Hardware Hacking a Voting Machine in 4 Minutes

goombah99 writes "Bev Harris of BlackBoxVoting.org has acquired an actual Diebold Acu-vote ballot scanner. Rummaging through King County's trash, she managed to get her hands on some of their tags and seals. She has since demonstrated a successful penetration of the seals without breaking them ... all in under 4 minutes with no training or technical skills required. There's a nice how-to with photos over at Verified Voting New Mexico." More from goombah99 below. "The demo is particularly relevant in light of the recent experience in Ohio in which there were large discrepancies between the electronic record and the paper trail, and also since many counties still permit the machines to be taken home by individuals before voting day (as a means of distributing them to precincts). These 'sleepover' machines were involved in the contentious narrow-margin San Diego Election, and are in continued practice in many states. Moreover, it's common practice for counties to contract out deliveries to third parties, such as in New Mexico where in one election, unlicensed delivery drivers took the machines on an unauthorized field trip and only got caught when they crashed the delivery truck after a stop at Hooters. The good news here is that the penetrated Diebold system in the photo essay is an optical scan system. It's not a touchscreen electronic voting system, so there is a paper trail. What hack really shows is that without mandatory random spot checks on the paper ballots, these may be as potentially vulnerable as the touchscreen direct recording electronic voting systems. It's perhaps worth noting that the open source voting system being developed by the Open Voting Consortium features a 100% reconciliation of every single paper ballot with an independent electronic record."

Comments

Good Enough for Government Work

[stealie72]

Seriously, it seems like the voting system is just shoddy, not specifically corrupt. But the shoddyness sure does help the corruption.

If only people thought their vote mattered, they might be concerned about this.

Re:Good Enough for Government Work

[monoqlith]

Exactly. It's a vicious cycle. People are convinced that their vote doesn't matter; therefore, our election administrators can get away with an opaque, shoddy, and potentially corrupt election system. Then, stories like this come out which confirms people's mistrust, cynicism, and resulting apathy, entrenching the popular opinion that the individual vote doesn't matter. Instead of being galvanized, most people(including myself, but not anymore) just sit back and declare that the ideal of popular representation has been dead for many years already or they wait for other people(the government?) to take care of the problem. Or they declare that there is no difference between the platforms; that all politicians are the same nihilistic creatures. Or they just don't feel like worrying about it. Or they don't understand why having a privatized election system administered by political appointees and elected officials, entails a conflict of interest. There are failures of curiosity at every level of public life.

This is not at all to say that stories like this are bad at all. They are very very good. They bring attention to probably the most important issue of our time; if we have no say in our government, then every other political issue is quite literally irrelevant. I applaud black box voting for taking this seriously, and hope that I can justify their efforts by helping to galvanize people to demand transparent voting. It is absurd that our election process is subject to error at all.

  As I've said before, it's just counting

Why can't we get it unequivocally right? It is so easy that there has to be some interest behind not making it as transparent and rigorously accurate as humanly possible. We need to draw out these interests and cancel out any undue influence they have over our system.

Re:My Perception Has Changed Again

[Anonymous Coward]

"The Diebold Acu-vote has failed as a product that requires the utmost security. I am a dissatisfied consumer and I sincerely hope every citizen of the United States agrees with me."

Unfortunately, you're not Diebold's customer. The elected officials who in turn buy the machines responsible for reelecting themselves are Diebold's customers.

Re:What about hacking paper ballots?

[Zenaku]

Depends on what you mean by "rigging." If you wanted to say, register in 5 different precincts, then vote at each one, you might get away with it. But that's 4 extra votes. If you wanted to say, change every 5th vote from a district, or just plain "lose" the results of the district entirely, you'd have a hard time doing it on paper.

In general, I'd say that any kind of large-scale vote rigging done by paper ballots would require a conspiricy involving multiple staffers and observers at the polling places. You'd need to physically replace thousands of paper ballots with fake ones. Good luck doing that by yourself. And afterwards, if the results look fishy, there is a good chance that the fraud could be discovered on a recount.

With these Diebold machines, on the other hand, any one person, even one without any special access given to election workers, could modify as many votes as they want, while arousing no suspicion, leaving no physical evidence in the form of discarded ballots, and leaving no trace of the original results should a recount or investigation be ordered.

There will always be some dishonest people who see democracy as a game they can "cheat" at to win. But if a voting machine doesn't produce a solid meat-space record that can be guarded, stored, and re-examined, the effects of those cheaters on the outcome is greater by orders of magnitude.

Re:Just my guess

[Osty]

But I think there is an assumption that the people running the polls will not allow a team of hackers to sit there at the Diebold machine prodding and prying at it, soldering logic boards onto it, and all the other funky stuff they've been doing to Diebold machines to make them mess up. I could just drive a truck into it, that would be even easier than hacking it!

It's not people at the polling place that they're concerned with. Its the corrupt officials who get to take the machine home with them, who could replace valid vote data with a trumped up memory card showing a clear majority win for whoever is paying them the most. The "tag" on the metal cover is supposed to prove that the machine has not been tampered with. This article proves that you can tamper with the data all you like without breaking that tag.

In a sense, this is even worse than a hacker attacking the machine right at the polling place. In this scenario, you feel like you've excercised your right to vote and contributed to the process of making things better, but in reality your vote never got counted at all. It was replaced by a dummy vote.

It's like television.

[Grendel Drago]

It's kind of like television. You are not the networks' customer. The ad companies are the customer; you are the product that is sold to them. Everything else is just flim-flam designed to keep you in front of the tube.

Re:What about hacking paper ballots?

[k98sven]

Here here! All the old fogys are afraid of the "darned electric voting boxs" when it was and still is easier to "acidentally" destroy all the black voters paper ballets or not count "pregnant chads". I'm not even taking into account thinks done by non-government forces.

Bullshit. How exactly is it easy to destroy ANY ballot when you have multiple election workers with their eyes on them at every moment? Plus any number of election observers, which may be representatives of all parties involved, plus any number of federal or foreign observers.

The ONLY way you can destroy a paper ballot is if there are no observers, and all present voting administrators are corrupt. (And observers are usually deployed to exactly the places where there are suspicions of corruption).

Now let's consider an "e-voting" machine that leaves no verifiable paper trail, shall we? The officials and observers at the polling station have no way of knowing that the vote the machine actually registered was accurate, and neither do you. Nor can they tell if the machine is malfunctioning. All you need is ONE person to tamper with the machine, and do so at ANY time.

If the machine is compromised it can still display "Zero votes registered" when the poll opens. But I'd sure like to see you do the same trick stuffing paper slips in a ballot box and still having it look empty.

To ensure a fair election with paper ballots you need: At least one honest election official. And/or at least one impartial observer. To ensure a fair election with an electronic voting machine you need: All people who've ever had the opportunity to tamper with the machine to be honest. You need the software to be correct and bug-free (yeah, right). You need to be able to verify the correctness of the software.

It's true that it's impossible to guarantee fair elections. All you can do is reduce the risk of cheating, and the possible magnitude of cheating. Electronic voting machines do neither. All they do is cost less money.