Slashdot Mirror
E-Voting Firm VoteHere Discloses October Break-In
linuxwrangler writes "In the ongoing saga of electronic voting 'security,' eVoting company VoteHere is the latest to reveal that they were the victim of a computer break-in. According to VoteHere founder, Jim Adler, the concern isn't about their source code which they plan to reveal 'eventually,' anyway, but is about the possible release of salary and other HR data. Astoundingly, the 'hot poll' associated with this story has (as this is being posted) 28% of respondents saying they would trust their vote on the internet and 41% saying 'not now, but maybe soon.' Feel free to cast your vote." Reader nSignIfikaNt points to the Assocated Press' article as carried by CNN.
Why should we trust their voting systems without auditing?
can you really trust voting results/percentages of an e-voting firm that was hacked?
The poll has apparently been closed already. Not sure what to make of that, but perhaps yet another political slant. At least CNN isn't as imbalanced as Faux News.
Anyway, on the substantive issue of reliable voting, computer security is NOT a done deal. This networking stuff is great in many ways, but there's a big problem when everything is connected together. You hack into one part of the system, and you've exposed various other parts to attack. The old idea was to make a secure perimeter with firewalls and DMZs and so forth, and you could keep something safe inside, but that's called the "eggshell model" now--turns out to be relatively easy to breech and you still need strong security for EVERY machine with ANY sensitive information on it. Someone in the office took his notebook computer home for the weekend, and you can never tell what Trojan backdoor is inside your network now.
Of course, the BIG threat here is abuse of power. No one needs to be protected from weakness, but powerful people often want MORE. Not an independent event--that greed is usually part of how they got there in the first place. Consider the recent example of Arnold in California and the selection in Florida in 2000...
If our votes are to have ANY meaning, they must be protected, and it is very clear that some people will play ANY game that will win more power. Voting machines as secret slot machines? Would you trust Las Vegas THAT much?
Simple. Print the ballots. Let the voters LOOK at what the ballot says, and save it. It's convenient that the machine can also report the results quickly--but NOT convenient that any computer can be hacked.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
E-voting is a reason not to trust e-voting. Slashdot just has story after story of how these big "trust us, our stuff is fair" e-voting companies have problem after problem after problem. Things are bad now, but imagine the kind of stuff that might come up if it was legislated that the 2004 Presidential Election had to be done on these systems. What happened in Florida (which was largly the fault of people who were too desperate to not loose to care about anything else, since the recounts and recounts didn't change anything) would look like a cakewalk compared to finding people who got to vote in 12 districts, those who's votes were counted 10,002 times, and the fact that anyone with a "A" or an "E" in their last name (BUT NOT BOTH) could only vote during odd numbered minutes of even numbered hours in districts that are prime numbers or some other rediculous things that at this rate seems it could easily turn up.
I'm all for MS bashing when they deserve it, and they may be the number one reason people don't trust e-voting (allbeit indirectly); but there are REAL reasons why people shouldn't trust it, and if it were to get reported more, then people still wouldn't trust the things, it would just be for the "right" reason.
Comment forecast: Bits of genius surrounded by a sea of mediocrity.
Securing HR data and salaries is basic, basic stuff. I would have some sympathy if Joe Schmoes Pizza barn had there salary and HR data compromised, after all they make pizzas, IT is way down the line for these people.
But lets face it, if you want to manufacture eVoting technology then securing the network is a crucuial part of that technology.
If THEY can't secure there own HR and payroll data then how am I supposed to trust them to handle evoting competently?
I'm not trying to troll here...but hear me out: People simply don't trust electronic voting...as a geek this makes me very sad, because voting is something that could and should be more automated.
Why should voting be more automated? The only reason ballot counters are used is to rig the election. Several contries around the world conduct elections with hand marked and hand counted ballots and do just fine. Automation just makes it that much easier to rig the vote. Voting SHOULD be difficult, hard to quickly count, and should envolve lots of people in the process. When one person or a small group gets to count the ballot or gets to build an automatic system to count the ballots it is far easier to bribe or threaten that small group and rig the election. Any kind of automatic system should be questioned, be it scantron systems, pull lever voting machines, or computers. It is all designed to hide the vote from the public NOT make voting safer. I don't trust computers not because I am ignorant of what they can do because I know exactly what they are able to do and how easy it would be to rig an election.
If it is not a paper ballot and the ballot isn't counted at the polling place in public view then you shouldn't trust that vote. Most places in the USA the ballots are not counted at the poll. They are hauled away to the court house and counted out of public view. No way to be certain that the ballot box is the same one that left the polling place and no way to have the public watch the counting. This is by design to aid in vote fraud. We haven't had a free election in most places in the country in years.
Slashdot, home of supporters of free software, free music, and free speech.Except for Moderators that disagree with you.
The only valid reason I've heard of for e-voting is to purely speed up the counting of the votes, so that the result of the election can be known much quicker than via hand counting.
Commonly people seem to assume that this means replacing paper votes, or rather, more specifically, replacing an auditable paper trail.
So we have a additional-efficiency model verses a replacement model.
For some reason, the model that has been adopted (and maybe encouraged by the "US" governement aka GWB) by these E-voting companies is the replacement one. Who knows why, although the conspiracy theorists would suggest Florida 200(? - I'm Australian, don't know exactly when the last US election was).
Of course, as all slashdotters know, under the replacement, electronic only model, security and accountability are a lot harder to do. All these e-voting security stories, such as this one, are evidence of that.
The Internet's nature is peer to peer - 20050301_cs_profs.pdf