Blackhat 2020: Tech community must help secure elections

I'm gonna talk about election security. And this is a very different talk than I would have given 4 or 5 months ago. But we'll be talking a little bit about stress testing our democracy And how we think about election security with the added wrinkle of an emergency and a pandemic. Our confidence in the outcome of the election increasingly depends on our confidence in the integrity of the mechanisms that we're using to do this. I've been working on election security for a couple of decades now. And I'm a computer scientist who studies computer security, which is full of terribly hard problems. I don't think I've ever encountered a problem. That's harder than the security and integrity of. Civil elections. It's an in particular, there it is almost impossible if you discover in your regularity to redo an election, that the integrity of the election results depends or can depend on the integrity of software and hardware. The outcome of the election might be under control of software. So the correctness of any software you're depending on for that purpose is critically important. In practice, we have a much larger attack surface than just that one line of code. We have to worry about the county election management software. We have to worry about the software in voting machines themselves. We have to worry about the communications protocols, typically that involve moving removable media, maybe USB sticks around and we have to worry about the physical and human scale protocols. Often that involve a big, temporary workforce. These attacks are not merely theoretical. When computer scientists have been asked to look at voting systems, invariably what they discover is that there are practical ways to do all of these things. And in fact, every current voting system that's been examined is terrible in some way, and probably exploitable. And then the pandemic came along and that added a whole new Set of concerns that were always there, but that got brought very sharply into focus. So what about voting in emergencies? Emergencies are likely to require scaling up our exception mechanism, which mostly involves mail in voting. So let's look at what the properties of that are in some detail. How do we scale up this mechanism in an emergency? And this is not a theoretical question, by which I mean this is a systems and logistics, Question. We have to look at how we actually do this what the operational details are, what are the resources required? How do we deploy them? So let's let's look at absentee voting. So this is a pretty labor intensive process, sending the ballots out to the voters who need them, and processing the marked ballots are both Very human intensive processes that often involve checks by multiple people and have to be done properly or the integrity of the election can get called into question. Should we be optimistic or pessimistic for November? And I think the the answer is yes to both. There's reason to be optimistic and reason to be pessimistic. Let's start with the pessimism. The first is that there's a lot of uncertainty about how many voters who would otherwise vote in person will need mail in ballots and we're likely not to know Until it's too late to change course. And that means we need to prepare for a very wide range of scenarios that may not come to fruition. So we may need to print lots of ballots that we don't end up using, and also provide for lots of in person voting that might not be used under pandemic conditions. The optimistic note is that we can do this, but we need to engage now. So let me end with a kind of call to arms that this community is precisely the one whose help is among others going to be needed by your local Election officials call them find out what their plans are. Find out how you can help