Slashdot Mirror
Vote Tabulator Security Hole Exposed
Doc Ruby writes "Black Box Voting has exposed a security hole in Diebold machines that tabulate votes collected from electronic voting machines. A code entered into the tabulator's user interface duplicates the "secure" counts into an insecure count which can be changed, and counted instead. The "double books" vulnerability and exploit were reported to the manufacturer over a year ago, and confirmed, while major customers (California and Washington states) were notified shortly thereafter. In spite of some revisions, the latest version of the software remains insecure. Diebold voting machines running GEMS version 1.18.x are vulnerable, running in about three dozen states. Although the software is widely deployed, and scheduled for use in shortly upcoming elections, risk mitigations are available, mostly protocols restricting physical or network access to the machines. Other auditing/accountability measures for ensuring only trusted access to the system are recommended."
You give people too much credit. The level of complacency after the 2000 fiasco, which no doubt some very sharp minds took note of, underscored that people just really as a whole don't give that much of a damn about democracy in the US anymore.
So ironic in the face of what's been happening in Honk Kong, as people vie against the Beijing political machine to retain or advance their democratic cause -- the country which lit a the fire of democracy lacks passion.
It's sad to say, but this system could be hacked 10 ways from Sunday and people would grumble, but you'd hardly see the kind of response it should warrant.
A feeling of having made the same mistake before: Deja Foobar
Lets see, a company whos leader claims to want to reform the US as a theocracy and has sworn to give the ellection to George Bush has a product used for e-voting that has a "feature" (sorry, this is not a bug) that allows someone to rig an election. Gee, I have no idea why anyone whould think this was anything negative.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
"I am committed to helping Ohio deliver its electoral votes to the president next year." --Walden O'Dell, CEO Diebold Inc.
Untwist your knickers. If he had said something about helping to "defeat Bush" or whetever, it would all be an evil left-wing conspiracy instead.
0 1 - just my two bits
When less than two dozen congressional seats are actually contested at any given election due to gerrymandering, and the electoral college system restricts the salient portion of the electorate to less than a dozen states, one wonders why Americans are so apathetic when so many of them are clearly disenfranchised out of the federal electoral process by an archaic voting system (the electoral college), or partisan state legislatures that draw ridiculously shaped congressional districts.
My theory is that the media, with its constant attention on "poll numbers" and the presidency, neither of which have any bearing on actual electoral results, have conditioned the many Americans who didn't pay attention in history class that we actually live in a direct democracy instead of a representative one.
On the other hand, in some ways its difficult to argue "disenfranchisment" - after all, California still counts, despite the fact that the Republicans have no chance there, and so does Texas. So does voting for an individual legislator - but only if no one else does. Unlike in Hong Kong, we are afforded a democracy. The distinction here is that it takes far more attention than the average person has, be they American, Chinese, or North Korean to realize how arbitrary and disproportionate our democracy is.
That is why it is probably best to put away all this conspiracy theory stuff. Whether or not it's true, I don't know, it doesn't matter. Electronic voting has shown it is insecure and innaccurate. Even without tampering a lot of the machines have failed. It shows a real lack of planning more than anything else on Diebold's part. My best guess is that they are more incompetent than corrupt. They severly underestimated the issues involved and just rushed something out before the 2002 election in order to take advantage of the 2000 fiasco while it was still fresh in people's minds.
If Diebold was really evil, than they would have put much more thought into the machines. If they were evil, then they would have a very small numbers of difficult to find exploits, while producing a seemingly reliable machine. There are problems even with the basic protocol of going into the booth.
They are incompetent. They may be sinister, but it's not important to the argument, their incompetence should mean that the machines should not be used for elections. When people bring up the conspiracy theories, it just solidifies the resolve of the other side to use the machines.
If you explain to people that regardless of the vote and tampering that Bobo the Clown could end up governor of Neveda, then we may be able to have productive discussions.
Monstar L
Here in Canada, you vote by writing an 'X' in the box next to the candidate you want. Votes are then counted by hand, with representatives of each major party in at each polling station watching the counting. It's not likely anyone will do anything underhanded and mess with the tally. I'm sure there have been some issues, but I can't remember anything remotely close to the mess in Florida during any of our elections.
It's a fallacy that you need a high-tech solution for this. Voting is too important to be obscured through code and harware. It's something that should be transparent, where recounts are done where necessary, and where there is no room for ambiguity or interpretation when the numbers are reported.
"Why can't everyone just be straight with me?"
"Because we live in a bendy world, dear."
You can't test a program or system of any complexity with some code in, pronounce it "good", and then take out some of the code.
Its new code at that point. Which is perhaps why its left in. If they take it out, then they have to re-test and re-certify.
But fundamentally, it shows that Diebold is, at best, incapable of understanding what it takes to produce this kind of code. It sounds like a bunch of junior programmers coding under the "direction" of a mid-level programmer.
What I'm surprised at is the local government accepted binaries from the vendor without (a) having full access to the source code (b) a mechnism to ensure the source code they audit matches the binaries in the machine.
When you think about it, the whole thing reeks of a company looking to make a quick buck and local governments too stupid to understand that they lack the expertise to judge this kind of software and make an intelligent decision about deploying it.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
The worst are full of passionate intensity
And the best lack all conviction...
But I suspect that that is always true - the best are by their nature capable of empathising with people on both sides of a question, and capable of seeing the logic on both sides. Hence they find it hard to be passionate.
True passion, I fear, probably comes from ignorance stoked by fear and testosterone.
Those who cast the votes decide nothing. Those who count the votes decide everything. - Stalin
Why? Because the loser has to concede to the fact that he has lost. We do not force the loser to lose, the loser allows the winner to win. "I lost in a fair fight. Better luck next time." The concession speech is just as important to democracy as the acceptance speech.
If a loser of an election disputes the results and the winner cannot defend the vote count, then the loser has every right to appeal to other means--in most countries, violence.
In the last American election, the loser disputed the vote count. The winner could not defend the results, so the loser appealed to other means--the Supreme Court.
The fact that there was no outbreak of violence (at least of any significance) was not due to the voters' acceptance of the count. It was due to the voter's acceptance of the Supreme Court as the final word in American government. The loser accepted the Supreme Court decision and allowed the winner to win. The voters (some begrudgingly) accepted the decision.
But please note: the last disputed election had something that the next one will not: chads--a paper trail--transparency. Win or lose, everyone had the hope that eventually, the truth would be known. It may take days, weeks or months to determine, but the truth would be known. The system would work.
Ignore conspiracy theories. Ignore corporate donors. Ignore programming loopholes. The threat of the next disputed election is the notion that even if the election is honest, even if every vote is counted, even if the outcome truly matches the intent of the voters, the loser will be able to dispute the outcome and the winner will not be able to defend it.
Imagine the turmoil if after the last election, over a million of the punch ballots had gone missing. That is what these systems offer. It does not matter who wins this fall. The loser will dispute the result and the winner will not be able to defend it.
As counter-intuitive as it may seem, Bush may be the most likely candidate to suffer from the paper-less voting system. If Kerry wins, I do not believe Bush will have much of a case for vote tampering as the systems are being used primarily in districts controlled by Republican party members. If Bush wins, it is very likely that the results would be thrown out altogether for the sake of another election. The anger pent up by Democrats in the last election fraught with claims of 'unfair' would be mild in comparison to an election that lead to charges of treasonous fraud. Nixon was impeached for election tampering and all he did was spy on his opponents.
Many comments have offered ways to counter the threat of the new systems and most them are good. Yes, it is helpful to point out the possibility of fraud. Yes, it is helpful to write/call representatives demanding change. Yes, it is helpful to create more transparent technical solutions (yes, open source is one option, but not the only one). In the meantime, the best way to ensure that 1.) your vote is counted, 2.) your vote can be recounted, 3.) your vote will not be disputed is to ask, NOW, for your absentee ballot. It is exactly the reason that both the Republican and Democratic Parties have started a "get out the absentee vote" campaign in areas where the new systems are being installed.
If the Supreme Court does not ask for a recount, they may look to the absentee ballot as the measure of voter intent. The next President may be elected by the voters that do not even show up.