Michael A. Specter 👻

Michael A. Specter 👻

@mikespecter.com

| Assistant Professor, CS @ Georgia Tech | | Research Scientist @ Google | | Prev: PhD in EECS from MIT | | spdr.cc.gatech.edu | | mikespecter.com |

350 followers143 following84 posts

We also bought EncroChat's original domain (encrochat.ch) --- it now hosts our paper and other info.

encrochat.chA Real-World Law-Enforcement Hack: The Case of Encrochat
Martin R. Albrecht@malb.bsky.social

Also, the article makes it sound as if our work is mostly concerned with the legal side of the Encrochat cases, but we gave a comprehensive technical account: eprint.iacr.org/2026/1319 We also discuss those open questions. We didn't have access to a device/image, limiting what we could establish.

Michael A. Specter 👻 reposted

Some important context: LA is the US's most populous county (9.6M), and as a result their elections are fascinating. They literally need helicopters fly ballots around. It's amazing. Anyway, that's why it takes so long. Hope this helps.

Voter files are largely public. In many states, political parties can buy them, or request them for free. My research team at Georgia Tech has gotten them from FL and GA for papers we've worked on. It's not shocking that China --- or any intelligence agency --- would get them.

I second this. I'm a professor, one that focuses on election security and disclosed vulns in real elections systems. A simple guide: Unhelpful: Relitigating 2020, the SAVE act. Helpful: Rebuild CISA, re-hire EAC commissioners, & fund elections research.

Ben Adida@benadida.com

In case this is useful this week: if someone claims that an election held 6 years ago was fraudulent, they would need evidence thoroughly convincing to a large majority of election experts. Anything short of that should be dismissed without hesitation.

Someone at my university's licensing office posted a ton of flyers trying to get our students to file patents. An enterprising grad student took that personally and stuck a flyer advertising the GPL below _every_ one.

Michael A. Specter 👻 reposted

New feature digs into the age check tech that Discord endorsed following widespread backlash. Bottom line: On-device checks—if they work as they claim—are more privacy-preserving, but privacy advocates still don't think age verification laws are effective enough to justify any of it:

View full thread

3. Yoti, the dominant provider in the US, collects significant private information. Data is sent to 3rd, 4th, or even 5th parties, including (in at least one case) the original site the user came from. 4. Yoti's security claims are... interesting

For context, the privacy concerns we found, as well as the compliance, and spill over effects directly contravene the logic in the recent Thomas's FSC v Paxton Supreme Court decision.

TL;DR: 1. Compliance is low: for sites that admit to age verification, roughly 15% deploy age verification in covered states 2. There's a spill-over effect: quite a few sites require verification in NY, despite there being no law there.

Michael A. Specter 👻 reposted

#ElectionGeeks: This will be a really interesting conversation on voting system usability and accessibility between @caltechlcssp.bsky.social Co-Director @rmichaelalvarez.bsky.social & Georgia Tech's @mikespecter.com, including discussion on Professor Specter's latest research.

Wed, 1/28 at 11am Pacific: “Beyond the Hype: A Research Driven Look at Claims About New Voting Technology” #ElectionScienceOfficeHours Host @rmichaelalvarez.bsky.social, @caltech.edu & guest Georgia Tech's @mikespecter.com. Register: caltech.zoom.us/webinar/regi...

View full thread

In any case this system should have been published before a launch was announced. If I take a look and find vulnerabilities, will Alaska stop the deployment? Can they? Or would doing so cause too much harm and reputational risk?

I’m begging here: elections officials should be proactively asking for help from security researchers in calls like this. Analysis should be done, and the system should be public before announcing adoption. Doing it this way forces bad press that I don’t want to give. It’s bad for democracy.

View full thread

The article also quotes, unchallenged, Estonia’s election director: “can you compromise it in such a way that the monitoring you’ve got in place wouldn’t detect it” First, vulns often would not have been detectable. Whatever this system is, it’s likely got flaws. Most deployed systems do.

Second, for elections, an attacker’s goal might be different than just causing a secret change in outcome Perhaps it’s stopping a certain population from voting. Or the goal may be causing chaos and weakening trust. E.g. What would happen if the system were just knocked offline on Election Day?

View full thread

I am aware of no advances in “cloud technology” that fix inherent problems in internet voting. “Paper backups” also fail to fix much of anything—a malicious or broken into system can ignore the voter’s selections and print whatever it wants.

“Security experts say that while nothing on the internet can be completely impenetrable from hacking, advances in cloud-based technology, as well as linking mobile voting to a paper backup system, could help alleviate some of the concerns” This is incorrect, and no security expert was quoted.

Time and again, Internet voting in practice has been shown to introduce significant vulnerabilities in elections. To my count, there have been five systems piloted in real world elections. Once researchers examined them, all have had significant flaws that would overturn the election.

View full thread

“...We refer to an abacus as “an abacus” rather than a digital computer, despite the fact that it relies on digital manipulation to effect its computations. Finally, we refer to a dog as “a dog” because even the most strenuous mental gymnastics can’t really make it sound like it’s a computer.”

View full thread

Michael A. Specter 👻 reposted

Michael A. Specter 👻 reposted

On Saturday, the United States Senate Parliamentarian determined that the proposed 10-year federal moratorium on enforcing state AI legislation contained in the budget bill has survived procedural scrutiny — known as the Byrd Rule — and will remain in the bill.

techpolicy.pressProposed Federal Moratorium on State AI Laws Clears Hurdle in US Senate | TechPolicy.PressThe path forward for the moratorium is now procedurally clear, pending broader negotiations over the budget bill’s contents.

Michael A. Specter 👻 reposted

Michael A. Specter 👻 reposted

"What anonymous source is going to go anywhere near me now? If you were some high-up whistleblower, the last thing you’d do is message a journalist on an app strongly associated with JD Vance."

buff.lyI’m the Private Messaging App Signal, and the Trump Administration Is Ruining My Brand“The unofficial version of Signal used by Donald Trump’s former National Security Adviser Mike Waltz has been hacked.” — Reuters - - -Want to hear ...