hello defcon
um a little bittersweet to be presenting
here
to you today unfortunately by wreck by
recording
instead of in person in las vegas but
hopefully next year
will be together i'm susan green hall i
am the senior advisor for election
security at free speech for people
i'm going to share my screen
now um
and hopefully you can see that uh um
freeze feature people is a non-partisan
not-for-profit public um
advocacy and legal organization and we
have
um several projects that are aimed at
our mission which is to
um strengthen and improve democracy for
all people
um we work on things like money and
politics and
corporate abuse of power and we have a
specific project on election security
which i
am the senior advisor for
um now we are here today to talk about
the wireless odyssey or why the blink do
we have
wireless connectivity in voting machines
um i really want to describe all the ins
and outs of a mind-blowingly
reckless and stupid decision made by the
federal
agency that oversees voting technology
to allow wireless networking devices
and federally certified voting machines
considering the state of confidence
in election systems in the current cyber
threat landscape it would seem to be a
complete no-brainer
that we should ban all wireless
networking in
voting machines but that's not what
happened instead
over a tremendous amount of public
opposition the united states election
assistance commission
or eac extra legally
with met with the voting machine
manufacturers and stripped
provision out of the proposed federal
voting system guidelines that would have
banned
any device capable of connecting
wirelessly to the internet
um but i don't want to get to ahead to
to the
end i'm skipping to the end um this is
some of the press about that um because
i want to talk about all the things that
led up to the ultimate um conclusion
which you know put us in this position
um and sort of uh
uh foreshadowed the fact that we would
see the federal agency
uh siding with the vendors to um
uh to permit wireless networking in
voting systems
um so the um u.s election assistance
commission
or the ac is the federal agency that is
tasked with setting the federal voting
system standards those are
um called the voluntary voting system
guidelines they are voluntary but most
states
many states adopt them and they impact
the marketplace considerably so they're
quite
influential um and states look to them
to develop their own standards as well
even if they don't require eac
certification
um the first set of standards developed
by the ac was in 20 uh
2005 um and the eac is still certifying
voting systems to this day to that to
those standards from 2005 so wildly out
of date um
those standards explicitly permit
wireless modems and networking
connectivity
um yet like many um other election
officials the eac commissioners helped
to spread the myth that voting machines
are never connected to the internet and
so i'm gonna have to
um slip out of zoom share for one second
and then i will reshare to show you the
video
that i have
okay
okay so that's just a little sampling
there were
multiple instances where the eac
commissioners made public statements or
provided
testimony to congress saying that the
voting machines are never connected to
the internet and that the federal
standards ban
any sort of connectivity or any sort of
wireless modems um
but that was not true but what was
interesting
um is that um oh wait i have one more
video
um let's
go back again
thank you zoom
okay so um
we established that they have made this
statement um
but what was interesting is that the
this demonstrates the ac
sort of recognized that there was
pr value to making these claims even
though
they weren't true um yet
when the eac actually had the
opportunity to update the standards and
adopt a ban
into federal voting system um
that would prevent any sort of internet
modems or
a wireless networking connectivity they
did everything they could do to subvert
it
in 2015 the eac began developing a new
set of standards which was going to be
termed vbsg
2.0 voluntary leading system guidelines
2.0
this process is very specifically
dictated by
the help america vote act um and it's
subject to other federal laws like the
administrative procedures act federal
advisory committees act
the standards must be drafted by the
eac's technical
guidelines development committee then
submitted to the eac's board of advisors
and standards boards also published to
the federal register and subject to a
90-day
public comment period all and as well
they also held
public hearings all of this to ensure
that there was
um you know robust public
oversight and engagement um any
modifications have to go through the
same process
so at this stage the eac did two
unexpected things that are
relative to what unfolded first they
separated out
the standards into a high-level set of
principles and guidelines things like
the voting machine should record your
vote accurately
it should be auditable um and then they
um had a separate uh document
that was the very detailed
requirements that would ensure that the
voting system met these high-level
principles and guidelines
and they decided that both of these uh
uh parts of the the standards document
needed to go through the same
public comment period
public hearings advisory boards review
et cetera et cetera
and then second they set up
topic-specific public working groups so
they had one on human factors
there was one on cyber security and i
participated in the cyber security
working group as probably some of the
people watching did as well
um this was comprised of computer
scientists advocates like myself
election officials and vendors
after the high level principles were
completed
the public working groups dug into
drafting suggestions for the detailed
requirements
and the issue of the wireless modems in
voting machines was very hotly debated
it quickly
became clear this was going to be a big
point of contention the vendors and
election officials opposed a ban
cyber security experts and advocates
like myself were in favor of a ban
um and we saw we were we were facing a
major fight
um and so with some allies
um we worked up a plan to try and
engage the public on this in the spring
of
2019 at the same time the wireless issue
was
hotly debated in the public working
group the high level principles and
guidelines were going through the public
comm period
providing a unique opportunity to
address this issue
um so and and we felt that this was such
an important
issue that it actually rose to the level
of
being included in the high-level
principles and guidelines not permitting
any sort of wireless
networking technology uh technology or
devices in the system
um so several um
allied organizations from all sides of
the political spectrum
um including common cause public citizen
daily coast
and freedomworks all sent emails to
their members lists
asking their members to send in public
comments to the eac
asking it to include a ban on wireless
networking devices and voting machines
and this caught fire
um the all combined all the groups
together
uh we got over 50 000 public comments
submitted to the eac
asking them to include the ban now by
any measure of success that's a pretty
good
return on investment to get that many
people
engaged in this sort of weedy wonky
issue
sending public comments to this tiny
agency nobody never heard of
and about voluntary voting system
guidelines something else
a lot of people never heard of um but
evidently the eac was not familiar with
online organizing
so they did something extraordinary when
they started to see the volume of emails
come in
they shut off the email address that was
receiving these messages
so that it could no longer receive any
emails
they did not make any public
notification of that
nothing in the federal register nothing
on their website
they um did not include a bounce back
message that would tell you
this email is no longer receiving
messages please
submit your comments in another fashion
so
anyone who submitted comments after they
closed the email
address or shut it off or disconnected
it
would have gone into a black hole and
they would never know
um uh yeah so they were essentially
tell and this was in in the midst of the
public commentary there were still
several days like almost a week i think
a little less than a week was still left
um when they shut off the the email
address um
a day and a half later they put out a
tweet that said that they were asking
people to go to
an online platform instead to submit
their comments
um uh but they still had not put
anything in the federal register
and so some of the groups that had
organized around this were
were pretty understandably upset and
they complained that the eac
was um violating the administrative
procedures act which requires the
90-day public comm period and they'd
already advertised it in the federal
register
um because the eac had screwed up the
public comment submission so badly the
ac
agreed to extend the common period by a
week and a few days later they published
the extension of the federal register
which was required by law with a link to
the submissions page
so a few months after this debacle in
september
of 2019 the eac's technical guidelines
development committee
met and during the meeting an eac
staffer gave an update
on the development of the standards and
the public comment
period and quite unexpectedly the eac
staff said nothing
about receiving tens of thousands of
comments on
the issue of wireless instead the eac
staff told
the committee that it had received 2 800
comments
and i have a slide on that as well
because i can show you the slide that
the um
eac oh
shoot not visible in my windows right
now okay you'll have to take my word for
it
um
the eac um
the eac gave
told the the the uh um
committee members it was that it was
2800 comments that they had received
um but what happened was that the
committee members asked to see the
comments they said can we see the public
comments that were received
and the eac staff said no now this
i know i have uh queued up here
and this was the exact exchange so this
is judd and that's the
uh election director for the state of
colorado who is a member of this
committee
is are you cliff saying that the public
comments aren't public
and this is the eac's general counsel
said the public comments have not been
accepted by the commissioners to be made
public that's correct
the colorado election director says so
we can't see or talk about the public
comments
and that's pretty much what they got no
you can't
talk about the public comments um they
never got the public comment or
i'll qualify they did not get the public
comments um
in any timely fashion it took about
more than a year before the eac
eventually published all of those 50
000 comments and acknowledged that they
were that they had
been received um and that was because of
a lot of pressure
so just to recap there was a clear and
concerted effort by the eac
to prevent the public from submitting
comments in support
of a ban on wireless net network uh
wireless networking
then the eac expressly misrepresented
the number of comments it received to
its development committee
and then when the committee asked to see
the comments they said no
you can't see the comments the public
comments aren't public
now we skip forward a few more months
though the eac
didn't seem to get the profound dangers
associated
with including the wireless devices nist
sure did
and because nist chairs the technical
development
committee nist prepared the draft
standards
for the committee and in december of
2019
a nist official gave a presentation to
the committee
that starkly explained that these
devices create a
huge uh vulnerability in voting systems
um and that they should not be present
in voting machines um and then this
provided the draft standards
which included a ban on an explicit ban
on any devices capable of wireless
networking and voting machines
this draft was voted on by
the technical development committee and
passed on to the eac
at this point it seemed to be settled um
nist had given
its recommendations loudly and clearly
and the technical development committee
which is directed by law to provide the
standards to the ac had
endorsed that version the draft
standards were then published and put
out for public comment
eac and nist also suspended all the
public working groups because the work
had been done
the standards were then subject to
multiple public hearings and they were
also sent to the
eac standards and advisory boards
in the summer of 2020 last year as the
draft standards were going through these
public reviews the eac
let's slip on a call with the standards
board that it was meeting weekly
with the voting system vendors in a
working group to solicit the vendor's
comments on the standards
so the vendors had already been involved
in public working groups they provided
their own public comments but now there
was a special meeting
that was closed to the public that was
um uh not being
no minutes were being published no
documents or readouts were being made
available to the public but they
that was still going on um specifically
to solicit the vendors comments
um um and
remember that um that there were the
the public working group and they had
the opportunity and that was already
disbanded
so this meant that there was this new
private working group when i learned
this i immediately wrote to the ec and
asked to be added to the working group i
assumed it was maybe an extension of the
other public working groups
the ac wouldn't wouldn't even respond so
i put in a foia for all of the
documentation and communication between
the eac and the vendors regarding the
meetings to try and learn more about it
we waited for several months for the esd
to produce the documents and while we
were waiting
we started to hear rumors that the eac
was revising the standards
to allow wireless devices in voting
machines
provided they were disabled but that
could be disabled by software it didn't
require
physical disabling
now we know the vendors like to push the
wireless networking devices and
electronic transmission of electronic
results from polling places to county
headquarters but there are other factors
that were driving this there are vendors
that are building their systems
using entirely cots hardware and they
those vendors have insisted it would be
way too expensive to have to remove the
wireless devices
or any chips or radios or anything
additionally
including the wireless devices could
allow vendors to use them
to update machines at the same time if
they had to
put in a software update or or upgrade
it
rather than having to manually update
each individual machine
and so these are changes that we know
directly benefited the vendors
we wanted to head off this terrible
decision so
free speech for people enlisted a bunch
of
top computer scientists and election
security experts to send a letter
to the eac warning of the dangers of
permitting wireless devices
and in voting machines wireless
networking devices
not surprisingly the eac never responded
but they did respond to the news stories
by publishing a document that tried to
spin the changes as a mere clarification
um and that the draft was never intended
to actually
prohibit the presence of any wireless
capability
um this wasn't supported out by the
facts or the record
or even the eac's own statements to the
press before they decided to take this
tax so they took
one attack and then took another deck
on january 13th the eac held a meeting
of the board of advisors
which the members in which the members
repeatedly asked
about the new draft they wanted to see
it because they
knew that they were voting on uh it was
supposed to be coming up soon
um eac refused to provide it to them
even though they are the board of
advisors
put there by the help america vote act
on january 26
in 2021 the eac announced it would meet
on february 10th to vote on the new
voting system standards but they still
had not published
this what they were going to vote on we
still had no idea what
changes they had made if any you know
they really shouldn't be making any
the stage without it going through the
process again a public process
and a couple of days later on february
1st 2020
they published the revision to the draft
um
which had not been subject to any review
by the advisory boards to the public
the new version allowed wireless devices
provided they were disabled by software
it also gutted some robust requirements
that guaranteed
public access to any system submitted as
ede verifiable or
unverifiable there had been a very
robust provision to make sure
that if anyone tried to submit a system
as and unverifiable to
avoid the paper ballot requirement they
would have to
make the protocol available to the
public readily available
for an extended period of time for
anybody that wanted it
um completely got it um
no public review of and verifiable
systems any longer
um and there were some other pro vendor
changes like removing a provision to
prevent the vendors from advertising on
ballots
so now you can look at your ballots and
have a nice advertisement from es and s
or
heart inter civic or dominion um nine
days later
eac voted to accept the new standards
um and several weeks after that we had
free speech where people sued the eac
over the unfulfilled foyer request for
the communication with the vendors and
the private meetings
that was in march we sued after we sued
the esc began to produce the documents
and we found more details of the what
weekly meetings that esc was holding
with the vendors which documented
the regularity and some of the topics
that they were covering we still haven't
gotten the full production
a few months after that though we sued
again and this time we did it
under the federal administrative
procedures act the federal
advisory committees act and um
and the help america vote act and so we
used
uh we sued under those um acts and i'm
not a lawyer so i'm doing my best to
explain the administrative procedures
act requires certain
um documents to be made public to go to
the federal register
etc um as mentioned the public comment
period was
there were issues with public home
period um the federal advisory
committee's act requires that
any sort of um group that's formed like
the
working group with the vendors that that
needs to be made public um keeping that
private is a big no-no under federal law
um and the help america vote act which
requires that
um when the standards are modified they
need to go back through the same public
process and they did
substantially change them so they were a
modification and they should have gone
back through
the public comment period and um to the
eac
standards board and board of advisors um
our lead plaintiff is professor philip
stark many of whom you know philip is a
member of the esc's board of advisors
um so his rights as a member of the
board
were explicitly abrogated when the ac
did not
let him review the standards before they
were
published we are seeking relief to
reinstate the original provisions and
roll back these changes that were made
um so you can make your own judgment
maybe i i've given you a presented a
bias story here
but it seems evident to me that the eac
is an agency that is way too close to
the vendors it is supposed to be
regulating
and it went far out of its way to
dismiss the public
in favor of the vendors preferences on
this issue while pretty brazenly
flouting
the federal laws that would have
prevented the agency
from holding clandestine meetings with
the vendors and making substantial
changes to the
voting system guidelines secretly
outside of the legally mandated process
the lawsuits are currently pending
under the foia lawsuit the eac has begun
to produce the documents
um and we'll see if they continue to
comply
for the second suit that alleges
violations of federal law we have
um regarding the development of the
standards we have yet to see a response
so we'll have to see how they respond to
that
the bottom line is that despite all of
the public statements
um by the eac and others there
are wireless networking devices and
voting machines around the country
and that the new federal voting system
standards adopted by the eac
when they had the opportunity to ban
them all together the eac did
everything it could to subvert that um
it's pretty incredible and pretty
disappointing
i am happy to take any questions on the
discord channel
um you can read our complaints and
filings if you go to
www.freespeecherpeople.org
and look at legal actions um willie
lashon's
uh it's stark v eac and
free speech for people v-e-a-c um thank
you very much
and uh look forward to your questions
thank you thanks very much