Slashdot Mirror

← Back to Stories (view on slashdot.org)

U.S. To Certify Labs For Testing E-Voting Machines

Posted by Zonk on from the who-certifies-the-certifiers dept.

InternetVoting writes "In a clear counter to the recent criticisms of secrecy involving Ciber labs the National Institute of Standards and Technology (NIST) has issued recommendations (pdf) to the Election Assistance Commission (EAC). NIST recommends the accreditation of two labs, iBeta Quality Assurance and SysTest Labs. The recommendation, emphasizing the need for transparency, includes on-site assessment reports, lab responses, and on-site reviews for each lab. These reports shed much needed light into the process of voting machine certification. Learn more from the Q&As About NIST Evaluation of Laboratories that Test Voting Systems."

75 comments

  1. Opaque Audits by P(0)(!P(k)+P(k+1)) · · Score: 5, Insightful

    It sounded, prima facie, like progress was being made; but quoth TFA:

    Currently, laboratories are using proprietary test methods and test cases to determine that a voting system meets existing federal standards. . . . By law, NIST must protect proprietary information. This includes details of a laboratory's specific testing methods and protocols.

    Call me cynical, but auditing opaque processes with equally opaque tests doesn't change much; I foresee a holographic sticker labelled “certified.”

    I'd wager, furthermore, they expect us to buy it at face value.

    1. Re:Opaque Audits by Rob+T+Firefly · · Score: 4, Insightful
      They do have a halfway decent excuse for that, though.
      Why are laboratories using proprietary test methods?
      Currently, no uniform set of tests exists to determine that a voting system meets federal standards. With the support of the EAC, in 2007 NIST will begin to develop a uniform set of non-proprietary tests to be used in conjunction with the next version of the Voluntary Voting System Guidelines (VVSG 2007). The availability and use of these open tests will improve consistency and comparability among testing laboratories.
      Even a baby step in the right direction counts at this point.
      --
      Slashdot Burying Stories About Slashdot Media Owned
    2. Re:Opaque Audits by truthsearch · · Score: 2, Insightful

      So, does that mean once these non-proprietary tests are created the process will be made more open? I agree, any step in the right direction is something good. I just hope that in the end we have real transparency.

      --
      Developers: We can use your help.
    3. Re:Opaque Audits by P(0)(!P(k)+P(k+1)) · · Score: 5, Insightful

      Even a baby step in the right direction counts at this point.

      I think you're being too soft on your own government. Government isn't a child in need of coddling: it's a cynical and self-aware machine that studies to persist at your expense.

    4. Re:Opaque Audits by Billosaur · · Score: 4, Insightful

      When you think about it, the lack of standards is probably what has caused the current crop of voting machines to be such dismal failures. While I'm not sure I trust Diebold anyway, given their political connections, they probably would have done at least a halfway decent job on their machines if there were a set of standards to measure them against. It's not enough for the US Government to send out a Request For Proposals outlining what they are looking for, unless the functionality and security can be defined against some kind of standard. If the standards had existed first, maybe the machines would not have all the loopholes and omissions which make them such trash currently.

      --
      GetOuttaMySpace - The Anti-Social Network
    5. Re:Opaque Audits by pilgrim23 · · Score: 5, Funny

      Wait, I thought the Dems won. Doesn't that mean there was no cheating?

      --
      - Minutus cantorum, minutus balorum, minutus carborata descendum pantorum.
    6. Re:Opaque Audits by truthsearch · · Score: 5, Insightful

      And if standards exist, maybe more companies can compete equally for the contracts.

      --
      Developers: We can use your help.
    7. Re:Opaque Audits by Alien+Being · · Score: 2, Insightful

      No, it just means the Reps didn't cheat hard enough.

    8. Re:Opaque Audits by gravesb · · Score: 1

      It may still be a step in the right direction, but I would rather have the source code. Really, aren't we as both citizens and voters buying the machines? Shouldn't we have access to them? If a company doesn't want to open the source code, then they shouldn't bid. And arguing that the methods might be copied is easy to overcome. Governments are really the only ones buying these machines, so let them sign a long term contract, and the company gets the same business regardless. And if the contract was long enough, technology would render obsolete anything they develop anyway.

      --
      http://bgcommonsense.blogspot.com
    9. Re:Opaque Audits by Yvanhoe · · Score: 1

      It looks more like a moonwalk in the wrong direction...

      --
      The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
    10. Re:Opaque Audits by divisionbyzero · · Score: 1

      I agree with you, but not having standards has some value as well. Once you publish a standard it makes it a lot easier for someone to create an exploit that will not be detected by that standard testing method. Of course, that assumes the standards will stay the same which hopefully they will not, but this is the federal government and when have they ever been nimble about responding to a threat?

    11. Re:Opaque Audits by Stanistani · · Score: 1

      >Government isn't a child in need of coddling: it's a cynical and self-aware machine that studies to persist at your expense.

      I think you're confusing the government with those who abuse it (whatever party is in power).

      The government at times resembles a half-wit child with a gun.

      --
      You can't talk about Wikipedia's flaws on Wikipedia
    12. Re:Opaque Audits by bberens · · Score: 1

      Perhaps it wasn't easily inferred, but the article is talking about voting machines in the United States.

      --
      Check out my lame java blog at www.javachopshop.com
    13. Re:Opaque Audits by P(0)(!P(k)+P(k+1)) · · Score: 1

      I think you're confusing the government with those who abuse it. . . .

      Hmm; I guess that's the converse of “hate the sin, love the sinner.” Realistically speaking, however, the will to power is so congenitally irresistable that differentiating between government and the abuse thereof is academic.

      No: government and its abuse are selfsame (or can be modeled as such with reasonable success).

    14. Re:Opaque Audits by Anonymous Coward · · Score: 0

      I still don't understand why they don't enable internet voting to a secure server maintained by a federal agency. It would be simple to avoid fraud just by using a social security number as identification. A log could be kept so voters could always go back in and confirm their vote. Granted, it would still be easy to adjust numbers on the back end, but it would be easy to audit the results with the logs. It just seems like a no-brainer to me. Even for people who don't have internet access, the local voting places could just have terminals there. The whole concept of individual machines having to keep the data which then gets uploaded to a central machine later just seems sort of asinine. The only reason I can see for still doing either paper ballots, or using local electronic voting machines is to limit the number of people who actually vote. I'm sure voting numbers would skyrocket if voting were as easy as logging into a secure system from the comfort of your own home. We'd get a much better picture of what the American people actually want.

    15. Re:Opaque Audits by Moofie · · Score: 1

      Good ol' security by obscurity! I hear that's the best kind.

      --
      Why yes, I AM a rocket scientist!
  2. Once that's done.... by parvenu74 · · Score: 3, Funny

    When they get done fixing the broken system for certifying voting machines, how about an effort to screen the certifiable morons who keep getting onto the ballot?

    1. Re:Once that's done.... by smooth+wombat · · Score: 4, Interesting
      how about an effort to screen the certifiable morons who keep getting onto the ballot?


      I know you're trying to be funny but every state has requirements for people who want to run for office. So long as they meet those requirements, anyone can get on the ballot.

      However, some states, such as Pennsylvania, have stacked the odds against third party candidates by requiring those candidates to meet higher standards. In Pennsylvania, if you are third party candidate and want to be on the ballot in November (you can't be on the ballot in May), you would need to gather signatures equal to or greater than 2% of the ballots cast for the largest vote-getter in the last statewide election race.

      In the most recent election, third party candidates would have needed 67,070 valid signatures to be on the ballot as the highest vote count in the last statewide election was 3.4 million.

      Contrast that with the 2,000 signatures that either a Democratic or Republican candidate must gather.

      Obviously the answer is to have the legislature change the reqirement but the vast majority of the unwashed masses don't know about the requirement, don't care about the requirement, and are happy enough simply voting straight ticket.

      Besides, can you imagine what would happen if it were easier for third party candidates to get on the ballot? Why, there would be competition and choice during an election! We can't have that, now can we?

      --
      We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
    2. Re:Once that's done.... by smoker2 · · Score: 1
      In the UK:

      To stand for election, a candidate must submit a nomination paper signed by ten electors* for the constituency and lodge a deposit of £500, which is refundable only if the candidate receives more than 5% of the total votes cast for each candidate at the election.

      * electors meaning members of the electorate, ie. general eligible public (for that constituency)

  3. Advances in technology for voting by zappepcs · · Score: 1

    will not only bring the process of voting into the 20th century, but it will allow a much faster recount of dead people's votes.... /sarcasm

    --
    Support NYCountryLawyer RIAA vs People
  4. i like the way i vote now by Prophetic_Truth · · Score: 1

    I take a black marker and complete an arrow next to the item I wish to cast my vote for. There is an election official next to the machine which reads in my ballot and electronically tallies my votes, along with the rest of the votes for that district. That way you have both a paper trail with the convenience of electronic tallying.

    --
    time is a perception of a being's consciousness
    time is your 6th sense, the wierd ones are 7+
    1. Re:i like the way i vote now by truthsearch · · Score: 2, Informative

      With electronics, the biggest issue is the tallying, not as much the method of voting. Tallying can be corrupt with no voter noticing.

      --
      Developers: We can use your help.
    2. Re:i like the way i vote now by Alchemar · · Score: 1

      And the guy doing the tally puts a big mark next to your name because you didn't vote for the person that your boss "requested" you vote for. You didn't need that cost of living wage anyway, because that is part of the trickle down theory your canidate would vote against. There is a reason that votes are to remain secret.

  5. Doesn't matter if the standards are the same... by RyanFenton · · Score: 3, Interesting

    Are these new testers truly being paid to examine these machines completely and exhaustively, or are they being paid to run a script, and sign a document?

    If it's the latter, then as long as the standards anywhere close to where they have been, we'll continue working with virtually whatever the voting machine companies assert is good.

    Ryan Fenton

    1. Re:Doesn't matter if the standards are the same... by Anonymous Coward · · Score: 0

      I did voting machine testing (testing carried out on every voting machine in the state.) Explains why I'm posting as AC...
      The script was provided by the manufacturer. On day one of the testing, the script proved to not match the actual screens or voting process. Almost seemed as if the person who wrote the script didn't know how the machine worked. On day two I rewrote the script so that it actually represented the screens presented and the voting process.
      The testers were temp. agency workers who knew nothing about testing. In fact, I am not a software tester (developer, development manager.) Most were very familiar with the machines and fixed the problems that occured along the way rather than putting in a failure report (this mostly applied to printing problems - the printers were terrible add-on's that jammed all the time.)
      After day two, the vendor didn't like the way the results were coming out, too many crashes, so they modified the test procedure (self tests were exluded, no changes were made to the voting process that I corrected.)
      All of the results to that point were thrown out and we started fresh.

      This is how voting machine testing was carried out. If this is how voting machine testing will be carried out in the future, don't bother.

      AC

  6. Why is it by gillbates · · Score: 4, Insightful

    That politicians can't grasp the immediately obvious? Why do they even bother with electronic voting machines when:

    • The voters don't want them, and,
    • They cost more and are less reliable than paper ballots, and,
    • The technical community thinks they're dangerous to democracy.

    How could any politician come to a conclusion that electronic voting machines make sense? There is no compelling reason to use electronic voting machines at all. The only possible explanation I see is that counties which bought electronic voting machines had county officials on the payroll of the voting machine makers.

    The fact that they've been purchased seems to suggest that politics is already not quite as transparent as it should be.

    --
    The society for a thought-free internet welcomes you.
    1. Re:Why is it by lividdr · · Score: 1

      I think you over-estimate how much people "actively" don't want these things. I'm sure plenty of people don't like them, but are people really going to get involved?

      The "scandal" around the 2000 election opened the door - "hanging chads", people whinging that they were confused and *might* have voted for someone by accident because the inanimate ballots are to blame, overseas armed forces ballots getting lost, state attorney generals getting involved, the supreme court deciding the election, etc. The general public just doesn't care, not enough to get off the La-Z-Boy and complain to a public official who isn't going to do anything anyway. Maybe if one of these electronic voting machines kidnapped a child, or slid down an icy hill and hit a dozen cars - maybe then the general public might care for a minute or two.

      It must be Friday - I'm feeling especially cynical today. Scotty, more power to the sarcasm dampeners!

      --
      Give a man a beer and he wastes an hour. Teach a man to brew and he wastes a lifetime.
    2. Re:Why is it by DudeTheMath · · Score: 1

      There are two compelling reasons for EVMs. The most important is that the blind can vote without assistance (preserving the secret ballot). The second is to simplify ballot format: no more will we have the creative "butterfly" ballot (an attempt to squeeze more candidates into a given page space by alternating names on either side of the central "punch" area), which on its own may have swung the 2000 election. Did you know that Pat Buchanan received more votes in Palm Beach County (well-known as a haven for Jewish retirees from New York City) than Al Gore lost by in the entire state of Florida?

      Of course, we may need multiple screens for all the candidates; who wants to be on screen three? EVMs also ought to have methods of randomizing the order of candidates; I've read that there's a bias towards selecting the first candidate in a list. Of course, election supervisors also need to be *allowed* to randomize the order; I think Florida law says that the candidate of the incumbent's party is always listed first (naturally). I wonder if this bias is why almost all the constitutional ballot initiatives get passed in this state, since "Yes" is always first. Actually, while I was living in South Bend, IN, the county election supervisor said it was "too hard" to randomize names on ballots, and always listed them in alphabetical order. Boy, if that's too hard.... She was voted out in the very next election.

      --
      You save only 59 seconds over 8 miles by going 75 instead of 65. Do you really have to pass that guy? Do the Math!
    3. Re:Why is it by PadRacerExtreme · · Score: 2, Insightful
      The voters don't want them

      I think you are confusing the /. crowd with the 'normal' mom & pop crowd. For the non-technical people it is much easier to press a box with the person's name (which then changes color) that poke a hole in a card.

      --
      Just remember - if the world didn't suck, we would all fall off.
    4. Re:Why is it by freezin+fat+guy · · Score: 2, Funny

      You don't understand - we've got this surplus of cash sitting around which we're not allowed to spend on education or universal health care.

    5. Re:Why is it by Chandon+Seldon · · Score: 1

      I have an amazing piece of technology I'd like to suggest that makes hole punching absolutely obsolete: the Sharpie Brand Permanent Marker.

      --
      -- The act of censorship is always worse than whatever is being censored. Always.
    6. Re:Why is it by k1e0x · · Score: 1


      I don't think people do want them, You tell people.. "Hea lets spend billions for a voting system that does no better job than the current one and has no paper trail.. but you get to know who wins instantly.. right after the lawsuits are finished that is."

      Politicians want to push these over on people and they will, "they will get use to them over time.. muhahaha!"

      All we need is to convert counties using wierd systems to a system where we use our number 2 pencils to fill in the dot on a paper ballot. The ballot gets read by a machiene made in the 60's, the votes are tallied and the ballot goes into a locked bin. If the race is contested, we count the paper balots. Its fast, its easy, it just works, and its secure.

      --
      Bringing liberty to the masses. - http://freetalklive.com/
    7. Re:Why is it by mpe · · Score: 1

      I think you are confusing the /. crowd with the 'normal' mom & pop crowd. For the non-technical people it is much easier to press a box with the person's name (which then changes color) that poke a hole in a card.

      It's even simpler to place a cross in a box on a piece of paper/card.

  7. Recommendations? by WiseMuse · · Score: 1

    How will "recommendations" change anything? Don't we need laws that protect the integrity of the voting process? Just asking...

    1. Re:Recommendations? by planetmn · · Score: 1

      No. If I've learned anything on slashdot, it's that the free market will sort this out.

      All joking aside, there needs to be a law that does protect the integrity of the voting process. But I believe we have these. It gets to be a problem though when you try to prove that somebody tampered with the electoral process. How do you show something was an intentional security backdoor, versus just a programming error? You can right specs and standards for this stuff, but specs have ambiguity, there are different interpretations. I have never seen a fool-proof spec.

      I like the way voting has worked in the areas I've lived. You fill out a scantron-type sheet (the ovals that are optically read by a machine) and insert the sheet into the reader. The reader can verify that the ballot is filled out properly, and if not, request the voter to fill out a new form. You also have a verifiable paper trail.

      -dave

      --
      /., where "Apple and Google provide Iran with nukes" will be refuted with "But Microsoft is a convicted monopolist"
  8. Watchmen by jdcook · · Score: 3, Insightful

    Let me guess: the auditors are political appointees?

    --
    Q:How many libertarians does it take to stop a Panzer division? A:None. Obviously market forces will take care of it.
    1. Re:Watchmen by cbrichar · · Score: 0

      Sir, I'll have you know that Halliburton E-Voting & VLT Analysis Corp. fought a hard battle to win that contract.

  9. I'm waiting for the day when... by gillbates · · Score: 3, Funny

    some hacker group gets Mickey Mouse elected via electronic voting machines. I'm wondering if even then people will pay attention.

    --
    The society for a thought-free internet welcomes you.
    1. Re:I'm waiting for the day when... by hclyff · · Score: 4, Funny

      Well, you elected GWB twice and nobody suspects a thing. Now tell me what makes you think people would pay attention if Mickey Mouse got elected... ?

      I thought so.

    2. Re:I'm waiting for the day when... by Anonymous Coward · · Score: 0

      Mickey Mouse elected? Aren't there enough problems with continual copyright extensions with just Disney involved already?

    3. Re:I'm waiting for the day when... by catalina · · Score: 1
      ...gets Mickey Mouse elected...

      Hmm. Some interesting possibilities. Thinking about the future, imagine what it would cost to put President Mouse's picture on currency. Would Disney license that use, and would the guv have to pay royalties for each bill/coin in circulation?



      And there's also the argument that we already have a mickey-mouse president.....

  10. whats wrong with this picture? by gordona · · Score: 3, Insightful

    Why is this just happening now after several years of use (and possible misuse)? Note to readers: this is a rhetorical question. I work for the cable industry which spends lots of money and time for years, certifying devices that get attached to the cable networks. I guess this is more important that ensuring the veracity of our voting systems. But this begs the question. The voting machines are only one link in the chain and perhaps not even the weakest link. Previous elections have quite possibly been affected by selective voter purges and mishandling of ballots--do provisional and absentee ballots even get counted? So, certification of the devices is a needed measure as is holding in escrow the source code of the devices. But this is not the only measure that should be taken.

    "If god had wanted us to vote, he would have given us candidates"

    --
    "Gentlemen, you can't fight in here! This is the War Room!" -- Dr. Strangelove
    1. Re:whats wrong with this picture? by Rob+the+Bold · · Score: 1
      Why is this just happening now after several years of use (and possible misuse)? Note to readers: this is a rhetorical question. I work for the cable industry which spends lots of money and time for years, certifying devices that get attached to the cable networks.

      The certification of voting machines is not new. There have been federal requirements that electronic voting machines' software be "third party certified" for some time now. The new phenomenon is certifying the certifiers. Previously you could hire a code auditor to examine your voting machine's source code who would certify to the feds that your system was clean. There was a lot of room for abuse, since there was no guarantee that the code you gave the auditor was the code compiled and running in your hardware. Since there were very specific requirements for code-readabiliity, the company would need to spend considerable time and effort preparing a "clean" version of the code for review.

      Since the equipment manufacturer is required to hire the 3rd party auditor, then the manufacturer also decides when to send in the audit results. Naturally, you would send those in after your auditor gave you a passing grade. Presumably, you would also then put this "clean" code into production. I was involved in this process as a contractor for ES&S's engineering consultants. I never did see the "clean" code merged back into the production code.

      The cable company, on the other hand, stands to lose subscribers if the hardware doesn't work.

      --
      I am not a crackpot.
  11. if you ask me.... by mastershake_phd · · Score: 1

    Any election where your vote is secret can be rigged. There have been stories of boxes of paper ballots disappearing. If the e-voting machines gave you the voter a receipt with a vote ID number, and your vote was published(say online) how could elections be rigged? Would it be worth the invasion of privacy to ensure a secure voting system?

    --
    Libertarian Leaning Political Discussion Forum.
    1. Re:if you ask me.... by DudeTheMath · · Score: 2, Insightful

      And any vote that's not secret can be coerced. Heard any news lately about the U.S. Chamber of Commerce pushing for legislation to make votes to form a union non-secret?

      Admittedly, in this country, it's hard to believe there could be wide-spread voter tampering, but vote-buying could still occur. For example, a company president could offers election day as a paid holiday (or just a monetary bonus) if the employee brings in his or her ballot indicating a vote for X? Or something more sinister: offer a paid holiday to all who show their ballot, but record who voted for whom, and using that data for some nefarious purpose.

      --
      You save only 59 seconds over 8 miles by going 75 instead of 65. Do you really have to pass that guy? Do the Math!
    2. Re:if you ask me.... by lividdr · · Score: 3, Insightful

      It wasn't that long ago that being identified as a "Communist" was enough to be accused of treason and brought before a Congressional inquest. It's nice to think that nobody will care how you vote, but once your voting record is public there are all sorts of people who wouldn't think twice about using it in judgements. It isn't that much of a leap to imagine being denied work or fired because you didn't vote with the PHB.

      See also, http://en.wikipedia.org/wiki/House_Committee_on_Un -American_Activities and http://en.wikipedia.org/wiki/Joseph_McCarthy for historical reference. There is already a fair portion of the public who thinks secret wire-taps are okay for catching "terrorists" - is it that much further to extend this to investigating people who vote for medical marijuana (drug users!) or assisted suicide (serial killers!)? Or those who voted for Keith Ellison (D-MN), that new muslim representative who surely has ties to the terrorists - he even insisted on using the Quran at his swearing-in!

      --
      Give a man a beer and he wastes an hour. Teach a man to brew and he wastes a lifetime.
    3. Re:if you ask me.... by mastershake_phd · · Score: 1

      Ok, well we could give everyone a receipt. And you could go online to make sure no one changed who you voted for. Like you can look up keno games now. You could look up vote #s. As long as the vote # isnt ties to a person there would be no problem. With the results public you could write verify the results yourself, and anyone whos vote was changed would have their receipt to prove it.

      --
      Libertarian Leaning Political Discussion Forum.
    4. Re:if you ask me.... by Anonymous Coward · · Score: 0

      Actually, with cryptography, it's perfectly possible that each voter could verify what he/she had voted, while his vote is still secret. Though, I don't know how practical it is on a nationwide-scale, you could certainly use it on local ones. Sorry, but I don't have the time to look up a name of an algorithm, but if you're interested, google it. Also, it's explained in the book "Applied Cryptography".

    5. Re:if you ask me.... by mpe · · Score: 1

      There have been stories of boxes of paper ballots disappearing.

      How hard is it to design ballot boxes with a tamper resistent tracking device and to have cameras watching when the ballot papers go in and when the boxes are opened to count the votes?

  12. Paper Ballots Hand Counted by Anonymous Coward · · Score: 0

    The simple, less deadly, less costly answer is.

    Paper Ballots Hand Counted

    Bradblog
    Black Box Voting

    WAKE THE FUCK UP!

  13. Why do they even bother? by wiredog · · Score: 2, Informative

    Florida, 2000. Hanging chads. Confusing paper ballots. The electronic voting mess was supposed to prevent that from ever happening again.

    --

    Best Slashdot Co
  14. It's a start, maybe. by fuego451 · · Score: 0, Redundant

    This may be a step in the right direction but, as we have seen so many times, throwing more bureaucracy at a problem usually doesn't help much.

    I simply don't understand the pigheaded stubbornness against using an open source operating system for voting machines. Voting is one of the key elements of our democracy and should be completely transparent. Sure, someone could/would/will find a way to cheat but openness in the process would at lest instill a little more confidence in the overall system.

    I have a question for our Australian brothers and sisters. I know an open source operating system was written for voting machines there which was reported and discussed here on /. (I can't find the news item.). Has it been accepted and is it being used?

  15. going back in time by chdig · · Score: 2, Insightful

    I wonder how the previous elections' voting computers would fare, being put through the new tests... think diebold would like to see exposed just how many security holes there were in their last series of "machines"?

  16. Just another money grab by tearmeapart · · Score: 1

    Is it just me, or is this another chance to create a group that will just suck all the money in and be corrupt?
    What is the likelihood that this group would be able to satisfy everyone and have enough power to keep elections from being rigged? //Thanks God for being born in Canada ///Not that we are much different.

  17. Blind Votes by camperdave · · Score: 1

    You guys are getting way complicated. Forget the punch-outs, the electronics, etc. Print a list of names with a box next to the name, and the voter puts an X in the box. Print a batch that is both in ink and in braille, with a raised edge around the box. Or maybe give the voter a ticket and have a few boxes in the booth. The voter just drops the ticket in the box corresponding to the candidate they wish. Print the name of the candidate in braille, in ink, and throw on a picture too, so the illiterate can vote.

    Of course, we may need multiple screens for all the candidates; who wants to be on screen three?

    Sheesh! Screen three? I thought you guys had a "two party system". How do you get three screen-fuls of candidates with only two parties? I live in a country where we have multiple parties, and the most candidates I've ever seen on a ballot was eight, or so.

    --
    When our name is on the back of your car, we're behind you all the way!
  18. Voting Computers by benjonson · · Score: 2, Insightful

    As was pointed out on slashdot yesterday http://politics.slashdot.org/article.pl?sid=07/01/ 18/152205, calling these things voting computers rather than voting machines gets the story across much better. People might wake up when they hear these things more accurately described.

    --
    =-+
  19. More crap like NIAP? by bug · · Score: 4, Interesting

    Another one of NIST's big security certification schemes is NIAP. It's difficult to see it as anything but a failure. The "protection profiles" that systems are tested against sometimes explicitly assume a benign environment with no hackers. Hello, what's the point then? Also, the most common certifications don't involve source code verification or any other kind of strenuous testing. Just take a look at the list of crap that they have validated, including some products with absurd levels of vulnerabilities. Apparently, Microsoft Windows is very secure, according to NIST's NIAP. Note also that, because this is pay to play, many of the best security tools are completely missing from the list. If I had to bet money, I'd say that well-heeled companies like Diebold will make it through the testing despite a lot of vulnerabilities, and the public will be no better off.

  20. Nothing wrong with NIAP itself by LanMan04 · · Score: 1

    You're got the right idea, but you're placing the blame with the wrong folks.

    Protection Profiles are written by the organizations using NIST standards. If Microsoft (for example) chose create a really, really lame Protection Profile for their ToE (Target of Evaluation, in MS's case several of their flagship OSes), that's their crap/deception, not NIST's. A lame PP would be one that states the system will never be connected to a network, is protected from physical access, never has unsigned code running on it, etc etc.

    NIST makes standards, but doesn't controll how they are used in the wild. It's like me saying "I'm a certified genius at age 30, but only when tested with materials designed for 4th-graders". There's nothing wrong with the test that was administered, but the *context and application* are all wrong. Several MS OSes are certified at EAL4 with totally bullshit PPs, but that's MS's evil deed, not NIST's.

    EAL by itself means nothing.
    EAL + PP gives you most of the picture.

    REMEMBER - "EALs refer to the level of confidence in the conclusions of the evaluation, and not to the level of secrity the product provides".

    --
    With the first link, the chain is forged.
    1. Re:Nothing wrong with NIAP itself by Moofie · · Score: 1

      Are you two trying to corner the market on acronyms? Because, seriously, the military has some GAME. Y'all better step up.

      --
      Why yes, I AM a rocket scientist!
    2. Re:Nothing wrong with NIAP itself by LanMan04 · · Score: 1

      Worked for the US government for a while in security.

      Rainbow Books WTF!

      --
      With the first link, the chain is forged.
    3. Re:Nothing wrong with NIAP itself by Python · · Score: 1

      Be that as it may, the NIAP is still a failure because the agencies don't seem to understand the short comings of the program. The perception is that EAL levels are some quantification of security. The higher the level, the better it must be, and if a product doesn't have an EAL - well then we shouldn't use it. Which means a lot of excellent security tools are excluded from agencies, particularly at DoD where they are really needed.

      For example, when conducting pen tests I've personally had to battle the EAL religion to just get decent tools approved for my teams, because NONE OF THEM ARE CERTIFIED. Which is both not a surprise, as some of the tools are so new (even the commercial ones) that they couldn't possibly have an EAL, are not maintained by people/organizations that have any motive to get them certified or take so long to get one that he state of the art tools are not available. You are left using older, less reliable and often times less secure products. Hell, at one point we had to battle over using Linux attack boxes because at the time Windows had a higher EAL! There was an insane perception that Windows would be better and after installing SP2, which was STIG mandated, the boxes were so slow at port scanning the IG caved and said go with Linux because the audit was going to take SO LONG it wouldn't get done in time. All of this stupidity was driven by the irrational belief in the holiness of the EAL.

      Couple this with the false sense of security the level gives, and the fact that it really doesn't add anything by itself - as you yourself said - and it begs the question: Is the value worth the cost? Experience has taught me that it does not. The EAL is just a rehashing of older certification methods (remember the old A, B, C levels?) and those were not very useful either (unless you went for the top levels, and even then there were problems). Its not rigorous enough to be a real evaluation (even a full code review doesn't mean a product is safe, prudence says assume the worst, which is why its a damn good thing the GIG and SIPR are on their own physical networks), it doesn't truly test the security posture of a product, its takes too long to get a through test - so vendors are tempted to short cut via a bogus PP - and it doesn't mean that a product is or is not an acceptable risk for an organization to use. And yet, its POLICY now that you can't use controls that don't have an EAL. The EAL carries tremendous weight just for that alone. I can not tell you how many IASM's and IASO's that try to argue to IG teams that the higher an EAL score the more secure it must be. And then can't imagine how their precious boxes just got owned by the Red Team. Uh, because the EAL doesn't mean jack, or the PP was junk, or hell the box just had a big fat hole in it.

      The NIAP program is garbage. The buyer is left with what, a level to tell them the confidence level in the conclusion? OK, so that means most of the EAL's mean: don't trust the conclusions. And yet the agencies think: EAL = secure. They don't get that. They don't understand that the EAL score is just a "only trust this conclusion X percent", they think its a score of how secure a product is. Its a failure for that reason alone. The NIAP just sends the wrong message to the agencies.

      --

      Python

  21. You got it wrong by Anonymous Coward · · Score: 0

    This democratic "victory" is simply a step in the republican stragegy to sweep in '08. By cheating to help their opponents, nobody will suspect that they are cheating when the constitutional amendment declaring Bush "President For Life and Beyond" and outlawing everything beginning with the letter "D" passes by a broad margin next spring.

    1. Re:You got it wrong by Anonymous Coward · · Score: 0

      Please tell me Dubya will be outlawed

  22. Bah! by Khammurabi · · Score: 1

    Mickey Mouse wouldn't get elected. His sexuality would be questioned immediately. He walks around bare-chested, hangs out with a pantless duck, and has yet to produce a single offspring or even marry his girlfriend of 50+ years (not to mention that odd high pitched voice of his).

    Bah! Goofy has a far better chance at the presidency. Now there's a complete fool I could respect!

  23. Um... whaaaa? by Anonymous Coward · · Score: 0

    Having the US 'certify' fair voting machines is like having Apple certify OS security. And as we know, this is a BAD month for Apple security (or rather, a revelation toward the lack thereof).

  24. Redundant? by fuego451 · · Score: 1

    I'm not here to gather mod points, not that I think I have the writing ability to do so if I wanted to, and I can certainly understand that my post may not be interesting to anyone in particular but 'Redundant'? I think that's a stretch.

    Earlier today, someone complained of the same thing but I'll be damned if I can find it; not that it really matters. /.'s search function only covers 'posted' articles/comments; if by 'posted' they mean 'added to the database'. Firefox's 'Find' seems to have lost some of its functionality as well and routinely balks a large pages. Oh well, c'est la vie

    1. Re:Redundant? by fuego451 · · Score: 1

      The parent was posted as a 'Reply' to and earlier post I submitted. I can't imagine how it became a new thread. I wonder what will happen to this post?

  25. No one cares about Diebold anymore by Anonymous Coward · · Score: 0

    It was Democrat demagoguery all along. Now that the Democrats swept 2006, electronic voting is the perfect embodiment of the "the will of the voter"!

    If anyone stood up and said: "Pelosi, Reid and Dean stole the election!" they'd be escorted to the looney bin, where all the faithful of President Gore belonged in 2000.

  26. Maybe someone could help me understand... by Monoliath · · Score: 1

    ...what in the hell is so god damn hard about making sure that a device records a selection that a user makes via a touch screen? What the hell about certifying that process needs to be kept as a 'trade secret'?

    This is all a bunch of media-spin garbage to get people to buy into blackbox voting, which (and I apologize for my arrogance) anyone with half a brain should see, is a horrible idea.

    As far as me and my tax dollars are concerned, all voting software should be open, methods transparent and certification records to be made public. There should be [b]NO PRIVATIZATION of ANY ASPECT of our DEMOCRATIC ELECTORAL PROCESS, EVER, FOR ANY REASON![/b]

    This isn't rocket science and never has been, our current moronic whitehouse administration just wants you to think so.

    It's just like the whole 'hanging chad' crap, it's just a distraction from what really needs to be done and shown.

  27. you can't do it by zogger · · Score: 1

    There is NO secure way to have computerised voting.

      We had a long established precedent that any citizen worth enough to vote could verify an empty box using nothing more than a set of mark I eyeballs. No programming needed, no electricity needed for that matter.

    I don't care how many standards and computers and voodoo assurances you throw at it, computerised voting doesn't pass that minimal "normal human eyeballs" test. I don't care if the code is open or not, even if it is they can still hack it upstream at the next computer, or the nexct one, and you wouldn't know. When it comes to what ownership of the government is worth-ultimate power and trillions of dollars-temptation is too great, or force of blackmail, or whatever-it'll get hacked to pieces.

        All you are doing with computers is swapping around the places and manners where *extreme* and easy large scale voting manipulation can occur. The old method was pretty hard to hack every voting ballot box, even a sdmall percentage, but with computers??? Large scale regional hacking possible, and you wouldn't know. Some got hacked in ye olden days,sure,ballot box stuffing, but having the ability to inspect the empty box, then stand around at night and verify the count, worked about as well as possible over the widest range of precincts.

    Computerised voting is designed on-purpose to fake people out with "new shiny" blinkenlights, and that's about it. It's a scam to perptuate the one globalist party system so that this election's "fearless leader" chose by the globalists "wins"..

        The old system wasn't broken so bad that we have to spend billions to completely finish smashing it to pieces.

    Paper ballot, indelible pen for marking. No hanging chads, no voodoo "code" counting at some remote server buried in a locked basement someplace and three paid off dudes "verifying" it, none of that. It's lame. A simple ballot box and paper ballots are just fine for voting, and if it takes a-horror!-whole day to vote and another to count..who cares? Why don't we have a full 24 hour voting period *anyway*, what's with near bankers hours for voting? And we have run out of humans who can count, just adding simple sums? I don't think so.

  28. 1 for you, 2 for me! by sciop101 · · Score: 1
    "Tallying can be corrupt with no voter noticing."

    The fair voting system favors the winner.

    I mean, the fair voting system disfavors the loser.

    LET'S HANG CHAD AGAIN!

    --
    The only thing new in this world is the history that you don't know.[Harry Truman]