Up next, a discussion on Election Security. This panel looks at preventing Voting Machines from being hacked. And talks about some of the benefits of paper ballots. Georgetown Laws Institute for Technology Law and policy hosted this series. Hi. Welcome. So im matt blaze. Im a professor here at georgetown in both the law school and Computer Science department. I want to welcome you to our afterlunch panel. Thank you for sticking around. On Digital Technologies and voting. We have, on our panel, who i will introduce very briefly, four very distinguished experts at various parts of the digital elections landscape. And and the technology and the risks of some of the Underlying Technology that is inherent there. And well be talking about this subject for from a very wide range of different perspectives. But all with a very technological bias. So im going to very briefly introduce these people. And im going to apologize now for being extremely incomplete in my introductions because they would take up the entire panel. Andrew apel is the higgins professor of science at princeton where he served since 1986. And, in fact, he was one of the members of my Doctoral Committee at princeton. His research focuses on software verification, security, programming languages, and technology policy. And in the case of the latter, particularly, with a focus on election technology. And Voting Systems. The next up on our panel is kim zetter, who is an awardwinning journalist, who has covered cybersecurity and National Security since 1999. Shes been on the staff of wired magazine for over a decade. And has written about tech and security publications like the New York Times, politico, Washington Post and many others. She is also the other of what is cert absolutely the best book on the stuxnet virus and the implications of it. You should run out and buy it and read stark is a professor i the department of statistics at uc berkeley whos work has impacted public policy, from the u. S. Census to credit risk modeling and so forth. Huge range of incredibly influential and important work that he has done. Most relevantly to us his method for auditing Election Outcomes with widely recognized as the standard for relooinl elections that make use of technology, risk limiting audits is something youre going to be hearing about quite a bit during our panel. And finally, Barbara Simmons is chair of the board of verified voting. She is a Computer Scientist whos work has been at the intersection of technology and policy for as long as i can remember. She is a former president of the association for computing machinery, and she was one of the first voices to look at the risks of the use of technology in Voting Systems. And again, i have not done justice to any of these people, but im sure they will introduce themselves as well. So im going to just briefly introduce our panel and kind of frame some of what were talking about here. Technology is all over our election. We ev we have Voting Systems which are probably the most prominent and the most highly visible parts of elections, in particular the technology in Voting Systems can sometimes be essential for the integrity of the ballot itself, for the integrity of the vote count itself and so forth. Voting is probably the main subject of the help america vote act. Theyre obviously quite important and prominent. They are targeted by corrupt candidates and their supporters who have the aim of offering the official outcomes of elections. So the risks are quite serious in Voting Systems, the integrity issues are quite important. But thats not the only place that technology exists in election systems. We also have the election management infrastructure. This is less visible, less standardized, tends to be built by individual counties. And its depended upon for the logistics, including the registration of voters and poll books that are being used at polling places to check voters in and determine whether theyre allowed to cast ballots in the first place. These systems as well are exposed to risk and ought to be attention of actors, particularly hostile state actors who may not be seeking to choose the outcome of an election so much as disrupt the election or cast doubt on the legitimacy of its outcome. And these systems are much larger than more exposed than the Voting Systems that we tend to focus on. So the issues on technology and Election Integrity are vast, and, you know, we will be touching on them quite a bit. I think this all started with a photo. If you recognize this photo that dates you to some extent as having been around at the turn of the century. Who recognizes this photo . Yeah, this is of course the recount of the 2000 president ial election in florida. And this photo and variants of it show, you know, somebody applying scrutiny to a peaiece cardboard that was used to express a voters choice during the election. This photo is interesting because we all know it because it was on the news and in the newspaper for over a month as the example of how terrible things were in the florida election. This is a national embarrassment, and we have to do something to make sure that this never happens again. And i think its interesting that this photo has almost inverted in its meaning in the two decades since. As also showing a strength of the 2000 election, that a human being could look at a physical artifact and make a judgment about what the voter may have intended, that we may agree or disagree about, but at least we can get kind of closer to the truth by examining this. So where does this come from . It came in fact from a Technology Failure in the voting equipment that was used, that did not itself actually involve computers or even electricity in the voting booth. This was the voting machine that produced those ballots. Called a voteowemattic. And the technology involved taking a perforated punch card and inserting it in the top of the machine and making your choice along a column of hole positions using a stylus and punching through the ballots. That would then produce a punch card that could be put into an electronic tab later, and the vote tallies according to what hole position had been punched out. The interesting thing about this is that the only electricity even involved in the voting booth itself was for the light in the room. This is a completely mechanical device, and yet it had a failure type, which a Computer Scientist would recognize probably as a garbage collection failure. [ laughter ] in that the as if more voters than usual showed up for the voting, for voting, eventually the little pieces of cardboard that were punched out from the more popular candidates would back up behind the position where the ballot was to be punched out. And as the day would wear on, in a hotlycontested and very popular election, eventually it would become physically harder to vote for your candidate of choice. And the difficulty would actually be proportional to how popular the candidate was, because there would be these pieces of cardboard behind the ballot. And the cannes kweonsequence of that a properlypunched ballot, if you look at hole number 68 in the center will be cleanly punched out and easily read by the optical electronic tally device that these cards were fed through. But what might happen if we look in the center instead of the cleanly punched out hole that we see in the upper right corner, we might see only a little of the cardboard square, a term that became known to every american, the dimpled chad. Or we might create a flap where the hole might have been that might close up. And neither of those two hanging chad in the terminology of these machines. And what would happen is these cards, a human being would be able to see, ah haha, the dimp. But the reader would pass a beam of light through each position, would interpret either of those conditions as no vote. And what we saw in a very close race is that the number of people in certain counties who didnt vote was within the margin of victory for the winner. Greater than. Sorry. Greater than. The margin of victory was within the margin of nonvotes, so we had to resort to this lengthy, tedious recount, that you can read about now in the history books. So the country was unlike today heavily guided on who should be president. This was a very sharply divided, not at all bipartisan world where there was bipartisan agreement on one thing, which was that we should replace these florida punchcard Voting Machines. And congress very hurriedly passed something called the help america vote act after the 2000 election. It mandated that states shift to accessible Voting Technology that would generally mean electronic touch screens with Adaptive Technology people could use if they couldnt interact with paper or with an ordinary type of interface, so there would be various assistive technologies available for that. And it also provided substantial funding to the states to purchase new equipment. Unfortunately for the most part the equipment mandated by the act didnt really exist at the time that it passed in full production form. And the understanding of how to do bills, equipment that would comply with help america vote in a reliable way, was not well understood by the technical community. And to the extent it was understood, it really wasnt a design consideration in the certification of the equipment. So it allowed for a number of different types of voting equipment, the most prominent is the direct reporting electronic voting machine, which is essentially a computer that stores the tally of the votes cast on it internally in computer memory. It also permitted optical scan ballots and absentee ballots that are mald in on paper as well as assistive devices like ballot marking devices, which im sure will be discussed as we go on. I want to talk a little bit about cre Voting Machines because they probably received the majority of attention from people concerned about technological risks. These are essentially computerized Voting Machines, computers in a particular form that makes them look like a voting machine, but these are really computers just like your laptop or desktop or phone, in that theyre controlled by software. And the tally of votes is maintained inside the memory of the machine under the control of the Software Running on this equipment. And so many questions have been raised over the years about whether dre Voting Machines can be made reliable enough to use in elections. And the overwhelming consensus of experts is that in fact they cannot. Yet many states are still to this day using them. So with that, id like to turn this over to our first panelist, andrew, you can either sit there or come up here. I think if you just keep going okay so ive been studying computer rised Voting Systems since about the hanging chad debacle. And in 2017 i was asked to serve on a National Academy of science of engineering and medicine consensus study panel which met for five twoday meetings. We heard from sketwo universiti cochairs. One law professor and three Election Officials. And we were asked to write down what is the Scientific Consensus. Dont invent any new science. We wrote a report. Here it is. Which has many recommendations backed up by even more pages of scientific explanation. So here are the key recommendations which i dont nearly have time to describe all of. Let me get to the main points. Elections should be conducted with human readable paper ballots. These may be marked by hand or by machine. Now, that was a Scientific Consensus in 2018. Thats no longer quite the Scientific Consensus. They may be counted by hand or machine using an optical scanner. Recounts and add its should be conducted by humans. Voting machines such as dres that do not provide the capacity for independent auditing, machines that do not produce a verifiable paper audit trail should be removed from service as soon as possible. These are the dre machines that you just heard about. They dont have a paper trail. You interact with them on the touch screen. The Computer Program in there says how many votes each candidate got. So its easy to commit largescale election fraud, write a Computer Program that cheats, make sure it doesnt kpaet except on election day like the folks, they wont cheat when theyre in the chess tournaments outside of election day, and get it installed on all the Voting Machines. Heres me installing software on a new jersey voting machine. Its in new jersey. I own this one. It would be a felony to do it on a real in use in the state of new jersey voting machine. But modern computers its much easier to install software through network propagation. Any Computer System now has so many lairs. The top layer is the application that counts your votes. Below that there are other systems and buyose, this is millions of lines of code, thousands of software bugs. And of those some are exploitable that allow an attacker to install a different application on top. So its stealing software instead of vote counting software. This can propagate to a network but also piggbacked on removable media as stuck net did which we can tell you more about. I can write that. Anybody with a bachelors degree can write that that shifts some of the votes around but doesnt do it when its not election day. So the solution recommended in the National Academy report is to vote on optical scan forms. This is a much Better Technology been punch cards. Right next to the name your candidate on the same smeet of paper, that the pen is intended to be read by humans as well as written by humans. This technology works. Its highly accurate. There have been measurements of that. And then we count those in some sort of machine. Either a precinct count optical scanner, the voter feeds the form into in the precinct, or its deposited in a ballot box or mailed in. This year here is how were going to vote. This is from the verified voting foundation. In white or cream color you see the places where were going to vote by optical scan form, counted by op scan commuters, recountable by hand. And in light, light brown are places where for accessibility theyre going to use paperless dres already maybe dres with paper. Thats not a great idea. And in dark, dark brown and in red are places where theyre going to use dres without a paper trail or ballot marking devices with an inadequate paper trail. Part of the good news is that most states use about the right technology for voting. They use the most auditable, least insecure technology. There are a few laggard states such as my own state of new jersey that are still using paperless dres. Theres a bigger problem that most states dont actually audit their paper ballots or even rekouchbt them with any reasonable probability. Heres how we vote. The voter markets a ballot, feeds it in the scanner. Its a computer. All my remarks about how easy it is to hack is plies to that as well. If a hacker got to install fraudulent software, that could deliberately shift the election by miscountsing the ballots. The paper ballot drops into a sealed ballot box, and if you can maintain a reliable chain of custody of that box from the polling place to where it can be stored for auditing and recounting later then you can trust the results of the election independently of any possibly hacked computer. So if you have to recount the ballots by hand, though, whats the point of having a computer . And the answer is, you can do a random sample audit of the paper ballots to be assured with statistically guerin tooebl probability that the outcome of the election is consistent as reported by the computers, is con sint with whats truly on the paper ballots. Many states do some sort of ran dome audit. B professor stark will be talking about the guarantee later. Ill cite the National Consensus report that says states should mandate risk limiting audits prior to the certification of election results. Some states do some sort of audit. The states in pink here do no audits or completely unsatisfactory audits. The states in yellow are mostly unsatisfactory audits. The states in blue do moderately unsatisfactory audits. And all the states you see in green are doing satisfactory risklimiting audits. But several others are following along with pilot projects to on the process of adopting high quality risklimiting audits. Ballotmarking devices were mandated by the act as an assistive technology. For voters who cannot mark a paper ballot by hand, they can use some sort of touch screen that will mark a ballot for them. You might ask, how is the touch green going to help the blind voter . But theres an audio interface you can plug in and allow the marking of a ballot. Some states have started adopting bmds for all, that are fed into an optical scanner. In the National Academy report there was concern about ballot marking devices of whether voters actually inspect whats printed out on that piece of paper, that its after the voter makes the selections on the touch screen and the card comes out, that records their choices supposedly, if the computer in the touch screen hasnt been hacked, will they examine it before they put it in the ballot box . There has been no research on that. The Scientific Consensus as of 2013 didnt have answers. Since then there