Speaker 1: All right. In this episode I talk about election security
Speaker 1: with retired Air Force Major General Earl Matthews who is
Speaker 1: the chief security officer at Rodan and who has been
Speaker 1: thinking about election security for over 20 years. We had
Speaker 1: a pretty wide ranging conversation taking us through the ultimate
Speaker 1: goal of election attacks. The Iowa debacle and the likely
Speaker 1: motives for foreign intervention into U.S. elections so with that
Speaker 1: I'm happy to bring you my conversation with General oral
Speaker 1: Matthews on the topic of election security.
Speaker 2: All right welcome General Matthews. Thanks for coming on. Unsupervised Learning.
Speaker 3: Dan thanks very much.
Speaker 2: Now Happy Friday dear so I will have already introduced
Speaker 2: you on the show and looking at your background it
Speaker 2: looks like we actually both worked at HP oh that
Speaker 2: also at same time I think it might have been.
Speaker 2: Yeah it was. Was it called ESPN the timer ISIS
Speaker 2: or something like that.
Speaker 4: No I it was so when I tried security products. Yes.
Speaker 4: Yeah I belonged in ESF That's right.
Speaker 2: Yes. So I worked for Jason Schmidt and fortify him
Speaker 2: for Ryan English and fortifying demand.
Speaker 5: Wonderful that I did when I fell in contact with
Speaker 5: Jason and others and I think fortify is still an
Speaker 5: outstanding private. I recommend it still did it yeah.
Speaker 6: Absolutely. Very cool. I guess told me how you got
Speaker 6: started in election security. I assume 2016 was probably a
Speaker 6: catalyst of some sort.
Speaker 5: Yeah. And it's actually you know my military background elections
Speaker 5: I've been front and center most of my entire career
Speaker 5: adult life. I voted the absentee ballot and it actually
Speaker 5: really started peaking my interest in there in 2000 right
Speaker 5: when we had the hanging chads and what the impact
Speaker 5: was at that time about you know supposedly all these
Speaker 5: absentee ballots from the military sway and sway the vote
Speaker 5: and hadn't been counted.
Speaker 7: And then many years later I find myself in the
Speaker 7: RAF in Germany and I am responsible for all the
Speaker 7: postal distribution throughout Europe. Now that comes by air and
Speaker 7: the army then would be responsible for by trucking it
Speaker 7: out to all the different bases but I really had
Speaker 7: to focus in on election years because after the 2000
Speaker 7: elections we had to account now for all the ballots
Speaker 7: that were coming into the military post offices overseas and
Speaker 7: actually tracking them to make sure that the people who
Speaker 7: got voted and put it back in there it got
Speaker 7: delivered on time and then just as an aside my
Speaker 7: wife also works in the I.T. sector and she was
Speaker 7: helping with the first voting.
Speaker 8: This is in Uganda to thousands of military folks. So
Speaker 8: I have been associated for a long time and now
Speaker 8: that know after 2016 and that all the influence on
Speaker 8: infrastructure security but really about the disinformation it has been
Speaker 8: used really got my attention leading up to that.
Speaker 5: Up to that election and so now today you know
Speaker 5: social media is really my biggest concern on disinformation.
Speaker 9: And you know we're seeing social media really start take
Speaker 9: a hold of this start deleting accounts and I firmly
Speaker 9: believe that social media companies should be accountable that the
Speaker 9: accounts that are being created are truly real accounts and
Speaker 9: are not being done falsely.
Speaker 6: Yeah absolutely. So are you familiar with our Rene de Resta.
Speaker 3: Yeah I am familiar yes sir.
Speaker 2: Yeah. So really interesting she she does a lot of
Speaker 2: work on the social media stuff and the both the
Speaker 2: misinformation and the disinformation. And one of the things she
Speaker 2: talks about is how difficult it can be to lock
Speaker 2: on to a bad account because what they'll do is
Speaker 2: months before the campaign they they create a legitimate account
Speaker 2: with like legitimate sounding you know user name or whatever
Speaker 2: and then they go in and they drop tons of
Speaker 2: content related to that particular thing. So let's say it's
Speaker 2: cars or fast cars or car modifications it'll be months
Speaker 2: and months and months of a precedent of legitimate content
Speaker 2: just so they could track the algorithms that look for
Speaker 2: you know pure misinformation.
Speaker 5: Yeah but when those accounts get January what I would
Speaker 5: say the corollary to that is that you have to
Speaker 5: supply name information telephone numbers and things like that. The
Speaker 5: more obscure that that becomes I think should be an
Speaker 5: indicator to a social media platform that something isn't exactly
Speaker 5: right here. And I think it's also interesting perhaps for
Speaker 5: your listeners to understand that 61 percent of all the
Speaker 5: traffic on the internet is actually created by bots and
Speaker 5: not by humans putting content on there and of that
Speaker 5: about 30 some percent are actually fairly defeated. So what
Speaker 5: we're going to talk about today. But I do think
Speaker 5: it's an interesting factoid that actually you know more than
Speaker 5: 60 percent of the traffic on the Internet is not
Speaker 5: human created yeah.
Speaker 2: Interesting. And what would you say most of that traffic
Speaker 2: is is that like clicking on youtube links like trying
Speaker 2: to vote up content on Twitter. Is it a voting
Speaker 2: type fraud or what type of bot activity is that.
Speaker 8: Yeah. So I would take most of that bot activity
Speaker 8: it's just taking information from one location and then moving
Speaker 8: it to another location or trolling where news organizations are
Speaker 8: continually looking for new types of news stories that are
Speaker 8: being out there whether they're generated by me putting up
Speaker 8: a video or that another news organization has has put
Speaker 8: up there. And so it's just you have these algorithms
Speaker 8: out there just to get that information and so forth.
Speaker 2: OK that makes sense. So who crawlers.
Speaker 10: Yes great traps. Yeah.
Speaker 6: Yeah sure. Awesome. And I noticed in researching some of
Speaker 6: your work you had some tenants you had five tenants.
Speaker 6: I have them here. But if you would like to
Speaker 6: go through them the first one was stop making assumptions
Speaker 6: the second one was transparency. You won't talk about those.
Speaker 8: Yeah. And I think that what our listeners really don't
Speaker 8: they'll have a hard time struggling with with all these
Speaker 8: new exposures of our information is that there really isn't
Speaker 8: anything new right that's happening here.
Speaker 11: Most of it is coming from mis mis configurations and
Speaker 11: part of that is just because we start assuming that
Speaker 11: things are actually working like they're supposed to be and
Speaker 11: their security controls really aren't doing that. I think there's
Speaker 11: a lack of transparency right in how the electronic voting
Speaker 11: companies are letting us know that the vulnerability of their
Speaker 11: platforms and that there's a lack of software independence in
Speaker 11: the voting machines and third parties. But now I think
Speaker 11: it's gotten significantly better since 2016 but I just think
Speaker 11: the whole all the assurance piece of what happens to
Speaker 11: these proprietary systems just aren't there for us.
Speaker 6: Yeah and you've got here mandate transparency from commercial hardware
Speaker 6: software companies many of these are transparency based data driven
Speaker 6: evaluation of providers that provide the technology alignment between state
Speaker 6: CEOs and CEOs and secretaries of state. These all seem
Speaker 6: really solid and continuous and quantified evaluation and validation of
Speaker 6: security controls. I think these are fantastic recommendations.
Speaker 8: Yeah probably for our listeners they may not well understand
Speaker 8: that by the way all elections are run by the
Speaker 8: states not run by the federal government. You know that
Speaker 8: this voting piece of this falls underneath the secretary of
Speaker 8: state and not underneath the governor. Day to day routine business.
Speaker 8: And so as a result there hasn't been a very
Speaker 8: tight alignment between the state CIO OWS and the state
Speaker 8: information security officers with the secretary of state's election State Committee.
Speaker 8: So I'm a huge fan of those organizations coming together
Speaker 8: and I've seen that I've seen it in Michigan and
Speaker 8: I've seen it in Indiana and then in Iowa. We
Speaker 8: just saw that the chief security officer for the state
Speaker 8: has now resigned from that position and actually has moved
Speaker 8: over to the secretary of state election office to help
Speaker 8: them with cyber security. So this is and that is
Speaker 8: primarily been because we have a treaty on infrastructure as
Speaker 8: a holistic problem. We've been looking at it in isolation.
Speaker 6: Interesting. So is that similar to like a jurisdictional problem.
Speaker 6: Not quite at the scale of 9/11 but where you
Speaker 6: have different groups and they're not designed to work with
Speaker 6: each other and therefore the information's not being exchanged. Is
Speaker 6: that kind of what you're describing with the secretary of
Speaker 6: state versus governors group.
Speaker 5: I think it's traditional. So I've been of functions versus
Speaker 5: the commingling of functions across an organization. And you and
Speaker 5: I saw this when we were at HP you two
Speaker 5: things got siloed off and then the left hand doesn't
Speaker 5: know what the right what the right hand is doing.
Speaker 12: But I think that since 2016 we've seen a significant
Speaker 12: change in all of this because of the one that
Speaker 12: designation against critical infrastructure. We've seen the DHS create a
Speaker 12: special office for election to look since her day oversight
Speaker 12: and we've seen the US government create the US election
Speaker 12: commission and then we've also seen the federal government designate
Speaker 12: funding for states specifically for election security.
Speaker 6: So I think that I think it's gotten very interesting
Speaker 6: I guess. So you currently work at is a very
Speaker 6: dinner or Rodin verdant probably yeah.
Speaker 5: Yes buried in and that's a common you mispronunciation of
Speaker 5: the organization but it comes from the god burritos for
Speaker 5: Truth o knife in the God put in for wisdom
Speaker 5: in battle and what Odin would do is send out
Speaker 5: dogs and ravens to collect intelligence about his enemy and
Speaker 5: then bring that intelligence back and then he would go
Speaker 5: into battle which is why he was so successful.
Speaker 8: I consider ourselves the warrior troop company because what we
Speaker 8: do is we instrument your network looking for your security controls.
Speaker 8: Current instantiation. Are they working like you are supposed to
Speaker 8: be working. And we do that by running like malware
Speaker 8: in your production environment to give you the No Kidding truth.
Speaker 8: This is how my controls are actually working. So that's
Speaker 8: what their net burden is about.
Speaker 2: Nice and Verizon is now part of FireEye. Is that correct.
Speaker 13: That is very true.
Speaker 8: So last summer we were one of the few cybersecurity
Speaker 8: companies that gets acquired and we were acquired by FireEye
Speaker 8: which is really considered the number one threat intelligence in
Speaker 8: the world and Mandiant is a part of fire right
Speaker 8: that does the most efficient response around the world in
Speaker 8: our platform runs off of intelligence. So it was a
Speaker 8: superb marriage for us.
Speaker 4: Now in this space that's fantastic Degrassi.
Speaker 2: Yeah. And actually I knew I recognized the name Veridian
Speaker 2: and I looked it up it's actually one of my
Speaker 2: favorite spaces in all of the security tools. I love
Speaker 2: the idea of continuous checking. So I guess can you
Speaker 2: go in a little more detail about how it works
Speaker 2: like Do you have a center and a receiver and
Speaker 2: you sprinkle these throughout the environment and then you send
Speaker 2: malware from the center to the receiver to see if
Speaker 2: it's caught by various controls or how does that work.
Speaker 5: Yeah. You've described that you've nailed it.
Speaker 8: You could be a spokesman for us and what is
Speaker 8: all automated mail software driven and what we are really
Speaker 8: attacking is the number one problem which is false with.
Speaker 8: And so we are both the attacker and the target
Speaker 8: we are. We sit in your operational environment but we're
Speaker 8: not on anybody's operational assets meaning if you have a
Speaker 8: server that has customer data on it. We're not sitting
Speaker 8: on that server. We just look like a virtual image
Speaker 8: of that server with the same security controls. And then
Speaker 8: is the. And then we put one and another side
Speaker 8: of your network where it could be external or to
Speaker 8: be internal to look for segmentation and then the you
Speaker 8: know the National console tells this actor to go attack
Speaker 8: this other actor. And we know that it's successful or
Speaker 8: not successful because we are controlling both the originating in
Speaker 8: IP address and the target IP address. And if it
Speaker 8: makes it from one end to the other we know
Speaker 8: that your security stack didn't block it. And then what
Speaker 8: we do is we produce all the data to show
Speaker 8: what in your security stack could have blocked it but
Speaker 8: you don't have it together correctly the painful to do that.
Speaker 14: Mm hmm interesting. Yeah. Yeah.
Speaker 2: And just to let everyone know who's listening. This is
Speaker 2: not about the vendor thing. So we have lots more
Speaker 2: questions about elections itself but I think this is important.
Speaker 2: And I actually want to ask you does this interact
Speaker 2: at all with election security devices like do you put
Speaker 2: it on a network where polling devices are in use
Speaker 2: this technology to defend elections in any way or is
Speaker 2: it unrelated.
Speaker 8: No you would actually put it into the segment in
Speaker 8: which those voting polling devices are going to be located
Speaker 8: and then what you would be doing is just assessing
Speaker 8: that the controls that are protect to protect that voting
Speaker 8: device are actually working like they're supposed to be working
Speaker 8: because many of these voting devices are connected to either
Speaker 8: a separate network or an outer band network and you
Speaker 8: monitor that from a defensive staff who's actually doing what
Speaker 8: it's supposed to be doing OK.
Speaker 2: That makes sense. So you're you're basically looking at the
Speaker 2: health of the networks and the connectivity around that environment.
Speaker 2: So it's not like running an age and like on
Speaker 2: the voting machine or something like that and looking out
Speaker 2: for anybody making standpoint that's all right.
Speaker 15: The voting machines have enough going on up there and
Speaker 15: they don't need any more heavyweight things put on there.
Speaker 6: Speaking of that what did you think about the Iowa
Speaker 6: situation yeah.
Speaker 8: And so this was really fascinating to me. I belong
Speaker 8: to a Forbes Technology Council and it was immediately sent
Speaker 8: a note by another member who was on the council
Speaker 8: and me on there like five or six others in
Speaker 8: this little dialogue.
Speaker 5: And as soon as I got it the next morning
Speaker 5: I just was easy for me to respond back and
Speaker 5: I knew in my heart that it was not because
Speaker 5: of the cyber vulnerability but development then you know I
Speaker 5: was a CIO myself at U.S. Transportation Command and what
Speaker 5: always happens in software is that there is a rush
Speaker 5: to finalize the code and then that generally leads to
Speaker 5: a lack of amount of time for the testing organization
Speaker 5: to do their full vetting of it before that app
Speaker 5: goes into production. Sure. That was my first suspicion and
Speaker 5: that that's the one that actually turned out to be true.
Speaker 5: My second suspicion was that there wasn't enough data sets
Speaker 5: available for them to actually go do the testing at
Speaker 5: scale and we see this all the time. It doesn't
Speaker 5: matter how large a organization is having that real production
Speaker 5: data it gets hard to come by. And then my
Speaker 5: third suspicion was there was no never a dry run
Speaker 5: of the entire system from end. So it turned out
Speaker 5: that the number one hey this rush to get there
Speaker 5: actually happened because we did x and the number to
Speaker 5: beat 360 or do a dry run with that.
Speaker 4: Interesting what that application. Yeah yeah.
Speaker 15: Now M.I.T. has done a review of their code. Now
Speaker 15: they've got all these other vulnerabilities but that wasn't the
Speaker 15: cause of the problem on top of that.
Speaker 6: Interesting. How do you see the relative threats of overall incompetence.
Speaker 6: Like you said just not necessarily incompetence but like software
Speaker 6: is hard and complex and there are lots of failures
Speaker 6: versus a lack of transparency into voting versus actual for
Speaker 6: an intervention into the system. How do you stock those
Speaker 6: as as threats.
Speaker 7: Well I would certainly stack. Number one foreign intervention through
Speaker 7: either miss or disinformation using social media platforms as being
Speaker 7: the number one threat and that is primarily because I
Speaker 7: think we've done a very good reason for this show
Speaker 7: about addressing the hardware and software pieces of it and
Speaker 7: to your point. Software is never going to be perfect.
Speaker 7: So that's how I would say that's the the order
Speaker 7: of those of those two threats is when we look
Speaker 7: at the voting process. Dan it's actually pretty simple. You
Speaker 7: have an eligible voter. You have one vote and that
Speaker 7: vote has to be kept secret.
Speaker 3: And then what happens is we have a chain of
Speaker 3: custody and it needs to be an end and verifiable structure.
Speaker 3: We have to guarantee integrity of the. And then that
Speaker 3: the ballot was actually cast was collected and that's been counted.
Speaker 3: And now we need to verify that. I mean it's
Speaker 3: a pretty pretty simple thing actually in the end.
Speaker 2: Interesting. What would you say. I actually agree with you
Speaker 2: for the record. But what would you say to somebody
Speaker 2: who says well yeah there was foreign interaction you know
Speaker 2: interference with the 2016 election but it didn't seem to
Speaker 2: have that much impact in a tangible way. I'm not
Speaker 2: sure we have great data on that. I think a
Speaker 2: lot might be conjecture. But let's say it wasn't that
Speaker 2: much of a tangible impact in 2016. How would you
Speaker 2: respond to those numbers.
Speaker 7: Yeah I would say where it had the most tangible
Speaker 7: impact was creating divisiveness between groups. All right. So that's
Speaker 7: where it had the biggest impact versus you know pitting
Speaker 7: the Republicans versus the Democrats are actually influencing the election
Speaker 7: through the voting infrastructure itself but certainly creating dissent and
Speaker 7: animosity amongst groups played it played a big role in it.
Speaker 7: And that problem is not going to go away. And
Speaker 7: we've looked and have tracked this now since the early
Speaker 7: 2000s and then you know specific some would say 40.
Speaker 7: Up to earlier this year we've seen them in the Philippines.
Speaker 7: We've seen it in the US elections we've seen it
Speaker 7: in France. We've seen it in Kenya seen it in
Speaker 7: Russia itself. We've seen it in Catalonia Andorra Cambodia and Mexico.
Speaker 7: Most recently in Hong Kong are not Hong Kong and
Speaker 7: Taiwan and their elections. So it's really our viewers and
Speaker 7: your listeners really have to pay attention to what is
Speaker 7: the source of the information in the media outlet that
Speaker 7: they're getting their data from and how they're making their decisions.
Speaker 7: That's what I would say that we have to just
Speaker 7: be smarter in that regard.
Speaker 6: Yeah I think that's crucial it seems like we can
Speaker 6: end up in November of 2020 with half of the
Speaker 6: country thinking the election was stolen whichever way it goes.
Speaker 6: What do you think we have to do to be
Speaker 6: able to address that.
Speaker 16: I don't think that will be the case.
Speaker 8: What I think more importantly right would be this whole
Speaker 8: issue on where did it. Where am I getting my
Speaker 8: my news media from and where am I getting my
Speaker 8: information from what are my trusted sources of that. And
Speaker 8: I think people have to educate themselves on getting you
Speaker 8: know familiar that hey there is a evolving threat landscape
Speaker 8: that is trying to impact the way that I think
Speaker 8: and what it is that I read and that if
Speaker 8: I'm only getting my information from one source I'm probably
Speaker 8: likely to get the least amount of right information. So
Speaker 8: it should be get kind of get cooperated. So I
Speaker 8: think people should try to get their news from you
Speaker 8: know well established news organizations versus some pop up site
Speaker 8: that has created some because they really don't know.
Speaker 7: I find it so that would probably be the the
Speaker 7: biggest thing. Then the second thing is that there are
Speaker 7: a lot of actually online resources that are voters if
Speaker 7: they are concerned about the voting infrastructure.
Speaker 9: If they can go to such an as the center
Speaker 9: net for Internet Security has a great election place Belfer
Speaker 9: Center at Harvard University also has one and then the
Speaker 9: DHS also has a collection services place where people can
Speaker 9: read up to you know make themselves more confident that
Speaker 9: you know things are being addressed and we will have
Speaker 9: a secure and uneventful.
Speaker 2: Yes even in 2020. That makes sense to me it
Speaker 2: all combines though into a single threat. Right. Which is
Speaker 2: the single goal for the attacker which is to reduce
Speaker 2: the legitimacy of the U.S. government in the mind of
Speaker 2: its citizens. Right. And it's all about this polarization. There's
Speaker 2: actually a conversation about how a lot of social media
Speaker 2: networks are trying to optimize for predictability in the user. Right.
Speaker 2: They actually don't want someone who's going to not be
Speaker 2: sure what to do with a piece of content. They
Speaker 2: want someone who's definitely going to like or hate something.
Speaker 2: And when we're training the algorithms we're actually training them
Speaker 2: to teach people to be more polarized which is which
Speaker 2: is kind of scary. And that's why I think I
Speaker 2: think we do have to worry about the 2020 situation
Speaker 2: because it's one thing to say well we should just
Speaker 2: take better sources.
Speaker 6: I think the problem is if they believe they have
Speaker 6: good sources they're not going to search for better ones. Right.
Speaker 6: And if you know what I mean so it's like basically.
Speaker 6: I think it was Hitchens that said if you have
Speaker 6: someone who doesn't accept evidence there's no evidence you could
Speaker 6: provide them to convince them.
Speaker 17: I would agree wholeheartedly with that.
Speaker 16: Right. And so again I just. There's no way you're
Speaker 16: going to come back I have no.
Speaker 8: No way to offer any solutions in that regard. In
Speaker 8: my personal view what we're seeing here are classic psychological
Speaker 8: operations being done at scale to influence elections that.
Speaker 12: Are Done. That's that's that's right.
Speaker 2: Yeah I agree with you. I mean what do you
Speaker 2: think are the main threads like what are the main
Speaker 2: messages that are trying to like advance it. I mean
Speaker 2: what we've saw before in 2016 it was very much
Speaker 2: along the lines of what you said earlier which is divisiveness.
Speaker 2: So they would find these niche groups that felt very
Speaker 2: strongly about a small topic and then they would inflame
Speaker 2: the counter side. In fact they they organized a physical
Speaker 2: one in Texas. I'm sure you heard of this one
Speaker 2: where they they managed to bring protesters from both sides
Speaker 2: of a topic and arranged them in the same physical
Speaker 2: location presumably to try to create an actual physical altercation.
Speaker 2: But it seems like they were doing that over and
Speaker 2: over with various topics. So that seems to be one
Speaker 2: like a tactical view to do it at a small
Speaker 2: scale for a small number of issues and get people
Speaker 2: really riled up about a specific thing but it seems
Speaker 2: to me like there's an overarching you know strategic narrative
Speaker 2: which is you can't trust the election system because it's
Speaker 2: all bad and it's all fake news and that just
Speaker 2: makes people want to check out. And it also makes
Speaker 2: them want to not accept an outcome if they don't
Speaker 2: like it yes to all of that.
Speaker 8: And the grand strategic play that's been done on the
Speaker 8: world stage in my view is that Russia China Iran
Speaker 8: and North Korea right are trying to create this decisiveness
Speaker 8: so that we will end up with this position of
Speaker 8: that we've got all these things happening at home. We're
Speaker 8: not going to engage anywhere else overseas when something else
Speaker 8: is happening. Right. That we normally might get involved in
Speaker 8: but we go ahead. We've got too much at home
Speaker 8: dander or we can divert our time and energy to
Speaker 8: focus on those other world part that a really one
Speaker 8: 100 percent.
Speaker 2: I think they're basically trying to get us basically trying
Speaker 2: to get us out of the global theater because we're
Speaker 2: too consumed with our own internal strife so that whoever
Speaker 2: can step up right. I think particularly Russia.
Speaker 6: Would love to see that happen so they could regain
Speaker 6: some of their previous glory right.
Speaker 13: Yes that's exactly right. But don't discount the you know
Speaker 13: the Chinese and in this either especially within their region
Speaker 13: of influence right now Hong Kong specifically Taiwan Vietnam. I
Speaker 13: just saw a news report right the other day saying
Speaker 13: that the Philippines may back out of the defense protection
Speaker 13: you know pack. Go that's dangerous for us if that
Speaker 13: if that's to happen in my personal personal view.
Speaker 8: So the Chinese are going to be heavily targeting elections
Speaker 8: within their within within our post Asian region. So look
Speaker 8: why we focus a lot on the Russians and our own.
Speaker 8: The Chinese are actively doing this and in Asia.
Speaker 6: Oh that's a great point.
Speaker 2: And then they could potentially do the same thing internally
Speaker 2: with causing strife internally because that would be one less
Speaker 2: person aggravating them overseas telling them not to do those things.
Speaker 2: For example if we were so consumed with our own
Speaker 2: problems maybe we wouldn't notice or wouldn't be able to
Speaker 2: act if they wanted to Taiwan.
Speaker 13: That's right. That's exactly right. And then if we look
Speaker 13: at them at least right. The Iranians are heavily involved
Speaker 13: in election hacking too because they're trying to influence what's
Speaker 13: happening right with what the Gulf States and causing uprising
Speaker 13: uprisings there too. So it's a world problem just a
Speaker 13: world problem and governments have got to come together. Now
Speaker 13: one of the things that you know maybe some of
Speaker 13: our listeners are going to be happy about it. What
Speaker 13: I'm going to say back. But you know our next
Speaker 13: really evolution into this kind of coming back to the
Speaker 13: Iowa pieces Mobile Voting I am a huge fan of
Speaker 13: having the capability to do mobile voting.
Speaker 4: Interesting.
Speaker 13: In that you know as I described my military background
Speaker 13: I spent a lot of time received most my career
Speaker 13: I did absentee voting. I would love to be able
Speaker 13: to just vote at the time and place it by
Speaker 13: the leader. If I'm deployed somewhere in the world or
Speaker 13: assigned somewhere in the world. We have a lot of
Speaker 13: expatriates write us citizens living in foreign countries this stay
Speaker 13: where you just might be on vacation. How awesome would
Speaker 13: it be that you could just use your phone to
Speaker 13: be able to go vote. Yeah and I it's come
Speaker 13: it's coming. I think block chain is a technology that
Speaker 13: will help us in that regard which is really totally auditable.
Speaker 13: It's immutable and it's very transparent and it's secure. We
Speaker 13: saw a couple of states in 2016. I think West
Speaker 13: Virginia and Virginia you test drive it and then you
Speaker 13: know then that will probably get most people's ideas. I'm
Speaker 13: you know I'm just a fan of the national digital identity.
Speaker 13: Why shouldn't I have. We'll have to have a passport
Speaker 13: app a driver's license to prove all this stuff already.
Speaker 13: And when I log on and I want to buy
Speaker 13: something that you know target I shouldn't target No. Yeah
Speaker 13: it's a road map is right. Here's his national identity.
Speaker 4: OK what do you think about that Dan.
Speaker 2: Yeah yeah I was going to ask you about this.
Speaker 2: This is very interesting that we got onto this. I
Speaker 2: was very much of the same opinion for many years
Speaker 2: that why don't we just move to digital voting like
Speaker 2: this is silly. You know it's we have all this
Speaker 2: technology why don't we just do it. And after attending
Speaker 2: the enigma conference for a few years I attended multiple
Speaker 2: elections security and actually digital election security talks and I
Speaker 2: came away from them with my mind changed. Basically all
Speaker 2: of them actually all of them said we are nowhere
Speaker 2: near ready. I wonder if it's not possible to say
Speaker 2: we are ready or aren't ready because it depends on
Speaker 2: the population that you're talking about. It depends on the
Speaker 2: technology you're talking about. But when you mentioned the national I.D.
Speaker 2: I think that would be a critical prerequisite because right
Speaker 2: now we just have a giant mess of different ideas
Speaker 2: like who's going to actually make sure that it's you.
Speaker 2: But what a lot of these talks actually talked about
Speaker 2: was just how easy it is to break these systems
Speaker 2: how fragile elections are already in that if you moved
Speaker 2: it to the digital world you would just have even
Speaker 2: more questions about integrity than we have now.
Speaker 5: Well what I would say is that in anything that
Speaker 5: we do in the electronic age is going to have
Speaker 5: some type of risk associated with it because nothing is
Speaker 5: truly secure and you know you're you're a longtime practitioner
Speaker 5: in this space as I am and you know that
Speaker 5: even close networks are not closed networks. So it depends
Speaker 5: to me is how big Hamlet. How let's assess what
Speaker 5: the risk is then let's figure out how would you
Speaker 5: how do we mitigate that risk. And you go from there.
Speaker 5: Yeah that's what I would.
Speaker 2: Yeah I agree with you. And I do think it's inevitable.
Speaker 2: And I do think that's where we should be going.
Speaker 2: I think the question is really just the cadence and
Speaker 2: what has to happen first. I think as we talked
Speaker 2: about earlier ultimately that the target for the attacker is
Speaker 2: trust in the system. Right. So yeah if we moved
Speaker 2: into digital voting that would have to be paramount on
Speaker 2: our minds is like how do we that if it
Speaker 2: was some sort of block chain thing which somehow block
Speaker 2: chain seems to have dropped off the radar in 2020.
Speaker 2: It seems like fewer people are talking about it at
Speaker 2: least in my circles. But yeah but if you were
Speaker 2: to have a record of every single vote that was
Speaker 2: done by the different different people and be able to
Speaker 2: say yes it was done on this device with these
Speaker 2: parameters and here's how they authenticated to that device and
Speaker 2: here's the the way we could tell it was actually them.
Speaker 2: I mean if we had a full life cycle like
Speaker 2: that that was you know cryptic graphically verifiable. I think
Speaker 2: that would be a great step.
Speaker 14: And I do think it's sad. I don't know.
Speaker 16: Yeah. I don't think we're too far away from it.
Speaker 16: I mean I've not gone to any of those to
Speaker 16: see what the you know the big enigma conference. You
Speaker 16: know what you're saying. But I would say if by
Speaker 16: the next you know in the next four years significant
Speaker 16: progress will be will be made it made in that
Speaker 16: if you think about it right. Every day we almost
Speaker 16: every a lot of America elevated what the markets do
Speaker 16: their banking every single day. They're comfortable enough with that risk. Right.
Speaker 16: Why would they be comfortable enough with taking the risk
Speaker 16: to be able to have my phone encrypt. You know what.
Speaker 16: Download the whatever app my state plays is their app
Speaker 16: and they get it then when I vote it gets encrypted.
Speaker 16: Goes back to that central database and then gets that
Speaker 16: gets deposited at any different than the way that they're
Speaker 16: logging on to make a deposit from their phone to
Speaker 16: their bank.
Speaker 2: Yeah. One 100 percent. I think that's why it comes
Speaker 2: down to the population. Right. I mean people in our
Speaker 2: outer circles I think and people listening are gonna be
Speaker 2: 100 percent able to do that and probably be able
Speaker 2: to do it securely. But I think there are other
Speaker 2: populations the elderly disenfranchised groups who maybe don't have access
Speaker 2: to the same tech. And then you have to worry about.
Speaker 2: I don't know. I mean security so I'm always worried
Speaker 2: about everything but it's like now you start paying people
Speaker 2: for votes. So the actual vote is a hundred percent correct.
Speaker 2: But they were somehow encouraged to do that and then
Speaker 2: you know they did you got to do it already
Speaker 2: in the current voting booth.
Speaker 16: So I think yeah that's still possible now but I
Speaker 16: would say that your assessment on that risk right is
Speaker 16: exceptionally notable that we have to pay attention to that. Right.
Speaker 16: That that certainly could drive up or even outweigh anything
Speaker 16: else that we're talking about from a cybersecurity perspective is
Speaker 16: that it's a lot easier to get people to be
Speaker 16: influenced to be able to go vote for that. Yeah
Speaker 16: right the way that they want to have it done.
Speaker 16: And that alone may say we never get there.
Speaker 6: I don't know. Well this has been fantastic I guess.
Speaker 6: Are you optimistic going into this very crazy 2020 election
Speaker 6: year or are you optimistic for this upcoming election and beyond.
Speaker 16: So as a recap on a very optimistic that the
Speaker 16: voting companies the machines and oversight by state officials is
Speaker 16: heightened like it's never been heightened before. We're on less
Speaker 16: optimistic is our ability to be able to detect when
Speaker 16: there isn't enough disinformation out there that is causing appraisal
Speaker 16: and consternation amongst our American population and get each other.
Speaker 16: That is what I believe will remain concerned from from
Speaker 16: the whole year and I will be watching media very
Speaker 16: closely to see to see how that happens.
Speaker 6: All right. Well General Matthews it's been great having you on.
Speaker 16: And I really appreciate the conversation and again I appreciate
Speaker 16: you're inviting me to come spend time with you here
Speaker 16: on this podcast. Thank you.