Slashdot Mirror
E-Voting Expert Testifies
Christopher Soghoian writes "Johns Hopkins University professor Dr. Avi Rubin (of previous e-voting fame) yesterday testified before the Maryland House Ways and Means Committee.
An article in the Baltimore Sun describes his testimony, as well as that of the director of the state elections board, Linda Lamone. Mrs. Lamone was highly critical of Dr Rubin's testimony, stating that he was doing 'a great disservice to democracy. They're telling the public: Don't trust them, don't trust the voting equipment.'
This begs the question: Is it better for security researchers to avoid publicly criticizing e-voting flaws? Is public faith in the system more important than overall system security?"
If Lamone is attacking the messenger, rather than the message, she is surely guilty of some flaw...
The E-Testifying company which handled his testimony, also owned by an E-Voting company, has changed what he said! The testimony now reads "E-Voting is great. We should all move to E-Voting now. I for one welcome our new E-Voting overlords."
Is public faith in the system more important than overall system security?
I love the Leader too!
-Ben
Just because a virus sitting in Jane AOL's system sending out spam isn't affecting her business, it doesn't make it OK. If fraud is going to go on next election, as personally I'm sure it will, there need to be huge changes happen before integrety is restored.
Faith in the system by the public is absolutely more important than actual security. As long as people perceive that everything is secure and on the level, then why should security matter? Actually securing the system would just be a hinderance to the system of electoral fraud that the USA was founded on.
Doubters have to be able to scrutinize the way the system works. So, in order to be trusted by as many people as possible, the system should be understandable by as many people as possible.
As soon as you have any kind of black box whose functionning cannot either be seen, or plainly understood by people, there is room for doubt.
This is why a hand-counted, paper-based ballot system is the most trustable one possible: it doesn't take a computer scientist to understand how it works and how it could be rigged.
I think they still do that today and if somebody went public with how stupid this really is, I'm sure they would get the same treatment. Be EDUCATING the public, the politicians feel threatened. They've made clueless decisions and when those decisions are threatened... well, it's just unAmerican( or so THEY say ).
For the people, by the people... yea, right.
LoB
"Anyone who stands out in the middle of a road looks like roadkill to me." --Linus
Most people, like the poster, incorrectly assume that "begs the question" is the same as "answers the question". This describes the proper use of the phrase.
Toronto-area transit rider? Rate your ride.
I don't think that I am stepping outside of the "group think" of Slashdot when I say "Secure systems are more secure with open and accessable standards and code which will verify that they are indeed secure". Furthermore, "Security is not inhanced by elimating the freedom of discussion"
The grass is only greener, if you don't take care of your own lawn.
What do you mean, the software is used to decide the next president?
Public faith in the integrity of the electoral system is vital if democracy is to be successful. If one of the vital components of the electoral system is flawed then the public can have no faith and the system cannot work.
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
-50 points
thank you
have a nice day
The adage "one (wo)man, one vote" is one of the founding principle of any democracy. Similarly "No person, be (s)he so great or so small shall count any more or less than any other."
...
With such powerful statements as the above, how can the reliability of the voting system be allowed to be suspect. I can't think of anything more demoralising to a voter than the thought that the "system" might just lose that person's vote. Or make it up. Or get it wrong. Or
You need to have a faith that "the system" works, in order to work within the system. Take a look around the world where it's failed...
With that in mind, then how can anyone who draws attention to a flaw in "the system" be villified ? Only by those with a vested interest (be that they are then open to charges of incompetence, that the system favours them, whatever) in the status quo.
I say "For shame". And I direct it not at those exposing flaws. I don't care, by the way, whether it's an electronic system or a manual one - it's the principle here that counts.
Simon.
Physicists get Hadrons!
sorry, you fail it. Should have done an emerge sync && emerge -u world last night, your first post would be up to date, but nooooo, you had to do it before upgrading...
"Is public faith in the system more important than overall system security?"
Maybe...since "democracy" is an illusion anyway, maintained by those with power to give those without power the illusion (or delusion) that they actually have a say in what goes on...basically to keep them pacified. Maintaining that illusion better suits democracy's real purpose more so than blowing the whistle on technical voting "irregularities". Make no mistake: Those irregularities, coupled with influence peddling and all the other mechanisms that result in only carefully scripted "decisions" have existed long before black-box voting reared its ugly head. "The will of the people" is a myth.
You're using her as bait, Master!
In my opinion, public faith may very well be better than a system that we think works. There are flaws in every system, some of them inserted deliberately. With flaws as egregious as Diebold's, we (or anyone) can probably use the flaws to fix the massive errors and possible cheating. OK, I know, this sounds idealistic, but someone will always try to rig e-voting, might as well make it easy to be fixed/counter-rigged.
"73% of quotes on the Internet are made up" -Ben Franklin
Is it better for security researchers to avoid publicly criticizing e-voting flaws? Is public faith in the system more important than overall system security?"
Is this a trick question? Is Slashdot being controlled by e-voting Nazi's who hope to find out those that are skeptical so they can come to their houses and force feed them e-voting propaganda?
Oh well, the answer is NO!!! Security through obscurity DOES NOT WORK!!!
They're telling the public: Don't trust them, don't trust the voting equipment.
Is public faith in the system more important than overall system security?
The trouble is with that 5-letter word: faith. Anything that handles data in an obscure way (read closed-source) relies on user's faith.
Anytime you start a closed-source program, faith in the coders/packagers is what makes you believe that nothing will go wrong. You can't double-check anything; if source is available, you don't need faith: just read the code. I guess for the majority it's the same: they don't understand so they must have faith in those who do.
But I feel it's just like a car: most people don't understand the inner workings - but they wouldn't buy one on which the hood is sealed.
This begs the question: Is it better for security researchers to avoid publicly criticizing e-voting flaws? Is public faith in the system more important than overall system security?
Is this really a question that needs to be asked? Are you asking that for the sake of democracy, is it better if the people don't know everything? At first I thought this question was ironically posed, but now I'm fearing that it's not.
I really don't see why in the world the people responsible would want to shush the researchers, other than to hide something they don't want uncovered. As hard as it is for the people that are trying to get the message out that these voting machines can't be trusted, I hope they continue doing it until this whole mess is over and a reliable voting system is put in place.
Maan
How in the world can you do a disservice to democracy by highlighting a new voting technqiue that is plauged by insecurity and potential for fraud? In fact, what he is doing more service to democracy than anyone alive. It's the people who think their jobs are on the line for some questionable calls that are doing democracy a disservice. With all due respect to their opinion, I don't really care if this makes some election official look bad. Perhaps the professor should be heard and the problems he highlights investigated. A lot of this technical stuff is not all that subjective. Here's an idea, have Cusomer Reports subject the e-voting machines to their usual array of scrutiny (they'll need experts of course). That sounds fun. :)
David Whatley
kind of LIEk va lairIE/robbIE's stuff that matters slowgun, & their whoreabully infactdead (& obviously, still broken) PostBlock(tm) commeNT censoring devise?
/.puppets to determine which way the wwwind is bullowing at gale force/farce?
& oe =UTF-8&q=microsoft+%22bill+weisgerber%22&btnG=Goog le+Search
& oe =UTF-8&q=microsoft+%22sanjay+ahuja%22&btnG=Google+ Search
& oe =UTF-8&q=microsoft+attacks+linux+open+source&btnG= Google+Search
you won't be needing any phonIE corepirate nazi FUDgePacking devices/?pr? ?firm?hypenosys
that's right, this stuff is unbreakable, wwworks on several (more than 3) dimensions, & requires no 'BiG scIEnce' FUnDing.
'big science' will have to 'discover' it's conscience before it can tap into this stuff.
Two programs got the nod, so far. The top priority is planet/population rescue. Other goals mandated include the permanent disempowerment of unprecedented evile, & assurance that the planet/population is around to enjoy the gnu millennium of open/honest communications/commerce. Your grandchildren will survive to produce additional uses for the powers that are rescuing us from the greed/fear/ego based life0cide, as the lights come up...
consult with/trust in yOUR creator... get ready to see the light. there's never a cover charge/subscription fee. see you there? tell 'em robbIE?
even more corepirate nazi schemes eXPosed?
& what dispositions are to be considered for the felonious payper liesense softwar gangsters as they are rendered invalid, & more&more of their phonIE stock markup scams are known? maybe they'll 'release' linus, & put fuddles et ALL, in prison.
then, let's say fuddles IS the greed/fear/ego based massturdmined softwar gangster bankrolling the phonIE ?pr? ?firm? scriptdead attacks on the hobbyist dogooders. can we say fud wants more, has a conscience deficit, & no regard for the public/his hostages? we could easily say that.
talk about fauxking wags?
nothing gnu about this phonIE ?pr? ?firm? softwar gangster scriptdead crud:
http://www.google.com/search?hl=en&lr=&ie=UTF-8
http://www.google.com/search?hl=en&lr=&ie=UTF-8
http://www.google.com/search?hl=en&lr=&ie=UTF-8
wag on at: http://www.trustworthycomputing.com
felonious softwar gangster execrable hired goons?
what else could it be?
http://www.mdarchives.state.md.us/msa/mdmanual/25i nd/html/30elect.html
Mrs. Lamone was highly critical of Dr Rubin's testimony, stating that he was doing 'a great disservice to democracy. They're telling the public: Don't trust them, don't trust the voting equipment.'
"Ignore that man behind the curtain."
(Or should that be "Ignore the guys sneaking up behind you with the net."?)
Yes, they're telling the public to distrust the voting machines. And in the short run that may destabilize the nation - slightly.
But distrust of something untrustworthy is appropriate - especially when letting it be corrupted can literally lead to tyrrany and war, while FIXING it so that it is verifiably trustworthy is trivial.
Of course that means the decisions of Mrs. Lamone's department (no doubt those of Mrs. Lamone) might be criticised, and her state be required to spend more money to upgrade or replace the devices they selected. Bad for her carreer path, eh?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
This begs the question: Is it better for security researchers to avoid publicly criticizing e-voting flaws?
The answer is pretty straightforward: NO. Security researchers and other whistle blowers serve a valuable role in public. This isn't even an interesting question. A more suitable qustion for discussion is:
* Why is the incumbent party in power supporting untrustworthy voting machines?
* Why would someone oppose a simple request for accountability being built in to our democratic process?
* How is it so difficult to see there is an opportunity to create the worlds possibly first trustworthy election system? All we need is a paper backup...
-- $G
Mr Rubin or Ms Lemone?
Ok, now that we have that settled, this woman has no idea what she's talking about and yet she's running the system. This is one of the MAJOR problems with e-voting. Everyone running the show has absolutely no clue. This makes it ripe for fraud and abuse.
I say we go back to a form of voting that even a five year old can understand - paper and pencil... or paper and crayon... because five year olds like crayons.
Remember, when dealing with children -- Keep it simple.
I'd rather have someone write about the flaws ahead of time than discover them by their results.
Information will find its way out, one way or another.
sigs, as if you care.
Obviously, for e-voting to function, there can't be any suggestion of fallibility. After all, what good is a voting system that instills doubt? It may be reasonable, but it's still doubt.
Litigious bastards
I read Slashdot every day. There seems to be an e-voting story about once a week, and it's always cast in an "e-voting is evil/impossible/flawed/broken/corrupt" light. I was wondering...is there any argument FOR e-voting, from a pro-technology, pro-democracy standpoint?
Does anybody out there support e-voting, and, if so, why?
There's no reason not to perform an ordinary round of safety and reliability testing on this system. It's obvious they did nothing other than casual alpha and beta testing, with no code inspection, no robustness, no structural coverage, and no documentation of faults.
They don't even follow the laws when taking machines out of service to be repaired at the polls.
It's not worth discussing the merits of the current machines. They have none.
ppp-67-37-26-36.dialup.wotnoh.ameritech.net
so?
Probably the best quote from the whole article: "I thought he was far more credible than I thought."
Use Ctrl-C instead of ESC in Vim!
Trust by Obscurity will never work to convince people with a background in computers. However, it is sad that people can argue about "hanging chads" but seem to trust that computers are impartial and never wrong.
Then again if we inform people that even discounting corruption and other problems, that a simple "off by one" error can greatly change the results they may never trust us, the computer development community, to do anything significant again.
All said and done though, since this seems to be a Republican plot, and I am a registered Republican, I want to be first to say this.
I Welcome Our New Republican Electronic Voting Fraud Elected Overlords
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
Ok, i'll bite..
Just how, exactly, does one become an "e-Voting expert"?
"Yes, your Honor, I have 3 years experience in the field of poking. I was a Poking major in college, and belong to a number of internationally-recognized poking, pointing and clicking consortiums. During my years at McDonalds, I logged a total of over 40 hours a week poking screens for nearly two years before leaving to pursue other career opportunities (fry clerk)."
WTF?
Bowie J. Poag
a great disservice to democracy. Now they are trying to improve on punchcards, and that's a disservice.
Will the argument go:
2000 - "Bush stole the election with punchcards. The people need e-voting!"
2004 - "Bush stole the election with e-voting. The people need punchcards!"
You know people, e-voting might not be foolproof, but punchcards are easier to hack. Any al Qaeda can walk into a DMV in California and ask for a voter's registration card, and voila!
Hacked.
Slashdot "libertarians": Small government for me, big government for those I disagree with. -1, I disagree with you
Public faith is important. The first step to that faith is a system which deserves it.
-Rob
Not that I'm advocating it, but I see a lot of people getting very angry about this issue. I can see this debate getting to the point where some group of angry citizens finds a way to disable or mess up the voting machines. Might be as simple as going into the booths and smashing the touch screens or better yet, something more clever, such as a hack that puts up Abe Lincoln as a candidate or something.
I can see the irony of all e-voting machines being technically disabled and people actually having to vote with pen and paper. Would certainly be a good story for the evening news...
Is public faith in the system more important than overall system security?
Faith is completely unimportant. Trust, on the other hand, is incredibly important. Faith is blind trust which is only important when the belief is not verifiable (think religion...you can't prove god exists, but you could have faith that he does.) Since e-voting is, at least, somewhat verifiable, faith shouldn't apply.
As the saying goes, "trust is earned." The only way to earn trust is to answer your detractors arguments to prove that your system is secure. You can be trusted once your detractors have no more valid points.
"Don't blame me, I voted for Kodos!"
Which is the argument against security researchers publicizing problems in any voting system. This is especially true if the new voting system is at least as fair and secure as the system to be replaced.
However, the standards for 'fairness' are increasingly strict. Many in the US now want to count every single person, no matter how poor, dark, or uneducated that person is. Such inclusive counting keeps people content while not changing the political landscape all that much, as the elite have other ways to control the landscape. Furthermore, as more people become educated they want access to the public process. Since the educated have the power to disrupt, their concerns matter and should be addressed to protect the peace which is so critical for economic well being.
Additionally, technology allows increased trust in our system. One good example is fingerprinting. Genetic matching brought up issues of the trust and reliability in the technology used to identify suspects. The courts ruled that any technology used in the courts must be reliable. This brought up the question of whether fingerprints are reliable. Though they have been used for a long time, and though a full fingerprint is reliable, the partial prints may not be. Even though they satisfies the standards of the past, they may not satisfy current standards.
Voting may be a smilier case. A higher level of reliability is possible, so it mandated that the possibility be realized.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
Is public faith in the system more important than overall system security?
The most important aspect of the public's relationship to voting is trust. Universal suffrage does not employ all the people in choosing our leaders because "100 million heads are better than one". To the contrary, "None of us is as dumb as all of us". Voting is a method of demonstrating consensus of the governed, so it's easier for us to accept the elected. With the beating administered to their constituents' trust by politicians ever increasing, trust of the elections must be increased to compensate, to allow us to be governable.
We don't have to choose between trust and security. Just read that sentence again; choose between trust and security?! Security REQUIRES trust. This goes beyond the modern either/or fallacies of the excluded middle, like "those who would choose a little temporary security at the expense of liberty" who would neither deserve nor get either security or liberty. When you look at the torrent of these fallacies coming out of politicians today, you've got to wonder "where is this coming from"? They're adults, haven't they learned to see through that simple trap? Or is it just contempt for the public that frames these false choices? America is the strongest country in the world, because of the variety of choices we create, then choose. To throw that away over every security issue is to choose the path to doom. Why do they hate America?
--
make install -not war
Disclosure: I'm a precinct poll-worker.
I find myself more and more irritated with the idea that, even if a system is approved, then I would still be forced to use it. Seems to me that's not in the best interests of democracy. If I went into the polls one day, saw the machines, I should be able to say "to hell with them...I'll just write my votes on a ballot and give it you people."
I say that one way to improve the system is to lobby state legislatures for the ability to opt-out from using the machines and cast a paper ballot. By always having that option available, security is under stronger examination, since the machines are in competition with paper.
Security, as most geeks know it, is an issue, but it's an issue because it speaks to a much larger concern: the overall integrity of the system- it is this trait that should worry anyone interested in maintaining a democratic form of government. In other words, it's not that the system is insecure, it's that it's lack of security, in addition to the lack of controls over modifications to the software, hardware maintenance/administration, etc., poses a substantial threat to the integrity of the voting process, and this is why e-voting should be scrapped (at least in its current form). Maybe this is just a semantic game, but referring to the lack of integrity moves it out of the technical realm, and gets at the real issue, which I'd argue, can be more easily understood.
Consider this: If the American people are so blind as to ignore the obvious problems with these e-voting machines, then they DESERVE whatever form of government corruption they end up with. We have a valuable lesson to be learned here. Fox news is beginning to pick up on this. Lets hope that the media bcomes quite loud in the coming months about the discrepancies and the "changes" made to these machines during and immediately after some recent elections. If these machines could be hacked, or changed, then I would submit that they are NOT viable as an alternative to conventional voting machines, be they mechanical or punch-paper cards. I would suggest that we keep the voting process as simple and straightforward as possible, and that we utilize our current methods for counting and recording the votes. No matter how complex it becomes, the voting process must be overseen by a responsible party, one that can be criminally prosecuted for fraud, should it become apparent. Since no electronic method is 100% secure, I would suggest that we disallow those methods. Now it's up to you, the people. Do you want someone else telling you how you voted before you vote?
There have already been enough electronic voting machines in place in the United States to completely change the outcome of recent elections. It's been happening and no one seems to care.
Just wait to see what happens in Nov 2004.
The Shit will hit the fan.
http://en.wikipedia.org/wiki/2004_U.S._Election_c
"I think they're doing a great disservice to democracy," she said. "They're telling the public: Don't trust them, don't trust the voting equipment."
Sounds like the sort of thing dictators say when making an example out of someone eg. "he's an enemy of the people, he would kill your baby in the blink of an eye, would you actually trust a man like this that kills babys?" Then again there was the whole communist thing "hes a commie burn him" and the un-american thing "you are an un-american and im gonna call the FBI on you"
Linda Lamone either has no-idea about electronic voting, or has another agenda.
Actually i just realised shes right but shes using the redifined term for democracy which means "the most money wins" in which case its bad that the machines cant be controlled buy the most affluent people
This comment does not represent the views or opinions of the user.
Anyone who wants public faith in the voting system over accuracy and security is opening the door to election fraud. Unfortunately for them, contempt levels with the government are so high right now (especially after Dubya's little fib about WMD in Iraq) that we don't trust anything they say. Stop lying to the people and they'll trust you. Until then, we'll continue to ask questions to make sure we're getting a fair deal and not a rigged election (well, they're all pretty much rigged anyway with party-based gerrymandering of voting districts, but that's a whole other issue. :)
Saying it is un-American to be critical of the American government is un-American. To ask others to be critical as well is really, really un-American.
Slashdot: Where people pretend to be twice as smart as they really are by behaving like children.
The article says that the governor assigned Science Applications International Corp to look over the Diebold code and they found 26 vulnerabilities. Diebold is supposed to fix them, but SAIC won't get to review the fixes.
Instead the check is to be done by BSC Systems of Churchton, MD. Google didn't have anything about them. Anybody know if they are qualified for this sort of work?
Here's part of a presentation to a county in New mexico which is considering Sequia systems If you aren't up to date on the controversy over so called "black box voting" here's just a few recent articles to give you a flavor about what is being said in the media: http://www.wired.com/news/politics/0,1283,61068,00 .html?tw=wn_tophead_5
http://www.nzherald.co.nz/storydisplay.cfm?storyID =3529556&thesection=news&thesubsection=wor ld
http://www.wired.com/news/print/0,1294,61045,00.ht ml
http://www.washingtonpost.com/ac2/wp-dyn/A1397-200 3Nov5?language=printer
Why there is no need to rush
The state deadline for HAVA compliance is over two years off, the planned system wont meet expected new federal requirements (sponsored by Tom Udall and 61 other congressmen), and better, equivalently priced, systems will be available in the forseable future. Finally, the federal law and state law requires voting machines to be FEC and NIST standards compliant; these standards have not yet been set for touch screens.
STATE DEADLINE IS OVER TWO YEARS AWAY
First, some comments by the clerks office indicate a belief that Los Alamos must have touch screen systems in place for the 2004 vote. Recent information contradicts this deadline. In fact, the N.M. Secretary of States draft plan for implementation of the HAVA act, calls for a goal of January 1 2006, for placement of one touch screen DRE in every polling place. (http://www.sos.state.nm.us/Election/HAVA/HAVA03.h tm )
NEW FEDERAL LEGISLATION MAY DISQUALIFY PLANNED SEQUOIA SYSTEM
Second, federal legislation currently in committee would disqualify the proposed Sequoia voting systems equipment. In may 2003, our representative Tom Udall co-sponsored H.R. 2239, to amend the Help America Vote Act of 2002 to require a voter-verified hardcopy, also know as The Voter Confidence and Increased Accessibility Act of 2003. This bill requires DRE systems to produce a voter verifiable hardcopy and the software to be fully disclosed to anyone (i.e. open source). The Sequoia system meets neither of these requirements at present (however, the next generation of Sequoia systems may possibly be able to meet this requirement.) http://holt.house.gov/issues2.cfm?id=5996
This bill has 61 co-sponsors: even if this bill fails to pass this session, the strength of this overwhelming endorsement ought to indicate to the council that Voter verifiable hardcopies and open source software are extremely desirable characteristics. Indeed this is so important that the country of Brazil, which has 400,000 electronic voting machines has decide to replace them with voter verifiable systems.
(see http://www.notablesoftware.com/Papers/BtF.html ) Australia, New Zeland, and Canada require open-source voting systems.
VASTLY BETTER TOUCH SCREEN SYSTEMS AVAILABLE AT NO ADDITONAL COST
Third, already three manufacturers offer touch screen systems, which provide paper voter verifiable records of vote and some offer software disclosure. The Avante Vote-Trakker, Accupol, and Advanced Voting Systems (Hewlet Packard) all print voter verifiable ballots. The "big three" touch screen makers ( ES&S, Diebold, Sequoia) all have prototypes that produce voter verifiable paper records that should be certified in the near future. (http://verifiedvoting.org) Finally, Vogue Election Systems, offers an alternative to touch screen systems: a HAVA compliant device that assists handicapped voters to independently mark a conventional optical scan ballot. (http://www.vogueelection.com/ )
These newer systems are not expected to be more costly that the current non-voter-verifiable systems. After pressure by California's Santa Clara county (19 million dollar contract), Sequoia voting system has agreed to implement (at no added cost) a voter verified, recountable, paper ballot addition to the touch
screen system. http://www.verifiedvoting.org/states/ca/ca-scco.as p
OTHER UNCER
Some drink at the fountain of knowledge. Others just gargle.
This is just another example of how dissent in this country is somehow viewed as "undemocratic" or "unpatriotic" (which is quite the oxymoron given that dissent is what DEFINES democracy). More and more often we see cases where the powers that be attempt to marginalize those who don't quite swallow the spoonfed BS. For example:
Diebold Issues Cease and Desist to Indymedia
US Takes Hardline Against Greenpeace
Labeling anti-war protestors as 'unAmerican'
I have no problem with people disagreeing with someone's opinion, but the instant labeling of someone as 'undemocratic' or a 'terrorist' because they are exercising free speech makes me sick.
If you aren't up to date on the controversy over so called "black box voting" here's just a few recent articles to give you a flavor about what is being said in the media:
.html?tw=wn_tophead_5
http://www.wired.com/news/politics/0,1283,61068, 00
http://www.nzherald.co.nz/storydisplay.cfm?story ID =3529556&thesection=news&thesubsection=wor ld
http://www.wired.com/news/print/0,1294,61045,00. ht ml
http://www.washingtonpost.com/ac2/wp-dyn/A1397-2 00 3Nov5?language=printer
Why there is no need to rush
The state deadline for HAVA compliance is over two years off, the planned system wont meet expected new federal requirements (sponsored by Tom Udall and 61 other congressmen), and better, equivalently priced, systems will be available in the forseable future. Finally, the federal law and state law requires voting machines to be FEC and NIST standards compliant; these standards have not yet been set for touch screens.
STATE DEADLINE IS OVER TWO YEARS AWAY
First, some comments by the clerks office indicate a belief that Los Alamos must have touch screen systems in place for the 2004 vote. Recent information contradicts this deadline. In fact, the N.M. Secretary of States draft plan for implementation of the HAVA act, calls for a goal of January 1 2006, for placement of one touch screen DRE in every polling place. (http://www.sos.state.nm.us/Election/HAVA/HAVA03.h tm )
NEW FEDERAL LEGISLATION MAY DISQUALIFY PLANNED SEQUOIA SYSTEM
Second, federal legislation currently in committee would disqualify the proposed Sequoia voting systems equipment. In may 2003, our representative Tom Udall co-sponsored H.R. 2239, to amend the Help America Vote Act of 2002 to require a voter-verified hardcopy, also know as The Voter Confidence and Increased Accessibility Act of 2003. This bill requires DRE systems to produce a voter verifiable hardcopy and the software to be fully disclosed to anyone (i.e. open source). The Sequoia system meets neither of these requirements at present (however, the next generation of Sequoia systems may possibly be able to meet this requirement.) http://holt.house.gov/issues2.cfm?id=5996
This bill has 61 co-sponsors: even if this bill fails to pass this session, the strength of this overwhelming endorsement ought to indicate to the council that Voter verifiable hardcopies and open source software are extremely desirable characteristics. Indeed this is so important that the country of Brazil, which has 400,000 electronic voting machines has decide to replace them with voter verifiable systems.
(see http://www.notablesoftware.com/Papers/BtF.html ) Australia, New Zeland, and Canada require open-source voting systems.
VASTLY BETTER TOUCH SCREEN SYSTEMS AVAILABLE AT NO ADDITONAL COST
Third, already three manufacturers offer touch screen systems, which provide paper voter verifiable records of vote and some offer software disclosure. The Avante Vote-Trakker, Accupol, and Advanced Voting Systems (Hewlet Packard) all print voter verifiable ballots. The "big three" touch screen makers ( ES&S, Diebold, Sequoia) all have prototypes that produce voter verifiable paper records that should be certified in the near future. (http://verifiedvoting.org) Finally, Vogue Election Systems, offers an alternative to touch screen systems: a HAVA compliant device that assists handicapped voters to independently mark a conventional optical scan ballot. (http://www.vogueelection.com/ )
These newer systems are not expected to be more costly that the current non-voter-verifiable systems. After pressure by California's Santa Clara county (19 million dollar contract), Sequoia voting system has agreed to implement (at no added cost) a voter verified, recountable, paper ballot addition to the touch
screen system. http://www.verifiedvoting.org/states/ca/ca-scco.as p
OTHER UNCERTAINTIE
Some drink at the fountain of knowledge. Others just gargle.
"I don't think Diebold would allow it," she said. "It's their proprietary code." --Linda Lamone, State Elections Board Director.
Okay, so has she not seen or even heard of the leaked e-mails from Diebold? Maybe someone should send them to her en masse?
Anyways...
That excuse is bulls#!t. If they have their way, EVERYONE'S elections will run on their systems. Would I would want someone other than Diebold to review every inch of that code? YA DAMN SKIPPY! I don't want my elections run by some clearly untrustworthy company who is a large contributor to ANY party running the election systems in this country.
This is another good reason to suggest open-sourced stuff for elections. The code would be open, and ideally it wouldn't be prejudiced toward any party. (Then again, some republicans in office may cry foul because it doesn't benefit any of their "constituents". ^_^)
Why yes I am paranoid! Thanks for asking!
innocents, results in a cesspool of greed/fear/ego based deceptive MiSinformation.
get ready to see the light. there'll be no going back, & no where to hide, as the big flash is already occurring.
If all the polls had a CowboyNeal option, I think everyone would be happy.
And then there was E
In matters of public trust it is not for any individual to censor himself. Rather, all facts and opinions MUST be expressed, so that those rightfully elected to make these decisions can make them will full information.
After all, what is more important? The trifling amount of money that might be saved, or valid, unrigged elections?
- In a knowledge based industry your main asset will always be people -
I think, one of the most important safeguards in voting is the possibility to audit and correct the results many times over by many "auditors" (e.g. people and processes who re-count). Paper and pencil in connection with proper processes represent technology/methodology with these characteristics. Good electoral processes include a certain amount of re-counting already in the original count. More than one person looks at each ballot and agreement on the intent of the vote has to be there. If an entire electoral station's vote-counters are corrupt, then ballot boxes can be shipped off to a new group of examiners.
For example, I think e-voting needs to emulate the capability of having several independent examinations of a vote (like several people looking at a ballot, and interpreting which way the vote was intended). This would at least require the capability of having software from more than one provider, each piece of software essentially interpreting the intent of the vote.
Each step of the data gathering and interpretation process should be multi-sourced. And yes, that would mean, that even a log of x/y co-ordinates, which have been touched, should be generated by more than one independent source.
If the independently created and managed processes(hardware/software) in the voting machine all agree on the result, there is a good chance that neither fraud nor error has been present - but if the results amongst the independent processes vary, one needs to investigate.
So, while I think open sourcing is a fundamentally more democratic approach to e-voting software (and hardware!), I think that multi-sourcing of software (preferably in each machine) is even more important.
"This begs the question: Is it better for security researchers to avoid publicly criticizing e-voting flaws? Is public faith in the system more important than overall system security?"
:/
This alone should be sufficient to overturn the DMCA and other laws of this nature. Basically forcing people to keep silent rather than voice concerns over issues we are facing. Reminds me of a Babylon 5 episode where Sheridan was appointed a political officer. She made a couple comments which are frightening.
"Of course we have problems back on earth, but that's no reason to embarrass our leaders".
then there was
Sheridan: When did all these problems with poverty, unemployment... go away?
PO: When we rewrote the dictionary.
Sounds familiar doesn't it. Ignoring the problem makes it go away. We've reached a new low level if this is true
Has Comcast disconnected your Internet account? Same here. You can read about it at http://comcastissue.blogspot.com
.. and the voting machines (Linux-based, IIRC) are being exported to a bunch of countries now. The voting machines have a numeric keyboard so you have to know the number of your candidates, but there's visual feedback (pictures) before confirmation.
Costs associated with paper backups can be greatly minimized arbitraging a significance level and using common undergrad mathematical statistics. The significance level is the probability that the whole population's parameter (say, W's total votes) will be within a certain error margin from the sample's parameter.
Error margin = (t * s) / sqrt(n), where t is Student's t number (calculated from sample size and the significance level you arbitraged using a common computer or a table), s is the standard deviation of the sample and n the sample size.
It's a demonstrable mathematical fact. The proof can be found in any basic statistics book lying around in a college library and understood by anyone who knows high school calculus.
Democracy isn't about blindly trusting your officials. We don't give our President absolute power because we "trust" him. We have separation of powers, checks and balances, etc., built into the system because the founders of this republic knew that power corrupts and we have to continuously struggle to keep ourselves honest.
/especially/ the part that deals with elections, is a "disservice" to Democracy is a complete nitwit who doesn't understand the first thing about Democracy. This person is an election official? Fire them immediately!!!
Anyone who says that mistrusting any part of the system, and
Assuming this isn't fixed before the next election, here's an appropriate form of protest. Immediately after you vote, go back to the clerk and ask politely:
"I don't believe that the voting machine recorded my vote correctly. Can you show me that it did? Could I get some kind of receipt or proof?"
The clerk will tell you that it is not possible. Act surprised at the way the system works and explain why that worries you.
The point of this exercise is that there is a line of people waiting to vote right next to the clerk. So you want to be polite and try to cause the other people there to understand and agree with your point of view. So actually starting an argument or wasting a lot of their time and being dressed like a freak won't help.
Many vendors have ignored security problems in the past. One result of that is that security activists have wrestled with the idea of whether or not it's ethical to publish exploits. If you publish the exploit, people will get hacked. But it usually forces the vendor to take responsibility.
Right now, these election commissioners are taking the same ostrich approach to security. They refuse to deal with a real problem, and they attack people who point out that the problem exists.
Would it be ethical to publish voting machine exploits? What if the machines haven't been deployed yet? Would it be ethical to publish exploits in order to prevent people from rolling out a flawed system?
The California recall election was almost derailed over problems with the butterfly ballot. These problems are a lot more serious.
Anyone who has been paying attention knows that we're enterting a period in which elections are being litigated as well as campaigned. These bad systems are going to open up all sorts of doors for claims. Most of them will probably be crazy, but all of which will have to be considered.
Worst of all, if bad systems aren't auditable, there won't be any way to tell if something happened.
What happens when someone goes to court with a plausible exploit, but no direct evidence that it occured, and a poll that suggests the election should have come out differently than it did? Do we really believe that some jury or judge won't overturn an election based on that kind of argument?
This technology represents thousands of disasters just waiting to happen.
She says Computer Scientists are telling people not to trust the voting officials or the (new, computerized) voting system. Why would Computer Scientists being trying to turn people off of computers? Doesn't that seem a little backwards? Sort of like Ford announcing that we should no longer drive SUVs cause they're dangerous to everyone else and pollute like crazy...
No trespassing. Violators will be shot. Survivors will be shot again.
Missed this one the first time. Anyone else notice that the "state's deputy chief information officer" is named Doupnick? I mean, c'mon...
/.
Maybe when he retires he can get a job checking submissions for
No trespassing. Violators will be shot. Survivors will be shot again.
Trust, but verify.
It's a shame that once they push this blackbox
thru your vote counts the way they say it does.
I called the County Clerk where I live and she
said that E-Voting has been mandated by the Texas
congress. We have to have it all installed within
2 years. Oh well, I don't like the Republicans or
the Democrats much anymore. So even if my vote did
count there is'nt anybody out there much worth
voting for. I feel like I'm living in the USSR.
Linda Lamone is a fucking ostrich.
Either that, or she thinks the electorate ought to be. I guess if we are all bent over with our heads in the sand, it makes it that much easier for people like her give it to us right in the ass.
When information is power, privacy is freedom.
"I've said it before and I'll say it again: democracy simply doesn't work." - Kent Brockman
Clearly there is a PAC driven talking points campaign to vilify anyone who points out the man behind the curtain. This seems to be coming from The Election Center (www.electioncenter.org) a front group for Diebold that's positioned itself as expert on the subject and is distributing white papers that get picked up verbatim by other organizations in an attempt to manufacture astroturf support for DREs.
These documents come from a guy named "Doug Lewis" who is, according to Bev Harris, a former used computer parts salesman who's been anointed a meta-expert on DRE security and who's pronouncements are cited by my ROV as being more authoritative than, for example the opinion of the Joint MIT/Caltech voting technology Committee (after all what do a bunch of geeks know compared to a PR flack?)
Anyway, he originally wrote "I knew that at some point in the growth and acceptance of DRE's that it was likely that the conspiracy theorists would begin t" Thanks to MS-Word QuickSave! The paragraph now reads "Now that Direct Recording Equipment (DRE) voting systems are growing in acceptance and use in American elections, it is almost inevitable that some groups, individuals and organizations will claim that such systems are not safe enough to use in elections."
He goes on to say "The problem is that well intentioned people, some of them even highly educated and respected, scare voters and public officials with claims that the voting equipment and/or its software can be manipulated to change the outcome of elections. And, the claim is, it can do so without anyone discovering the theft of votes. " This from 4-2003.
Hopefully the MD legislature can see through this transparent mendacity.
As far as the topic at hand, the poster might have written what they said as:
I can't fucking believe the Director of the Maryland Elections board would stand before an elected committe and say, "trust in the voting process is more important than the integrity of the process."
Linda Lamone might as well have said, "I'm a cheerleader and don't care if people steal elections, so long as the public thinks they have a voice." It's that cynical. Her slavish attitude is best captured by her refusal of outside help:
"I don't think Diebold would allow it," she said. "It's their proprietary code."
In other words, "We will eat whatever dogfood Dibold thinks we should." That kind of "trust" from a watchdog of elections is unacceptable. She's let some wierd faith in "IP" comprimise her duty to safegaurd elections. You don't need trust when you have transparency and can check for yourself. Lamone has put DiBold's ownership of a particular set of software above her own job. That's pathetic.
Friends don't help friends install M$ junk.
However, having a black box which can do anything with your vote it likes, provides no verification of vote cast, and is completely open to manipulation - THAT I have a problem with.
And has had serious, basic, demonstrated, implementation flaws in far too many instances to date...
It seems a sort of mystique is gathering around paper, like: it holds the truth, it is permanent, it can't be tampered with. I think this is disturbing. The paper ballots are no more reliable than the alternative of electronic voting, it just takes a little more effort to cheat the system. ... mainly: human error.
Didn't Florida prove that paper systems could create as much of a debacle as any other system? Before that, didn't everyone who voted have faith in their vote being counted? Paper can be burned, lost behind a filing cabinet, corrupted with smatterings of ink, it can be mishandled, it can be dropped in the trash, it can be forged.
What I see happening with the e-voting companies (despite their obvious sales executive approach, which is mind-numbing trust in their product) is an effort to protect against those kinds of manipulations and accidents. Yes, they are opening up a whole new world of manipulation, yes there have been problems, but it does solve the problems that arose in the Florida Debacle
Any al Qaeda can walk into a DMV in California and ask for a voter's registration card, and voila!
That's hacking one card. With e-voting, you just have to open the Access DB, and you can modify the County's votes. All of them at once. With a nice point'n'drool interface.
Her election board selected Diebold to build the system. She is the head of that election oard. In her mind, she is not incomeptent. She does not hire clueless people.
Ergo, the decision to contract Diebold was the right one, and anyone who says otherwise is simply wrong.
Defending your own territory is nothing new. Even in you are completely wrong.
It would be nice if the e-voting machine manufacturers were to test and subject their systems to this sort of criticism BEFORE using them as part of the public voting apparatus. If the system isn't secure, it's going to receive criticism and it's their own damn fault that the criticism is in newspaper editorials and in Congressional testimony.
"Mother, should I run for President? Mother, should I trust the government?"
If it's a black box, has no paper trail, and is manufactured by a company whose president has close ties to a sitting administration AND is a major contributor to the administration AND has promised to deliver votes to that administration AND a company that has an abysmal security record then how in the hell can you trust any election run on their voting platform?
Shooting the messenger isn't going to fix the problems, nor is it going to restore faith in the system. Researchers must loudly and publicly criticize flaws; doing otherwise undermines democracy.
I don't trust any electronic voting system that is not open source and has not gone through an exhaustive (and public) security review with each release.
This begs the question: Is it better for security researchers to avoid publicly criticizing e-voting flaws? Is public faith in the system more important than overall system security?"
Of course not. If they fix security, faith will follow. It really is that simple. This is like leaving your front door wide open while you go on holiday and then being upset when people worry that their house will be robbed while they are gone. Secure the door well and people will feel better. It really is that simple.
In a nut shell, it's Linda Lamone that's doing a great disservice to democracy, technology, and the people that elected and/or hired her to do what's best for the people in her distirct(s). I can't think of anything more un-American that ensuring democracy is easily manipulated and faith in the results is shaken. She needs to be beaten with a stick and replaced. She is either incompetent or actively wants a mechanism to minipulate election results.
"I don't think Diebold would allow it," she said. "It's their proprietary code."
Bam, there it is, she's put some kind of faith in IP above her elected duty to safegaurd elections. It's peposterous that elections officials don't have access to the actual method of vote counting and everything else the machines do. With transparancy you don't need faith in a system, you can have reasonable trust that what you saw and know will work.
Dibold has made themselves a proxy for voting. If you removed the electronic components the flaw becomes apparent. Imagine Dibold hired people to sit in a booth and write down your vote where you could not see what they wrote! After that, the representatives would take the votes in closed bags to a place where they would count them and give the results to the elections commisioners. The electronic system has even larger flaws because it's easier to comprimise thousands of computers than it is to comprimise thousands of people, but no one would trust the low tech analog. Defending faith is such a system over the actual integrity of the system is nuts.
You can have an electronic system with a publically inspected paper trail. If the system is not free or open it can't be trusted because you don't know how it works. It's that simple.
Friends don't help friends install M$ junk.
Electronic voting is coming, and its not going to go away. It certainly does have the ability, if done properly, to make elections far more accurate and fair.
However, the current election board members nationwide are generally clueless about computer security and why a closed system is bad as opposed to open, publically audited one. They don't have the knowledge or expertise to make a good decision regarding this.
This is a excellent chance for you, slashdotters, to get involved with your community and do some good instead of sitting at your keyboards and bitching. Meet with local officials about your concerns and most importantly - volunteer your time. Get yourselves on the election board, propose a new seat, such as officer of technology and the like that makes sure systems are fair and equitable and secure.
Democracy only works when the public participates. If you don't do your part, or simply sit and bitch behind a keyboard, don't expect things to fall your way on their own.
-
Is this where we're at now? Anyone who criticizes the official line is a "smart aleck" who should be disregarded before even listening to what they have to say?
If a Ph.D. from Johns Hopkins gets this kind of treatment from the "we know better than you" legislators, how much influence do you think you and I have when we send our handy little emails to our elected officials?
Why is there this blind faith in technology and corporate competence, especially when the issue is as critical as this one?
the academic wouldn't be making a career for himself by saying that "everything is just fine." While i'm not saying that this /is/ the case, one must not forget that each side potentially has motivations beyond simple reporting of fact.
Well, I thought I thought he was better than I thought you thought. So there.
sulli
RTFJ.
I understand the concern about e-voting, as a US citizen, I do feel that my vote should count. However, it doesn't. Because it isn't a representative vote. If 60 percent of the country votes for 2 candidates that have leftist views, but neither of them get a majority, the remaining 40 percent (the minority) of the country has an administration in power. Interesting, eh?
I find this disturbing. But thats just one way of vote manipulation. Others include: blatant lies during campaigns, smear campaigns, party affiliation (I don't know anything about this candidate, but it's a democrat! I'll pick it, n/m it's warhawk stance and corporate leanings), intimidation, money, and pre-political fame. Not to mention the manipulations of the present administration: free press conferences, interviews, wars (or the stopping of)... etc.
I think these are more pervasive than electronic tampering. Plus, since there are over 2 brands of voting machine being used, I think it could be easy to detect which ones are cheating: lets say diebold only picks republicans and brand x always picks democrats. When votes are tallied I think this manipulation will be obvious.
So why is Linda Lamone so attached to the Diebold implementation of e-voting? I hope that if she is found to be on the Diebold payroll in any way that she does some jail time. My assumption is that her payoff will come in the form of an overpaid consulting job for Diebold because of her experience as an election official and early adoption of an e-voting system - I really hope she is not allowed to accept a payoff in that form.
[Set Cain on fire and steal his lute.]
Comment removed based on user account deletion
So, where are the open-source alternatives ? I would have thought that there we enough open-source contributors and security experts worried enough about these closed-source products to start an open-source project to do the same thing. An enterprising touch-screen systems intergrator could take this to the market as fully independently audited by the community, and probably undercut Diebold etc in the credibility stakes.
How do you think Bush won?... "A dissservice to democracy for revealing a flaw"??? Just die, pigs.
I'm not anti-microsoft. I'm anti-bullshit. Which means I'm anti-microsoft.
How can anyone warning of voting machine flaws be doing a disservice to democracy? The US election system is already flawed, buggy voting hardware is the last thing you need.
This begs the question: Is it better for security researchers to avoid publicly criticizing e-voting flaws? Is public faith in the system more important than overall system security?"
Security, in this case, is extremely more important than public faith. The only way to get the public faith is to have a system that is secure. Think about it. Wouldn't you be more upset that you were lied to and told that your vote didn't count than if before you voted, you found out that voting wasn't as secure?
Besides, public scrutiny on processes that will have an impact on our every day life, on processes where we choose who will represent us, is necessary. If the system is secure, you'll easily gain public trust. If it's not, you have some work to do - work that involves making it more secure.
Just my two cents and then some.
Yeah, right. I can't see them buying that one.
So if the politicicians don't think think it sensible to trust us not to cheat them, why on earth should it be sensible for us to trust them not to cheat us.
And if anyone ever finds me begging such a blithering, brain-dead bonehead question, feel free to shoot me. I'd sooner be dead than be that short of ideas.
sheesh...
Don't let THEM immanentize the Eschaton!
I think the solution could be like this:
1 Find a security flaw
2 Keep it secret until next elections.
3 Exploit it to promote a candidate that was without chance. Just make some really mad wacko win.
4 Leave the note on the machines: "Go opensource or your candidates never win".
5 Vanish until next elections.
No matter if they cancel the results, if they investigate, if they say you're a terrorist or whatever, they will just HAVE to make the process secure. Simply the public will NOT allow them to go on with such a flawed system.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
The biggest problem with these systems being closed is that as long as large number of machines are being purchased from the same vendor, and the number of vendors are small, there's now a trivial way of fixing the elections.
A little trivia: We know the security at Diebold is ridiculous as is. But let's say they do code reviews. Lets say check ins are monitored.
Heck, maybe they even open source the system.
Then it would be safe, wouldn't it?
WRONG
Without an audit trail in physical form, verified by the voter, these systems will NEVER be safe.
Consider this little todo list if you decide that voting fraud would be an interesting career choice:
The list of fun stuff to try would be endless.
Creating a paper audit trail is cheap, compared to verifying the hardware design (of the actually delivered boxes, not of what was supposed to be manufactured), verifying the binary images of all the software actually on the delivered boxes, INCLUDING BIOS, drivers, microcode on any "interesting" chips in the system (it would not be surprising if the touch screen had a programmable CPU on it, for instance - after all the good old Amiga keyboard had an embedded CPU with on chip RAM and ROM and a 6502 compatible instruction set - all you'd need to modify the data stream), and how it all works together (see the memory arrangment suggestion).
Seemingly innocent changes to various parts of the system might have distasterous effects once they are combined.
Without an audit trail you will NEVER, EVER have a reliable, safe, tamper proof system - electronic solutions are simply too complex to prevent someone from finding comparatively easy exploits.
Linda Lamone, director of the state elections board, largely dismissed Rubin's concerns and insisted Diebold had completed all the recommended changes in its software.
and
Russell Doupnick, the state's deputy chief information officer, rejected Rubin's call for full disclosure of the SAIC report. He said officials did not want to provide "a road map to intrude into the system."
If Diebold has made fixed all of the vulnerabilities, then how is a report of the vulnerabilities going to tell people how to exploit them? Any system should be able to maintain high security with full disclosure of all code and APIs. If not, they're relying on security through obscurity, and we all know that works pretty well until some 14-year-old reverse engineers it.
...and replaced with cheering, smiling crowds.
According to the Bush administration, such 'artistic' molding of reality is an expression of free speech.
Blow a goodbye kiss to your democracy, America!She's already walking out the door.
Do posterity a favor and beat the shit out of the nearest GOP dickhead.
I think I'd be trying my best to get Linda Lamone fired and replaced by someone who has an IQ above room temperature.
Next on the list of countries to conquer - England! Kill the limey bastards.
GWB
"Is public faith in the system more important than system security?" Why on earth would any rational person ask such a thing? In a democracy the accuracy and integrity of elections are paramount. All the "faith" in the world counts for zip if the elections are rigged or so incompetently run that the results cannot be trusted. Should the truth about possibly dangerously skewed election results be suppressed in a free country? Again, this is a stupid question. Freedom is about NOT suppressing the truth, especially when it comes to the direct exercise of that freedom.
YES! If you live in a totalitarian state, that is...
Would someone with appropriate credentials (e.g. Computer Scientist, Security Researcher) please start an online petition requesting that only Open Source Software be allowed to be used in elections.
Without transparency, there is simply no assurance. This issue is incredibly important. I don't know how else a movement to push Open Source in elections can be started, perhaps there is a better way. But for now, perhaps a petition is a decent door-opening move?
The reason that it can be true that 1+1 > 2 is that very peculiar nonzero value of the + operator
Calling Avi Rubin a "smart aleck" after he criticizes e-voting machines is like saying the AMA is a bunch of smart alecks when they decry smoking as cancer-causing. We don't have a 'Security General' like we have a Surgeon General, but if we did, Rubin would be qualified by the job -- and only one of a handful of people I'd want to see in it.
This has really gone from, "Wow, what is that crazy county thinking?" when they selected Diebold e-Tyranny systems to absolute insanity. After so many major vulnerabilities were found and a bevy of absolutely insane catastrophes have occurred (like the number of votes being 10x the number of registered voters?), these systems should be done forever. Fix them? Wrong. Throw them away, and let Diebold make something they're qualified to make, like... bubble gum dispensers.
The shocking thing is that the security experts are raving about how intentional compromises could occur -- but these machines are so pathetic, they can't even function properly due to accidental bugs! If they can't even function when used normally, what happens when we introduce maliciousness?
The ACLU should have lawsuits coming out the wazoo for this. Hanging chad? Hanging chad has nothing on these machines.
Maybe the ATM wasn't that good of an example
I agree that we wan't to be able to validate the system until trust is earned. Nevertheless, even the paper trail is a BLACK BOX unto itself? Maybe you can look at a list and see (validate)your own vote, but what about a vote from Frank N. Stein - do you know that vote is real?
Maybe an auditing service can match actual votes to registered voters. But that in and of itself would not tell you actually who voted and who didn't. Someone's name could appear as having voted, even though they haven't seen a poll in 20 years (how would we know, how would they know?) Then, you would have to rectify all of the audits in various, counties, districts, states, etc. (for antional elections). And DO THIS BY HAND if you want to eliminate any computer glitches.
Do you trust thousands (?) of ballot counters to not make any mistakes? Are the ballots they are counting genuine? Does Mr. Chad rear his ugly head again? How can the average person verify this? even with a paper trail
To mangle a Matrix quote - 'The Problem is Trust'
There are genuine trust issues with either, system, all I am saying is that BOTH have their BLACK BOX aspects
Keep in mind, I am not for or against either system - whichever works out best is fine for me
Mrs. Lamone is highly critical of telling that she does a shoddy job, facts not withstanding. Hmm, why am I not astonished?
The real problem is that Rubin's testimony won't have any effect, since politicians are too far away from the real world to take over responsibilities for their work. OTOH, that bands them together with CEOs of large companies - so maybe they're not so far away from the real world after all... :-)
Joachim
People don't write Manifestos any more -- what's going on in this world? [Frank Zappa]
Is it better for security researchers to avoid publicly criticizing e-voting flaws? Is public faith in the system more important than overall system security?"
Ummm. No. An educated public is one of the foundations of democracy, withholding information about vital flaws to the election system for the mere purpose of public faith is precisely contrary to this goal! Of course this should be disclosed, withholding this information cannot have any benefit to the public and can only lead us to a situation were these inexcusable flaws will be forgotten.
I stole this Sig
Wish I had some mod points today. I don't blame you for posting anonymously due to the right wing mods which cannot tolerate comments which are unflattering to the Grand Ol' Party (GOP).
There is an assault on your civil liberties taking place. Some is obvious, some not. The net effect is chilling. I have voted in every election for the last 25 years. I have cheered and cursed our government, but I have never feared them.
The US is like a frog slowly boiling in a pot of water. Is it just me, or is it getting pretty fucking warm in here?
God help the USA
There is nothing so powerful as an idea whose time has come.
This needs to be a very much past due wake up call for people (read taxpayers) in Maryland. We've had our collective pockets picked time and time and time again by totally inept state procurement processes when it comes to information systems. I started to cite examples in this reply and realized that it would soon become article-length. But I am thinking of school systems and our motor vechicle administration among others. Our records weren't even protected from August's virus onslaught.
/. (especially the comments) into a letter to the editor of the Baltimore "Sun." There are good technology companies here, and there are good people working in them. Perhaps if a few more of us did the same, it might attract the bloodhound interests of whoever's in charge at the Sunpapers these days.
It's time to make the fraud potential of these voting systems known to the general taxpaying public--in Maryland as well as in other places. We just have the misfortune to have feather merchants in charge of most IT here where we need smart, tough-minded computer people who know how to ask the right questions and to make themselves heard by the pols.
I have no clue what I can do as an individual, but I'm going to start by assembling what I've read here on
Also, and on another topic: JUST BECAUSE ADOBE DECIDES TO USE ATROCIOUS GRAMMAR IN ONE OF THEIR ADS DOESN'T MEAN YOU SHOULD. PLEASE GO LOOK UP THE DEFINITION OF "TO BEG THE QUESTION." (sorry).
Anne
DUCT TAPE: The Election Supervisors' Secret Weapon
Ok, not her as an individual miscreant, but her as a participant in a politically-inspired movement to get everybody to buy into non-auditable voting machines being sold and promoted by Friends of Bush. If she's viewing Rubin as somebody who's opposing this because they oppose Bush, rather than because he actually cares about the results, then that kind of response is appropriate political tactics. On the other hand, if she doesn't care whether that's the case, but is trying to defeat him because he's opposing her political position, then her use of those tactics is a bit more cynical. Either way, of course, she ought to be bounced out of office, but she is responding to a political risk of getting bounced out of office for being part of the Election Machine Machine if they lose.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
The only reason a woman's statement was attacked was because Avi is a heterosexual misogynist. A woman is always the source of truth and compassion.
Or if you're like me, you think a woman is as likey to be a nitwit as a man.
Former is a Howard Dean liberal, latter is a Libertarian. And besides, with the Diebold voting system, only pro-abortion candidates will win.
This happened once before, under the New York City mayor Ed Koch. He cut a deal with a supplier of lever voting machines. As long as Ed's candidates won, the supplier got the support contract. Eventually, the supplier was arrested and did jail time, but Ed never shuts up.
I don't suppose you can offer some information on the subject?
Smart alecks are people like me who say that the reason the Bush Machine likes unauditable voting machines is that "Stuffing ballot boxes the old-fashioned way is manual labor, and Republicans don't like to do manual labor."
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I mean every time this guy gives a talk, there's an "audience" of military personnel behind him. I guess his spinmeisters' goal is to project an image of a strong state and a strong leader, but as a European it find it too close to Hitler's propaganda.
I was under the impression that one could practically sue for almost anything in the US. Would it not be possible for someone to start a class action suit against the state election commission for willfully damaging the saftey of the democratic process in that state (MD)?
'This begs the question: Is it better for security researchers to avoid publicly criticizing e-voting flaws?' No, it seems it begs the quesion: Do we make decisions based on who can shout the loudest? Given most management type meetings I've suffered through, I would say: yes. But, this is only a tiny subset of reality (I would prefer it was an alternate one....).
Ads are broken.
Cool! - where can I find a Diebold bubble gum machine? -- Put in a quarter, get twelve pieces of gum and three dimes in change.
Both parties clearly understand the importance of public faith in a system that will allow them to rig elections. The real question is: which party will get control of the election system first?
you figured it out, welcome to America
the public has no faith, our democracy isn't one, never has been (you in doubt? i have two words for you: electoral college), never should have been (that's right, ONE REPUBLIC UNDER GOD). what we are is an Oilgarchy (and that's not a typo)
Great, now we've gone from security by obscurity to security by "Shut the fuck up!"
re: E-Voting Expert Testifies
The next Woodward and Bernstein?
Couldn't hurt. I followed the handy links
to the Sun, clicked on 'suggest a follow-up',
and sent them the note below.
I hope you'll all consider doing likewise.
-jim
"Veis no imminicht vat dein
kschtinken badges ist.
"
---
This is an important story. Thank you for publishing it. I hope you will consider
doing a follow up -- this story definitely has legs. I can offer that a good follow
up source would be Dr. Rebecca Mercuri, another expert on electronic voting, whose
congressional testimony (which supports Dr. Rubins) has alarmed the nation.
Not that the issue at hand actually *requires* such expertice -- nearly anyone
even remotely familiar with computer security can verify much of what Dr. Rubin
has testified to. His statements were not controversial.
The Ehrlich administration is apparently quite naive, perhaps dangerously so.
Unfortunately for all of us, they are not alone. Please help educate our country's
legislatures, inform the voting public, *and* sell more newspapers by continuing
to take the lead on this story.
(By the way, a more accurate lead might help drive the story -- I believe that my mother
qualifies as a 'voting system critic' -- wheras your actual story attributes the warning to
a 'voting system expert', a 'security expert', or 'Security Institute'. Many of your readers
no doubt noticed the mis-lead, but one could expect that some readers would be thrown
off by the accidental dilution. And finally, to capitalize on the moment, you might consider
grabbing the spotlight with something like 'Security experts warn the homeland').
Again, my thanks for a great story, and a great service. We need you.
Sincerely,
Jim Sawyer
---
Source contact info:
(from the web, via last citation below)
Rebecca Mercuri, Ph.D.
P.O. Box 1166 -- Dept. EV
Philadelphia, PA 19105
215/327-7105 or 609/895-1375 (try the 609 number first)
mercuri@acm.org
I am available for comment, consultation, expert testimony,
and lectures on electronic vote tabulation, and can be contacted
via the information above.
Members of the press and researchers seeking interviews
and quotation permissions may find it helpful to look at the
guidelines posted at
http://www.notablesoftware.com/manifesto.txt
and background material posted at
http://www.notablesoftware.com/evote.html
---
Folks,
... or other such poppycock [AKA: BS] rhetoric.
... whatever they are called) and need one great leader that will help murder the opposition literally.
_____If public faith is lost, then the system (democracy) fails. System security must always support the public faith in democracy by assuring legitimate, veracious, and verifiable results. It is better that the nation and citizens die or fade into history, then allowing democracy to fail.
_____A democracy is a nation where the citizens feel individually responsible for deciding their destiny. Corporate, religious, and plutocratic institutions are disenfranchised in a democracy, because of the human psychology/society premise of "Power corrupts, Absolute power corrupts absolutely."
_____This is part of the reason for the separation of powers in our USA Constitution, but though implied we have never been able to completely protect the election process and/or eliminate corruption of elected officials that vote/act in the interest of the corporate, religious, and plutocratic interest while verbally patronizing US citizens with "FRIENDS, ROMANS, COUNTRYMEN", "IN THE NATIONAL INTEREST",
_____Rhetoric is frequently the only skill most preachers and politicians have, and without honor and ethics they are puppets of any megalomaniac in power. Plutocratic factions promoting their interest know that they always have allies (religious terrorist (Christian Moslem and Jew), Nazis,
_____The nonsense rhetoric of some politicians and preachers is at this level. Just pay attention to Jerry Falwell, his colleagues, and followers [http://www.funnystrange.com/quiz/], and their close politician friends), and never forget the "Honorable for some" Louis Farrakhan. Fortunately the claptrap rhetoric has not been able to subdue the commonsense of US citizens and our birthright for skepticism of authority's self-interest and delusions of grandeur.
_____We can still vote for better citizens to take any politicians place in Washington DC, state capitals, and locally. Politicians are all (for now) replaceable. This is the way to put a politicians head up their own self-important ass and let them know their shit truly stinks. For preachers, let GOD judge them. For the Corporate and plutocratic institutions lets disenfranchise them from our democratic process and return to one person one vote by eliminating the purchased sound-bite rhetoric elections.
_____Do you feel more secure today then you did on 2001/09/11? Do you feel national interest, economy, and security are the priority of today's politicians? I agree with JFK "Ask not what your country can do for you, ask what you can do for your country." I would add, be responsible to the USA Constitution and Democracy, "ask every politician and preacher what have they done for the NATION?", If they wear $500 to $2,000 dollar suits, have a personal income of more than $250,000.00 annually, and ask for any citizen to sacrifice and donate money to GOD or a cause then they are frauds.
OldHawk777
Reality is a self-induced hallucination.
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
I don't suppose you can offer some information on the subject?
e .h tm?site=http%3A%2F%2Fwww.nodeception.com%2Farticle s%2Fpixel.jsp
Just two URL's are necessary.
http://www.foxnews.com/
and
http://graphicssoft.about.com/gi/dynamic/offsit
Yeah, it's really better that we keep our concerns about the voting system to ourselves. We wouldn't want to upset all those fragile, sensitive voters by letting them find out their democracy's a sham.
The paper trail part would be fully identical, and you could also put part of the system in a sealed box and design the interface so it can fundamentally only take incremental updates or be erased completely (fully equivalent to the empty boxes).
... if you can understand it on paper you can understand it in bits.
The unit is slotted in the booth, the witnesses verify it is fully erased before the election starts.
You have a box with a database, and each entry is the exact equivalent of a paper ballot
So far as I can tell, American democracy is nothing more than a front for corporate superpowers.
This applies to a greater or lesser extent to other democracies, but the USA has it bad; very bad.
Not only do corporate superpowers have effective control over the mass media by which most people decide how to vote (think Chicken Noodle News and tabloids), over the means by which people working in government beauraucracies actually go about their jobs (think desktop operating systems and 'office productivity software') but they are gaining power over the very means of voting itself (think evoting).
We are witnessing a subtle and insidious change in the the governance of modern societies.
In the free world the media isn't government run; the government is media run.
The only reasons to not want real e-voting flaws criticized are:
Linda Lamone should be immediately terminated for incompetence. Her comments show that she is unworthy of public trust.
She should be told privately that if she protests, she can always find herself under investigation for conspiracy to commit election fraud or conspiracy to defraud the state government, i.e. facilitating the purchase of voting machines she knew were inadequate for the job.
Tech Public Policy stuff
People with a +1 karma bonus have a moral obligation to withold that bonus when they post stupid shit like this.
Sorry but its far from Corporate control, its a world of special intrest. Just as the US Congress is controlled by special intrest, having long lost a will or need to obey the public intrest so goes the EU.
The EU "constitution" is a perfect example of Special Intrest and no public intrest.
E-Voting is yet another form of this, most of the people against e-voting as a means are only so because they cannot exploit it. They don't care that its not auditable, they can't abuse it yet. They would prefer it to be without a trail, so the dead can vote again, people vote twice, and etc.
When you have politicians stand up and say picture IDs are not required for voting how can you expect them to care about fraud in e-voting?
* Winners compare their achievements to their goals, losers compare theirs to that of others.
We do have a secretary of homeland security , and in his first speech in that role he mentions candor as a very important part of security.
Seems to be a pretty clear refutation of Linda Lamone's statement.I'd say that the manner in which our reps are elected falls pretty clearly under essential infrastructure. Maybe they can send Ms. Lamone to Gitmo or something.
I like computers and technology - I really do.
However, unless computers will do a job better than previous methods, they shouldn't be used.
Voting systems are what I would have to call mission-critical systems. They should have all the rigor, analysis, and verifiability that can be brought-to-bear towards making systems accurate and robust. They should be very formally designed and tested, and placed under the most rigorous configuration management and control.
Why these sytems aren't being built (or required) to undergo what would have even been considered best-practices in the 1970s or 1980s eludes me. I consider the lure of the technology, coupled with a general apathy towards the genuine intracacies and consequences of failure, to be a big part of the problem.
There should be damned strong requirements on how any system used in any governmental election are designed, proven, built, etc... I would actually want to start with proven security/OS kernels in any such designs. This machine does not even have to be based on a commercially available OS platform - it has to perform a specific type of task very reliably.
Sam Nitzberg
http://www.iamsam.com
...it raises it, you fucking ignoramus.
Maybe, just maybe, you should read and learn a little before opening that shithole you call a mouth.
READ THIS
Osama Bin Laden and Saddam Hussein had an operational relationship
It's what we've been telling you fucking morons all along and not a damn one of you was smart enough to understand it.
Suing someone means you're asking the state to settle your argument with that person.
Suing the state means you're asking the state to decide who's right, you or the state. Oh, and they're supposed to make that decision based on the same laws that the state enacted.
Google for, or check a law textbook for, the concept of "sovereign immunity". You can sue your state government, but the scope for doing it is limited.
Consult an actual lawyer if you're seriously considering this and need legal advice.
If the system is secure, public trust is helpful.
If the system is not secure, public distrust is vital!
With reasonable men I will reason; with humane men I will plead; but to tyrants I will give no quarter. -- William Lloyd
Isn't it better for democracy to avoid e-voting systems in the first place? Is public faith in the system more important than overall system itself? I'm serious. We are not talking about our email, the ATMs or some fucking lottery. We are talking about the democracy.
"Is public faith in the system more important than overall system security?"
A high-school educated adult can actually ask this question in seriousness?
Man the rockets. It's time to abandon the planet.
--
As an aside, I am desperately trying to find any sources not employed or otherwise funded by a voting machine company - think respected professors, prominent scientists, engineers, heads of standards bodies or trade groups - who will go on record saying that it's OK to skip per-vote paper records.
I have been searching off and on; I can't find a single credible expert who will say electronic voting without paper records is a good idea. Not one. In fact, even slashdot trolls devil-advocating the issue are rare. All I have found so far, from Harvard, Princeton and M.I.T., to the ACM, to acquiantances with the appropriate background, is 100% uniform agreement that per-vote paper records are absolutely necessary for the system to be trusted.
Do they even have a single person to trot out, to give them even a thin film of legitimacy? Or is actually true that every relevant expert is uniformly condemning these paperless systems? Are states across the nation actually adopting voting systems in opposition to every known academic standard?
You know, once upon a time, quite a long, long time ago now, in a very different age, people put their faith in things BECAUSE THEY WERE ACTUALLY SECURE.
Want to Know How to Cheat the GPL? Read On!
If the aim of the system is to provide a proper representative democracy, then it is critical that the system works and is secure. In this scenario, trust is secondary, since the untrusters will be in the minority, and not in a position to rock the boat too much - natural forces will balance out a level of distrust. Even if a paper audit trail is available, Joe Avg is not in a position to personally audit the results, so its all down to faith at the end of the day.
If the aim of the system is to install a fascist autocracy, then it is critical that public trust and perception comes first. The actual workings and security of the system (and indeed the results themselves) are largely irrellevant. Votes are conducted in a dictatorship scenario as a simple mechanism to make people think that they had their say, and therefore are being fairly represented.
Either way, there is going to be a small portion of the population who dont trust the result, and blame it on some conspiracy. Fact is, come the next general election in the USA (2004 ?), we are just not in any position to know which version of reality we are living in.
In another 20 years time anyway, voting will be conducted via SMS, and people will be openly encouraged to post multiple votes - Elections will be a combination of public circus, TV entertainment and money spinner.
They will start with 100 presidential candidates, and each week voters will have to tune in to TV to listen to their addresses, and then vote via SMS to evict a bunch of candidates who failed to perform in the speeches, singing and bathing costume sections of the election.
And tune in next week viewers, as our surviving presidential candidates have to negotiate the crocodile infested obstacle course in their speedos whilst singing 'I Did It My Way'. The real government of the day can then go about their business unmolested, whilst Mr Popular stands out before the TV cameras as the public face of the party.
Is there any way to independently validate the system, in a way that prevents tampering on election day? Please don't forget that Diebold's CEO is the one whose been shmoozing with the Republican aristocracy at $1000 / plate dinners and promised that his company was "committed to helping Ohio deliver its electoral votes to the president next year".
Wow, that's convincing. A memo from the Office of Special Plans (which does nothing more than compile and pass on reams of intelligence data from various sources without actually performing checks on it) containing nothing more than extremely sketchy single-source information. You sure showed them!
one would need to take a look at the entire system no?
I don't like electronic voting though I see plenty of ways to make it trustworthy. What I like less is groups seeking power through the manupulation of our very laws and process designed to protect against just that sort of abuse.
Too many elections showed too many suspect results. The amount of effort taken so far just to broach the subject and review the issue reveals to me an unacceptable level of risk.
Blogging because I can...
the simple fact that technology has outpaced the ability for society in general to deal with it and those in the know are taking advantage.
The law regarding technology is in the dark ages right now. We are fighting basic battles over information. Our ability to even process our own information freely is under attack. Our very ability to think and discuss things with one another is under question today.
Our leaders, in general, are behind the times with regard to technolgy and its potential effect on society today. Sure they have advisors, but who do they represent? Can we be sure their advice is in our best interests? This assumes our leaders are true in their desire to better the American People. Maybe they know full well how technology works today. What of their decisions then?
At least ignorance preserves some of the faith we have in our system of government... The alternative is an exercise for the reader. --You.
The general public is only now reaching a basic level of use competency. Lots of people have computers, but very few of us really understand them. Fewer still understand the potential long-term effects they promise.
Those who produce the technology of today have a huge advantage over those it affects. They have understanding and power without any high degree of direct accountability for their actions.
These things together really point to a problem that has been bothering me for quite some time, namely: how can we, as a society, represent ourselves in a fair and informed manner when we do not yet possess the understanding necessary to know the potential result of the choices we are being asked to make?
This whole voting affair finally illustrates, on a level many people can understand, the danger present in the unbalanced state of things here in the US. We are rapidly reaching a state where the companies call the shots while the citizens (or consumers as they like to call us) live with the consequenses.
Folks, this should not be happening by any measure. This is exactly the sort of thing our founding fathers did not want to happen. The words:
We the People of the United States, in Order to form a more perfect Union, establish Justice, insure domestic Tranquility, provide for the common defence, promote the general Welfare, and secure the Blessings of Liberty to ourselves and our Posterity, do ordain and establish this Constitution for the United States of America.
were not intended for corporations. They were meant for us, you and me and the guy down the street. They were meant to express the idea that we are governed by ourselves. We are judged by our peers. We control and participate in the process that forms the society we must live with.
The fact that this crap has even happened reveals a problem far greater than which machine works best or is more trustworthy, or who paid off who.
The problem is not about technology. It is about who controls it and how it gets used and what people in general know about it.
For many people, computers are these mysterious things that process information in ways not easily understood, yet we trust them. Why is this? Are we lazy as a nation? Do people just not care? Maybe they feel stupid and are afraid to ask. Nobody else seems to be asking why should they?
As a kid I used to ask. Did not get answers then. As an adult I am asking again. Are you?
Until the Information age, all political discourse happened in ways one could trace to a degree. Sure, two people talking behind the fence are tough to audit, but the paper trail they leave as they execute on their plan is. Moving information required people to be involved back then. Recorded information was in a form not easy to change without somebody knowing about the nature of the change at a minimum. This brought with it a level of accountability we could ultimatly trust.
Today these things are not true anymore. Computers process and store information in ways that b
Blogging because I can...
Answer: No. :-) )
(And that's pretty gutsy--trolling at the end of the article itself.
Furry cows moo and decompress.
Is it better for security researchers to avoid publicly criticizing e-voting flaws? Is public faith in the system more important than overall system security?
HELL YES!
We should have faith in our government. They know what's best for us. As our democratically elected representatives, they will look out for our interests.
"Trust but verify."
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Because of the length of time over which this generally occurs, I fail to see the problem.
Please re-read what I wrote. I am talking specifically about the case where this length of time is short. Also, there are reasons why that length of time has been short in the past, which might include:
(Confused? Consider these: HTML, CSS, XML, Perl, PHP, Java... you get the idea.)
HTML, CSS, XML, Perl, PHP, Java, and PDP-11 still mean pretty much the same thing they did a year ago. They aren't changes in existing language, just additions to it.
There is already an efficient means of stating that something "raises a question", and this is different from "begging the question". Merging these two logically distinct phrases in our language makes the language a less efficient tool for communicating.
Also, in this case, we are discussing a term which is specific to the science of Logic. I think that when a non-logician tells a group of logicians that they need to invent a new phrase because "language evolves" simply demonstrates the non-logician's ignorance. It's no different than a PHB who, when corrected, tells Bruce Schneier that ROT-13 really is a "strong cipher", just because he and his friends have been calling it one (or that Sun Java really is "open source").
I agree that language evolves, but people have lately been using that fact as a means to justify their ignorance.
Generic email address: sep@elections.state.md.us
other modes of contact are here.
http://www.wired.com/news/ebiz/0,1272,61045,00.htm l