More E-Voting Software Leaks Surface

Christopher Soghoian writes "Sound like something you've seen before? Wired News reports that the software which runs Sequoia's AVC Edge voting machines has been accidentally placed on another company's publicly available FTP server, although this time it's the binary, rather than the source that's been leaked. Machines running this software were used in California's Riverside County for the 2000 presidential election and for last month's California gubernatorial recall election. The system also has been used in counties in Florida and Washington state."

Comments

does it really matter?

[adamruck]

I dont know a whole lot about cyrpto, but if its a big deal if a binary got leaked, perhaps the software isn't that secure to begin with. We all know security through obscurity doesn't work.

Code shouldn't be important!

[hampton2600]

If these systems were really secure, then finding out the code shouldn't be important. Just because I know the RSA 128-bit algorithem, doesn't mean that I can break it in a second!

Also, why isn't the federal government coming out with a standard software framework for voting?

This seems obvious to me, at least.

Not that I trust my government to be the best coders, but heck... get the DOD on it. They are pretty good at these problem domains.

Maybe they'd run it off of source forge....

-hampton2600.

E-Voting

[mizhi]

I think that no matter how many assurances there are (and there aren't a whole lot right now) we're never going to be able to take care of lingering doubts about the security and fairness of e-voting.

Right now, voting software is obviously not ready for primetime and the companies that make it need to have some sort of oversight committee making sure they're not playing games or royally fucking things up.

There was enough of a commotion in FLA about hanging chads that people's confidence in machines are shot. And those are relatively simple compared to secure e-voting software!

It seems that the more we try to "high-tech" the voting process, the more problems and uncertainty we will introduce into the system.

So, right now I'm leaning towards a really low tech solution: simple paper and pen for ballots.

I know I'm a geek and supposed to love technological solutions. And I do, but with something as important as voting, until they get it to be as reliable as pen and paper, I say screw the machines because as a geek, I also know how unreliable software can be.

Bullshit. Libraries. F-15s. Interstate Highways.

[namespan]

Yeah, because if the federal government does it, it is efficient, reliable, and effective.

Blah blah -- the government boondoggle meme strikes again. Yes, it has its roots in some truths, and that's why it exists. But...

The problem is, there are in fact examples of government programs and agencies working and working well. Our, poor, terribly innefficient government programs are responsible for creating the world's best military. My locality might be an exception, but we've got incredible public library resources that I'm so happy with I'm *glad* when I get library fines. The Interstate Highway system makes cross country travel effecient and quick -- which keeps the cost of goods lower -- at least, those you buy that were shipped from somewhere else.

Yep -- I know, private firms were involved in the creation of each of those things. Doesn't change the fact that some branch of our poor, incapable, incompetent government commissioned and managed those projects.

And yes, I know -- the DMV is frustrating to deal with. But I can tell you that the service of the DMV and even the IRS looks positively stellar compared to any number of private entitities -- several health insurance companies, Sprint, Microsoft Customer support, and the hosting company I called last week (no, not some dinky provider either -- I'm talking freakin' Interland here). All of whom should have, in theory, been erased by the invisible hand or otherwise kicked in the pants by the market. But in fact, these beaurocracies are no better than most mediocre government beaurocracies.

So it's fun to repeat, but remember to look at the facts while you're thinking about it. Our beloved commercial driven-to-efficiency-by-the-market companies have produced an absolute steaming heap of bovine excrement when it comes to an e-voting product. And yes, it's still taxpayer subsidized, because our governments are paying for these products -- and not just the costs, but also the profits.

Re:Standard Rubuttal to Ballot Receipts

[laird]

Paper receipts are worthless -- not only do they rely on everyone keeping theirs (and turning it in when asked, etc.) in case of a recount, but there's no guarantee that the vote printed on the receipt matches the vote recorded in the eVoting system.

The only system that works is having people make marks on paper that they can look at and verify, then put into an independent tallying device to count the votes, which rejects invalid votes immediately so that they can be corrected. And in the even of a recount, the paper can be re-scanned.

Astoundingly enough, such devices not only exist, they're cheap, reliable, and fairly widely used -- scantrons! They have the lowest error rate of any voting mechanism, and cost almost nothing.

I have no idea why anyone would even consider an untested (and un-auditable) touchscreen terminal that costs thousands of dollars instead of a scantron that costs almost nothing (the forms cost about 10 cents, and the election board can borrow the scantron from the local schools).

Luckily (http://newshound.de.siu.edu/spring03/stories/stor yReader$1954) not everyone is so enamored of technology that they overlook the obvious.

But just to keep us on our toes, these morons (http://clients.enfocom.com/avs/products_winvote.h tml) actually put wireless LAN interfaces on their touchscreen machines ("The functionality linchpin of the WINvoteTM system is its wireless LAN (IEEE 802.11b) system - called the Wireless Information Network (WIN) -- that enables the user to communicate remotely with the major components of the voting system.")

Isn't anyone with a brain cell writing the requirements for these voting systems? You'd think that secure and auditable would be adjectives that you'd want in a voting system.