Slashdot Mirror
Diebold Disks May Have Been For Testers
opencity writes "The Washington Post reports on the two Diebold source disks that were anonymously sent to a Maryland election official this past week. Further investigation has lead individuals involved to believe the disks came from a security check demanded by the Maryland legislature sometime in 2003." From the article: "Critics of electronic voting said the most recent incident in Maryland casts doubt on Lamone's claim that Maryland has the nation's most secure voting system. "There now may be numerous copies of the Diebold software floating around in unauthorized hands," said Linda Schade, co-founder of TrueVoteMD, which has pressed for a system that provides a verifiable paper record of each vote."
Can't play on ranked servers without a cd key and the gameplay itself is more boring than WoW. I'll stick with BF2.
If the attackers can use the source code to attack the machines then the machines aren't secure and probably wouldn't withstand an attack from someone who had access to the machine even without source code.
Having numerous copies floating around is a good thing if disclosure of security holes is encouraged, and the fact that Diabold are implying that the security of their systems rely on people not having access to the source code is a very bad thing.
Lets look at things logically. The only people who would rig the election using those machines would have to have physical access to the machines, and if they did they wouldn't need the source code to highlight security holes. If the source code was released then the people who would be advantaged would be the people who would responsibly disclose security holes.
If the software was well designed, this wouldn't matter at all. I mean it should be clean and simple, and secure. All incoming data should be validated, all data should be stored, and a mile wide system audit trail should be created at the same time. Then, spit out the paper version with a transaction # so you can run it right back against the system.
Instead, I bet it's a pile of shit. Recycled code, buffer vulnerabilities, piles of ad hoc crap, with poor documentation.
I hope someone does find a way to exploit the code. People need to wake the hell up.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
Face it, it would probably be a more secure voting system if they voted by email. They could even make it into a computer game to encourage more young people to vote!
Although, if they did vote by email, imagine the junkmail vote....
You gotta wonder about any politician that wants no paper trail of his own votes. Why is he not interested in having hardcopy proof that he really did win this or that election? (or she, or she, I hope to the gods that Americans aren't backward enough to have only male options in parliament).
Forgive if if I misunderstood, but shouldn't Linda Schade be happy that there's copies of the software available for public scrutiny instead of complaining about it? If she's really concerned with the security of electronic voting, surely she would be in favour of the software being verifiable?
If I didn't misunderstand, someone in D.C. should give this lady a call and explain to her the pitfalls of "security through obscurity" and why openness is a Good Thing.
Diebold whines about how the source code to their voting software is secret and copyrighted and blah blah... but you know what? Accurate democratic elections easily outweigh the need of any company providing voting software to keep their software secret. The government ought to be hiring a software company on contract to provide the service of writing voting software, not buying a product from them.
This is assuming, of course, that there's any overall benefit to digital voting in the first place, which there really isn't. Digital elections are a terrible idea -- stick with paper. Oh no! We'll have to wait a few more hours to have complete results! Big fucking deal.
"Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
I was one of the RABA testers. We discussed this today and we returned the disks to the testers. The leaks came from Linda Lamone's OWN OFFICE!
Just before the 2002 election, a secret "patch" was distributed by order of the president of Diebold without the knowledge of election officials, according to several whistleblowers. You know, the guy who promised to "deliver [Ohio's] votes to the President".
Who gives a fuck if J0e Hax0r can compromise a voting machine when secret code can be installed on thousands, if not all, of the voting machines at the last minute with absolutely no oversight and nobody knowing about it? Voting, to borrow from one of the current "President's" minions, is a "quaint" and outdated practice.
Considering that paper ballots have been used for TWO CENTURIES. Jesus Christ. Just make a machine that scans the barcode on a piece of paper, punches holes in it, and copies the data so no duplicate votes can be made or votes be changed since there will be a paper back up to turn in that will back up the electronic vote, and the voter gets a carbon copy of the paper. Wow. How hard was that to think up? Now, can I have all of the money that Diebold has been getting?!
Never monkey with another monkey's monkey.
Perhaps she's concerned about the give_election_to_highest_bidder() function being discovered..
What is funny is that no one has commented on the real story here - Diebold sent a copy of the source code for a security audit, as requested. Maryland's security team then leaked the code to external people and used the incident to claim that Diebold's security is awful...
The real lesson here is the lengths some politicians will go to so that they appear "right".
(OK, and Diebold also has security issues - but that is a side issue, everyone has security issues. These are the guys making ATMs, for goodness sake. A voting machine that is as secure as an ATM is probably good enough. You can't stop human fraud via a machine - humans win every time.)
while (sig==sig) sig=!sig;
In other news, slashdot search queries for "wretchedhiveofscumandvillainy" increases dramatically.
I hope to the gods that Americans aren't backward enough to have only male options in parliament
Actually, our options for Parliament are even more limited than that...
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
You, the voter, need to physically move your verified ticket into a box under the watchful eye of the election judge. This MUST NOT be done by machine, unless the machine also does it in an easily visible fashion under the watchful eye of an election judge - which is simply not what's going on.
I early voted on a Diebold voter verified machine - and it's NOT good enough. I even had a nice conversation with the technical election judge, and since it did print a verified trail I did have to go home and think about this before I realized how it sucked.
They totally and complete circumvented the idea of a voter verified paper trail.
The way this machine works is you vote, it prints, you can see-but-not-touch the printout. You can vote AGAIN (up to 3 times) and it voids the previous printouts. Again, without you touching them. Which means the process expects that some percentage of its paper trail will be voided. The printouts get sent into some magic compartment.
So 1) there's no way except by noise for the election monitors to know if it printed a variety of extra votes. And they were pretty quiet.
2) There's absolutely zero way to know if it went back and voided your vote, because there's plenty of precedent for voiding votes.
3) It can absolutely tell via paper alone who voted in which order; it's on a spool. Which could be easily tracked by anyone who watched what order people voted at that machine. Your votes are even less anonymous.
*sigh*
(Ok, so I posted this on the previous Diebold story - sue me. It's important, so I reposted it, Karma be damned.)
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot
"A voting machine that is as secure as an ATM is probably good enough."
Wasn't it just a few weeks ago people were finding the passwords for ATMs 'hidden' right there on the net with instructions on how to reprogram them from the front pannel so that it thought the 20s slot was actually dispensing $5s???
If this is the security we can expect...well, I just hope my side finds the password list before the other side. Those bastards are slimy cut and run warmongers who want to stay the course of flipflopping.
"These are the guys making ATMs, for goodness sake. A voting machine that is as secure as an ATM is probably good enough."
If the system were as secure as an ATM network I would have to agree. An ATM gives you a bit of paper to prove the transaction took place and are fully auditable by the bank, the voting machines in question do not give a receipt and do not leave an audit trail. The fact that diebold also makes ATM's indicates nothing less than malice in the design of such a piss poor security scheme for their voting machines.
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
I'd argue that the source code for voting machine should be made public in any circumstance. There is *no* reason to keep any part of the counting process secret. If there are exploitable holes in this process, that means the *process* is at fault, and should be redone until there are no holes.
Who cares? The actual way tags ended up being used is a lot more in the Slashdot spirit. I, for one, like having one-word snarky commentary right below every story.
Never attribute to malice that which is adequately explained by stupidity.
While tagging in general is an interesting idea, you have to understand that the combination of semi-anonymous tagging + your average internet idiot will completely ruin any hopes for a tagging system that does what you specify.
Instead, the editors who post the story should be tagging it appropriately. As well as that, there should be a common set of tags that can be voted on for each story ( dupe, inaccurate, comfirmed, ect.. ), with the voting be weighed by user.
And even that is subject to errors, but it'd be more accurate.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
>A voting machine that is as secure as an ATM is probably good enough.
That's not what we're getting, as the research and disclosures have made painfully clear.
In any case, Diebold has had some trouble with ATMs, including the ATM reprogrammed as a jukebox and the ATMs infected by a virus.
Voting machines are a harder and more safety-critical application than ATMs. Voting machines have to preseve anonymity. Imagine how that would complicate banking. Then, the worst case failure of an ATM is that some money changes hands inappropriately and laywers earn lots of money sorting it out. The worst case failure of a voting system is an election lost to fraud, meaning the victors are the crooks. The damage is potentially incalculable: think of the nations ruined by having the wrong leaders.
Except that, because me and others find this amusing, "wretchedhiveofscumandvillany" will be able to be used to search for articles concerning government corruption (among, I imagine, other things). As for your argument about it gummming up the works, that would be true if each article had a limited number of tags that it could have. But it doesn't. So if you have a tag you like better, stick it on. Don't you just love how the tagging system really works?
Oh, and I wasted my mod points so I could tell you how people with senses of humour work.
Tluin natha Linux xxizzuss uriu olt bwael mon'tun.
Proper tags for this article may include "Diebold" "voting machines" "Maryland"
Surely you can think of some more useful tags like "electoral fraud", "corruption," "cronyism" ...
Better to be despised for too anxious apprehensions, than ruined by too confident a security. --Edmund Burke
The fact that diebold also makes ATM's indicates nothing less than malice in the design ...
Diebold BOUGHT the voting machine deisgn (by buying the company that made it). It is unrelated to their ATM designs.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way