worry about defacement. 13:54.900 --> 13:56.240 I'm trying to fly. 13:56.280 --> 13:57.200 I'm trying. 13:57.200 --> 13:57.760 Whoo! 13:57.760 --> 13:58.860 Not too bad. 13:59.520 --> 14:00.200 Okay. 14:00.460 --> 14:04.740 Now, defending against defacement is going to be defending against web server attacks. 14:04.820 --> 14:07.400 So I'll just, I'll leave that. 14:07.400 --> 14:11.500 You want to know best practices for descending against web server attacks? 14:11.500 --> 14:14.100 You probably already know, but you can check the white paper. 14:14.320 --> 14:15.480 It's all very simple. 14:15.480 --> 14:21.560 But, I mean, all of this stuff, all of these best practices, I say they're simple, and I'm blowing them off. 14:21.560 --> 14:22.980 People don't do them. 14:24.660 --> 14:26.120 And we're going to get to that. 14:26.120 --> 14:28.440 I'm going to talk a little bit about policies, too. 14:28.860 --> 14:30.220 Wireless poll books. 14:30.220 --> 14:31.080 Wireless. 14:32.360 --> 14:33.060 Wireless. 14:33.060 --> 14:35.360 What can I say about wireless, right? 14:35.620 --> 14:38.060 Wireless has all kinds of security issues. 14:38.060 --> 14:38.580 Poll books. 14:38.580 --> 14:40.460 Y'all know what poll books are? 14:41.740 --> 14:48.120 Poll books are tablets that are used, that have the voter rolls on them, that are used to check in voters. 14:48.720 --> 14:49.260 Okay? 14:50.200 --> 14:54.340 For example, in Vermont, we don't have them, but I've dummied up my own on tablets. 14:54.340 --> 14:59.600 But they're, they're, they're wired, and they're in a standalone network. 14:59.600 --> 15:02.240 I stay away from wireless as much as possible. 15:02.640 --> 15:03.860 And this is just... 15:05.460 --> 15:11.880 When I had great visions of going over the wireless a little more, particularly, you can see the history of it. 15:11.880 --> 15:18.240 You go from open to WEP and WPA, and then TKIP pops up in AES. 15:18.240 --> 15:23.940 Now we've got WPA3, which does away with the unencrypted sessions. 15:24.380 --> 15:30.580 But, for those of you who are hackers, you'll hear that it's no longer susceptible to crack. 15:30.580 --> 15:32.060 Don't believe it? 15:32.060 --> 15:32.500 It is. 15:32.500 --> 15:34.780 It's still got that four-way handshake. 15:34.780 --> 15:36.540 And it's still vulnerable. 15:36.900 --> 15:38.880 So that worries me. 15:43.480 --> 15:46.260 So what's the danger with wireless poll books? 15:46.260 --> 15:47.960 Well, it's the danger with wireless. 15:47.980 --> 15:59.360 Particularly, the possibilities of man-in-the-middle attacks, and intercepting traffic, or just doing a denial-of-service attack. 15:59.360 --> 16:02.060 Which would be plenty, right? 16:03.480 --> 16:13.960 Now this is one of those that, you know, you're not going to have the Russians show up at your polling place and mess up your wireless connection to your poll books, right? 16:13.960 --> 16:20.640 This one in particular is one that concerns me about the sort of rogue local. 16:21.520 --> 16:37.860 You know, someone who's an election conspiracy theorist, who just wants to play that Joker thing, and cause havoc as much as they can, because they think the system is corrupt, they think the system is out to get them, and they're just going to be concerned with crashing it, 16:37.860 --> 16:41.020 because they're not going to trust anything that comes out of it anyways. 16:41.100 --> 16:48.780 So, this is the kind of thing that worries me, that isn't going to worry, say, folks in Homeland Security. 16:49.240 --> 16:51.960 But it could make my life very difficult. 16:52.260 --> 16:53.580 Which is why I don't do it. 16:55.560 --> 16:57.400 Cough, cough, cough. 16:57.940 --> 16:59.140 Alright. 17:00.040 --> 17:02.460 It's going to wreck my singing voice. 17:04.860 --> 17:07.720 And this I just put up there for folks. 17:07.940 --> 17:12.580 Entercap, Aircrack, Wireshark, Wash. 17:12.840 --> 17:16.480 These are all, this goes to the script kiddie point, alright? 17:16.560 --> 17:22.380 These are all things that, in one way or another, help you with a wireless hack. 17:22.380 --> 17:27.340 Either by cracking passwords, or sniffing out information. 17:27.740 --> 17:29.660 They're free. 17:30.020 --> 17:32.080 They're easy to use. 17:32.080 --> 17:33.600 They're everywhere. 17:33.800 --> 17:42.640 So, you know, some of these are less applicable than others, but I stretch out the definition a little bit to make my point. 17:44.640 --> 17:46.160 Injection. 17:46.840 --> 17:48.060 Alright. 17:48.780 --> 17:49.620 Injection. 17:49.620 --> 18:03.500 For those of you who don't know, injection refers, we're talking about a web application for people like me to interface with my voter rolls and to run my election. 18:03.720 --> 18:10.200 Injection would be an attack where you're sending commands behind that application. 18:10.460 --> 18:14.620 You can send them behind the application to a database back there. 18:14.620 --> 18:17.700 You can tell the database to delete data. 18:17.700 --> 18:20.160 You can tell the database to drop data. 18:20.160 --> 18:23.260 You can send commands to the OS. 18:23.720 --> 18:27.060 You can send directory commands. 18:27.260 --> 18:32.360 You can set up cross-site scripting and mess with other people's lives when they come up there. 18:34.460 --> 18:38.040 SQL injection is the doozy here, and I'll tell you why. 18:38.280 --> 18:59.940 It's a little bit ancient history now, but in 2016, when the Mueller report came out, election mischief from the Russians in 2016, there was a small part of it where they specifically cited SQL injection as an attack that Russians had tried in every state, 18:59.940 --> 19:08.680 and in at least one instance, I think it was a county in Florida, successfully penetrated into the data behind the app. 19:09.620 --> 19:14.760 Now, I'm going to beat up my old Secretary of State again, because he used to talk about this. 19:14.760 --> 19:19.860 And the reason I'm saying this is I think a lot of them do. 19:19.860 --> 19:24.380 There's political motivation to not have problems in your system. 19:24.380 --> 19:27.020 To say the other guy's got problems, we don't. 19:27.020 --> 19:31.980 So he would brag that ours wasn't the one that got penetrated. 19:32.120 --> 19:37.140 Well, how can he say that for sure, basically? 19:37.600 --> 19:48.140 And I don't know how you get this sort of, let's say, a zero-trust mentality that assumes a breach out to political interests. 19:48.140 --> 19:50.040 It's very, very hard. 19:50.100 --> 19:56.300 But if you deny there's a problem, and a lot of them do, then you don't get to solve it. 19:56.800 --> 20:02.880 This is an example of a login. 20:02.900 --> 20:05.460 This is what we call the My Voter page. 20:05.500 --> 20:07.880 I think all states have something like this. 20:07.880 --> 20:11.000 You get your name in there, you can ask for an early ballot. 20:11.000 --> 20:16.820 You can see the status of your ballot, if it's been counted yet, that kind of thing. 20:17.580 --> 20:34.930 This is the kind of form that you could, this is just more examples, pass information to the database behind it if it's not set up to block it, or through the URL field. 20:34.930 --> 20:43.070 Now, there are always new SQL attacks coming out, but the fact is we know what to do about this. 20:43.390 --> 20:47.410 Input validation, input sanitization. 20:47.470 --> 20:53.650 We don't allow these single quotation marks, ampersands, asterisks. 20:53.650 --> 20:55.870 You don't let them go in. 20:57.590 --> 21:01.330 And yet, it was a vulnerability. 21:01.410 --> 21:05.030 This is where I lose faith in those vendors even more. 21:05.030 --> 21:07.570 They shouldn't have gotten that far. 21:08.470 --> 21:12.930 If it was a SQL injection attack, they shouldn't have gotten that far. 21:14.530 --> 21:20.210 Now, I'm sure it's much better now, but I still worry. 21:23.260 --> 21:43.560 Now, one thing I'll say about this before I get lost, because I'm afraid I'm going to run out of time, is we're going to talk about some ways, and this is the kind of thing that could have happened, or that could happen with a mobile device hack, is simply intercepting login information. 21:44.560 --> 21:47.860 And there's lots of ways you can intercept login information. 21:48.140 --> 21:55.420 But if you do that, and I'm going to bring up that privilege escalation thing again. 21:55.420 --> 21:58.120 I'm yelling so hard I'm forgetting my basic vocabulary. 21:58.120 --> 21:59.380 Bear with me. 22:00.060 --> 22:13.580 That somebody who gets in there, just like somebody who gets into the Granby-Vermont voter system, can potentially find ways to horizontally increase their privilege. 22:14.140 --> 22:16.120 And that's stuff to worry about. 22:16.120 --> 22:18.140 Scary stuff, again. 22:18.500 --> 22:20.980 We're not powerless with this stuff. 22:20.980 --> 22:27.240 There are best practices that do a very good job, but I'm going to get to a little more of that. 22:27.240 --> 22:29.880 This is just something I put up, if you're ever curious. 22:29.880 --> 22:35.380 A guy named Shannon Wheeler did a graphic novel version of the Mueller Report. 22:35.440 --> 22:36.620 It's brilliant. 22:36.880 --> 22:38.020 I love it. 22:40.140 --> 22:42.480 Alright, number four. 22:42.940 --> 22:44.600 Online ballot hacking. 22:44.600 --> 22:47.680 Who's got a state that does some kind of online voting? 22:47.680 --> 22:48.920 Uh-oh. 22:48.920 --> 22:49.780 We got one. 22:49.780 --> 22:50.820 Got two. 22:51.420 --> 22:54.280 We talked about it in Vermont this year. 22:54.280 --> 22:56.160 It didn't happen. 22:56.560 --> 23:01.620 Now, the reasons for voting online are noble. 23:02.000 --> 23:07.120 They tend to come down to the Uniformed and Overseas Citizens Absentee Voting Act. 23:07.120 --> 23:08.860 You will call the voters. 23:09.100 --> 23:16.620 This is the law set up to basically give service people deployed overseas, expats, a fair chance. 23:16.620 --> 23:20.800 Because the mail is not reliable in a lot of these countries, right? 23:21.720 --> 23:28.240 So you're supposed to allow enough time for them to receive the request in the mail, enough time to get it back. 23:28.240 --> 23:29.660 It's problematic. 23:29.700 --> 23:32.020 Every election, I still get back. 23:32.020 --> 23:37.820 I will get back ballots six months later for an election. 23:37.880 --> 23:39.140 So it's a noble reason. 23:39.140 --> 23:42.520 You've also got disabled voters who have trouble getting to the polls. 23:42.520 --> 23:46.160 And maybe didn't get their act together, get an early ballot. 23:46.160 --> 23:47.120 It happens. 23:47.120 --> 23:50.840 So these are noble reasons to vote online. 23:51.660 --> 23:55.760 But, there are obvious reasons not to. 23:56.300 --> 24:17.420 And that's, once again, it's another opportunity to, especially if you're working from a mobile device, it's another opportunity to intercept, grab somebody's session, maybe get an open session cookie, stay in the system, and do what you can in terms of escalating privileges, 24:17.420 --> 24:19.540 or just canceling out their vote. 24:19.540 --> 24:25.120 But I'll tell you, that's not what really worries me. 24:25.340 --> 24:31.340 What worries me is the much lower tech version, and that's large-scale voter suppression. 24:31.340 --> 24:33.540 Okay, think for a moment here. 24:33.540 --> 24:35.820 You've got online voting in your state. 24:35.820 --> 24:39.700 And the problem is, it's not going to stay at just UOCAVA voters. 24:39.700 --> 24:42.600 Because what's sauce for the goose is sauce for the gander. 24:42.600 --> 24:47.840 Eventually you get to a point where, if they can vote online, why can't I? 24:47.840 --> 24:48.620 Right? 24:48.620 --> 24:56.320 So once we get to large-scale online voting, you've got incredible opportunities for voter suppression. 24:56.840 --> 25:01.240 Phishing emails generally are 19-20% effective. 25:01.280 --> 25:04.920 Targeted phishing emails can be 70% effective. 25:04.920 --> 25:21.060 Imagine targeted email to a particular demographic group, based on older voters, younger voters, minorities, basically crafted for that group, saying, here's the link to go vote. 25:21.300 --> 25:22.640 Go do it. 25:22.640 --> 25:25.260 All they know is, we've got online voting. 25:25.260 --> 25:25.840 Look at this. 25:25.840 --> 25:27.540 It comes from the Secretary of State. 25:27.540 --> 25:28.280 Boom. 25:28.280 --> 25:29.120 Okay? 25:29.120 --> 25:30.640 They've lost their vote. 25:30.640 --> 25:34.600 They may have also lost their ID in the process. 25:34.600 --> 25:43.300 This would be very simple, and it could be in such numbers that we're no longer talking about mischief and inconvenience. 25:43.640 --> 25:47.420 You know, what we do here with Voting Village is amazing. 25:47.480 --> 25:49.440 It's amazing stuff. 25:49.440 --> 25:57.220 But if you really want to talk about changing a result of an election, you're looking right at it. 25:57.520 --> 26:02.080 That's the biggest concern, in my opinion, that exists for that kind of thing. 26:02.080 --> 26:04.220 So, not a fan. 26:05.340 --> 26:12.380 Now we're getting up to the stuff that's so generic, but it has to be there, because it's so obvious, it's generic. 26:12.380 --> 26:13.500 What are you going to do? 26:13.520 --> 26:16.540 Unpatched legacy or legacy software? 26:16.540 --> 26:17.960 Unpatched software. 26:18.540 --> 26:20.800 Why don't we patch software? 26:22.680 --> 26:24.820 I don't understand this. 26:24.820 --> 26:28.320 I mean, I'm not an admin. 26:28.320 --> 26:30.660 Maybe it takes up more of your life than I think, right? 26:30.660 --> 26:32.880 I'm just an elections guy. 26:32.880 --> 26:35.600 And I license dogs, because I'm a city clerk, right? 26:36.580 --> 26:37.120 But... 26:38.380 --> 26:40.000 Starting to go. 26:40.960 --> 26:54.820 So, it's one of the three or four broadest ones, but I tell you, if you combine unpatched software with phishing, you've got 95% of your hacks right there. 26:54.840 --> 26:57.580 So we've got to be serious about this. 26:57.580 --> 27:08.200 And again, I don't necessarily trust the vendors, knowing that some of them, in my opinion, the one I'm currently using, in my opinion, is kind of a slipshod product. 27:11.550 --> 27:13.590 Now, mitigation... 27:15.610 --> 27:18.830 Mitigation on the enterprise is going to be about policies. 27:19.430 --> 27:20.950 It's another thing I don't trust. 27:20.950 --> 27:24.230 I mean, any good enterprise has got to have... 27:25.430 --> 27:33.330 got to have policies, got to have logging management policies, incident management, change management, patch and vulnerability management. 27:33.330 --> 27:36.130 Again, this is all best practices. 27:38.210 --> 27:42.550 Also, I think just in general, I'm going to put in a pitch for Zero Day. 27:42.950 --> 27:54.370 The Center for Internet Security, which is sort of a non-profit connective tissue between the Department of Homeland Security and us locally, is very much pushing a zero security model. 27:54.430 --> 27:56.450 It assumes a breach. 27:58.790 --> 28:04.590 It's got the principle of least privilege on steroids. 28:04.850 --> 28:07.550 And it also has micro-segmentation. 28:07.550 --> 28:10.630 It assumes anything anomalous is a breach. 28:10.750 --> 28:11.970 And it acts in that way. 28:11.970 --> 28:13.090 It's a great thing there. 28:13.090 --> 28:14.070 I've done my pitch. 28:14.070 --> 28:19.530 I would love to do a whole half an hour on Zero Trust. 28:19.530 --> 28:21.710 So that's Zero Trust. 28:24.890 --> 28:26.730 It talked about security. 28:26.730 --> 28:28.330 It talked about Zero Trust. 28:28.350 --> 28:31.150 So we've got to be vigilant with these vendors. 28:31.690 --> 28:36.490 And I didn't get to be Secretary of State, so I'm not sure how you do that. 28:36.490 --> 28:39.370 Because these smaller states... well, no, I am sure I did. 28:39.370 --> 28:40.770 I'm going to get to that in a minute. 28:40.770 --> 28:43.050 I do have an answer to that. 28:44.070 --> 28:55.710 Local Secretaries of State just don't have the kind of pull in such a small marketplace to have an impact on some of these vendors and make sure they're doing things right. 28:55.710 --> 29:01.730 I suspect they are not necessarily creating their software in a responsible way. 29:01.730 --> 29:04.330 Okay, number two. 29:04.510 --> 29:06.250 Physical security. 29:06.610 --> 29:08.990 Physical social engineering, okay? 29:08.990 --> 29:11.210 It's what we're doing over here. 29:12.590 --> 29:21.190 Physical security, again, is not something that you're going to have to worry about from the Russians or the Chinese or the Iranians. 29:21.190 --> 29:24.770 But I have to worry about it, and it's a big deal. 29:26.050 --> 29:32.250 It can be a bigger deal if you're talking about network systems, but I'm not even going to go there. 29:32.250 --> 29:36.090 So, examples of physical security. 29:36.170 --> 29:47.390 Physical defense in depth, protecting ballots and tabulators, authorized personnel restrictions, gates, locked doors, vaults, even security personnel. 29:47.390 --> 29:51.810 Because physical social engineering is a thing, okay? 29:51.810 --> 29:54.790 I had a teacher who was so hardcore about this. 29:54.790 --> 29:55.710 Oh, my God. 29:55.710 --> 29:59.430 He actually, when he was, he would pen test for real, right? 29:59.430 --> 30:02.550 He wouldn't just do one of these out-of-the-box pen test things. 30:02.870 --> 30:05.810 He'd go nuts with the physical stuff, too. 30:05.810 --> 30:14.350 He actually built, created a card reader for his hand that he would try to get close to badges, access badges. 30:14.790 --> 30:16.630 I don't know that it ever worked. 30:16.630 --> 30:17.910 I think it's brilliant. 30:17.910 --> 30:21.530 I know he gave me a good story about how it was miserable. 30:21.530 --> 30:26.210 Like falling, he was at a Starbucks and he tried to fake falling down. 30:26.210 --> 30:28.670 It was hilarious. 30:28.830 --> 30:33.170 But this is a message that needs to get out there. 30:33.270 --> 30:38.310 And that I think folks in IT and information systems forget. 30:38.310 --> 30:42.730 And that's that physical security is cyber security. 30:42.730 --> 30:46.170 Physical security is cyber security. 30:46.170 --> 30:48.650 I would have put this number one. 30:48.650 --> 30:50.470 I want to preach this so much. 30:50.470 --> 30:53.110 Except that number one is too obvious. 30:53.110 --> 30:57.850 I feel like I'd lose credibility if I didn't put number one at number one. 31:02.150 --> 31:03.950 Number one! 31:03.950 --> 31:04.730 Woo! 31:05.190 --> 31:07.310 All right, that got the room. 31:07.390 --> 31:08.850 Social engineering. 31:08.870 --> 31:09.930 Fishing. 31:10.310 --> 31:12.450 Cross-site request forgery. 31:12.570 --> 31:13.370 Spearfishing. 31:13.370 --> 31:14.490 Farming. 31:15.330 --> 31:16.490 That's it. 31:16.650 --> 31:18.870 Raise your hand if you were surprised. 31:19.350 --> 31:20.170 Yeah, all right. 31:20.170 --> 31:28.350 Everything we have talked about, just about, can be perpetuated by social engineering. 31:29.530 --> 31:34.310 So I'm not even going to spend so much time in that cross-site scripting. 31:34.310 --> 31:37.390 If you want to know about it, check the paper. 31:39.650 --> 31:43.110 Another type of social engineering we mentioned is phone spamming. 31:43.110 --> 31:48.070 I already mentioned it because I'm trying to crowd it all together. 31:48.750 --> 31:50.130 Phone spamming happens. 31:50.130 --> 31:51.870 This is not theoretical. 31:53.010 --> 32:11.110 I take part in every election day, or at least the big elections, I'll sit in a virtual war room that the EI Isaac puts together that's got election administrators at all levels from across the country all sort of reporting into each other. 32:11.110 --> 32:17.930 You'd think it'd be chaos, but people have other things to do, so they're not talking about what their kids are doing or anything. 32:17.930 --> 32:31.870 But anyways, every time for the last few years, I don't have to wait too long before somebody reports there's robocalls going out into my jurisdiction telling people not to vote. 32:32.910 --> 32:34.930 Telling people it's dangerous. 32:34.930 --> 32:38.290 Telling people the election has been delayed. 32:41.790 --> 32:45.570 And how can we even tell how well that works? 32:46.150 --> 32:50.610 It's another thing that could actually throw an election, but who would know? 32:50.850 --> 32:52.670 So this stuff is very serious. 32:52.670 --> 33:03.670 These are all headlines, obviously, so just to prove I'm not making it up, you've got Virginia, you've got North Carolina, Florida, the one I know of was Idaho. 33:04.850 --> 33:07.150 It's only going to increase. 33:07.150 --> 33:11.110 It was bigger this last general election than it was the time before. 33:11.110 --> 33:16.490 I think it's going to be off the charts for this coming election. 33:19.060 --> 33:21.100 A special mention. 33:21.200 --> 33:27.280 I've done my 10, but I can't stop with just 10, even though I don't have time to go over 10. 33:27.580 --> 33:33.120 I was involved in a tabletop exercise that included members of the military. 33:33.120 --> 33:41.400 I was blue team, and I was really surprised how concerned they were with public infrastructure hacks. 33:41.840 --> 33:43.500 A lot of them happen. 33:44.300 --> 33:46.520 I've got some examples up here. 33:46.560 --> 33:47.740 Again, we're in a hurry. 33:47.740 --> 33:50.060 I won't go over them, but you can take a look. 33:50.060 --> 33:51.220 There's a lot more. 33:51.220 --> 33:54.860 You see a lot of these in Europe that you don't see as many. 33:54.860 --> 33:56.840 This is just the last year, really. 33:56.840 --> 34:02.720 You don't see as many of them in the U.S., but you do see them, and there's no reason we won't see more. 34:02.720 --> 34:10.600 A public infrastructure attack would be, imagine in the middle of election day, every stoplight in the city goes red. 34:12.340 --> 34:14.820 That's a way to mess up an election. 34:15.120 --> 34:17.760 Imagine it happened in multiple cities. 34:17.760 --> 34:20.760 You could really, really choke things down. 34:20.880 --> 34:22.160 Choke things up. 34:22.180 --> 34:23.540 Shut things down. 34:24.020 --> 34:26.400 My metaphors are losing me. 34:27.520 --> 34:32.000 So, I didn't really go over best practices, but they're in here. 34:32.000 --> 34:36.520 So, let's say we're doing everything right. 34:36.780 --> 34:40.480 Mitigating everything, every way we should. 34:40.600 --> 34:42.720 We're in the clear, right? 34:43.860 --> 34:45.120 Yeah? 34:46.080 --> 34:52.180 Well, being 100% secure is a fantasy. 34:52.240 --> 34:54.560 It will always be a fantasy. 34:55.160 --> 35:01.120 So, nothing is guaranteed unhackable, so should everybody freak out. 35:01.120 --> 35:02.240 No. 35:02.800 --> 35:03.660 Okay? 35:03.680 --> 35:04.940 Absolutely not. 35:04.940 --> 35:07.100 And this is what I tell people. 35:07.100 --> 35:10.040 I tell people, look, there's going to be hacks. 35:10.040 --> 35:11.860 It's going to happen occasionally. 35:11.860 --> 35:13.180 If nothing else, the phones. 35:13.180 --> 35:16.060 But it's just the nature of the world. 35:16.160 --> 35:30.800 But if we're doing everything right, if we're doing everything we should, if we're following best practices, then that doesn't have to do anything more than slow down the final results for a few weeks. 35:31.220 --> 35:39.660 You know, back in Vermont, it wasn't that long ago that we had to have a recount because one of the town clerks found a bunch of boxes of uncounted votes. 35:40.080 --> 35:44.320 And that slowed down the final results by a few weeks. 35:44.580 --> 35:48.140 This can be the modern version of that. 35:48.140 --> 36:00.440 If we're doing everything we should, with paper backups, with responsible security, with responsible physical security, we will get the answers of our elections and they will be correct. 36:00.440 --> 36:04.240 But we just might have to cool our jets and wait a while to get them. 36:04.240 --> 36:07.080 But that's the price you pay for getting it right. 36:07.240 --> 36:09.740 I firmly believe this. 36:09.740 --> 36:11.480 And this is why I talk about this. 36:11.480 --> 36:13.300 This is why we should talk about this. 36:13.300 --> 36:17.160 This is what keeps this from all being a big exercise in nihilism. 36:17.220 --> 36:18.160 Right? 36:18.400 --> 36:21.440 And this is also why people don't want to talk about it. 36:21.440 --> 36:23.200 Because it's scary. 36:23.200 --> 36:34.240 But if you get to the point of telling folks, we're going to do everything right, let's shine the sunshine on everything so you can see we're doing everything right. 36:34.240 --> 36:35.920 Let's talk about it. 36:38.960 --> 36:43.680 Then I think it's nothing but positive we should be getting out there. 36:43.680 --> 36:45.320 All right, got a little time. 36:46.100 --> 36:49.160 Some good ideas for secure election process. 36:49.160 --> 36:51.680 Physically secure tabulators and ballots. 36:51.680 --> 36:53.540 Minimal user access. 36:53.540 --> 36:56.580 Dedicated election management workstations. 36:56.580 --> 37:01.140 Shouldn't be doing anything on an election computer other than elections. 37:02.020 --> 37:04.940 Election workstations with mission-critical websites. 37:04.940 --> 37:06.740 Whitelisted, nothing else. 37:06.740 --> 37:08.040 No email. 37:08.040 --> 37:14.040 Multi-factor or passwordless encryption, obviously. 37:14.040 --> 37:17.840 USB disabled unless that's where your token is. 37:18.160 --> 37:19.280 Et cetera. 37:19.280 --> 37:20.800 Paper ballot backup. 37:20.800 --> 37:22.000 Paper ballot. 37:22.720 --> 37:24.160 Paper checklist. 37:25.720 --> 37:28.600 Now let me say something about open source. 37:28.800 --> 37:37.260 I've been beating up the vendors and I've been saying that a lot of these small states are hostages to these vendors. 37:37.420 --> 37:38.960 Well, they don't have to be. 37:39.620 --> 37:58.540 I mean, ideally, if you're going to have a vendor, given that advanced persistent threats that move very slow, that move under IDSs, given that the Russians and whoever are working 24-7, what's the answer to 24-7 hackers? 37:58.540 --> 38:00.720 It'd be 24-7 pen testing. 38:00.720 --> 38:03.940 Which is something I've advocated for. 38:03.940 --> 38:04.740 Buy pen testers. 38:04.740 --> 38:05.820 Get them on your staff. 38:05.820 --> 38:07.100 Have them working constantly. 38:07.100 --> 38:08.080 Is that going to happen? 38:08.080 --> 38:08.960 No. 38:09.620 --> 38:11.040 So what should we do? 38:11.040 --> 38:12.700 We should go to open source. 38:12.700 --> 38:23.960 Open source, yes, I know it has its own challenges, but the open source community for election management, for election database systems, would be so robust. 38:24.160 --> 38:26.980 I think the advantages to security would be enormous. 38:26.980 --> 38:29.080 The cost would be better. 38:29.080 --> 38:30.640 It's just all around. 38:30.680 --> 38:33.280 I am a strong advocate of open source. 38:33.280 --> 38:40.000 It's actually what I ran on for Secretary of State and got squashed, but it was nice to be out there saying it. 38:41.000 --> 38:42.320 Okay. 38:42.420 --> 38:44.380 Honorable mentions. 38:44.540 --> 38:50.100 Physical threats to election staff and voting places, including doxing and swatting. 38:50.220 --> 38:55.240 Election administrator offices being compromised by bad actors. 38:55.240 --> 39:02.860 Good election administrators getting run out of office and being replaced by people who are not good election administrators. 39:02.860 --> 39:13.520 And, of course, social media disinformation, which is its own huge topic, and folks will tell you that that is the number one problem with elections these days. 39:13.520 --> 39:14.380 May or may not be. 39:14.380 --> 39:19.960 I don't think, I don't know that I agree with that, but if not, it's number two. 39:21.700 --> 39:23.980 Now, conspiracy theories. 39:26.390 --> 39:28.690 And this is what I'm going to end on. 39:29.710 --> 39:41.550 We get accused here of promoting conspiracy theories, and conspiracy theories are the things that, you know, that are really screwing up a lot of our elections these days. 39:42.270 --> 39:49.150 But the fact is what we're doing, what's happening over here, what's happening with these talks, is sunlight. 39:49.830 --> 39:51.930 Now you're starting to get the metaphor now, aren't you? 39:52.130 --> 39:54.130 See where I'm going with this. 39:54.510 --> 39:55.510 Sunlight. 39:55.890 --> 40:00.250 Conspiracy theories thrive when people don't know and they don't understand. 40:00.530 --> 40:03.130 I mean, there's always going to be people who don't believe. 40:03.130 --> 40:05.310 There will always be conspiracy theories. 40:05.310 --> 40:08.470 But they take hold in the dark. 40:08.470 --> 40:10.190 In the shadow. 40:10.930 --> 40:16.950 And sunlight is what makes conspiracy theories go away. 40:16.990 --> 40:18.490 Once and for all. 40:19.890 --> 40:20.870 So. 40:21.090 --> 40:22.670 Oh my God. 40:22.670 --> 40:34.450 I have never flown through, in any practice, this presentation in less than 50 minutes, and I think we're almost on track. 40:34.450 --> 40:35.910 I've got about 10 minutes left. 40:35.910 --> 40:39.070 I don't know if anybody has any questions or observations. 40:39.070 --> 40:41.910 Don't make them too techy because I'm a script kiddie. 40:44.300 --> 40:45.420 Anything? 40:46.600 --> 40:47.720 Ah. 40:56.170 --> 41:02.450 So some of the scenarios you've described are problems because we've got elections that are one day, you know. 41:02.450 --> 41:03.070 Yeah. 41:03.070 --> 41:07.870 It's, you know, you can tell people, hey, come back and vote tomorrow. 41:08.210 --> 41:15.830 Or, hey, you know, we're going to stop up all the traffic so you can't get to your polling place, so you can't actually vote before the polling place is closed. 41:15.830 --> 41:16.350 Right. 41:16.630 --> 41:24.790 Would these problems that you've described, this class of problems, be mitigated by actually making elections, like, over a week or over a month? 41:24.790 --> 41:32.170 Or would that just introduce new problems, new vectors for attack that wouldn't be effective in a one day election, that would be effective... 41:32.170 --> 41:33.790 If we had more than one day. 41:33.790 --> 41:34.130 Multi-day elections. 41:34.130 --> 41:43.210 The question is, a lot of these vectors of attack look like they're particularly effective if you were talking a single election day. 41:43.390 --> 41:50.650 And wouldn't it be safer, elections be more protected if we had an election season, basically. 41:50.670 --> 41:52.310 Which, yes, absolutely. 41:52.310 --> 41:54.790 I'm a huge proponent of early voting. 41:54.790 --> 41:56.350 That's where you start with. 41:56.350 --> 41:58.290 Have an election season. 42:01.750 --> 42:05.150 Hopefully we don't all wait to the last minute to pay our bills. 42:05.510 --> 42:07.030 We have a bill-paying month. 42:07.030 --> 42:08.590 We have a bill-paying season. 42:08.730 --> 42:15.450 So yes, a lot of these, if we can encourage people to vote early, they get around a lot of these problems. 42:15.970 --> 42:19.650 You know, there are states that are doing just vote-by-mail. 42:20.530 --> 42:30.070 And whatever unique challenges there are to that, they avoid many, many, many of the challenges I brought up. 42:30.390 --> 42:34.350 So yeah, election season, vote-by-mail, woo-hoo! 42:41.850 --> 42:42.750 I can talk last. 42:42.750 --> 42:43.590 Oh, I'll repeat it. 42:43.590 --> 42:45.850 I was going to repeat it because I have a big booming voice. 42:46.430 --> 42:50.580 So you talked about CI0. 42:50.580 --> 42:51.420 Trust. 42:51.960 --> 42:56.340 How do other election officials, how are they accepting that? 42:56.340 --> 43:03.900 Because that seems to be a very novel idea for a lot of election officials who don't want to accept that their systems could be breached. 43:03.900 --> 43:07.520 That they kind of don't see that as a possibility. 43:07.540 --> 43:13.360 And then I also did want to make a plug for the panel tomorrow on online voting because I know you talked about it. 43:13.360 --> 43:19.360 If anybody wants to hear more about online voting, tomorrow at 10.30 we're doing a panel on online voting. 43:19.360 --> 43:19.700 Uh-oh. 43:19.700 --> 43:21.160 I don't know if you want me there. 43:21.360 --> 43:22.600 No, we can sit. 43:22.600 --> 43:22.940 Oh , okay. 43:23.360 --> 43:24.620 I'll be there. 43:24.620 --> 43:25.460 Alright. 43:25.760 --> 43:41.380 So the question was, in a nutshell, how do you get election administrators to accept a zero-trust, not just a model but an entire mentality, really, of assuming a breach? 43:41.380 --> 43:45.000 I don't know, because it flies in the face of politics. 43:45.380 --> 43:56.600 Politics, the political viewpoint at the top when you're talking elected secretaries of state, is to assure everybody at all costs there are no problems. 43:56.660 --> 43:58.560 They're not going to want to hear about it. 43:58.620 --> 44:02.400 So that's going to have to be... boy, that's a tough question. 44:02.400 --> 44:12.880 But I have to say that's going to have to be more of a grassroots movement from the local election administrator level up. 44:12.880 --> 44:15.760 We'd have to normalize that conversation. 44:15.940 --> 44:19.980 And I may be being cynical, but I don't see secretaries of state doing that. 44:22.760 --> 44:26.140 We're going to do something unusual and end on schedule. 44:26.140 --> 44:28.140 So thank you so much, Don. 44:28.600 --> 44:30.160 Thank you so much. 44:30.160 --> 44:37.740 And in particular, thanks for a really terrific talk under terribly suboptimal conditions. 44:37.740 --> 44:40.960 So an extra round of applause for that. 44:40.960 --> 44:42.220 So thank you.