Slashdot Mirror
Absentee Ballots by Email?
tordia writes "Bruce Schneier has come out against a plan proposed by the Missouri Secretary of State, Matt Blunt. Blunt's proposal would allow "soldiers at remote duty stations or in combat areas cast their ballots with the help of e-mail." The plan arose when Jim Avery, a Missouri State Representative and National Guard soldier currently on active duty in Iraq, told Blunt that the fax machines required by the current Missouri absentee ballot law are rare, but most soldiers have access to computers.
A spokesman for the Secretary of State's office downplays the privacy and security considerations by saying, "If the soldier is uncomfortable with this process, he or she should not consider this option".
I agree with Bruce when he says "This is troubling"." Like many things, this is a wonderful idea in theory; it's just that darn implementation that things get...messy.
Can't they just use an email -> fax gateway of some sort?
And, if they plan to use email, this seems like the perfect chance to try out digital signatures. The military could organize it.
"If the soldier is uncomfortable with this process, he or she should not consider this option"
:(
.mil or gc.forces.ca email addys to people handing out Gmail invites, to prevent personal info being circulated that could lead down a dangerous path if the enemy decided to look them up. This has been largely difficult to reign in, but for the most part it's a fairly anonymous exchange. No worse than name, rank, serial number. And that's the idea. But if you have to fill out an absentee ballot in this email scheme, it would require much more personal info or it could be easily abused.
That's the worst excuse for bad security I have ever heard, and I think that if it was applied on all other systems, it would be a huge disaster. Look at the ATM for example. What if instead of a bank card, we shifted to an email scheme for withdrawing and depositing money? Email cheques are fairly secure but they have a password scheme and they don't rely soely on email. There's also no private information being transferred with an email cheque, just a link that requires a password over a secure connection. But what if we just made up email money and passed it around? Huge security flaw there. Take it one step further, why not add salt to the wound, by suggesting that if you don't like the insecure system, don't use it! Duh.
If soldiers send their private info over email, this also produces a security risk if the enemy gathers intel on soldiers to use against their families. Bad bad bad idea.
I'm one of the admins of Gmailforthetroops.com and we've had to let everyone know that we only want soldiers to privately provide their
The dangers of knowledge trigger emotional distress in human beings.
This will help cement Bush/Cheney in for '04!
Oh crap, did I just say that out loud?
I run a few mailservers :). Every day the spammers and viruswriters come up with a new way to defeat whatever anti-spam and anti-virus measures I implement. It's a case of running as fast as we can to stay in the same place!
So maybe the spammers will decide who gets to be president this time, instead of the Supreme Court.
I'm going to call this election early:
John Kerry: 80,000 out of 150,000 votes
George Bush: 160,000 out of 150,000 votes
Seriously, after all the controversy over the heavily developed Diebold e-voting system, who comes out and says, "let's do it by email!".
If this refers to the SMTP/IMAP/POP3 email system then one wonders why such an insecure system would be considered.
With today's encryption technologies, it shouldn't be that big of a deal to do it securely, but suggesting to do this over standard email after all of the Diebold e-voting fear is rather bold.
I know cryptology is complex but christ, there are a few tenants that even I have picked up reading his most excellent newsletters. Am I the only one who reads these? I can see it now: the US government winds up in Schneider's 'dog house' along with the rest of the shady dealers.
And me having to vote from Vienna
Nothing in the world is more dangerous than sincere ignorance and conscientious stupidity.
give soldiers ability to send regular postal mail?
a week before Nov 2, simply gather up everyone's ballots (sealed in envelopes), then mail them back home. IIRC, this is what was done in 2000, and many other elections pre-fax machines.
Why is it that politicians seem to do everything in their power to undermine public
confidence in the election process? What's wrong with having miltary poll stations
in Iraq and then simply flying the ballot boxes back? Sure, it's more expensive
that e-mail but if the US government can spend billions to put a democracy in the middle east
surely a few million dollars could be set aside to insure integrity of the US vote.
Simon
Oh, I see. If you're worried about security, don't use the system. Right. So, what's to prevent someone from using this system for me in my name? Who decides which ballot is valid in the case of multiple submissions? I certainly hope someone rethinks this idea before it gets implemented. There is simply WAAAAAY too much potential for abuse.
-- Gargonia
Never play leapfrog with a unicorn.
Bush: 1,356
Kerry: 1,498
Nader: 1
L337 D00d Linus Torvalds: 82,239,123
This is a great idea!!! Now where can I dig up a list of overseas soldiers??? Ahhh yes...I knew there was a reason why I bookmarked this story...
I'll turn into a supernova and burn up everything. Well I'll turn into a black little hole and you'll turn into string.
Let's say I am an employer, and I say "you'll get fired if you don't vote for candidate X". If the only methods of voting are by secret ballot, the voter is protected. Otherwise the voter might be forced or coerced into using the "optional" un-secret method. (And yes this has happened before!)
On top of that concern, we're using e-mail? I don't trust the e-mail system for anything important at all. Last semester we had to turn in our homework via e-mail in one of my classes, which I had qualms about. Lo and behold, at the end of the semester, two of my assignments didn't get counted by the professor. He insisted that the e-mail system was perfect. This idea, very bad.
A spokesman for the Secretary of State's office downplays the privacy and security considerations by saying, "If the soldier is uncomfortable with this process, he or she should not consider this option".
So I wonder what they'll say afterwards...
Spokesman: See, this plan worked perfectly - we got 100% turnout.
Soldier: 100%? How? I didn't use the email voting system.
Spokesman: Sure you did, we have your vote right here. You voted for Kevin Mitnick, and used the reply-to address "haX0r-v0t3r@133t.ru."
Soldier: What?
Spokesman: There you have it folks, as we said beforehand, if they didn't trust it, they wouldn't use it. 100% used it, so clearly 100% trust it. And if 100% of our fighting men and women trust a system they know nothing about, who are you to question it? It's a simple question really: Do you support our soldiers, or are you a terrorist? The terrorists don't want our soldiers to vote.
Stop-Prism.org: Opt Out of Surveillance
It's not as bad as it might sound. The only "internet-type" involvement in the process is actually data being moved over MILNET. Very little of MILNET is publicly accessible. When the ballots get to the DoD, they are faxed to the appropriate election officials in Jefferson City, MO.
Not ideal, but it's not as insecure as I would have imagined.
"There is no night so forlorn, no mood so bleak, that it cannot be infused with pleasure by tender meat..." - R.W. Apple
Okay, emailing a vote is not exactly secure, but how secure is faxing a vote?
Oh sure, they can "see" a signature but how many people in the voting office are going to check the signature against the one on file? (IE, how many dead people vote in elections?)
I agree, there is a serious problem with the attitude of "if you think it's insecure, just don't use it". I've run into this same attitude with regards to touchscreen electronic voting machines. I have been told that if I don't trust the ES&S systems, I should just vote by absentee ballot. It doesn't matter if I use a known secure voting apparatus if the other people who are voting do not. It doesn't help that my vote gets counted accuratly if someone can add an arbitrary number of votes for the candidate of their choice.
Hypothetical Example:
1000 people eligible to vote.
600 actually vote:
200 use secure method. They vote 150 for candidate A, 50 for candidate B.
400 use insecure method. They vote 220 for candidate A, 180 for candidate B.
Total legitimate votes: 370 for A, 230 for B.
Now Mr. Vote-Hack adds 200 phantom votes for B, through the insecure method.
Did anyone's vote count, aside from Mr. Vote-Hack?
In some systems, unless the entire system is secure, securing parts of it doesn't really matter.
That's a false dichotomy. There's also snail mail.
Email is a lot easier to intercept than faxes. Faxes require physically tapping into the line. Email simply requires any ISP have any computer on their local network which the data passes through en-route from the military computer to the voting office be comprimised, *or* tapping into the lines.
And, it's not just a "not voting/voting with risk to your family" situation. It's a "someone who doesn't like the statistical balance of your unit's politics and launches a DDOS attack on you when you would normally be voting. Or its a case of someone phishing (what was it, 22% of all phish emails work?). Or a case of a worm whose sole task is, apon propogating, to send out a ballot voting for candidate X. Or a dozen other things.
I just invaded Grammar Czechoslovakia and duped Grammar Neville Chamberlain; now it's on to Grammar Poland.
You know, only the US (of developed Western democracies at least) makes such a big fricken' mess out of the whole voting process. Pieces of paper and ballot boxes actually work. They may be slower, they may be more expensive, but they WORK and they are transparent. They are scaleable and the hardware is cheap. Recounts are easy and verifiable.
Prediction: the US will be convulsed over the reliability and fairness of its elections procedures every four years for the forseeable future.
Countries using ballot papers and boxes will get their results a bit slower, but will not be convulsed.
As for the argument that e-voting makes it easier for people to vote, thus increasing democratic participation, all I can say is, if you care so little about your vote that you can't be bothered to leave the house to cast it (I"m assuming those who are housebound are catered for) you don't deserve to vote.
Sheesh. I have used up my 'fricken' quotient for today but it was worth it.
Some old technology is very good. Like the bicycle. When I worked in TV we used to bike tapes around rather than using the internet, because as our tech director used to say, "Never underestimate the bandwidth of a man on a motorbike".
I'm not wrong. You haven't thought about it hard enough.
More than digital signatures are needed. There has to be feedback to the soldier that his vote was cast and counted at the central polling place. There is a technology that can do this from the company "vote here" which allows the voter to call in later and check that their vote was recieved unchanged without actually telling them the vote (basically it tells them an encrypted checksum that cant be reversed to reveal the vote even by brute force). This does not prevent the client computer casting the ballot from making a mistake or being corrupted malicously or otherwise. But it does solve the transmisson and feedback problem. I oppose this tehcnology for general public use (favoring paper trails due to their ability ot be recounted) but for soldiers overseas prompt ballot collection may take priority over recountability since the risk is greater that your ballot wont be counted at all than it will be miscounted.
Some drink at the fountain of knowledge. Others just gargle.
Voting by email could work, but probably not with the scheme being proposed.
Every military member has a CAC card which serves as a military ID but it is also a smartcard. Every person in the DoD is issued a digital certificate by the DoD when the card is issued. It should just be an academic exercise to create a voting station where the user inserts his CAC, votes and receives a confirmation that is encrypted with the user's public key and signed with the appropriate private key as an audit trail. I think this scheme fulfills the requirements for a "trusted" voting system. Voters are securely authenticated, votes are audited and cryptographically secured. Of course, the flaw usually lies in the implementation...
Each voter is issued a crypto-token, the private part of a public-private key pair. Of course, this cant be tied to a name to preserve anonymity. They vote electronically and all the votes are emailed at once in a big tarball. A hardcopy is printed of each vote (encrypted) in case you want to recount.
They can then verify the individual votes authenticity with the corresponding public keys.
It could be done.
I don't need no instructions to know how to rock!!!!
Not only that, but there are a few other details that make this a little different.
.mil domains. The military owns the entire domain. Implement a verification procedure, such as a reply-to-sender that "I received your vote. Please reply to this email to let me know that you actually sent it."
.mil enclave, but I'm on base right now and can't check.) Every member of the military should have three certificates that are issued by one of the military's private PKI servers. The three certs are intended for identification (such as logging into computers and web sites), email signing and email encryption.
.mil domain, and that is signed and encrypted by two different PKI certs issued by private and extremely well protected PKI servers isn't the gaping security hole that "Just send your vote by email" makes it sound like.
First, all of the email will be coming from
Second, the military ID card (the CAC, or Common Access Card) is a Smartcard. (Hopefully, the link works. I'm not positive that it's accesible from a machine outside the
This doesn't make the scheme foolproof or provide airtight security. But an email that is verfied as coming from a
"The legitimate powers of government extend only to such acts as are injurious to others." Thomas Jefferson.
Soldiers in combat are rarely cut off from the rest of America's physical presence for very long. Ammunition, food, and other materiel are supplied by American supply lines, even far forward at the front. Those lines also deliver mail, as part of the US Postal Service extended to military requirements. These ballots can be sent securely through those supply lines, as they always have been. Most soldiers can send their ballots in advance of deployment to the front, which is almost always planned long before. Their disadvantage in access to "late breaking news", after their vote but before Election Day, is consistent with the other liberties soldiers voluntarily suspend when accepting military command. Corruption of their right to secrecy, and corruption, through selective demographic ballot under/service, of the people's right to equal access to all voters, is not consistent with military service defending the Constitution.
--
make install -not war
Why not for all U.S. expatriates, if you're going to do something like this at all?
People say I'm crazy, I got diamonds on the soles of my shoes...
If they could use PGP I'd have less a problem with it. You could scan the ballot and then encrypt the file to the state's public key and send it off. But you can still track the file to the sender so short of using anonymous remailers this still isn't private.
Slashdot, home of supporters of free software, free music, and free speech.Except for Moderators that disagree with you.
After all, nobody's ever stolen a ballot box, stuffed a ballot box, altered a paper ballot, discarded a paper ballot, or anything at all like that.
Why can't they ever just say "We need a way for soldiers to easily cast an absentee ballot" and then let people who know what they are doing come up with the proper system?
This is a problem where I work as well.
1.) The application has to get to the voter somehow. This is not as much of a problem as it once was, because one can email the town clerk and ask for it to be mailed, one's relatives can send it to you, or you can print it out from the Secretary of the State's web site.
2.) Once the application is filled out, it must be mailed back to the Town Clerk. Currently, the law allows one to fax the application to ensure the ballot goes out in a timely manner, but it must be mailed at the same time it is faxed. If the application is not received in the mail be the close of polls on election day, the ballot is rejected.
3.) When the Town Clerk receives the application, he prepares a ballot and mails it.
4.) Then I get to vote. And mail back the ballot. And hope that it's received in time.
That's a cycle of three or four mail trips across the world. Anybody overseas who wants to vote absentee needs to get going right now to make sure their votes are counted! Incidentally, look at the audit trail absentee balloting leaves in its wake: the completed application, an outer envelope for mailing, an inner envelope to ensure ballot secrecy, and the ballot itself. With the potential for mischief that absentee balloting presents, I am glad all this paperwork exists. However, in the interest of timeliness and of not disenfranchising remote voters, I think the application process, but not the voting itself, can be shortened by using email without sacrificing security. Imagine this process:
1.) The voter emails the town clerk with the required information and a digital signature.
2.) The clerk mails the ballot.
3.) The voter mails back the ballot.
That's two mail trips. That's still a wait, but the process is simpler, there's still an audit trail, the identity of the voter is still verifiable, and the ballot is on good old paper. Why can't states adopt a sensible, middle-ground process like this one? And why doesn't Missouri's chief elections official understand the importance of an auditable vote?