Preet Bharara:

From Cafe and the Vox Media Podcast Network, welcome to Stay Tuned. I’m Preet Bharara.

Chris Krebs:

You have election deniers, stop the stealers, running for secretary of state in Georgia, in Arizona, in elsewhere. And you’re putting them in a position if they’re elected to actually have the pen on certifying results. What’s going to happen in ’24?

Preet Bharara:

That’s Chris Krebs. He’s the former director of CISA, the Cyber Security and Infrastructure Security Agency at DHS. CISA was established in 2018 and as director, Krebs dedicated much of his time to strengthening the physical and cybersecurity of America’s voting systems. He also spoke out against election related misinformation which ultimately cost him his job. In the days after Joe Biden was declared the winner of the 2020 election, Krebs testified before the senate.

Chris Krebs:

The 2020 election was the most secure in US history.

Preet Bharara:

He was fired by former president Trump who was then in the early stages of perpetuating the big lie. Now he’s a founding partner at the Krebs Stamos Group. A firm that helps companies and organizations navigate threats to cybersecurity. Krebs joins me to discuss the great Facebook shutdown of October 2021, election security, and why voting by phone might not be such a great idea. That’s coming up. Stay tuned.

Preet Bharara:

It’s time for some listener questions. This question comes in an email from Becky who asks, “Are there any tea leaves to be read from the news that Joel Greenberg, representative Matt Gaetz’s former associate, has asked a federal judge to delay his sentencing? What kinds of information could he be providing to prosecutors?” Becky, that’s a good question. People will remember that Joel Greenberg is someone who pled guilty to a series of crimes. He faces a mandatory minimum sentence of 12 years in federal prison but he appears to be cooperating. In fact, we know he’s cooperating because it has come out in court proceedings. The significance of cooperating and providing substantial assistance with respect to investigations of other people, including representative Matt Gaetz, is pretty much the only way that Greenberg can get out from under the mandatory minimum sentence of 12 years. Now, what’s interesting is the timeline here. At one point Greenberg was scheduled to go to trial. On the eve of trial he pled guilty. And then after you plead guilty to a crime in federal court you get a sentencing date scheduled. And once upon a time that sentencing date was August 19th of 2021. In advance of that sentencing Joel Greenberg in consultation with prosecutors and in agreement with prosecutors as for an adjournment of that so he could continue to provide substantial assistance through cooperation. And we’ve seen that happen a second time now.

Preet Bharara:

So instead of a sentencing taking place November 18th of 2021 they’ve asked for that to be adjourned now to March of 2022. Now, that’s not at all unusual in situations of cooperation. What it means is prosecutors seem to be happy and satisfied with the information that Greenberg is giving them probably with respect to Matt Gaetz. Does that mean there will definitively be a prosecution of someone else, Gaetz or anyone else, based on the cooperation of Greenberg? Not necessarily. But I will tell you based on the multiple adjournments and the amount of time that has passed and prosecutors seeming happy to see what’s going on, the likelihood is quite high. People might be asking, what takes so long? The witness comes in, tells what he knows about someone else and that’s that. It’s not always so simple as that. Sometimes the information is complicated. The most important thing you need with a cooperating witness, especially someone like Joel Greenberg who is himself someone who has credibility problems and has pled guilty to his own crimes, is corroboration. And corroboration sometimes takes time. So for example a cooperating witness like Greenberg might say something about a financial transaction or about a meeting or a communication and it might take prosecutors some time to subpoena and find those communications to corroborate what Greenberg is saying.

Preet Bharara:

So I suspect some combination of the volume of information being provided and the need to meticulously corroborate that information is what’s leading to the delay. Bottom line is, bad news for Matt Gaetz.

Preet Bharara:

This question comes in an email from Surge who asks, “Were you surprised by DOJ’s announcement that it is reviewing its decision not to prosecute the FBI agents who botched the Larry Nassar investigation? Have you seen something like this happen before?” Of course Surge is referring to the disgraced former USA Gymnastics doctor who sexually molested and abused hundreds of his patients, some of whom were world famous gymnasts. As you may recall from Stay Tuned and from other sources, on two separate occasions both when Donald Trump was president and then again when Joe Biden became president, the Department of Justice made a decision to decline prosecution with respect to two FBI agents who were excoriated in an inspector general report that basically said the FBI botched the investigation of Larry Nassar. Complaints where made to particular FBI field offices. Information wasn’t shared. And then more ominously, it was alleged in the IG report that the FBI agents made false statements in connection with their investigation and that can lead to criminal prosecution. So lots of people including Senator Blumenthal of the judiciary committee have been quite critical of the department wondering why it is that there hasn’t been a prosection, why it is that there was that declination.

Preet Bharara:

Now, as you also may know from hearing me talk about legal cases over the last number of years and from reading my book, Doing Justice, it is a difficult thing to explain why you decline to prosecute a case. There are also circumstances in which given the lack of public faith and the concern that Americans may have that maybe there was a declination because of a too close relationship with respect to a component of DOJ itself. Maybe the declination of prosecution wasn’t in good faith.

Preet Bharara:

Now I doubt that’s the case but that’s a concern people have. Lisa Monaco my friend and our former colleague, both in the justice department and at Café, the deputy attorney general came before the judiciary committee and revealed that there hasn’t been apparently a final, final decision not to prosecute those agents and that new information has come to light and the investigation is ongoing and continues. That does not mean that DOJ will make a decision to prosecute them but it means that it’s still a possibility. What I find kind of interesting about that is generally speaking DOJ does not make pronouncements about investigations that are open and that are not completed. But I take it here given the totality of the circumstances, the concerns that senators and ordinary people have had about why DOJ declined prosecution that she made in her discretion the decision to have more transparency with the committee and with the American public. And I think in these particular circumstances that’s a good thing and we’ll see what happens.

Preet Bharara:

This question comes from Twitter user @AdamTravisG who asks, “Do you care that Facebook was down?” Answer, no. Well, look that’s speaking for me personally. As you’ll hear in my interview with Chris Krebs it does pose a question and it causes people to wonder whether a very significant corporation, whether you like Facebook or not, millions and millions and millions of people rely on it. They rely on applications that are owned by Facebook including WhatsApp and Instagram. WhatsApp in fact as Chis and I discuss is the necessary tool of communication for many people in many countries in the world. And you wonder how vulnerable a monolith like Facebook is. That causes a concern. Is it too big? But we’ll get to that in the interview in a few minutes.

Preet Bharara:

Stay tuned. There’s more coming up after this.

Preet Bharara:

My guest this week is Chris Krebs. He was the director of CISA. An agency focused on cybersecurity at DHS. He was fired by Trump after establishing that the election was not in fact rigged by widespread election fraud. Now he’s a founding partner of the Krebs Stamos Group consulting on issues of cybersecurity of which there are plenty. Chris Krebs, thanks for joining us on the show.

Chris Krebs:

Hey Preet. Thanks for having me on.

Preet Bharara:

I understand you’re in Vegas. You’re going to violate the principle that what happens in Vegas stays in Vegas because this is all being put out wide distribution. So sorry about that. Any confession you want to make?

Chris Krebs:

No. No. No. It’s all normal here in Vegas which is really surreal. But it’s funny, I saw you in LA last week. This is I think the fifth or sixth week on the road and most of them have been west coast trips. So like road warrior status is … Achievement’s unlocked and here we are back kind of almost pre COVID.

Preet Bharara:

Is everyone wearing a mask at the blackjack table?

Chris Krebs:

Oh yeah. So at the Mandalay at least the security teams were pretty rigorous. If you’re on the casino floor at least for the less than 60 minutes I was on the floor last night-

Preet Bharara:

So you say.

Chris Krebs:

They were enforcing mask rules. Hey, I had a keynote I had to give this morning and it was my first keynote in like a year and a half two years. And I was like, do I remember how to do this? No guard rails.

Preet Bharara:

Would it help if you had a laptop in front of you and just look into the cam?

Chris Krebs:

Oh no. I can’t. First off, nobody wants to listen to a single individual spout off for 30 minutes.

Preet Bharara:

Except on this podcast.

Chris Krebs:

This is like a fireside chat where it’s engaging, it’s back and forth.

Preet Bharara:

We’ll see about that. That remains to be seen.

Chris Krebs:

But like a person sitting there on a screen. So anyway.

Preet Bharara:

So we’re recording this on Tuesday afternoon, October 5th. And I guess I need to ask you, given the events of yesterday, did you miss Facebook for the many hours it was down? Did you get along without it? Did you survive?

Chris Krebs:

So I was actually on a plane. I had wifi connectivity so I kind of saw this spiraling out over another social media platform, Twitter. But it was pretty surreal. Particularly if you think about the events of Sunday evening and 60 minutes and the whistleblower.

Recording:

The thing I saw on Facebook over and over again was there were conflicts of interest between what was good for the public and what was good for Facebook. And Facebook over and over again chose to optimize for its own interests like making more money.

Chris Krebs:

But to see this platform, Facebook, Instagram, WhatsApp and then kind of the third party dependencies they have across the eCommerce community and then their identity authentication measures, it was crazy to see the impact on the global internet ecosystem.

Preet Bharara:

As someone whose expertise is in among other things cybersecurity, do you immediately think when something like that happens that it was nefarious and there was some bad third party actor?

Chris Krebs:

Yeah. So first off, I’m paranoid. I think you kind of have to be paranoid to be in these jobs and be successful. In fact, I had a nickname at DHS at least in the early days with some of the leadership there. My nickname was Catastrophic Krebs.

Preet Bharara:

That’s long for a nickname.

Chris Krebs:

Sure. Yeah. But you see these things happen and first off, it’s too coincidental. It happens just after … Is there some sort of insider risk or something like that? But you really have to be disciplined here, particularly in leadership positions where you have a voice, and not throw kerosine on a smoldering or full burning fire because that can lead to a lot of unnecessary panic. But for sure there was the nagging thought in my mind that maybe somebody was disgruntled. Maybe somebody saw the 60 Minutes piece and wanted to kind of shut Facebook down off the internet. But like always there are a couple of key pieces of internet infrastructure and its domain name system and border gateway protocol. Just the way that the routing across the internet works. Facebook jacked it up with an update and then they couldn’t fix it because they were all remotely deployed.

Preet Bharara:

Your best assessment is it was not nefarious.

Chris Krebs:

Oh no. Whether you believe them or not, they issued a statement. One of their people issued a statement this morning and said no, it was not malicious. It was not nefarious. Again, they had their team distributed working remotely. They pushed and update to the system and that broke the remote connection. So they actually had to … From what I understand … This is rumor mill here. But they had to send a team to a data center and then because the Facebook communications enterprise and the way that they use their badges to badge into the conference rooms and data centers, that was broken too. So they had to actually bring an angle grinder to saw into the data center to get access to manually update the system. So it was just a catastrophic failure.

Preet Bharara:

Catastrophic Krebs.

Chris Krebs:

There you go.

Preet Bharara:

There was a lot of joking about Facebook being down. And then you realize that among other properties Facebook owns WhatsApp. And in a lot of places in the world including the country of my birth and Israel where I traveled and Palestine, it’s basically the essential mode of communication for people among their friends, family, coworkers. I mean it sort of functions as a utility. Does the fact that all of that can go down so easily based on an error give you any thoughts or pause about the size of Facebook and the ways in which people should communicate and diversify?

Chris Krebs:

I think we got to separate a few things here. But to your point about WhatsApp, the thought immediately crossed my mind, that’s how I communicate with a bunch of friends that are in the UK for instance and Singapore and to your point, Israel. It is one of the most stable broadly used effective communications platforms whether you use other things.

Preet Bharara:

Well because it’s free. People often ask, why use WhatsApp, why not just text? In lots of places in the world for the consumer at least certain apps are free and texting may not be.

Chris Krebs:

Right. The other issue with texting is that it goes over the telephonic infrastructure, the telephony infrastructure and therefore it does not have an … As a former prosecutor I’m sure you were dealing in the encryption debates. But WhatsApp and Signal and others have that encrypted capability that allows for more private conversations particularly when you’re talking about some of the countries out there that don’t have the civil liberties and privacy protections that we have here. It’s a good way to get past some of the authoritarian surveillance regimes that are in place.

Preet Bharara:

So what’s the solution there?

Chris Krebs:

The solution is keep a platform like WhatsApp up and running. But to your bigger point about is there a too big to fail here? I think from a technology perspective I think we’re well past the moment of fully understanding and addressing systemic risk based on the various technologies and services that we use. Whether it’s a cloud infrastructure that 100% of the federal government runs on for Microsoft or an authentication measure that runs in small and medium businesses like Facebook. A lot of people probably couldn’t log into whatever their newspaper of choice is because a lot of that log in is enabled through things like Facebook. And so it’s a really disruptive cascading effect and we think about product features and ease of access rather than what happens when this thing breaks? What’s my fail over? What happened to the people that only or primarily communicate by WhatsApp? They couldn’t do anything for six hours yesterday so we have to think about that both from an organizational and infrastructure resilience perspective but also a personal resilience perspective.

Preet Bharara:

Yeah. And look, this time it was six hours. Makes you wonder, what if it’s for three days? What if that’s how businesses take appointments in their communities? It’s a huge rupture to the normal process so I think you’re right. So your area of expertise covers a lot of different discrete things. And since we don’t have hours and hours and I could talk to you for hours and hours, what I think is maybe the most salient thing to talk about … I know this is close to you given what you did before and what you continue to do now, and that’s election security. So very famously after the 2020 election when you were still in the government’s employ, you said that the 2020 election was “the most secure in American history”. And I know you’ve talked about this a lot but I want to ask you for my listeners, why did you feel compelled to make that statement?

Chris Krebs:

It’s funny you frame the question the way because I was just looking back over something that somebody had sent me a tweet earlier today. And I said something to the effect about a little over a year … A little under a year ago rather that it was based on the work that we did at CISA. The Cyber and Infrastructure Security Agency at the Department of Homeland Security that was the lead for election security working with state and local partners that under the constitution as we’ve heard ad nauseam over the last year are responsible for administering elections. We knew the work we had put in over three and a half years. And here’s just a quick metric. In 2016 less than 80% of votes cast in the presidential election had a paper ballot associated with it. Which paper give you the ability to go back and audit. Like a real audit. Like what they’ve done in Georgia and Pennsylvania and Michigan not the fake thing they just did in Arizona. But a real legitimate audit and recount and make sure you’ve got the right count. So that was less than 80%. There were some systems that don’t have any paper trail at all that make it really complicated to audit and therefore really convincingly from an evidence based perspective demonstrate that there was no manipulation or hacking into that system. And those systems were in 2016 in Georgia. Notably in Georgia and Pennsylvania.

Chris Krebs:

So in the intervening three and a half, four years from ’16 to ’20, that number of paper records associated with the vote when up to about 95%. Now, part of it was due to the increase in mail in ballots. In fact, the entire state of New Jersey when to mail in. But specifically two states, Georgia and Pennsylvania, swapped out those old electronic only machines to machines and equipment that used a paper ballot or scanned a paper ballot. That alone shows that we had confidence in the processes and we had the ability to go back and count it time and time again. And then there’s all the other Department of Defense, intelligence, community, law enforcement stuff.

Preet Bharara:

So I get all that and that’s a good justification for the statement but let me ask again, why did you feel the need to make the statement?

Chris Krebs:

That’s two different things, right?

Preet Bharara:

Yeah.

Chris Krebs:

I had the confidence to make the statement in part because of that increase in paper ballots but also the stuff that I knew the Department of Defense was doing and the intelligence community. The eye of Sauron. They were out there looking for interference from Russia and China, Iran and others. We had a good sense of what they were going to do and what their decision calculus was doing. But the reason we made the statement is because we anticipated initially adversaries, Russia, China, Iran and others, to try to discredit the processes and claim absent any legitimate evidence that there was a manipulation or some other sort of bastardization.

Preet Bharara:

Wait, I’m sorry. Your initial thought was that foreign parties would cast its versions on the security of the election?

Chris Krebs:

Yep. Preet, this is the lead up. The planing factor … The planning-

Preet Bharara:

This if I’m clear, you made that statement not in response to an inquiry or a letter from congress. That was a unilateral expression of confidence in the integrity of the 2020 election. Is that right?

Chris Krebs:

Yes. Yep.

Preet Bharara:

So the next question is, because we know what happened after this and I’d like you to recount some of the immediate history after you made that statement, were you surprised in any way given what you just said that actually the people casting aspersions on the security … Not just the security but the fairness and the integrity of the election came from Trump followers and supporters?

Chris Krebs:

No. No. Not at all. Let me kind of separate out two things here. First is at CISA we were focused on the technical challenges associated with administering a safe and secure election. Planning factors as I mentioned over three and a half years. Developed countless scenarios on what could be done by a bad actor to get in the middle of the process and disrupt it. We worked through all these things. And that was both on the technical cyber side as well as disinformation. The perception hacking process. But ultimately when you play out those scenarios they’re readily applicable to domestic actors as much as they are foreign actors. So again, we were focused on the technical challenges. But now where I am on the outside and I can sit back and look a little bit more at the structural and systemic issues at play here, no. All the telltale signs were there in 2016 with claims of a rigged election. So this was imminently predictable. In fact there were groups that saw this coming and helped prepare for it.

Preet Bharara:

Did you anticipate that Donald Trump himself would be angry about the statement?

Chris Krebs:

Sure. Right. His campaign, his lawyers, a bunch of his supporters, his advocates, his proxies were all talking about how there was massive fraud in this state or that state. Their favorite kind of fallback is they were just asking questions. It was critically important that the people that know how elections work and those state and local officials who joined in on that statement by the way … They’re actually the ones that drafted and initiated it. I just repeated it and retweeted it. It’s important that those that have that firsthand experience with the process were the ones saying, “Look, here’s the ground truth. Here’s what’s happening out there.” So as to whether I was surprised that the former president was upset by it … You know.

Preet Bharara:

Were you surprised? I’ve shared some of this experience. Were you surprised that it seems to have been the reason for your firing?

Chris Krebs:

No. I was shocked in the moment but not overall surprised. There’s a certain philosophy where if you accept your mortality you make a different set of decisions.

Preet Bharara:

What took you so long to get fired? Some people manage to accomplish that in seven weeks.

Chris Krebs:

I know. It’s like I’m almost talking to someone that pulled that off. We were just focused on the mission. We didn’t get engaged in politics and we had a … We generally approached things … Not generally but universally approached things in a bipartisan or even nonpartisan manner, whether it was cybersecurity in general or election security. I told the team … So this is CISA and as we were running up to the election I think there were a lot of nervous people like what’s going to happen if we get kind of under the thumb of the White House? And I said … There are kind of two things or at least my management philosophy was, “For this agency, for CISA to be successful there are five P’s that we need to focus on. People, policy, programs, public affairs and politics.” And I said, “That last P politics, actually that’s not your problem. That’s my problem. So you guys worry about the first four P’s and I’ll worry about the fifth P.” And I think that gave some comfort to the team that as a senate confirmed director of an agency that I was looking out for and that we were going to get the mission done.

Preet Bharara:

There’s some disconnect it seems when we talk about election security, integrity, whatever phrase you want to use. There’s a disconnect between the way that the world seems to be moving in modern life which is increasing technology, digital technology, using your devices. Entering the COVID pandemic, I’ve taken to using Apple Pay, contactless. I don’t take the receipts because you’re worried that … At least in the early days, should you be touching something that was touched by someone else? But in the voting and election universe it seems like for various reasons which it would be wonderful for you to go through them and explain, we’re going in the opportunity direction. We’re going more and more away from technology. Perhaps in part because that’s the way that people will get comfort. We’re doing things in the same way we did them 100 years ago. Paper ballots, et cetera. But that’s what gives them confidence when in other areas of modern life moving in favor if technology and away from paper. Does that make any sense?

Chris Krebs:

No, it absolutely does. And I think there’s a key difference here between voting where you’re ensured a secret ballot where whom you voted for can’t be traced back to you and the flip side of technology is your bank account for instance where you’re seeking an immutability of the transaction. And this is everybody was like, “We need the blockchain.” I was like no. Look. The whole point about online banking for instance is the bank knows exactly how much money you have and what transactions you’re making. And they tie it back to you uniquely with an identifier. That is not how elections should work under the current tradition of a secret ballot. And that’s why I am convinced that we are probably decades away from any sort of meaningful deployed at scale digital voting technology like mobile phones. And the other thing is look, it’s also … It limits access. Because yes, you and I might have access to the latest iPhone with super security features but there are a lot of people out there that aren’t even on secure phones, that use flip phones. There are actually members of congress that still use flip phones.

Chris Krebs:

There are marginalized communities that just don’t have access to the same technology. So whatever we do here we need to make sure that there’s a level playing field and make it easy to vote.

Preet Bharara:

Is the biggest issue at this moment then not necessarily how the voting takes place on election day or the days leading up to election day if there’s early voting, but the ability to audit later in a way that will convince people who are increasingly suspicious of elections that the election was kosher?

Preet Bharara:

I didn’t mean to provoke that sound.

Chris Krebs:

It just drives me crazy because everything you’re hearing in the aftermath of the Arizona “audit” here where you’re seeing it between Georgia trying to audit the ballots in Fulton county, the four counties in Texas, these requests for audits in Florida, Michigan, Pennsylvania, it could go on. There are best practices. There are standards. There are professionals that conduct and administer post election audits already and they do it in a transparent way with bipartisan representation. They aren’t from obviously biased contractors that make up their processes on the fly and don’t provide meaningful access and transparency for the state. There are processes. Stop calling these stupid things audits. They’re not. They’re partisan inquests at best.

Preet Bharara:

Yeah. But the question remains. In other words, you have an undeniable trend now, not put words in your mouth but I’ll speak for myself, of people like Donald Trump urging on his supporters not to believe any election result that was adverse to him. So you have increased … I’m not saying it’s legitimate and I’m not saying it’s not in good faith. You have increased suspicion and disbelief in election results that are unfavorable to Donald Trump. That is going to be true in 2022, in the midterms, in 2024. And given that rise in suspicion whether it’s good faith or well founded or not, does that to your mind necessitate some different way of dealing with elections and election security in the future? Which is not an issue of technology and integrity per se but it’s about dealing with the citizenship problem we have were people just don’t want to believe you. You go and you cash your ballot. They say, “I don’t believe you. Where’s the proof? Where’s the proof? Where’s the proof?” Does it necessitate a change?

Chris Krebs:

Look, I think we’ve kind of lost our way from a civics education perspective. And by the way, I’m not naïve enough to think that this is going to fix everything. I’m just kind of giving some of the context I think for why we’re where we are. So just civics in general have fallen off the books. People just don’t engage with their local officials. And so we’ve got … And we’ve somehow arrived at a point where everyone believes and part influenced by the president, the former president rather, saying the voting should be done that night and all the counting should be done the night of the election. Which is not nor has it ever been that way. Mail in ballots, overseas ballots from service members, they come in after the election day. So I think for one we’ve got to be back to the basics of communications and education and I think this past election has really opened the eyes of a lot of election officials on how they need to be much more proactive, much more aggressive on the mechanics of voting and what the timelines look like. So I think that’s step one. Step two is continue to push towards eradication of those machines that don’t have a paper trail. And then full 50 state plus territory, post election pre certification audits that will, again, establish the facts of the election and that the initial count was consistent with the ultimately certified count.

Chris Krebs:

I think those are just two quick steps. But the third … Look, the biggest problem here to your point is the former guy. Former president Trump continues to baselessly promote these conspiracy theories that there was a … And look, he’s not the craziest about it. I mean Sidney Powell’s stuff is out of control. This is a steady state. He goes-

Preet Bharara:

Lin Wood. By the way Lin Wood is not making waves by saying outright and in public that 9/11 was staged.

Chris Krebs:

He’s a truther. Right. But look, ultimately I think that’s going to agitate and activate the fever swamp. We have to kind of assume that a non zero percentage probably closer to 20% if not slightly more of the American population are just irretrievably gone. They will not accept fact.

Preet Bharara:

It might be a lot more. I mean this is the problem Chris. It used to be the fever swamp folks were a small percentage and for good or ill depending on your perspective maybe they didn’t have a lot of political leverage. But I’ve seen some polls, I don’t have it front of me, that suggest that 70% of republicans … And I don’t know what percentage of the whole population that is, but 70% of the republicans believe that Donald Trump won the election. So now you’re starting to get into crazy numbers. And I don’t know that that’s going to abate anytime soon. And I guess one of the things that you and I are talking about is how through procedure and process and technology and election voting systems do we begin to eat away at that and erode that lack of confidence? Maybe it’s not possible. Are you optimistic?

Chris Krebs:

I think we can round the edges off. I think we have to continue pushing through like I said on the technology side and on the practices and the communications and the transparency side. But what’s really so upsetting to me is that there are kind of like four levels of government involvement with election administration and election confidence. It starts down at the state and local level and the legislatures. And I think that’s where you’re really starting to see things unravel like some of the state senators in Arizona. Some of the state officials or elected officials in Texas and elsewhere. It’s politically advantageous for them to promote this garbage because it activates their base. They get fundraising. They get voters. And that kind of like … That illiberal political cynicism we’ve got to figure out a way where that doesn’t work in their favor anymore. My hope is that just the general voter will recognize it for what it is. The second level is those folks that are elected into the executive branch at the state level. So secretaries of the state for instance. You have election deniers, stop the stealers, running for secretary of state in Georgia, in Arizona and elsewhere. And you’re putting them in a position if they’re elected to actually have the pen on certifying results. What’s going to happen in ’24?

Chris Krebs:

And then you start leveling up to the federal level and you’ve got the congress where you continue to hear from … Particularly in the house. Though I am concerned that there’s some more radical types that may be successful in a senate seat. But you have members of the house that push this stuff. So it’s really a layer. There’s no single solution here. What particularly makes it complicated at the federal level, particularly with the elected officials and serving in the house, is the speech and debate clause. They hide behind that. And it makes it really hard other than every two, four, six years to hold them accountable for the things they say.

Preet Bharara:

We’ll be right back with more of my conversation with Chris Krebs after this.

Preet Bharara:

Hearing you talk, it occurs to me … This is true in other contexts as well. Do we have too many election systems? I’m not sure it can be changed. The constitution leaves time, place and manner, the setting of elections to the states so that’s the federal system that we have. Would it be easier if all the states and localities had a common set of principles about voting and mechanism for voting? How much does that play a role in confusion and in suspicion?

Chris Krebs:

So there are set of general timelines they have to meet under federal law and statute. Seating the electoral congress all the way back through certification and safe harbor deadline of December 14th or whatever it was this past year. But from a tactical operational boots on the ground administering elections, it really does depend … State by state. If you’ve seen one state’s requirements for elections you’ve seen one state. And it’s based on geography, on rural communities, about urban density. Trying to administer election in a highly rural or even just like Oregon for instance is going to be so much different than Rhode Island or Massachusets. So I’m not convinced that there needs to be a single approach to election administration in the US because I just don’t think it would work. But we certainly need much clearer guidelines on technology. We need more stringent cybersecurity requirements out of the election assistance commission and some of the certifications that they issue for equipment. This really just comes down to … It’s like we’ve got to be able to penalize and hold accountable those that spread nonsense and lies about the outcome of an election.

Preet Bharara:

And hopefully we can do it in someway other than companies who work in elections and make machines suing for defamation right?

Chris Krebs:

It takes too long.

Preet Bharara:

Seems not to be the best way to regulate.

Chris Krebs:

This is actually one of those things I think we as kind of an election security and administration community need to take a hard look at some of the lessons learned from the 2020 election. I’ve talked to the dominion folks about this. What other legal remedies were available to them in October or November where they could have sought some sort of injunctive relief against some of the people that we’re talking about dead Venezuelan dictators that had compromised their systems?

Preet Bharara:

But it’s fraud to do that. I mean they’re not DOJ and DOJ has prudential rules and policies on this and guidelines. But it’s still pretty fraud for a company like Dominion to be bringing preemptively some big hype lawsuit in the days leading up to an election don’t you think?

Chris Krebs:

No. You’re absolutely right. But I think we have to kind of test these waters. But look, so they have filed suit against various individuals associated with the campaign, media outlets. Some of the individuals are judgment proof. Like they’re not going to get any money out of some of these people. But even if they do get to a resolution and they have at least verbally indicated that they’re not going to settle, that they’re going to take this to the very end, that’s two plus years out maybe. And by the then the damage has been done. They’ve already talked about in some of their legal filings about how they’ve lost contracts at the state or county level because the election officials are scared. Because they’re like our people aren’t going to vote if they see Dominion because they bought that bill of goods that the former president and his acolytes were selling.

Preet Bharara:

Let me try to ask a question whose answer maybe is implied in what you’ve been saying but let me ask it in this way. Is there a system that can be devised for voting in any particular jurisdiction that is human proof? In other words, is every system of voting ultimately going to be reliant upon the good faith and integrity of the humans whether that’s election officials or the secretary of state or the state legislature? Is it ultimately going to depend on the good faith and integrity of those people or can you do something to insulate from those people?

Chris Krebs:

From a practical perspective, you want to eliminate single points of failure as much as possible. And there’s a concept in election administration as it relates to technology of suffer independence. And basically that means you never want software or hardware to be a single point of failure in your election process. That you have redundancies, that you have checks and controls throughout the process front to back that will either identify, detect, mitigate or just flat out stop any sort of compromise of the system. That goes from a policy perspective as well. We have checks and balances throughout the process at the state level and at the federal level I think they keep us from having to be highly reliant upon a single individual like the vice president of the United States counting the slates or whatever. I think those processes are in place. I just don’t know if we … The biggest problem here is that the big lie about how the election was stolen, all the things that could have been done in the Eastman memo and elsewhere, they never had to worry about being accurate or truthful or actually having the law on their side.

Chris Krebs:

Garry Kasparov has talked about this but it’s the flood of lies. It’s asymmetry. They’re not trying to win you over. They’re trying to get you to lose the perception of what’s real and what’s true and if they do that you’re a lost cause.

Preet Bharara:

So I think your answer to then is … Which is disturbing but not unexpected, is that we can focus a lot on policies, on rules, on statutes, but if the folks who are responsible at the end of the day for saying yay or nay are not good people we’re going to have a problem.

Chris Krebs:

That’s how it’s always been.

Preet Bharara:

I say that it seems obvious. But I feel like that’s a missed point for some folks.

Chris Krebs:

Yeah. I mean the reason we’ve gotten as a country 250 some odd years down the road is because we had good faith actors for the most part for the majority of that time. Yes, there have been some free radicals and those that were of a more illiberal approach or viewpoint. But it’s really disconcerting kind of this orthogonal departure from liberal democracies that we’re seeing out of a pretty significant chunk of the republican party right now and that-

Preet Bharara:

There used to be less kraken.

Chris Krebs:

Yeah.

Preet Bharara:

There was less kraken. I think that’s the solution. Less kraken. I know what your answer’s going to be but I want you to flesh it out a little bit more because a particular technological leap has been suggested by a number of people but included among them is Andrew Yang. Formally ran for president. Formally ran for mayor of New York City. Who said, “Wouldn’t it be great if we could vote from our phones?” He tweeted that. Your response was-

Chris Krebs:

Danny Davito.

Preet Bharara:

The equivalent of an eye roll. Representative Eric Swalwell also got into the mix saying, “Wouldn’t it be great if we could figure out a way for people to vote on their phones?” Could you be specific as to why that’s a bad idea in your view?

Chris Krebs:

Look, I get the interest and the willingness and the kind of excitement about like can’t we just do this technology thing? We’re the most technologically advanced society on the face of the earth. But again, the technologies that we use today for banking and other online transactions are not set up for, again, the concept of a secret ballot. There’s metadata. There’s so many other indicators and little pieces of digital exhaust associated with how we operate that ultimately A, would kind of do … Not kind of but would make it really hard to do a secret balloting process. And then-

Preet Bharara:

Can I ask you a question about that? Because I don’t understand the technology as well as you and other people. I mean, anonymity is needed for many things that we do including electronic medical records. And maybe this is a terrible analogy but we do accept some risk that those things can be hacked and it would be embarrassing for large populations of people. But as we get further in the modern world and for ease and for treatment purposes particularly in a pandemic we’ve seen a rise in electronic communication of medical information. Protected sensitive health information. How is voting different from that? Maybe that’s a silly way of putting it.

Chris Krebs:

Well look, any way you cut it some healthcare provider still has your records, your name and your medical history on it. So let’s put this into a practical context. So let’s say we use some sort of digital voting that associates your identity even if it’s a unique identifier that could potentially down the road be tied back to you but they have your voting history. And let’s say you trust … Going back to your point about human proofing. You may trust the secretary of state today but what if some nut job gets elected in there and then they have the ability to look up your voting history and actually not just if you voted but whom you voted for down the slate.

Preet Bharara:

And there’s a market for that. There’s a market for that information.

Chris Krebs:

Well, not just from a campaigning perspective but also don’t discount the fact that political retribution is a possible thing. I mean, it has happened before. Not just here but obviously elsewhere. Again, as long as we’re committed to a secret ballot system there are ways to do this where using physical media, physical format media paper that is, that can separate the identity from the vote. And yes, there are likely ways to do this with technology. But the instillation base. So that means that the 330 million or however many eligible voters that are out there in the United States will not have the same access to the technology needed to do this in a secure way. Maybe 10% would. And that is not for nothing.

Preet Bharara:

And am I correct that no voting system that aspires to be safe and have integrity should be hardwired to the internet?

Chris Krebs:

That’s absolutely the best practice. I think the election assistance commission has some guidance on that. CISA has some guidance on that. My old agency has some guidance. But yeah, you don’t need to be connected to the internet. There’s no requirement for most applications. Certainly for the voting machine that you cast your vote on there’s virtually no scenario where that would be useful. There’s arguments on the tabulator side where you want to be able to modem out the unofficial results. And that’s why, again, it’s important to have paper. Because even if there was a connection and even if there was an attempted intrusion or a successful compromise, you still have the paper records that you can go back and audit over and over. Georgia they counted three times. Three times. And guess what-

Preet Bharara:

Hoping it’s going to be different.

Chris Krebs:

They were consistent. So I think that’s the part that’s, again, so critical. The ability to conduct evidence based elections to maintain confidence. It has to be the first imperative.

Preet Bharara:

So last question on this and then I want to talk about some other stuff. If you could start from scratch or build an election system in a state, Catastrophic Krebs, all you, what are the main principles and mechanisms that would make it in your mind not just the safest and most secure but be perceived to be the safest and most secure?

Chris Krebs:

Well, there’s a difference here between in practical terms what is safe and secure and then what the narrative has developed around of safe and secure.

Preet Bharara:

Both are important. That’s why I keep asking both. Because it matters.

Chris Krebs:

Yeah. I think just from a practical perspective it’s maximum paper with very, very clear and effective ballot design. And that’s something that we tend to not talk a lot about. Not all ballots across the country are designed and configured the same way. That’s even at the state level, at the county level. You can have precinct level differences. School boards, you’re voting on the same ballot, at least in the commonwealth of Virginia, same ballot maybe on the back side that you’re voting for the president. And that’s going to change. It’s really about good practices on designing the ballot, having very clear processes for how they’re getting counted, good chain of custody, post election audits, risk limiting audits. Scientifically based audits to confirm the outcome before certification. So it’s not after but it’s before certification so you can confirm. And transparency in the canvasing process just to make sure that you’ve done the things properly to ensure that every person that was registered and eligible to vote was able to do so and that there are no sort of departures from the norm. Now, that’s different though because now you hear all these things about how mail in voting is susceptible to massive voter fraud despite all the available evidence and the additional controls that are in place where hey you can request a ballot but you may not use it. You can go in and vote in person.

Chris Krebs:

And then they’re just signature verification and all those other things. We’ve lost the narrative through that flood of lies about what the things that matter and the process and we’ve kind of been snowed over by some of the grifters.

Preet Bharara:

It’s not even the lies. It’s the willing belief in those lies in the face of contrary evidence. So it almost doesn’t matter. The distinction I keep drawing between what is safe and secure and what is perceived to be safe and secure and I think for some subset of folks at least at this moment there’s no bridging that. Nothing you can say to them … And this is because the lie has been perpetrated but also willing believed. There’s nothing that you can say to them that will convince them that Trump lost Georgia. You can count it 94 times. You can have … Sidney Powell can be disbarred. Doesn’t matter.

Chris Krebs:

So I would actually go and look again at Arizona and their recently completed again “audit”.

Preet Bharara:

Fraudit some people call it.

Chris Krebs:

Right. That found that in fact Trump had fewer votes than initially thought and Biden had more. So the pivots are remarkable. The pivot by the stop the steal crowd are like oh the cyber ninjas team was pressured to release that report or some other party came in. So now the true believers of stop the steal have turned on Arizona state senate president Karen Fann and they’re like, “Oh, they’re not strong enough. They were intimidated. The deep state’s got to them.”

Preet Bharara:

There’s always someone you can scapegoat for not giving you the result that you want.

Chris Krebs:

Yes. But I do think through part of this we continue, as I said, rounding off edges. We’re chipping away at the people that are either on the fence or kind of teeter tottering over into the fever swamp. Even in the Qanon movement we’re seeing people like enough. This is too much. You haven’t delivered any results. I’m done. I’ve lost family over this. It’s time to move on.

Preet Bharara:

So we face a lot of issues, a lot of threats on the cyber front. And I wonder if you have a thought about the … I raise this issue from time to time and I worked in the congress. I watch members of congress in the house and the senate when they conduct hearings and sometimes you see this in the legislation they write. That they’re not necessarily so sophisticated about technology and about the cyber threats and people get terms wrong and sometimes tech executives come before congress and it’s a cake walk for them because many members are just not fluent. They’re just not savvy. Do you worry that members of congress don’t have the sophistication needed to deal with a threat?

Chris Krebs:

Preet, I have no idea what you’re talking about.

Preet Bharara:

You don’t have to name anyone. [crosstalk 00:52:47].

Chris Krebs:

No, look, there are people that take advantage of that. The ability to throw a 100 mile an hour high tech fast ball and there’s no possible follow up. You see it all the time. I think it’s important that we ensure that the technical sophistication expertise is resident in the committee staffs and in the personal staffs. I think the tech fellow program that is just reemerging in congress right now … In fact, I have a current employee that is applying into that program. It raises the bar in terms of understanding, helps craft better policy. Kind of can call the lobbyists out for the BS when they try to lay it down. I think that is probably one of the most critical investments that congress can make. But on the elected official, I can’t see, absent maybe the Bay area and maybe parts of the pacific northwest or the Seattle area, where a technology savvy member of congress has any sort of electoral differentiator that would get them into congress more. So I think we go to work it at the staff level.

Preet Bharara:

Yeah. Well, the staff don’t get to ask the questions at the hearings. This is an example I use over and over again and maybe it’s changed since he said it but Lindsey Graham said not that long ago … Whatever you think of him, he’s a smart guy. He said just recently in the last few years that he had never sent an email. It’s hard to understand when we’re talking about level of sophistication how a body of lawmakers some of whom have literally never sent an email can understand some of these very, very much more complicated things.

Chris Krebs:

Yeah. I think there are reasons for things like that. Not sending emails. Part of it’s operational security. You don’t want to put anything in your words.

Preet Bharara:

Look, I think he said it, in fairness to him, in the context of saying he was ahead of his time because he can’t get hacked. His emails are not going to be on Drudge because he doesn’t send them.

Chris Krebs:

But also that they have staff do everything for them. But just to your larger point, yes, there is an absolute knowledge gap how technology works. That’s not even the worst part of it. Yes on the congress and the regulatory side but it’s just the average person has no idea how these things work that they’re rolling out into their homes and how to maintain them and what sort of data is being collected on a daily basis and what sorts of things they’re willingly turning over just to get the latest app or little widget. The best example here is Facebook. Well, there are a thousand examples here with Facebook. The one I like is all the quizzes. Like tell me your first car when you were a kid and your favorite dog and all that. It’s like people, this is a social engineering experiment. They’re collecting information on you and building a profile. And bad people can do bad stuff with all that information.

Preet Bharara:

Hey today, just tell me the first four digits of your social.

Chris Krebs:

Raise your hand if you’re a January birthday. It’s like stuff like that.

Preet Bharara:

Two days later, give us the last few digits of your social. Oh, I see.

Preet Bharara:

Chris Krebs, thanks for spending time with us. It’s been great.

Chris Krebs:

Hey Preet, thanks so much.

Preet Bharara:

My conversation with Chris Krebs continues for members of the Café Insider Community. To try out the membership free for two weeks head to café.com/insider. Again, that’s café.com/insider.

Preet Bharara:

I want to end the show this week with a bit of news that’s important to me personally which will become obvious in a moment, but also more importantly is consequential for New York and indeed for the country. And it’s about my old office. The US Attorney’s office for the southern district of New York. You may not realize this but the last time someone was senate confirmed to that position was me over 12 years ago. And after I was fired there were of course competent excellent people who had been in charge of that office. But I think it makes a difference if someone is actually presidentially appointed and senate confirmed and is a permanent person to be in that position. So as of Tuesday night of this week we have a senate confirmed US Attorney in the southern district of New York for the first time in a number of years. That US Attorney is Damian Williams who I know very well. In fact a number of years ago when I ran the office I interviewed him, the team interviewed him, and I hired him. As I told the New York Times when they were writing a profile about Damian, he was an absolute no brainer hire.

Preet Bharara:

He’s incredibly smart. He’s incredibly talented. He clerked on the DC circuit court of appeals for then judge Merrick Garland, who wonder what happened to that guy. But it should mean for a good relationship between SDNY and main justice because the attorney general and Damian have known each other for a long time. Then Damian went on to clerk for Justice John Paul Stevens. Came to the SDNY office as a young person. Immediately shined. Is an excellent, excellent trial lawyer. And eventually was promoted to head of the security’s fraud unit which of course is a difficult job and handles very sophisticated cases. And he’ll be sworn in soon as the next US Attorney for the southern district of New York. And I just wanted to express my pride in Damian. My happiness that the office will have a permanent leader. I think the office will be in incredibly good hands because Damian has good judgment. He’s open minded. He’ll be tough but fair. Understands the traditions of doing justice.

Preet Bharara:

I should also mention not to be remiss that there is also a new senate confirmed US Attorney in the I guess rival office, the eastern district of New York. Breon Peace, who served in that office seven years ago, has long been a partner at the esteemed law firm of Cleary Gottlieb in New York City, was also confirmed on Tuesday evening. He’s also a great and talented lawyer and will lead that office well. Now both men have a lot on their plates. Some we know about because of public reporting and because of court proceedings. In the southern district of New York, Ghislaine Maxwell, however you pronounce her name, is set to go on trial. Damian will be overseeing that. There’s the ongoing saga of the investigation of the former US Attorney himself, Rudy Giuliani. That’s a sensitive investigation and no doubt a complicated and difficult one. Damian will be overseeing that as well. And then there are probably all sorts of cases that you and I know nothing about. Investigations that are at the early stages and then there will be matters that come up over time. New York is still the target of terrorist attacks. Wall Street is still there with lot and lots of frauds and deceptions waiting to happen. So Damian has a lot on his plate.

Preet Bharara:

Same with Breon Peace in the eastern district among other things. Notably for example the investigation and prosecuting of Tom Barrack, one of the former associates of president Trump. Both Damian and Breon are excellent picks recommended by my former boss Senator Chuck Schumer for their excellence and for their talent and for their judgment. And I just wanted to say to the people of both of those offices you’re very lucky to have them. I wish them luck and the fortitude to do the right thing in the right way for the right reasons in every decision they make. And also on occasion the strength to withstand criticism with grace. Good luck. Congratulations Damian Williams and Breon Peace.

Preet Bharara:

Well, that’s it for this episode of Stay Tuned. Thanks again to my guest, Chris Krebs.

Preet Bharara:

If you like what we do, rate and review the show on Apple Podcasts or wherever you listen. Every positive review helps new listeners find the show. Send me your questions about news, politics, and justice. Tweet them to me, @PreetBharara, with the hashtag #askPreet or you can call and leave me a message at 669-247-7338. That’s 669-24-Preet. Or you can send an email to staytuned@cafe.com. Stay Tuned is presented by Café Studios and the Vox Media Podcast Network. Your host is Preet Bharara. The executive producer is Tamera Sepper. The senior producer is Adam Waller. The technical director is David Tatasciore. The Café team is Mathew Billy, David Kurlander, Sam Ozer-Staton, Noa Azulai, Nat Weiner, Jake Kaplan, Jennifer Korn, Chris Boylan and Sean Walsh. Our music is by Andrew Dost. I’m Preet Bharara, stay tuned.