A Deep Dive on Vulnerability Disclosure in the Election Sector
Tod Beardsley examines the cultural shift in election vendor vulnerability disclosure, tracing progress from adversarial hostility to coordinated CVD programs.
Summary
The Evolution of Election Sector Coordinated Disclosure
Since the inaugural Voting Village at DEF CON 25, the relationship between independent security researchers and voting machine vendors has undergone dramatic transformation.
From Hostility to Structured Bug Bounties
Tod Beardsley traces how private election services providers shifted from legal threats and denial to adopting ISO-compliant Coordinated Vulnerability Disclosure (CVD) policies.
Navigating Legal and Operational Vulnerability Pipelines
Beardsley analyzes the role of the CISA Vulnerability Disclosure Policy (VDP) and third-party coordination platforms in mediating voting machine CVE disclosures.
Institutionalizing Independent Security Auditing
The presentation provides recommendations for embedding continuous vulnerability research and bug bounty programs into state procurement contracts.
Related talks
Voting Village·15 min
Miracle Owolabi
Advocates for expanding legal safe harbor protections for election security researchers globally, drawing on lessons from research barriers in Nigeria.
Aerospace Village·30 min
Matt Gaffney
Matt Gaffney recounts reporting critical vulnerabilities to aircraft manufacturers, analyzing why safety arguments are required to prompt aviation remediation.
Voting Village·44 min
Moore · Young · Baggett
Applies the military CARVER targeting and vulnerability analysis matrix to evaluate systemic risks and physical attack vectors across the US election system.