--:-- Sean Rameswaram: You know what time it is? It's today, explain time, but it's also finally time for the Viper Club to be showing in theaters nationwide. The movie stars Susan Sarandon as a mother trying to get back her journalist son and kind of striking out on her own to do so because the government can't help.
--:-- Sean Rameswaram: Viper Club starring Susan Sarandon in theaters in New York and Los Angeles and other places too.
--:-- Sean Rameswaram: Logan Lamb is what is known in the business as a white hat hacker. So there are black hat hackers, and those are the bad guys who go into systems and do nefarious things. And then there are white hat hackers whose job it is basically to figure out whether or not systems are secure.
--:-- Sean Rameswaram: He decided to start looking into the election systems in Georgia because people had been talking about it during the 2016 campaigns. He starts poking around in the election systems center, which is at a university in Georgia called Kennesaw State. And that's where all of the election data is organized.
--:-- Sean Rameswaram: He wrote a little program to just see what he could find within that website. And he was shocked because it had downloaded all sorts of information that should have been private, should have been behind a firewall. He found every single voter in the voter database. So that's something like 6.7 million voters.
--:-- Sean Rameswaram: All of the software for the electronic poll books, all sorts of PDFs with passwords for the election workers to sign in to their central server on election day. He got into all the databases for the election management services where they put together the ballots. Basically, he found everything that would have been needed to run an election and therefore everything that would be available to be hacked.
--:-- Sean Rameswaram: So at that point, he was obviously very surprised and he reported it to the guy who was in charge of the election center, a man named Merle King. King told him, OK, thanks a lot for telling me this, but make sure you don't tell anyone downtown. So he didn't. And he just assumed that King was going to take care of it.
--:-- Sean Rameswaram: A few months later, there was the election. And there was always this talk at that point of, you know, Russian interference with the election. So he was talking to a friend of his and they decided to go back and see if they could get access to it. They assumed they couldn't, but he went in, and there it was again. They were able to download everything again that he had found.
--:-- Sean Rameswaram: Georgia did nothing with the information that Logan Lamb had found out. And it was only after the second venture that they actually moved it away from Kennesaw State. But it was unsecured throughout the entire election.
--:-- Sean Rameswaram: Sue Halpern, you wrote about election hacking for The New Yorker. When we talk about hacking our elections, what are we talking about? Is the Russian bots spreading propaganda on Facebook with fake accounts? Or is it like, I voted for a Democrat and some hack changed my vote to a Republican or something more sinister sounding like that?
--:-- Sue Halpern: Hacking is many, many different things. There's the kind of hacking that we saw during the election and prior to the election and now, which is spreading propaganda, essentially, through social media.
--:-- Sean Rameswaram: Yeah. And then there is the kind of hacking that we sort of think more typically as hacking, which is going in and messing with some kind of data.
--:-- Sue Halpern: What people focused on during the election was, did the Russians manage to change votes? That campaign was multifaceted. It involved cyber espionage, leaks of stolen data, cyber intrusions into voter registration systems, online propaganda, and more.
--:-- Sean Rameswaram: There's no evidence that they did change votes. It's possible, so it's not clear.
--:-- Sue Halpern: So we know for a fact that they may have influenced the way people voted, but we don't know for a fact if Russians changed any votes directly. That's right. There's no smoking gun.
--:-- Sean Rameswaram: No, the Department of Homeland Security has said numerous times that although no actual votes were changed in 2016, let me be clear in this, America will not tolerate this meddling.
--:-- Sue Halpern: It's a little unclear how they would know that because there are plenty of voting machines that are in service in this country that have no way of being audited or no ability to have a recount.
--:-- Sean Rameswaram: So it's really just not clear. You know, a lot of the work that hackers do is surreptitious. So they can say for certain that it really didn't happen. You can just say probably didn't happen.
--:-- Sue Halpern: Did Homeland Security find any evidence of an attempt to get at any voter registration voter machines anything like that?
--:-- Sean Rameswaram: Yeah. Homeland Security found that Russian hackers had touched something like 20 states' voter registration databases. We saw targeting of 21 states and an exceptionally small number of that 21 were actually successfully penetrated.
--:-- Sue Halpern: What that really means is states that had sensors on their servers that would indicate that someone from the outside was trying to gain access to it, but not every state has those sensors.
--:-- Sean Rameswaram: That number is not necessarily a representative number, it's just the number that we have. We know for sure that they were able to get access to the Illinois voter database, but I think that might be the only one that we know for sure that they went beyond just touching it.
--:-- Sue Halpern: Is that a thing you want to like hack into? Like a voter roll, a voter registration roll? They have them when you go vote. You see all these names kind of, you know, there's a volunteer managing it.
--:-- Sean Rameswaram: Couldn't you just like run into like a voting booth and grab one and run away? But that doesn't do you any good unless you can manipulate it. If you could get access to it at the kind of root level of it and then start messing with it.
--:-- Sue Halpern: When you go to vote, what appears to be the real record has been manipulated, has been changed. That's a trick.
--:-- Sean Rameswaram: And it's particularly worrisome in a state like Georgia, because Georgia has very strict rules. Someone can get tossed off if they haven't voted in a couple of years.
--:-- Sue Halpern: And so if they delete someone's voter history and that person shows up to vote and says, I'm here to vote, and the poll worker says, well, you haven't voted in the last couple of elections, so you're no longer registered to vote, there's no way to prove that they actually did vote.
--:-- Sean Rameswaram: So it's a very effective way of hacking an election without changing a single ballot.
--:-- Sue Halpern: What about voting machines? I mean, when I go to vote and I'm using this old clunky piece of hardware and I hear about voter hacking, I always think, well, those machines can't be that hard to hack, can they? They look vulnerable.
--:-- Sean Rameswaram: It depends on the machine. But for the most part, the ones that we're using now are extremely vulnerable.
--:-- Sue Halpern: Part of the reason why they're vulnerable is they're really old. They are probably close to 20 years old.
--:-- Sean Rameswaram: They probably had a shelf life of about 10.
--:-- Sue Halpern: They often use software that is no longer supported by the manufacturer, but they're very expensive.
--:-- Sean Rameswaram: That doesn't necessarily mean that someone's going around to your voting place and messing with your particular system. It would be much more efficient to hack into the vote tabulators.
--:-- Sue Halpern: But if a voting machine is sending information to like a central server over the internet or over cellular data streams, it can be intercepted.
--:-- Sean Rameswaram: There are things called stingrays. Stingrays. It sets up a fake cell phone tower that tricks something sending cellular data into sending the data to it. It can manipulate it and then it sends it on to the final destination.
--:-- Sue Halpern: So that's a possibility.
--:-- Sean Rameswaram: Have you ever hacked into a machine, Sue?
--:-- Sean Rameswaram: Okay. But I have been in the presence of people hacking into election machines, for sure. For example, not for real, right?
--:-- Sue Halpern: Yeah, yeah, yeah, obviously. Because if I did it for real or if it was even in the presence of someone doing it for real, that's actually a felony. Right.
--:-- Sean Rameswaram: Every year for the last two years at DEFCON, which is the big hackers conference in Las Vegas, there's something called Voting Village. This voting machine is used in 18 different states, and it's extremely easy to get admin access on this machine.
--:-- Sue Halpern: So let me show you how quick it is. It's about a little under two minutes.
--:-- Sean Rameswaram: A bunch of computer scientists will have gathered probably about 30 or 40 old voting machines that they buy off of eBay or at government surplus auctions to be hacked.
--:-- Sue Halpern: All they have to do, this bad actor, would be to open up this machine by pressing this button right here, unplugging this. Again, you don't need any tools to do this. Pick this lock here with a ballpoint pen.
--:-- Sean Rameswaram: And now I have full admin access. So I've watched people do that.
--:-- Sue Halpern: And then this year, they set up a whole other system, which was a voter registration database. It was a mock-up of the Illinois system. And they let people try to hack into that.
--:-- Sean Rameswaram: When you go hang out with these folks who are hacking machines or hacking databases, how surprising is it to you how easy they can do it?
--:-- Sue Halpern: You know, it's actually very shocking.
--:-- Sean Rameswaram: There was a really funny thing that happened this year at DEF CON. They set up a situation for kids to hack into mock Secretary of State voter registration databases.
--:-- Sue Halpern: So they weren't the real thing, obviously. My name is Alex, and I'm seven years old, and I'm hacking into voting. It's actually really easy.
--:-- Sean Rameswaram: I bet the Russians could do it in their sleep.
--:-- Sue Halpern: It took the kids minutes to get into them and then to manipulate them.
--:-- Sean Rameswaram: The idea that kids are capable of doing this is worrisome.
--:-- Sue Halpern: The fact that the best hackers in the world can break into most of these machines within minutes is worrisome.
--:-- Sean Rameswaram: I mean the whole thing is worrisome.
--:-- Sue Halpern: Coming up, Howie ended up with this trash fire of a system in the first place.
--:-- Sean Rameswaram: Thank you. I haven't seen Viper Club, but now I can because it's showing in Washington, D.C. right now. I just Googled it. It's showing at the Regal Gallery Place Stadium 14 at 1215, 255, 535, 815, and 1055.
--:-- Sue Halpern: And it's showing at the landmark Bethesda Rose Cinema at 130, 425, 725, and 955.
--:-- Sean Rameswaram: You too can find out when Viper Club is showing near you because it's Friday, November 2nd, and Viper Club is now showing in theaters nationwide.
--:-- Sean Rameswaram: When did the election system get so vulnerable to hacking? When exactly did that happen?
--:-- Sue Halpern: In the 2000 election, Bush v. Gore, there were a lot of older voting machines. Look at this in Florida. Here we are at 99 percent of the vote in. We have projected it, obviously, for George W. Bush.
--:-- Sean Rameswaram: I've just gotten off the phone. It is, in fact, true that the vice president has called to recant his concession. But this race is simply too close to call. And until the recount is concluded and the results of Florida become official, our campaign continues.
--:-- Sue Halpern: Voting machines in Florida were the ones that resulted in these things called hanging chads.
--:-- Sean Rameswaram: Do you have an hour? I can explain it.
--:-- Sue Halpern: First, you have to know that the punch hole is called a chad. It is attached to the ballot by four threads.
--:-- Sean Rameswaram: You were pushing a button, and the button was supposed to make a mark on a ballot.
--:-- Sue Halpern: In the morning, the commissioners had decided that if it had been detached by only one thread, it would not be counted as a vote. Two detachments, maybe. Three definitely counted as a vote.
--:-- Sean Rameswaram: But then there was also another whole issue there. Democrats charge a confusing ballot layout led voters to think they were punching the ballot for Al Gore when they were actually voting for Reform Party candidate Pat Buchanan.
--:-- Sue Halpern: It wasn't clear who the person was actually voting for. Number four, pointing over here. Number five, pointing over there.
--:-- Sean Rameswaram: They either voted for the wrong man or they hit two numbers. And so there was this complete, you know, mess going on in Florida.
--:-- Sue Halpern: Given the totality of the circumstances here, I move that this board conduct a manual recount of all the ballots for the presidential election for the year 2000.
--:-- Sean Rameswaram: You know, it went to the Supreme Court. The Supreme Court of the United States has reversed the decision of the Florida Supreme Court.
--:-- Sue Halpern: And now by one vote on the Supreme Court, this election is over.
--:-- Sean Rameswaram: As a consequence, Congress passed this law called Help America Vote Act, HAVA.
--:-- Sue Halpern: The Help America Vote Act of 2002 is a bipartisan measure to help states and localities update their systems of voting and ensure the integrity of elections in America.
--:-- Sean Rameswaram: Hava put aside a lot of money that went to the states for them to upgrade their election machinery and their systems.
--:-- Sue Halpern: And so a lot of states went out and bought these kind of fancy new electronic voting machines.
--:-- Sean Rameswaram: But first of all, they degrade. Second of all, they have security holes that don't get patched.
--:-- Sue Halpern: And as we've seen, they're also easy to hack.
--:-- Sean Rameswaram: Are they being used differently across the country?
--:-- Sue Halpern: Every state administers its own elections. So every state has its own systems.
--:-- Sean Rameswaram: And within every state, every county has its own system.
--:-- Sue Halpern: And every county administers its own elections.
--:-- Sean Rameswaram: And so it's a patchwork.
--:-- Sue Halpern: They're very, very different. There's no consistency municipality to municipality.
--:-- Sean Rameswaram: And that has been seen in many ways as a benefit because it's harder, obviously, to break into a system that is very localized.
--:-- Sue Halpern: You can break into it, but it won't necessarily have that big an effect.
--:-- Sean Rameswaram: If you're a hacker, you want to find a big attack surface. You want to find the biggest one you can find because that will have the biggest impact.
--:-- Sue Halpern: The understanding has been that the patchwork system that we have, which can work better in some municipalities than others, is a deterrent to hackers.
--:-- Sean Rameswaram: It's a feature, not a bug. Yeah it unclear if that true but that been one of the talking points for people who are trying to allay other people worries that this is a hackable system.
--:-- Sean Rameswaram: Has the government tried to do anything about the fear of hacking in particular yet?
--:-- Sue Halpern: Yeah. So the government has done a bunch of things to try to deal with this problem.
--:-- Sean Rameswaram: But the federal government has no control over elections. It's only the states that control elections.
--:-- Sue Halpern: And some states are really very much opposed to the federal government having any role in elections whatsoever because they see it as taking over some state autonomy and they don't like that.
--:-- Sean Rameswaram: The idea of federalizing our elections to where we have a one-size-fits-all voter registration system or mandating that states use a certain voting system creates all kinds of problems and, quite honestly, I think would make the system more vulnerable, not less.
--:-- Sue Halpern: Before Obama left office, his Secretary of Homeland Security declared our election systems to be critical infrastructure.
--:-- Sean Rameswaram: And of course, on January 6, 2017, utilizing my authority as Secretary of Homeland Security, I designated election infrastructure in our country as critical.
--:-- Sue Halpern: And that gave the federal government the ability to offer states help in hardening their systems.
--:-- Sean Rameswaram: So they put money into that. So they would send cybersecurity experts around to the states to help them figure out how to make their systems more secure.
--:-- Sue Halpern: But it was a voluntary thing. States didn't have to do it.
--:-- Sean Rameswaram: So how can this be solved? I mean, you've written about this. You've hung out with hackers. You know quite a bit.
--:-- Sue Halpern: Do you have ideas that the government doesn't?
--:-- Sean Rameswaram: If I did, I think I could make a lot of money.
--:-- Sue Halpern: Is there money in this? It feels like in America problems get solved when there's money in it.
--:-- Sean Rameswaram: But it feels like these sad voting machines continue to be used because no one really cares to spend any money on this.
--:-- Sue Halpern: It really, in many ways, is a money question if we can upgrade the hardware and the infrastructure.
--:-- Sean Rameswaram: But then there's also another whole issue there, which is that pretty much every computer scientist who looks at electronic voting machines of any kind will tell you that they can't be 100% secured.
--:-- Sue Halpern: It's just not a possibility.
--:-- Sean Rameswaram: And that's why everyone in this field will also tell you that what's needed are paper ballots and what are called risk-limiting audits at the end of an election period.
--:-- Sue Halpern: Then the risk-limiting audit is basically a way of looking at a sample of ballots to make sure that they correspond to what the machines are saying happened.
--:-- Sean Rameswaram: Many of the machines that we have now are purely touchscreen machines that have no paper trail and therefore can't be audited and can't have a recount.
--:-- Sue Halpern: We have to have an ability to have a paper record that can be checked.
--:-- Sean Rameswaram: And that way we can have elections where we know the end result is true.
--:-- Sue Halpern: This is one of the few things in our day and age that technology can't fix.
--:-- Sean Rameswaram: What's most interesting to me is that the people who are the most technologically savvy are the people who are saying we need this very non-technical fix.
--:-- Sue Halpern: And the reason is because they know machines are vulnerable.
--:-- Sean Rameswaram: Sue Halpern is a contributing writer to NewYorker.com and a scholar in residence at Middlebury College.
--:-- Sean Rameswaram: Sounds nice. I'm Sean Ramos from This is Today Explained.
--:-- Sean Rameswaram: Before we go for the weekend, I just want to say we promote a lot of podcasts on this show, but I feel especially invested in the second season of The Impact because I've been sitting here at Vox for almost a year now watching Sarah Cliff and her team, Jillian Weinberger and Bird Pinkerton put together this show.
--:-- Sean Rameswaram: And I hear about the stories they're focusing on for the second season, and it just sounds so good.
--:-- Sean Rameswaram: What they're doing is getting out of Washington, D.C. to look at how states are experimenting with policy to help people.
--:-- Sean Rameswaram: Because unlike Washington, D.C., local governments are constantly implementing new, exciting, experimental policies.
--:-- Sean Rameswaram: The first new episode of the season is called, Is Fixing Campaign Finance As Easy As Giving Everyone 100 Bucks?
--:-- Sean Rameswaram: Because Seattle is running this radical experiment to fix campaign finance.
--:-- Sean Rameswaram: Last year, the city sent every resident $100 that they could donate to the local campaign of their choice.
--:-- Sean Rameswaram: You can find out how that went.
--:-- Sean Rameswaram: Why wouldn't you want to listen to that?
--:-- Sean Rameswaram: Go subscribe to The Impact, rate, review, listen to every episode.
--:-- Sean Rameswaram: You're gonna love it, kid.