Slashdot Mirror

Online elections have been tried before in Canada -- the last one I heard about was for the election of the New Democratic Party held over a year ago, run by election.com.

During this election the system was hacked and was down for a few hours, highlighting the fact that anarchists and hackers see elections as a focal point to concentrate their efforts; luckily for election.com, the NDP, and pro-online vote advocates, they had a backup plan of some sort that seemed to thwart further hack attempts (I don't know what they did though).

Online elections will not lead to massive fraud, no more than has happened with paper ballots in most countries already. The software set up by some of the online election companies is robust and undoubtedly have redundancies built in that can thwart potential hacks. Of course nothing if foolproof but there is no sense throwing up one's hands before trying.

Maybe someone can explain to me why an online election would be any different to, say, online banking systems, for example? An online bank has a lot at stake as well, and is open to hack attempts 247, not just for 12 hours in 4 years.

It also probably WILL mean a larger voter turnout, as people with internet access (quite a large percentage of registered voters, in Canada anyways) will find it easier to vote, as they have when filing their taxes online (another government system that hasn't been seriously hacked in the few years it has been active).

Get used to on-line elections -- their "paper" trails are as good as we have already, and they attest to how robust software can be made to fend off serious and concentrated hack attempts.

If so, then also when have they patched their systems? Election.com was awarded this job in September last year. (Press release here)

Pardon me, I think it's time I registered to vote.

I think you're too late. In most states, the deadline to register has passed. Go to election.com to check it out. There's a few where it's October 27th or so, but most deadlines were in the first half of this month.

Sorry. Try again in four years. :)
--

Note that Simmons and Lessig are much further down the list than they were listed in the /. endorsements.

Timothy doesn't read Slashdot
Posted by timothy on 04:20 AM April 1st, 2001
from the at-least-read-the-front-page dept.
Frac writes: "It seems rather obvious that timothy doesn't read Slashdot, considering that the an article still on the main page mentions the exact same news." Interesting stuff. And in other news, there are now proton polymer batteries available, results from ICANN elections, and a really interesting article at ZDNET on reverse-engineering.

I like how North America Got A Cryptic Chart
chart
while everyone else got gimpy ones.
I feel sorry for the Popov guy, sorry he didn't get that many votes cause i sure love his cheap vodka.

Many people tried voting yesterday and received error messsages saying their username/password/pin were incorrect when trying to cast their vote even though they were able to login.

Number = 50101
Description = Invalid credentials. Your member number, PIN code and password combination is incorrect.
Source = Component.ApplyVote failed

The sad part is that Election.com had no one monitoring the ICANN election 24/7 since attempts by many ICANN Members to contact Election.com regarding the voting problems were unsuccessful. Surely, one would expect better oversight over an election of such importance.

Many people tried voting yesterday and received error messsages saying their username/password/pin were incorrect when trying to cast their vote even though they were able to login.

Number = 50101
Description = Invalid credentials. Your member number, PIN code and password combination is incorrect.
Source = Component.ApplyVote failed

The sad part is that Election.com had no one monitoring the ICANN election 24/7 since attempts by many ICANN Members to contact Election.com regarding the voting problems were unsuccessful. Surely, one would expect better oversight over an election of such importance.

The Reform Party's primaries have already happened... Just like the recent Arizona election, they used Election.com to handle the ballots.

Here's a Wired News story about the election.

Look people, the Voting Integrity Project went to court to try and stop the internet primary, and lost. They tried arguing that the votes could be forged. So can real votes, and they're watching both intently. They tried arguing the Digital Divide. Wrong again, the court said, because the party took extensive steps to make sure the polling places were out in the rural areas, with several in each county. VIP tried to attack on a loss on anonymity, and lost again, because there is a double blind for ballots cast in polling places as well - in Arizona you sign in at the polling place, and they assign you a ballot number. The ballot is passed along, and later, if challenged, can be traced back to an individual voter. The electronic system worked similarly.

Being familiar with computers, I talked extensively with Arizona Democratic Party Chairman Mark Fleisher, Executive Director Cortland Coleman, consultants from Election.com, and state party lawyers. I expressed much concern about the setup because of the potential for DoS attack. They had actual humans sitting monitoring the severals round the clock, watching the votes tally up, looking for things symptomatic of a DoS attack, waiting to take action against it. You'll note that NO ATTACK OCCURRED.

Yes, I hammered them because their client software didn't support Macs - it was a Java error which tested out on some Macs, but not others. I'm a Mac user, and was denied the ability to vote from home on my G3. I was able to speak with a human at their tech support line without waiting on hold at 1:30 am in the morning who directed me to another location that I could vote from.

The long and short of it was that there were not really any major problems, no voting abnormalities, and turnout increased 622%. The electronic voting, combined with mail in voting and polling places, gave people more options to vote. regardless of the naysayers, I think it was a success and will likely be repeated soon. The "Voter Integrity Project" did not have a case then, and it doesn't now, either.

ObDisclaimer: I do not work for the Arizona Democratic Party, or election.com. I do not speak for my employer on this matter, and they have no position on the Arizona Democratic Party's electronic primary election. I am a lawyer, but there is no legal advice in this message for you. Before acting on anything in this message, please consult your own attorney.
==
"This is the nineties. You don't just go around punching people. You have to say something cool first."

Look people, the Voting Integrity Project went to court to try and stop the internet primary, and lost. They tried arguing that the votes could be forged. So can real votes, and they're watching both intently. They tried arguing the Digital Divide. Wrong again, the court said, because the party took extensive steps to make sure the polling places were out in the rural areas, with several in each county. VIP tried to attack on a loss on anonymity, and lost again, because there is a double blind for ballots cast in polling places as well - in Arizona you sign in at the polling place, and they assign you a ballot number. The ballot is passed along, and later, if challenged, can be traced back to an individual voter. The electronic system worked similarly.

Being familiar with computers, I talked extensively with Arizona Democratic Party Chairman Mark Fleisher, Executive Director Cortland Coleman, consultants from Election.com, and state party lawyers. I expressed much concern about the setup because of the potential for DoS attack. They had actual humans sitting monitoring the severals round the clock, watching the votes tally up, looking for things symptomatic of a DoS attack, waiting to take action against it. You'll note that NO ATTACK OCCURRED.

Yes, I hammered them because their client software didn't support Macs - it was a Java error which tested out on some Macs, but not others. I'm a Mac user, and was denied the ability to vote from home on my G3. I was able to speak with a human at their tech support line without waiting on hold at 1:30 am in the morning who directed me to another location that I could vote from.

The long and short of it was that there were not really any major problems, no voting abnormalities, and turnout increased 622%. The electronic voting, combined with mail in voting and polling places, gave people more options to vote. regardless of the naysayers, I think it was a success and will likely be repeated soon. The "Voter Integrity Project" did not have a case then, and it doesn't now, either.

ObDisclaimer: I do not work for the Arizona Democratic Party, or election.com. I do not speak for my employer on this matter, and they have no position on the Arizona Democratic Party's electronic primary election. I am a lawyer, but there is no legal advice in this message for you. Before acting on anything in this message, please consult your own attorney.
==
"This is the nineties. You don't just go around punching people. You have to say something cool first."

What happens if somebody intercepts a bunch of physical this-is-your-PIN letters on their way to the voters

or -- better yet -- snoops on their PINs when they're being sent online?

It's a great idea that you can now vote online. The process looks simple. You type in a pin number that they sent to you a few weeks earlier, cast your vote, and your all set.

I see one big problem with this.
Aren't elections suppose to be annoymous? Can't they simply track your voting record by cross-referencing it with your pin number?

Another thing that worries me about this is that the pages don't look SECURE. When IE is on a secure page the icon of a webpage turns golden. They have a bunch of screen-shots and the icon doesn't look golden. You can grab them here. Wouldn't this be a little problem? Hmmmm.

Time period: Yes, the system will only be open for general population voting for about 48 hours. This is about the time it took people to hack the GCHQ cr/hacker test, but the Votation guys will be watching this system like hawks. I think they'll be able to handle the inevitable attack.

Availability of the system to the general public: Believe me, the Arizona Democratic Party is concerned about reaching core Democratic constituencies, many of whom do not even have access to computers, much less the internet (think about the residents of reservations, residents of poorer communities and minorities). The party is setting up more than 50 traditional polling places statewide with terminals that will conduct voting after the general public has had their chance to vote. Just as mail-in ballots reached out to those who were out of town or unable vote in person, I think this is an excellent way to reach out to younger voters, who still turn out less than any other demographic group.

Anonymity: This has always been a problem with voting. It is a special problem here - DNC rules say that only identified Democrats can cast a ballot. But, it's always been a problem! If you vote with a paper ballot or with a machine, you generally still have to come in and sign the vote register. Only then do you get your anonymous ballot. Voting by mail requires that the voter sign the flap of the envelope! Online, a series of verification checkbacks can be set up that result in a voter casting an anonymous ballot.

Vote fraud: Yes, this is a huge issue. The verification system set up is pretty extensive... The voter will receive a PIN in the mail. They'll have provide that PIN, along with other personal information required on Arizona's voter registration form to be validated to obtain a ballot. And I think the pieces are slowly coming together to prosecute fraud online. And to the people who noted e-commerce isn't 100% safe - there are always people who will try to vote illegally. This system is perhaps better equipped to stop them than some traditional hand-verification procedures. Papaer ballots are just as vulnerable to tampering.

Security: Ok, so now Votation has your verification information. At least they're one vendor, as opposed to having it scattered in the hands of hundreds of election officials statewide. And I think it's pretty much common knowledge that hacking an individual 128-bit-encrypted stream is pretty worthless compared to hacking the server that the votes are taken on. I would think relying on the browser's technology, and guarding the servers should put up a good defense. These Votation guys have conducted stockholder and union votes before, with no problems.

I'll probably get richly flamed for this post, but I think on-line voting is a valuable step in the future of the internet, the future of government and in the social well-being of the country.

==
"This is the nineties. You don't just go around punching people. You have to say something cool first."