voters is easier than hacking ballots
my name is maurice turner and in this
talk i will cover who i am
human-based election vulnerabilities
social media analysis
foreign adversaries and recommendations
to help prevent
voter hacking
i call myself a public interest
technologist currently i am the cyber
security fellow
at the alliance for securing democracy
at the german marshall fund of the
united states
i helped develop comprehensive
strategies to deter
defend against and raise the costs on
autocratic efforts to undermine and
interfere in democratic institutions
my focus is securing critical
infrastructure and deterring
cyber operation escalation i have also
held positions in the united states
election assistance commission
the center for democracy and technology
the united states
senate and in other public sector and
private sector organizations
in dc and california i hold degrees in
public administration and political
science
as well as a certificate in cyber
security strategy
i got my start in tech probably the same
way that some of you did
i broke things around my house and tried
to put them back together
sometimes it worked other times not so
much
in high school and through college i
built computers and worked at a small
medical product development firm where i
grew my skill set from basic repairs
to sysadmin to product design and cad it
was my first experience being part of a
product lifecycle and seeing how
decisions made by a small group
could literally mean the difference
between thousands of patients going home
weeks earlier
or dying that lesson has stuck with me
throughout my career
i got my start in elections at around
the same time
first i volunteered on local campaigns
in southern california while in college
in 2008 i made the shift to the other
side of elections to become a poll
worker
the new dres were being used so i knew
it was a good opportunity for
me to bring my tech know-how to help
other poll workers who might not be as
comfortable with the digital voting
machines
i continued that for nearly 10 years
even after i moved to virginia
i took a deeper dive into elections
after my first defcon
at the inaugural voting village learning
about election security was
eye-opening to say the least what keeps
me interested in the field is the
combination of it modernization
cyber security policy and administration
all working toward helping people
exercise their constitutional rights
the u s election infrastructure is
maturing but still has a major weakness
its voters malicious domestic and
foreign actors
capitalize on free seats protections and
inconsistent content moderation
enforcement
to seed and amplify disinformation and
misinformation on social media platforms
the alliance for securing democracy has
developed a social media analysis tool
to track these overt disinformation
messages
that are targeting democratic elections
in the united states
as well as europe
authoritarian regimes have long used
influence campaigns as a means of
controlling public sentiment
internally and externally these regimes
have turned to social media platforms to
extend their power asymmetrically
but it's not too late to implement
technical and policy measures
to improve resilience in the election
infrastructure in the united states
and in other democracies
u.s elections infrastructure
vulnerabilities
malicious actors are growing adept at
using social media platforms to
communicate directly with american
voters
they have used facebook and twitter
since at least the 2016 general election
youtube and instagram users are also
being targeted with visual content
that may be more difficult for content
moderation teams to identify
and track snapchat and tick talk are the
latest platforms gaining popularity in
america
as you'd expect the attackers will
follow users
to continue their efforts at perception
hacking
apts attributed to russia china and iran
targeted hundreds of political
organizations with hack and leak
operations in the 2020 election cycle
the goal was to gain access to personal
accounts in order to exfiltrate
sensitive data
that could be used in future
disinformation campaigns or
extortion attempts
the vast majority of americans use at
least one of the popular social media
platforms
most of these users are on their
preferred platform
daily despite saying that social media
is having a mostly negative effect on
the way that things are going in the u.s
today
what those users are looking for is new
content that is engaging
content that malicious actors are happy
to create or amplify
the concerns about just how effective
algorithmic suggestions are
at leading users toward progressively
more divisive content
are well known even the criminals know
how to game the algorithms
and for those that don't disinformation
as a service operators are standing by
to write articles make social media
posts
and even provide search engine
optimization
for disinformation campaigns
technical advances to generative
adversarial networks
and artificial intelligence have made
the creation of believable bot
accounts nearly trivial it's a constant
battle to take down these fake accounts
as quickly as possible
facebook reports that it bans billions
of accounts a year
but banning accounts is not as simple as
you may think
just ask twitter last month they
verified several fake accounts
that had supposedly gone through a more
rigorous verification process
i believe that there is a greater value
in fake accounts
when they are used to amplify rather
than create disinformation
it's far less risky to boost the reach
of a real user's social media post
because all the platforms value
authentic engagement
sometimes that engagement is prioritized
even when it violates policies
social media analysis
so to help researchers and journalists
reveal some of these state-backed
messages
the alliance for securing democracy
created the hamilton dashboard
it can be used to help shed some light
on these attempts
using disinformation to subvert
democratic institutions
to learn more about how the hamilton
tool was developed
let me introduce you to my colleague
brett shafer
media and digital disinformation fellow
brett is the creator and manager of
hamilton 2.0
an online open source dashboard tracking
the outputs of russian
chinese and iranian state media outlets
diplomats and government officials as an
expert in computational propaganda
state-backed information operations and
tech regulations
he has spoken at conferences around the
globe and advised numerous governments
and international
organizations prior to joining gmf
he spent more than 10 years in the tv
and film industry
including stensek the cartoon network
and as a freelance writer for warner
brothers
he also worked in budapest as a radio
host and in berlin as a
semi-professional baseball player
here's brett with more on hamilton this
is the hamilton 2.0 dashboard which is
an
online open source tool developed by the
alliance for securing democracy at the
german marshall fund
that tracks the outputs of russian
chinese and iranian
government officials and state media
accounts and outlets
across twitter youtube state-sponsored
websites as well as through the official
outputs
at the ministry of foreign affairs in
the coming months we're going to be
adding in facebook data as well
so whenever user first lands on the
dashboard we provide a summary analysis
of the topics and themes that have been
promoted the most often by the networks
that we track over a given time period
we typically default to the last seven
days i've selected the last 30 but this
is customizable so users can select any
date range of interest
i've also selected all three countries
that we monitor but again
if your interest is in a specific
country you can just select on that
country
and drill a bit deeper into that network
so as a user scrolls through the
dashboard it's a great way to orientate
yourself
around the topics and themes that are
being promoted the most
during this specific time period that
has been selected we also show a
snapshot of the accounts
that have been the most influential
during that time period
as well as the individual tweets that
have received the most retweets and
likes
but we provide things like the countries
most mentioned the urls that have been
the most shared as well as the accounts
that have been the most
mentioned the dashboard also provides
for
a little bit deeper analysis though so
if your interest is less
in the topics and narratives being
promoted more
in the accounts that are the most
influential a user can select the
account page which for example will show
the accounts that have had the most
gains and followers over a specific time
period
we again show a little bit more detail
here in terms of which accounts have the
most follows the most retweets the most
likes
and if you scroll down you can look at
things like the
most retweeted accounts that are outside
of the network so these are the accounts
that
official state-backed actors are trying
to boost through retweets
you can also dig into an analysis of the
networks that are the retweet networks
that are sharing specific content
so i'm gonna change to a different tab
here only because things tend to work a
little bit slowly when doing a screen
share
but i looked at the last 30 days
selected former president trump as my
key phrase of interest and here it will
show me
the retweet network so these are
accounts that have tweeted about trump
and then have been retweeted by one or
more of the accounts that we
follow on the dashboard as mentioned
we also provide a bit of analysis of
youtube and state-sponsored websites as
well
so again clicking to a new tab on
youtube we are tracking
four channels that are financed by the
russian and chinese government so rt rt
america cgtn
and cgtn america and again just
scrolling through here you can get a
pretty quick snapshot of the content
that is
that has rece received the most views
likes
dislikes over a specific time period
again great way for a user to
familiarize themselves with the kind of
topics that are
being promoted by each network but also
we
give the user the ability to do a bit
deeper dive analysis as well
on state-sponsored websites we are
currently tracking about
35 websites most of them russian-backed
at this point
but here we'll have every article that
has been published through
particularly english language
state-sponsored websites
as well as a few cutouts as well so
these are websites that we know to have
connections to russian military
intelligence for example
across the dashboard if you're
interested in something that is not
appearing in one of the top charts
you can always run a custom search here
as i did by running former president
trump with the network analysis and the
dashboard will show you
relevant metrics we have also created a
tool that we call
hamilton search what it is is
essentially a
google for state-sponsored outputs so
here i ran president biden over the last
two years
and you'll show all of the tweets that
have mentioned biden from russia
we have a global control group that we
use as well uh
china and iran and a few other actors as
well
and then scrolling through here you can
just see the
most recent content but you can also
change to
well what's been retweeted the most
often and this is a great way to get a
pretty
quick sense of how these networks are
talking about a specific
individual or how they are discussing a
specific
topic so that is the quick four to five
minute overview of the hamilton
dashboard
as mentioned it is an open source tool
that we hope
uh ocean researchers and others will
utilize to get a better sense
of how state-backed actors are messaging
around topics of interest
uh to audiences around the globe
foreign adversaries
let's start with russia russia has a
long pattern of u.s election
interference online
after 2016 most in the u.s were
convinced by the evidence that russian
agents were actively trying to influence
public sentiment
surrounding divisive issues in 2018
u.s cybercom actively disrupted the
internet research agency
a russian troll factory to discourage
interference in the election midterms
in 2020 russia produced content using a
website called newsroom for american
and european-based citizens and followed
american users to new social media
platforms like gab
telegram and parlor russian interference
campaigns are mostly covert
the ira and now the website
r i a f a n
generate content under the guise of
multiple blogging personas
these articles often contain compelling
keywords
or at mention popular handles in order
to make them compelling to followers
they are also signal boosted through
linking schemes with the goal of
spreading the misinformation to
legitimate news organizations
russia is willing to harbor cyber
criminals that target critical
infrastructure
my biggest concern is the escalation
from information-based attacks
to attacks on the operational
infrastructure of elections
the us intelligence community said that
this did not happen in 2020
however the recent diplomatic and
enforcement actions by the biden
administration
in response to the spate of ransomware
attacks on other critical infrastructure
operators
shows that russia is openly permitting
or even encouraging
criminals to operate within its borders
russia is uniquely positioned to launch
a disinformation campaign
based on a legitimate attack on election
infrastructure
it would be trivial to leave evidence of
a data breach on a county server
and then spread claims that that same
attack occurred in counties
across the nation
the research shows that russia was quite
active in promoting claims of voter
fraud
stories about mail-in ballots and
president trump disputing the election
results were spread across social media
networks from official
and unofficial media accounts
we expect that russia will continue to
evolve its tactics in order to evade
content moderation efforts by social
media platforms
these tactics include setting accounts
within the target country
renting the accounts of authentic users
and recruiting domestic
activists
here are some examples as we would
expect
there are quite a few examples that at
mention real donald trump
for example 66 tweets between november
1st
2020 and january 31st 2021
include the word fraud and mentioned at
realdonaldtrump
however sputnik affiliates are the only
accounts that actually use his handle on
twitter
iran iran is active in
covert and overt campaigns against
critical infrastructure
iran is another country with a long
history of digital attacks
against the united states and a strong
interest in sowing distrust
in the democratic process in september
2012
iranian hackers directed a ddos attack
against u.s banks
in march 2018 iranian hackers crippled
atlanta's city government
with the samsam ransom attack
in october 2019 an iranian government
hacker group tried to breach microsoft
email accounts
associated with journalists current
and former us government officials
and a u.s presidential campaign
in june 2020 google announced that iran
unsuccessfully tried to breach president
trump's re-election campaign email
accounts
iran has experience with successful and
sustained
information campaigns iranian affiliates
have operated websites and social media
accounts in the open
these websites and accounts are used to
create and amplify pro-iranian
propaganda
the united states has been able to take
down some of these websites using legal
means
last october 92 domain names used to
push disinformation
by the revolutionary guards were seized
in june the department of justice also
sees
the press tv al-alam and more than 30
other pro-iranian domains
press tv is the islamic version of
russia's rt
a homegrown news themed media outlet
aimed at influencing
english speakers in the west social
media accounts on facebook
and twitter are also popular means for
spreading disinformation
and stealing credentials by iranian
hackers
twitter removed 238
identified accounts as attempting to
interfere
with the 2020 election by directly
influencing public conversation
facebook removed nearly 200 iranian fake
accounts
that were targeting military personnel
and companies in the defense and
aerospace industries primarily in the
u.s
this persistent attack used a
combination of social engineering
phishing and malware in an attempt to
conduct
espionage operations one of the
limitations of the hamilton platform
today is language support
as some of these messages are in english
but most of them
are targeting non-english audiences
there's also the issue of what happens
to social media posts
that link to domains that have been
seized and are no longer visible
here are examples from iranians efforts
they certainly covered stolen election
fraud campaigns
but largely from an anti-trump point of
view
so most of the coverage was de
dismissive
also as per usual most of their output
isn't in english so it's targeting
that non-american audience
china china has a history
of industrial espionage and
anti-democratic messaging
the chinese government is notorious for
its theft of intellectual property
in order to provide an advantage to its
domestic business interests
the ccp's industrial espionage asparatus
is quite effective compare the new
j-31 stealth fighter on the top with the
u.s
f-35 stealth fighter plane on the bottom
president obama entered into an
agreement with president xi in 2015
to curtail this kind of ip theft
in 2017 chinese military-sponsored
hackers conducted a cyber attack
on one of the united states largest
credit reporting agencies
scraping the personal data of around 150
million u.s
and uk customers
china has begun to utilize wolf warriors
to spread its version of
information on twitter in mandarin as
well as in english
these high-level trolls will join
divisive conversation online
like black lives matter in order to
deflect from domestic human rights
issues
like pro-democracy protests in hong kong
it's amplifying the voices of
influencers who are motivated by a
pro-beijing
anti-west world view
china is doing something that russia
isn't which is engaging with
inauthentic accounts or at least
accounts that are highly suspicious
it's hard to know if these were created
by the government
or computer generated accounts either
way
beijing's diplomats have retweeted these
accounts
hundreds and hundreds of times and
they're included among the
top most retweeted accounts
china is a well-established presence on
social media platforms as a means
of influencing foreign policy and
attempting to control the chinese
diaspora
the strategy intensified in 2020 once
reports of kobit 19
originating from china began to gain
traction globally
chinese officials themselves started
promoting outright fake information
starting in march 2020 a foreign
ministry official shared conspiracy
theories tying the virus to a u s
military research
facility in maryland later that month
one of his colleagues shared a video
purporting to show
italian singing thank you china from
their balconies after receiving chinese
medical supplies
italian fact checkers term that the
video was at least partially doctored
another takedown of over 30 000 twitter
accounts in june 2020
also showed that the chinese state is
still resorting to inauthentic behavior
to amplify its propaganda
there's no evidence of china using
informational or cyber attacks against
the united states
elections what is particularly
concerning is that china has tremendous
cyber capability that it's not using
it's currently ranked second to the us
on the belford center's national cyber
power index
to date it appears as if u.s elections
don't fall into the category of being
valuable enough to hack
here are some examples of china's wolf
warrior diplomacy
in action
recommendations despite these growing
concerns about foreign information
attacks there are still some precautions
that election officials and state
leaders can take
to mitigate these risks continue
training on the basics
near the top officials have access to
free
state-of-the-art training from several
organizations
learning about strong passwords in 2fa
is the foundation for getting
officials and leaders onto social media
platforms
where the disinformation is being
propagated having verified accounts in
those
is platforms opportunity to counter
divisive narratives and report
fake accounts it's not enough for
elections to be administered smoothly
officials need to be able to communicate
the integrity of the election to the
public
communication and incident response
training can help
both resources emphasize the importance
of having a communication plan that
provides timely updates to reduce the
space
for disinformation to spread
the social media platforms themselves
play an obvious role in the spread of
misinformation
the evolution and enforcement of their
content moderation policies are what
lead to message deletions and account
bans
but platforms are still struggling to
apply these policies in a consistent and
equitable manner
having verified accounts for officials
helps to establish their
trustworthiness as an authoritative
source this is the first step in
prebunking
misinformation and reducing the chance
that is amplified
preventing amplification of false
information got a boost from government
agencies this election cycle
cisa's rumor control website headlined
in november
as a source of reliable election
information to counter the common rumors
about ballot handling and vote tallying
that were circulating in the media
on the other hand another debate that
inexplicably
continues is the claim that ballots in
arizona were tampered with
in response the maricopa county election
department launched
the justthefacts.vote website and
real auditors don't hashtag campaign to
specifically bust
myths propagated during the fake audit
process
as new and upcoming networks like
snapchat and tick tock or
parlor and getter grow in popularity
they only go through the same
deliberation process of how to
manage divisive election content or
whether to
allow users to engage in political
speech altogether
it will be important to include election
officials in these conversations to make
sure they understand how quickly
and effectively voters can get engaged
and connected with authorities that have
the source of information on elections
the one area of responsibility for
security
that lies squarely with the federal
government is in deterring attacks by
foreign malicious actors
more coalition-based responses are
needed against regimes that harbor
criminals or themselves conducting
operational or information attacks on
critical infrastructure
that includes gathering more support for
the paris call on
global cyber norms and further
developing
the offensive and defensive escalation
pathways
when there is an attack in the cyber
domain it's up to united states and its
nato allies to leverage foreign policy
and military options
that can buy time for network defenders
and the american people
to build resilience against these
attacks
asd will continue to develop the
hamilton dashboard
an authoritarian interference tracker to
help uncover
subversion attempts of democracies
around the world
the current dashboard has specific
technical limitations that need to be
overcome
the biggest is that it is text only and
restricted to languages that our human
coders and automated transition
services can understand that is
sufficient for text-based platforms but
obviously
a much larger problem for visual first
platforms
video content on youtube is analyzed
by services including vitterover
and microsoft
at the end of the day it is still a
manual process
that has the potential for human error
and variability is greater
than would be acceptable in an academic
study so we
urge caution when using or citing
categorical data i'd like to
thank you all for joining me today on
this talk
and to especially call out the defcon
voting village
the alliance for securing democracy
election officials
voting advocates security researchers
and most importantly voters
thank you