WEBVTT - Voting and Technology 0:00:04.120 --> 0:00:07.160 Get in touch with technology with tech Stuff from how 0:00:07.200 --> 0:00:13.800 stuff works dot com. Hey there, and welcome to Tech Stuff. 0:00:13.840 --> 0:00:16.560 I'm your host, Jonathan Strickland. I'm an executive producer at 0:00:16.600 --> 0:00:20.960 how Stuff Works in a love all things tech usually, 0:00:21.760 --> 0:00:25.520 but today we're gonna talk about a type of technology 0:00:25.560 --> 0:00:30.280 that can have either positive or negative effect depending upon 0:00:30.320 --> 0:00:35.400 how it's implemented. And joining me today is someone that, uh, 0:00:35.760 --> 0:00:38.400 I'm really excited could join us on the show. I'm 0:00:38.400 --> 0:00:43.280 talking about Bob Sullivan, a founding member of MSNBC, the 0:00:43.320 --> 0:00:47.680 guy behind Bob Sullivan dot net ak the Red Tape Chronicles. 0:00:47.760 --> 0:00:51.000 He's also a co host on a show called The Breach. 0:00:51.600 --> 0:00:55.160 It's All about Data Breaches. Season one, which is phenomenal, 0:00:55.400 --> 0:00:58.760 is all about the massive data breach that happened with 0:00:58.840 --> 0:01:04.360 Yahoo with three billion accounts exposed as a result of 0:01:04.360 --> 0:01:09.320 that data breach. And now they're gearing up. Season two 0:01:09.360 --> 0:01:12.720 is starting, and you're here to talk to us about 0:01:13.480 --> 0:01:17.800 voting machines, elect and and elections and how technology intersects 0:01:17.840 --> 0:01:21.080 with that and how that how that can be somewhat 0:01:21.640 --> 0:01:26.280 terrifying in some ways. Welcome to the show, Bob, Sure, 0:01:26.360 --> 0:01:28.920 thanks for having me. Really important topic, right now, so 0:01:28.959 --> 0:01:32.000 I'm glad we're talking about it. Yeah, me too. And 0:01:32.640 --> 0:01:35.399 for interest of full disclosure, I live in the state 0:01:35.440 --> 0:01:38.920 of Georgia here in the United States, and Georgia is 0:01:39.120 --> 0:01:44.319 a state that adopted touchscreen electronic voting machines very early, 0:01:44.360 --> 0:01:47.040 back in two thousand two, I think is when we started, 0:01:47.360 --> 0:01:51.600 and it's statewide here at Georgia and UH we we 0:01:51.680 --> 0:01:55.640 have a lot of things that I hesitate to use 0:01:55.680 --> 0:01:59.760 the word distinguish, but really kind of highlight some of 0:01:59.760 --> 0:02:05.600 the shoes I have with UH direct recording devices like this, 0:02:06.080 --> 0:02:10.640 the biggest one being that in Georgia, there's no associated 0:02:10.680 --> 0:02:14.600 paper trail with any of the voting record, So when 0:02:14.639 --> 0:02:17.680 a voter goes in and casts his or her ballot, 0:02:18.520 --> 0:02:22.240 there's no paper receipt where they can check that the 0:02:22.280 --> 0:02:26.120 results showing up on screen are reflected on paper, and 0:02:26.160 --> 0:02:30.639 therefore there's no real way to do a full audit afterward. 0:02:31.639 --> 0:02:36.280 And I think best case scenario, and Bob you can, 0:02:36.800 --> 0:02:38.519 I want to hear your input as well, but best 0:02:38.560 --> 0:02:42.800 case scenario for me is that even assuming there's no 0:02:43.200 --> 0:02:48.720 hanky panky going on, there's no interference in the election process. 0:02:49.639 --> 0:02:55.040 It it hurts the the appearance of the democratic process 0:02:55.160 --> 0:02:58.920 because it inserts the concept of doubt without being able 0:02:58.960 --> 0:03:02.120 to audit those results and say yes, in fact, the 0:03:02.200 --> 0:03:04.760 votes that were cast are the votes that were recorded. 0:03:05.800 --> 0:03:11.080 What what's your point of view on that particular topic. Well, 0:03:11.280 --> 0:03:13.600 that's the most important point at all. You've started at 0:03:13.600 --> 0:03:16.840 the punch line, which is fine. Um. Vote hacking is 0:03:16.840 --> 0:03:20.400 a complicated subject. In Georgia, you're very intimate with it 0:03:20.639 --> 0:03:23.280 at the moment, but all around the country there are Um, 0:03:23.320 --> 0:03:25.480 it's not just the machines, there's a whole life cycle 0:03:25.560 --> 0:03:29.160 of how your vote might be hacked or um suede 0:03:29.400 --> 0:03:32.560 or made to disappear. There's lots of different ways that 0:03:32.639 --> 0:03:35.720 votes can be manipulated. But something that's just the most 0:03:35.760 --> 0:03:39.240 fundamental thing about voting and about democracy is that when 0:03:39.240 --> 0:03:41.880 the election is over and the results are posted, that 0:03:41.960 --> 0:03:46.480 the losers believe in the legitimacy of the election. And 0:03:46.520 --> 0:03:50.600 when they don't, that creates a tremendous governance problem. So 0:03:51.000 --> 0:03:54.640 faith in the institution of voting itself is fundamental to America. 0:03:54.960 --> 0:03:57.480 And faith isn't an on off switch. And we're seeing 0:03:57.480 --> 0:04:00.200 this right now in lots of different ways, right, Um, 0:04:00.240 --> 0:04:02.280 But whether or not people believe in the integrity of 0:04:02.320 --> 0:04:05.839 the voting process itself. We'll say a lot about how 0:04:05.880 --> 0:04:09.800 we're governed. And in Georgia you mentioned paper. Um, the 0:04:09.920 --> 0:04:11.920 irony here we are on a tech podcast and we're 0:04:11.920 --> 0:04:15.520 talking about the latest and greatest technology, and we're here 0:04:15.560 --> 0:04:19.200 in the country with the latest and greatest entrepreneurs and 0:04:19.320 --> 0:04:23.599 the latest and greatest inventions, and anyone you talked to 0:04:23.800 --> 0:04:26.919 in the the voting hacking space will tell you the 0:04:26.960 --> 0:04:30.680 most important thing is paper. So we're going backwards here 0:04:30.680 --> 0:04:32.640 in some ways, but it all comes down to paper 0:04:32.720 --> 0:04:35.880 because there has to be some way to audit a 0:04:35.960 --> 0:04:40.000 vote afterwards. And if there's not, then you have a 0:04:40.040 --> 0:04:41.880 black box and people are walking up to it and 0:04:41.920 --> 0:04:45.120 touching a screen and you just trust that is going 0:04:45.120 --> 0:04:47.679 to work. And anybody who works in the technology world, 0:04:47.720 --> 0:04:51.000 we we're just having this conversation before we started this podcast. 0:04:51.640 --> 0:04:56.920 Tech often breaks everybody. Who's I mean, in the simplest example, 0:04:56.960 --> 0:04:58.400 how many times have you walked up to an a 0:04:58.480 --> 0:05:00.520 t M and tried to get forty dollars out of 0:05:00.560 --> 0:05:04.159 the machine and you accidentally hit the sixty button. Happens 0:05:04.200 --> 0:05:06.520 all the time. That's that can be a calibration thing. 0:05:06.520 --> 0:05:08.760 It can even be an angle thing. So that's just 0:05:08.880 --> 0:05:11.159 one of you know, fifty ways that things can go 0:05:11.200 --> 0:05:13.640 wrong just on the one kind of voting machine that 0:05:13.680 --> 0:05:16.240 we started talking about. So this is a big, rich topic. 0:05:16.279 --> 0:05:19.279 But legitimacy is the most important thing. And it's it's 0:05:19.320 --> 0:05:21.920 interesting that you bring up the A t M example 0:05:22.080 --> 0:05:26.279 because obviously there was the the it became somewhat infamous 0:05:26.279 --> 0:05:29.440 in text circles. But die Bald, the company that makes 0:05:29.520 --> 0:05:31.360 a lot of A t M s for a long time, 0:05:31.440 --> 0:05:35.159 was in the business of making these voting machines for 0:05:35.279 --> 0:05:39.159 various places, and uh in two thousand and four it 0:05:39.200 --> 0:05:44.000 was a huge story. The CEO of Diebald, Walden w Adell, 0:05:44.120 --> 0:05:49.359 had written a letter to various wealthy acquaintances he had 0:05:49.720 --> 0:05:53.599 in and a fundraising effort for the Republican Party and 0:05:53.640 --> 0:05:56.360 said that he was looking forward to delivering the electoral 0:05:56.440 --> 0:06:00.279 votes to get the president back into office. And a 0:06:00.320 --> 0:06:02.840 lot of people said, well, whether he intended it to 0:06:02.920 --> 0:06:06.400 be we're going to make sure this happens versus I 0:06:06.480 --> 0:06:09.760 want to, you know, support this candidate I believe in 0:06:10.560 --> 0:06:13.000 is kind of beside the point, because again, it brought 0:06:13.120 --> 0:06:16.760 that doubt into the democratic process. If if people point 0:06:16.800 --> 0:06:18.560 to him and say, but you make the machines that 0:06:18.640 --> 0:06:21.880 count the votes, and you say you plan on delivering 0:06:21.920 --> 0:06:25.279 these votes to a specific candidate, that kind of has 0:06:25.760 --> 0:06:29.960 a very dangerous implication in it. And as you say 0:06:30.160 --> 0:06:34.960 it's this, it's you already have this level of this 0:06:35.080 --> 0:06:37.400 hurdle that you have to overcome when you're designing any 0:06:37.480 --> 0:06:40.479 kind of system for voting. To make sure that the 0:06:40.520 --> 0:06:44.720 process is as straightforward and as difficult to mess up 0:06:44.800 --> 0:06:49.120 on the users side as possible. The whole keep it simple, 0:06:49.200 --> 0:06:52.520 stupid kind of approach really would be a huge benefit 0:06:52.560 --> 0:06:57.080 when you're designing any sort of voting system. Two give 0:06:57.240 --> 0:07:00.359 confidence to the voter that whatever choices they want to 0:07:00.360 --> 0:07:04.040 make are actually reflected in the votes that they're casting. 0:07:04.920 --> 0:07:07.800 And uh, as you say, with a T M S, 0:07:07.880 --> 0:07:10.160 it's easy enough to make a mistake. Those same companies 0:07:10.160 --> 0:07:14.720 are designing some of these electronic voting systems. And anyone 0:07:14.760 --> 0:07:17.840 who's worked with engineers for a long time understands that 0:07:18.800 --> 0:07:21.920 engineers are very good at building systems that make sense 0:07:21.920 --> 0:07:25.920 to engineers. Sometimes they build systems that are not so 0:07:26.000 --> 0:07:29.920 transparent to the end user. Sure, and the other thing 0:07:29.920 --> 0:07:33.400 that engineers, um some engineers do is they like to 0:07:33.480 --> 0:07:36.080 keep their code to themselves. So another problem with Dibuld 0:07:36.120 --> 0:07:39.240 and another voting machine companies has been, okay, so you 0:07:39.320 --> 0:07:41.560 have this who knows what he meant, I'm going to 0:07:41.600 --> 0:07:43.600 deliver the votes that. You can hear that in an 0:07:43.640 --> 0:07:46.160 innocent way. You can hear that in a suspicious way. 0:07:46.200 --> 0:07:49.480 But then when in this computer security world, what often 0:07:49.600 --> 0:07:51.160 happens is if you want to prove that you're a 0:07:51.240 --> 0:07:54.640 very secure piece of software, you offer it up to 0:07:54.640 --> 0:07:57.120 the open source community and let it let it be reviewed, 0:07:57.120 --> 0:08:00.760 and you submit yourself to vulnerability testing. You even vulnerability 0:08:00.800 --> 0:08:04.400 bounties and the voting machine industry in general has been 0:08:04.480 --> 0:08:07.840 very late to this entire process of of inviting hackers 0:08:07.880 --> 0:08:11.840 in and helping them, letting the hackers help them secure 0:08:11.840 --> 0:08:14.480 their machines. For the most part, the entire sort of 0:08:14.560 --> 0:08:18.760 voting complex has been very defensive about this process. And 0:08:19.000 --> 0:08:22.320 that's another reason for another layer of suspicion. So there's 0:08:22.440 --> 0:08:25.480 there's that black box behind what's going on in these 0:08:25.560 --> 0:08:29.160 voting machines. Until fairly recently, it was for the most 0:08:29.200 --> 0:08:32.640 part illegal to tinker with voting machine software because of 0:08:33.040 --> 0:08:37.280 Digital Rights management rules. UM, the Library of Congress recently 0:08:37.400 --> 0:08:39.960 changed rules, and that's why we're seeing and been hearing 0:08:39.960 --> 0:08:43.680 so much more about machine hacking because they've temporarily temporarily 0:08:43.720 --> 0:08:48.000 created this research window whereby hackers can actually buy machines 0:08:48.040 --> 0:08:49.720 if they can buy them on eBay or whatnot, and 0:08:49.720 --> 0:08:52.079 then try to hack them. And that's why you might 0:08:52.160 --> 0:08:54.720 recall that in the summer at the big Las Vegas 0:08:54.760 --> 0:08:57.280 Hacker Convention def Con, they had something called the Voting 0:08:57.360 --> 0:09:00.280 Village and last year was the first time. This member 0:09:00.280 --> 0:09:01.800 was the second time they did it, all because of 0:09:01.840 --> 0:09:04.440 this Library of Congress ruling. They bought a bunch of machines, 0:09:04.480 --> 0:09:06.280 They invited a bunch of packers into the room, and 0:09:06.280 --> 0:09:08.800 they said go to town. And of course the results 0:09:08.800 --> 0:09:11.920 were probably what you are are guessing. Lots of these 0:09:11.960 --> 0:09:14.959 machines are hackable. UM. I want to take one step back, though. 0:09:15.000 --> 0:09:18.680 You mentioned that your machines are from two thousand two, 0:09:19.400 --> 0:09:23.000 and that's not an accident, that's on purpose. UM. All 0:09:23.040 --> 0:09:25.240 of the country, all over the country are these fifteen 0:09:25.320 --> 0:09:28.440 year old voting machines that are essentially the byproduct of 0:09:28.480 --> 0:09:31.360 something called the Help America Vote Act and that was 0:09:31.400 --> 0:09:34.640 the result of the Bush v. Gore uh controversy in 0:09:34.640 --> 0:09:38.000 the year two thousand. Remember the hanging chads and people 0:09:38.080 --> 0:09:41.200 staring at screens all the time, and America at that 0:09:41.240 --> 0:09:43.440 point said, oh, we have to update our voting technology. 0:09:43.480 --> 0:09:46.719 Why are we using this nineteen seventies era machines with 0:09:46.800 --> 0:09:48.880 these big levers in these punch cards that you know, 0:09:48.960 --> 0:09:51.760 are like from an IBM basement computer. In the fifties, 0:09:52.120 --> 0:09:54.360 so the federal government made a bunch of money available 0:09:54.960 --> 0:09:58.880 for localities, for states and counties to buy new voting machines, 0:09:58.960 --> 0:10:01.400 and so there was a gold rush. Everybody went to 0:10:01.440 --> 0:10:04.000 buy what was then the latest technology, which looked something 0:10:04.040 --> 0:10:06.840 like an a t M machine. Um. But the problem is, 0:10:06.880 --> 0:10:08.480 and I think this is the point I'd really like 0:10:08.520 --> 0:10:11.720 to stress more than any the federal government can't tell 0:10:11.920 --> 0:10:15.400 jurisdictions how to collect votes. And there are something like 0:10:15.679 --> 0:10:20.360 ten thousand different entities all across America and overseas that 0:10:20.440 --> 0:10:23.640 can collect votes in America, ten thousand, and all of 0:10:23.679 --> 0:10:26.120 them decide on their own what kind of machine, what 0:10:26.200 --> 0:10:29.280 kind of procedures they're going to use. So anybody who's 0:10:29.280 --> 0:10:33.600 ever moved and gone to vote realizes, wait, this process 0:10:33.679 --> 0:10:36.600 is totally different from the last process that I used. Now, 0:10:37.000 --> 0:10:39.400 think about how how hard it is for a billion 0:10:39.440 --> 0:10:42.040 dollar company to secure its systems. And now I want 0:10:42.080 --> 0:10:44.960 you to think about ten thousand voting jurisdictions, all of 0:10:45.000 --> 0:10:50.320 whom need to have some cybersecurity expert connected to their process. 0:10:50.840 --> 0:10:53.360 There aren't ten thousand qualified people in the world period 0:10:53.360 --> 0:10:55.640 to do that, let alone that these jurisdictions have the 0:10:55.640 --> 0:10:57.920 money to pay for that. So it's a very very 0:10:57.920 --> 0:11:01.040 tricky problem, and we're only to beginning to come scratch 0:11:01.080 --> 0:11:03.600 the surface of how we fix it. Yes, and in 0:11:03.600 --> 0:11:08.800 the United States it is incredibly complicated. I mean in Georgia, 0:11:08.840 --> 0:11:14.600 for the longest time, the the responsibility of getting the 0:11:14.640 --> 0:11:19.520 infrastructure in place to even cast votes was left up 0:11:19.520 --> 0:11:23.120 to the county level. It was only later that it 0:11:23.160 --> 0:11:26.680 became a state level thing, which was largely to install 0:11:26.800 --> 0:11:33.520 these these electronic voting machines. We've obviously, again not to 0:11:33.520 --> 0:11:38.520 harangue my home state, but we've also had a recent 0:11:38.600 --> 0:11:45.880 controversy about the the the the central server for a 0:11:46.000 --> 0:11:49.080 counting up the votes and whether or not it was 0:11:49.200 --> 0:11:54.280 the target of Russian hackers a few years ago, and 0:11:55.040 --> 0:11:59.120 the story unfolded that the main server that was being 0:11:59.160 --> 0:12:04.840 tested was over in Kinnesaw State University, was part of 0:12:04.920 --> 0:12:10.040 the overall system that was in charge of tabulating all 0:12:10.040 --> 0:12:13.360 these votes up run by Center for Election Systems here 0:12:13.360 --> 0:12:16.800 in Georgia. And there was a lawsuit that was brought 0:12:16.880 --> 0:12:21.559 together to get more access to this technology to understand 0:12:21.679 --> 0:12:24.520 what potential vulnerabilities there might be, whether or not any 0:12:24.559 --> 0:12:29.120 hackers had actually managed to penetrate that, And then the 0:12:29.440 --> 0:12:32.640 word got out that the server had been wiped, and 0:12:32.679 --> 0:12:37.480 then a month later the backup servers had been wiped, which, again, 0:12:37.880 --> 0:12:43.360 even if nothing bad happened, casts doubt on legitimacy. And 0:12:43.440 --> 0:12:48.359 it is you some could argue a method of voter suppression, 0:12:48.440 --> 0:12:53.280 it ends up demoralizing the voting base. Uh. And it 0:12:53.360 --> 0:12:56.920 is incredibly complicated, and not just from it. This is 0:12:56.960 --> 0:13:00.440 a psychology thing, not just a technology thing. And it 0:13:00.480 --> 0:13:03.120 does not help that we know that Russian hackers were 0:13:03.120 --> 0:13:06.720 targeting various election systems, or at least probing election systems 0:13:06.960 --> 0:13:10.440 throughout the United States and two thousand you know, fourteen 0:13:10.480 --> 0:13:14.520 fifteen through two thousand sixteen, right right, I think this 0:13:14.600 --> 0:13:18.240 is a really important point, and we're racing out a 0:13:19.240 --> 0:13:22.320 mini version of the Breach podcast to deal with this, 0:13:22.400 --> 0:13:25.640 and and I actually would just like to stress one thing. 0:13:25.760 --> 0:13:27.960 Of course, when you think about voting hacking, you think 0:13:28.000 --> 0:13:30.400 about somebody switching a vote in a machine. I've voted 0:13:30.440 --> 0:13:33.000 for Bush, the machine thinks score and and so on. 0:13:33.480 --> 0:13:37.880 But but voting hacking, air quotes hacking actually has a 0:13:38.240 --> 0:13:42.040 much much wider life cycle than that, And it begins 0:13:42.120 --> 0:13:45.280 all the way with you already suggested it with voter suppression, 0:13:45.600 --> 0:13:49.360 with you deciding you're going to vote or not and 0:13:49.400 --> 0:13:52.160 who you're going to vote for, so that process can 0:13:52.200 --> 0:13:54.200 be hacked. And again we have evidence of this from 0:13:55.160 --> 0:13:59.720 that outsidentities can can create false news stories that say 0:13:59.760 --> 0:14:02.559 the the Pope has endorsed Donald Trump, for example, or 0:14:03.080 --> 0:14:06.000 one of a thousand other fake news stories that that 0:14:06.720 --> 0:14:10.160 you utilize this propaganda too, is to do one of 0:14:10.200 --> 0:14:13.880 two things. Either confuse the electorate or depress the electric 0:14:13.920 --> 0:14:16.079 so people don't bother to vote or don't bother to register. 0:14:16.840 --> 0:14:19.400 That's only one step. The next step is you actually register, 0:14:19.440 --> 0:14:21.720 and how does that happen, How does the registration process 0:14:22.240 --> 0:14:24.360 take place, and whether or not the information is lost 0:14:24.440 --> 0:14:28.880 or somehow manipulated. When you register on online or or 0:14:28.920 --> 0:14:32.200 over paper, and then that registration stays in a computer somewhere, 0:14:32.240 --> 0:14:34.080 and as long as it's in a computer, something bad 0:14:34.080 --> 0:14:37.240 can happen to it, right and magically, when you the 0:14:37.280 --> 0:14:39.240 day you show up to vote, there has to be 0:14:39.240 --> 0:14:41.280 a way that the person sitting across the table from 0:14:41.320 --> 0:14:43.440 you can verify that you're entitled to vote where you are. 0:14:43.920 --> 0:14:45.640 Um that used to be done with paper. A lot 0:14:45.640 --> 0:14:48.280 of these states now use something called e poll books. 0:14:48.880 --> 0:14:52.240 They're usually iPads, and on the fly, those poll books 0:14:52.240 --> 0:14:55.160 are downloading voter registration data to make sure that Bob 0:14:55.160 --> 0:14:58.600 Sullivan really lives in this voting precinct and belongs there. 0:14:59.400 --> 0:15:04.200 Um that the information gets there, sometimes wirelessly, sometimes over 0:15:04.320 --> 0:15:07.560 over an old network, But that's another opportunity where the 0:15:07.600 --> 0:15:10.920 information could be altered and and from the file of 0:15:11.000 --> 0:15:15.200 voter suppression. Imagine if they either erase it or just 0:15:15.280 --> 0:15:17.240 move it, move you to another district. So you show 0:15:17.320 --> 0:15:19.520 up to vote, and this happens all the time without hacking. 0:15:19.720 --> 0:15:21.600 You shop to vote and the person says, no, no, no no, 0:15:21.600 --> 0:15:23.480 you're not registered in this district. You have to vote 0:15:23.920 --> 0:15:26.280 over there, and maybe over there is an hour away, 0:15:26.280 --> 0:15:27.840 and maybe your lunch hour is gone, and now you're 0:15:27.880 --> 0:15:31.720 not voting. So a lot of times we think about 0:15:31.760 --> 0:15:34.760 vote hacking is somebody switching a million votes for some candidate, 0:15:34.800 --> 0:15:37.520 But it can happen in these smaller ways too. So 0:15:37.680 --> 0:15:40.720 and then after you vote on the machine, the machine 0:15:40.760 --> 0:15:43.520 has to tabulate, so maybe it registers the vote correctly, 0:15:43.520 --> 0:15:46.800 but the tabulation is done wrong. After that local machine 0:15:46.840 --> 0:15:49.880 tabulates and all the precinct votes are added up using 0:15:49.880 --> 0:15:53.000 some process. And then I think this is the trickiest part. 0:15:53.320 --> 0:15:55.720 All those results have to be transmitted eventually to the 0:15:55.760 --> 0:15:58.840 Secretary of State's office. Sometimes it's a sneaker net. Somebody 0:15:58.840 --> 0:16:01.120 puts a memory card in our pocket and drives it 0:16:01.480 --> 0:16:04.000 across the state. More often than not, now it's it's 0:16:04.120 --> 0:16:07.400 wirelessly transmitted over a mobile network or whatnot, And those 0:16:07.440 --> 0:16:10.240 are opportunities for hacking. And then just to put one 0:16:10.280 --> 0:16:12.480 more thought in your head, because this is something that 0:16:12.520 --> 0:16:15.360 has happened. The Russian government has done this in other nations. 0:16:15.880 --> 0:16:18.320 Let's say everything goes smoothly, everything is on the up 0:16:18.360 --> 0:16:21.400 and up, no hacking anywhere, but the moment the results 0:16:21.400 --> 0:16:24.680 come out, the secretary of State's website is hacked. So 0:16:24.800 --> 0:16:27.800 for just an instant, the results are the wrong results, 0:16:28.320 --> 0:16:31.000 and then they're switched back. The Secretary of State figures 0:16:31.000 --> 0:16:33.480 out all that's that's a mistake. Now all the people 0:16:33.480 --> 0:16:36.680 who lost are going to have screenshots of this hacked 0:16:36.720 --> 0:16:39.880 page that's say they want, And once again you can 0:16:39.920 --> 0:16:44.440 create domat in flament doubt and uncertainty and illegitimacy an election, 0:16:44.880 --> 0:16:46.960 not by doing any of this other sci fi stuff 0:16:47.000 --> 0:16:50.680 we're talking about, but simply one website hack. So protecting 0:16:50.720 --> 0:16:52.920 the vote requires you to protect every single one of 0:16:53.000 --> 0:16:57.040 these stages, and it's a mammoth task. Guys, Mr Sullivan 0:16:57.080 --> 0:17:00.920 and I continued our conversation about data secure and elections, 0:17:01.000 --> 0:17:03.400 but before we get into that, let's take a quick 0:17:03.440 --> 0:17:13.439 break to thank our sponsor. I'm so glad that I 0:17:13.480 --> 0:17:17.159 have you on here too, because it also it reinforces 0:17:18.280 --> 0:17:21.000 this idea that I have said in previous episodes when 0:17:21.040 --> 0:17:24.480 it comes to talking about hacking, because we all have 0:17:25.200 --> 0:17:28.800 the image in our heads of the Hollywood version of hacking, 0:17:28.920 --> 0:17:34.239 where it's the the either the super too cool for 0:17:34.280 --> 0:17:38.040 you person or the incredibly nerdy person sitting down at 0:17:38.119 --> 0:17:41.720 a computer terminal, typing in and on the third attempt 0:17:41.800 --> 0:17:43.680 gets through the password and then you see a bunch 0:17:43.720 --> 0:17:46.359 of meaningless characters on the screen and they say whoa 0:17:46.760 --> 0:17:50.359 or something along those lines, which is not at all, 0:17:50.520 --> 0:17:53.760 not at all close to reality. One of the biggest 0:17:53.760 --> 0:17:57.400 tools in any hackers toolbox, and it's one that you've 0:17:57.600 --> 0:18:02.159 you've mentioned, is social engineering. This idea of manipulating people 0:18:02.240 --> 0:18:05.159 to get what you want, which doesn't even involve you 0:18:05.240 --> 0:18:09.840 necessarily having contact with a device. It is an age 0:18:09.880 --> 0:18:13.960 old trick of hackers because it's it goes all the 0:18:13.960 --> 0:18:16.680 way back to confidence. Man. I mean, this is something 0:18:16.720 --> 0:18:18.440 that has been around for ages. If you know how 0:18:18.480 --> 0:18:21.760 people think, and you know what people react to, and 0:18:21.800 --> 0:18:24.439 you leverage that, you can get what you want. And 0:18:24.520 --> 0:18:28.639 it may only involve very light technology and the sense 0:18:28.760 --> 0:18:33.000 of hacking that one website that's enough to to really 0:18:33.359 --> 0:18:38.119 put things into a turmoil. Uh, it doesn't require having 0:18:38.560 --> 0:18:42.520 physical access to these voting machines. I see that often 0:18:43.040 --> 0:18:45.399 people pointing that out, that a lot of these machines 0:18:45.440 --> 0:18:49.000 would require someone to get physical access and that the 0:18:49.080 --> 0:18:52.439 likelihood of that is very low. And again all of 0:18:52.440 --> 0:18:55.439 that may very well be true, but ultimately, if the 0:18:55.480 --> 0:18:59.880 perception that it's possible these machines have been uh tam 0:19:00.040 --> 0:19:03.320 bread with is enough to cause problems. It's kind of 0:19:03.320 --> 0:19:08.000 a moot point, so uh. I've also seen one of 0:19:08.000 --> 0:19:10.040 the first articles I ever worked on when I was 0:19:10.119 --> 0:19:13.240 hired by how Stuff Works, was about electronic voting machines, 0:19:13.680 --> 0:19:15.359 and there was a section that they wanted me to 0:19:15.400 --> 0:19:19.800 do about the concept of casting votes over the internet, 0:19:20.119 --> 0:19:25.160 because the idea of giving accessibility, widespread accessibility, improving that 0:19:25.240 --> 0:19:29.800 maybe maybe improving the number of people who actually participate 0:19:30.480 --> 0:19:34.000 in the voting process. Things like that are very important 0:19:34.160 --> 0:19:37.560 and it's you can't just dismiss them. However, I'm curious 0:19:37.600 --> 0:19:41.480 what you think. Is there a is there a way 0:19:41.600 --> 0:19:44.399 do you think of implementing such a system that would 0:19:44.480 --> 0:19:48.080 be secure, or at least not just secure, but appear 0:19:48.160 --> 0:19:50.320 secure enough that people would have faith in it, or 0:19:50.359 --> 0:19:53.000 do you think that that's a non starter. I'm gonna 0:19:53.040 --> 0:19:57.080 give you two answers that are a bit contradictory. Um 0:19:57.280 --> 0:20:01.879 I I'm one who believes that the integrity of the 0:20:02.240 --> 0:20:06.680 voting process visa v hacking is incredibly important. That's in 0:20:06.720 --> 0:20:09.439 my cybrus curty friends are going to take out their 0:20:09.440 --> 0:20:12.000 pose and arrows on me right now, but that's probably 0:20:12.119 --> 0:20:13.959 third or fourth on the list of things that are 0:20:14.000 --> 0:20:17.600 wrong with American elections. You know, things like jerrymandering and 0:20:17.640 --> 0:20:20.240 just voter disinterest are even bigger. In fact, one of 0:20:20.280 --> 0:20:22.200 the conclusions not to give away the punch line to 0:20:22.280 --> 0:20:25.200 my podcast, but my conclusion at the end of it 0:20:25.240 --> 0:20:29.680 is the thing that makes America's voting system the most vulnerable, 0:20:29.760 --> 0:20:32.720 Like our biggest vulnerability in our voting process is the 0:20:32.800 --> 0:20:35.640 disinterest of our voters, who you know, half the people 0:20:35.640 --> 0:20:38.119 don't vote even for presidential campaigns, and that creates this 0:20:38.240 --> 0:20:41.640 massive opening that makes it easy for a hacker. Again, 0:20:41.680 --> 0:20:44.080 who wouldn't have to change a million votes, that could 0:20:44.119 --> 0:20:47.640 just change thirty votes in Wisconsin and Pennsylvania and Ohio 0:20:48.119 --> 0:20:50.480 and tip an election. Right. So so it's on us 0:20:50.520 --> 0:20:53.239 to participate. And as a result of that, you know, 0:20:54.040 --> 0:20:57.560 I am one, I am interested in internet voting somewhere 0:20:57.600 --> 0:21:01.640 along the line because it would increase increased participate. Patian Um, 0:21:01.680 --> 0:21:06.320 all of the cybersecurity people who respected me thirty seconds 0:21:06.359 --> 0:21:09.239 ago don't respect me anymore. All of them, in one 0:21:09.320 --> 0:21:12.080 voice would say to you know, what we need is 0:21:12.080 --> 0:21:14.760 paper and we never need internet voting. That that they're 0:21:14.800 --> 0:21:17.040 all terrified of internet voting and just really don't think 0:21:17.040 --> 0:21:19.240 that there's a way to make it secure. And they 0:21:19.280 --> 0:21:22.359 they do know, at least from the security standpoint, even 0:21:22.359 --> 0:21:25.120 better than I do. Like all the reporting says, we're 0:21:25.160 --> 0:21:29.600 nowhere near that there are. There are very limited examples 0:21:29.640 --> 0:21:32.720 even in the US of people voting over the internet. 0:21:33.040 --> 0:21:36.480 Soldiers at sea sometimes can do it overseas um, but 0:21:36.560 --> 0:21:40.680 there's a critical difference there in that they surrender their 0:21:40.800 --> 0:21:45.280 right to anonymity um and just to uh throw another 0:21:45.320 --> 0:21:47.879 concept to you and your listeners. One of the reasons 0:21:47.880 --> 0:21:50.679 this is also difficult is because we have to secure 0:21:50.720 --> 0:21:53.280 these votes but at the same time preserve the anonymity 0:21:53.320 --> 0:21:55.440 of the voter. The secret ballot box is an important 0:21:55.440 --> 0:21:58.200 part of our process and an important part of democracy, 0:21:58.520 --> 0:22:00.440 and as a result of the fact that vote is 0:22:00.440 --> 0:22:03.639 a secret, it's very hard to authenticate the vote and 0:22:03.720 --> 0:22:08.400 not identify the voter, so they do. The exception that's 0:22:08.440 --> 0:22:11.400 made for overseas voting over the internet is the soldier 0:22:11.440 --> 0:22:15.280 will actually allow for a verification of the vote that's 0:22:15.320 --> 0:22:18.439 outside of the someone someone will call or otherwise contact 0:22:18.440 --> 0:22:21.080 the voter and verify the vote itself. So there's a 0:22:21.119 --> 0:22:25.640 process for that, but in general, um, the fact that 0:22:26.680 --> 0:22:30.159 there is no real positive way to identify a person 0:22:30.400 --> 0:22:32.800 on the internet. We see this every day with spam 0:22:32.800 --> 0:22:35.920 mail and everything else. The mix of that lack of 0:22:36.200 --> 0:22:40.160 real authentication with with voting is just a toxic combination 0:22:40.200 --> 0:22:42.760 that seems like a really hard problem to solve. Well 0:22:42.800 --> 0:22:46.760 and and again that has become the a central point 0:22:46.880 --> 0:22:50.679 in in things like voter suppression, where that ends up 0:22:50.720 --> 0:22:55.920 being the the defense of those who would use more 0:22:55.960 --> 0:23:00.800 and more restrictive means of verifying of a ter's identity 0:23:00.840 --> 0:23:04.480 before allowing them to vote because of the perceived fear 0:23:04.840 --> 0:23:10.119 of people misrepresenting themselves and casting what would amount to 0:23:10.160 --> 0:23:15.120 a false vote. Uh. That that's a very popular narrative 0:23:15.240 --> 0:23:20.520 I've seen that doesn't seem to have that much evidence 0:23:20.600 --> 0:23:23.760 to support the fear, right. It's it's one of those 0:23:23.760 --> 0:23:25.399