Slashdot Mirror

← Back to Stories (view on slashdot.org)

Experts Critique SERVE Internet Voting System

Posted by simoniker on from the e-uh-oh dept.

linuxwrangler writes "SFGate is reporting that a critique by four security experts claims that SERVE, a system being developed to allow US citizens overseas to vote via the Internet, is so vulnerable to attacks that it should be scrapped. The other six experts who examined the system declined to issue a report. Nevertheless, the Pentagon stands by the system and plans to use in in elections next month."

19 of 270 comments (clear)

  1. Important by Mork29 · · Score: 5, Insightful

    It's a shame that the government and these companies can't get their act together, and build a simple, secure voting system that includes a paper trail. Why is that so complicated. I'm currently serving in the US Army in Germany, and an online voting system would truly make life easier. It's a soldiers job to defend democracy, so it's a very sacred thing for us to be able to take part in it. To be able to vote right over the internet without much hassle is something has taken far to long to develop.

    1. Re:Important by Mork29 · · Score: 3, Insightful

      Where is the justification for your illegal war? The look on the Iraqi's school childrens faces when you give them a pack of markers to bring to school with them. The mass graves that were uncovered, because of Sadam's rath. That's what I personally think is the justification. The fact of the matter is my opinion doesn't matter. What I think is sad, is that I can post my comments with pride and my handle shown, but your forced to send out your forced to troll without saying who you are. I'll bite on your comments, but only because I believe in what I say.

    2. Re:Important by WegianWarrior · · Score: 4, Insightful

      A simple secure online system is anything but simple to develop. Now, I don't know how the US has arranged for citizents living or working arbroad in previous elections, but I know that we (ie Norway) has usually asked people to go a central location to register their votes (embasy, consulate, military barracs*). It should be relatively simple to set up a secure** server at each such location which collects the votes casted and contacts the central server once every day or so. The collected votes, complete with a papertrail, chould then be sendt in an encrypted form, possible utilizing a one time pad to prevent tampering.

      However, if the system should include a 'log on anywhere' capability, not be reliant on installing a client on the users PC, and be reliant on sending the information over the internet... good luck making it secure. I seriously don't think it will ever be secure enought for this application.

      __*) if you look at the number of soldiers on either NATO, UN or other mission*** abroad compared to the number of people living in Norway, we have more soldiers out there than the US have... but then, there are less people living in Norway
      _**) Secure in this meaning could include a squad of soldiers making sure no one tampers with the server, if you're so inclined.
      ***) Like the people we have in Iraq right now, helping secure and rebuild that nation.

      --
      Everything in the world is controlled by a small, evil group to which, unfortunately, no one you know belongs.
    3. Re:Important by tuxette · · Score: 4, Insightful
      He was elected in a democratic election. There may have been problems with that election, he may not have had the popular vote, but he was elected by a democratic proccess,

      Please explain to me (and I'm sure many others here) how the electoral college system is "democratic." Because I don't think it is. Bush was elected by the electoral college, not by the people. Had it been an election by the people for the people, Gore would be president.

      --
      People say I'm crazy, I got diamonds on the soles of my shoes...
    4. Re:Important by ThePythonicCow · · Score: 3, Insightful
      However, regardless of whether a secure voting mechanism can be implemented over the internet, this one is in deep doo-doo:
      1. I doubt that our institutions are capable of providing a secure voting mechanism without much trial and error (at the expense of our elections)
      2. Those who make the most use of election fraud now have much to gain from claiming that this voting system is allowing the _other_ side to steal elections. It puts the heat on the other side, and tends to delay the acceptance of these new systems until the dishonest figure out how to hack them as well. Meanwhile, the same old systems are used as before, with well known ways of being stolen.
      3. Elections are a public act, that depend on the public trust. Most of the public can be easily persuaded to distrust any electronic system that can be imagined, especially one that is actually subtle enough to be secure.
    5. Re:Important by Eivind · · Score: 3, Insightful
      It's Constitutional.

      ...and therefore beyond critisism. Seriously, I agree that the US constitution is not hopeless, indeed for the time it was written it was quite radical.

      But today it *does* show it's age. And a few points are downrigth undemocratic.

      Worst when it comes to the elections are not the Electoral College in itself, but rather the fact that even though multiple people are elected from each state for the college, it is winner takes all.

      It's pretty obvious to most people that if the population of a state is split 50/50, and that state sends 8 representatives, the democratic option would be to send 4/4 representatives, not 8/0 in favor of whichever party happens to get 50.2%.

      It's also pretty obvious that a system in which everyone living in a clearly-republican or clearly-democratic state has no reason at all to go voting is not exactly optimal. How much, exactly does my vote for the republican candidate count if I live in a state far away from the balance-point (in either direction!)

  2. Why is this so hard? by Corpus_Callosum · · Score: 4, Insightful

    If the U.S. govt would ask a University Comp-Sci department (any University) to initiate an open-source secure electronic voting system, this problem would solve itself very rapidly.

    Why do these things continue to go out to bid instead of being handled in academia where they should be?

    --
    The reason that it can be true that 1+1 > 2 is that very peculiar nonzero value of the + operator
    1. Re:Why is this so hard? by Reivec · · Score: 4, Insightful

      If it were open source patches would come in from all over the place. The algorithm is the important part! The bugs can be worked out as you go. But if your algorithm is crap, no amount of debugging will make it better.

      I totally agree with the parent here. It would be cheaper, it would be a good educational tool for universities to get their students in. It wouldn't be hidden from the public since this is such a public issue. Experts could inspect the code at will and provide patches. I can't even really think of a negative here. I simply think too many government officals are convienced that if the source is open that means anyone can figure out how to break it, which isn't really the case.

      Plus any good NEW ideas that might come out of it would also be open and could be used in other applications. And if they did, they would make good standards since they would probably be under a BSD type license. Good all around I say!

    2. Re:Why is this so hard? by Ckwop · · Score: 3, Insightful

      SSL is a secure channel protocol and the simplest of the standard cryptographic problems. It is monsterously complicated to code but the basic premise of how it works is fairly easy to understand..

      However, Just the description of secure voting schemes is pretty monsterous.. In Applied Cryptography, Bruce takes a chapter to develop a secure voting protocol.A real world system is an order of magnitude more complicated..

      I think the way to develop a secure voting system is to have an international competition much like the way AES selection process was run! Private companys can't solve this problem.. it has to be a community effort involving the world's experts.

      Simon

    3. Re:Why is this so hard? by mpe · · Score: 3, Insightful

      If the U.S. govt would ask a University Comp-Sci department (any University) to initiate an open-source secure electronic voting system, this problem would solve itself very rapidly.

      No doubt the US government would get upset were the answer something along the lines of using a system which could be easily counted by hand or machine, without involving lots of computer hardware and software. Especially if "not invented here" syndrome was involved.

      Why do these things continue to go out to bid instead of being handled in academia where they should be?

      It's a political dicision. The claim is that putting things to "the market" (the criteria being such that only a very few businesses could even put up a bid in the first place) is "more efficent". Whereas in actual practice it could just as easily be "corporate welfare".

  3. US Armed Forces by Anonymous Coward · · Score: 4, Insightful

    There are thousands of troops overseas who'd like to vote. Given that an election's outcome could easily determine the amount of time that these men and women remain overseas, I say their opinion matters...

    I'm not sure why there's a push to do this electronically instead of the absentee ballots that troops have been using for years, but it's probably something to do with "possible impropriety" in how soldiers' overseas ballots were counted (or not) in 2000.

  4. Pentagon?? by femto · · Score: 3, Insightful

    What is the Pentagon doing developing voting systems? As a major recipient of government money, with no funding guarantees, wouldn't it have a significant vested interest in election results?

    1. Re:Pentagon?? by femto · · Score: 3, Insightful
      That's not a reason.

      Soldiers can still vote if the overseas voting system is developed and run by an independent entity, with independent funding. Soldiers may have to trust the Pentagon with their well being, but hat trust should NOT have to extend to trusting the Pentagon with their vote.

  5. vote by edverb · · Score: 3, Insightful

    Vote by absentee ballot this year. I reckon the paper trail might be necessary (again).

    --
    Vonnegut: "What is the purpose of life? To be the eyes, ears, and conscience of the Creator of the Universe, you fool."
  6. Re:conclusiveness? by CB-in-Tokyo · · Score: 3, Insightful

    The concnesus was a majority, 4 votes against; nil for.

  7. Why Not use Soldiers? by Linus+Sixpack · · Score: 3, Insightful

    Considering the US military presence in so many countries (I think 145 at last count) whats wrong with a few polite soldiers, a few witnesses, and a paper trail.

    Lightning fast counting with no paper trail seems too much like an adaptable magic wand to say whatever Bush wants it to say.

    ls

  8. Re:One idea by Zontar+The+Mindless · · Score: 4, Insightful

    > I've heard the idea batted around that only those
    > residents of the actual States should get the
    > right to vote as they're vote has a direct bearing
    > on the policies that will affect them, whereas
    > expats are removed from such policies by living in
    > foreign countries.

    Yeah, I've heard lots of ignorant and unfair ideas batted around in my time, too...

    We're just as American as you are, thank you very much. And it's not like we're unaffected by US Government policy... For example -- you think Americans living abroad are exempt from paying taxes? If the US declared war on Australia tomorrow (granted, that's an unlikely event, but nevertheless), do you think the Aussie would just let me hop the next flight out of Brisbane Internaitonal back to LA? Hell, no -- I'd be interned as an enemy national.

    In addition, living abroad gives us a unique advantage in seeing just how US foreign policy affects other countries and US relations with them.

    > This suggestion also leads to the debate about
    > allowing illegal immigrants the right to vote.

    Apples and oranges. And what, pray tell, is there to "debate"? Answer: Zero. Nada. Zilch.

    If immigrants can qualify for US citizenship, then they get to vote in US elections. Non-citizens are not allowed to vote. I think that's pretty easy to understand.

    As for me, I was born and raised in the USA of native-born American parents; my American ancestors fought in the Revolution, the Civil War, and both World Wars; I hold a US passport; I pay US taxes. I am definitely a US citizen, and I definitely am enitled to vote in US elections.

    Some people obviously have very fucked up ideas about what "citizen" means and no clue as to what it's like to be considered a foreigner.

    --
    Il n'y a pas de Planet B.
  9. Fundamemtally Insecure by igaborf · · Score: 4, Insightful
    My problem with any such system is that it doesn't protect against coercion. One reason traditional polling booths are set up the way they are is to prevent anyone from knowing how you voted. If you're voting from home via the Internet, that's not possible. Imagine someone who has power over you standing behind you while you vote to ensure you vote "right." (If you're a leftie, you can think of that person as a representative of the evil corporation. If you're a rightie, you may want to think of a union shop steward.)

    Note that this is not a computer security problem. Even if the voter's identity is established to a certainty, it doesn't ensure the voter is not being coerced.

    There is simply no substitute for casting your vote in a manner that ensures your choice is unknown to those who might wish to coerce you. The only viable method for doing that is to have your privacy ensured in a public polling place, by poll watchers.

  10. Bush? (was Re:Why Not use Soldiers?) by cascadingstylesheet · · Score: 3, Insightful

    Lightning fast counting with no paper trail seems too much like an adaptable magic wand to say whatever Bush wants it to say.

    Why Bush?

    Those dead people in Chicago, the inner city residents who get bussed from polling place to polling place, and those who aren't, er, technically citizens, weren't voting Republican last time I checked.

    Does you're side really want to start talking about voting fraud (as opposed to metaphysical "voter intent" and "hanging chads")?