Originally aired on June 12, 2020 @ 12:30 PM - 1:00 PM EDT
Cloudflare General Counsel Doug Kramer and The Carter Center Senior Advisor of Digital Threats to Democracy Michael Baldassaro will talk about what it's like being a Project Galileo partner and what more can be done to help vulnerable voices online.
Well, good day, everybody. My name is Doug Kramer. I'm the general counselor at Cloudflare. I'm happy to be joining you today on Cloudflare TV as part of our spotlight section related to Cloudflare's Project Galileo. Project Galileo is an effort through which Cloudflare identifies and works with a number of marginalized groups around the world that might be facing cyber attacks or other sort of behavior that prevents their ability to communicate online and do the great work they do on the Internet. And I'm really happy today to be joined by Michael Baldassaro, who is a senior advisor at the Carter Center, who is one of the partners we have in the Project Galileo group to help us identify and then provide those essential services. So welcome, Michael, to Cloudflare TV. Thank you. It's great to be here. I'm very happy to be part of the first week. Well, we're excited in any number of ways, not only to have you here, but have you as a part of Project Galileo and really thinking about some of the hard problems that you're trying to address and the way that those align with what we do. So why don't we just start out generally, because I think a number of people obviously know, not only in the United States, but around the world, which is where we draw our viewers about former President Carter. Fewer may know or have heard of the Carter Center. So can you just give us a general description of what the Carter Center is? Sure. So the Carter Center was founded in 1982, as you know, by former President Jimmy Carter and First Lady Rosalyn Carter to advance democracy and human rights worldwide. We also work in the areas of conflict resolution and tropical disease eradication, but I'm less intimately involved with that aspect of the work. My work is in the democracy and election side of the organization. And a core part of our mission is to promote peaceful, democratic elections through nonpartisan election monitoring. And over the past four decades, the Carter Center has directly monitored or partnered with civil society organizations to monitor more than 100 elections worldwide. So as one historical note for people who may not know it, especially those who are, you know, serve our non US viewers, I mean, there's there are provisions in US law that that for former presidents when they leave office, and they might have their records or the history of their administration or all of that that the National Archives provides for those presidents to have libraries. And in a lot of places around the world, these are museums, but also repositories of what used to be a lot of paper documents and increasingly less so, but really become the archivist for that administration. And if not the first, certainly President Carter was revolutionary and sort of rethinking the way that his after presidency life would play out. And the Carter Center, you know, really is a living embodiment of what otherwise would have just been, you know, some sort of museum to his administration. I mean, am I getting that right? Like, do that's always been my sense of part of what is really special about the Carter Center. Yeah, that's exactly right. And, you know, President Carter, when he left office wanted to sort of continue to do some of the work that he had started to do on the international stage, and also to pursue some of the things that he couldn't accomplish during his presidency. And so this was sort of a natural extension of all his dreams and desires that he could do on the world stage. And, you know, for the past 40, almost 40 years right now, they've really made an incredible and indelible mark on the world for a positive way. Yeah, and I think history will show there may be a bit of a pivot, you know, as a resulting of what sort of ex US presidents do after their administrations as a result of what President Carter has done. I think you see, to some extent, the level of engagement of the Clinton Global Initiative. Definitely, if you look at what the Obama Foundation is trying to do and model themselves on, I think it comes in a similar space. And you mentioned in addition to working on a lot of world health issues and eradicating disease and things like that. You know, I'm less versed probably in the history of global election monitoring, and, you know, third party observers and things like that. But I will say what I know of it really has been highlighted by the Carter Center over the last 30 years or so, and if not the first, they're also sort of trailblazing. So specifically within that area, which is which is the area you work in. How would you describe the different forms of engagement that the Carter Center takes when it comes to promoting democracy, defending elections, ensuring elections and those sorts of efforts? Yeah. So, you know, as you noted, the Carter Center has really been a pioneer in this space, and a lot of the modern sort of election observation methodology that's used by both international and local organizations in countries was developed by the Carter Center and other organizations collectively. And just to make sure, I mean, I'm not sure how much our audience is aware just of what election observation is and sort of the core of what we do, but we typically start by analyzing the legal framework governing an election, specifically the rules and regulations regarding voter registration, campaigning, voting procedures, results tabulation, etc. We develop observation training manuals, data collection forms, and we deploy volunteers throughout a given country to monitor key aspects of the process and document any irregularities that they might encounter. And then ultimately we analyze that data or our partners analyze that data if we're working with a partner, and they issue public statements to provide an impartial and accurate assessment of the process with recommendations for how to safeguard the process from further irregularities going forward. It's one of those things when I would like to say I grew out of this once I was no longer a teenager and got educated, but I'm still educating myself, right? You have this sense that like once a country signs up for democracy, well that's done, right? Then you just, everybody votes, the majority wins, you know, you're good to go. And then I think the more you learn not only about your own voting systems like here in the United States, but then other parts of the world just because someone's adopted democracy and the idea of free and open elections as a principle, you know, that can be played out in so many different ways. I know one of the challenges we've looked at here in the U.S. is ultimate responsibility for running so many elections is much more localized than most Americans would even realize. You've done it, you know, the city or county level, let alone the state level, and that is at a government-wide national level, there isn't a lot of the operational day-to-day that the national government really does there. And so to try and work on elections, at least in the United States, you have to go to that level of granularity. You know, how do you see that playing out, you know, around the world? And you talked about, you know, the first thing having to do is really figure out the legal system and all of that. What are the different, you know, challenges or unique nature of different voting systems that you think at least opened your eyes that you may not have realized? And certainly people watching this episode have probably never thought about. Sure. Well, you know, every country is unique and every, you know, they have their own set of laws and their own set of challenges. I think that, you know, when I first started doing this, which is now almost about 20 years ago, I didn't have any conceptualization of what, you know, there were differences between different systems throughout the world. You know, and a lot of the stuff that we encountered very early on in terms of problems or challenges were what I would call, for lack of better term, you know, retail -level, you know, fraud or retail-level irregularities. You know, vote buying, ballot box stuffing, things like that. You know, and now obviously different systems, different problems, but you can actually even sort of see some trends in some of the biggest problems that we see. And right now, again, you can't really extrapolate to every single country in the world, but I think one of the main challenges that we face, and it's going to be obvious to anybody watching in the United States, is disinformation. You know, we're worried, we worry a lot about foreign interference and meddling, and of course that's a real problem, but it's not just Russian troll armies that are actually, you know, affecting disinformation in these countries. It's a serious problem, and it's perpetuated by domestic political actors in a lot of cases, and I think that we can look to Brazil and the Philippines and some of those countries to see that it's coming from the very top. And so it's not a new phenomenon. Disinformation is old, it goes back a long, you know, time, so we shouldn't treat it as sort of a new concept, but I think what we're seeing is that the affordances of social media, it really facilitates its spread with sort of unprecedented scale and speed and reach, and that's really where the problem is, and it's particularly problematic in what I would call information-poor environments, for lack of a better term. I mean, we often are working in quasi -democratic spaces, you know, countries that are either emerging from, you know, conflict periods, and these are transitional elections, or countries that have sort of a, that may be experiencing a backsliding effect of some sort for whatever reason, and so there's very little impartial or accurate authoritative information or trust in sort of the media institutions that exist, and so disinformation is now filling that space, and I would say that's a real challenge that we're seeing. You know, and the other challenge I will say, and you know, we just saw this, and you know, we see this in the United States during the Democratic primary, is there's an increasing reliance on technology to administer elections. It is so pervasive, and for the majority of folks, and probably not the audience that I'm talking to, a lot of this technology is black box, in which people don't really understand much about it. They don't, they certainly don't really have any depth of knowledge about data storage and data management, and you know, just as sort of an example of where it was problematic in Kenya in 2017, they put up a, they put together a very sophisticated vote tabulation system for the election, so not even the voting machines, but the tabulation of results that's pulling the data from these results, and the losing candidate in that election, after the results were announced, said, you know, I didn't lose the election, algorithms stole the election, and that set off this huge amount of unrest, and because the system wasn't properly audited before the elections, there was no way to, you know, with confidence, say that he wasn't correct, but so the challenge becomes with the sort of the advent of these, you know, increased use of technologies and black box technologies, it creates this vacuum that people can fill with any type of spoiler effect that they want to sort of undermine the credibility of a process, and I think disinformation and sort of the misuse or the blaming of technology seem to be real problems for us globally. You know, that's a fascinating way to put that, right, because I was already sort of was stopping and contemplating the first part you made there, so let me go back to that, right, which is, you know, these aren't necessarily new efforts or tricks, they are just the same tricks with new tools, right, you know, what would have been, you know, you read the stories from 50, 60 years ago, you'd go into districts that you knew were very partisan in one direction or the other, and you'd see flyers up saying, you know, the election's been postponed, you know, for a week, or, you know, because of this or that, you know, your polling place has been moved across town, right, you know, you'd see things like that going up trying to manipulate the election, and that people are still trying to do those sorts of things just with much more complexity, using the technical tools to do it in a very different way, and that challenge, so there's the disinformation piece. And then there's the, you know, the piece of just running the election, right, and I want to touch a little bit on that one, because I think that's usually what people think about when they think about election security, is this, you know, election voting booth I'm going into, if I don't get a punch card, if I don't put it into a box that has a padlock on it, right, can I have confidence in that? Because, you know, the most unsophisticated person can look at a box with a padlock on it, and they may not sit there all day and make sure it gets, you know, delivered without anybody opening that lock, but you have some sense of what's going on there. The overwhelming majority of people will have no sense what sort of encryption or other sorts of systems are built into that electronic, you know, voting booth to give them the confidence in that, so how do you think about that issue? Is that a solvable problem? Because I think we've already started to see, you know, in countries around the world, if you want to try and distrust the election or the outcome of the election, distrusting, you know, the voting systems themselves and the way they work when you may not be particularly technically savvy and they are increasingly technical, do we just go back to pen and paper? Are there ways to sort of do that? What do you think is the long arc of how we develop those voting systems? Yeah, it's a good question. I think that, you know, frankly speaking, the pace of adoption of technology for election administration, election management purposes is outpacing our digital literacy, and so I do think that there is a rapid shifting in the direction of, you know, using these voting machines. And it makes sense from an efficiency standpoint, and they're not going away. I think it's incumbent on organizations like the Carter Center and like the election observation groups of the world to sort of develop the best practices and standards that need to be put in place to govern those, to govern the use of technology in elections. And I'll be honest with you, my job, most of my job right now is basically helping our observation missions and civil society partner organizations to develop and implement new methods and tools for how they identify and counter disinformation or hate speech online, how they can assess data privacy and data protection regimes and protocols implemented by election administrators, you know, just make sure that election information that's being collected is being stored and secured properly, and also assessing cybersecurity measures that are in place to assess the vulnerability of our registration, voting, tabulation technologies, you know, hacking or abuse. And these are all very significant challenges, and we need to basically gather the evidence and data to be able to make recommendations on the back of that evidence to be able to say, well, these are the things, these are the weaknesses in the system, these are the things that need to be done, this is where the public lacks confidence, and these are the steps that you can take. So what it's requiring from organizations like ours and our partners is that we need to look to, you know, I mean, we've developed over the past, you know, multiple decades, these, you know, very rigorous methods for evaluating all types of, you know, potential election corruption, evaluating, you know, the abuse of state resources, vote buying, all those things. But, and these are new challenges, and we are constantly refreshing and adapting the approach that we take. So we're looking to academic institutions and the expertise found in the private sector. And to be quite honest with you, some of the skills possessed by Cloudflare engineers are exactly what we need on our missions to really address these challenges, you know, particularly related to assessing voting technology and cybersecurity issues. And so this is a constant challenge, but we're working on it to try to understand better in every country, you know, what are the sort of the vulnerabilities and weaknesses that exist, and how can we make recommendations to make sure that there are safeguards in place to protect, you know, voters and make sure that the results reflect the will of the people. So how does the Carter Center then approach? You have this goal of making sure that, you know, democracy and elections are conducted in a fair and appropriate way around the world. You know, what percentage of the time, on the one hand, is that sort of, you know, the academic abstract idea of how do we make sure tools are out there? How do we, I mean, it makes all the sense in the world to me that having the Carter Center and similar groups sort of sign off on a loop, a group of best practices or give a good housekeeping seal to certain sort of systems would provide a really good buffer against a disgruntled, you know, loser of an election that would try to sow, you know, some sort of dissatisfaction or unrest, right? So that's sort of the abstract macro approach to making elections work better around the world for everybody and making those tools easier to access. My sense also, though, is that there are more acute circumstances where the Carter Center may say more than just that, you know, that general macro approach. There are individual elections that are going to go on that are sensitive, that are important, that have either requested or we think, you know, for stability in the region. It's important that we go, you know, have an on -the-ground team, get very involved. So it'd be really interesting for you to walk through those two parts of, you know, how much time and how you think about those two different roles, and then specifically when a decision is made to more directly engage in an election and be active in that election, what is the nuts and bolts of that look like, you know, in the lead up to that? And then when the team lands on the ground and starts looking around for what to do, how do you go through those specific steps? Yeah, it's good questions. And I'm not sure if people still use the good housekeeping seal anymore. My age comes through every once in a while. I don't have a better, if you have a better example, I'm more than happy to get rid of that one. But I've yet to come up with anything yet. Maybe that just describes how splintered a world we are anymore, that there are no central, you know, approval stamps anymore. But anyway. No, you know, I think I'll probably start with the sort of the latter question, because I think it may flow into the other one, which is, you know, how do we, I think a good question is even how do we choose, you know, where and when to observe an election? And that's a particularly difficult situation. I mean, we are, we are often not observing in most Western democracies at this point in time, where there is a level of stability. And, you know, I don't want to say continuity in democratic process, because there, there's still vulnerabilities, there is what we saw in Hungary, you know, just a few elections ago, and what we see going on now proves that nobody is immune. But you know, there are also international and regional and domestic organizations in those countries that are very well equipped. A lot of the work that we do directly when it comes to monitoring or building the capacity of our partners are in countries that, as I mentioned, are quasi democratic, or that are emerging from conflict situations. And so, you know, right now our focus is on, you know, countries like Myanmar, which are heading into, you know, basically their, their, their second elections, which in theory should be a consolidation election. But you know, it's been rocked by, and again, disinformation and hate speech on social media was a contributing factor to some of the instability that exists. And as you know, we're seeing that bear out again in these elections. And so trying to make sure that this process is as credible and transparent and accountable as can be, as you know, we picked Myanmar as a place where we'd like to see democracy succeed, and where we think that there's a need for sort of an impartial outsider assessment in light of the violence. Ethiopia is another country is an example of that, where, you know, it's emerging from another transition, you know, the passing of a, of what many would call an autocratic leader, to, you know, a transitional government, which, you know, bears the hopes of, you know, opening a freedom of expression and opportunities for really competitive elections. And so having an international presence there, where there's this lack of trust, you know, we were able to provide that reassurance in some way by basically putting our stamp as to whether or not the, you know, election was credible and the degree of confidence to which people should have in the results. And that's, that's sort of our role in this. And again, countries like Bolivia, which just had a recently, you know, a traumatic post election fallout from disputed election results and is going into a new election. So we're picking, you know, picking is a strange word, but we're focused on countries where we're worried about the implications where a lack of public trust is, is, is could undermine public confidence, legitimacy, and where spoilers could have that effect in an outside independent voice can play a role there. Now, as part of that process, you know, we are, you know, basically in the information gathering and, you know, we're putting information out there to help people make up their own minds as to whether or not they should accept the election results. And it's all grounded in, in methodologies that are derived from international human rights standards. And so we're not picking and choosing questions, you know, based on what we think should happen, but based on, you know, a universal set of principles and laws that are codified in the United Nations and the international covenant on civil and political rights that are the basis for how we're looking at things, evaluating domestic laws in the first place, and then making sure that if those laws are compliant with those international principles, you know, how does the performance stack up vis-a-vis the law? And so I'm not sure that I answered your question. Actually, I might have gone off track there, Doug. I'm sorry. No, no, no. It's all very interesting. No, you actually, you went into something I think is also very fascinating, and I wanted to get your take on, and that is, you know, what, what do you view your role? I know both you and then the National Democracy Institute, which I know you've worked with as well and does a lot of great work in this space. You know, you want to build up the capacity of different people working in this area right before you ever get there. If you get there two weeks before the election, it's probably too late to do a lot of this stuff. At the same time, you know, you go in, and I don't know if NDI and the Carter Center are different on this, but if you go in as an election observer, I mean, part of what you'd be expected to do is be there to add that voice to say, no, this, we don't think this is a disputed election. We sort of looked at everything. You know, Michael, our digital lead, looked at the voting algorithms. He doesn't think there's a problem here. We were out in a number of the cities, not just the Capitol, and didn't see, you know, some of the problems that are being reported. And we can say that we do not see significant irregularities in this election, you know, good to go. At the same time, when you get on the ground, you know, when it's two months out or even two weeks out, and you're on the ground, and you see things sort of struggling, you might see a government election ministry, you know, under digital attack, or things like that. Do you always feel comfortable jumping in and sort of helping fix at that point? Or do you find that there's a tension between the short term need to fix up some of those things around an election and the role you all play as observers, right? That, you know, you might not want to be the referee that gets too involved in sort of fixing the rules of the game, you know, mid game or something like that. Is that ever a struggle? It's a good question. So I mean, you know, I would be, I would, I would hesitate not to use the word interfere, because I mean, part of our goal is non interference. Our goal is, is to observe, document and make recommendations for the steps that they could or should take. And so two weeks before an election is sort of late in the game, we typically show up, you know, prior to voter registration, or campaigning in those processes. And so by that point, you know, hopefully we will have done an evaluation of, you know, what are the vulnerabilities in the way that data is being stored by the Election Commission and make recommendations at that point early on enough in the process that gives them a chance to be able to correct it. If they don't take those steps, that we've made a recommendation on based on, you know, some thorough analysis of their system, then at the point, the two weeks before the election, and you know, we're in an unfortunate situation where we're standing back and just documenting what happened as a result of that, which is terrible. But the, you know, the big challenge or the is, we're in the role of international election observer, we're in the role of non -interference, but there are groups on the ground, and you mentioned, you know, NDI, but they're, you know, groups that are usually working with election commissions themselves, or like IFAS, the International Foundation for Election Systems, they're usually on the ground, you know, we coordinate, we'll provide our statements, and we'll tell them the, you know, the folks at IFAS, it's like, oh, hey, you know, here's a vulnerability or weakness that we discovered here, you might want to get on top of that. And, you know, that sort of combination of making a public statement, and then, you know, providing sort of the consultations with other stakeholders on the ground to try to remedy that, that's kind of our role, but usually two weeks before the election, it's too late. So what are the most of the sort of attacks that you will see, whether it is, you know, do you find, so getting back before you mentioned, you know, earlier in the conversation about some of the things that Cloudflare engineers or Cloudflare services, you know, address in this space, where do you see the need there, or some of the risk, you know, when it comes either to government entities, on the one hand, who are, you know, providing information about the election, providing availability for registration, things like that, on a bit of the disinformation side, are you seeing, do you see more of the time spent on maybe going after some of the groups, whether politically or socially or journalistically engaged, who are trying to influence views and ideas in the election, or is it a mix of both? And if so, sort of how do you think about that? But what's the real, where are the bad guys sort of targeting their sort of anti-democratic, you know, efforts in this space? That's a good, that's a really good question. And, you know, to be honest with you, we're not, we're often not privy to, the Election Commission is typically not going to tell you that they've been hacked, for the sake of trying to preserve, you know, public confidence in the process. And so we typically don't even know that information ourselves, and, you know, unless it becomes sort of leaked or public. What I will say is that we, what I can tell you, based on our own experience, is that it's, our civil society partners are particularly vulnerable. So if they're observing elections, you know, they are, how would I put this, they're target, they may be targets of governments, they may be targets of private institutions or private sector entities that want to preserve, you know, or advance a particular election outcome. So, you know, they're coming under threat from all angles. And, you know, when I was in Bangladesh in 2018, I was working with a coalition of election observation groups, and one of the main members of that group, they had their website hacked, and they were the victim of a DNS hijacking. And, you know, I'm speaking to an audience that I think understands what a DNS hijacking is, and basically just redirected to a splash page that read, you know, this site has been taken over by some random, you know, hacking group. And the website, you know, the host acted quickly, took the site down, but what it prompted was the series of discussions amongst the election observation network as to whether they should observe at all. So it really put them in, it had the self-censorship, the chilling effect on them as to whether or not they should pull their punches or observe at all. So the immediate effect was censorship, or the goal was censorship. The attack, we couldn't even derive, you know, who it was. And, you know, it was, in a better situation, we would have done some tracing and tried to figure that out. But, you know, the immediate effect was censorship. The secondary effect was a chilling effect that was basically self-censorship. And I can't say whether or not they pulled their punches at all during the election. But, you know, that's just one example of, you know, what happens and that where we need to be a little bit more vigilant. And we're, you know, Project Galileo actually becomes a very important service in that whole entire equation. No, I think actually that's something I don't know that I'd completely thought of before that. In addition, I mean, we think about Project Galileo and think, you know, there are these viewpoints out there, generally marginalized, very generally going against often, you know, entrenched interests that have incentive to fight them. And so we've seen attack volumes that are disproportionate to the amount of traffic that those sites see. And when you see that, because usually traffic and attack volumes run in a pretty straight line. And when you see deviations from that, more than anything, we sort of saw it in this space. And so, you know, the first immediate approach there to a group that does cybersecurity or the sort of, you know, services we do as well, fix them, keep them online, you know, fight off the attack. But you pointing out that the way people feel within those organizations is not just that they want to stay online for their 99.999, but they may not have the money or the resources or the technical savvy to stay ahead of it. And so they may start to self-censor. So it's not only just keeping them online, but it's keeping them online and feeling that they can be safe and secure without concerns of expenditure of funds or anything else, because otherwise they may self-censor and sort of do the work for the attackers. That's an interesting point that I don't think goes to the next level on that. Well, I mean, and just to dovetail on that, I don't know how much time we have, but just, you know, really quickly, I mean, our civil society partners, they're subject matter experts in elections, human rights, democracy. They're not cybersecurity experts. They don't know. They've heard of what a DDoS attack is. They don't know what it is. You know, they wouldn't be able to evaluate the significance of it, what it means or whether they're going to lose all their data or files as a result of that. And, you know, to be honest with you, we try to do our best to educate them on those things, but there's limitations to, you know, people who don't have sort of the background that, you know, or the depth of knowledge to be able to understand all these sophisticated cyber threats that they face. So honestly, you know, what Cloudflare provides through Project Galileo is this reassurance, I mean, that, you know, you've got their back. They don't even understand necessarily everything that you've got their back on or their back end in this case, but, you know, the fact that it's there gives them that confidence and sort of mitigates the potential effect of even, you know, self -censorship because they don't have to worry about that. And to me, that service is just, is gold, you know, and I know, I know what it's worth from my vantage point, even if they don't always do. And so I'm really appreciative of the opportunity to be able to provide organizations that I know in this space that are trying to do the right thing, that are making themselves vulnerable for the people who are vulnerable, to know that we can have their back in some way is really, it makes me feel great. Yeah, no, I appreciate that. We have just a few seconds left before we need to drop off and hand off the baton to the next show. But do appreciate your time and wanting to point out that in your role as a partner for Project Galileo now, it's, you know, we rely on our partners to sort of help us identify the folks who don't have the time to come and find Project Galileo, or may not even be thinking about it, but to find the people in the trenches sort of fighting these battles with these groups, and then sort of point us in the right direction, or if people come in out of the woods, and we're trying to figure out what they're up to, go to the experts in the field and get that guidance. And so, you know, we couldn't exist and operate the program the way we do if it wasn't for the partnership of not only the Carter Center generally, but also what you've been able to do. So thank you, not only for spending some time with us today, but for that work generally. Thank you very much. It is a privilege to be part of Project Galileo. Okay, thanks, Michael. Thanks, Doug.