Special: Hacking an Election

Speaker 1: Russia, if you're listening, I hope you're able to find the 30,000 emails that are missing. I think you will probably be rewarded mightily by our press.

Speaker 2: So when people talk about hacking an election, they tend to talk about voting machines, and those are a real problem. 43 American states use digital machines that are over a decade old, and in terms of cybersecurity, that's just not okay. But when it comes to hacking an election, it's not just hacking machines you have to worry about. It's hacking people. For example, in April of last year, the French television network TV five piped terrorist propaganda into the homes of its 256,000,000 viewers. During an eighteen hour period, the largest French language news network in the world broadcast a black screen with a message written by ISIS. So, why, you might be asking, in the world would anyone give eighteen hours free airtime to a terrorist organization? And the answer is no one. TV5 was hacked by a group calling themselves the Cyber Caliphate. ISIS had never really dabbled in cybercrime on this scale before, and now everyone was realizing that they were this entirely new kind of threat. But, in the weeks following, researchers into the attack began to notice discrepancies in this narrative. The government had tasked 15 investigators with learning more about the cyber caliphate, and during their research, they found that while much of the groundwork for the hack was laid from IP addresses all over the world, the code was almost entirely written on a keyboard layout corresponding with the Cyrillic alphabet used most commonly in Russia. They noticed patterns in the hours during which the hackers worked based on time zones. It would seem they were working in Moscow. This is all a very roundabout way of getting to the larger point that now French authorities officially believe that the hack came from a group with close ties to the Kremlin. In a country with a complicated relationship with the Muslim world, millions of eyes watched as the purest expression of their fear unfolded on live television. France was the victim of this cyberattack by radical Muslim extremists, except they weren't. Probably they were tricked, which was the whole point. I mention this in the context of elections because in the days leading up to the twenty fifteen UK election, the GCHQ, which is Britain's NSA, forwarded a very, very similar attack. An attack the night before an election that would have had people going to the polls thinking they were at war with one group, and not finding out that they had been deceived until after their vote was cast. When we talk about hacking an election, we're not just talking about hacking machines, we're talking about hacking people. We're talking about making people think the world is one way, when really it's another. So when the guy who says that Russia should leak their opponent's email also says that

Speaker 1: November 8, we better be careful because that election's gonna be rigged.

Speaker 2: You're gonna wanna ask some follow-up questions. My name is Jordan Blumen. And I'm Scott Winder. And this is how to hack an election on this episode of Hacked.

Speaker 3: There's been a lot of talk of rigged elections, and I think the number one thing that jumps in everybody's mind is vote rigging because vote rigging is the, you know, the tangible action that leads to the outcome. And so whenever somebody talks about hacking an election, they talk about vote rigging, or at least I think your mind naturally jumps there.

Speaker 2: Sure. I picture someone unscrewing a panel on the back of a voting machine and plugging something in, and suddenly your vote doesn't count the way you think it's going to.

Speaker 3: Yeah. Which is apparently plausible and also has been done in lab environments. So, you know. Sure.

Speaker 2: But I think that's I imagine that would be tough to do on a mass scale, though.

Speaker 3: Yeah. Yeah. So I think there's, like, there's an interesting thing and, something that you and I have discussed a lot is that, you know, there's kind of three pillars to the hacking world, and there's the, you know, the social, you know, the interpersonal aspect, making people what, you know, social sentiment and public sentiment is. And there's, like, the digital, which is, you know, the email hacks and the software side. And then there's the physical, which is, like, you know, your machinery and your environments and all the rest of it. So so I think that rigging the voting machines is definitely in the digital paradigm and and and could quite well be plausible, but, you know

Speaker 2: You're more concerned with the social?

Speaker 3: Yeah. Yeah. I think to actually hack the voting machines, you know, just given the way that The United States runs elections, when Donald Trump says that the elections are rigged, I agree with him, but I actually think that they're rigged against Hillary because it seems like there's a lot more foul play going on in the physical and social space against Hillary. Does that make sense? So so when Donald Trump stands up and says the elections are rigged against me, he's insinuating one socially that the media is not covering him positively, but he's also insinuating that there could be election tampering in the digital sense or in the voting sense or in the in the actual execution of the election. And just the way that the independent bodies run an election in The United States makes that, you know, I'm not gonna say virtually impossible, but to do anything on any kind of large scale would make it very, very, very challenging.

Speaker 2: Yeah. The term voter fraud keeps coming up, and I feel like in a lot of people's minds, that's tangled up with a sense of, well, we're doing digital voting, and I keep hearing that term voter fraud. It's really easy to put those two things together.

Speaker 3: Yeah. Very easily.

Speaker 2: And it's maybe misrepresenting what the actual threat of hacking an election is?

Speaker 3: Yeah. Very much so, I think. Like, I I I'm not gonna say that there isn't voter fraud. Actually, there's proven cases of it. It's just so minor. And, you know, there's always this hypothetical that, like, when I push the HRC or the Donald Trump button on the voting machine, it actually registers as the registers as the opposition candidate or as some statistical anomaly that will not get caught registers. That stuff can totally happen, but it's just you would assume, and I don't have any real deep knowledge of it, but that you would assume that there's a significant set of checksums and checks and balances behind the scenes to make sure that doesn't happen.

Speaker 2: So if you wanted to get around those checks and balances, how would you do it?

Speaker 3: I really have no idea. I can hypothesize at how they could be vulnerable, but only somebody that knows the code that drives them and the architecture of the infrastructure that powers them would have a better understanding. But I assume they have network connectivity, so they must talk to a home base or to a regional server that then aggregates the data and ships it up. So they have to have some form of network connectivity, which makes them inherently vulnerable. I'm assuming that that network connectivity has layers of encryption, layers of checks and balances, layers of, you know, identity verification to make sure that the servers are what they are and that people can't listen in on the communications. Because even if I was able to listen in on the communication and see the language it was talking, I might be able to reverse engineer my own Raspberry Pi voting machine that I can drop into a network at a voting booth without anybody knowing that shoots data. So, you know, the physical access to the machines would be a big thing. So so there'd be because they are a physical thing that requires, you know, digital infrastructure, they will be vulnerable. And it's not just the, like, reprogramming the firmware in them to have them record every forty second red vote blue or blue vote red. It would be more about figuring out how they talk, figuring out when they talk, why they talk, what the checks and balances are, can we trick the checks and balances. You know, there's be so many games. It would be I would love to have one and get to, like, bug bounty it. Like, it would be so much fun. Because I guarantee it's got a vulnerability, and it would be great to get to play with one to see. So if you're listening, voting booth designers, once the election's done, Jordan and I will happily have one and make an entire episode about us tearing it apart and seeing if we can find a bug in it.

Speaker 2: Starting something new isn't just hard. It can be downright terrifying. You put a lot of work into a thing. You're not entirely sure it's gonna work out. You're taking a huge leap of faith. I've started a few things. Now I know I was right for believing in, you know, the idea, the product, despite all of those fears and hesitations. But boy, does it sure help when you have a partner like Shopify on your side. Shopify is the commerce platform behind millions of businesses around the world and 10% of all e commerce in The US. From household names like, well, hacked podcasts merch, to brands just getting started, you can get started with your own design studio with hundreds of ready to use templates. Shopify helps you build a beautiful online store that matches your brand style. Did I mention that that iconic purple shop pay button that's used by millions of businesses around the world? I don't know why I wouldn't. I should. It's why Shopify has the best converting checkout on the planet. It also helps boost conversions, meaning less carts, sort of getting abandoned in the parking lot, and more sales for you. It's time to turn those what ifs into sign up for your $1 per month trial at shopify.com/hacked. Go to shopify.com/hacked. One more time, that's shopify.com/hacked.

Speaker 3: Something that not a lot of people know is that Jordan and I actually both work in advertising now. And the common kind of saying is that there's only two emotions that matter. It's hope and fear. If you wanna make somebody do something, you need to make them believe that what they're doing is for the good and and make them hope in a better tomorrow or make them fearful of a worse tomorrow. You know, the intro story about hacking French media and playing, you know, these scary commercials that scare us to our core and make us fearful are super, super effective at making us change our actions, change our attitudes, change how we believe and how we think. And that's just what's going on. You know? And it's not just one-sided. And this is, you know, what we would call hacking an election. I think political strategists would call good work.

Speaker 2: So at that point, if engaging in behavior that a lot of people would call hacking an election is just good political strategy, how do you hack an election? If you wanna take it one step further, if you want to pull at the seams of something until it works the way you want it to, how do you do that in a world where everyone's already playing that game?

Speaker 3: Yes. Start breaking bigger, badder laws, stealing emails, violating privacy. Like, these are people who already have zero privacy. Like, as secretary of state, every single one of her emails is public record, essentially. So she had a personal email account so that people couldn't read her, like, public emails. That's not illegal. Like, 18 other serious politicians have come out saying that they also have that because they don't want their personal, personal communications on the record. And that's I think once you go into office, you should still be allowed to have some privacy. But that same thing is what's costing people or, like, what's costing them today is like it's like if there is no more lines that you're not willing to step over, if you're willing to put a camera inside someone's home or record their confidential conversations and then air them on public TV and CNN will air them on public TV, Is that good political strategy? Probably. Is it illegal? Absolutely. And that's really where we're at today is that the social side of this is being manipulated and has been for a hundred years. Like, this is not new. It's just that given the new era of the cyber age, we have new ways to violate people's privacy.

Speaker 2: So is this literally just come come down to the fact that we just generate so much more content in 2016 than we did in 1992 that there's there's a lot more stuff that can be kind of thrown out into the limelight?

Speaker 3: Sure. Yeah. On the record content for sure. Like, just think about, like, think about if every note you passed in in junior high was documented, recorded, synced to the cloud, and searchable by the NSA. Like, imagine if your diary was a public blog now. You know, there's there's we're removing the barriers to our privacy as much as anyone else is, but at the same time is that we're still putting a ton of our confidential information and private data into domains where it can be accessed by hackers. And I think that's really the thesis of what's going on in the social manipulation here is is everything that's happening is a violation of privacy, and it is social manipulation. It's social engineering of the election. But it's all coming from, you know, cybercrime. There's no way that John Podesta handed out his emails. He might have, and some trolls speculate he did.

Speaker 2: In the case of Podesta, his emails weren't just vulnerable. They were actually leaked. How do you think that happened?

Speaker 3: Oh, I think they probably my my gut instinct is that he got phished.

Speaker 2: What is phishing?

Speaker 3: What is phishing? Phishing is getting somebody to give you their information without them knowing that they're not giving it to the right person. Does that make sense?

Speaker 2: Yeah. I think so.

Speaker 3: So I masquerade as Google. So, like, I think John Podesta had a Gmail account. I'm not sure. I haven't looked at his stolen emails, but I'm pretty sure it was Gmail.

Speaker 4: This episode is brought to you by Fox one. Watch all 104 matches of the FIFA World Cup live in four k for just $19.99 a month with three days free. Build your own multi view, choose up to three streams, and follow player spotlights. Stay on top of every moment with live stats, highlights, and instant replays. The FIFA World Cup, streaming live on Fox one, offers a subject to change. See fox.com for complete terms and conditions.

Speaker 3: So I make an email look like it's coming from Gmail. It says, hey, sir. We've noticed some suspicious activity on your account. Click here to verify your personal settings. It opens up a new window that says, oh, we actually need you to log into your account. You know, these are advanced recovery options that require you to authenticate into them. He types in his email address and password. We present him with a message that says his email account actually looks okay. Thanks for checking. He goes off on his merry way. We now have his email address and password. That's phishing.

Speaker 2: So you can then log in, you can download all the emails, and then you could leak them out to the world, which is exactly what happened.

Speaker 3: Precisely. Or not precisely. Potentially. Hypothetically. Hypothetically.

Speaker 2: But that's not what happened to Hillary.

Speaker 3: Nobody knows what happened to Hillary. It seems to be wrapped in a constant air of suspicion. Her emails have not been leaked, but there's a lot of insinuation by people like kim.com and the FBI even or a lot of, you know, the Reddit troll world. Sorry. Please don't hate us. That is insinuating that someone is in possession of all of Hillary's emails and they will be coming and that Julian Assange is about to leak them. You know, it's always like it's about to happen, and it hasn't happened yet. So I'm not sure if they actually do exist.

Speaker 2: In your like, just your personal opinion, if you were trying to hack an election, do you think it's more effective to reveal secrets, or is it more effective to manufacture suspicion? Depends how dirty the secrets are.

Speaker 3: You know, if it's, you know, if I go into Jordan Blumen's personal email at Box and find out that he is living a shadow life, and that shadow life is not one that will be accepted by the masses. Is revealing that secret more powerful than creating a suspicion? And I would say yes. And so that's just it is, you know, there's enough suspicions around both Hillary and Donald that revealing any secrets even political strategy like the stuff that people have pointed at in Podesta's emails and been like, oh my god. This proves this. It's just basic communication strategy. Like, it's nothing bad. But the thing is is that when taken out of context and looked at in a specific lens, of course, it looks bad because it's manipulating the public. That is what advertising is. That is what political strategists do. That is what happens to you every time you watch a campaign ad, every time you listen to a speech, every time you watch the debate. They're they focus group, they've tested, and they're manipulating you into believing and feeling fear or hope. And, yeah, I don't even know where I'm going, but it's just it's just the system.

Speaker 2: We, we actually finished recording this episode today on November 7 because we wanted to get it out there before election day. It should be launching tonight, meaning that most of you are gonna be listening to this on November 8, the day that you're hopefully voting. We, Scott and I, don't live in The US. We're Canadian. We are weighing in on an election that is not ours. And while some personal political leanings definitely leaked in the episode, I hope we kept it even handed enough that even if you got the vibe you might disagree with one of us politically, there's still something meaningful for you in the discussion of what it means to hack an election in 2016. Now you guys have been dealing with a really, really, really intense super partisan election, and I think that there's still room for discourse between people that disagree on stuff. And hopefully, this was a cool way in to a topic that, you know, affects everybody regardless of your political leanings. Everyone wants democracy to work properly. And it's important to talk about what it looks like when that fails. We've been gone for a really, really long time for a bunch of reasons. The first is that we're bad at podcasting, but we're trying to get better. And the second is that we've been working on a bunch of stuff for fans of hack that if it goes through is gonna mean that we get to tell way way bigger stories for a much bigger audience. I'm not gonna say what, I won't go into it, but fingers crossed we get to do it and hopefully it makes the giant absence make sense and be worth it. A lot of people have written us with really really kind words about the show, but we definitely heard your comments about the giant gaps between episodes. Right now, we're sitting on two already recorded totally finished intro stories for two upcoming episodes. More on the way. They're really cool topics, much more traditional hacked episodes than this one. If this is your first time listening, we recommend jumping back an episode to get a better sense of what the show actually is. I wanna give a really big shout out to everyone who is stuck with Hacked through this giant radio silence. I promise you we've got some really cool stories from the world of hacking coming soon. I hope you will stick around. My name is Jordan Blumen. And I'm Scott Winder. And this has been Hacking an Election on this episode of Hacked.

Speaker 5: Have no fear. Chosen Foods is here to defend your favorite foods from the forces of seedy oils and sketchy ingredients. With cooking oils, salad dressings, and mayo, all powered by the good fats from 100% pure avocado oil and simple delicious ingredients, chosen foods.

Speaker 6: This podcast is brought to you by Carvana. Selling your car should feel like one less thing on your list, not one more. With Carvana, it is. Just go to carvana.com, enter your license plate or VIN, and get a real offer down to the penny. No back and forth. No surprises. Just an experience you can trust. Like your offer? Accept it. Schedule a pickup, and we'll come to you with a check-in hand. Your car, your timeline, your terms. Visit carvana.com to sell your car today. Carvana. Delivery fees and terms may apply.

Speaker 5: Some days you want a little extra oomph to your usual look. Whether that's lashes for days with the viral liquid lash extensions mascara or awakening your eyes with a lasting lift and soft color with the brilliant eye brightener, Thrive Cosmetics is your go to when you want to amplify your everyday look. Whether you want a simple, just got to get out of the door routine or full glam, You'll always look and feel like the best version of yourself with Thrive Causemetics. Plus, every product is 100% vegan, cruelty free, and made with clean skin loving ingredients that work with your skin, not against it. And for every product purchased, Thrive Cosmetics donates to help communities thrive. So every time you use your favorite Thrive Cosmetics product, you're helping communities you care about too. Amplify your everyday. Go to thrivecosmetics.com/shine26 for an exclusive offer of 20% off your first order. That's thrive cosmetics, c a u s e m e t I c s dot com slash shine twenty six.