Slashdot Mirror
Brave New Ballot
Ben Rothke writes "In an important new book Brave New Ballot: The Battle to Safeguard Democracy in the Age of Electronic Voting, Avi Rubin writes 'too often in American life, when it comes to divisive issues, the facts can be less important than the weight of public opinion'. That basically sums up Rubin's story in this fascinating story of his frustrations in dealing with government and corporate officials in his quest to show that e-voting was not as secure as it was originally made out to be." Read the rest of Ben's review.
Brave New Ballot: The Battle to Safeguard Democracy in the Age of Electronic Voting
author
Aviel Rubin
pages
272
publisher
Morgan Road Books
rating
10
reviewer
Ben Rothke
ISBN
0767922107
summary
Electronic voting systems are being deployed with inadequate levels of trust and security
Brave New Ballot (BNB) is Rubin's story of how in 2003, he and his graduate students at Johns Hopkins University demonstrated that the Diebold Election Systems electronic voting technology in wide use was full of security problems. It was just in 2002 that Sherron Watkins of Enron was named Time magazine person of the year for her work in uncovering fraud at Enron. It would have been thought that Rubin's work would have immediately won him some sort of patriot of the year award for his work.
While the accolades were indeed many, his team's research was maligned as being that of a homework assignment, and the Administrator for Elections for the state of Maryland (where Rubin lives and works) publicly stated that 'computer scientists (a direct reference to Rubin and his team) who question the security of electronic voting machines are undermining our democracy.' Such a scenario makes up much of the story that the book tells in Rubin's team's efforts to blow the whistle on unsecure e-voting machines.
As to the Administrator for Elections for the state of Maryland and her disdain for computer scientists, she would likely find constituents such as the zombie-like Stepford wives more to her liking. Unfortunately, she ended up with Professor Rubin.
It is not that secure electronic voting is inherently unattainable. Rather, nearly all of the commercial solutions that have shipped to date have not been adequate designed with security in mind. This is due to many factors, some of which are that the makers of these devices do not completely understand the security risks and countermeasures, in addition to public officials who are far too trusting of these commercial e-voting vendors.
The early chapters of the book detail how Rubin's team analyzed the security and cryptography used within extremely sloppy coding of the Diebold Accuvote-TS director recording electronic device. One particularly humorous incident is when the Diebold programmers reference Bruce Schneier's Applied Cryptography in their C++ code for their decision of which algorithm to use of a for pseudorandom number generation. The only problem is that Applied Cryptography states that the specific algorithm they used should specifically not be utilized for random number generation. Rubin comically states about that incident that Diebold should have consulted with Schneier, rather than have their staff misunderstand what they read in his book.
I had a similar frustrating incident when consulting on an e-voting systems some years ago. The lead developer (who obviously was no expert in cryptography) documented that the e-voting system used 120-bit encryption. Upon analysis, we found that the system was using 40-bit encryption. When countered about that, the developer replied that they perform the 40-bit encryption routine three times using the same key, for an effective 120-bit key length. Of course, 40-bit encryption will always be (insecure) 40-bit encryption, no matter how many iterations he put it through; but it is frightening that he did not know that.
After his team presented their report in 2003, Rubin writes in detail how Diebold started a smear campaign against him. Not only was it Diebold, but also election officials in municipalities that had deployed the Accuvote-TS system that also maligned Rubin. This was done primarily by misinterpreting his objections, and also by refusing to pay attention to other independent reports on the insecurity of the devices.
For a more timely and somewhat humorous account of how insecure Diebold really is, see 'Hotel Minibar Key Opens Diebold Voting Machines'.
Being a whistle-blower always takes a toll on a person and Rubin was no different. He work on e-voting consumed him and took a toll on his family, career and his students. The book chronicles how Rubin found himself caught in a crossfire between big business, partisan politics, and overworked election officials. Rubin also found himself between the crosshairs of the ITAA (Information Technology Association of America), powerful vendor-based lobbying group. The ITAA, of which Diebold was a client, attempted to discredit him on many occasions, but their evidence was always weak and reckless, and in the end only served to bolster Rubin's claims against the Diebold systems.
Part of the absurd claims of the ITAA was that the open-source movement is using the issue of e-voting security to wage a 'religious war' that pits open-source software against proprietary software. Rubin could have filed chapters with similar ITAA absurdities, but wisely chose not to.
Similarly, an article I wrote 'E-Voting: It's Security, Stupid' also was the recipient of the wrathful ITAA reply. In their so-called rebuttal mistakenly titled 'E-Voting Does Work', Harris Miller of the ITAA follows his modus operandi of first attacking the person, avoiding the issue, stating vague meaningless comments, and concluding the issue by missing the point.
99% of the voting public does not know about backdoors, insecure code, Trojan Horses, insider threats, and scores of other security issues that the e-voting vendors have yet failed to fully address. The election process as we know it is rapidly being migrated to these electronic voting machines that are replacing the older, but more reliable mechanical systems.
BNB is a timely and important book as it details the very real defects on which these e-voting systems are built on (and Windows is only one of them). The ITAA made claims such that the only vulnerability within e-voting is that of a rogue programmer conspiring to steal public office. Such politicking only serves to confuse the issue for a public that is inherently trustful of these voting machines. Yet if these e-voting machines were built to the same stringencies and regulations that the aviation and pharmaceutical industry faces, they would never make it within a mile of a voting booth.
Brave New Ballot is to e-voting what Rachel Carson's Silent Spring is to the global environmental movement. It is a vitally important book that details the problem of e-voting and what can be done in the future to make certain that it can one day be carried out in a secure manner.
Of course, the image of an embedded crypto key or plaintext password in an e-voting system does not convey the same impact on the public as that of a thalidomide baby. Pictures of thalidomide babies caused heads to roll at the FDA, and one should hope the that the publication of Brave New Ballot will awaken the public from their slumber on the topic of electronic voting, and encourage the Election Assistance Commission to immediately ban electronic voting until it can be secured.
Deforest Soaries, the first Chairman of the United States Election Assistance Commission sums it up best when he states 'If the integrity of our sacred right of voting is less important than partisan politics, corporate interests, or bureaucratic systems, then shame on us for presenting ourselves as the global standard bearers of democracy. As Brave New Ballot shows, there is a lot of shame going around.
You can purchase Brave New Ballot: The Battle to Safeguard Democracy in the Age of Electronic Voting from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Brave New Ballot (BNB) is Rubin's story of how in 2003, he and his graduate students at Johns Hopkins University demonstrated that the Diebold Election Systems electronic voting technology in wide use was full of security problems. It was just in 2002 that Sherron Watkins of Enron was named Time magazine person of the year for her work in uncovering fraud at Enron. It would have been thought that Rubin's work would have immediately won him some sort of patriot of the year award for his work.
While the accolades were indeed many, his team's research was maligned as being that of a homework assignment, and the Administrator for Elections for the state of Maryland (where Rubin lives and works) publicly stated that 'computer scientists (a direct reference to Rubin and his team) who question the security of electronic voting machines are undermining our democracy.' Such a scenario makes up much of the story that the book tells in Rubin's team's efforts to blow the whistle on unsecure e-voting machines.
As to the Administrator for Elections for the state of Maryland and her disdain for computer scientists, she would likely find constituents such as the zombie-like Stepford wives more to her liking. Unfortunately, she ended up with Professor Rubin.
It is not that secure electronic voting is inherently unattainable. Rather, nearly all of the commercial solutions that have shipped to date have not been adequate designed with security in mind. This is due to many factors, some of which are that the makers of these devices do not completely understand the security risks and countermeasures, in addition to public officials who are far too trusting of these commercial e-voting vendors.
The early chapters of the book detail how Rubin's team analyzed the security and cryptography used within extremely sloppy coding of the Diebold Accuvote-TS director recording electronic device. One particularly humorous incident is when the Diebold programmers reference Bruce Schneier's Applied Cryptography in their C++ code for their decision of which algorithm to use of a for pseudorandom number generation. The only problem is that Applied Cryptography states that the specific algorithm they used should specifically not be utilized for random number generation. Rubin comically states about that incident that Diebold should have consulted with Schneier, rather than have their staff misunderstand what they read in his book.
I had a similar frustrating incident when consulting on an e-voting systems some years ago. The lead developer (who obviously was no expert in cryptography) documented that the e-voting system used 120-bit encryption. Upon analysis, we found that the system was using 40-bit encryption. When countered about that, the developer replied that they perform the 40-bit encryption routine three times using the same key, for an effective 120-bit key length. Of course, 40-bit encryption will always be (insecure) 40-bit encryption, no matter how many iterations he put it through; but it is frightening that he did not know that.
After his team presented their report in 2003, Rubin writes in detail how Diebold started a smear campaign against him. Not only was it Diebold, but also election officials in municipalities that had deployed the Accuvote-TS system that also maligned Rubin. This was done primarily by misinterpreting his objections, and also by refusing to pay attention to other independent reports on the insecurity of the devices.
For a more timely and somewhat humorous account of how insecure Diebold really is, see 'Hotel Minibar Key Opens Diebold Voting Machines'.
Being a whistle-blower always takes a toll on a person and Rubin was no different. He work on e-voting consumed him and took a toll on his family, career and his students. The book chronicles how Rubin found himself caught in a crossfire between big business, partisan politics, and overworked election officials. Rubin also found himself between the crosshairs of the ITAA (Information Technology Association of America), powerful vendor-based lobbying group. The ITAA, of which Diebold was a client, attempted to discredit him on many occasions, but their evidence was always weak and reckless, and in the end only served to bolster Rubin's claims against the Diebold systems.
Part of the absurd claims of the ITAA was that the open-source movement is using the issue of e-voting security to wage a 'religious war' that pits open-source software against proprietary software. Rubin could have filed chapters with similar ITAA absurdities, but wisely chose not to.
Similarly, an article I wrote 'E-Voting: It's Security, Stupid' also was the recipient of the wrathful ITAA reply. In their so-called rebuttal mistakenly titled 'E-Voting Does Work', Harris Miller of the ITAA follows his modus operandi of first attacking the person, avoiding the issue, stating vague meaningless comments, and concluding the issue by missing the point.
99% of the voting public does not know about backdoors, insecure code, Trojan Horses, insider threats, and scores of other security issues that the e-voting vendors have yet failed to fully address. The election process as we know it is rapidly being migrated to these electronic voting machines that are replacing the older, but more reliable mechanical systems.
BNB is a timely and important book as it details the very real defects on which these e-voting systems are built on (and Windows is only one of them). The ITAA made claims such that the only vulnerability within e-voting is that of a rogue programmer conspiring to steal public office. Such politicking only serves to confuse the issue for a public that is inherently trustful of these voting machines. Yet if these e-voting machines were built to the same stringencies and regulations that the aviation and pharmaceutical industry faces, they would never make it within a mile of a voting booth.
Brave New Ballot is to e-voting what Rachel Carson's Silent Spring is to the global environmental movement. It is a vitally important book that details the problem of e-voting and what can be done in the future to make certain that it can one day be carried out in a secure manner.
Of course, the image of an embedded crypto key or plaintext password in an e-voting system does not convey the same impact on the public as that of a thalidomide baby. Pictures of thalidomide babies caused heads to roll at the FDA, and one should hope the that the publication of Brave New Ballot will awaken the public from their slumber on the topic of electronic voting, and encourage the Election Assistance Commission to immediately ban electronic voting until it can be secured.
Deforest Soaries, the first Chairman of the United States Election Assistance Commission sums it up best when he states 'If the integrity of our sacred right of voting is less important than partisan politics, corporate interests, or bureaucratic systems, then shame on us for presenting ourselves as the global standard bearers of democracy. As Brave New Ballot shows, there is a lot of shame going around.
You can purchase Brave New Ballot: The Battle to Safeguard Democracy in the Age of Electronic Voting from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Of course, I wouldn't be satisfied by anything but publishing the voters' choices. Not by name -- give them an anonymous unique voter ID so that they look at the database, they can say "ah, they got mine right".
Not good enough: They might give all the people expected to vote for the Democratic candidate the same voter ID. If any of those people end up voting republican, the only visible discrepancy would be that some Republican votes were counted as Democratic -- which obviously wouldn't be considered cause for a recount if the Republican candidate won!
What you need is to give each voter an secret unique ID, and have them record a nonce (i.e., random number) on their ballot in addition to their vote. Then publish the (ID, nonce, vote) tuples; if two voters were assigned the same ID, it will be obvious when they pick different random nonces.
Tarsnap: Online backups for the truly paranoid
Election officials and those they work for don't want the voting machines to be secure, nor do they want them to generate an audit trail. They want to be able to silently steal elections. They want to become the New Ruling Class.
Real democracy brings instability to the government. It's the very nature of democracy. These people don't want instability -- they want stability, which means they want to be in charge and to remain in charge. They don't want to serve the people. They want to serve themselves.
I think it's likely they'll get what they wish. They have too much money, power, and control to be ousted now. That includes control over most of the "information" sources that people use to make their decisions, primarily the mass media. And they're willing to go to any lengths at all to maintain their control. I mean any lengths.
In the struggle for freedom and self-determination, we have lost. Time to enjoy what little we have left for however long we have it.
Use 'slashdot stuff' in the subject line in any email you send me if you want to get past the spam filter.
So what? You can distribute the storage just as you can distribute human-handled vote-counting. In fact, counting vote is one of those few extremely parallelizable, highly scalable operations. That's why democracy and paper ballots work in a country like India, with 1 billion citizens and more potential voters than the total US population.
Storing a hundred pallets of ballots is a fair bit (it's not even a lot). Storing two or 3 pallets per state is small, storing a few boxes of ballots per county is nothing and utterly trivial.
Computerizing votes is one of the few things that can at best be considered stupid, because it's safer, easier and inherently more secure to just use hand-counted ballots.
"The way we can tell it's C# instead of Haskell is because it's nine lines instead of two." -- wadler
Someone in this thread is going to state that electronic voting is just splendid, and we can make it work, if we just try harder next time. Fine. Show me.
You're on. Where voter-verified paper audit trails (VVPAT) exist and enough are randomly sampled and recounted to detect fraud, it can be a success. Show me otherwise.
Unfortunately, the VVPAT is a placebo. What guarantees what's recorded is what's printed? Nothing. And experiences to date demonstrate that actually auditing the VVPAT is infeasible (1h 15m per ballot cast).
I call horse-hocky. Doing a FULL recount of an electronic ballot box using a VVPAT should take about as much time as counting paper ballots - not long at all. A partial recount should be shorter or the same. This ASSUMES the VVPAT trail is DESIGNED to be quickly counted. The lack of a design to date does not mean such a machine isn't feasable or economical. However, the lack of such a machine today is NOT grounds to say that actually auditing the VVPAT is infeasable - because it is very feasable given the right equipment. See this post and the linked journal entry for some ideas I think will work.
I don't think I mentioned it in the link, but a simplified way of using a VVPAT is to use the electronic count as a preliminary unofficial number only, and use the VVPAT as the official ballot of record. Everybody wins. The media get their results almost instantly, the official returns come in a few hours later, the voters know their vote got counted correctly, and the media get to have a field day with any discrepancies. Hooray all around.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I recently had a discussion with a friend about this whole Diebold mess, and how the public just has no clue about the vulnerabilities. I'm beginning to feel that an election version of "9/11" is the only way to do it. Have a bunch of operatives volunteer to work an election in some district and then, on election day, have the machines report twice as many votes as there are registered voters... and have them all be for the Green party or something. Until then, the sheeple will think that it's all ivory-tower theoretical stuff. They need to be shown that a real election can really be stolen.
Of course, this will mean jail time for the perps, but I have two things to say about that. 1) Some would consider that a small price to pay for preserving democracy. 2) You might be able to get a light sentence if you mailed, before the election, some letters (saying "Do not open until after the election" on them) to several news agencies declaring that you are going to rig the election in order to expose the dangers to our democracy.
The people in government are choosing the machines based on their hackabality.
When the CEO of Dibold tells GWB that he can deliver OHIO, he gets it done.
Why does everyone always pussyfoot around this?
It's going to keep up until some college kids sneak a camera into an active voting booth and film the swap as it's being done by dedicated republicans.
At that point, it will turn out to be a single, horrible terrorist loving republican, no others would do that (Even though the descrepancies showed up across the nation in the last election)
So, this poor kid will be prosecuted as will this One Evil Republican (Much the way only enlisted people were prosecuted in the torture scandle) and it will all go away.
America has been taken over by fundamentalist extremists.
Learn to live with it or do something about it (and voting is NOT doing something).
----
Hell Yeah I'm posting this anynomously!
>"...undermine democracy"
Sometimes I feel like I'm in one of those Star Trek episodes where nothing makes sense and it turns out to be psychological testing by aliens.
According to my government officials,
- a decorated Marine colonel is a "coward'
- ayone who agrees with the Army War College about Iraq is an appeaser
- people who uphold oaths to defend the Constitution "only aid the terrorists"
- and people who work for honest elections "undermine democracy".
Check out Students for Orwell.
Actually, if the solution is designed correctly, the voter should be able to leave the location assured that their vote has been registered correctly. Preferably, they'll get a receit with an id on it that they can enter on a website to make sure their vote made it all the way through and was correctly tallied.
Since the unique ID does not need to be traceable, it would not mean a loss of privacy. But it WOULD mean that the voters for the first time in history had the power to discover fraud.
Stop the brainwash