9 ms·

DHS plans urgently needed to address identified challenges before 2020 elections [pdf]

64 points by infodocket 7y ago

howmayiannoyyou 7y ago
https://www.youtube.com/watch?v=TYVLH1tLIDY https://www.youtube.com/watch?v=TYVLH1tLIDY They should start with Rand Waltzman's presentation at DEFCON (link above). In sum, USGOV is still totally unprepared for information warfare ops ongoing and intended. About 1/2 through this video the content is the best I've ever watched from DEFCON, period.
- lflux 7y ago
  Holy shit, that's my college prof from KTH who taught us Intro CS
- oblib 7y ago
  That is a great video. Thank you for pointing me to it.
- rfmw19 7y ago
  Great video, thanks! I have one question: There's a part where Rand says he was asked to provide questions for the congressional Facebook hearing. He said he was shocked when his questions were not used and instead "stupid" questions were asked. I'm not sure if he meant this sarcastically or not, but isn't it clear, especially to someone like Rand being an expert in disinformation and related areas, that the questions were likely deliberately not asked? I'm not sure why he was shocked.
throwaway2048 7y ago
At this point, its pretty obvious that the inaction on the part of the senate on election security is 100% intentional.
- DiffEq 7y ago
  From Obama himself: https://youtu.be/cruh2p_Wh_4?t=5 https://youtu.be/cruh2p_Wh_4?t=5 https://youtu.be/qLe9CW_jSw4 https://youtu.be/qLe9CW_jSw4 https://youtu.be/mRZS-w36IvQ https://youtu.be/mRZS-w36IvQ
  - MeltySmelty 7y ago
    yea, because you can trust the guy who raided dispensaries and drone striked 24/7
- corporate_shi11 7y ago
  That's a naive conspiracy theory. More likely culprit is the fact that Congress is in general unable to act on complex issues.
  - throwaway2048 7y ago
    Not congress in plural, the republican held senate, and specifically Mitch McConnell blocking almost every bill.
alwaysanagenda 7y ago
It's pretty easy to "secure" the election. 1. Voter ID 2. Paper ballot electronically counted, paper stored as backup for any disputes or recounts. 3. No digital / computerized voting machines.
- minikites 7y ago
  Voter ID laws aren't about protecting elections, they're about disenfranchising voters: https://www.nytimes.com/2016/09/17/us/some-republicans-acknowledge-leveraging-voter-id-laws-for-political-gain.html https://www.nytimes.com/2016/09/17/us/some-republicans-ackno... https://www.theguardian.com/us-news/2019/dec/21/trump-adviser-republicans-voter-suppression https://www.theguardian.com/us-news/2019/dec/21/trump-advise...
  - 1000units 7y ago
    It's about keeping non-citizens who don't have the right to vote from voting. Not implementing these laws diminishes the enfranchised.
    - josefresco 7y ago
      Nope, just another form of Poll tax: https://en.wikipedia.org/wiki/Poll_taxes_in_the_United_States https://en.wikipedia.org/wiki/Poll_taxes_in_the_United_State...
      - 1000units 7y ago
        No, it isn't. However, let's assume it is. If you don't pay your (separate and presumably uncontroversial) federal taxes, you become a felon and legally disenfranchised. It becomes clear this is all a minor accounting detail.
    - wbronitsky 7y ago
      Do we have any evidence that non-citizens voting is an actual problem, or are you just spreading FUD? The GP has linked some well sourced articles about how voter ID laws have been used for primarily racist purposes in the US. Do you have any evidence that supports another narrative?
geogra4 7y ago
Paper and pencils please.
- jcrawfordor 7y ago
  The discussion over paper vs. electronic ballots tends to miss many of the largest issues in election security. DHS is correct in pointing out that we need a focus on the larger landscape of election support infrastructure. Notably, electronic pollbooks are a very important part of the voting system which cannot readily be replaced with a non-digital solution. Simply switching to paper ballots reduces the problem, but does not by any means eliminate it. Calls for paper ballots also tend to get muddled up in the realities of how ballots are counted. When paper ballots are used, they are virtually always still counted by computer using an OMR. A precinct tabulating solution, which is widely used in the US right now, simply moves the OMR from the central election office out into the polling place, and is broadly equivalent from a security perspective to what most people would call a "pure paper" solution except that the environmental exposure of the OMRs is higher because of their presence in field voting locations. However, security measures used to protect centralized OMR in jurisdictions without precinct tabulators are not necessarily any better than OMRs out in the field. In fact, precinct tabulators are generally built with significantly improved anti-tamper mechanisms compared to the older central tabulators. These measures aren't perfect of course, but it is a matter of tamper seals, cryptographic signatures, and audit tapes used by precinct tabulators as compared to absolutely no anti-tamper measures in many centralized tabulators used by jurisdictions with what many people would call "completely non-digital" voting. While it is possible to tally the ballots by hand without the assistance of OMR, and there are organizations which advocate for this, it is an extremely expensive proposal and it's actually fairly hard to argue that it is superior to a well operated OMR approach - even in the case of hand-tallying of ballots, audit recount should still be performed to ensure accuracy and integrity in the (recently recruited online, poorly paid, minimally trained, and very hurried) election officials.
  - sp332 7y ago
    An audit recount is at least possible with paper ballots. If digital records are modified, how are you going to audit them?
deleted 7y ago
[deleted]
_Understated_ 7y ago
Here in the UK we still use paper and pencils and while you can still mess with individual votes it isn't something that scales... not like running a DB query: UPDATE tbl_Vote SET Candidate = [The one that paid us the most] WHERE State = [State Name]
maximente 7y ago
when viewed from a sludge-money lens (a la the F35) electronic voting and election security seem largely working as intended: - we know paper works (Canada/UK) so there must be an ulterior motive for pushing on tech solution so hard - money gets sent to various entities under the guise of tech, security, freedom, etc. (contracts for voting machines, contracts for software, etc.). this basically gives some limited air cover for transfer of funds to entities - it nicely feeds into itself: defensive work always needs to keep up with (real or imagined) offensive threats so basically unlimited amounts can be spent without too much eye rolling - it is basically a get out of jail free card for both political parties in the future: "elections were hacked" is bipartisan and can be a useful tool to defeat/deny access to popular party outsiders on both parties, as opposed to a genuine candidate blowing up the system (Sanders?) - any foreign entity can be conveniently used if e.g. need to get a quick war going to distract the plebs from, say, medical parasitism or offshoring jobs
- ctoth 7y ago
  Posiwid thinking. The purpose of a system is what it does.
- claudeganon 7y ago
  Judging from Iowa, I imagine that some primary Sanders wins will claim to have been hacked by Russians. Democratic Party operatives were already doing false flag “Kremlin” stuff during the Doug Jones race in Alabama: https://thegrayzone.com/2019/01/23/how-new-york-times-scott-shane-covered-for-architects-of-a-shocking-false-flag-elections-campaign-in-alabama/ https://thegrayzone.com/2019/01/23/how-new-york-times-scott-...
  - deleted 7y ago
    [deleted]
- syshum 7y ago
  >>- we know paper works (Canada/UK) so there must be an ulterior motive for pushing on tech solution so hard Works sure, efficient no, and largely one of the reason for low participation rates (though far from the only) That said none of the "tech" solutions that simply replace paper ballots at a polling place with a Touch Screen at a polling place would be what I desire from a "tech" solution to voting The rest of your points are largely true, though on the money never discount the power of incompetence when it comes to government, they way government contracts are "awarded" attracts the most incompetent people in any industry for if they were competent they would not need government contracts as the old saying goes... If you can... do If you cant.. Teach If you cant teach... Work for the government
ZeroCool2u 7y ago
Interesting that the DHS response to all 3 points is that they concur, but for all 3 points the resolution the Department points to is a document called the #Protect2020 Strategic Plan, which will supposedly be released on Feb 14th. Is that actually enough time for the guidance within to be implemented?
ryanmarsh 7y ago
Simple question, are electronic voting systems required to be FedRamp certified? If not why not?
- advisedwang 7y ago
  They are not. For one thing elections are run at the state level.
- jcrawfordor 7y ago
  Elections are managed by the states and, in some states, almost all aspects are deferred to the counties. There is currently no standardized framework for elections system security on a national level and it is difficult to implement one for political reasons. DHS has moved in the direction of producing guidance, but it is my hope that a mandatory framework can be introduced.
beepboopbeep 7y ago
There is every incentive in the world to do whatever one wants to our elections right now. It's a free-for-all of bad, patchwork technologies, zero oversight, and a political establishment that is openly encouraging nation state interference. I am deathly afraid for our elections this year.

64 points by infodocket 7y ago

https://www.youtube.com/watch?v=TYVLH1tLIDY https://www.youtube.com/watch?v=TYVLH1tLIDY They should start with Rand Waltzman's presentation at DEFCON (link above). In sum, USGOV is still totally unprepared for information warfare ops ongoing and intended. About 1/2 through this video the content is the best I've ever watched from DEFCON, period.

lflux 7y ago
Holy shit, that's my college prof from KTH who taught us Intro CS
oblib 7y ago
That is a great video. Thank you for pointing me to it.
rfmw19 7y ago
Great video, thanks! I have one question: There's a part where Rand says he was asked to provide questions for the congressional Facebook hearing. He said he was shocked when his questions were not used and instead "stupid" questions were asked. I'm not sure if he meant this sarcastically or not, but isn't it clear, especially to someone like Rand being an expert in disinformation and related areas, that the questions were likely deliberately not asked? I'm not sure why he was shocked.

throwaway2048 7y ago

At this point, its pretty obvious that the inaction on the part of the senate on election security is 100% intentional.

DiffEq 7y ago
From Obama himself: https://youtu.be/cruh2p_Wh_4?t=5 https://youtu.be/cruh2p_Wh_4?t=5 https://youtu.be/qLe9CW_jSw4 https://youtu.be/qLe9CW_jSw4 https://youtu.be/mRZS-w36IvQ https://youtu.be/mRZS-w36IvQ
- MeltySmelty 7y ago
  yea, because you can trust the guy who raided dispensaries and drone striked 24/7
corporate_shi11 7y ago
That's a naive conspiracy theory. More likely culprit is the fact that Congress is in general unable to act on complex issues.
- throwaway2048 7y ago
  Not congress in plural, the republican held senate, and specifically Mitch McConnell blocking almost every bill.

alwaysanagenda 7y ago

It's pretty easy to "secure" the election. 1. Voter ID 2. Paper ballot electronically counted, paper stored as backup for any disputes or recounts. 3. No digital / computerized voting machines.

minikites 7y ago
Voter ID laws aren't about protecting elections, they're about disenfranchising voters: https://www.nytimes.com/2016/09/17/us/some-republicans-acknowledge-leveraging-voter-id-laws-for-political-gain.html https://www.nytimes.com/2016/09/17/us/some-republicans-ackno... https://www.theguardian.com/us-news/2019/dec/21/trump-adviser-republicans-voter-suppression https://www.theguardian.com/us-news/2019/dec/21/trump-advise...
- 1000units 7y ago
  It's about keeping non-citizens who don't have the right to vote from voting. Not implementing these laws diminishes the enfranchised.
  - josefresco 7y ago
    Nope, just another form of Poll tax: https://en.wikipedia.org/wiki/Poll_taxes_in_the_United_States https://en.wikipedia.org/wiki/Poll_taxes_in_the_United_State...
    - 1000units 7y ago
      No, it isn't. However, let's assume it is. If you don't pay your (separate and presumably uncontroversial) federal taxes, you become a felon and legally disenfranchised. It becomes clear this is all a minor accounting detail.
  - wbronitsky 7y ago
    Do we have any evidence that non-citizens voting is an actual problem, or are you just spreading FUD? The GP has linked some well sourced articles about how voter ID laws have been used for primarily racist purposes in the US. Do you have any evidence that supports another narrative?

geogra4 7y ago

Paper and pencils please.

jcrawfordor 7y ago
The discussion over paper vs. electronic ballots tends to miss many of the largest issues in election security. DHS is correct in pointing out that we need a focus on the larger landscape of election support infrastructure. Notably, electronic pollbooks are a very important part of the voting system which cannot readily be replaced with a non-digital solution. Simply switching to paper ballots reduces the problem, but does not by any means eliminate it. Calls for paper ballots also tend to get muddled up in the realities of how ballots are counted. When paper ballots are used, they are virtually always still counted by computer using an OMR. A precinct tabulating solution, which is widely used in the US right now, simply moves the OMR from the central election office out into the polling place, and is broadly equivalent from a security perspective to what most people would call a "pure paper" solution except that the environmental exposure of the OMRs is higher because of their presence in field voting locations. However, security measures used to protect centralized OMR in jurisdictions without precinct tabulators are not necessarily any better than OMRs out in the field. In fact, precinct tabulators are generally built with significantly improved anti-tamper mechanisms compared to the older central tabulators. These measures aren't perfect of course, but it is a matter of tamper seals, cryptographic signatures, and audit tapes used by precinct tabulators as compared to absolutely no anti-tamper measures in many centralized tabulators used by jurisdictions with what many people would call "completely non-digital" voting. While it is possible to tally the ballots by hand without the assistance of OMR, and there are organizations which advocate for this, it is an extremely expensive proposal and it's actually fairly hard to argue that it is superior to a well operated OMR approach - even in the case of hand-tallying of ballots, audit recount should still be performed to ensure accuracy and integrity in the (recently recruited online, poorly paid, minimally trained, and very hurried) election officials.
- sp332 7y ago
  An audit recount is at least possible with paper ballots. If digital records are modified, how are you going to audit them?

deleted 7y ago

[deleted]

_Understated_ 7y ago

Here in the UK we still use paper and pencils and while you can still mess with individual votes it isn't something that scales... not like running a DB query: UPDATE tbl_Vote SET Candidate = [The one that paid us the most] WHERE State = [State Name]

maximente 7y ago

when viewed from a sludge-money lens (a la the F35) electronic voting and election security seem largely working as intended: - we know paper works (Canada/UK) so there must be an ulterior motive for pushing on tech solution so hard - money gets sent to various entities under the guise of tech, security, freedom, etc. (contracts for voting machines, contracts for software, etc.). this basically gives some limited air cover for transfer of funds to entities - it nicely feeds into itself: defensive work always needs to keep up with (real or imagined) offensive threats so basically unlimited amounts can be spent without too much eye rolling - it is basically a get out of jail free card for both political parties in the future: "elections were hacked" is bipartisan and can be a useful tool to defeat/deny access to popular party outsiders on both parties, as opposed to a genuine candidate blowing up the system (Sanders?) - any foreign entity can be conveniently used if e.g. need to get a quick war going to distract the plebs from, say, medical parasitism or offshoring jobs

ctoth 7y ago
Posiwid thinking. The purpose of a system is what it does.
claudeganon 7y ago
Judging from Iowa, I imagine that some primary Sanders wins will claim to have been hacked by Russians. Democratic Party operatives were already doing false flag “Kremlin” stuff during the Doug Jones race in Alabama: https://thegrayzone.com/2019/01/23/how-new-york-times-scott-shane-covered-for-architects-of-a-shocking-false-flag-elections-campaign-in-alabama/ https://thegrayzone.com/2019/01/23/how-new-york-times-scott-...
- deleted 7y ago
  [deleted]
syshum 7y ago
>>- we know paper works (Canada/UK) so there must be an ulterior motive for pushing on tech solution so hard Works sure, efficient no, and largely one of the reason for low participation rates (though far from the only) That said none of the "tech" solutions that simply replace paper ballots at a polling place with a Touch Screen at a polling place would be what I desire from a "tech" solution to voting The rest of your points are largely true, though on the money never discount the power of incompetence when it comes to government, they way government contracts are "awarded" attracts the most incompetent people in any industry for if they were competent they would not need government contracts as the old saying goes... If you can... do If you cant.. Teach If you cant teach... Work for the government

ZeroCool2u 7y ago

Interesting that the DHS response to all 3 points is that they concur, but for all 3 points the resolution the Department points to is a document called the #Protect2020 Strategic Plan, which will supposedly be released on Feb 14th. Is that actually enough time for the guidance within to be implemented?

ryanmarsh 7y ago

Simple question, are electronic voting systems required to be FedRamp certified? If not why not?

advisedwang 7y ago
They are not. For one thing elections are run at the state level.
jcrawfordor 7y ago
Elections are managed by the states and, in some states, almost all aspects are deferred to the counties. There is currently no standardized framework for elections system security on a national level and it is difficult to implement one for political reasons. DHS has moved in the direction of producing guidance, but it is my hope that a mandatory framework can be introduced.

beepboopbeep 7y ago

There is every incentive in the world to do whatever one wants to our elections right now. It's a free-for-all of bad, patchwork technologies, zero oversight, and a political establishment that is openly encouraging nation state interference. I am deathly afraid for our elections this year.