Slashdot Mirror
Opening Diebold Source, the Hard Way
Doc Ruby writes to tell us about an article in the Baltimore (MD) Sun, reporting that someone sent a package to a former legislator containing what appears to be Diebold source code. From the article:
"Diebold Election Systems Inc. expressed alarm and state election officials contacted the FBI yesterday after a former legislator received an anonymous package containing what appears to be the computer code that ran Maryland's polls in 2004... The availability of the code — the written instructions that tell the machines what to do — is important because some computer scientists worry that the machines are vulnerable to malicious and virtually undetectable vote-switching software. An examination of the instructions would enable technology experts to identify flaws, but Diebold says the code is proprietary and does not allow public scrutiny of it." Read on for more of Doc Ruby's comments and questions.
Maryland's primary elections last month were ruined by procedural and tech problems. Maryland used Diebold machines, even though its Republican governor "lost faith" in them as early as February this year, with months to do something about it before Maryland relied on them in their elections.
The Diebold code was secret, and was used in 2002 even though illegally uncertified — even by private analysts under nondisclosure. Now that it's being "opened by force," the first concern from Diebold, the government, and the media is that it could be further exploited by crackers. What if the voting software were open from the beginning, so its security relied only on hard secrets (like passwords and keys), not mere obscurity, which can be destroyed by "leaks" like the one reported by the Sun? The system's reliability would be known, and probably more secure after thorough public review. How much damage does secret source code employed in public service have to cause before we require it to be opened before we buy it, before we base our government on it?
Maryland's primary elections last month were ruined by procedural and tech problems. Maryland used Diebold machines, even though its Republican governor "lost faith" in them as early as February this year, with months to do something about it before Maryland relied on them in their elections.
The Diebold code was secret, and was used in 2002 even though illegally uncertified — even by private analysts under nondisclosure. Now that it's being "opened by force," the first concern from Diebold, the government, and the media is that it could be further exploited by crackers. What if the voting software were open from the beginning, so its security relied only on hard secrets (like passwords and keys), not mere obscurity, which can be destroyed by "leaks" like the one reported by the Sun? The system's reliability would be known, and probably more secure after thorough public review. How much damage does secret source code employed in public service have to cause before we require it to be opened before we buy it, before we base our government on it?
I think the closed source parking garage was a perfect example why the government shouldn't let a private company control government assets or processes.
With all the vulnerabilities in voting machines, it amazes me that the states do not mandate paper trails. Someone wouldn't even need access to the source code to start changing votes. For example, in this report from ABC News on October 1st, they discuss a method to almost invisibly manipulate both votes recorded and logs, all with only a couple minutes access to a voting machine.
Here's an excerpt:
In a paper last month, "Security Analysis of the Diebold AccuVote-TS Voting Machine," (available at http://itpolicy.princeton.edu/voting/) Princeton computer professor Edward W. Felten and two graduate students Ariel J. Feldman and J. Alex Halderman discussed a common Diebold machine. They showed that anyone who gets access to the machine and its memory card for literally a minute or two could easily install the group's invisible vote-stealing software on the machine. (Poll workers and others have unsupervised access for much longer periods.) Changing all logs, counters, and associated records to reflect the bogus vote count that it generates, the software installed by the infected memory card (similar to a floppy disk) would be undetectable. In fact, the software would delete itself at the end of Election Day.
Crack - Free with every butt and set of boobs
One would think that the state would require the sourcecode for due diligence...
#1. Flaws in the code that could be exploited by anyone who knew them. The classic "security via obscurity". This is just plain stupid.
#2. Trade Secrets would be revealed. So Diebold has some ingenious work in the system that it does not want revealed.
#3. Stolen code would be revealed. So Diebold illegally incorporated code from someone else in their product and doesn't want anyone to see it.
#4. Legal code re-use. So Diebold uses the same code on their ATM's as their voting machines and they worry that anyone with access to the voting code could POSSIBLY find a flaw in the ATM systems.
Anyone have any other possibilities?
Apart from a layer of security, just how complex does the software have to be?
(Clear all variables)
Enter selections
Hit accept/enter
Accumulate values for all selections
Clear screen
(Repeat)
Export at end of election
Why the hell does something of this level of incomplexity even need to be closed source?
How long before we can download it on Bittorrent?
Besides taking the effort to install invisible vote-stealing software, one can just open the MS Access database and edit the values: http://www.scoop.co.nz/stories/HL0307/S00065.htm#v otes
Or maybe they're worried that the code contains evidence of tampering with election results? Otherwise it's just code. Just because it's public doesn't mean Diebold loses their copyright.
But if that code contains evidence of treason...which is what tampering with election results would be...then anyone involved deserves to be stood up against the nearest wall and shot. Then leave the bodies as a permanent reminder to anyone else thinking about ballot stuffing.
The real question is if the results were rigged, what's that do to the Bush presidency? It would seem to invalidate the '04 election. That means anything he's done while in office should be voided and Kerry should be allowed to serve out the rest of his term. It gets really interesting to consider that the deciding vote on the Supreme Court would be one of those invalidated actions.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
Voting is public. How can a company legally be allowed *not* to disclose the mechanics of a system built to be used in public elections. What .. we should just assume we can trust the democratic system in the hands of big business? Every programmer? Every engineer? They might as well just hire a bunch of staff that go house to house promise to vote for us.
There are lots of things that you should be able to keep secret, but not how my voting system works. We might as well do away with it altogether.
Quack, quack.
It's true that with open source, someone could potentially find a flaw, not tell anybody about it, and then exploit that flaw to manipulate an election. Why would someone do that? Obviously to advance an agenda, either by getting a win for a particular candidate who supports that agenda (so you'd want to manipulate the votes in a sneaky way) or if your agenda is getting rid of these voting machines, producing results that are clearly absurd (landslide victory for the Stallman write in campaign). I think the former is more subversive and likely to have financial support either from the candidates themselves or organizations supporting those candidates. Given this, it is reasonable to assume that if you are going to fix the vote for the win, your opponent will too, which means you need to either escalate the fraud operation, increasing the risk such fraud will be exposed, or you need to prevent your opponent from taking advantage of the flaws by having them patched and using that labor you saved by not escalating to instead get out the vote.
I might also be way off in this analysis, but I think having the code open to public scrutiny and the hardware securely locked down (any potential tampering should be evident) would be the way to go if computers are used at all.
Remember RFC 873!
FUCK A PAPER TRAIL. We need PAPER ELECTIONS. Just that simple. Can paper elections be rigged? Of course they can. Can they be rigged as easily, as invisibly, as completely as digital elections? Hell no. What's mind boggling is that there's even a debate here. Get rid of digital voting machines. Hell, get rid of ANALOG voting machines. Piece of paper, ink pen, padlocked metal box. That's how sane people run elections. The notion of there being anything worth debating here is nothing but complete bullshit.
Who are the people, other than DieBold, that support DieBold's secrecy? Who are the people who would like to preserve things as they are rather than fix the problems that the rest of the interested public is concerned about?
I think that when we can publically identify who these people are, we can either have a proper public debate on the topic or we can put the matter to rest by exposing the corruption that has been going on.
The problem with electronic voting hacks is that a single person can change entire elections, in very little time, without leaving any evidence at all.
With paper ballots, you have to come up with a lot of other ballots if you want to stuff the ballot. That takes time, material, and co-conspirators. If you want to destroy ballots, you have to take them out of the box and get rid of them. You might shred, burn, bury them, or throw them in a river. That takes time, and leaves evidence and possibly witnesses. If you want to destroy enough ballots to change an election, you will probably also need co-conspirators, and will need to avoid witnesses.
So anything you do to change a paper election will take a lot of time, resources, and manpower, where as an electronic theft of an entire election is almost instantaneous, with no witness and no evidence *.
* Aside from exit polling.
Computers are useless. They can only give you answers.
-- Pablo Picasso
You, the voter, need to physically move your verified ticket into a box under the watchful eye of the election judge. This MUST NOT be done by machine, unless the machine also does it in an easily visible fashion under the watchful eye of an election judge - which is simply not what's going on.
I early voted on a Diebold voter verified machine - and it's NOT good enough. I even had a nice conversation with the technical election judge, and since it did print a verified trail I did have to go home and think about this before I realized how it sucked.
They totally and complete circumvented the idea of a voter verified paper trail.
The way this machine works is you vote, it prints, you can see-but-not-touch the printout. You can vote AGAIN (up to 3 times) and it voids the previous printouts. Again, without you touching them. Which means the process expects that some percentage of its paper trail will be voided. The printouts get sent into some magic compartment.
So 1) there's no way except by noise for the election monitors to know if it printed a variety of extra votes. And they were pretty quiet.
2) There's absolutely zero way to know if it went back and voided your vote, because there's plenty of precedent for voiding votes.
3) It can absolutely tell via paper alone who voted in which order; it's on a spool. Which could be easily tracked by anyone who watched what order people voted at that machine. Your votes are even less anonymous.
*sigh*
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot
For a (slight) glimpse at the stakes of a game like this, consider the recent Robin Williams film "Man of the Year". The movie was okay, but the truly frightening thing was how likely a scandal like a rigged election, purposefully or otherwise, might take place. However, before I go into some facts I found through surfing about Diebold and electronic voting, I wanted to point out that even if it was demonstrated beyond a shadow of a doubt that Bush was elected through vote fraud of some kind (not that many of us need any further convincing), it doesn't mean Kerry automatically gets to take the White House and Bush is out. What would most likely happen, along with a series of investigations and lawsuits, is the Supreme Court court would invalidate the election results and declare a new election, at a reasonable time period. Dennis Hastert would assume the throne until the new election results were confirmed but nothing Bush has done would be invalidated, at least, not right away. Even if he was fraudulently elected, he was still the de-facto sitting President and so his actions would be legal (in a manner of speaking). Congress could take some action to reverse some of his doings, but that assumes they want to in the first place. Now, on to Diebold. Found via a Google of "Diebold facts": 1. 80% of all votes in America are counted by only two companies: Diebold and ES&S. http://www.onlinejournal.com/evoting/042804Landes/ 042804landes.html http://en.wikipedia.org/wiki/Diebold 2. There is no federal agency with regulatory authority or oversight of the U.S. voting machine industry. http://www.commondreams.org/views02/0916-04.htm http://www.onlinejournal.com/evoting/042804Landes/ 042804landes.html 3. The vice-president of Diebold and the president of ES&S are brothers. http://www.americanfreepress.net/html/private_comp any.html http://www.onlinejournal.com/evoting/042804Landes/ 042804landes.html 4. The chairman and CEO of Diebold is a major Bush campaign organizer and donor who wrote in 2003 that he was "committed to helping Ohio deliver its electoral votes to the president next year." http://www.cbsnews.com/stories/2004/07/28/sunday/m ain632436.shtml http://www.wishtv.com/Global/story.asp?S=1647886 5. Republican Senator Chuck Hagel used to be chairman of ES&S. He became Senator based on votes counted by ES&S machines. http://www.motherjones.com/commentary/columns/2004 /03/03_200.html
http://www.onlinejournal.com/evoting/031004Fitraki s/031004fitrakis.html
6. Republican Senator Chuck Hagel, long-connected with the Bush family, was recently caught lying about his ownership of ES&S by the Senate Ethics Committee.
http://www.blackboxvoting.com/modules.php?name=New s&file=article&sid=26
http://www.hillnews.com/news/012903/hagel.aspx
http://www.onlisareinsradar.com/archives/000896.ph p
7. Senator Chuck Hagel was on a short list of George W. Bush's vice-presidential candid
It's funny my parent post got a score of 0. I was speaking in reference to a lecture I heard from a lady from Renton, WA, who stepped upon an FTP site with the Diebold software. There was a directory called "Rob-Georgia", I might add. In this was 3+ Gigabytes of files from Diebold. This stuff was uploaded and when she tried to get people to pay attention, no one bothered to (like the moderator who decided not to score the parent post).
To make a long story short, she uploaded the files to an area where technologically savvy people frequent, and said, "Hey guys, take a look at this." The only people that replied were the people willing to take a stand, i.e. the programmers at Princeton.
So, for an "unimportant post", I divulged information that actually happened. You see, after government officials became aware of flaws in the software, they still kept the Diebold machines in their budgets (hundred of millions of dollars in sum, mind you). Huge amounts of money is being spent on machines that have software programmed by douchebags up in Canada. These machines can be telephoned into to be monitored (good ole' Windows RAS). Oh, and the whistle blower lady was harrassed, her house being broken into subsequently and her being monitored by a government agency, which she has had to talk with regularly.
Yep, you trust your election security to software programmed by dumbasses using Microsoft Access as a database. You trust your election security to individuals that are allowed to bring the Diebold machines home with them after elections are conducted. You trust people to count elections who are ex-convicts hired out by contracting firms.
Why? Um, well, because, um, I think they can be trusted? Oh, that sounds sooooo comforting.
Let's ignore the whole issue about suffrage that was fought so hard for.
My only logical conclusion if people can possibly ignore what I just wrote is that they are idiots. I just hope slashdot readers are a set above the curve.
The roll printer idea, where the people see their votes printed, but don't actually get to touch the printout is fine. This should be done regardless, but i'm going to go a few steps beyond that.
Basically for some of the rest of the design, if your going to make it electronic, first look at all the ways the xbox security system, for instance could have been made much harder to hack. [I wouldn't necessarily limit it with that, but that is actually a decent start.] For simplicity I'll list some ideas, off the top of my head, and then justify them.
1) Soldered in main cpu (The cpu will be important, and as such must not be something that can be easily changed.)
2) Security seals on the case that show signs of tampering.
3) Ideally the GPU will be inside the cpu. [This prevents what is display from being easily tampered with, although the need for this can be argued, but what you see on the screen, is, of course, what you hoep you are voting for.]
4) The system on boot will be able to read from only one source for its OS. The CPU will read the OS and compute a crytographic hash on the entire system. The ROM image (or whatever) will also have a separate field which contains a public key encrypted version of that same hash. The cpu will decrypt that hash with its public key and if the two match, the system will finish booting.
5) Obviously the private key originally used to encrypt that hash must be
stored in a very safe place. [The cpu never needs to know that key, and as such, there is no way that possesion of one of the devices can alloy you to create an arbitrary rom image that check out.]
6) The bottom part of the screen should, at minimum show the cryptographic hash of the software, at all times, so that independent people can verify things.
7) Optional: Take the original hash and use say the last so many bits from it to randomly select from a stack of pictures, or perhaps several pictures. The key part here is to create a visual representation of what the cryptographic hash is, at least in part. You can show this to the voter as a series of icons on the bottom of the screen say to the right of that hash, as an additional check on security. If all of the code that does this is in hardware, this provides an additional check to verify the software has not been modified that people might remember. Of course there are lots of variations of this, including just say making the last 4 digits of the hash bold, or whatever.
8) Keep the code open source. There is no particular reason this is 8, it could as easily be (1). If the cpu is a custom chip, it might require releasing an open source emulator so people can test it. Of course, most likely you are going to use some common cpu core, even if you say put the cpu/gpu on the same chip. Just to reinterate, the key with some of this to be on the same silicon is to prevent tampering. If say the chip that verified the hash was elsewhere, then you might be able to just send a "it passes" signal for everything. Similarly if the code that computes the hash or the encryption is elsewhere, you also have a vulnerability. By having everything security related on the same silicon, you can be reasonably assured that when it checks out the election software that it truly is secure.
9) You can argue with the need to be able to update these fast, and if you agree with that, then you might have to boot from a second source, in order to update the flash, or whatever storage the device uses. All in all though, i don't buy that argument. if you say put it on a flash device that is behind a seal, then you can as easily physically change the flash module. Of course, if you are going to allow a second booting source to reprogram the device, it had better pass its own cryptographic checks to insure it comes from a trusted source.
10) Don't forget the paper trail. While, I've tried to make the previous ideas sound, I likely missed things. This is, after all, a relatively quick post, and I'm only one pe
So the deal is, concerned citizens now have to come and babysit elections. We train on all the fine points of who can access the machines and are basically there to watch the Diebold personnel to ensure they don't "patch" the machines at the last minute. It's fucking insane. As you can probably tell, I'm highly suspect of America's status as a democracy anymore, but I'm doing my best to help us recover. I'll give it a few more years, but the state of affairs is pathetic. We seem set to turn our elections over to the corporations that are running our country (and, as a consequence, our foreign and domestic policy). If Americans don't start giving a shit, this country is over.
I agree with paper elections. I also think that digital machines can have a place in elections. You make your choices on a computer, the computer prints out the ballot. The ballot is plain english and human readable. Nothing computer readable, not even a barcode.
Actually India has a pretty good e-voting system:
Slate magazine pokes fun at America's continuing electronic voting anxiety by using India as an example of how to do things right:
While we in the United States agonize over touch screens and paper trails, India managed to quietly hold an all-electronic vote. In May, 380 million Indians cast their votes on more than 1 million machines. It was the world's largest experiment in electronic voting to date and, while far from perfect, is widely considered a success. How can an impoverished nation like India, where cows roam the streets of the capital and most people's idea of high-tech is a flush toilet, succeed where we have not?
Apparently India uses an incredibly simple technology that may not be as fancy as the machines here, but does the job well.
The result is a machine that looks like a cross between a computer keyboard and a Casio music synthesizer. In fact, it's not much of a computer at all, more like a souped-up adding machine. A column of buttons runs down one side. Next to each button is the name and symbol of a candidate or party. These are written on slips of paper that can be rearranged. That means unscrupulous politicians couldn't rig the machines at the factory, since they wouldn't know which button would be assigned to which candidate. Also, the software is embedded--or hard-wired--onto a microprocessor that cannot be reprogrammed. If someone tries to pry open the machine, it automatically shuts down. After much testing, India adopted the machines for nationwide use this year.
Why do our machines suck?
American machines, by contrast, may be vulnerable to wholesale fraud. Our machines are far more complicated and expensive--$3,000 versus $200 for an Indian machine. The U.S. voting machines are loaded with Windows operating systems, encryption, touch screens, backup servers, voice-guidance systems, modems, PCMCIA storage cards, etc. They have millions of lines of code; the Indian machines hardly any at all.
FalconShould there be a Law?