Gula Tech Cyber Fiction - Episode #2 - Ben Adida

gtcf-2-ben-2

In our second episode, Ron interviews Ben Adida, founder of voting.works, about their role in helping secure the 2020 US election and all of the different types of controls in place to prevent voting fraud.











Episode #2 Transcript



Ron Gula: [00:00:00] Hi there. This is Ron Gula with episode two of the Gula Tech Cyber Fiction podcast. Today we have a guest, uh, Ben Adida from voting.works and we're going to get into some actual fiction of cyber with voting election.
But before that we're recording today, December 22nd, this is the second week of the Solar Winds and FireEye hacks. And some of the Gula tech portfolio companies are here to help. Of course, Tenable can help you with all of your cyber hygiene and trying to figure out what's exposed out there. Scythe can actually help you simulate a nation state hackers and see how well you are.
At detecting these things. And finally, Secure Circle actually has a desktop encryption solution that can help your coders, uh, protect their source code and actually probably protect the actual, uh, attack vector that was used in, in solar winds. So I'm sure there's more to that story. That's going to be jump.
Remember if you're not hunting, you're probably not going to find these types of people. All right today, we're going to talk about a lot of the news and sort of, uh, misconceptions and maybe misreported news that happened during the election. Uh, today we've got Ben Adida. The founder of voting.works with us.
Ben, how are you doing today?
Ben Adida: [00:01:13] I'm doing really well, Ron. Thanks for having me on the podcast
Ron Gula: [00:01:16] and thank you very much for your work and protecting democracy in this last election cycle here. Can you tell us a little bit about voting.works, how you got involved with it? How big the organization is.
Ben Adida: [00:01:26] Yeah. So we are, uh, the only non-profits, uh, election technology vendor in the United States.
We are two years old. We are 13 people and we, uh, we do two major things. One, we produce open source, affordable, secure voting equipment for voters to prepare and cast a ballot, both the kind that is. Marked with the assistance of a computer and the kind that you Mark with a pen, uh, and the scanners to process those.
So that's one thing we do voting equipment. And the other thing we do is, uh, auditing of vote tabulation. You may have heard the term risk limiting audit. That's a kind of auditing mechanism that's performed on, uh, the tabulation process. And we have open source software called Arlo - A R L O. It doesn't stand for anything.
It's just a fun, little phonetic twist on RLA and it's a friendly name and it's the only open source piece of software you can use. It's actually the only piece of software period you can use to run a statewide risk-limiting audit. And that's the second pillar of what we do at voting.works. So voting equipment and tabulation audits are the two big things we do.
Ron Gula: [00:02:43] And this year with the COVID epidemic, you really had to pivot from the in-person voting machines to doing more of the paper ballot. What was, what was that like? And what were some of the issues at the States that they had to struggle?
Ben Adida: [00:02:54] Yeah. So there's two big things that we were thinking about in 2020 that, uh, we, we focused on one, as you mentioned, there was a move from in-person voting to, uh, well, there was a move from it.
Election day in person voting to two things early in person voting and vote by mail. And so we did some work to help on that front, specifically in the state of Mississippi, which is the first day where we've been helping with voting equipment voting equipment takes a long time to build and certify and, uh, sell to States.
Mississippi is the place where we started as an organization because it's a state that has a great need. There's a number of counties in Mississippi that. Have equipment that's more than 20 years old. And so we started there as a, as a place to, to make sure our equipment works even in, um, the most rural counties.
And, uh, we were able to help an eight counties in Mississippi this year. The second part of what we focused on 2020 was less focused on COVID and more focused on just how. I would say how polarized we've become as a country. And we knew that auditing and building confidence in the outcome of the election this year was going to be pretty important.
I don't think we predicted just how important it would be. Uh, it did, it did get, and to some degree it's still going, it's still actively an issue right now of how much people are trusting the outcome of the election. And so we focused a lot on auditing and we are. We're we're excited to have been able to help in a number of key audits this year in particular, the one in Georgia after the general election, where our team on the ground and our software was used to run the full hand count audit, um, in the two weeks that followed the general electric.
Ron Gula: [00:04:39] So let's, let's talk about that for a, uh, for a minute here.
Ben Adida: [00:04:43] You
Ron Gula: [00:04:44] actually, I mean, there's so many people who, who helped. I mean, obviously Chris Krebs has been, you know, a really, really good example of
Ben Adida: [00:04:51] how, you
Ron Gula: [00:04:52] know, talking about this can, can be a very polarizing type of thing, but you were actually involved with the actual collection of votes, the actual auditing of those votes. So how
do you feel when somebody says, Oh my God, the election was hacked or it was rigged or there was so much fraud. How does, what's your emotional response ?
Ben Adida: [00:05:08] to that? You know, the first thing I want to clarify right before I get into that, we are very careful at voting.works that when an election is happening, we let the election officials and the administrators handle the ballots.
We are there to provide support and the tools, but we try very hard to not touch ballots. It's, you know, we are not elected officials. We are not representatives of the County. So we help with a lot of support and software and we might even guide them and point them. This is how you audit, but we try to keep our hands off the ballots as much as possible.
Uh, now how do I feel. This is a really important question. I have, I have two big thoughts that come to mind. One based on the facts and everything that we've seen. It's. Just incorrect to say that this election, this year was hacked or that there was massive fraud. There's always some amount of fraud by the way, every election, when you run a process with, you know, 200 million eligible voters and, you know, 155 or 156 million votes cast this year, it's, there's going to be some amount of fraud.
Historically. There's never been a significant amount of fraud that actually swings the outcome of an election. Right. In any recent history and you know, that, that, uh, that we've seen. And this year, I would say it was the opposite. We're just not the opposite of, of the, as in like, there was even less, there was even less concern this year.
Uh, even though there was so much change, I mean, you have to take a step back and realize that elections, election technology, election methods, they don't change that quickly. Right? Usually you go from one election to the next four years later. If you're thinking about just the presidential elections and you might see an evolution of like a few percentage points in vote by mail, right.
For example, but COVID accelerated so much change this year and you could have reasonably expected things to go very poorly just because of the amount of change. Not because of any evil intent, just that much change. The system is hard to, um, hard to process and hard to work with. Uh, but we didn't, we saw instead is election officials working unbelievable hours, people at the local level, from both parties, I should say, from all parties, but from both major parties, uh, people at CC, as you mentioned, Chris Krebs, uh, Matt Masterson, a whole number of other folks who really worked incredibly hard to train election officials in, in various ways to respond to issues, prepare them for the increase in vote by mail.
Also, if you remember at the very beginning, there was this common refrain that, Oh my goodness, everyone's going to vote by mail. And then the experience folks were saying, hold on, we're going to see an increase in vote by mail, but you still have to be ready for voting in person and voting early because it's not like everybody's going to switch.
This is going to move that way. So we saw an incredible amount of work and incredible amount of preparation. And I think just. Uh, an amazing outcome in terms, and I don't mean the result of the election. I simply mean in terms of how the election was run. Right. That's the, that's the first thing I think, just on the facts, I don't think there's any evidence to show that there was significant fraud that folks should be concerned about at the same time.
The second thought I have is if people don't trust the outcome of the election, that's an inherent problem. And. Some of it. We can blame on disinformation, some of which is coming out of the white house, unfortunately, but we can't only blame it on that. I think we also have to blame it on an industry. The voting industry that I think has been shockingly non-transparent about the way it operates about the way the systems, the machines operate about the source code that runs on these machines.
I'm not worried that it's going badly. But in democracy, you need transparency. And I don't think we have nearly enough. And I think that's playing a role in the way. Some people distrust the outcome of the election.
Ron Gula: [00:08:59] Yeah. And I, I apologize to Ben before we started this, because I don't want him to have to single handedly defend.
You know the results of the election or what not, but you're right in the middle of it more than most, because so many folks in cybersecurity just instantly became election experts overnight, but you've actually been working on this and care deeply about it. So looking forward, so let's go through the basics part of an election and let's do this from the point of view of, to build trust with people.
So let's start with paper ballots. We hear all the stories about, you know, dead people voting or people xeroxing or millions of ballots coming in, in a truck for that. So how does paper ballots, what kind of mechanisms exist to prevent fraud with paper ballots?
Ben Adida: [00:09:40] So the first thing you have to understand about paper ballots is how much fraud they prevent.
And then we can talk about how we buy by the nature of paper ballots. Then let's talk about how you protect them, right? So consider a world without paper ballots, which is what many States had in the early two thousands. When we had touchscreen voting machines that just kept a memory record of how you voted, um, We've had instances around the world of things like bits being flipped on a memory card and totals changing without any trace, right?
There's the world where we don't have paper. Ballots is one where a simple mistake of code or a corruption of a memory card or anything like that could change the outcome by thousands and thousands of votes, sometimes tens of thousands of votes. And no one would know the difference unless that. That change is so egregious that, you know, the numbers just don't look right at the end of the day.
And so, you know, in a world where you have States like Georgia, that where the margin was less than 0.3%, you know, these things, if Georgia had had non-paper ballot and like non-paper ballot voting machines this year, that would have been incredibly hard to cope with. Right. So. The first thing to realize about paper ballots is they make scalable fraud much, much harder, because if you want to attack the system, you now have to change thousands of thousands of pieces of paper, right?
Because ultimately you're going to go back to the paper or you're going to audit, you're going to recount that kind of stuff. So the first thing to realize about paper ballots is how much safety they bring. Now, the second question you asked is about, you know, what kind of safeguards do you have around these paper ballots?
There's two ways to think about it. One is voting in person and two is voting by mail there's parallels between those two, but the mechanisms we use to protect the ballots before they get into ballot boxes are a little bit different. It all comes down really to authenticating the voter, right? How do you know that this person is allowed to vote?
How do you know that this person hasn't already voted? Right? And then once they vote, how do you make sure that you record it so that you know, they can't vote again? Okay. When you vote in person, you know how that's done. Usually you show up you, depending on the state, you give your name and address.
Sometimes you have to show ID in some States you don't. Um, by the way, the record of voter fraud based on impersonation is also extremely, extremely low. It's just usually that's handled by a penalty being so high that nobody would be so stupid as to try this, right, because for one vote you might go to jail for a number of years.
It's just not worth the trade-off. Right. So. But you have that authentication or you show up, you give some information, you're checked on the list as eligible as not having already voted and then you're checked off. So you can't vote again. Uh, and then there's this moment where you're given a ballot and then you drop it in the box.
And at that moment, you're checked off the list and your ballot goes into a box and we dissociate the ballot from you. And then we keep the ballot box secure. And we send it off to be counted sometimes at the precinct sometimes later at the County, there's an important reconciliation that happens in every election, which is you count how many people have checked in and you count how many ballots you got, and those should match.
It's very common for those numbers to be off by a little bit, because. People make mistakes, right? So you might forget to check a person off or about a voter, might walk away with a ballot and not put it in the ballot box. Right. Um, Those things happen, but usually those numbers are quite close together and in a lot of precincts there they're identical.
Ron Gula: [00:13:19] Right. And, and usually in these appreciates there's people from multiple parties making this decision aren't there.
Ben Adida: [00:13:24] Yeah, absolutely. Right. So it w it's, uh, in some places people are affiliated as poll workers and some certainly there are affiliated poll Watchers who can watch and make sure things are going well.
But most importantly, in precincts, you can't do anything. As a single individual, right. There have to be multiple people involved. There's also a log book that's kept. So if anything weird happens, uh, it's written in the log. I can tell you a funny anecdote. I was a, um, I was a precinct captain in, uh, my precinct in California in the election of 2008.
I did a number of stints as a poll worker and precinct captain before I had little kids. Having little kids is not, it makes it hard to have a 20 hour day. Um, but if you have the chance to be a poll worker, I strongly recommend it. It's just an amazing experience to watch democracy in action. So. In 2008, California had just moved to start to move away from their, uh, electronic voting machines and back to paper, but not every precinct had good ballot boxes yet.
So we had a cardboard box, a cardboard box was our ballot box. Right. And it was sealed and it was taped together, but it was still kind of fragile. And as the precinct captain 2008, that was the election of Barack Obama. We were expecting. Pretty high turnout. And indeed there was very high turnout. So the instruction was every now and then you got to shake the ballot box to make sure the bounce get like stacked, you know, kind of settled.
So there's room because we're expecting a big turnout. Um, and so what I did, I was responsible for doing this and I took the ballot box and I shook it, but I grabbed it by the slot. And when I shook the ballot box, it tore open. Right? So here I am precinct captain you're
Ron Gula: [00:15:07] you're subverting the election, obviously.
Ben Adida: [00:15:09] Yeah, clearly, clearly. Right. So I get really worried about this. Like what am I going to do? And just to give you a sense of what happens in that situation. It's actually pretty straightforward. I called over three other people that were working in the precinct. I said, I would like all of you to watch this ballot box, I'm going to go get the log book.
I went to get the log book I wrote in the log book. This is what happened. We all signed it. We all said like we, to the best of our understanding, like no bowels have been lost. I called the center and they brought me a new ballot box and we were able to. Uh, to transfer them with, again, multiple people watching.
So in the moment it felt like disaster, right? It felt like I had completely screwed up that precinct. But then when you think about the process of there's multiple people watching, we have a log book that we can go back to. We've all signed it. We've notified the, the, you know, the, the County they knew about it.
It tends to work out right now. Vote by mail, obviously vote by mail. Authentication is different, right. And. The most important thing to know about vote by mail in some States you're automatically you get a vote by mail ballot by default, right? That was the case in California. This year. That's been the case in Colorado and Oregon and Washington state for a little bit longer authentication of the voter is usually done by a voter signature, right?
So you put your ballot in an envelope, you sign, right. And there is vote by mail. There is in vote by mail, just like voting in person. There is this moment where your vote is secret. But you are authenticated as a voter and then a separation of identity from the vote so that your vote can become anonymous.
Right? And so when the envelope gets to the County, they check and they say, Ben Adida - has this person already voted? Cause it says that on the go envelope, right? It says my name. And they check the signature and the signature should match. And if it doesn't match, they might give me a call or text me and say, Hey, we have a problem because it happens all the time.
People's signatures evolve over time. They change over time. We don't want people to lose their right to vote, but we also want to make sure that it's the right person voting. So there's usually a cure process after that. But the point being your envelope is checked. You're checked off the list and. Um, your signature must match and only then is the envelope opened the ballot extracted and put in a pile for scanning and counting.
That is the equivalent of dropping your ballot in the ballot box. When you are at the precinct, right? That moment where your identity and the ballot gets separated. And now we have to keep a certain chain of custody around that set of ballots, because now there's no identity tied to them anymore. Right.
And yeah, that has to be done carefully. The, usually in a lot of States that are experienced with it, they have a 24 seven video feed of what's going on there so that if there are any shenanigans there, they're visible and you still have the count of ballots that you can compare. How many ballots came in, how many ballots are being counted.
So, um, I think it's reasonable to ask questions around are voter signatures a good enough way to authenticate voters. Both for good and bad reasons, meaning you're going to quit somebody fake somebody's signature. They could, if they know what that signature looks like, probably fake it, not a very scalable attack, but they could, um, uh, they'd also be committing the same felony as if they came in and impersonated somebody else.
Um, also you have to be worried about the fact that some voters, some votes might be ejected. Without, uh, I mean, there's a reason for it, but those people would be disenfranchised. Like those are valid votes, it's just their signature didn't quite match. So I think it's good to question that and see if we can do better over time than signatures.
It's also hard to think about it. That ventilation mechanism that's going to work for everybody, right? Like how you can't expect everybody to have a smartphone. You can't expect everybody to have some special code. They registered ahead of time. So it's a good question to ask. And it's a hard question to answer.
So
Ron Gula: [00:18:59] that's excellent. So on the, when, when the votes are being counted, when the ballots are being counted and there's a discrepancy, like a lot of people were worried about a theft. You know, we had a couple of stories about postal workers throwing out entire batches of ballots. Um, you know, all at once, but like here in Maryland, you know, I got an email that says, Hey, we got your vote.
You know, which means that I know that they got my
Ben Adida: [00:19:22] vote.
Ron Gula: [00:19:22] It didn't, it wasn't lost. That's kind of cool. I was kind of hoping, they told me how I voted. That would have been kind of interesting. That's a whole different level though, stuff. So like, is there, that's part of the audit, right when they're done and the votes are counted, they're like, Hey, we send out a million ballots, we got 999, 9,001.
That's probably good enough. Right? I mean, it's that margin of error where, where humans make mistakes, but there's not these huge swings in the numbers, but
Ben Adida: [00:19:46] I think it's worth being clear that if. It's hard. You know, there are discrepancies between the number of bouts being sent out and the number of bouts being returned.
And by that, I mean, there are fewer bouts return than bouts being
Ron Gula: [00:19:56] said, not everybody votes, right.
Ben Adida: [00:19:57] Not everybody votes. Right. And so, um, you know, if, uh, if a whole, but it has happened in the past that whole batches of ballots have been misplaced by a post office. Uh, and didn't get there in time or didn't get there at all.
And so. We have to be aware of these possible issues that could occur. Right. There is no voting method. That's perfect. The question is, is this a reasonable attack that would get noticed, right? W what would the attack beat? Well, I'm going to target a Republican County, particularly Republican district, and I'm going to.
I don't know, not deliver their mail. I suppose that's an attack you could carry out. You would probably see that in the data. You'd probably see like, wait, why is participation in this district lower than it's been? Or why do we have all these people claiming they voted when you know that? Because at the end of the day, you could check the way my vote received and the tracking you talk about in Maryland, which exists in more and more States that is extremely useful, right?
That's extremely, and it's, it's more and more widespread. Where using intelligent barcodes that the USBs provides, you can find out, Oh, my ballot is in, transit on my ballot was received and then the County can tell you, and we received the two right then. So whether you're using ballot tracks or ballot scout, uh, there's a number of solutions out there that States are using for tracking ballots.
I think they're incredibly important and I would encourage every state to have them because they can get ahead of these potential issues where. Most likely not for malicious reasons, but just because an error was committed, you could have, you know, a few hundred ballots that get lost in some, uh, in some, uh, postal office someplace.
And it would be good to know. Right. And to figure that out. There's also some States that allow you, if your ballot has not been received by election day, they allow you to override your vote and come in and vote in person. I also think that's a good idea. You want to be, you want to have resiliency in the process, right?
So ideally if you're voting by mail and come election day, you still haven't gotten the confirmation. Then you can at least go vote in person and override, you know, say, okay, you didn't get my ballot. So let me vote now and make sure my vote is counted. The way elections become secure. It's not by having one magical solution.
It's by making every step of the way as resilient as possible. Right. Having fallbacks, having opportunities to recover, having audits, that kind of stuff.
Ron Gula: [00:22:17] So the next step in the process is to count all this stuff and figure out who won. So, so now that you have all the ballots, whether I was there in person, And, and you had another thing, like I could be present, but absent, right.
In some States where they use of out-of-town ballots to vote in person because of this COVID process, which I thought was funny, but regarding,
Ben Adida: [00:22:35] yeah. And some States they call, they, they have, they have what they have, what's called in-person absentee, which is, uh, what other States would call early voting.
But for traditional, their tradition is to call it in-person absentee. Yeah. Excellent.
Ron Gula: [00:22:47] So, so now it's time to count the votes.
Ben Adida: [00:22:48] Yeah. So,
Ron Gula: [00:22:49] you know, we kind of talked about how the paper trail avoids, maybe the in-person voting, uh, you know, tampering being done there, but what about as you pass these ballots from the County and even at the state level Capitol, how do we prevent, you know, hacking and changing of the numbers both?
Ben Adida: [00:23:08] Um, maybe in real
Ron Gula: [00:23:10] time, cause it's still useful to, you know, talk about election results in real time on the none of the election. Uh, but also just, just to be absolutely. Yeah.
Ben Adida: [00:23:18] So there's two, two big things that I think are important to consider here in terms of how we secure the ballot custody process.
Right? This is really about a ballot custody process, making sure that the batches of ballots. Remain intact along the way. The first defense against this is how distributed our elections are. Bouncer counted by counties. In some States they're actually counted by townships, but most States it's by counties.
So think about Georgia, right? Georgia is a state that was in the public eye a lot this year and will still be with the runoff in a few days. Um, 159 counties. That means 159 offices where ballots are counted, uh, for the bouts for that County. So the bowels don't go very far, right. They traveled from the precinct to the County and they stay at the County and they never leave the County.
Right. If there's a recount, if there's any other process it's happening at the County level, that's what makes it complicated. By the way, when you do a recount, you have to coordinate 159 different counties. So, and then what does each County do? They have. And the more experience they have, the better they get at this.
Right. But George was one state that ramp this up extremely quickly and extremely well, I would say in the last couple of years, because they didn't have paper bouts two years ago in Georgia. They just implemented them last year. So they have a process for when a batch of ballots comes in from a precinct it's in a box it's sealed.
It has a sheet on it that tells you how many ballots to expect. And anytime you handle that, Batch of ballots. You're going to break open the seal, record that, and then you're going to have to reseal it afterwards, right. And record the data before and after. So at that point, it is fairly tried and true processes for maintaining chain of custody, of physical evidence.
Right. You can think of all, all the proceeds we have, whether it's police evidence, whether it's, you know, just confidential documents, it's just a process that involves sealed boxes. Recording. Everything that happens, logging everything that happens and making sure that it matches with the original list of voters.
Um, the number of voters who have cast votes, right? So this kind of reconciliation is, is what really saves us. And then the last part of course, is the tabulation, which is maybe where you were going to write the actual counting of the votes themselves. Exactly. Yeah. So that is the part where it is absolutely worth.
Having some amount of skepticism, right? We take all these paper ballots, they were verified. They may have been marked directly by the voter, or they were printed by about marketing device. But the voter looked at that, looked at the paper and you take all that paper and you put it through a scanner. And then the scanner tells you who won right now?
We need scanners in the U S because our ballots are really complex, 20 - 30 questions on the ballot. Counting that by hand is going to be super slow and super error prone. Humans are actually really bad at counting repetitively, right? There's also an actually a really important aspect to it, which is the objectivity of the scanner.
If you tell the scanner how to count a bubble, it's going to count it the same way every time, whether that bubble is next to Biden or Trump, right. Because it's a computer. Whereas if it's a human looking at it, We're all biased. We all have our political preferences, right? We've if the check Mark is not quite right, then, you know, if it's a little ambiguous, are we going to count it objectively the scanners, our computers.
So they will do things as objectively as we can possibly make them. Right. But there are still some edge cases where the computer can't really figure it out where human could figure it out. Think about somebody fills in a bubble and goes, Oh, wait, that's not what I wanted. Then they cross out the name.
Then they fill in the other bubble. Well, what does the computer see? The computer sees just to filled in bubbles? Right? So a number of ballots have to be adjudicated by humans, right by people. They get kicked out of the automatic counting process, adjudicated by humans. And that process needs oversight.
It needs to have multiple people looking at it. It needs to have a record of the fact that a ballot was adjudicated. And that's what, that's what happened in Georgia. That's what happens in all these other States. There's a funny part to it, which is. The term of art that's used is a duplicate ballot. So when you have a ballot that has this kind of overload situation, you, the election office will create a second ballot.
That will be linked by number two, the first one and say, this is how the humans interpreted this ballot, but they'll call that one, a duplicate ballot, which I think is really confusing because it sounds like you're cheating, right? It sounds like you're copying the ballot. Right? Um, I wish we had a different term, but if you hear a duplicate ballot, that's what this, that's where this comes from.
Um, But then you still have to trust the scanner. The scanner is adding all, all these votes. How do you know it's doing the right thing? I'm telling you, it's fast. I'm telling you it's objective, but what if the Russians hacked it? Right? What if the Chinese hacked it, then what? Right. It gives a different number and that's where risk limiting audits come in.
And I'm happy to tell you more, but the two sentence version of risk limiting audits is it's a fast and efficient way by looking at a small sample of the ballots to check. That if you did a full hand count, you would get the same winner. That's the core, core idea of the risks coming on it.
Ron Gula: [00:28:29] So rapid fire questions here. So can I, uh, when no one's looking, can I take a ballot and just rescan it three times? Cause I saw that it was voted for Trump, but I want to get more Trump votes.
Ben Adida: [00:28:40] Yes, you can do that. You'd have to be pretty sneaky about that. What will happen if you do that? Is that the total number of ballots will not match.
The T the piece of the number of paper and piece of paper. And then that will probably lead, uh, that batch to be rescanned right. So you can do it, but you probably won't get away with it.
Ron Gula: [00:28:58] So, same thing, I hack the system and I say, I want every third vote, no matter what it's for, it's going to be for Trump or maybe, you know, 5% I'm gonna, I'm gonna move it up. But you have the software and software on the scanner.
Ben Adida: [00:29:11] Yeah. So, uh, to get away with it, you would have to do it in a way that during the logic and accuracy testing, which happens before the election, your code is turned off. So maybe your code is like, I'm not going to, I'm only going to be active between like 5:00 PM and 12:00 PM on election day.
Right. So you'd have to be careful about that. And if you did that and there was no audit, you would get away with it. Uh, you probably would have to be a little more subtle than once every three votes, because that would change the numbers quite a bit. But if you did it like two or 3% of the time, you might get away with it until there's an audit, because then the audit will check and make sure by hand that the counts are okay.
And it's specifically a risk limiting audit. We'll look at a sample of the ballots, uh, and statistically give you high confidence that the scanner did the right thing. Job, uh, the tighter, the margin, the more bouts you have to look at, but that is the point where this kind of situation would get caught.
By the way, if that happens, that would be a major, major story like that. Oh yeah. We're going to the town right for awhile.
Ron Gula: [00:30:14] That's right where, I mean, we're going through some of the stuff, but I'm not picking these by random, so, okay. I'm a Chinese PLA agent and I want to influence a selection for China.
Yeah. And I want to get Biden to win. Right. So that's, that's a story that's on the right. A good bet. Um, okay. So I want to pay off maybe what a third of the people working on this voting per sitting. Right. And I want to get them to all collude together to get around us. The detectives are at the County level.
Ben Adida: [00:30:48]Right. I mean, at some level, right. Won't as they certify these things and send it up, there's like another level that they'd have to divide pass, right?
Yeah. So if you are running the audits. The way we recommend you run it, which is at the state level, you run a state level audit that then dispatches request to the counties.
And the counties process is open to the public with the precedent, attendance and whatnot. And you're a foreign agent. I think the only way you have a chance of succeeding is you have to corrupt the paper record at the source. Right? You'd have to be at the County substituting ballots. It would be a pretty heavy duty. It's it's doable, but it's, it's, it's there. All right. So then that's how you'd have to do it. You'd have to do it by falsifying the paper record. I think going after the scanners, just the software that's increasingly unlikely to happen because of the kind of auditing.
Ron Gula: [00:31:30] Right. So, so do any States have a hundred percent electronic voting?
Are they, do they all have some form of paper, paper trail?
Ben Adida: [00:31:36] There are so 95% of voters in 2020 voted with a paper ballot. Okay. Uh, up from, I think, 80% in 2016. So we are absolutely headed in the right direction. Uh, and we're almost there. Uh, I think the voting systems that we're using could still use a lot of improvement, but the paper is winning and that's very good.
Ron Gula: [00:31:57] So one thing like, just, can we talk a little bit outside of just, just, I mean, these people who volunteered this time around, I mean, there was such a good story of a lot of younger people. Yeah, I wanted to come and help. Do you have any stories of just people that
Ben Adida: [00:32:11] work? Exactly. Yeah. Yeah. Sorry. I cut you off.
Ron Gula: [00:32:17] Did you ever ask, do you have any good stories or examples of just people who are volunteering and like, like what was it like, like maybe in Georgia?
When the governor order or the secretary of state, I forget exactly who, but they ordered the recount, like, is that right? Were people excited to stay late and do a lot more manual labor?
Ben Adida: [00:32:32] No, they were not excited. It's a, it's a, it's really tough. So everybody who comes in as a poll worker or, uh, as a helper in the, in the audit is usually paid. It's not a lot of money, but it's, they're usually paid, uh, you know, uh, a small, uh, minimum wage or better. Um, they had to hire a lot of people. To count all those paper ballots.
So a little bit more about the story in Georgia, Georgia by law has to do a risk limiting audit on one of their statewide contests, uh, because the margin on the presidential was so tight. I think nobody thought that they would pick the presidential contest because a risk limiting audit would turn into a full hand count because of the margin being so tight.
Uh, I think Georgia chose to do it. And in retrospect, I think they made the right call because so many eyes were on Georgia and that particularly close election that, that extremely expensive and tedious process of counting all the ballots, um, was worth it. I think to give, give people confidence, even though it was of course the most extreme version of an audit, but in that situation, every County brought in.
Um, some people they hired. Right. And if you think about Fulton County, the largest County in Georgia, in terms of number of voters, I think they hired 300 people in two days to come and help count in this huge arena, uh, you know, with video stream and observers watching and all of that stuff. But yeah, I, and you know, it's risk, it's a risk and it is COVID risk, of course.
Right. So they're all wearing masks and they have plexiglass shields and whatnot. I mean, to me, The most inspiring thing is the fact that a lot of people came together under this threat of COVID for democracy to make sure the count was right at the end of the day, the count was off the hand count was offered the machine count by less than 0.01%, very, very small deviation.
They did it for not a lot of money. And in the end, that was the largest. And fastest us hand count in us history and in a time of COVID and that's pretty inspiring. I think there was one person I interviewed on TV because after the hand count, they went to another machine recount, which the Trump campaign requested and they, as they had the right to, and so people were coming in for a third count of the ballots and there was one person who was interviewed on TV, who said, Bring me in as many times as you want, you want me to count them five times, seven times, eight times, you know, whatever democracy needs.
And I was like, yeah, that's, that's the attitude. That's what you want to see.
Ron Gula: [00:35:06] You know, that's, that's excellent. So this last section of questions, we're going to talk about the future, which is, which is delicate because yeah.
You know, we as cyber people, we can always do better and make things more transparent, but pointing out some of these weaknesses doesn't necessarily mean that this wasn't the most secure election that we, that we've had.
So it's just so interesting. I mean, cyber people get beat up all the time by politicians where they live, they live in a different completely world and, and, and whatnot. But having said that,
Ron Gula: [00:35:36] you know, voting.works, you have some advantages being opensource. Yeah. Uh, then some of the commercial things. So what are some of the recommendations you might have for the Biden administration or the department of Homeland, or even the state by state election commissions when it has to deal with, uh, commercial voting?
Ben Adida: [00:35:51] Yeah. So, um, let me think, let me talk about the focus on the federal. Um, The first thing is not surprising and it's going to sound like a same old, same old, but the federal government needs to provide more money to the States to run elections. It's really important to point out that many of this counties and States specifically counties were able to survive the selection in no small part.
Thanks to $400 million provided by the Chan-Zuckerberg initiative. To, uh, directly to counties, uh, with the help of this fantastic organization called the center for tech and civic life CTCL that, that helped make sure that those grants were fair. And, you know, and, and for people who needed them $400 million so that they could run this election safely, that's more money than the federal government allocated this year to elections.
That's not okay. I mean, it's great that this money was made available and I, I praise, uh, the Chan-Zuckerberg initiative for doing that. But there are legitimate questions to be asked as to whether it should be, uh, you know, a single large donor who helps run all the elections in the U S that doesn't seem like a scalable process going forward.
So I think the federal government needs to invest more regularly in, uh, helping financially States and counties run their elections. That's not the number one thing I would recommend to the Biden administration. The second thing I would recommend is. The EAC, the election assistance commission, the federal agency that's tasked with overseeing the standardization, the certification, the security of voting equipment.
I think one, they need to be funded. And I actually think the latest bill that just passed gives them funding. So that's really good. There also needs to be some streamlining of the certification process because we're in a world right now where voting.works is not only the first. Non-profit voting vendor in the U S it's the first vendor period in 12 years.
This is not a very dynamic industry. This is a highly regulated, highly fragmented, low total market industry that is crawling in terms of progress. And we think, I think it can go a lot faster if we review the standards, the certification standards. And streamline them, get rid of the old requirements that are really no longer relevant, uh, provided easier path for, um, new entrance to try things at small scale.
Right. Right now it's kind of, you're either certified or you're not certified. It's very, it's, it's very all or nothing. Um, and think, and make sure that the market, um, liveliness, um, Uh, that a healthy market is one of its goals. I think it's not a goal right now, the EAC to create a healthy market.
Officially, it's not an official goal. There's lots of people there who want to do that, but it's not a stated goal of the agency. And I think if you made it a stated goal of the agency, that they have to figure out how to help new vendors get in how to help new technologies. And sometimes new technologies doesn't have to mean fancy and complicated.
It can just mean cheaper. Right. And cheaper is really good too.
Ron Gula: [00:39:00] Or in your case, the ability to print color ballots, right. Such as in Mississippi, or was that Alabama?
Ben Adida: [00:39:05] It was Mississippi. Yeah. Where we had, we had to print color belts. Yeah, exactly. So using off the shelf equipment, you know, encouraging that again, the people that work at the agency are fantastic and they're doing really great work.
However, like most federal standards, the standard seems to just grow with time more and more requirements without streamlining the old, without really thinking about how to make the market more dynamic, more lively, more. Uh, just better, right. For, for counties. So that's the second piece of advice I would give, make sure that one of the goals of the EAC is to ensure that the voting industry can have more competition.
Um, and we'll get better equipment, more affordable equipment, more secure equipment. If we do that, do we,
Ron Gula: [00:39:45] so I'm a big state's rights fan, right? I mean, we're the United States of America, right? It's it's um, but at the same time, every state's got a little bit, yeah. Different way that they go about that. And that's fine.
Alaska is going to have something different than maybe a more densely placed like New York or California. So I get that. Having said that though does not having a standard. Make it harder to have competition because now, like you have to tell your software to Alabama and Florida and Texas, if we had more standards or even maybe like an organization, like the secret service that was a federal organization that, that did voting, would that help like, do we think we need to go that far?
Ben Adida: [00:40:22] Well, I think one could make the argument that the EAC is that organization with, I would say maybe a pairing of the EAC and SISA CSO the sun a lot to help election officials, not with equipment itself, but with processes and cyber defense and that kind of stuff. Um, so I think we kind of have that as you pointed out, state's rights means that States get to decide how they carry out their own elections, but it's worth pointing out.
That most States are delighted at the idea of having a federal standard, they can rely on because that's less work they have to do. It's hard to decide on what a standard should be for voting equipment. You know, uh, now you're right, that there are some things that States will not let go of. Right.
Certain States have. Peculiarities of how they want the ballot presented it's in their laws. They're not going to change it. And it would be easier if we could find a way to harmonize some of those requirements across States. So I think you're right. If I had a third recommendation, it would be what can the federal government do?
To help harmonize some of the requirements without taking away state's rights. States can continue to, you know, do what they think is right, but maybe create incentives so that if, you know, if it's all the same to the States, then maybe lining up with an existing harmonized version of a voting machine, uh, would make life easier for them and everybody else.
I think that's a good point.
Ron Gula: [00:41:40] Awesome. Well, Ben, I think you're one of the heroes of this election, you and your entire organization. I think you did a great job helping out and talking about all the good work at voting.works. Where can people go to, to learn more? Can they donate? Can they get involved?
Ben Adida: [00:41:54] Yeah, so we are a five Oh one C3. You can make a tax deductible donation. It's almost the end of the year. Now it might be a good time. Uh, if you go to voting.works, w O R K S. That's our website. You can see a number of videos, including a documentary of our work in Mississippi, which I think, uh, I think is pretty great. And, uh, there's a donate link at that page.
You can also just go to voting.work/donate and you can give there, uh, and we're of course, incredibly thankful for all of our donors. And, uh, it's, you know, it's a privilege to do this work. You're too nice to call me a hero. I think the real heroes are. The election officials and administrators who have been on the ground risk and COVID, um, to help democracy run this year and they did a spectacular job.
Ron Gula: [00:42:41] Awesome. Well, thanks again, Ben. Thanks for everybody who has been watching the show and listening to the podcast. This is episode two of the Gula Tech Cyber Fiction show. Thanks everybody for hanging with us.