Kill Chain: The Cyber War on America's Elections

Harri Hursti: Voting is about our capability

to change the way the government works

by changing the people who make the decisions,

and have a peaceful transfer of power

when the people have made that choice.

If you don't have that,

then the alternatives are revolutions.

The problem is once you understand how everything works,

you understand how fragile everything is,

and how easy it is to... lose this all.

Richard Burr: Do you have any doubt

that Russia attempted to interfere

-in the 2016 elections? -None.

In 2016, we know that Russian actors

targeted state election systems.

Has the department conducted any kind of

post-election forensics on the voting machines

that were used in 2016?

Our department has not conducted forensics

on specific voting machines.

I think it had no bearing on the election.

We have no evidence that votes were changed.

No actual votes were changed.

CyberZeist:

Hursti: I keep hearing that

the system is unhackable.

Bzzz! Wrong.

Everything is hackable, always.

These are just computers.

We call them voting machines,

but they're nothing more than obsolete computers.

Man: Wow.

Woman: Password. Do we want...? For admin. Yeah.

-Admin. -Yeah.

-Man 1: Awesome. -Man 2: Success!

Carsten Schurmann: We are in!

Amy Klobuchar: It's not just about hardware.

It's the hardware of our democracy.

-Man: Thank you for voting. -Sue Halpern: When people say

no votes were changed, it misses the point.

What matters is that you create chaos

in the election system.

Hursti: We tend to see these events as random and disconnected,

but, in fact, there's a pattern you can see.

In cyberwarfare, it's called a "kill chain."

We may be buying the world's best 20th century military,

when the battlefront in the 21st century is election security,

cybersecurity.

Hursti: In order for us to find a way forward,

we have to understand how broken the system is

and what are the fundamental problems we are facing.

This shouldn't be a partisan issue.

This is our common problem,

owned by everyone living in the United States,

and we have to solve it in order to preserve

our way of life, our society,

the rule of law, and our right to self-govern.

So, how we vote in the United States is very complicated.

Elections are run locally.

There's no national election system,

no agency, and all of this is left up

to the states, and within the states,

it's left up to, typically, to the counties.

There are many, many, many counties in the United States.

Within the counties, it's then left

to the election officials in those counties,

and they get to decide how we vote.

They get to decide what machines we use,

and there are many different kinds of election machines.

Halpern: Then the memory card is placed into the voting machine.

Some places also use paper ballots,

and all of the paper ballots go into a scanner.

Paper ballot here, hand-mark it,

and feed it to our precinct scanner.

Other districts will use what are called

"direct recording electronic machines,"

which are touch-screen computers,

and then, ultimately, all of these votes

will go into a central location that will tabulate the votes.

So, at the end of the night, when you close the machine down from voting,

there's a thumb drive...

Man: As soon as the voting stops, the coordinator pulls this out,

has a special laptop, to just put it in the side of that machine,

and they send it to the right place,

and then it's done. Pow!

Halpern: Basically, there is no way

that you can say, "This is how America votes,"

because America votes in this very,

kind of chaotic, very idiosyncratic way.

James Comey: Our vote system in the United States is very, very hard

for someone to hack into 'cause it's so clunky and dispersed.

It's Mary and Fred putting a machine

under the basketball hoop at the gym.

The overlapping layers of the system are what give us confidence,

the fact that there's a wide variety of machines in use,

a wide variety of procedures across jurisdictions.

Thousands of machines

at thousands of locations across the United States...

Means that there's no national system that a hacker

or bad actor can infiltrate to affect

the American elections as a whole.

Hursti: There is a commonly repeated statement,

repeated over and over again,

that the US election system

is protected by its vast diversity,

uh, that's not exactly true.

The laws are actually very similar across the US,

but so are also the voting machines.

There is commonalities between, basically, all makes and models,

and one of the commonalities is that

the key element to carry and store the votes

seems to always be a removable medium.

Whether it's a card or whether it's a USB stick,

it doesn't matter--

it's still a removable storage medium.

Every single step of the way, it is vulnerable to attack.

One machine, then another machine,

then another machine, and so on.

It is also important to understand

that modern storage devices are computers of their own.

It is not just where data is stored,

also storing instructions

for the voting machine, how it should operate.

What we are going to do here is modify one card.

And it's a very simple process-- you just add the card in,

and tell exactly what file

you want to be put in.

You run the rewrite program,

and then bring it to the election supervisor's office.

Here is the memory card I have touched.

Okay. Now this is the only piece

-of Diebold equipment that you've used? -Hursti: That's correct.

What we have here is a programmed optical-scan ballot.

Now there is only one question on this ballot.

Two individuals will be voting "yes,"

the rest of us will be voting "no,"

and then we'll scrutinize the ballots afterwards,

to ensure that that is indeed the mark.

Sancho: Oh my.

Woman: Oh no!

-What is it? What is it? -Woman: Seven yes, one no!

Oh my gosh!

Seven people said it could be hacked.

-Woman 1: And we put through... -Woman 2: Six and two.

Women (overlapping): Six no's and two yes's.

Oh my gosh. Do you know what this means?

Hursti: The memory card can be altered,

and that will cause incorrect results,

and every single element of the system

will be reporting the same incorrect results,

seamlessly, leaving no evidence,

nothing to be detected.

Hursti: The first reaction was to shoot the messenger,

to try to use any legal means possible to cause a chilling effect.

And there was a huge amount of resources used

just to stop the communications,

just to stop people discovering the vulnerabilities.

There was a huge amount of lobbying,

advertising, marketing to assure customers

everything is fine when it was not.

If those same resources would have been put

to actually fix the problem, that would've been way cheaper.

The real differentiation of Dominion is we are customer-driven.

Our employees partner with our customers to make elections

simpler, more secure, and more accessible.

-(birds chirping) -(rain pattering)

Hursti: We are right now outside of Tallahassee, Florida, in Leon County.

It's been almost 15 years

from when we hacked the voting machines

back in 2005.

And we are here to see our old friend, Ion Sancho,

who was the election supervisor

of Leon County.

Sancho: On September 30th of 2016,

we get this cryptic email

from the secretary of state of Florida's office, saying,

"All supervisors of elections must be

"on this conference call at such and such a time.

"This is secure.

You will be there, and you will not mention this call to anybody."

-Mm-hmm. -We gathered our staff, put it on a speakerphone,

and what it was, was the FBI

was telling Florida election officials

that a foreign power

had penetrated a vendor

-which does work in Florida. -Mm-hmm.

It didn't take us long

to figure out that they were talking about

the GRU, i.e., Russia's military intelligence service.

And the vendor was a Tallahassee vendor,

-VR... -Hursti: Mm-hmm.

...which did all the programming

for a majority of the counties in the state of Florida.

They do the absentee ballots.

They do the early voting operation.

This... This company,