Slashdot Mirror
U.S. To Certify Labs For Testing E-Voting Machines
InternetVoting writes "In a clear counter to the recent criticisms of secrecy involving Ciber labs the National Institute of Standards and Technology (NIST) has issued recommendations (pdf) to the Election Assistance Commission (EAC). NIST recommends the accreditation of two labs, iBeta Quality Assurance and SysTest Labs. The recommendation, emphasizing the need for transparency, includes on-site assessment reports, lab responses, and on-site reviews for each lab. These reports shed much needed light into the process of voting machine certification. Learn more from the Q&As About NIST Evaluation of Laboratories that Test Voting Systems."
It sounded, prima facie, like progress was being made; but quoth TFA:
Call me cynical, but auditing opaque processes with equally opaque tests doesn't change much; I foresee a holographic sticker labelled “certified.”
I'd wager, furthermore, they expect us to buy it at face value.
When they get done fixing the broken system for certifying voting machines, how about an effort to screen the certifiable morons who keep getting onto the ballot?
Are these new testers truly being paid to examine these machines completely and exhaustively, or are they being paid to run a script, and sign a document?
If it's the latter, then as long as the standards anywhere close to where they have been, we'll continue working with virtually whatever the voting machine companies assert is good.
Ryan Fenton
That politicians can't grasp the immediately obvious? Why do they even bother with electronic voting machines when:
How could any politician come to a conclusion that electronic voting machines make sense? There is no compelling reason to use electronic voting machines at all. The only possible explanation I see is that counties which bought electronic voting machines had county officials on the payroll of the voting machine makers.
The fact that they've been purchased seems to suggest that politics is already not quite as transparent as it should be.
The society for a thought-free internet welcomes you.
With electronics, the biggest issue is the tallying, not as much the method of voting. Tallying can be corrupt with no voter noticing.
Developers: We can use your help.
Let me guess: the auditors are political appointees?
Q:How many libertarians does it take to stop a Panzer division? A:None. Obviously market forces will take care of it.
some hacker group gets Mickey Mouse elected via electronic voting machines. I'm wondering if even then people will pay attention.
The society for a thought-free internet welcomes you.
Why is this just happening now after several years of use (and possible misuse)? Note to readers: this is a rhetorical question. I work for the cable industry which spends lots of money and time for years, certifying devices that get attached to the cable networks. I guess this is more important that ensuring the veracity of our voting systems. But this begs the question. The voting machines are only one link in the chain and perhaps not even the weakest link. Previous elections have quite possibly been affected by selective voter purges and mishandling of ballots--do provisional and absentee ballots even get counted? So, certification of the devices is a needed measure as is holding in escrow the source code of the devices. But this is not the only measure that should be taken.
"If god had wanted us to vote, he would have given us candidates"
"Gentlemen, you can't fight in here! This is the War Room!" -- Dr. Strangelove
Florida, 2000. Hanging chads. Confusing paper ballots. The electronic voting mess was supposed to prevent that from ever happening again.
Best Slashdot Co
And any vote that's not secret can be coerced. Heard any news lately about the U.S. Chamber of Commerce pushing for legislation to make votes to form a union non-secret?
Admittedly, in this country, it's hard to believe there could be wide-spread voter tampering, but vote-buying could still occur. For example, a company president could offers election day as a paid holiday (or just a monetary bonus) if the employee brings in his or her ballot indicating a vote for X? Or something more sinister: offer a paid holiday to all who show their ballot, but record who voted for whom, and using that data for some nefarious purpose.
You save only 59 seconds over 8 miles by going 75 instead of 65. Do you really have to pass that guy? Do the Math!
It wasn't that long ago that being identified as a "Communist" was enough to be accused of treason and brought before a Congressional inquest. It's nice to think that nobody will care how you vote, but once your voting record is public there are all sorts of people who wouldn't think twice about using it in judgements. It isn't that much of a leap to imagine being denied work or fired because you didn't vote with the PHB.
n -American_Activities and http://en.wikipedia.org/wiki/Joseph_McCarthy for historical reference. There is already a fair portion of the public who thinks secret wire-taps are okay for catching "terrorists" - is it that much further to extend this to investigating people who vote for medical marijuana (drug users!) or assisted suicide (serial killers!)? Or those who voted for Keith Ellison (D-MN), that new muslim representative who surely has ties to the terrorists - he even insisted on using the Quran at his swearing-in!
See also, http://en.wikipedia.org/wiki/House_Committee_on_U
Give a man a beer and he wastes an hour. Teach a man to brew and he wastes a lifetime.
I wonder how the previous elections' voting computers would fare, being put through the new tests... think diebold would like to see exposed just how many security holes there were in their last series of "machines"?
As was pointed out on slashdot yesterday http://politics.slashdot.org/article.pl?sid=07/01/ 18/152205, calling these things voting computers rather than voting machines gets the story across much better. People might wake up when they hear these things more accurately described.
=-+
Another one of NIST's big security certification schemes is NIAP. It's difficult to see it as anything but a failure. The "protection profiles" that systems are tested against sometimes explicitly assume a benign environment with no hackers. Hello, what's the point then? Also, the most common certifications don't involve source code verification or any other kind of strenuous testing. Just take a look at the list of crap that they have validated, including some products with absurd levels of vulnerabilities. Apparently, Microsoft Windows is very secure, according to NIST's NIAP. Note also that, because this is pay to play, many of the best security tools are completely missing from the list. If I had to bet money, I'd say that well-heeled companies like Diebold will make it through the testing despite a lot of vulnerabilities, and the public will be no better off.