E-Voting Company Reveals Their Source Code

Kodi writes "VoteHere has decided to release their source code so that other people will have confidence in it (MSNBC, press release.) It's definitely NOT open source (unlike OVC) but it's still a step in the right direction."

Comments

Obscured?

[dolo666]

Something is really wrong with this move by Votehere. Nowhere on their site is a place to access the revision history of the code, or upload changes, or even contact them about bugs in the code for credit or what-have-you.

Obscured security relies on obscurity; therefore we have a previously obscured source code that is now revealed (as is) and the creator expects the public to be pleased? The key element of Open Source is the insight from a million minds into security, feasibility and programming efficiency; not the wide-open access to the creation of a few minds, who may have conflicts with the management of the company, conflict of design methodology, or flagrant criminal intent (hey you've heard of a silent strike, well programmers do this more than anyone because they are mistreated by management with little recourse at times; read: Microsoft). I think if they are going to release the code, they should at least have a framework for accepting revisions, and base credit upon these revisions from the Open Source community -- bare minimum. This current method is only a public form of espionage without any hopes of maintaining security through accessible revision tree access to the public. Somone might be fired for this? I mean if it were *my* firm, I'd be looking for someone to execute over such a breech, without the necessary systemic functions available for interpretation of risk and absolute recovery system diagnostics, et cetera.

Re:Obscured?

[Analogy Man]

The key words are transparency and accountability.

A) There can be no accountability without transparency (something that our press has been doing a poor job at supporting for the last 20 years...worsening of late). What we don't know hurts us!

B) Transparency is meaningless without accountability. So I punched you in the nose...bugger off and deal with it you big baby! We lost all the votes from Precinct 27 oops, sorry. We had 2x as many votes as registered voters in precinct 43 so it comes out a wash ok? Knowing and having no recourse for justice is no good either.

I'm concerned, I have nothing to hide, trust me...

No

[hanssprudel]

VoteHere has revealed _some_ source code, which may or may not be what is used in their machines. Unless the machines are produced in a truly open fashion, the fact that they have made some code available for viewing means very little.

Re:No

[molarmass192]

Doesn't anybody else think that this kind of software should be developed by the government in an open source fashion? I don't like the idea of a closed 3rd party system being responsible for electing my next government. The election process is supposed to be transparent.

Re:No

[pjt48108]

YES! I agree! Open up the code, and let voting machine makers MAKE THE MACHINES that run it. As an analogy, auto manufacturers don't determine the design and construction of roadways, only the cars that use them. A person should be able to read the code themselves. In fact, such open code could be used for free by a multitude of organizations across the spectrum of society in order to run their own elections, be it for city council, scout troop leader, union president, etc.

Of course, I am still a fan of analog balloting, but truly open sourced voting apps could ease my anxiety a good bit.

Re:No

[pangian]

Can anyone think of a really pressing need to use some kind of electronic vote machine, other than the "we can declare the result instantly!"

Well I can think a few reasons why electronic voting machines would seem advantageos to the people who administer elections, and they have very little to do with speed of reporting (which isn't currently and issue):

1) Lower cost in the long run over printing paper ballots. This resonates particularly well with election managers who are forced to *reprint* a bunch of ballots because of a mistake or change in the race.

2)Electronic voting systems can be used to accommodate voters with special needs. Electronic voting machines can often display a ballot in several languages and large print and can be designed to provide Braille or audio through headphones. Currently, in many districts, the blind don't have an entirely secret vote. This is temping for election administrators as accessibility requirements expand.

3) Touchscreen e-voting systems often provide an opportunity for the voter to check and confirm his or her votes, and can reduce the need for election officials to divine the "intent of the voter" that occurs in some pencil and paper, optical or punch systems. This is attractive to managers since Florida.

I am also *very* skeptical of electronic voting, and would probably feel a lot more comfortable with pencil and paper voting (which is not immune from user error and manipulation, I'll remind you). However, too often skeptics rail on e-voting without an real understanding of the resons that election managers choose them.

It isn't just about the source...

[AtariDatacenter]

Exposing the source code for e-voting (and electronic voting systems) is good. But just as important are the methods and procedures that a company uses around the software. Without knowing how they handle data, what protections and precautions they take, what operational or administrative technical policies are in place, I don't think we can judge much about a system from the source code. But we can, of course, find flaws in the code itself.

Re:PR?

[xanie]

This is totally just a poly at PR.

I mean here's the thinking.

"Hey! We can appease the OS folks by making the code visable to them! And then the media, they'll be like 'Woah! No one would EVER release insecure code if they didn't think it was secure!'"

Yay... This is a joke.

Re:First Glance

[lcde]

Also, who's to say that this is the source code that will be compiled on the voting terminals?

these are the same arguments for anything you don't compile yourself. Who is really to say that RedHat RPM's don't have a patch that opens them up. Because they don't show it in the source RPM? Because they're not microsoft? Sometimes you have to have a little trust.

It may be true that they want people to submit bug reports or other things they see wrong and they will closely look over and patch with their own patch.
[tin_foil_hat]
But with it being e-voting and used for US politics. i wouldn't be to surprised if some gov. agency makes them have a back door.
[/tin_foil_hat]

Re:First Glance

[Talthane]

Also, who's to say that this is the source code that will be compiled on the voting terminals?

You can take paranoia too far, you know. Who's to say the people counting the votes at the polling stations are counting the same pieces of paper you filled in there? If you're going to take that extreme a view, then all voting is irrelevant and utterly without any means of proof. Linux is as unreliable as Windows, the OVC as Diebold, because anyone could have compiled your nice open source software and turned it into something evil....all over ze world...

I do like your tinfoil hat. :-)

Re:First Glance

[interiot]

Paranoia can't be taken too far regarding voting, at least not conceptually. In practice, you can only spend so much time and effort on proving that votes haven't been tampered with, but if you combine electronic voting machines with the results of 50 years of research in computer security, then software should be able to do most of the grunt work, and it may be possible to have MUCH stronger proof that no tampering took place than is available with paper, without requiring very much reoccuring human time/effort.

Re:First Glance

[AntonyBartlett]

these are the same arguments for anything you don't compile yourself.

Ah-ha, trust the compiler do you? No amount of source-level verification or scrutiny will protect you from using untrusted code.

Re:First Glance

[4of12]

Also, who's to say that this is the source code that will be compiled on the voting terminals?

Precisely.

And how many voters or voting officials will be able to verify the digital signature of the binary that the voting machines run (which would potentially thwart trojan replacement of compiled code with different binaries)?

Or, to verify the voting machine hardware itself does not contain any backdoors?

Yes, that's right. The same number of informed caring intelligent voters and educated informed voting officials you saw participating in previous elections. (To be fair there are many intelligent caring voters and officials - it's just that intelligence and caring don't guarantee successful secure electronic voting measures.)

With all the potential avenues for compromise and the levels of expertise, scrutiny and trust required for proper implementation, there's good reason some of the best computer scientists in the country think electronic voting is not a good idea.

At least I'll credit this company for taking one step forward in a mile long journey. I just hope decision-makers get the hint about vulnerabilities and realize how far we have to go.

Re:New system

[HiThere]

If you aren't sure, you aren't thinking things through.

You can't trust it. You *might* be able to trust a system of which it was a component. One program doesn't make a secure voting system, though it can make an insecure one.

Re:First Glance

[Anonymous Coward]

Also, who's to say that this is the source code that will be compiled on the voting terminals?

Well, all bets are off if the company decides to purposefully make a "bad" (evil?) product. In that case, you just have to hope for a whistle blower inside the company.

BUT...by opening the source code...they allow other people to look and see what precautions have been made security-wise.

In other words, if an unintentional mistake was made everyone will have a chance to see it.

So, no, making the source available doesn't (and shouldn't!) quell all doubts. But it's certainly a good thing.

Re:First Glance

[NineNine]

1. Tough shit. You get to see the source don't you? Just put on your tinfoil hat and download it. It's a hell of a lot better than no source.

2. Strong encryption. duh.

3. Who cares how it's compiled? Open source is open source? You personal choice of compilers is irrelevant.

Everything else: Look buddy, unless you're going to physically check every voting machine in the country, you are gonna have to trust somebody. Even with paper ballots, the only way that someone as paranoid as yourself is going to be sure if to personally count every ballot yourself. That's the ONLY way to be sure, which is a physical impossibility. What you're bitching about it unrealstic, and utterly paranoid. Again, put on your tinfoil hat and vote.

Re:First Glance

[Valar]

You're right. The advantage to the code being publically availible is that if there is an unintentional backdoor (security flaw) it might be spotted sooner. It wouldn't protect from intentionally mallicious actions by the company.

Prove them wrong...

[TamMan2000]

If people are so convinced that this code must be insecure, find a bug... Break the thing and tell the company, if they don't fix it, tell the press.

I think this is an enormous step in the right direction, it allow a much greater degree of public oversite for e-voting. I am actaully satisfied with this, I would love a more open process, but I think this is good enough...

Like PGP

[Rick Zeman]

This is just like what Phil Zimmerman, then NAI, and then PGP Corporation did with Pretty Good Privacy. They'd publish their source code for peer audit, but you definitely weren't allowed to do anything with besides audit the source and compare the resultant binaries. It was NOT open source.
I don't have any problems with that, or with the election software not being open source.

Re:Like PGP

[tiger99]

Yes, in this case that sort of arrangement is quite acceptable. Because this is going into a commercial piece of hardware, the software needs to be controlled at one place, so even if it was Open Source, it would not be possible to get contributions from all and sundry. But it also shows something that such as Gates and Ballmer are incapable of realising, that you can freely expose the source of closed commercial code. It bears a copyright, so it can't be copied and used improperly, and more than can a binary. By showing your intellectual property, you actually make the detection of illegal copying easier, unlike the stupid SCOundrel case, where nothing has been shown, nor ever will be, therefore nothing can be proved.

Altogether it is much cleaner and tidier to show the source, in particular it does not involve giving away your intellectual property (but first you have to have some intellect, in order to develop some IP...) It clearly defines exactly what you have.

In a sensible world, there would always be the option to see source code, just as there used to be comprehensive maintenance manuals with many pages of circuit diagrams for hardware, which theoretically could have led to copying, but in practice did not. I used to love the Tektronix oscilloscope manuals, but judging by the mediocre performance of most of their competitors products, the fact that every design detail was exposed, to assist with maintenance, did not result in significant copying. However, it might have inspired lots of engineers in the way they designed other things, just the same as exposure to Minix (ugh!) source code may have inspired Linus. It might, and did, also result in some ingeneous modifications when the proper spare parts were not immediately available.....

I hope this disclosure is the beginning of a trend, it will benefit everyone, including the fact that the owners of the code can get some extra, free, code review.

It will not, of course, please RMS. You can't please all of the people all of the time.

Bah

[dolo666]

How is this at all a proper framework for bug submission?????? It reminds me of submitting to Microsoft... where they put you on ignore and go about their business.

RTFA or not, this is not correct framework at all.

Re:Reading this story

[pangian]

Usually a little more than 50% of registered voters votes in a presidential election. I'm not sure how that compares to the overall population, but its worth noting [reletively] recent Moter Voter laws have made it easier for people who are on the fringes about voting to get registered. This is a good thing, but something that needs to be kept in mind when people bemoan decreasing turnout rates

WRT internet voting, while it has been piloted in a few situations (most recently in the Michigan primaries), Internet voting is an extremely BAD idea.

First there is the protential for technical malfeasence: denial-of-service, spoofing, viruses that record keystrokes, etc. As report in the DOD's SERVE internet voting system mentioned previously states articulately:

"These vulnerabilities are fundamental in the architecture of the Internet and of the PC hardware and software that is ubiquitous today. They cannot all be eliminated for the foreseeable future without some unforeseen radical breakthrough. It is quite possible that they will not be eliminated without a wholesale redesign and replacement of much of the hardware and software security systems that are part of, or connected to, today's Internet."

Second there is the potential for procedural malfeasence: employers, pastors and friends who "help" people to vote on the internet, internet voting salons sponsored by candidates that make it easy for you get a free t-shirt (or a pint of your favorite beer) with your vote, etc.

TUTORIAL: What all this means

[goombah99]

VoteHere a company that makes software to implement a particular voting crytographic scheme is the second outfit to release their source (the first was OVC).

http://www.votehere.com/news/archive04/040604.ht m

Until I know more details I wont pass judgement other than to say this underscores the point that making source code open does not diminish the rights of the company to its ownership and copyright of the code. It does allow bugs to be found and fixed. And expert independent testimony to its safety may result and thereby build public confidence. Thus this is all good.

I dont know what exactly was released. My understanding in the past was that VoteHere was not actually a voting machine maker but a seller of a patented system for validating encrypted votes. Sequoia Systems had in the past discussed the possibility of letting buyers purchase this for use on their machines, though I have not heard of any machines actually deployed with this.

More specifically, the VOTE HERE system still requires the machines to be error free. Recounts are not possible in the event of an error. The votehere system only eliminates certain kinds of fraud but not all and does nothing about errors, the discovery of errors, and recounting after errors. Additionally since machines using this system will for practical purposes look the same as machines with tampered software: how do know what is going on inside as a voter?

I have read the VoteHere White papers on the mathematics of their algorithm. Two things are apparent 1) It's so complex--and I am trained in advanced mathematics--it's not perfectly clear that all the loop holes are plugged 2) Even if it works as claimed to the voter its still a magic black box that offers no visual evidence of the vote. Thus on both counts voting confidence is not available.

Look at their logo--its a bunch of math symbols. To most folks that is more of a put-off than a confidence builder. Clearly they think they have a technical solution but dont appreciate the sociology issues.

It appears to mainly move where fraud and erros can occur from the polling place to the programming place and to the people who hold the encryption keys. Its not clear what happens if the keys are accidentally leaked.

Still clearly votehere sees it in their interest to get the issue of open source on the table and that is a great sign. kudos for them even if it is partly a bussiness decision.

Don't be unfair!

[Syncerus]

Look, these guys are trying to do the right thing to inspire trust and confidence in the integrity of their software. What they are doing is entirely reasonable and proper. Just because they want to make real money from their code doesn't mean they are evil. Just because you think that everyone should release everything under the GPL, doesn't mean that they should be forced to accept your values. The release license is the choice of the author; never forget that.

The purpose behind this excercise is to promote trust in the integrity of the electronic voting process; not to release Open Source voting software.

You should commend these guys, not snarl at them.

Re:First Glance

[Tassach]

What prevents any e-voting company to build binaries that have "secret conspiracy back doors" in them?

1. Release the makefiles along with all the details of how the release executables were built (exact details of the build platform, compiler flags, etc) -- basically all the details you need to produce an identical executable.
2. Calculate the MD-5 and SHA-1 hashes of the test version you built yourself. EG:

   find / -name \* | xargs md5sum | sort > checksums; \
   find / -name \* | xargs sha1sum | sort >> checksums; \
   cat checksums

3. Have independent auditors perform this process on a random sample of deployed machines.
4. diff the checksum file for the machine being tested against the one for your reference build.

If all the hashes match, you're assured that the executables on that machine have not been tampered with.

You may not download this Software if you are located in any country (or are a national of a country) subject to a general U.S. or U.N. embargo or are deemed to be a terrorist country (i.e., Cuba,Iran, Iraq, Libya, North Korea, Sudan and Syria). Ouch! Why the patriotic license clause?

Same reason any made-in-the-USA software containing strong crypto has a similar warning -- US law prohibits the distribution of strong crypto software to "bad" countries.

AES, FAA, Certification Authorities

[Discoflamingo13]

I won't be satisfied until voting machines are subjected to the same safety criteria as automotive or aerospace software (e.g. FAA's DO178B). This means clear requirements, traceability from requirements to implementation, formal verification by third parties, and an audit trail. Infrastructure already exists for this purpose - the FAA could take this on with little difficulty.

I thought our government was a bureaucracy - why didn't they think of this first?

Some people just like to bitch.

[Saeed al-Sahaf]

Boy, you just can't win at Slashdot. All the sputtering frothy yappers here demand a look at the code. They get a look at the code, but that's not good enough anymore.

I guess some people will bitch no matter what.

Re:First Glance

[Tassach]

It's unlikely that a general release compiler (gcc, vc++, etc) would have a specific back-door for a voting system built in to it. Any backdoor of this variety would be present in any system built with that compiler

. In this case it doesn't really matter if you can trust the compiler or not -- what you want to do is ensure that the version of the software installed on deployed machines matches the audited reference copy. This can be done easily. Then you can test the hell out of the reference copy to make sure that it doesn't have any backdoors.

This doesn't assure you that the reference is 100% secure (there's no such thing), but it does give you 100% assurance that the machine you use to cast your vote is running the audited software.

Re:My Idea

[Zathrus]

That's just insane.

Look, it's pretty simple. If you don't trust the precompiled binaries they have on the machines, then why on earth would you trust the compiler they provide? I'm not talking about not trusting gcc... it would be fairly trivial to produce a hacked gcc that compiles the code in question differently (or simply compiles an embedded version of the code). And you'd have no way of knowing.

Heck, hack the diff tool for that matter. Either reject any schmuck who actually tries to pull this, or replace their source with yours while diffing. How thick is that tinfoil beanie anyway?

Oh, and don't think that a mechanical system is any better either. After all, some machine has to read those ballots and you could just compromise it!

Sure, I guess you could go to hand counting. That'll only take a few weeks to verify the results. No matter... I'm sure the rest of the world will understand that we're just too damned incompetent to use modern balloting techniques. I'm sure it won't have any impact on domestic markets either... nope... just because we don't think our products are good enough to use doesn't mean you shouldn't buy them!

doesn't matter

[Anonymous Coward]

The software could be peachy clean, but any part in the election process could be corrupted to modify the results.

Even if the machines are perfect, the voting locations could be biased. At some point, humans are going to read the data from the machines, and humans can't be trusted for crap. You aren't going to see the tabulated machine results, but some processed and compiled data.

Will it remain open???

[OGmofo]

"Lookie folks, you can download our source code, unlike those other evil opaque ne'erdowells."

What's to keep them from closing the source once everyone hops on the bandwagon? If there's no promise to keep it open in perpetuity, its worthless.

No it's not.

[lynx_user_abroad]

It's definitely NOT open source (unlike OVC) but it's still a step in the right direction."

No it's not a "step in the right direction" and you're not helping to fix things by claiming that it is.

Having a copy of some source code is not a "step in the right direction" if you can't understand it. Most people can't read source code.

Having a copy of some source code is not a "step in the right direction" if you can't have complete confidence it's implemented correctly. If it's at all complex, there's a good chance the are bugs in it. If the manufacturer ever admits they've fixed a bug in it, then they are admitting even their engineers who designed it didn't understand it enough to spot all the bugs. Will Joe Voter spend as much time reviewing the code? (If they never admit to a bug in it, then they are in denial.)

Having a copy of some source code is not a "step in the right direction" if you can't be sure the source you have is the same one used to compile the binary runninng on the machine you're casting your vote on.

Having a copy of some source code is not a "step in the right direction" if you can't be sure the compiler wasn't trojaned. Or the hardware itself.

Unless you have evidence of a ballot cast, the best you can claim is heresay testimony of a ballot cast. Are you willing to accept that as a basis of your next government?

Re:Reading this story

[cpeterso]

you are assuming each voter cast just one vote.

No matter, indeed.

[sean.peters]

Sure, I guess you could go to hand counting. That'll only take a few weeks to verify the results.

Somehow, the Republic managed to survive for a couple hundred years with paper ballots, waiting longer than "a couple weeks" for the results in the days before electronic communciations. What was the problem, again?

Sean

design/intent

[chadjg]

Well, by definition, software can only do what it was designed to do, right? If those functions are different from the stated intent of the developer, then tough beans.

Computers are wonderfully deterministic beasts. We shouldn't pretend that they aren't and blame our glitches on computers. If Ralph Nader is "accidentally" elected, it's not a machine/software problem. Somebody, a person or a group of people, screwed up.

I'm not saying that a law court would agree, but if a voting machine can be made to sing "Turkey in the Straw" every time you hit the Libertarian button, then that's exactly what the it was "designed" to do.

(Wow, a two bit thought in three paragraphs, time for more bran.)