Speaker 1: Get in touch with technology with tech Stuff from how
Speaker 1: stuff works dot com. Hey there, and welcome to Tech Stuff.
Speaker 1: I'm your host, Jonathan Strickland. I'm an executive producer at
Speaker 1: how Stuff Works in a love all things tech usually,
Speaker 1: but today we're gonna talk about a type of technology
Speaker 1: that can have either positive or negative effect depending upon
Speaker 1: how it's implemented. And joining me today is someone that, uh,
Speaker 1: I'm really excited could join us on the show. I'm
Speaker 1: talking about Bob Sullivan, a founding member of MSNBC, the
Speaker 1: guy behind Bob Sullivan dot net ak the Red Tape Chronicles.
Speaker 1: He's also a co host on a show called The Breach.
Speaker 1: It's All about Data Breaches. Season one, which is phenomenal,
Speaker 1: is all about the massive data breach that happened with
Speaker 1: Yahoo with three billion accounts exposed as a result of
Speaker 1: that data breach. And now they're gearing up. Season two
Speaker 1: is starting, and you're here to talk to us about
Speaker 1: voting machines, elect and and elections and how technology intersects
Speaker 1: with that and how that how that can be somewhat
Speaker 1: terrifying in some ways. Welcome to the show, Bob, Sure,
Speaker 1: thanks for having me. Really important topic, right now, so
Speaker 1: I'm glad we're talking about it. Yeah, me too. And
Speaker 1: for interest of full disclosure, I live in the state
Speaker 1: of Georgia here in the United States, and Georgia is
Speaker 1: a state that adopted touchscreen electronic voting machines very early,
Speaker 1: back in two thousand two, I think is when we started,
Speaker 1: and it's statewide here at Georgia and UH we we
Speaker 1: have a lot of things that I hesitate to use
Speaker 1: the word distinguish, but really kind of highlight some of
Speaker 1: the shoes I have with UH direct recording devices like this,
Speaker 1: the biggest one being that in Georgia, there's no associated
Speaker 1: paper trail with any of the voting record, So when
Speaker 1: a voter goes in and casts his or her ballot,
Speaker 1: there's no paper receipt where they can check that the
Speaker 1: results showing up on screen are reflected on paper, and
Speaker 1: therefore there's no real way to do a full audit afterward.
Speaker 1: And I think best case scenario, and Bob you can,
Speaker 1: I want to hear your input as well, but best
Speaker 1: case scenario for me is that even assuming there's no
Speaker 1: hanky panky going on, there's no interference in the election process.
Speaker 1: It it hurts the the appearance of the democratic process
Speaker 1: because it inserts the concept of doubt without being able
Speaker 1: to audit those results and say yes, in fact, the
Speaker 1: votes that were cast are the votes that were recorded.
Speaker 1: What what's your point of view on that particular topic. Well,
Speaker 1: that's the most important point at all. You've started at
Speaker 1: the punch line, which is fine. Um. Vote hacking is
Speaker 1: a complicated subject. In Georgia, you're very intimate with it
Speaker 1: at the moment, but all around the country there are Um,
Speaker 1: it's not just the machines, there's a whole life cycle
Speaker 1: of how your vote might be hacked or um suede
Speaker 1: or made to disappear. There's lots of different ways that
Speaker 1: votes can be manipulated. But something that's just the most
Speaker 1: fundamental thing about voting and about democracy is that when
Speaker 1: the election is over and the results are posted, that
Speaker 1: the losers believe in the legitimacy of the election. And
Speaker 1: when they don't, that creates a tremendous governance problem. So
Speaker 1: faith in the institution of voting itself is fundamental to America.
Speaker 1: And faith isn't an on off switch. And we're seeing
Speaker 1: this right now in lots of different ways, right, Um,
Speaker 1: But whether or not people believe in the integrity of
Speaker 1: the voting process itself. We'll say a lot about how
Speaker 1: we're governed. And in Georgia you mentioned paper. Um, the
Speaker 1: irony here we are on a tech podcast and we're
Speaker 1: talking about the latest and greatest technology, and we're here
Speaker 1: in the country with the latest and greatest entrepreneurs and
Speaker 1: the latest and greatest inventions, and anyone you talked to
Speaker 1: in the the voting hacking space will tell you the
Speaker 1: most important thing is paper. So we're going backwards here
Speaker 1: in some ways, but it all comes down to paper
Speaker 1: because there has to be some way to audit a
Speaker 1: vote afterwards. And if there's not, then you have a
Speaker 1: black box and people are walking up to it and
Speaker 1: touching a screen and you just trust that is going
Speaker 1: to work. And anybody who works in the technology world,
Speaker 1: we we're just having this conversation before we started this podcast.
Speaker 1: Tech often breaks everybody. Who's I mean, in the simplest example,
Speaker 1: how many times have you walked up to an a
Speaker 1: t M and tried to get forty dollars out of
Speaker 1: the machine and you accidentally hit the sixty button. Happens
Speaker 1: all the time. That's that can be a calibration thing.
Speaker 1: It can even be an angle thing. So that's just
Speaker 1: one of you know, fifty ways that things can go
Speaker 1: wrong just on the one kind of voting machine that
Speaker 1: we started talking about. So this is a big, rich topic.
Speaker 1: But legitimacy is the most important thing. And it's it's
Speaker 1: interesting that you bring up the A t M example
Speaker 1: because obviously there was the the it became somewhat infamous
Speaker 1: in text circles. But die Bald, the company that makes
Speaker 1: a lot of A t M s for a long time,
Speaker 1: was in the business of making these voting machines for
Speaker 1: various places, and uh in two thousand and four it
Speaker 1: was a huge story. The CEO of Diebald, Walden w Adell,
Speaker 1: had written a letter to various wealthy acquaintances he had
Speaker 1: in and a fundraising effort for the Republican Party and
Speaker 1: said that he was looking forward to delivering the electoral
Speaker 1: votes to get the president back into office. And a
Speaker 1: lot of people said, well, whether he intended it to
Speaker 1: be we're going to make sure this happens versus I
Speaker 1: want to, you know, support this candidate I believe in
Speaker 1: is kind of beside the point, because again, it brought
Speaker 1: that doubt into the democratic process. If if people point
Speaker 1: to him and say, but you make the machines that
Speaker 1: count the votes, and you say you plan on delivering
Speaker 1: these votes to a specific candidate, that kind of has
Speaker 1: a very dangerous implication in it. And as you say
Speaker 1: it's this, it's you already have this level of this
Speaker 1: hurdle that you have to overcome when you're designing any
Speaker 1: kind of system for voting. To make sure that the
Speaker 1: process is as straightforward and as difficult to mess up
Speaker 1: on the users side as possible. The whole keep it simple,
Speaker 1: stupid kind of approach really would be a huge benefit
Speaker 1: when you're designing any sort of voting system. Two give
Speaker 1: confidence to the voter that whatever choices they want to
Speaker 1: make are actually reflected in the votes that they're casting.
Speaker 1: And uh, as you say, with a T M S,
Speaker 1: it's easy enough to make a mistake. Those same companies
Speaker 1: are designing some of these electronic voting systems. And anyone
Speaker 1: who's worked with engineers for a long time understands that
Speaker 1: engineers are very good at building systems that make sense
Speaker 1: to engineers. Sometimes they build systems that are not so
Speaker 1: transparent to the end user. Sure, and the other thing
Speaker 1: that engineers, um some engineers do is they like to
Speaker 1: keep their code to themselves. So another problem with Dibuld
Speaker 1: and another voting machine companies has been, okay, so you
Speaker 1: have this who knows what he meant, I'm going to
Speaker 1: deliver the votes that. You can hear that in an
Speaker 1: innocent way. You can hear that in a suspicious way.
Speaker 1: But then when in this computer security world, what often
Speaker 1: happens is if you want to prove that you're a
Speaker 1: very secure piece of software, you offer it up to
Speaker 1: the open source community and let it let it be reviewed,
Speaker 1: and you submit yourself to vulnerability testing. You even vulnerability
Speaker 1: bounties and the voting machine industry in general has been
Speaker 1: very late to this entire process of of inviting hackers
Speaker 1: in and helping them, letting the hackers help them secure
Speaker 1: their machines. For the most part, the entire sort of
Speaker 1: voting complex has been very defensive about this process. And
Speaker 1: that's another reason for another layer of suspicion. So there's
Speaker 1: there's that black box behind what's going on in these
Speaker 1: voting machines. Until fairly recently, it was for the most
Speaker 1: part illegal to tinker with voting machine software because of
Speaker 1: Digital Rights management rules. UM, the Library of Congress recently
Speaker 1: changed rules, and that's why we're seeing and been hearing
Speaker 1: so much more about machine hacking because they've temporarily temporarily
Speaker 1: created this research window whereby hackers can actually buy machines
Speaker 1: if they can buy them on eBay or whatnot, and
Speaker 1: then try to hack them. And that's why you might
Speaker 1: recall that in the summer at the big Las Vegas
Speaker 1: Hacker Convention def Con, they had something called the Voting
Speaker 1: Village and last year was the first time. This member
Speaker 1: was the second time they did it, all because of
Speaker 1: this Library of Congress ruling. They bought a bunch of machines,
Speaker 1: They invited a bunch of packers into the room, and
Speaker 1: they said go to town. And of course the results
Speaker 1: were probably what you are are guessing. Lots of these
Speaker 1: machines are hackable. UM. I want to take one step back, though.
Speaker 1: You mentioned that your machines are from two thousand two,
Speaker 1: and that's not an accident, that's on purpose. UM. All
Speaker 1: of the country, all over the country are these fifteen
Speaker 1: year old voting machines that are essentially the byproduct of
Speaker 1: something called the Help America Vote Act and that was
Speaker 1: the result of the Bush v. Gore uh controversy in
Speaker 1: the year two thousand. Remember the hanging chads and people
Speaker 1: staring at screens all the time, and America at that
Speaker 1: point said, oh, we have to update our voting technology.
Speaker 1: Why are we using this nineteen seventies era machines with
Speaker 1: these big levers in these punch cards that you know,
Speaker 1: are like from an IBM basement computer. In the fifties,
Speaker 1: so the federal government made a bunch of money available
Speaker 1: for localities, for states and counties to buy new voting machines,
Speaker 1: and so there was a gold rush. Everybody went to
Speaker 1: buy what was then the latest technology, which looked something
Speaker 1: like an a t M machine. Um. But the problem is,
Speaker 1: and I think this is the point I'd really like
Speaker 1: to stress more than any the federal government can't tell
Speaker 1: jurisdictions how to collect votes. And there are something like
Speaker 1: ten thousand different entities all across America and overseas that
Speaker 1: can collect votes in America, ten thousand, and all of
Speaker 1: them decide on their own what kind of machine, what
Speaker 1: kind of procedures they're going to use. So anybody who's
Speaker 1: ever moved and gone to vote realizes, wait, this process
Speaker 1: is totally different from the last process that I used. Now,
Speaker 1: think about how how hard it is for a billion
Speaker 1: dollar company to secure its systems. And now I want
Speaker 1: you to think about ten thousand voting jurisdictions, all of
Speaker 1: whom need to have some cybersecurity expert connected to their process.
Speaker 1: There aren't ten thousand qualified people in the world period
Speaker 1: to do that, let alone that these jurisdictions have the
Speaker 1: money to pay for that. So it's a very very
Speaker 1: tricky problem, and we're only to beginning to come scratch
Speaker 1: the surface of how we fix it. Yes, and in
Speaker 1: the United States it is incredibly complicated. I mean in Georgia,
Speaker 1: for the longest time, the the responsibility of getting the
Speaker 1: infrastructure in place to even cast votes was left up
Speaker 1: to the county level. It was only later that it
Speaker 1: became a state level thing, which was largely to install
Speaker 1: these these electronic voting machines. We've obviously, again not to
Speaker 1: harangue my home state, but we've also had a recent
Speaker 1: controversy about the the the the central server for a
Speaker 1: counting up the votes and whether or not it was
Speaker 1: the target of Russian hackers a few years ago, and
Speaker 1: the story unfolded that the main server that was being
Speaker 1: tested was over in Kinnesaw State University, was part of
Speaker 1: the overall system that was in charge of tabulating all
Speaker 1: these votes up run by Center for Election Systems here
Speaker 1: in Georgia. And there was a lawsuit that was brought
Speaker 1: together to get more access to this technology to understand
Speaker 1: what potential vulnerabilities there might be, whether or not any
Speaker 1: hackers had actually managed to penetrate that, And then the
Speaker 1: word got out that the server had been wiped, and
Speaker 1: then a month later the backup servers had been wiped, which, again,
Speaker 1: even if nothing bad happened, casts doubt on legitimacy. And
Speaker 1: it is you some could argue a method of voter suppression,
Speaker 1: it ends up demoralizing the voting base. Uh. And it
Speaker 1: is incredibly complicated, and not just from it. This is
Speaker 1: a psychology thing, not just a technology thing. And it
Speaker 1: does not help that we know that Russian hackers were
Speaker 1: targeting various election systems, or at least probing election systems
Speaker 1: throughout the United States and two thousand you know, fourteen
Speaker 1: fifteen through two thousand sixteen, right right, I think this
Speaker 1: is a really important point, and we're racing out a
Speaker 1: mini version of the Breach podcast to deal with this,
Speaker 1: and and I actually would just like to stress one thing.
Speaker 1: Of course, when you think about voting hacking, you think
Speaker 1: about somebody switching a vote in a machine. I've voted
Speaker 1: for Bush, the machine thinks score and and so on.
Speaker 1: But but voting hacking, air quotes hacking actually has a
Speaker 1: much much wider life cycle than that, And it begins
Speaker 1: all the way with you already suggested it with voter suppression,
Speaker 1: with you deciding you're going to vote or not and
Speaker 1: who you're going to vote for, so that process can
Speaker 1: be hacked. And again we have evidence of this from
Speaker 1: that outsidentities can can create false news stories that say
Speaker 1: the the Pope has endorsed Donald Trump, for example, or
Speaker 1: one of a thousand other fake news stories that that
Speaker 1: you utilize this propaganda too, is to do one of
Speaker 1: two things. Either confuse the electorate or depress the electric
Speaker 1: so people don't bother to vote or don't bother to register.
Speaker 1: That's only one step. The next step is you actually register,
Speaker 1: and how does that happen, How does the registration process
Speaker 1: take place, and whether or not the information is lost
Speaker 1: or somehow manipulated. When you register on online or or
Speaker 1: over paper, and then that registration stays in a computer somewhere,
Speaker 1: and as long as it's in a computer, something bad
Speaker 1: can happen to it, right and magically, when you the
Speaker 1: day you show up to vote, there has to be
Speaker 1: a way that the person sitting across the table from
Speaker 1: you can verify that you're entitled to vote where you are.
Speaker 1: Um that used to be done with paper. A lot
Speaker 1: of these states now use something called e poll books.
Speaker 1: They're usually iPads, and on the fly, those poll books
Speaker 1: are downloading voter registration data to make sure that Bob
Speaker 1: Sullivan really lives in this voting precinct and belongs there.
Speaker 1: Um that the information gets there, sometimes wirelessly, sometimes over
Speaker 1: over an old network, But that's another opportunity where the
Speaker 1: information could be altered and and from the file of
Speaker 1: voter suppression. Imagine if they either erase it or just
Speaker 1: move it, move you to another district. So you show
Speaker 1: up to vote, and this happens all the time without hacking.
Speaker 1: You shop to vote and the person says, no, no, no no,
Speaker 1: you're not registered in this district. You have to vote
Speaker 1: over there, and maybe over there is an hour away,
Speaker 1: and maybe your lunch hour is gone, and now you're
Speaker 1: not voting. So a lot of times we think about
Speaker 1: vote hacking is somebody switching a million votes for some candidate,
Speaker 1: But it can happen in these smaller ways too. So
Speaker 1: and then after you vote on the machine, the machine
Speaker 1: has to tabulate, so maybe it registers the vote correctly,
Speaker 1: but the tabulation is done wrong. After that local machine
Speaker 1: tabulates and all the precinct votes are added up using
Speaker 1: some process. And then I think this is the trickiest part.
Speaker 1: All those results have to be transmitted eventually to the
Speaker 1: Secretary of State's office. Sometimes it's a sneaker net. Somebody
Speaker 1: puts a memory card in our pocket and drives it
Speaker 1: across the state. More often than not, now it's it's
Speaker 1: wirelessly transmitted over a mobile network or whatnot, And those
Speaker 1: are opportunities for hacking. And then just to put one
Speaker 1: more thought in your head, because this is something that
Speaker 1: has happened. The Russian government has done this in other nations.
Speaker 1: Let's say everything goes smoothly, everything is on the up
Speaker 1: and up, no hacking anywhere, but the moment the results
Speaker 1: come out, the secretary of State's website is hacked. So
Speaker 1: for just an instant, the results are the wrong results,
Speaker 1: and then they're switched back. The Secretary of State figures
Speaker 1: out all that's that's a mistake. Now all the people
Speaker 1: who lost are going to have screenshots of this hacked
Speaker 1: page that's say they want, And once again you can
Speaker 1: create domat in flament doubt and uncertainty and illegitimacy an election,
Speaker 1: not by doing any of this other sci fi stuff
Speaker 1: we're talking about, but simply one website hack. So protecting
Speaker 1: the vote requires you to protect every single one of
Speaker 1: these stages, and it's a mammoth task. Guys, Mr Sullivan
Speaker 1: and I continued our conversation about data secure and elections,
Speaker 1: but before we get into that, let's take a quick
Speaker 1: break to thank our sponsor. I'm so glad that I
Speaker 1: have you on here too, because it also it reinforces
Speaker 1: this idea that I have said in previous episodes when
Speaker 1: it comes to talking about hacking, because we all have
Speaker 1: the image in our heads of the Hollywood version of hacking,
Speaker 1: where it's the the either the super too cool for
Speaker 1: you person or the incredibly nerdy person sitting down at
Speaker 1: a computer terminal, typing in and on the third attempt
Speaker 1: gets through the password and then you see a bunch
Speaker 1: of meaningless characters on the screen and they say whoa
Speaker 1: or something along those lines, which is not at all,
Speaker 1: not at all close to reality. One of the biggest
Speaker 1: tools in any hackers toolbox, and it's one that you've
Speaker 1: you've mentioned, is social engineering. This idea of manipulating people
Speaker 1: to get what you want, which doesn't even involve you
Speaker 1: necessarily having contact with a device. It is an age
Speaker 1: old trick of hackers because it's it goes all the
Speaker 1: way back to confidence. Man. I mean, this is something
Speaker 1: that has been around for ages. If you know how
Speaker 1: people think, and you know what people react to, and
Speaker 1: you leverage that, you can get what you want. And
Speaker 1: it may only involve very light technology and the sense
Speaker 1: of hacking that one website that's enough to to really
Speaker 1: put things into a turmoil. Uh, it doesn't require having
Speaker 1: physical access to these voting machines. I see that often
Speaker 1: people pointing that out, that a lot of these machines
Speaker 1: would require someone to get physical access and that the
Speaker 1: likelihood of that is very low. And again all of
Speaker 1: that may very well be true, but ultimately, if the
Speaker 1: perception that it's possible these machines have been uh tam
Speaker 1: bread with is enough to cause problems. It's kind of
Speaker 1: a moot point, so uh. I've also seen one of
Speaker 1: the first articles I ever worked on when I was
Speaker 1: hired by how Stuff Works, was about electronic voting machines,
Speaker 1: and there was a section that they wanted me to
Speaker 1: do about the concept of casting votes over the internet,
Speaker 1: because the idea of giving accessibility, widespread accessibility, improving that
Speaker 1: maybe maybe improving the number of people who actually participate
Speaker 1: in the voting process. Things like that are very important
Speaker 1: and it's you can't just dismiss them. However, I'm curious
Speaker 1: what you think. Is there a is there a way
Speaker 1: do you think of implementing such a system that would
Speaker 1: be secure, or at least not just secure, but appear
Speaker 1: secure enough that people would have faith in it, or
Speaker 1: do you think that that's a non starter. I'm gonna
Speaker 1: give you two answers that are a bit contradictory. Um
Speaker 1: I I'm one who believes that the integrity of the
Speaker 1: voting process visa v hacking is incredibly important. That's in
Speaker 1: my cybrus curty friends are going to take out their
Speaker 1: pose and arrows on me right now, but that's probably
Speaker 1: third or fourth on the list of things that are
Speaker 1: wrong with American elections. You know, things like jerrymandering and
Speaker 1: just voter disinterest are even bigger. In fact, one of
Speaker 1: the conclusions not to give away the punch line to
Speaker 1: my podcast, but my conclusion at the end of it
Speaker 1: is the thing that makes America's voting system the most vulnerable,
Speaker 1: Like our biggest vulnerability in our voting process is the
Speaker 1: disinterest of our voters, who you know, half the people
Speaker 1: don't vote even for presidential campaigns, and that creates this
Speaker 1: massive opening that makes it easy for a hacker. Again,
Speaker 1: who wouldn't have to change a million votes, that could
Speaker 1: just change thirty votes in Wisconsin and Pennsylvania and Ohio
Speaker 1: and tip an election. Right. So so it's on us
Speaker 1: to participate. And as a result of that, you know,
Speaker 1: I am one, I am interested in internet voting somewhere
Speaker 1: along the line because it would increase increased participate. Patian Um,
Speaker 1: all of the cybersecurity people who respected me thirty seconds
Speaker 1: ago don't respect me anymore. All of them, in one
Speaker 1: voice would say to you know, what we need is
Speaker 1: paper and we never need internet voting. That that they're
Speaker 1: all terrified of internet voting and just really don't think
Speaker 1: that there's a way to make it secure. And they
Speaker 1: they do know, at least from the security standpoint, even
Speaker 1: better than I do. Like all the reporting says, we're
Speaker 1: nowhere near that there are. There are very limited examples
Speaker 1: even in the US of people voting over the internet.
Speaker 1: Soldiers at sea sometimes can do it overseas um, but
Speaker 1: there's a critical difference there in that they surrender their
Speaker 1: right to anonymity um and just to uh throw another
Speaker 1: concept to you and your listeners. One of the reasons
Speaker 1: this is also difficult is because we have to secure
Speaker 1: these votes but at the same time preserve the anonymity
Speaker 1: of the voter. The secret ballot box is an important
Speaker 1: part of our process and an important part of democracy,
Speaker 1: and as a result of the fact that vote is
Speaker 1: a secret, it's very hard to authenticate the vote and
Speaker 1: not identify the voter, so they do. The exception that's
Speaker 1: made for overseas voting over the internet is the soldier
Speaker 1: will actually allow for a verification of the vote that's
Speaker 1: outside of the someone someone will call or otherwise contact
Speaker 1: the voter and verify the vote itself. So there's a
Speaker 1: process for that, but in general, um, the fact that
Speaker 1: there is no real positive way to identify a person
Speaker 1: on the internet. We see this every day with spam
Speaker 1: mail and everything else. The mix of that lack of
Speaker 1: real authentication with with voting is just a toxic combination
Speaker 1: that seems like a really hard problem to solve. Well
Speaker 1: and and again that has become the a central point
Speaker 1: in in things like voter suppression, where that ends up
Speaker 1: being the the defense of those who would use more
Speaker 1: and more restrictive means of verifying of a ter's identity
Speaker 1: before allowing them to vote because of the perceived fear
Speaker 1: of people misrepresenting themselves and casting what would amount to
Speaker 1: a false vote. Uh. That that's a very popular narrative
Speaker 1: I've seen that doesn't seem to have that much evidence
Speaker 1: to support the fear, right. It's it's one of those
Speaker 1: things where it says, well, you know, we have to
Speaker 1: have these systems in place, otherwise we're going to have
Speaker 1: fraudulent votes, and apart from some small stories that you'll
Speaker 1: hear that end up being exaggerated a great deal, you know,
Speaker 1: like dead people in Chicago casting votes for the mayor,
Speaker 1: kind of thing. You don't really see it, but it
Speaker 1: ends up becoming the central argument for putting systems into
Speaker 1: place that effectively tell people, uh that their vote isn't welcome.
Speaker 1: And I certainly have a lot of empathy for people
Speaker 1: who maybe it's not that they're disinterested in voting necessarily,
Speaker 1: but it's more that they've been actively discouraged from participating
Speaker 1: in the process. And you couple that with anyone who
Speaker 1: has this sensation that perhaps their vote wouldn't even count
Speaker 1: in the first place, you can definitely see why there
Speaker 1: are some real problems. Um. I've seen a lot of
Speaker 1: people argue for things like a mandated voter registration, maybe
Speaker 1: go in Australia's direction and have mandated voting as well.
Speaker 1: I've also seen people who who don't necessarily have a
Speaker 1: solution in mind, but they say we need to make
Speaker 1: voting as easy for elections as it is to vote
Speaker 1: for American Idol. That that's like a common meme on
Speaker 1: the internet as well. And I don't I don't necessarily
Speaker 1: disagree with any of that. I think encouraging participation is
Speaker 1: really is really key. As you point out, the more
Speaker 1: people who are participates who participate, the harder it would
Speaker 1: be to really skew the outcome for one thing. Uh,
Speaker 1: it would be much more noticeable if any one word,
Speaker 1: to try and skew an outcome where you've got a
Speaker 1: very large participation unless things are just you know, super
Speaker 1: close all the way down the line among the entire
Speaker 1: population of whatever region it is that's holding the election. Uh.
Speaker 1: What do you think is a solution or perhaps the
Speaker 1: best way to move forward given all these different problems,
Speaker 1: not just the technological ones but the psychological ones. Sure well,
Speaker 1: the solution a lot of folks agree on is actually
Speaker 1: not in more technology. Um. You love technology, Evan writing
Speaker 1: about technology for twenty years, But I think all of
Speaker 1: us have a really bad habit of thinking whenever there's
Speaker 1: a problem that more technology is going to take care
Speaker 1: of it, it's a silver bullet somehow, Like a better
Speaker 1: voting machine is not going to take care of this. Um,
Speaker 1: there's a bunch of solutions, but the most important solution
Speaker 1: is the auditing of elections themselves. So, um, there has
Speaker 1: to be some sort of process s that's automatic after
Speaker 1: every election where we figure out whether or not the
Speaker 1: votes that were cast are actually the votes that were counted,
Speaker 1: and we're presented to us later. And now I'm going
Speaker 1: to tell you why that hasn't happened yet, even though
Speaker 1: pretty much everybody agrees on the election. And I'm going
Speaker 1: to draw on my first five years as a I
Speaker 1: was a reporter in small town newspapers in New Jersey,
Speaker 1: covering school boards and planning boards in the city council
Speaker 1: and mayor and all that, and elections of course, local elections.
Speaker 1: And when you're running from mayor of Pompton Planes, you know,
Speaker 1: the vote is five hundred to four every time, and
Speaker 1: the loser always demands a recount. What does the winner
Speaker 1: say when the loser demands a recount? This has happened
Speaker 1: over over in American history. Winners never want to recount.
Speaker 1: Only bad things can happen if you're a winner and
Speaker 1: there's a recount. So the people have spoken, that's it. Yeah,
Speaker 1: And because you know what, there's a there's a chance
Speaker 1: that you might lose the recount, so stop the recount.
Speaker 1: Um and Audit sounds a lot like recounts to people.
Speaker 1: So in general, here's what happens. Some election, however legitimate
Speaker 1: or not legitimate, it is again, it's it's not like
Speaker 1: a yes or no it's more of a scale of
Speaker 1: one to ten. Thing. Some election occurs, some group of
Speaker 1: people win, and that group of people has no interest
Speaker 1: whatsoever in changing whatever it was before that had them win.
Speaker 1: So if you were to implement a new process like
Speaker 1: they do, they do these sample audits. They're called risk
Speaker 1: limiting audits, and this is generally agreed to be the
Speaker 1: best way to approach this. You take a sample of
Speaker 1: the ballots that's very carefully picked, and you make sure
Speaker 1: that the results match the published results, and that's just
Speaker 1: away with like a confidence level that you see if
Speaker 1: the election was manipulated or not. The winners never want
Speaker 1: to do this because again, if you're in office now,
Speaker 1: why would you want to do something that might raise
Speaker 1: the possibility of somebody saying, oh, no, you didn't win.
Speaker 1: So it's very very hard to get get elected officials
Speaker 1: to spend the money and the focus on this problem.
Speaker 1: And then the other problem is attention span. We care
Speaker 1: about this because it's two weeks before an election in December.
Speaker 1: We'll stop talking about election security until two years from
Speaker 1: now when we talk about it again. This is a
Speaker 1: cycle that we've been through over and over again. I'm
Speaker 1: hoping because of what happened in and all the Russian
Speaker 1: news that's in the year. There might be a little
Speaker 1: more staying power this time around, but it's a very
Speaker 1: hard problem to attack. It's certainly again in my home state,
Speaker 1: it's it's front and center, in no small part because
Speaker 1: we have a governor's race this election in which one
Speaker 1: of the two candidates is the current Secretary of State,
Speaker 1: which has raised all sorts of interesting questions about processes
Speaker 1: and technologies and motivations for not changing systems even after
Speaker 1: these various controversies have happened. Uh, it almost always comes
Speaker 1: down to cost, which is I mean, that's a legitimate factor.
Speaker 1: It's you can't just wave your hand away at that,
Speaker 1: but it also becomes a very convenient one. Uh. And
Speaker 1: so again it ends up having that effect of potentially
Speaker 1: demoralizing people who otherwise would come out and perhaps support
Speaker 1: an opponent. But it's very much in front of us
Speaker 1: here in Georgia. But obviously there are other areas across
Speaker 1: the United States that have maybe not a similar situation,
Speaker 1: but just as passionate a discussion about these processes as
Speaker 1: in my home state. UM, I really appreciate you coming
Speaker 1: on my show and talking about this. I'm very much
Speaker 1: looking forward to your episode of The Breach. Season one
Speaker 1: was phenomenal, going over in great detail the Yahoo hack.
Speaker 1: If you guys out there haven't listened to the Breach,
Speaker 1: please go and do that because you're going to learn
Speaker 1: a lot. Uh. The episodes are informative and they go
Speaker 1: into great detail, and it really stresses how incredibly complicated
Speaker 1: and important and potentially scary information secure already really is.
Speaker 1: And uh, it's nice to have a journalist on to
Speaker 1: talk about this, someone who investigates this sort of stuff.
Speaker 1: I've had hackers on before. They have a very interesting
Speaker 1: philosophy and attitude that I sometimes cannot resolve. So fair enough, Yeah,
Speaker 1: I feel like I would like to if I could
Speaker 1: just throw one quick thing out to you. Though, all
Speaker 1: the election security people stressed this to me, however pessimistic
Speaker 1: they are about the state of affairs today, they all
Speaker 1: are very convinced it can be fixed and that there
Speaker 1: is a solution that that with enough energy and will,
Speaker 1: we can overcome and we can straighten on our voting process.
Speaker 1: Voting is a very very limited specific task as opposed
Speaker 1: to saying something like banking, and it can be secured
Speaker 1: and so one of the messages I don't want to
Speaker 1: leave people with is the vote can be hacked. I
Speaker 1: don't bother voting quite the opposite, right right, It's it's
Speaker 1: this is something we can fix, and it's it's it's
Speaker 1: very important that we do it, and that all it really, ultimately,
Speaker 1: all it really takes is the willpower and the support
Speaker 1: for it to go forward. And and I certainly think
Speaker 1: that we're getting into a a climate where that's going
Speaker 1: to become more and more of an issue, where there's
Speaker 1: just gonna be a demand for that. I mean, it's
Speaker 1: it cannot stand to continue, Um, as long as there
Speaker 1: is this doubt in the process. It's it's so fundamental
Speaker 1: to who we are as a nation. In order for
Speaker 1: that too, uh, it has to be addressed on a
Speaker 1: very real level and not just given lip service. I
Speaker 1: actually am fairly optimistic about this, and um, I think
Speaker 1: that maybe in the short term it may not be
Speaker 1: the smoothest ride, but I think we are going to
Speaker 1: see a lot more advocacy and movement on this front.
Speaker 1: So I have high hopes and I do look forward
Speaker 1: to hearing that episode of the Breach once it publishes.
Speaker 1: I believe it's coming out November five. Yeah, maybe a
Speaker 1: couple of days sooner than that, but right before the election.
Speaker 1: Just excellent to get your stirred up. All right, well,
Speaker 1: I look forward to hearing that. Bob, thank you so
Speaker 1: much for joining our show. Thanks for having me. I
Speaker 1: have a bit more to say about the technology of voting,
Speaker 1: so stick around, but first let's take a quick break
Speaker 1: to thank our sponsor again. I want to thank Bob
Speaker 1: Sullivan for joining us on the show and his insight
Speaker 1: into the dangers of hacking and voting. We realize, of
Speaker 1: course that you know, just the appearance of that danger
Speaker 1: is enough to influence people because we we are human beings,
Speaker 1: were affected by our emotions, and if you introduce the
Speaker 1: thought that perhaps the system is broken, that has real consequences.
Speaker 1: But before I go, I wanted to give a quick rundown,
Speaker 1: sort of a uh an overview of the advance of
Speaker 1: technology when it comes to voting and how that has
Speaker 1: changed over the years. The mechanical lever machines that have
Speaker 1: been used in voting first debuted back in eighteen eighty nine.
Speaker 1: They were patented by a guy named Jacob H. Myers,
Speaker 1: and the technology actually became known as the Myers Automatic Booth.
Speaker 1: The first time it would actually be used in an
Speaker 1: election was eighteen ninety two in Lockport, New York, and
Speaker 1: then you started to see other lever based voting machines
Speaker 1: arise in the decades following. Optical scans wouldn't be a
Speaker 1: thing until nineteen sixty two. The first optical scan voting
Speaker 1: ballot was used in Karn's City, California. This would be
Speaker 1: the sort of scans that you would see in in
Speaker 1: something like an s a t in a way where
Speaker 1: you've got or a standardized test where you have to
Speaker 1: fill in bubbles. The idea being that you're using a
Speaker 1: ballot and you're using a system that relies upon light
Speaker 1: to read that ballot and to detect which votes have
Speaker 1: been cast and then record them. Uh. Then the next
Speaker 1: moment in tech comes from my hometown in Atlanta, Georgia.
Speaker 1: We have lots of counties that make up the metro
Speaker 1: Atlanta area, but the two main ones are Fulton into
Speaker 1: cab for the heart of the city. Those were the
Speaker 1: first two counties in the United States to use punch
Speaker 1: cards with computer tally machines. That was in nineteen sixty four.
Speaker 1: The following year, Joseph P. Harris and William ruverall patented
Speaker 1: the votomatic punch card system. That was a system where
Speaker 1: you would actually have two things to to reference. You
Speaker 1: had your ballot, but you also had to have a
Speaker 1: little booklet that told you which numbers on the ballot
Speaker 1: would correspond with which candidates in the election. So you
Speaker 1: might say Choice one represents one candidate, Choice to represents
Speaker 1: another candidate. You look at the ballot. The ballot would
Speaker 1: not have the names of the candidates on there, just
Speaker 1: the numbers, and you would punch the corresponding numbers out.
Speaker 1: This was considered to actually be a superior system in
Speaker 1: the that the computer tally machines could handle these sort
Speaker 1: of ballots much more easily than earlier ones. However, you
Speaker 1: could imagine that that also introduced a bit of a
Speaker 1: barrier for people who are trying to use the system
Speaker 1: to make sure that the number that they are punching
Speaker 1: out actually corresponds with the choice they wanted to make.
Speaker 1: In ninety four, a group of inventors got a patent
Speaker 1: for a system they called video Voter, which was a
Speaker 1: direct recording electronic voting machine or d R e UH
Speaker 1: This was likely the first design of a d r
Speaker 1: E that was used in a real election. It was
Speaker 1: first used in nineteen seventy five and a couple of
Speaker 1: Illinois locations, all in the United States, would conduct a
Speaker 1: study and would issue a report that had the title
Speaker 1: Effective Use of Computing Technology and Vote Tallying. And in
Speaker 1: that report they investigated concepts like security, UH system functionality,
Speaker 1: system design, and also the ability to audit systems, which
Speaker 1: if you were listening to Mr Sullivan you realize is
Speaker 1: a very very important part of the process in order
Speaker 1: for people to have confidence that the system works. The
Speaker 1: r F Shoop or Shop Corporation I actually don't know
Speaker 1: how to pronounce it, s h o u P would
Speaker 1: produce the Shoop or Shop Tronic elect ironic voting machine.
Speaker 1: I say elect that way because the elect and electronic
Speaker 1: is all in capital letters. It was a push button
Speaker 1: d r E voting machine, so not a touch screen
Speaker 1: but a push button machine, but it was electronic. It
Speaker 1: was the first to achieve real commercial success. In another
Speaker 1: report comes out. This one's called at Your See Integrity
Speaker 1: and Security and Computerized Vote Tallying was written by Roy Saltman,
Speaker 1: and it warned that punch cards with pre scored sections.
Speaker 1: You know, a punch card that sort of has a
Speaker 1: little perforated areas for you to punch out. Uh, could
Speaker 1: be unreliable and that would come into sharp focus in
Speaker 1: the wake of the two thousand US presidential election. You
Speaker 1: heard Mr Sullivan reference that with the hanging Chad's that's
Speaker 1: what that refers to. In the Federal Election Commission released
Speaker 1: the first set of standards for computer based voting. This
Speaker 1: was called Performance and Test Standards for Punch Card mark
Speaker 1: Sense and Direct Recording Electronic Voting Systems. Marks Sense, by
Speaker 1: the way, referred to U an optical scanning technology, and
Speaker 1: those standards would receive updates in two thousand two with
Speaker 1: the Help America Vote Act. In nineteen six the Reformed
Speaker 1: Party was able to vote in their presidential primary over
Speaker 1: the internet. This was, you know, a small third party,
Speaker 1: small in comparison to other parties, and but it did
Speaker 1: show someone trying to make use of the Internet as
Speaker 1: a tool for elections. But again just a just a primary,
Speaker 1: not a an actual election election. In two thousand three,
Speaker 1: there was a group of computer scientists who would release
Speaker 1: a report after analyzing a specific model of a d
Speaker 1: R e voting machine and finding vulnerabilities that could potentially
Speaker 1: be exploited. So at least as early as two thousand three,
Speaker 1: you had concerned data security experts raising this possibility. Uh
Speaker 1: In in two thousand four, we had that moment where
Speaker 1: the CEO of die Bald wrote that letter that again
Speaker 1: raised more doubt about the system. UH. Die Bald would
Speaker 1: get out of the voting machine business in two thousand nine.
Speaker 1: They sold off their division to a company called Election
Speaker 1: Systems and Software, Incorporated, which today controls more than so
Speaker 1: many five percent of the voting machine market in the
Speaker 1: United States. Kevin Shelley, the Secretary of State of California,
Speaker 1: would ban touchscreen electronic voting machines in four counties in
Speaker 1: California and de certify all existing systems pending security improvements.
Speaker 1: This also happened in two thousand four. That same year,
Speaker 1: Nevada would pass a mandate that would require all electronic
Speaker 1: voting machines used in federal elections to produce a paper
Speaker 1: audit trail um, something again that Mr Sullivan argued. Two
Speaker 1: thousand four, a company called Unileect got into some trouble.
Speaker 1: They manufactured some voting machines that were used at Carteret
Speaker 1: County in North Carolina, and according to the company, each
Speaker 1: voting machine could store up to ten thousand five d votes,
Speaker 1: but in fact they could only store three thousand five votes,
Speaker 1: and worse than that, they appeared to accept votes beyond
Speaker 1: three thousand and five, but those weren't actually recorded, so
Speaker 1: the machine did not give any indication that its memory
Speaker 1: was full, and ultimately four thousand, four hundred thirty eight
Speaker 1: votes were lost, and when you think about it, that
Speaker 1: means that more than half of all votes were lost.
Speaker 1: Only only less than half in that voting precinct were recorded,
Speaker 1: and that's pretty terrible. Two thousand five, a company called
Speaker 1: black Box Voting would set up a mock election in
Speaker 1: Florida and to security experts were invited to try and
Speaker 1: hack the voting machine system that they were using, and
Speaker 1: they were able to change the outcome of this mock
Speaker 1: election and leave no trace of their presence behind, and
Speaker 1: it demonstrated how some systems can be vulnerable. The same
Speaker 1: company would demonstrate the following year how some systems have
Speaker 1: backdoor vulnerabilities which can be exploited and software can be
Speaker 1: injected to activate months or years later to alter election results.
Speaker 1: So if you were able to get access to these
Speaker 1: machines half a year or a year before an election,
Speaker 1: then you could actually make the alterations, and in the
Speaker 1: time span in between, when security starts to increase the
Speaker 1: elections are coming up, no knows that the machine has
Speaker 1: already been compromised. In two thousand six, Dr Edward Felton
Speaker 1: showed that if you really know what you're doing, you
Speaker 1: could install malware on a Diebold electronic voting machine in
Speaker 1: less than a minute. Now, you had to have physical
Speaker 1: access to the machine, so that does make it more challenging.
Speaker 1: You do have to get that access. But if you
Speaker 1: knew what you were doing and you had the physical access,
Speaker 1: in less than sixty seconds, you could put malware that
Speaker 1: would alter votes, could steal votes from one candidate, give
Speaker 1: it to another, and it could also act as a
Speaker 1: virus and spread to other machines if they were sharing
Speaker 1: a network. So pretty nasty stuff. In two thousand seven,
Speaker 1: the Ohio Secretary of State Jennifer L. Brunner would authorize
Speaker 1: a study of these direct electronic voting systems in Ohio,
Speaker 1: and the report would conclude that none of the computer
Speaker 1: based systems in that state met security standards and all
Speaker 1: were susceptible to breaches. In two thousand eleven, Argon National
Speaker 1: Laboratory security experts would demonstrate that they could hack a
Speaker 1: d r E machine via remote control, but that hack,
Speaker 1: again would require getting physical access to the machine. You
Speaker 1: had to install a component in the machine. Once the
Speaker 1: component was in there and connected to the system, then
Speaker 1: you could access the system from up to half a
Speaker 1: mile away and change things around using a remote control.
Speaker 1: In June two thousand seventeen, that's when the first hackathon
Speaker 1: at Defcon really focused on on voter machines, and according
Speaker 1: to the story I was reading, a Danish hacker was
Speaker 1: able to compromise one of the machines that were there
Speaker 1: for the hackers to work on while the presenters were
Speaker 1: still introducing the event, so they hadn't even concluded their
Speaker 1: introductory comments when one of the hackers had already managed
Speaker 1: to compromise one of the machines. By the end of
Speaker 1: the day, the various hackers had discovered and exploited eighteen
Speaker 1: new vulnerabilities in various e voting and epole book systems.
Speaker 1: So this is obviously a matter of major concern, and
Speaker 1: the Russian hacking scandal has done nothing but make that
Speaker 1: even more apparent. And UH, the Department of Homeland Security
Speaker 1: initially stated that twenty one different states voting systems were
Speaker 1: targeted by Russian hackers in two thousand sixteen. UH. Georgia
Speaker 1: was not among them in that report, according to the
Speaker 1: Secretary of State. But then the investigation that Robert Mueller
Speaker 1: conducts is conducting in the in Russian hacking. It included
Speaker 1: the indictment of twelve Russian military officers that were connected
Speaker 1: to election tampering allegations, and that indictment revealed that the
Speaker 1: charges included probing attacks on county websites in Georgia, thus
Speaker 1: showing that perhaps Georgia did not get away scott free
Speaker 1: during that election and that was possibly targeted. This is
Speaker 1: what led to that investigation revolving around the server in
Speaker 1: Georgia that may have been targeted and tampered with, but
Speaker 1: then was subsequently wiped and then the backups were also wiped. UH.
Speaker 1: And there's a whole scandal about that. I'm not going
Speaker 1: to go into that because I know you guys have
Speaker 1: heard way too much about Georgia and a show that's
Speaker 1: just about technology in general. I want to leave off
Speaker 1: with echoing something that Mr Sullivan said, which is that
Speaker 1: this process is incredibly important. And while there are real
Speaker 1: problems here, challenges that we need to overcome, they are
Speaker 1: totally solvable problems. These are not insurmountable. There's the things
Speaker 1: that are standing in our way are willpower and money.
Speaker 1: So we have to have legislations that are are willing
Speaker 1: to budget the money necessary to put the proper systems
Speaker 1: in place. We need to have the willpower to make
Speaker 1: sure that those are done responsibly and that no one
Speaker 1: is being told not to vote, that we aren't suppressing
Speaker 1: anyone's vote. And that goes for any political side. It
Speaker 1: doesn't matter to me whether you share my personal political
Speaker 1: philosophy or not. What matters to me is that you
Speaker 1: are able to express that in the manner of voting,
Speaker 1: and that you are not, you know, kept from that activity,
Speaker 1: that you are able to participate fully in the democratic process.
Speaker 1: That to me is the most important part. And uh,
Speaker 1: and I'm well, if it comes out where the political
Speaker 1: philosophy I believe in is on the losing side, if
Speaker 1: the election appears to be completely legitimate, and that's the
Speaker 1: will power that you know, it's the will of the people,
Speaker 1: and I just happen to be on the losing side.
Speaker 1: I can reconcile that a lot more easily than I
Speaker 1: can thinking I'll never know if the system reflects what
Speaker 1: the people really wanted, or if the system failed us
Speaker 1: because of either inherent vulnerabilities in that system or the
Speaker 1: perception of those vulnerabilities. And uh, it's a complicated thing.
Speaker 1: But again, I want to thank Mr Sullivan for joining
Speaker 1: the podcast and sharing his expertise and his thoughts on
Speaker 1: the matter. I recommend you check out the Breach podcast.
Speaker 1: I think you will really enjoy it. If you, guys
Speaker 1: have suggestions for future episodes of tech Stuff, you should
Speaker 1: send me an email. The addresses tech Stuff at how
Speaker 1: stuff works dot com, or you can drop me a
Speaker 1: line on Facebook or Twitter. The handle at both of
Speaker 1: those is text Stuff hs W. You can go over
Speaker 1: to our merchandsise store that's at t public dot com
Speaker 1: slash tech Stuff. Check that out. Don't forget to follow
Speaker 1: us on Instagram and help talk to you again really
Speaker 1: soon for more on this and thousands of other topics.
Speaker 1: Because it how stuff works dot com. Eight