♦ Show Topic: Election Security: Securing the Vote While Securing the System

Discussion on how voting machines are inherently vulnerable and what can and should be done to make them safer  –  to the ‘Gold Standard’ of paper ballots used across American in this election. Further discussion on hacking, audits and International bad actors trying to infiltrate state election databases as well as old voting machines that are vulnerable to attack and manipulation. An open and frank discussion with a ‘security guru’ with decades of experience on how we can keep America’s democratic process of voting safe and secure.

Guest: Bruce Schneier, is an internationally renowned security technologist, called a “security guru” by the Economist. He is the New York Times best-selling author of 14 books — including Data & Goliath, & Click Here to Kill Everybody — as well as hundreds of articles, essays, and academic papers. His influential newsletter Crypto-Gram and blog Schneier on Security are read by over 250,000 people. Schneier is a fellow at the Berkman-Klein Center for Internet and Society at Harvard University; a Lecturer in Public Policy at the Harvard Kennedy School; a board member of the Electronic Frontier Foundation, AccessNow, and the Tor Project; and an advisory board member of EPIC and VerifiedVoting.org. He is the Chief of Security Architecture at Inrupt, Inc.

#SecuringTheVote #Voting2020 #ElectionSecurity2020 #BruceSchneier

hello and welcome to the legal edition i'm your host attorney mary kay elloian our show topic today election security securing the vote while securing the system our guest is bruce schneier he is an internationally renowned security technologist and a new york times best-selling author he is also a fellow at the berkman klein center for internet and society at harvard university and a lecturer in public policy at harvard kennedy school let's welcome bruce schneier welcome bruce thanks for having me do you believe the the 2020 presidential election was secure so it seems like it was i mean you know we don't know a lot of things happened behind the scenes in 2018 u.s cyber command ran some offensive operation against russia and disrupted some operation in progress we don't know what it was we think it has something to do with the reporting and the results not actually changing the votes but changing the way it was reported and we don't know if anything similar happened this year we know that department of homeland security said yesterday this was the most secure election it seems like nothing happened certainly nothing obvious happened and we were concerned about a lot of different things like chaos at the polls because voting roles were deleted machines not working machines flipping votes tallies not being tallied none of that happened so it seems like yes this was a secure election and we don't know whether it was because those who want to attack it didn't bother or because the u.s government the military was good at defending you know we might find out over the next couple of years as things leak as i hear things and hear say but yes we had a secure election it's kind of amazing and this year they used what you have referred to as the gold standard the paper ballot now not everybody there's more paper ballots than before you know so the history is after 20 after 2000 the help america vote act was supposed to modernize machines and modernize voting systems and the machines that a lot of states bought were these touch screen machines like atm machines and those are vulnerable insecure can't be audited because there's no paper there's no audit trail more systems are moving towards paper ballots verifiedvoting.org is an organization that tracks this you can see a map of who's voting on paper i vote in minnesota so this is the gold standard optical scan voting i get a piece of paper that's my ballot i fill in ovals i walk to a machine feed the paper in i'm immediately told if i voted properly in that there's no undervote so there is not an office i didn't vote for and no overvote no place i voted twice if there is an overlord under vote the machine beeps it offers me my ballot back to fix i can say never mind i want it that way because there might be uh down ballot races i don't care about you know there might be things i don't vote for so you get a quick tally from the optical scan reader and then the paper ballot drops into a box which is available for recounts so do you actually see that i see that process yeah i mean i i feed it into the machine it's kind of neat the machine's right there and i feed it when i'm done voting i take my piece of paper it's in a folder so no one else can see it then i just feed it right into the machine it beeps you vote to correct properly i get my little sticker and i leave and that'll happen if i vote on election day or if i vote early the same thing happens if i vote by mail of course someone else does the feeding for me and there's no opportunity for me to correct my my balance so right doesn't work great for doesn't work as good for by mail voting but that really is the gold standard and more americans are voting that way than before we still have some touchscreen machines i think pennsylvania is about half touch screen but half not so we're getting better yeah there was some controversy about those touchscreen machines in the past uh has that been rectified you know so they're inherently vulnerable because there's no there's no paper audit trail because if there is something that happens in the machine we'll we can't fix it now there have been errors which don't seem to be enemy actions seem to be just errors so there's a local election where we open the machine and the and they were like votes for all for one candidate zero for the other and this was the machine that the other candidate voted in so we know it can't be right or once there was like a negative number of votes right some kind of glitches in the machine those seem to be errors but we worry about them from a security perspective because if they're tampered with you would never know right there's no paper backup and we are seeing it's anecdotal but sometimes the screens are old which means when you and you know this if you have a touchscreen computer after a few years it's not that accurate where you press and there were stories anecdotal of you pressing on one candidate and you get the other just because the screen itself is is old and it gets you know thousands of presses during the day and something happens it's not great technology we really don't want a vote touch screen is anybody currently uh using those old type screens have you seen any of that there are there are states that use them again verifiedvoting.org is the website that has the map of exactly who votes on what machine i don't remember the details but yes those machines star are still in use well when the voter uses those machines and they're pressing the button and they can they see that it's not tallying the right person that they're voting for at that moment they can't see anything all i can see is the screen shows them i mean when you type things into your computer do you know what happens inside the machine you have no freaking clue you see what's on the screen you hope what's on the screen is what happens in in the machine but if the machine is hacked i mean we see this in in banking hacks right i mean i'm going to do a bank transfer i type in the account i want to send to there's some malware in the machine that shows me what i want to see but sends the bank a different account number right i have no way of knowing and that's the problem with computerized systems so this paper ballot system that a lot of the states are using that's the golden rule they're even complaining that those aren't accurate there's those tallies on accurate with the paper ballot we've seen this from the trump people what do you say about that yeah but they likely are but we can check the thing about a paper ballot is you can audit it so if they're not accurate we have the paper we will know but it seems like i mean my guess is my george is doing a recount it'll change by a couple hundred votes maybe it's not going to reverse tens of thousands of votes we've seen that in previous recounts i live in minnesota we had the great uh frank and coleman recount and i think like a dozen votes changed in the entire state after the recount and those are the kinds of things you see with these systems so my guess is is you know nothing was widespread the anecdotes are easy and they're often uh wrong data shows that that voting is accurate which in some ways is sort of miraculous it is i mean it kind of we shouldn't we should like pause and say like how amazing it is that so many human beings can can vote in a way that works and we learn the result in a week or so i know we like to learn the result before we go to sleep at night but you know now that it's no longer election day it's election week or election month it's a lot harder and it's a good way to think about it we have actually three different elections there's election day the one we're used to there's early voting which is i did in minnesota so i went to machines like two weeks before wholly different setup system place to go and then the mail-in system which is a different set of procedures so election officials are now running three different elections with different rules and different guidelines and different personnel requirements and a lot of these people are are volunteers working part-time not a lot of experience it is amazing that we pull it off it is now again i was listening to uh television today and they said that's your first mistake they they said that uh i cnn reported that georgia is going to be doing an audit uh can you tell us how an audit works so it depends on the state but basically so if it's so you basically it's do it again but more carefully right so georgia and i don't know how what machines they had and how they worked but they tallied everybody's votes somehow hopefully there's paper and so if this paper they will go through every piece of paper again run it through the machine look at it to make sure that it that it's proper to make sure the person is eligible to vote to make sure that nothing was wrong if it's a uh computerized machine there's no recount they just open the machine and get the same numbers out again so you really can't do a recount but they will and they will just more carefully run that pyramid from individual machines to precincts to districts to the whole state and then come up with a final tally and and i will bet that the difference will be under 200 votes any change and likely less than that if it is more than that i'll be very very surprised yeah they said it was like 14 000 um excuse me they said it was 14 000 people uh voted for biden over trump in the state of georgia right that was the right that's a margin of victory and that's just you know we just don't have recounts that uh flip that much our our voting systems on election day and right after are more accurate than that you're not going to see that margin flip that's that's really unlikely well they said if i if i recall correctly georgia said they're going to hand count everything and he and counting i would assume would be more inaccurate that would be my guess right because people make mistakes but it's going to be this there's not going to be one person you know trump trump biden biden biden trump right there's gonna be like four people staring at each ballot so there'll be enough checks right you're unlikely to see systemic errors i mean you know when you when when i alphabetize sometimes i just forget where the where one letter is they put a different pile that's not going to happen it'll it'll be a slow process it's expensive probably not necessary although if it increases the confidence of the voters then we should do it right i mean elections are not only about conv about choosing the winner they're about convincing the loser and don't lose sight of that as an important value of elections that in a democracy the side that lost needs to believe they lost fairly but you know there's normally a belief that elections are fair and accurate now on that same vein president trump has been saying there's all kinds of conspiracies to get him out of office that you know dead people all these dead people are on the voter rolls have you ever seen that anything like that or in in your work or he's saying that there's absolutely no checks and balances here no i mean he's talking about old things i mean you know when he grew up in the i grew up in new york also he's older than i am grew up in new york right there was a political machine that ensured the right people won back then you could get away with controlling the voter rolls that way controlling the vote that way so new york chicago boston philadelphia you know those old cities that had party machines that kind of fraud did happen and you know it the 1968 election illinois was probably fraudulent because of that in the now right now you can't get away with that you know i remember stories from the 70s in new york about uh party bosses buying votes i mean handing out cash and buying votes and you do that now you're gonna get out you're gonna be videoed you'll be on youtube it'll never work so so those sorts of things do not happen anymore that kind of retail vote fraud what we're concerned about is the wholesale election fraud by tampering with the machines tampering with the systems tampering with the tallies that's what we're worried about and that scene that is what seems not to have happened this year what about the stories about the russians hacking into state databases of secretary of state databases so that seems to have happened it seems to have happened uh in 2016 2018 and this year as well we don't know a lot of details the stories are very scant i assume a lot of this is classified but all the stories stress that no registrations actually change so here's the fear and this is what we're worried about on election day that election day starts and a state that matters let's say michigan the poll books don't work right in the morning everyone sets up and the electronic poll books the list of who's eligible to vote the database is gone it's corrupted it's wiped clean it's wiped clean it's full of errors everybody's address is wrong make up your own horror story right and the state just grinds to a halt that didn't happen now there have been changes in voting role attacks the the one i know about i believe it's california this was a primary that some republicans had their party affiliation changed to democrat they tried to vote in the republican primary and were unable to now this seems not to be foreign interference is because the website where you just change your party affiliation you go online and change your population had no security so someone changed the party affiliation of the supporters of you know the the primary candidate he didn't like right so it's republican versus republican it's a primary but if you make your opponent supporters democrats they can't vote right so that seems to have happened and uh professor latonya sweeney at harvard she has looked into the security of of of that system she the changing of address changing of party affiliation and found that in many states it's not very secure now that seems not to have happened in this election at any scale right we really read no news reports about that but those are the sorts of things we worry about and so we do see this probing the us government has talked about it openly has admitted it but it seems like nothing has been done with it now we can ask why why they bothering we don't know well i know your own senator senator amy klobuchar had introduced a bill for election security and nothing happened to it and it's still sitting on mitch mcconnell's death well election security is now a partisan uh activity and it shouldn't be it shouldn't be of course not i mean the uh getting people to vote should be something democracy wants to do you know i mean from my perspective i think we need more federal involvement and the problem we have is we don't have one election we have 51 different elections all the different rules all different security and you know some election official in akron ohio versus the government of russia is not a fair fight this is not a fair fight so the more we can have federal standards on poll books on voting machines on recount systems on you know eligibility requirements the more you can federalize this the safer we will be because the threats are now national they're not local that's hard to do right constitutionally the elections are local uh right i thought with the way to i think the way to solve this is the same way you solved the 55 mile hour speed limit right the federal government was not able to set the speed limit but they said look look you state if you want federal highway money if you want the money you will right you will impose the speed limit i think everybody but montana did so you can do the same thing you know right federal government says we have all this money available for election infrastructure voting machines for training for for data or for everything and if you youth state want a piece of it you have to abide by these national guidelines that yes are optional but are you know but the money is contingent on them and then we would be much more secure right now what are your thoughts on mail in voting um that should be you know paper should be traceable uh easy to uh cross check however in this election we have a plant at the post office you know slowing down the mail we have dejoy slowing down the mail that was a big contention in this election that was it was a surprise right who who you know funny i'm teaching a class in election security the harvard canadian school right now and one of the things we did early on is listen who do we have to trust to have a secure election and the obvious on the secretary of state the voting officials the election machine makers like who thought you had to trust the post office but turns out they're on the list so mail-in voting is interesting right so the reason we might not like it is because it allows for vote buying right i can hand you ten dollars you give me your signed ballot i've bought your vote right that's a worry that seems not to be a problem but that that is why we have the secret ballot right there is fear and it's certainly in the 50s that men would forcibly vote for their wives or their adult children living at home so you know we have the voting booth which you're completely private it turns out uh that kind of vote buying doesn't happen again i think if it happened at scale it would be exposed we would know about it you couldn't get away with it and it it is much more convenient so the uh experiments especially the pandemic but oregon has been doing mail-in voting for for years and and they find that it's easier people to vote more people vote giving people options to vote is good the worry and mail in voting is that sometimes the rules are so convoluted they're almost like a literacy test now you have to so generally you have a ballot you fill it out you put it in an envelope seal it maybe write something on the envelope put the envelope in another envelope and seal it and then maybe sign something else and if you do it wrong your vote might not count and you might not be told sometimes you are you know i have a friend here in minnesota tells a story of his daughter who voted by mail gets a call like 5 30 pm on election day saying we have your mail-in ballot it's not right it doesn't count if you run down to your precinct you can still vote you've got an hour and a half left all right better than nothing but still kind of yikes so sometimes the rules are complicated my parents live in new york my mother is convinced that her primary votes didn't count for her her and my father because they filled out the they did the envelopes wrong in pennsylvania there's a recount you're going to learn about what they're going to call naked ballots where this it's just in one envelope not in both envelopes do those count or do those not right i mean that's going to be an argument i i want everyone to be able to vote but you didn't follow the rules technically your vote doesn't count virginia had some weird thing about you have to get a witness to sign it but you didn't actually have to i don't even know the story of that again standardized national rules will help a lot here yeah there was some talk about you know the witnessing people are elderly they can't go coronavirus they can't go knock on somebody's door and say can you witness me standing here you know or wherever they have to go so how did you vote how did you vote massachusetts to stay this year well massachusetts we had we had options we had uh there's early voting there's um mail-in voting and there's same-day voting right so you have all three options that's what we have minutes we have in minnesota which works very well um so it went very smoothly there's never been a problem it's very decisive yeah unfortunately how smoothly it goes often depends on your socioeconomic status you know people in white middle class neighborhoods pretty much never wait in line to vote people in poor minority communities can wait in line for hours and that's that's really sad well texas even took away the drop boxes the only right yeah making it harder to vote is a is a i mean it's a republican voter suppression tactic it's very unusual you have to understand it for what it is for a party that says they're for america they're doing everything you know in a lot of ways voter registration is a suppression tactic you go to japan you don't register to vote when you when you turn the right age i don't know what it is let's pretend it's 18. you automatically sent your voting card right you know there's no separate registration process but what kind of nonsense is that that is a holdover and it is meant to be provo to enable voter suppression it is a holdover from the jim crow yeah it is you know and i'd like to see a permanent bureaucracy in charge of accurate and secure voting uh elections canada would be an example right that is a bureaucracy in canada that administers elections the uk has something similar japan does australia does we don't you know we don't have like the u.s census bureau in charge of counting a bureau in charge of elections we should but one of my concerns about that if you can manipulate the post office from a federal level couldn't you have a president that could undermine or manipulate that so in a sense you you were always stuck with that i mean right now we had a president try to manipulate the census so yes you're always stuck with those in power can manipulate the electoral system and in a sense there's no way to stop that you know we need enough checks and balances enough moral outrage enough norms and we seem to have gotten it you know even with all the problems we did that we did have a an accurate election now there's all the structural deficiencies it's not enough for a candidate to get more votes in his opponents because we have some very archaic electoral college systems you have to you know and and gerrymandering you have to actually kind of cut right you have to get more than you know and that's why you can have the united states minority government and we do and it's it's again not democratic yeah many times the unpopular person uh won because of the electoral college and now you know that many i mean recently and this is something that that that's that sways republican both and that's both electoral college which means some votes count more than others and really suppresses uh urban votes in very popular states and then gerrymandering where you can precisely design your districts which has happened mostly in the republican district yeah you know democrats do it too but republicans do it more yeah someone should be able to do it you know districts should be drawn by you know party blind computers that that don't know anything except how to draw lines and population numbers i just made that up right you know we can imagine ways to do this fairly that no one is uh that no one has an advantage now uh the russians probably tried to hack this time you know we don't know if they did it's an interesting question i i'm i'm not convinced they did because they didn't succeed and they didn't fail in a way that we noticed that implies to me they didn't try but it we do not know that what about iranians what do you think you think they tried this guy so i don't know i don't think so actually and i wonder if it is stuff that u.s cyber command did right there were those stories that seemed to have been a tribute to iran but that felt weird that voters were getting a threatening mail purporting to come from other proud boys so a fringe republican american group democrat supporters were getting mail we also saw that people had biden signs or getting threatening uh letters i mean as election manipulation goes it's kind of dorky i mean huh right that's it really feels sort of amateur it does but you know we don't know what happened and what was thwarted behind the scenes and and i hesitate to guess you know it turns out u.s cyberman is doing a pretty good job yeah i think so i i think it went rather smoothly despite all the the claims of fraud and wrongdoing by the administration now whether the new president-elect will take office that's another story that is a is another story and i think he will i mean this there's a lot of of you know there's a lot of stuff going on but i i don't i don't see how it will prevent the actual election results from uh from turning into reality so what advice do you have for um you know the voter who is concerned that their vote maybe didn't count or didn't count correctly what advice do you have for the those that man the infrastructures of our voting system you know so we voters have to make sure we vote make sure we vote properly learn the rules and really push for more secure accurate and fair voting that enfranchises as many people as possible and those are policy pushes so we need to start demanding that and election officials i mean they're doing they're you know they're doing a great job they're doing the best job they can understand that some threats are are greater than you and the more you the more open you can be the more the you know sort of the more you can just do your job and try to ignore the noise i think the better you'll do i mean pennsylvania was great at that they just counted their ballots and the press screamed and trump screamed and the i mean i just was great watching them we're just going to count our ballots go away we'll tell you when we're done i thought they did a very good job i thought they were very devoted to the task right arizona two which took forever right georgia was just called i think today yes and er and so so right i mean and these are people doing their job and they are they are dedicated to an accurate account and unfortunately some of those dedicated civil servants were getting death threats um doing their job and that is i mean and that is terrible yes so un-american is is there anything else that you would like to add before we close i think this is good thank you very much for uh grabbing this issue it's important i think it's very important and uh do you have any suggestions on whether we should go more paper ballot in the future of course there's been two things we want a voter verifiable paper ballot remember those four words and a risk limiting audit those are the two things we need to demand and that is that will secure our elections that will help secure our elections there's no panacea but those two things are essential great well thank you so much thank you it's been a pleasure i want to thank our guest bruce schneier for sharing his insights and opinions on securing our voting systems i also want to thank you our viewers for tuning in for more information on today's topic and our guest visit the legal edition online at thelegaledition.com and remember this information is for general educational purposes it is not legal advice and don't forget subscribe online and download our podcast find us on facebook youtube instagram and twitter