@tmekelburg1 wrote:
@CISOScott wrote:
@vt100 In the hearing yesterday Jack Dorsey of Twitter admitted that he is not an expert on voter fraud but yet he allows his organization to "fact check" voter fraud. Is that really what we want?
Can you clarify this statement? If taking this at face value, I read it as Twitter not allowed to fact check Tweets that Jack is not an expert in. I'd expect him to be an expert in business acumen with his current role and for him to hire experts in researching information across different mediums for his fact checkers. I'm not defending him for his lack of knowledge or how his hearing went, just curious on your opinion.
I agree with you. I would expect the leader to hire the best people to handle parts that they do not know. The problem I have is with one sided "fact-checking". As evidence of this I have seen multiple posts by several individuals that had NOTHING TO DO WITH VOTING, slapped with a "There is no voter fraud" or "US elections are and always have been, fair and legal." type warnings. This tells me that the platform is less inclined to be unbiased and just want to tag every comment from certain individuals with the narrative they want to push. I want it to be clear what happened. If there is fraud, then expose and fix the system. If it is fairly investigated, and no fraud is found, then I can and will accept the results. I also want fair and open free speech. That is my problem with what is going on. I wish the social media platforms spent as much time fixing the spam and fake account problems as they have done with this "fact-checking" they have been doing.
As an information security professional I want to see honest fact checking. I want to see honest procedures. I want to have the cyber security problems identified this cycle taken care of and fixed so that we don't have to go through this again. I want the vulnerabilities identified, remediated, and secured for the future. That should be the big thing that we are all upset about. That there are problems that are not being fixed. There are auditing items that need to be resolved to ensure auditability. There are broken procedural processes. This could be a good use of bit chain technology. Let me explain just one of the process failures. I will do this without getting into one side or the other, let's just look at the process and let me know if you, as an information security professional, would be good with this process at your place of employment.
We currently have a problem with absentee ballots. Absentee ballots were designed to be used if you could not make it to a voting place on election day. You are supposed to request it, and then be sent it. This year, these were sent out in a large batch by the millions, unrequested. Some people received ballots for people no longer living at that address. Some people received ballots for dead people who had died, but whose names were still on the voter registration roles. Some people received ballots for their PETS!. Yes somehow the senders of these unrequested ballots had gotten hold of mailing lists where people had registered their pets instead of themselves to avoid receiving junk mail. Some people received ballots and went and voted in person as well. Some places have a process to prevent this, but some places do not. Some people went in to vote in person, but were told that they had already voted through an absentee ballot, even though they never submitted one (so someone else voted for them).
A hacker would look for fraud points or places where fraud could be inserted so they can insert their will.
SO one problem. Voter roles not updated or verified (Fraud Point 1). This becomes magnified when the process becomes abused. There is supposed to be a signature match from the signature on the ballot against the voter registration card that was submitted when the person registered to vote. Some places did this and some did not (Fraud Point 2). Some relied on AI and machine matching but then set the threshold for mismatch to a low threshold as to minimize the rejection ratios (Fraud Point 3). Some voting places have voter identification and some do not (Fraud Point 4). So anyone could walk in off the street, claim a name and address, and get to vote, unverified. Can you start to see the problems with the current process? Would you allow a person to logon to your network if their password was only 40% correct? Some people are fortunate enough to own properties in several states and can therefore, although illegal, register to vote in multiple states. There is no state to state verification of voter registrations so this part of the process can be manipulated (Fraud Point 5). In some states ballot harvesting is allowed. Ballot harvesting is where one individual can go around and collect these absentee ballots and "assist" the person in filling them out (Fraud Point 6), watch the person fill them out (thus knowing who the person voted for and possibly spoil or destroy the ballot) (Fraud Point 7), or just gather them up that have not been filled out yet (and potentially fill them out for their chosen candidates) (Fraud Point 8). Then, in some states absentee ballots have to be received by election day. Some can arrive up to 12 days AFTER election day. (Fraud Point 9) The date the ballot is received by the post office is supposed to be stamped on the outer envelope. However; this can be done by machine OR by hand. It is possible for someone to backdate the date received (Fraud Point 10). The ballot is supposed to be sealed in a security envelope and then placed in the outside mailer. The outside mailer is what is date stamped. When the outside mailer is opened and the inside "security" envelope is removed, they are not linked (Fraud Point 11). Separating them at this point removes when the ballot was received. Then the "security" envelope is opened and the ballot removed (Fraud Point 12). The person opening the envelope stamps that the ballot was received in time and is therefore valid, or they can reject it, AFTER seeing who the ballot was cast for (Fraud Point 13). If it has not been filled out they can alter the ballot (Fraud Point 14). They are also supposed to perform a signature verification at this point and make sure that all of the required info has been filled out, by the submitter, not the envelope opener (Fraud Point 15). Then the ballot is forever separated from both envelopes (Fraud Point 16). So it is impossible to separate this ballot from another ballot if audited. If this ballot was illegal, it would be impossible to invalidate it once mixed in with legal votes. There are voter watchers that are allowed various degrees of success to view this process and challenge any perceived errors. It is not applied universally across states so in some places these observers were close enough to see if the ballot was potentially invalid, in other places they were over 100 feet away and told to use binoculars to view the action. Even if they saw an impropriety they would not be able to alert an official to remedy it before the ballot was mixed in with the legal pile (Fraud Point 17). Some observers were asked to leave (Fraud Point 18). Some absentee ballots arrived in an unsecure manner (in boxes, in bags, in large groups, etc. ) (Fraud Point 19). Some ballots had only a mark for one candidate, and while technically possible, it is highly unlikely. So you can see, there are multiple places for fraud to exist and be inserted into the system.
As INFOSEC professionals we look for hackers who attempt to break in or break the process. One of the easiest hacks is to attack the weak points in the system. So if you came across a business where
1) user authentication was flawed in multiple places (no ID match, only required 20-40% password match, login location not restricted, some locations had stronger or weaker protections than others, the login servers (or IT staff) could use their own biases to allow or deny access, in some cases the password doesn't matter and isn't even checked and just is accepted)
2) user accounts could be manipulated (intercepted like MITM, deleted, reviving old accounts, etc.)
3) user activity was not monitored centrally (could log in multiple times from multiple locations, one person or group could control multiple user accounts and the activity of those accounts)
4) user accounts were not maintained or even checked for existence (ex-employees could still log in, accounts who were not even legal employees of the company or didn't exist could log in)
5) user activity could be destroyed or spoiled
6) The audit process was severely flawed and varied from location to location. No centralized standards for auditing. Auditors were not allowed to watch the key places where fraud COULD be detected. Actions were taken to actively obstruct auditors. Irregularities were observed. Auditors were sent home after being told the activity was being stopped, but then the activity continued in secret, out of the eyes of the auditors,
7) The security around delivery of user activity is non-existent in several places, user activity is found on thumb drives, CD's, DVD's, floppy disks, hard copy, email accounts, network storage, etc. and there is no way to verify if this activity is legitimate, duplicated, or fabricated.
8 ) Anomalous activity was detected that was outside of norms and could not be explained or was even audited to see why it was anomalous.
AND there were at least 19 points where fraud could be inserted in a very key process, would you be comfortable certifying that everything was OK and secure at that company and with that process? Would you say that no fraud existed or was even possible? I think not.....
