Meanwhile, the need for safeguards extends beyond AI.

Last year, a cyber attack crippled several state government systems.

Nevada's response to it is just one topic I recently asked cybersecurity expert Jake Braun about.

Braun leads the University of Chicago Cyber Policy Initiative.

And at this year's DEFCON conference in Las Vegas, he unveiled a new program to help small water utilities defend themselves from cyber attacks.

DEFCON is a long-running convention for hackers; and it's also where, in 2017, Braun helped launch the Voting Village, where hackers and researchers test election systems for weaknesses.

(Jake Braun) It was launched in 2017 on the heels of the 2016 election interference from the Russians, where they hacked into election systems around the country and were able to exfiltrate data from voter registration databases and things like that.

There's no evidence any votes were changed or deleted or otherwise manipulated, but we do know that these Russian hackers were able to get into voting systems and, at the very least, exfiltrate data.

And so at the time, there was a lot of folks in the election industry who were saying that elections were secure and nothing could be hacked and everything was, you know, puppy dogs and roses.

And the the hackers know that that's not the case.

And so we decided that we couldn't just say that; we had to show people.

And so we went and bought a bunch of voting machines.

And to this day, the Voting Village has never encountered a voting machine that it could not hack successfully, so there are still very real vulnerabilities in our election infrastructure that need to be addressed.

And a lot of that requires federal funding to help improve security features of voting machines, network security of the election offices, and so on and so forth.

-So according to the DEFCON website, the Voting Village has been invited to testify to Congress about how to strengthen election infrastructure.

What has actually changed as a result of the Voting Village?

-Number one, people became aware of the insecurity of the voting system; but, two, it helped dislodge about a half a billion dollars in funding for voting equipment around the country back in 2018.

And so DEFCON wasn't the only group that helped ensure that money got delivered to election offices, but they played a big role in highlighting the need.

-And so, where has that money gone to improve what kind of infrastructure, in particular?

-I think that election offices have done a lot in terms of putting security on their network to stop the bad guys from getting in to begin with.

There's also a lot more information sharing now about threats, from the federal government to election offices, that didn't exist before.

And the infrastructure to share that information wasn't there before.

Probably the most important thing, and this may be weird hearing from a cyber guy, was there's been a massive shift to paper ballots.

And that analog solution is your best cybersecurity.

-The 2020 election, which President Donald Trump claims was stolen, where do you stand on that?

Where were you at that time in your career?

-So I think that it's an incredibly complicated issue, of course, because there are real flaws in our election systems.

There is real insecurities, and there are foreign entities, like the Russians in 2016, who have exploited those entities.

That being said, there's no evidence that the 2020 election was stolen or that votes were manipulated.

And in my career, I was working for the Biden campaign at the time.

-You worked under two Democratic Presidents, Biden and Obama, in cybersecurity.

And so we may have viewers who think, well, of course he's going to say that there's no evidence that the 2020 election was stolen, because he worked under Democratic Presidents.

What would you say to that?

-Go back and look at the evidence.

-Okay.

Let's talk about the threats that do exist.

And maybe we should first clarify the difference between manipulating votes and election interference.

There's a difference there, and I'm not sure that's easily understood.

What is it?

-So election interference could take any form.

So, for example, actually in '20, the Iranians did do a whole host of mis- and disinformation around the election, but they didn't actually hack any voting infrastructure; whereas, the Russians in 2016 actually hacked voting infrastructure.

And so that's kind of the difference.

Any type of way you can make voters maybe not know what their polling place is or think the time to go vote is wrong or have bad information about a candidate that's untrue or something, that could be election interference.

But the actual hacking of an election is when the computer equipment that underpins the election is altered or otherwise broken.

-The misinformation, though, what does that look like?

I think I heard you on a podcast in 2024 talking about if there are long lines at a voting center or there's something that malfunctioned--a piece of equipment that malfunctioned--and someone tweets out a picture of the long lines and says something to the effect that, Oh, gosh.

Who knows what's going on?

We're hearing equipment may not be working.

Then what happens after that?

-Well, the concern, of course, is that conspiracy theories will get spun up about what's happened.

And a lot of times-- This voting equipment wasn't made like an F-16 plane or something like that with all these security features.

It was made to be cheap and count votes.

And so a lot of these machines just kind of break.

And so I think the example you're talking about was in 2018 in Texas.

One of the machines had kind of a glitch where the screen would kind of shake or look like it would shake, and so people thought it was hacked.

But really, it was just kind of a bad machine that just wasn't working well.

And so what happens is then people will say, Oh, well, no, the election's hacked.

And then all of a sudden the conspiracy theories start, and then you get foreign actors who come in and take those conspiracy theories online and spin them up to seem like they're, you know, mainstream validated claims when, in fact, it's just conspiracy theories that were started by somebody who was waiting in line too long and saw a machine behave in a way they didn't think was appropriate.

-That can have a tremendous impact, right?

-It's had a tremendous impact on our country.

I think that we're in a situation where a lot of people don't trust the outcomes of elections now.

And, really, there's no reason to not trust the outcomes of elections at this point.

We are very good at counting votes.

We've been doing it in this country for 250 years.

And particularly with the massive move to hand-marked paper ballots, as we've seen all across the country, if there's ever a question, you can just go back and have humans count the ballots.

-Those paper ballots, though, can take longer to count.

Am I right?

And then that leads some people to thinking, Oh, this is taking way too long to get the results.

There must be something funny at play.

-Yes, of course.

You know, in this country, we're very good at both sides of the aisle spinning up conspiracy theories that service whatever they, you know, whatever claims they want to make.

But really, at the end of the day, while it may take longer and it may cause a lot of consternation, knowing that a bunch of humans can sit there and hand count every ballot and other people can watch and validate that that was done correctly is how we get to the right result.

-Okay.

The State of Nevada had its own cyber attack last year; and several months later, the Governor's office came out with a report about how it confronted it, saying that they achieved full recovery within one month.

No ransom was paid.

No evidence of successful extraction of the data or publication on a leak site.

And in total, $1.5 million was spent on recovery efforts.

Taking that all into account, what do you think about the state's response?

-Well, first and foremost, I want to applaud the Governor and his team for not paying the ransom.

We need more people to have the courage to stand up and do that and do the really hard work that the Governor and his team had to do to back up all their systems and kick out the bad guys out of the network and all that type of stuff.

It would be a lot easier to pay the ransom, and it's really laudatory that the Governor and his team did not pay the ransom and did the hard work to clean up the system and kick out the bad guys.

-As a result, will the elections be more secure in Nevada this year?

-Oh, absolutely.

I mean, elections are more secure now than they have been in modern history, and that's true in Nevada for sure.

-Okay.

And you have also used this week for DEFCON to announce a really neat initiative project, and this is related to the cyber attacks that we are seeing on water utilities across the country.

What do we know about what's happened, and what are you now doing?

-Most recently, there's attacks that presumably are from Iran.

I don't think the actual attribution has been definitively made yet, but presumably they're from Iran.

Those attacks, I think, should be viewed as a shot across the bow from the Iranians, telling the American people and the administration that they can do really three things: They can shut off the water to our military assets, which are almost all supported by civilian water utilities; they can shut off the water to our key economic driver in this country, which is our AI prowess and the data centers that power AI which are also all supported by civilian water utilities; and then in a time when the country is deeply divided over the Iran war, undermining trust in the government to be able to deliver basic services.

And so I think that's what we're seeing here.

This wasn't an attack that had anything to do with a particular water utility.

It was about sending a message.

-And so you have come up with a way to fight this.

I think its focus, though, is on small communities who are being hacked, their utilities are being hacked.

Why and how does this project work?

-Sure.

So there's about 150,000 water utilities in the country, so nearly all of them are small.

There's a handful that are large, but almost all of them are small.

And to secure those utilities, we spent two years with our DEFCON researchers working arm in arm in the trenches with water utility folks to figure out what would work.

And what we found is that you really need to take the approach that you would to secure a small business--because that's really what most of these water utilities are, small businesses.

And so we've set up a program called the Water Watch Center, where it's a nationally scalable program where we have these small cybersecurity providers that support small businesses today and also support water utilities today, who now are able to provide cybersecurity for free for small utilities around the country.

-Who's funding that?

-Several philanthropic funders are behind this.

Craig Newmark, Craig from Craigslist, is one of the biggest funders of it.

There's a few other philanthropies.

And one of our funders is also DARPA, which is the research agency for the U.S.

military.

And they're funding us to do research on how we could potentially use AI to better secure these systems in a scalable way, because getting to 150,000 water utilities is no small feat.

-I think for people watching at home, this can all be very scary.

And they may think there's nothing they can really do to help with this.

Is there anything they can do?

-There absolutely is.

Nowadays, cyber attacks aren't done on their own or in a vacuum.

Cyber attacks are nearly always coupled with mis- and disinformation from foreign actors.

In this case, likely Iran.

And so as your viewers are seeing a social media post that was sent to them by their cousin or something, checking that information before they forward it on to everybody with reputable news organizations like yourself and others to make sure that information is accurate so that they don't inadvertently become an agent of the Iranian military is really important.

So checking your information to not spread mis- and disinformation for the Iranians is something that every person in Nevada can do themselves.