Slashdot Mirror
E-Voting Firm VoteHere Discloses October Break-In
linuxwrangler writes "In the ongoing saga of electronic voting 'security,' eVoting company VoteHere is the latest to reveal that they were the victim of a computer break-in. According to VoteHere founder, Jim Adler, the concern isn't about their source code which they plan to reveal 'eventually,' anyway, but is about the possible release of salary and other HR data. Astoundingly, the 'hot poll' associated with this story has (as this is being posted) 28% of respondents saying they would trust their vote on the internet and 41% saying 'not now, but maybe soon.' Feel free to cast your vote." Reader nSignIfikaNt points to the Assocated Press' article as carried by CNN.
Why should we trust their voting systems without auditing?
can you really trust voting results/percentages of an e-voting firm that was hacked?
I'm not trying to troll here...but hear me out: People simply don't trust electronic voting...as a geek this makes me very sad, because voting is something that could and should be more automated.
Now, ask yourself, why is it that people don't trust comptuers?
Answer: Microsoft's abhorent trackrecord with regard to security has an awful lot to do with it. It's not the only factor, but it is *huge*.
All these windows bugs do effect us linux geeks: The perception of computers in general has suffered greatly.
--
Join Jihad against slashdot's editors. Join anti-slash
The linux hacker
The poll has apparently been closed already. Not sure what to make of that, but perhaps yet another political slant. At least CNN isn't as imbalanced as Faux News.
Anyway, on the substantive issue of reliable voting, computer security is NOT a done deal. This networking stuff is great in many ways, but there's a big problem when everything is connected together. You hack into one part of the system, and you've exposed various other parts to attack. The old idea was to make a secure perimeter with firewalls and DMZs and so forth, and you could keep something safe inside, but that's called the "eggshell model" now--turns out to be relatively easy to breech and you still need strong security for EVERY machine with ANY sensitive information on it. Someone in the office took his notebook computer home for the weekend, and you can never tell what Trojan backdoor is inside your network now.
Of course, the BIG threat here is abuse of power. No one needs to be protected from weakness, but powerful people often want MORE. Not an independent event--that greed is usually part of how they got there in the first place. Consider the recent example of Arnold in California and the selection in Florida in 2000...
If our votes are to have ANY meaning, they must be protected, and it is very clear that some people will play ANY game that will win more power. Voting machines as secret slot machines? Would you trust Las Vegas THAT much?
Simple. Print the ballots. Let the voters LOOK at what the ballot says, and save it. It's convenient that the machine can also report the results quickly--but NOT convenient that any computer can be hacked.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
Securing HR data and salaries is basic, basic stuff. I would have some sympathy if Joe Schmoes Pizza barn had there salary and HR data compromised, after all they make pizzas, IT is way down the line for these people.
But lets face it, if you want to manufacture eVoting technology then securing the network is a crucuial part of that technology.
If THEY can't secure there own HR and payroll data then how am I supposed to trust them to handle evoting competently?
The only valid reason I've heard of for e-voting is to purely speed up the counting of the votes, so that the result of the election can be known much quicker than via hand counting.
Commonly people seem to assume that this means replacing paper votes, or rather, more specifically, replacing an auditable paper trail.
So we have a additional-efficiency model verses a replacement model.
For some reason, the model that has been adopted (and maybe encouraged by the "US" governement aka GWB) by these E-voting companies is the replacement one. Who knows why, although the conspiracy theorists would suggest Florida 200(? - I'm Australian, don't know exactly when the last US election was).
Of course, as all slashdotters know, under the replacement, electronic only model, security and accountability are a lot harder to do. All these e-voting security stories, such as this one, are evidence of that.
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
Where the internet would be useful is in making registration and obtaining absentee ballets easier. I work a lot of hours, as do most of us, and find registration a pain. It's rediculous to have to register months before an election. I was buried in work and found out late at night it was the last day to register for the last Presidential election. If we could register on-line and obtain ballets it would definately make things more accessable. Verifying identification is an issue but most aren't checked for ID as it is and none of those are verified. As far as electronic voting, I'm against National ID cards but most of us have drivers licenses with magnetic strips. An ATM system that uses those as verification could improve security. The system would only use the drivers license to access an electronic form. It would record that the individual voted but not which form was used. Any system can be hacked. The only way to largely avoid that is to network the voting machines at each location by firewire. An electronic count could be sent but would have to be verified by a verbal number given over the phone by some one at the polling location. A print out of totals could act as a third verification. It doesn't prevent tampering before the fact though. One possible way to avoid pretampering would be to have name order assigned on the day with more than one person required as in nuclear sites. Any pretampering would not know which name was being represented by any given code number. No system is foolproof but there is a fair amount of tampering already. Can you say Florida?
27% Yes
40% Not now, but maybe soon
Fucking idiots. That's about all I can really say in response to this. I'm just too disgusted for words.
-- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
Boy, these guys have a lot of nerve. The guy at VoteHere claims that the break in might be politically motivated. ("We feel that it may have been politically motivated,"Adler said.) But when asked to elaborate, he defers and says he doesn't want to politicize the situation. ( "I don't want to necessarily politicize this," he said. "This is just a crime.")
Waaa??
So he impugns activists pointing out flaws in his system, then claims to be taking the moral high ground. And the cowardly reporters don't even question him about this blatant double-talk. Shame on VoteHere. Shame on MSNBC. Shame all around. When people lie, they need to be called to the mat for it.
So shouldn't we try to fix the system we have in place already? The biggest problem with electronic voting is that if you can alter one vote, you can alter lots of votes. When it's done by hand this isn't the case. Having competent poll workers and changing the system to one in which the ballots would be counted in public instead of carted off to a courthouse would result in a much more secure system.
I'm not trying to say e-voting shouldn't be done at all, but if there is no paper trail, then the potential for mass voter fraud still exists. A previous post suggested a system in which an electronic input system would print out a marked ballot for you, which you could then verify before submitting it. This would increase the ease of voting while still maintaining, if not increasing security.