35C3 - Election Cybersecurity Progress Report

35C3 preroll music

Herald Angel: Mr. Halderman, professor of
computer science at the University of

Michigan. Famous for inventing things like
Let's Encrypt, finding the--

applause

Herald Angel: There's more.
applause

Herald: But wait, there's more! Logjam
-- I love buzzword bingo -- and zmap.

And now he's going to talk about
American elections. Thank you.

J. Alex Halderman: All right. Thank you so
much. It's fantastic to be back at

Congress this year. Two years ago I was
here with Matt Bernhard one of my Ph.D.

students and we gave an update about what
happened during the 2016 presidential

election. Today a lot has changed and a
lot remains the same. And I'm here to let

you know what we've learned about what
happened in the 2016 election and what we

still need to do to make sure elections in
the U.S. and around the world are well

protected. So, a quick flashback. On
November 8th, 2016 Donald Trump became

president of the United States by beating
some other person. Now history quickly

forgets the losers in presidential
elections. And it really doesn't matter

who Donald Trump beat, because today, for
better or for worse, he is the president.

But how close was the election? President
Trump likes to talk about how he won by a

landslide, but actually he was the fifth
person in American history to win the

presidency while losing the popular vote.
In fact his opponent received 3 million

more votes in the election than President
Trump did. How can that happen? Well we

have this crazy system called the
Electoral College. And in the Electoral

College each state has a certain number of
points, and Donald Trump ended up getting

more of those points. But if we want to
ask "How close was the election,

really?"... well that depends on the way
each state allocates its electoral votes,

and most are "winner-take-all". So we
might ask how many votes would, say, an

attacker have had to change in the
smallest number of states in order to

change the election result in order to,
say, make it a tie instead of a win for

President Trump. And it turns out that if
you look at the three closest states, they

could be flipped with a very very small
number of votes changing, and changing

just any two of these three states would
have been enough to reverse the outcome of

the presidential election. If we look at
the next few closest states they also have

very small margins, and any three of these
six states would have sufficed to change

the election result. In total just
changing twenty seven thousand, five

hundred votes from Donald Trump to Donald
Trump's opponent would have changed the

outcome of the U.S. presidential election.
There were 137 million votes in total.

That's a change of just 0.02 percent. That
is a very close electoral result by even

contemporary American standards. And
that's why the possibilities of computer

hacking, voting machine manipulation,
information warfare that actually did take

place, some of them in 2016, not only have
the possibility to have effected the 2016

election result but stand to have the
possibility to affect future election

results as well. And that's why election
security is so important right now. But if

we go back to 2016, when I was speaking
here two years ago, the main thing I was

talking about were recounts in three
states: Wisconsin, Michigan, and

Pennsylvania, that I and other election
security advocates had a big role in

orchestrating. Well we realized after 2016
that this was a close and unexpected

election result, but no one was going to
go back and check the physical evidence of

the votes: the actual paper ballots in any
states that really mattered to make sure

that the computer election results we have
been told about were right. Well, when I

and others pointed this out to the public
it resulted in an overwhelming show of

support. And one of the third party
presidential candidate Jill Stein stepped

in and had the legal standing to demand
recounts in states where she stood for

election, even though she had no chance of
winning. And she raised through small

donations from the public more than seven
million dollars to fund efforts to go back

and count and check the votes to make sure
things were right. Unfortunately, a

recount after an American election is a
politically fraught process, and in all

three states we found opposition from the
apparent winner of the election, we found

challenges in the courts, and only one of
those states, Wisconsin, ended up

recounting all of its ballots and found no
evidence of fraud. In Michigan the

recounts were halted after only a few days
with less than half of the votes counted

after a court challenge by the
Republicans. Again, no evidence of fraud

in the votes that were recounted. And in
Pennsylvania, unfortunately, like many

states most of the state had no paper
trail at all. There was nothing to

recount: just digital records and
machines. The courts denied the Stein

campaign the right to have independent
experts examine the machines, and in very

few of the places in the rest of the
state, the small amount that did have

paper actually did complete a recount. But
still there was no evidence of fraud. So

in all there is no evidence that hacking
of voting machines -- hacking of actual

vote counts -- changed the outcome of the
2016 election. But there is abundant

evidence that cyberattacks of other forms
had a major influence on the election,

certainly could have a huge influence on
future elections. And that's what I'm

going to talk about today. So first
looking back at 2016 in the two years

since I was last here we have learned a
lot more about what really took place

during the 2016 election. Starting just
January of 2017 when the U.S. intelligence

community -- the CIA, NSA, and other three
letter agencies -- who often in this

community we don't trust, still came out
and released a joint assessment in which

they rated with very high confidence the
conclusion that attackers linked to Russia

were ordered by Russian President Vladimir
Putin to interfere with the American

election in order to weaken Clinton, boost
Donald Trump, and discredit the electoral

process as a whole. They called it a
significant escalation of longstanding

Russian efforts to undermine the US-led
liberal democratic order. So where's the

evidence that this actually happened? And
what actually happened? According to not

only the intelligence reports but other
information from other sources we can use

to see to see whether it's credible. Well
what happened in the U.S. actually looks a

lot like something that happened in 2014
in Ukraine, where, according to other

published reports, attackers linked to
Russia engaged in a multipronged attack to

try to undermine the presidential election
there. They released targeted leaks of

e-mails linked to the presidential
campaign. They attacked the Election

Commission's servers in order to cause
them to initially post the wrong

presidential winner. And this was
apparently detected and narrowly averted

only hours before the winner was to be
announced. And they orchestrated DDoS

attacks to try to delay the election
results. In the U.S. in 2016 we saw a

similar multipronged attack of targeted
political leaks trolling and message

amplification on social media and attacks
against election infrastructure. So the

targeted political leaks, you've probably
heard about some of this. You have e-mails

stolen from the Democratic National
Committee through a hacking campaign that

involved two different Russian-linked
military groups hacking into the DNC

servers, installing customized malware and
exfiltrating thousands of e-mails that

were then published by WikiLeaks. Later,
John Podesta -- Clinton's campaign

chairman -- also had his personal email
compromised, and Podesta's emails were

similarly published by WikiLeaks. Whatever
you think about WikiLeaks -- and

government transparency, and I myself am a
huge fan of transparency -- there's

clearly something subversive and
manipulative about just one side being

targeted, and being targeted by other
foreign nations, and having its dirty

laundry aired for the world to see. This
is subverting the entire notion of

transparency, turning our need for true
information about politicians against us

and manipulating the entire process. John
Podesta, since his e-mails were all leaked

to the public, well, we can go and see the
phishing attack e-mail that got his

password, and here it is. So this mail
sent to John Podesta claims to be from

Gmail saying that someone has tried to
sign in with his password and he urgently

needs to change it by clicking here. Well
he did click there and Russia got his

password. We also see his staff talking
about this e-mail and one of his staffers

recognized that this was a phishing
attempt and emailed urgently telling John

Podesta to change his password immediately
but he typo'd. In dashing out this e-mail

he wrote that this is a "legitimate
e-mail". He has subsequently claimed every

time he's talked about it that he meant to
write "illegitimate" not "legitimate".

Well, the rest is history. A couple of
extra letters might have changed a lot. So

beyond the e-mail leaks we've seen an
orchestrated campaign on social media

through trolls and false identities to try
to manipulate people's opinions, to try to

create political divisions between people,
to try to amplify certain discordant

messages. That could be a whole talk in
itself, and I'm not going to go deep into

the trolling and message amplification,
but it's a subject that is an ongoing form

of attack that again turns our tools of
communication against us. People need to

know whether the information they're
reading is really what other people they

know and are like them think, or whether
it's being generated by bots, by attacks.

Alright this kind of artificial
amplification and manipulation of

messaging turns us against each other.
Finally, and the category of attacks that

I want to talk about most today because I
think they're the most relevant for our

community, are attacks against election
infrastructure itself: the increasingly

computerized systems that we use to run
elections, not just in the US but in

countries around the world. There were
attacks against voter registration systems

in states across the country, organized by
the same Russian groups. There were

attacks against companies that make
technology used in polling places. In all,

the intelligence assessment is that up to
21 states had their voter registration

systems probed. Now of course how can you
go back in time and know for sure that

others were not probed, were not
compromised. That's very difficult, even

if you are, say, the NSA and are watching
everyone's network traffic. However we

know that in multiple states the attackers
got in through SQL injection, through

other attacks, and were able to steal
hundreds of thousands of voters'

registration records. More information
came out later in 2017 through leaked

information from NSA. So this woman,
Reality Winner, an NSA contractor, leaked

to the Intercept a series of intelligence
assessments that showed the Russian

attacks went even farther, that they
executed attempts to break into the

computer systems of at least one election
computer software vendor, and then after

breaking into their systems started trying
to fish their way into the computers of

local election administrators, the people
who actually run the technology on

Election Day. For sharing this information
with us Reality Winner is currently

serving a five year prison sentence for
violating the Espionage Act. But the

information that she leaked has since been
corroborated. In July of this year

prosecutors in the Special Counsel's
office -- this is the Robert Mueller

investigation of Russian interference and
collusion -- indicted a set of GRU

officers, Russian military officers, in
conjunction with the voter registration

system attacks, the theft of email from
the Democrats, and the attempts to indict

local election officials. If you're
interested in this stuff I highly

recommend you read this indictment. It's
about 20 pages of very detailed

information asserting to apparently
detailing exactly who these people were

where they worked what they did. Step by
step.Now it's scary to think that we might

have such detailed information about
crimes that took place in the past. It

doesn't say how we learned, for instance,
that this certain officer, Anatoly

Kovalev, was working for unit 74455 of the
GRU at 22 Kirabo Street Building, the

tower, and quite how he pulled off each
step in the attack that's asserted here.

But as the Mueller indictments advance, as
the special prosecutor's case comes

together, we're likely to learn a lot more.
And what's to come in 2018 as the Mueller

investigation winds down, I think we're
going to learn a lot more about quite who

ordered what, about who in the United
States was involved, and about whether the

attacks went even further than we have so
far discovered. So that's 2016

and what we've learned about 2016,
but I'm here today to give you a

progress report on 2018. So what happened
during the 2018 election? Well we saw

several things during the November
election this year. According to

intelligence, once again, we have
allegations of continued social media

influence operations, this time allegedly
linked to not only Russia, but China and

Iran. Now I think it's very difficult to
independently comment and establish on

whether these allegations are true or even
to understand the full extent of the

social media involvement, because it's
just a small set of large Internet

companies that have the raw data that we
need to analyze. However the best reports

we have are these assessments from the
intelligence community that the social

media influence is ongoing. We also saw
sporadic breakdowns of voting machines.

Now patterns of breakdowns of voting
machines could be the indication of an

attack. But in 2018 all of them seem to
have perfectly natural explanations. In

New York City for instance many optical
scan machines broke down and jammed and

caused long lines but apparently it was
because it was raining and that causes the

paper to swell a little bit, these
machines to mis-feed and so on. So this is

probably just natural failure. We also had
unfortunate human error for not the first

time. An election in Florida potentially
had the result changed because of very bad

usability design in just the layout of the
ballot. So in Broward County, Florida

3.7 percent fewer voters cast a vote at all
in the U.S. Senate race than the race for

governor. This was potentially enough
because of the demographics of Broward to

change the outcome of the Florida Senate
race. Here's why: Here's the ballot. So

this is the race for governor, which most
voters filled out, as you would expect.

Right down there underneath that long
column of instructions is the U.S. senator

race. So you imagine this ballot. It's
much larger than a normal piece of paper.

At the bottom of that is hanging off your
desk as you're filling it in. I can see

how 3.7 percent of voters might have
completely missed that race in the first

column. Finally we had the old-fashioned
political fraud. In North Carolina a race

for the House of Representatives was
decided by only about 900 votes. But it's

come out since then that operatives
working for the Republican candidate

allegedly stole or manipulated a large
number of absentee ballots, and the

candidate there hasn't been certified yet,
it likely won't be seated on time. There's

multiple investigations going on into
exactly what happened, but it goes to show

you that political fraud is a reality. And
even outside the domain of computers it

continues to this day. Now if you can
imagine an election can be changed by just

a few people working on the ground, going
around collecting people's mail in ballots

and promising to return them for them,
well imagine what nation state attackers

could do to a vulnerable and highly
computerized online infrastructure. But on

the whole 2018 was, well, eerily quiet. But
if we go back to 2016... so the U.S. Senate

Intelligence Committee, a bipartisan group
controlled by Republicans in the Senate,

issued its report earlier this year about
2016. They pointed out that they found

that in a number of the states where
Russia attacked the registration systems,

the Russian hackers were in a position to,
at a minimum, alter or destroy the voter

registration data, which, if undetected,
would have caused massive chaos on

election day when people showed up to vote
and were told that they weren't on the

election rolls. But those attackers chose
not to pull the trigger. And I think

that's exactly what happened in 2018. It
was quiet, not because we've adequately

secured our election systems, but because
our adversaries this year chose not to

pull the trigger. They're waiting for the
bigger prize in 2020 when we're likely to

once again have a close and divisive
presidential contest. So what do I worry

about? What I worry about most is not the
last war -- registration systems, all of

that -- but the bigger prize: the 2020
election and the vulnerabilities in the

way that we cast and count votes in the
U.S. Now I testified about this in 2017 to

the Senate Intelligence Committee and --
that's actually not me. that's that's

former FBI Director Comey-- but two weeks
later I was sitting in the same chair with

far fewer TV cameras and testified that
the real lesson of 2016 is that the

threats are real and that the attackers
will be back. And this is the picture I

painted: so U.S. voting machines have their
own extreme set of vulnerabilities. I was

going to bring one of these machines,
AccuVote TSX with me here today. This

machine is still used in many parts of the
U.S., but my machine has been in Germany

for about a week and FedEx doesn't know
where it is. So if it shows up I'll have

it somewhere for people to play with, but
my advice is if you have to ship something

urgent to Germany don't send it via FedEx.
What I would have shown you though is a

mock election on this machine and the mock
election I always like to do to keep it

from getting too political is between
George Washington, the father of the

country, and Benedict Arnold, the traitor
of the American Revolution. And of course

everyone likes to vote for George
Washington. But these machines are so

vulnerable. So I would have shown you an
attack whereby I can compromise this

machine and cause it to report the wrong
election outcome without having any direct

physical access to the voting machines.
Instead all an attacker needs to do is be

able to infect these memory cards that
election officials use before every

election to program the machine with the
design of the ballot -- that is, the

races, the candidates, the rules for
counting. If an attacker can infect the

memory card there are a whole host of
different ways that the attacker can

compromise the machine and install malware
on the voting machine itself. There is an

unauthenticated software update mechanism
that can replace the election software.

There are buffer overflows in the code
that's used to read the ballot design and

process it. There's even an interpreted
programming language that's used to

generate the reports of who won. So you
can just replace the honest counting

software with dishonest counting software
right on the memory card, and that's what

will get executed and determine the
election results. Any of these ways would

be sufficient. So when the machine counts
the votes at the end of the election it

prints out a little cash register receipt
that becomes the official record of the

result. That's controlled by the
interpreted programming language on the

memory card. And on my machine, no matter
who you vote for, Benedict Arnold is going

to win. And that's because the malware I
install via the memory card is in complete

control of the election results. And there
are more problems than that. So these

voting machines like the AccuVote TSX have
been studied by academic researchers, by

independent researchers, by groups
commissioned by secretaries of state in

various states around the country. And
every time the same machine is studied

again, groups find new vulnerabilities.
This is part of the table of contents from

a report I helped to author ten years ago
about the AccuVote TSX, and you can see

just this one page of several pages of
vulnerabilities in this single machine.

These things are so poorly designed;
they're so complex. Each of the voting

systems has on the order of a million
lines of source code. And that's on top

of, in this case, on top of an old and
unsupported version of Windows CE. There's

no way that these things could possibly be
secure. But the AccuVote TSX is still used

in 18 states. In many of these states it's
still used with software that predates

that 2007 report I just showed you. We've
had known buffer overflows and other

problems in this firmware for more than 10
years and some states still have not

updated the software. That's how bad it
is. But it's not just that one machine. So

in the US every state gets to pick its own
election technology. There are no federal

rules that requires states to do any
particular kind of technology or testing,

and you might ask, especially from the
European perspective, why don't we just

count votes by hand like a civilized
country. Well here's part of the answer.

This is one example of a ballot from one
part of the country and it's eight pages

long. We insist on voting for not only the
federal races but the state and local

races and even city races. The joke is
even for dog catcher. And this complexity,

well, the counting ballots by hand scales
linearly with the number of questions and

our ballots by tradition are just too
complicated to efficiently count manually.

So we turn to computers, and about half
the country-- well, really there are two

different styles of voting machines that
we use. Some of them are optical scanners

where the voter fills in a piece of paper,
and it gets scanned in by a computer. The

rest are touch screen machines and others
that we call DREs -- direct recording

electronic. On these machines voters cast
a vote on the screen; it gets recorded in

electronic memory; some of them will also
generate a print out of each vote, but

that's relatively rare. In many cases the
only record of the vote is in a computer

memory. So in study after study these
machines have been examined, and in every

case, for both the optical scanners and
the DREs, where a machine has been tested

by qualified people, well, it's been found
to have vulnerabilities that would allow

an attacker to install vote stealing
malware and change the electronic results.

Every single case. So how hard would it be
to go from hacking these individual

machines to say changing the results of a
presidential election? Unfortunately much

easier than we might think. There'd be
three challenges to doing this in a way

that would likely be invisible. The first
challenge is that the machines are, well,

many different types. They're diverse;
they're decentralized. Each state's system

is independent, and thank goodness! Because
that means that we don't have just a

single place you can hack into to change
results nationwide. Unfortunately, because

of our electoral college system, this
diversity of technology can turn into a

weakness in very close elections. So
remember I said that just any three of six

states, for instance in 2016, would have
been sufficient to flip the outcome of the

presidential election. Well before an
election an attacker can scan all the

states, figure out which ones are most
weakly protected, and, if they can find

enough weakly protected ones to strike in,
that could be sufficient to change the

national results. So the attacker gets to
pick and choose, because our diversity of

technology also means a diversity of
strength and weakness. The second

challenge is that, as election officials
often point out, the voting machines

aren't connected to the Internet, or at
least they're not supposed to be. It turns

out that some of them are, because they
upload their results over a 4G cellular

modem right after election results are
complete. But let's just suppose they're

not connected to the Internet. All right.
It turns out that's still not enough to

protect us. So as I said before every
election every single voting machine in

the country has to be programmed with the
ballot design and that ballot programming

is created by election officials on a
computer workstation somewhere, usually an

old Windows PC. Those computer
workstations can sometimes service an

entire county, sometimes an entire state.
Sometimes they're controlled by

independent external contractors that can
perform work across multiple states. And

if an attacker can infiltrate one of those
systems they can spread vote stealing

malware on the memory cards to voting
machines across the whole region. So how

hard would it be to break into one of
these systems? Well in Michigan, my state,

in 2016, about three quarters of counties
outsourced this programming to just three

small businesses. These are 10-20 person
companies operating in strip malls and so

forth -- the same companies that the
jurisdictions buy their ballot boxes and

"I voted" stickers from. Here's the
website of one of them. You can see it

doesn't have HTTPS, has lots of nice high
resolution photos of their warehouse in

case you want to burglarize it, and,
probably most interestingly to an

attacker, they have this nice employee
directory with everyone's name,

photograph, job title, and email address.
So if I wanted to break into elections in

Michigan I might start by, say, forging an
email from Larry the president there to

Sue his administrative assistant and say I
urgently need you to open this file. After

she does, of course, it installs my malware
on their network, I'm in. I'm one step away

from the election programming system and
spreading malware to machines across a

quarter of the state. All right, there's
one more challenge. And that's that today

more than 70 percent of US votes are
recorded on a piece of paper. And this is

great! This is much more than ten years
ago because officials have been listening

to computer scientists and security
experts who have been warning about the

dangers of fully electronic voting. And
paper might seem like a step backwards,

but it's actually a pretty high tech way
of thinking. In any kind of critical

system, if we can afford to have a
physical failsafe in case of technology

problems it's a good idea to do that. This
is why if you fly on a commercial

aircraft... well, it has a very fancy
satellite-guided navigation system, but

also, by law, there's a magnetic compas in
the cockpit. It's also why in your

car...well you probably want to have a
mechanical linkage between the brake pedal

and the brakes just in case... well, you
know. So paper can be a very sophisticated

defense. It's relatively slow and
expensive to tally, but it's something

that's verified by the voter and that
can't be changed later in a cyberattack.

Meanwhile we also get an electronic record
from systems like optical scanners that's

fast and cheap to tally, but unverified.
As long as we make sure that these records

agree well then changing the election
result would require you to change the

electronic record through a high tech
attack. And the paper records through a

low tech attack and in a way that
agrees, and that would require a truly

extraordinary conspiracy. And to check
that the paper is right... Well we have

high tech approaches to that too. You
don't have to count all of it. In fact

over the last ten years computer
scientists and statisticians have

developed very sophisticated ways of just
spot checking the paper record to make

sure that it's right and these are called
risks limiting audits. A risk limiting

audit is a statistical process in which
you can count randomly selected ballots

until you establish with high confidence
that hand counting all of them would

determine the same winner. There are many
ways to do this but they all turn out to

be, or many of them turn out to be
incredibly efficient. In a typical state

with a fairly wide margin of victory just
spot checking a handful of ballots might

be enough to establish with high
confidence that the winner really did win

by a landslide. Of course if the election
result is a tie, logically you do have to

look at all the ballots to establish that
it is indeed a tie. So the amount of work

you have to do depends on how close the
election was. But in all cases you can

find an efficient approach to determining,
without trusting the computer systems,

that the paper really does reflect the
true winner. Unfortunately, well, most

states don't do risk limiting audits. In
fact most states don't look at enough

paper at all to determine that the winner
of a close election was genuine. So

hacking a national election would probably
be easier than most of us thought. You can

use pre-election polls and scanning to
determine which states to target, hack

into the election management systems in
the most weakly protected ones, then

infect voting machines with malware to
change, say, a few percent of the vote.

The paper records might catch the fraud,
but you can rely on the fact that most

states will throw it away without looking
at enough of it to determine who actually

won. And that's the sorry situation that
unfortunately in 2018 we are still in. So

since 2016, however, there has been a
change in mindset. Increasingly election

officials have been listening to the
scientific community when we say you need

a paper trail, and they're starting to
think that that is correct. Almost all

states that don't have paper trails today
at least have people strongly advocating

for replacing the equipment that's there.
And most other states, well, they at least

have people starting to look into the
security and testing the security of other

election related computer systems, like
their voter registration systems, to make

sure that they're shored up. Now you don't
have to take it from me that paper ballots

and post election audits are the way to go
to secure our election systems. Just this

fall the National Academies of Science
Engineering and Medicine -- the authority

on scientific advice to government --
released a report with their highest level

of advice -- a consensus report -- urging
the adoption of paper and risk limiting

audits, pointing out that this is a
pragmatic, robust, and necessary defense

for elections. This report was written in
conjunction with election officials.

People with experience administering
elections and it just goes to show you

that at least the election officials who
have taken the time to understand the

threat are waking up and starting to pay
attention to the path to a solution. The

problem is that that solution will take
time to implement. And if we look at which

states still don't have a paper trail, it
turns out that there are 14 where some or

all votes still aren't recorded on paper,
and it's going to take between 130 and 420

million dollars according to credible
estimates to replace all the machines

still in those states. Some of them like
Pennsylvania are working to do that now,

but in other states there still are no
plans in effect to get rid of the

vulnerable machines. If we look at the
national map for post-election audits

though the picture is a lot worse. And
this is what concerns me most. Although

many states in 2018 did small pilots of
risk limiting audits, the majority of

states still do not conduct audits that
can rigorously guarantee the electronic

results of an election. And many still
have no plans to do so in time for 2020.

Because risk limiting audits are so
efficient, the cost for auditing

nationwide is ridiculously small. It would
cost according to my estimates less than

25 million dollars a year to audit every
federal race nationally, potentially a lot

less than that. But it requires
organizational on the ground. And

unfortunately in our system operations on
the ground are conducted by about 13.000

local jurisdictions on Election Day. We
need national leadership. We need much

more dispersed expertise in order to get
these protections in place, because if you

don't actually look at the paper you might
as well not have it in the first place. So

this year did see some movement in
Congress. In the spring, as part of the

omnibus appropriations process, Congress
gave the states 380 million dollars in

emergency election funding in order to
start working to secure their registration

systems and polling places. This was great
in that it was money available

immediately, and if you've been paying
attention, getting Congress to do much of

anything these days is pretty hard. On the
other hand the money came with very

limited oversight, with no standards about
how that money should be used, and isn't

even enough to eliminate all of the
paperless machines because of the way it's

spread out amongst the states. But it's an
important first step. We can look at a few

of the states to see how they're doing,
and I pick these as a representative

sample of the diversity of progress. In
Maryland, for instance, which until 2016

used AccuVote touch-screen machines,
vulnerable to all of those problems I

talked about, finally replaced the
machines with paper ballots. That's a huge

step forward. Unfortunately Maryland,
instead of auditing them by having people

look at the ballots, decided it would be
more efficient to audit them by having

people look at digital scans of the
ballots from the voting machines. As I

think everyone in this room probably
realizes, but maybe some in a broader

audience would not, it's pretty easy to
manipulate digital photographs. In fact I

have work from students in an
undergraduate security class I taught this

term who implemented a machine learning
algorithm that can take scans of ballots

and just automatically change the marked
results to produce whatever outcome you

want, and we'll have more on that in
a publication this spring. But

unfortunately these audits are security
theater. They might catch human error, but

they're not going to catch a sophisticated
attacker who has the ability to manipulate

how the machines are reading the ballots,
can be easily fooled by malware. So I give

Maryland on the whole maybe a "C".
Pennsylvania, another state that just two

years ago during the recounts was
practically a laughing stock of the

country for its lack of paper records of
votes and it's byzantine rules about

recounting them, well, today is making
really good progress. The state recently

committed to replacing all of its
paperless machines with paper ballots in

time for the 2020 election, and it's
committed to implementing a robust post

election audits by 2022. Unfortunately,
2022 is going to be too late to secure the

2020 presidential election, and this just
emphasizes the need to get moving more

quickly. There were also questions about
whether the auditing regime they implement

will be truly statistically rigorous.
There are a lot of details to get right,

but on the whole, Pennsylvania has made so
much progress. I think out of sympathy I

can give them a "B". All right, now let's
look at a top performer. This is the state

of Colorado. Colorado has become a leader
in election security, because not only

does it have paper ballots statewide,
largely vote by mail which has its own

problems, but that's a subject for later.
But Colorado also was the first state in

the country to implement these
statistically robust risk limiting audits

statewide and has been doing it since
2017. They've got both of these critical

protections in place, and yes, they
actually do choose the random seed for

sampling the ballots during the risk
limiting audit by rolling a set of

10-sided dice. So that's a great way to do
it in a public ceremony. So Colorado gets

an "A". They're very well protected by
these standards. Then there's Georgia. So

Georgia in 2018 voted statewide with the
AccuVote TSX voting machine, the one that

FedEx has that I've hacked. They haven't
updated this software in their AccuVote

TSX machines since 2005, and they claim
that the machines and their election

programming systems are air gapped. But
during a court hearing about this earlier

this fall their head of elections
described that their system was air

gapped. Yes it's perfectly secure. It's
air gapped. The only way you can get into

it is through the bank of modems attached
to it. It's air gapped except the bank of

modems. Also it turns out he programs it
by moving a USB stick back and forth from

his personal laptop. Sigh Georgia also
of course doesn't have robust audits,

because, well, meaningful post election
audits would require a paper trail, and

none of those machines have paper. This
alone would be enough to give Georgia an

"F". Except there's one more thing: their
voter registration system also was shown

in 2018 to have some problems. So you're
not going to believe this story. One more

story. So in Georgia they do online voter
registrations through a Web site. And in

2018 just a few days before the election
the Georgia Democratic party learned from

one of it's-- from someone working for
them, from a volunteer, about a series of

vulnerabilities in this voter registration
system. While it turned out that you could

read and manipulate anyone's voter
registration records just by changing a

sequential ID number in a particular URL.
There was another URL for viewing a sample

ballot, that if you just change the path
of the file it pointed to you could read

any file and the server's filesystem. Well
these are pretty bad problems, right? Even

though Georgia apparently had gone through
the process of having a security

assessment of its registration system
performed and didn't catch these, well...

So the Democrats less than five days
before the election learned of these

problems and disclosed them to the
Secretary of State's office which is

responsible for running the election
system. There is Secretary of State Brian

Kemp, who, also, it turned out, was
candidate for governor in a very close

race. So not only was he running the
election system, but he was the candidate

in the most important race in the state
where the polls were projecting that the

election was going to be a dead heat. So
an hour after receiving the security

disclosure, Secretary Kemp's office put
out a press release with this headline:

That after a failed hacking attempt
they're launching an investigation into the

Georgia Democratic Party and they've
called the FBI on the Democrats. So...

Brian Kemp won the election and is now the
governor elect of Georgia. So this guy who

did so well handling the security of the
voting system while he was secretary of

state is now the head political officer of
the state of Georgia. I think Georgia's

"F" just might stick with them through
2020. So...

applause
H: Thank you. So there is hope though. I

want to end on a message of hope, because
despite this, with all of these different

levels of rigor and of readiness across
the different states I believe we need

more national leadership, national
standards, and national resources thrown

into securing elections. And a bill to do
just these things made a lot of progress

in the Senate during the past term. This
is a bill called the Secure Elections Act

that was introduced by Senators Lankford,
Republican of Oklahoma, and Klobuchar,

Democrat of Minnesota. And it ended up
gathering a large number of bipartisan

sponsors, split evenly between Republicans
and Democrats. It would have required

states to adopt paper, to adopt strong
audits, and to adopt stronger information

sharing practices to let each other and
the federal government know if they saw

signs of people trying to break in. This
bill made it a long way, but unfortunately

got stuck in the committee after some
opposition from the White House just days

before it was going to be marked up and
hopefully then made it make its way to the

floor. But this shows that bipartisan
cooperation is possible even in this

Congress, and that there are a lot of
serious people who now realize that

election cybersecurity is a matter of
national security and defense. I think in

the next Congress there's a good
possibility that we will see effective

legislation to provide national standards
and leadership for elections. But it's a

question of threading a political needle
and getting Congress to act. So to defend

our elections we don't need rocket
science. We need simple steps like

applying security best practices and
expertise to secure registration servers,

adopting a paper record of every vote, and
applying simple post-election audit

techniques to make sure the paper record
is right. If we do these things well we'll

have a much more robust and evidence-based
election system that can detect and

recover from attack attempts.
Unfortunately today our dialogue about

elections isn't based on evidence. It's
largely based on faith: on faith in the

democratic process, on faith in the people
and the technology that's responsible. But

I think voters deserve better. Voters
deserve, if they're reasonably skeptical,

to have it proven to them that the
election result was right, and that is

possible with simple and practical
technology that we have today. All it's

going to take is national leadership to
make sure that all states, even states like

Georgia, adopt the necessary protections
soon. So what can you do? Well as a hacker

or a computer scientist you can work with
your election officials to help explain

the technology, the threats, and the
defenses. You can work to explain the

threats to the public, because we all need
to understand, just as a matter of modern

civics, how elections can be attacked and
defended. You can work to build better

ways to use technology to make voting on
paper easier and more efficient. While

technology can help voting in a lot of
ways, just... we shouldn't trust it is the

only way in which votes are counted and
results are determined. And as a citizen,

well, you can demand that election
authorities implement paper and risk

limiting audits. Get involved through
activist groups to help campaign for

protections like this, and especially
please urge the U.S. Congress to pass

legislation like the Secure Elections Act
and similar bills to make sure that

election systems across our country
achieve these security properties. You can

learn more from an online course I have
for free on Coursera called Securing

Digital Democracy that provides several
weeks' worth of material about the history

and the technology of election defenses.
But we've got to get going. It's only been

two years, believe it or not, since Donald
Trump became president, and it's only

about 22 months until the next
presidential election. It's time to get

moving. Thank you.

applause

Herald Angel: thank you very much. What I
got from this talk is it takes 27,400

people, so we have to scale up Congress.
We're going to do a Q&A. And I think we'll

just start with Mic number two
because I can see that one.

Question: Thanks for the great talk. What
if someone targets the-- Mic problems

Mumbling
Herald: Um, we need mic #2 live.

Question: Does this work? Hello?
silence

Angel: Try again
Question: Hello? Ok great. Thanks for the

great talk. What if someone targets the
randomness in your risk-limiting audit?

Q: Doesn't that pose a vulnerability?
Speaker: Oh yes. Definitely you need to have

a secure randomness in whatever auditing
method you're doing if it's going to be by

a statistical sampling. That's one reason
why the auditing techniques that Colorado

practices, they actually have a public
ceremony in which officials throw dice in

front of TV cameras in order to pick the
random seed. But a lot of thought has to

go into designing that process well, so
that it's not only truly random but also

something that people can know and believe
is truly random. Thank you

Angel: OK Mic number six
Question: Thank you so much for the talk.

You spoke about how in Georgia the
disclosure of vulnerabilities was

punished, almost. Is there any talk or
movement towards having something like bug

bounties for Election Systems?
Speaker: Yes in fact there is another bill

that was introduced in Congress that would
do just that, and establish a kind of bug

bounty program. I'm not sure that that
idea yet has a lot of legs, but I think it

would help. I think right now though we
don't really need all that much more

incentive for people to want to try to
help secure democracy. A lot of people,

including I'm sure a lot of people in this
room, would gladly volunteer to do so. We

need a way of organizing that effort and
making sure that people can discover and

report problems without fear of having it
turn into some political weapon to be used

against them.
Angel: Mic number one

Question: Hey thanks for the talk. Like
the case in Georgia doesn't sound that

terrible because like in Lithuania a couple
of years ago we've had this issue where you

just didn't need to change the URL you
just did have to refresh the page and here

you go. You have the information about a
different citizen. My question is, like,

what if the paper trail leads to the
knowledge that the election was rigged in

some particular area like two years after
the election or like one year after the

election? What happens then? Does it
change anything?

Speaker: A year or so after an election
would be a great catastrophe if we only learned

then that the political leaders were not
legitimately elected. We don't really have

any precedent for that. That's why the
recommendation and what some states like

Colorado are starting to do is, they're
implementing stronger audits, is to make

sure the audits are completed as soon as
possible, ideally before the election

results is certified. I recently came out
with a paper with Phillip Stark and Ron

Rivest that gives an audit system that you
can start doing even the moment polls

close on election night and perhaps have,
in a not so close election, a full complete

audit by the time results are announced on
election night. So it's possible to do it

quickly with sufficient organization.
Angel: OK. Microphone number 8

Question: Hi I'm curious about the
attribution of attacks. Is there possibly

any instance at which you would be not
sure that it was Russia that performed the

attacks, or maybe it was China. So how do
you know that it was exactly Russia, or

China or India?
Speaker: So all we have to go by really is the

assertions of our intelligence agencies in
the U.S. and in some cases like for the

Democratic National Committee breaches the
assertions of private security firms that

were involved in the investigations. I
agree with you, attribution in general is a

darn hard problem. But if you're willing
to accept the credibility of the

intelligence reports and read between the
lines just a little bit it looks like the

reason, the basis for their attribution, is
largely not technical but based on

intercepted communication of people who
were involved in organizing the attacks in

Russia. And I think more information about
that is likely to come out as the Mueller

investigations proceed. So I mean there's
some necessary grain of salt. You can see

what incentive people might have to try to
trump up, so to speak, the involvement

of Russia. But you can also see in the
current political climate why at least the

executive branch would have a reason to
try to tone down allegations of Russia's

involvement. So you'll have to interpret
the weight of the evidence as you will.

Angel: OK, the last question
from the Internet.

Angel: We're running out of time. Sorry.
Question: Has any organization or group

unveiled a voting machine designed to
address all of the security issues that

you have brought up here? Is there a
solution to the problem?

Speaker: I'm sorry could you repeat the
beginning of that question?

Question: Has any group or organization
unveiled a voting machine that is designed

to address all of those security issues
that have grown up?

Speaker: OK so there are efforts to
develop voting machines that are based on open

source software, that are based on better
validated software. Benedita, a researcher

in this area who has done a lot of great
work is one person who's recently launched

an effort to do that, although there are
others. And I think that will help. But at

the end of the day I think however well-
designed the software and our voting

machines is, that can raise the bar for
attacks, but it's never going to be enough

to also be able to convince skeptical
voters that everything is OK, because,

well, among other things, how do you know
that that software is really what's

running in the machines that are counting
your votes? So there's a lot we can do to

make voting machines better. At the end of
the day they're also going to have to have

that paper trail and those statistical audit
so that everyone can believe the results.

Angel: Thank you very much.
That concludes the talk.

Speaker: Thank you.
applause

Angel: I think you'll be around for a few more
answers on the Congress, so everybody who

is here can ask questions in person.
Speaker: I will and hopefully tomorrow

there'll be a Diebold voting machine
somewhere around here for everyone

to hack themselves. Thank you again.
Angel: Let's hack that thing.

postroll music

subtitles created by c3subtitles.de
in the year 2018. Join, and help us!