Before I start, can I take a quick poll? Has anybody on the committee ever hacked a computer system? Nobody has. We have women, we have men, and we have no computer professionals—and one of the things we are debating is whether to include computers in our electoral process.
I own two software businesses. One of my clients is actually Elizabeth May. She doesn't know it. She probably doesn't know the business by name—it's Guestlist, but that is not the point. My other business has worked with the federal government. During my time there, I disclosed multiple security vulnerabilities of a very serious nature, including the census and aspects of our military apparatus, as well as those of allied countries. We are not at the point where we can trust the computer systems we build with something as important as our election.
If you are choosing electoral systems, please consider non-computerization. If you must computerize it, please note that there is a difference between an Internet computerized voting system and a non-Internet computerized voting system.
There are four types of attacks: fabrication, theft, surveillance, and denial. Fabrication is impossible to stop with Internet-connected voting systems.
Russia is interfering in the American election right now, and it will interfere in ours unless we safeguard this process. If you must have an electronic voting system, make sure it goes outbound only—so radio or UDP connection outbound—and make sure you have a mandatory paper ballot that goes into the voting box and can be verified by any observer who can request a physical count at any polling station. Even using techniques like statistical sample sets will not guarantee a fair election, because an attacker can observe what polling stations to hit by using complex statistical number systems.
Thank you very much for your time.