Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

The Paper Chase

Kevin Shelley

PolicyVoting Village49 minBeginner
Watch on DEF CON media

This recording is not on YouTube. It plays from the DEF CON media server; the button opens the file there.

Where

Voting Village
DEF CON 34

Duration

49 min

Traces how a 2003 California investigation and a failed 2004 primary pushed the state to require paper records and source code review for voting machines.

Summary

The keynote opens with the push toward touchscreen voting after the 2000 Florida recount and the Help America Vote Act. Stanford computer scientist David Dill warned that direct-recording electronic machines left no independent record of each ballot, so errors or manipulation could never be detected. Former California Secretary of State Kevin Shelley describes how he first resisted that argument, then formed a task force in which only three of eleven members backed a voter-verified paper trail.

The middle covers the fallout. Bev Harris found Diebold source code and release notes on a public server, and a state audit showed 17 counties running software that had never been certified. Shelley ordered source disclosure, paper ballots and parallel monitoring, then descertified the TSX in four counties. Machines failed in Alameda and San Diego during the March 2004 primary, and a San Diego absentee miscount was caught only because paper ballots allowed a hand recount.

The closing section notes gains: California required voter-verifiable paper records by 2006, most recent presidential votes were cast on paper, and all 50 states now have post-election audit laws. Federal certification still does not require source code review, vendors still pay the test labs, and major manufacturers have not taken part in the village. The practical takeaway is that a record the voter can check matters more than a receipt.

Materials

Related talks

Voting Village·26 min

  • DEF CON
  • Policy
  • Date: Aug 2026
  • Location: Las Vegas

Richard DeMillo

Argues that election security failures persist when known vulnerabilities become normalized, drawing on the Challenger and Columbia investigations and a Georgia voting lawsuit.

villageriskvulnerabilities+2