Notices by Matt Blaze (mattblaze@federate.social)

I referred to a group recently as “a bunch of clowns” and I regret that. It was uncalled for.

Clowning is a serious and honorable art, requiring years of study and practice to master. The people I was referring to would more properly be described as clown college rejects.

Just got a long screed from a total stranger (who follows me) explaining how they will be "forced" to block me because I "rudely" don't put content warnings on posts about election security.

With all due respect, go pound sand. I study election security for a living. It's what I *do*. It's a big part of who I am, and not something I make any attempt to keep secret. Anyone who follows should know this; it's right on the label.

I get that you might find what I do boring and tedious. Sorry.

@evan @scottley I'm not sure that's how states and borders work. Seattle is a short drive from Canada, which is a completely different country. And Portland is right across the water from Washington. And don't get me started about Lake Tahoe.

@scottley I apologize if you found my post offensive in some way, but will admit to being completely confused as to why.

I must have leveled up in the "helplessly watch your delivery driver get lost" game. They are literally now in the next state, with my dinner.

I think the driver must have picked up my food and then either had some kind of emergency or simply forgot what they were doing and went home. Or is exceptionally bad at petty theft.

My concern here is about much more than the unfairness to Krebs, though this abuse of presidential power certainly harms him and makes him and his family targets for threats of violence.

My larger concern is that this represents a clear and direct threat to anyone, inside or outside the administration, who dares raise a dissenting voice or who exposes facts that might be contrary to the party line.

It is diametrically opposed to what the first amendment is designed to protect.

Trump's official denouncement of former CISA director Chris Krebs (in the form of a "Presidential Memorandum") is chilling in substance and utterly Stalinesque in tone. By threatening anyone who hires him, it aims to render Krebs effectively unemployable.

I said it then, and I will repeat it now: There is simply no evidence that the 2020 election was "hacked". Krebs's forthright clarity about this in November, 2020 was a brave and important act of public service.

https://www.whitehouse.gov/presidential-actions/2025/04/addressing-risks-from-chris-krebs-and-government-censorship/

@heidilifeldman @kims The consequence of defying the judgement are important, but I'm even more concerned about what happens next. At some point, either Trump backs down or the Roberts court has to acknowledge they have no effective authority over the executive. If the latter happens, we're in completely uncharted territory.

Thanks to the tariff craziness, they expedited a repair for a camera I had to send overseas so they could ship it back before new duties were to take effect. Expected to take 4-6 weeks, actually took 4 days.

It's especially notable that none of these "smoking guns" were raised by the Harris campaign or any other candidate to contest the election results before they were certified. Mostly because they don't actually show evidence of fraud.

Elections are decided by the votes reflected on the ballots that were cast, not by how well those votes conform to polling or prior elections.

I'm currently being swarmed on Bluesky by a posse that's mad at me for failing to acknowledge that the 2024 election was clearly stolen. I honestly have no idea if this is a bot army or real people. It's a very attractive explanation for the outcome of an election that disappointed you, so it's very easy to peddle stuff like this.

There's an elaborate, but mostly meaningless "analysis" floating around that purports to "prove" that the 2024 election was stolen. It consists of stats and graphs of supposedly "anomalous" voting patters in a handful of cherry-picked counties.

The graphs are very pretty, but they just aren't evidence of fraud. They're very similar to the supposed "proof" that the 2020 election was stolen.

"Proof" that reenforces what you want to believe has to be approached with extreme caution.

Election security is back in the news, and it's easy to be taken in by confident but specious claims of "hacked elections". There *are* technical vulnerabilities in US election infrastructure, but fortunately so far there's no they've been exploited to alter an election outcome. I know that's frustrating, but it's the reality we live in.

Want to learn more? Read on.

- My top suggestion: Become an election day poll worker! It's an important service and you'll learn a ton!

- This National Academies report is the best overall summary of of election security which I'm aware, and despite being published in 2018 is still current: https://nap.nationalacademies.org/catalog/25120/securing-the-vote-protecting-american-democracy

- Here's a paper outlining the technical issues and solutions: https://georgetownlawtechreview.org/wp-content/uploads/2020/07/4.2-p505-522-Blaze.pdf

- I gave a talk at Columbia last year on the state of election security: https://www.cs.columbia.edu/distinguished-lectures/2024-Fall/Matt_Blaze.mp4

Unfortunately, I have to say this again:

US election infrastructure isn't perfect and there's still work to do to make it more secure. But there is simply no credible evidence that the 2020 election outcome was altered through technical attacks, despite exhaustive scrutiny.

Shortly after the 2020 election, when these discredited claims were first raised, 58 of my colleagues and I issued this statement:

https://www.mattblaze.org/papers/election2020.pdf .

Nothing we've learned since then alters my assessment.

@sophieschmieg exactly. The great thing about Signal is you can bootstrap with another user quickly and easily and without having to trust much about the infrastructure. And that makes it highly useful for lots of things. But totally the opposite of what you need to enforce a well defined centralized hierarchy.

I should also note that when I say the cryptography in Signal is “probably fine; a practical attack would be a big surprise”, that’s about the best we can say about almost all cryptography used in the real world. No strong (not dependent on unproven assumptions) security proofs for much of anything you’d actually want to use.

I'm not dunking on Signal here (though there *are* some features and usability quirks I dislike). It's probably the best designed and implemented secure messaging platform *for general use* that we've got. I use and rely on Signal quite a bit myself.

But it's simply not designed for, or suitable for, classified national security communications.

For the record:

- The *cryptography* in Signal is probably fine; a practical attack would be a big surprise.

- Signal lacks specific features required for classified systems, such as security labels, certified identities, revocation, etc.

- Signal runs on uncontrolled, insecure platforms connected to the Internet, rendering it unsuitable for classified even if it had the above features.

- Adding classified features to Signal would make it unusable for most purposes for which it's intended.