NY Legislature Rejects "Microsoft Amendment"

An anonymous reader writes "Finally, some good news on electronic voting. The New York state legislature rejected an amendment proposed by Microsoft's lobbyists which would have gutted New York's requirements for voting machine vendors to turn over their source code to the state Board of Elections. Assemblywoman Barbara Lifton commented: 'The voting machine vendors have known for two years what our laws said. Now they're saying that those parts of their systems using Microsoft software have to be proprietary? It's just wrong.'"

Comments

Nothing to see here. Move along.

[WilliamSChips]

Right next to a MS ad, even.

Was I the only one?

[pooh666]

Who reacted with a HA! HA! Nelson is my copilot...

Re:Was I the only one?

[Daedone]

What i want to know is, why don't they just use the "everyone votes" channel on Wii?

Re:Was I the only one?

[geekboy642]

Right, so all 13 people who actually own a Wii would be able to vote. Waitaminute...you're saying you'd pull yourself away from Paper Mario long enough to vote for some idiot to run the US? Nonsense.

Re:Was I the only one?

[Daedone]

well, as a Canadian i wouldn't have a vote, but IF i did, it would BE for Mario :)

as an aside, if there are only 13 of us, that means i know 25% of all Wii owners, and we all happen to be in St. Catharines, Ontario.

Re:Was I the only one?

[drgs100]

>we all happen to be in St. Catharines, Ontario Spooky.

Re:Was I the only one?

[teknopagan]

I apologize for feeding the troll, folks, but here's the facts according to Bloomberg as of 2007.06.25:

Nintendo has so far sold about 2.37 million Wii consoles in the U.S., 2 million in Japan and 1.47 million in other regions, including Europe, since the November debut

Full text of that story here

~5.8 million > 13.
The More You Know.

Re:Was I the only one?

[Valthan]

Well you can add another person out of the 13 that is from St Kitts

Re:Was I the only one?

[geekboy642]

Not a troll, that was exaggeration for effect.
The population of the U.S., according to the CIA world Factbook, is over 301 million people. ~301 million > 2.37 million. Even as broken as the U.S. election system is, we get slightly better than 0.7% participation.

no its not

[Zeinfeld]

I agree that the voting code should be published.

But platform code that is obtained from a third party vendor should be acceptable provided that it is widely used as a general purpose platform and there is a reliable demonstration that the code has not been modified.

I would rather see voting platforms built on microsoft trustworthy computing platforms without code review of the platform part of the system than built on a platform where I cannot be sure what code is running.

The code reviews are useless unless I am sure that the machines actually run the code that was reviewed.

Of course paper and pencil requires no code review.

Re:no its not

[MightyMartian]

But platform code that is obtained from a third party vendor should be acceptable provided that it is widely used as a general purpose platform and there is a reliable demonstration that the code has not been modified.

That's some rigorous requirement you've got there. So how much does Redmond pay you to be the local /. shill?

Re:no its not

[WindBourne]

The voting system in old USSR, Current China, Cuba, taliban controlled afghanastan, etc were on systems that were widely used. Personally, I would not trust them. Why settle for a system like MS, when you can insist on having no chance of an illegal election. NY has it right. Insist on all the code up front. Have it compile and then that is installed on the systems. Otherwise, the ppl from other countries have it right; There is NOTHING wrong with a paper vote other than taking so long.

Re:no its not

[EagleEye101]

They were told they needed to show the source code of the voting machine software to the code review, not only some of the code. They should have thought of this before, its their fault.

Re:no its not

[Anonymous Coward]

The solution is to create a system where you don't have to trust the source code to begin with

Touchscreen, vote, hit done, the machine prints a paper ballot. You review said ballot and deposit the paper ballot in the ballot box.

What could be simpler and less prone to manipulation or error?

In that scenario, you don't have to know jack shit about the voting machine or its source code. It doesn't matter. The voter reviews the output, not the internals. If people start noticing that a certain machine or certain brand of machines prints incorrect ballots frequently, well then steps can be taken to figure out why.

But the end to end system can't be gamed.

There is no level of code review or "trusted computing platform" specification that will provide anywhere NEAR that level of trust and confidence in the system. Add to that the fact that you have an incontrovertible source of paper ballots for recounts, what more does anyone want? why do we put up with anything less?

Re:no its not

[drinkypoo]

But platform code that is obtained from a third party vendor should be acceptable provided that it is widely used as a general purpose platform and there is a reliable demonstration that the code has not been modified.

Widely used as a general purpose platform doesn't mean it's any good.

And "the code has not been modified" from what? There's no reason you couldn't have collusion between Microsoft [or any other vendor] and someone trying to hack the vote. The specific code to tamper with eVoting could be buried deep and you'd never find it.

Given that Ashcroft took the DOJ off Microsoft's ass, and given that Ashcroft is a known criminal, I think assuming that there is a relationship there is probably more reasonable than believing that there is not. Maybe that's just because I'm paranoid, but more likely it's because I know a little something about history. Anyone read the CIA crown jewels yet? Or the parts that aren't marked out, heh heh...

Re:no its not

[Sunshinerat]

If I create perfect voting code but use proprietary code (and therefore closed) for trivial things like multi-user data storage. Under these rules that would suffice. However, the Microsoft code that I use may not be up to the task of having thousands of concurrent connections.

What do we do then?

Maybe certify based on specific conditions like: number of voting stations connected, number of votes per hour.

MvE

Re:no its not

[Anonymous Coward]

> given that Ashcroft is a known criminal

Eh?

Besides, next to Gonzales, he's Elliott Fucking Ness and Mister Smith rolled into one.

Re:no its not

[bl8n8r]

> I would rather see voting platforms built on microsoft trustworthy computing platforms

Here you are. Point the arrow at your candidate and pull the handle.

Re:no its not

[Zeinfeld]

That's some rigorous requirement you've got there. So how much does Redmond pay you to be the local /. shill?

So the only reason someone would disagree with your point of view is that they are paid to do so? That is some opinion of your abilities you have there. Would not have taken very much effort to follow the link to my blog and find out who I am.

Security is risk control, not risk elimination. In this particular case the risk of a trapdoor in the platform code is a lower concern than the risk of the running code being substituted on the final machine.

Security does not fit into rigid dogmas or political agendas. Nobody can provide an operating system that is 100% reviewed. Palladium is the nearest thing we have. At least I can audit the nexus (which is published source) and have the nexus validate the rest of the running code.

Re:no its not

[Zeinfeld]

Given that Ashcroft took the DOJ off Microsoft's ass, and given that Ashcroft is a known criminal, I think assuming that there is a relationship there is probably more reasonable than believing that there is not. Maybe that's just because I'm paranoid, but more likely it's because I know a little something about history. Anyone read the CIA crown jewels yet? Or the parts that aren't marked out, heh heh...

Since the family jewels were written in 1973 under the Ford administration it is not at all likely that they have any mention of electronic voting.

The key here is whether there is the opportunity for someone to introduce a backdoor into the code.

If the code base is small enough for someone to actually perform a review, that is fine. The problem here is that the systems are huge and performing a comprehensive review is not practical on a hundred thousand plus lines of code.

Since I don't believe that its possible to review the entire code base the next best approach is to prevent collusion between the person writing the voting software and the platform provider.

Re:no its not

[91degrees]

If it was necessary to use proprietry software then I'd agree. But Linux is an option. So is BSD. So are various other operating systems. Given that there's no major harm in eliminating the closed source ones, why make an exception?

Re:no its not

[drinkypoo]

Since the family jewels were written in 1973 under the Ford administration it is not at all likely that they have any mention of electronic voting.

Well, that's not what I meant. What I'm saying is that it's clear that our government (what? no, surely, not ours!?) is continually engaged in skullduggery and dirty tricks, and such are also par for the course for presidential candidates. And just how many of our recent presidents have been members of Balls and Shaft? er, sorry, Skull and Bones. There's a reason everything looks like a conspiracy. Everything is. Frequently they are not so dark or secret as is imagined, and the word 'conspiracy' has picked up a nutjob connotation which must be much-loved by conspirators everywhere.

The key here is whether there is the opportunity for someone to introduce a backdoor into the code.

With closed-source software, you have no idea, which is my point.

Since I don't believe that its possible to review the entire code base the next best approach is to prevent collusion between the person writing the voting software and the platform provider.

I'd like to know how you plan to do that.

Do you intend to lock one or both of them up in solitary confinement and feed them through a very small tube so no one can pass them a message?

It doesn't matter what the source of the code is, you must be able to do an audit. Personally I think that the software should just be fucking written in assembler and run on FreeDOS or something. That keeps the system simple and auditable, and frankly, there is no reason for the OS on a voting machine to have much complexity anyway. NONE. Meanwhile, there are several reasons for it to be as simple as possible.

Re:no its not

[FuzzyDaddy]

I agree that having the source code offers no assurances as to the legitimacy of the vote. It's too easy to hide stuff.

However, if there are general "quality" problems (lost votes, machines crashing, etc.) it will be that much easier to place the blame after the fact. Imagine your voting machine crashes, and an independent commission can look at the source code and find the problem without your cooperation. If they find serious bugs or code quality problems, the vendor is going to be in a nightmare position, PR wise. This puts a much higher amount of pressure on the voting machine vendors to do things properly, or be exposed.

So I see the code escrow not as a quality assurance, but as a deterrent to the voting machine vendors producing a sloppy product. They'll do it anyway, I'm sure, but this way they'll be very unhappy if something is screwed up.

Re:no its not

[WindBourne]

palladium says that the OS that was installed on the OS was not modified from what the controller wants. It does NOTHING to guarantee that the OS was not compromised before being put on there. I will take a locally compiled version of BSD and/or Linux. In fact, better yet, I will take something that is DO-178B compliant in which the feds have already looked over it, and still looked over. BTW, when MS was asked if they would submit one of their OSs for Do-178B, they asked for the certs. A month later when asked, they laughed the CEO out. They said that NONE of their OSs could come close to close inspection.

Re:no its not

[timmarhy]

why not just use paper then? hell of a lot simpler and cheaper.

how does that paper assure you the recorded vote is saved in the system is the same as what the paper says? it doesn't.

the only form of electronic voting i can see working is a system of electronic paper, which lets you press directly on the box you want and fills it. you deposit it in the secure box as normal and it's then counted by a machine, advantage being that it's digital so your counter won't run into false positive problems like with pencil, and it's still human verifible like paper.

Re:no its not

[MissP]

And what happens to the paper ballot? It gets fed into a scanner running software. That's the place to steal the election, when the votes are counted not when they are cast.

Re:no its not

[Anonymous Coward]

That is a warranty issue between the buyer (local or state government) and the seller. It is immaterial to the issue at hand.

The proposed code reviews are not for warranty issues, they are to ensure that the vote is not being manipulated. And that is a very, very tall order for a code review to provide (especially system wide, with removable cards and databases and hardware issues, etc.)

For example, I don't give a rat's ass what warranty agreement McDonalds has with its point-of-sale terminal provider. I also don't need to do a code review on the POS terminal. I review it's output. If I get the proper order in my hands for the expected amount of money, I am satisfied with the machine. Otherwise I would complain, and eventually McDonalds would have to figure out WTF is wrong with its POS.

Same thing should apply to me as a voter. If I get the expected paper ballot out of the machine, I'm done and turn the ballot in to be counted. Any other details (up time, failures, paper jams, etc.) are not my concern as a voter (they might be my concern as a taxpayer of course). And those problems are likely not going to be solved by some code jockey doing an audit of the underlying C code.

Re:no its not

[dangitman]

Touchscreen, vote, hit done, the machine prints a paper ballot. You review said ballot and deposit the paper ballot in the ballot box.

So, why even use the computer in the first place, if you're going to be counting paper anyway? Wouldn't it be a lot cheaper and more reliable to use pencil and paper?

What could be simpler and less prone to manipulation or error?

Marking a ballot manually with a pencil?

I'm not sure why you think this won't be prone to error. I'd bet that at least 50% of people won't even look at the printout. It could say "I vote to be enslaved by Satan" and they'll just blindly place it in the ballot box. At least with a manual method, the voter actually has to make the marks in the first place, rather than relying on a machine.

As for simple, many people find even the simplest of computers confusing. Just the presence of a machine is enough to intimidate some people and make them think funny. So, in that respect, it's a lot simpler to use manual voting than to train people to overcome their technophobia. There's also a lot more maintenance and infrastructure involved in a computer-based solution. Even the most foolproof machines are going to require a complex technical support network when you think about the scale and importance of elections.

Re:no its not

[Original Replica]

In this particular case the risk of a trapdoor in the platform code is a lower concern than the risk of the running code being substituted on the final machine.

IANAProgrammer, But for this application neither is acceptable.
Given what the code is required to do (allow for the selection of a vote in each catagory, record said votes, provide totals for each catagory) shouldn't the code be blindingly simple? Give me ANSI graphics and no mouse driver. Give me three imputs: cursor up, cursor down, enter/select. Hell, it can print out on a dot matrix. It should be a requirement that the code be small enough to be reviewed completely, without excessive effort.

Re:no its not

[dangitman]

If the code base is small enough for someone to actually perform a review, that is fine. The problem here is that the systems are huge and performing a comprehensive review is not practical on a hundred thousand plus lines of code.

There's a warning sign right there. Why should these systems be "huge"? They only have to perform a very simple task. If you're using a complex system to do that, then that demonstrates that there's stuff in there that doesn't need to be, and could cause problems.

Ever heard of the "KISS" principle?

Re:no its not

[Anonymous Coward]

I agree that the voting code should be published. Votes should be published! =D

Re:no its not

[morgan_greywolf]

Mod parent up! MSFT operating systems are simply not secure enough for mission critical applications. That's why you see most mission critical apps running on either big iron, Unix, or a realtime embedded system from companies like WindRiver.

Re:no its not

[Anonymous Coward]

why not just use paper then?

you answered your own question: so your counter won't run into false positive problems like with pencil, and it's still human verifible like paper.

how does that paper assure you the recorded vote is saved in the system is the same as what the paper says? it doesn't.

because you turn in the PAPER to be counted, not some electronic bits and bytes on a compact flash card. The voting machine allows you to produce an error free, highly scannable ballot, free of hanging chads, improperly filled in ovals (undervotes), too many ovals filled in for same race (overvotes), etc. It produces a BETTER ballot than paper and pencil because it is more scannable and prevents illegal ballots from being generated (overvotes).

the only form of electronic voting i can see working is a system of electronic paper, which lets you press directly on the box you want and fills it. you deposit it in the secure box as normal and it's then counted by a machine, advantage being that it's digital so your counter won't run into false positive problems like with pencil, and it's still human verifible like paper.

which has the exact same effect, but instead of some high tech electronic paper being used for the ballot, a printer, ink, and common paper are used.

Re:no its not

[KlomDark]

There's a better system than that - your vote is stored in a database, but your vote is also printed out for you to review. You then put the paper in a box that is kept under lock and key. For quick results, the database count is the one that is looked at. However, any third party can request to count the paper votes and compare them to the database count. If they do not match, then there is a physical audit trail to show that someone was monkeying with the software. This way, we get fast results, and verification.

Trust, then verify, is the solution in this case.

Re:no its not

[Anonymous Coward]

"And what happens to the paper ballot? It gets fed into a scanner running software. That's the place to steal the election, when the votes are counted not when they are cast."

It gets counted and audited by humans. The advantage of having the computer registration of votes is that the (unofficial) results are know immediately, as well as being more accessible.

Ultimately, they should correlate with the hand-counted votes but, in the case they don't, the paper votes are authorative. No, it doesn't save you money. What price would you be willing to pay to give up your democracy, though? I'm sure the cost of doing elections the right way is worth it.

Re:no its not

[dotwaffle]

You have the code? Do you have the code to the compiler?

Ok, it's GNU C Compiler. Do you have the blueprints for the chip so that you can tell it's not doing it's own routines whenever an interrupt is generated?

Oh, it's SPARC. Ok, here's one that'll get you - have you got at least two independant sources checking through the stack from top to bottom, making sure everything is ok? That's a shit-ton of code, I bet no-one does.

Trust no code you didn't write yourself. And even then, did you write *everything* - hardware included?

Re:no its not

[timmarhy]

obviously you've never written any computer system for the general public. no one will check their ballot, and if it misprints a single ballot, all the ballots before it must be discarded because who knows how long it was misbehaving? that system is ripe for the picking.

atleast with electronic paper, you know for sure that each ballot was marked by the person casting the vote. oh, and you never once mentioned that you'd use the paper ticket for counting, so you've only got yourself to blame for people not interpreting it correctly.

Re:no its not

[Misch]

Kinda how New Jersey is going to be doing things.

It won't be in place until 2008, but it will be there.

Re:no its not

[Anonymous Coward]

oh, and you never once mentioned that you'd use the paper ticket for counting, so you've only got yourself to blame for people not interpreting it correctly.

You review said ballot and deposit the paper ballot in the ballot box.

Here's your sign.

Re:no its not

[Goaway]

Yeah, that's pretty much exactly how you don't want to do voting.

One of the big stated reasons for electronic voting is to make it easier for the disabled to vote.

Re:no its not

[amRadioHed]

There is NOTHING wrong with a paper vote other than taking so long. Not that it even takes that long. Most results are in by the 11 O'clock news. In a close race you may need to wait till the morning to get your election results. Who cares?

Electronic voting machines are the solution to a problem that doesn't exist and only result in complicating things immensely and making the results less reliable. I don't see the benefits.

Re:no its not

[dgatwood]

Why is two-factor authentication marginally better than one-factor? Same principle applies. If you stuff the ballot electronically and also have to stuff the paper ballot, it's at least twice as hard to do it as only having to fudge the software or print up a bunch of extra ballots and punch or mark them.

IMHO, an ideal system would have several different protections:

• A crypto key per voting machine generated randomly on the day of voting to sign each electronic ballot. The private key would be written automatically to a removable card for vote verification. The public key would be stored in battery-backed RAM and wiped at the close of voting. It should be designed such that any attempt to remove the battery-backed RAM would immediately wipe its contents. This would greatly increase the difficulty of vote fraud, as each electronic vote would be highly verifiable, and the only way to fake a vote would be to either rig the random number generator or insert an additional public key, which would then show up as a larger number of voting machines than expected.
• A paper copy. In order to stuff the ballot, you would have to fake both the electronic record and the physical paper copy. The printed ballot would also include a high density bar code (signed data). Most ballots would be scanned normally, but a random sampling of these ballots would also get pulled and verified with OCR to ensure that the printed vote matches the bar code data.
• A vote verifier. Voters could scan the paper ballot and verify themselves that it matches the printed text, if desired.
• A set of stubs with a unique number (barcode, probably) that matches the ballot number on the paper copy. This would be retained within the voting machine and counted by an independent agency (e.g. a randomly selected group from the local media or something) after the close of elections. Any significant discrepancy between this list and the primary vote list would be seen as likely evidence of fraud.

Re:no its not

[amRadioHed]

The physical vote should be automatic. The instant electronic returns are nice, but only a count of the physical ballots should be official.

Re:no its not

[nschubach]

Doesn't the Microsoft EULA state that their OS is not to be used in mission critical applications or applications where the lives of people could be at risk anyway? I remember reading that on the NT4 EULA. Not sure if it remained in the text...

Re:no its not

[Rakishi]

Of course to count those votes a machine would need to be used, after all the paper ballots are of high quality and likely designed specifically so a machine can count them. But since we know its a law of the universe that only voting machines not vote counting machines are susceptible to abuse there is nothing to worry about at all.

In the end the result is exactly the same in terms of how valid the vote is but without all the wasted time in feeding the votes into the vote counting machine.

Re:no its not

[alx5000]

You hit the nail right on its head. Here in Spain we have 97-99% accurate results by 11pm (actually, most parties will admit defeat earlier than that). As for the ones not trusting the people who stays and counts, I gotta say they're being monitored, and the results are double-checked in situ.

Re:no its not

[amRadioHed]

They certainly could and should be made easily countable by people. Of course I agree, it is much more expensive system with marginal benefit over just using paper ballots to begin with.

Re:no its not

[Anonymous Coward]

And we need a bunch more laser beams in every precinct so we can finally detect Tom Cruise when he logs into the computer while suspended from the ceiling! Better yet: sharks with frikken laser beams

Re:no its not

[Rakishi]

Of course they would be countable by people by my point is that a full recount would be done, by default, by machines. Now you could test the machine counts with random hand counted samples and so on. However you can do the exact same thing with a fully electronic system that has paper ballots. In either case you'd have a machine in charge of the ballot counting with a hand recount (or count by different companies machine) if discrepancies were found except that in one case you'd waste a lot of time (and money) on intermediate steps. Hand ballots and mass hand recounts on the other hand have tons of counting problems and errors of their own, see Florida for example.

I don't see any system that is better than an open electronic count with medium scale random machine recounts and smaller scale hand recounts for verification. Three levels of verification by three parties and machines from two separate companies. If discrepancies show up (including those against voter counts before the voting which are logged using a third separate system) then a full scale recount is done, machine counting with hand verification once again (unless the machine counting system had problems itself).

Re:no its not

[Anonymous Coward]

You wouldn't even have to count them all on the first pass. You could have the counting machine count the ballots in sets of 300, injecting separators and giving you the vote breakdowns for each set. Then randomly select the greatest of some minimal number / percentage of the sets (i.e. greatest of 25% or 5 sets per polling machine) for manual verification using the rotating auditor pairs someone else mentions.

You would want to make sure that the manual counting auditors don't get to know what the computer-calculated number is and that a different pair of auditors compares the manual and electronic counts. That would catch any hanky panky without needing to manually count every ballot. Just make sure your random generator is physical (not pseudo-random) and macroscopic (i.e. double coin flips). Some QA statistical expert can probably recommend what the best number is but it might be as low as 10% of the total vote counts in higher density urban areas.

That way you get to catch both deliberate tampering and bugs that might have been added in the latest code revision.

Re:no its not

[RobBebop]

Touchscreen, vote, hit done, the machine prints a paper ballot. You review said ballot and deposit the paper ballot in the ballot box.

What could be simpler and less prone to manipulation or error?

if (input == "John Kerry") {

    rand(time) > 0.9 ? vote = "George Bush" : vote = input;

}

With proprietary code, this type of tomfoolery could switch the vote, but still echo the voters proper selection on the slip of paper... unless a manual recount were conducted (and found to be off by 10%!!! or if the code was available to inspect).

Honestly, in addition to code being available... the person loading it must not be paid by the vendor in any way, and must compile and load it onto the voting machine him or herself. Having an open standard that could perform white/black box testing wouldn't be bad either.

Re:no its not

[Mattintosh]

Most results are in by the 11 O'clock news.

Here in the midwest, we have you beat by an hour. We get it on the 10 o'clock news.

Re:no its not

[Kadin2048]

Simplify the architecture as far as possible. Like, 1980s architecture simple. Publish all the code publicly, so as many people as want to can comb over it. Make the 'bootstrapping' of the compiler chain a public event, open to observers. Use a hardware design that's as simple as possible, using parts that are old and widely understood. Make one single, standard reference design, and test/audit the hell out of it. Allow opposing political parties to act as observers during the election and vote-counting process. Keep an audit trail and make that public, too.

Alternately, just use pencils and learn to be slightly more patient than usual. The whole desire for electronic voting is due to a desire for immediate gratification and a pointless requirement to have the votes tallied on the same day as the election. It's stupid; voting is the most important thing in our government, if it takes a week, it takes a week. Democracy functioned without e-voting; we're just making the system more opaque than it needs to be.

Re:no its not

[Torvaun]

Still won't stop Micah.

Nathan Petrelli for President!

Re:no its not

[Anonymous Coward]

I would rather see voting platforms built on microsoft trustworthy computing platforms without code review of the platform part of the system than built on a platform where I cannot be sure what code is running.

The problem is that believing in a "trustworthy computing" closed source OS is about as smart as handing out ballots that are prone to hanging chads.... the MS closed source trustworthy computing initiative is a sure way to create a hole ridden insecure OS and software that uses the insecure OS file system services. Because the windows OSs rely on an already hacked closed source FS it is only a matter of time before windows Vista and the MS server kernel gets hacked big time. That is why they gave up on trying to release a new fs for their NT series of kernels. The windows kernel(s) are far too dependant on certain fs routines that are really weird compared to other file systems like the IBM or Sun FS.

You can bet that the Linux nt3g project is a prime target of the patent fud that MS is currently dishing out. (remember the fuss when MS announced that it was going to charge royalties for the use of the FAT http://www.theregister.co.uk/2004/06/14/ms_fat_pat ent_reexamined/ fs?) Realising that their prime file system has been hacked must have really spooked the shit out of the suits and programming leads in Redmond. Maybe giving Linux read write access to the prime core operations of Windows was a mistake. But then again it was better that the white hat Linux coders did it first anyway. Even Steve Jobs must be pissed at this because he has to pay for the same thing!

Re:no its not

[stony3k]

Which is why I like the voting machines used in India - they're very simple and basically just counting machines. That makes it easier to verify that the code is secure.

Re:no its not

[Paradise Pete]

after all the paper ballots are of high quality and likely designed specifically so a machine can count them. But since we know its a law of the universe that only voting machines not vote counting machines are susceptible to abuse there is nothing to worry about at all.

If it sorts them into piles it's easy to do quick spot-checks simply by weighing the piles.

Re:no its not

[edwdig]

Most non open source software licenses have a clause like that. It's just a "it's not my fault if something really bad happens" thing. Unlike the GPL, the MS EULA doesn't go quite as far as to disclaim all warranty and responsibility - just most of it.

Re:no its not

[scatters]

The Royal Navy's Windows for Warships progam probably counts as both a critical application and one where people's lives are at risk.

e.g.

Prompt: An inbound missile has been detected that could hit your ship (time to impact: 15 seconds). Allow or Deny?
User: Clicks Deny.
Prompt: Are you sure (time to impact: 13 seconds). Yes or No?
User: Clicks Yes.
Prompt: Anti-Missile Counter Measures Application has encountered a problem and needs to close - we are sorry for your impending destruction. Send error report to Microsoft? Yes or No.

Re:no its not

[Phroggy]

Designing an intuitive user interface that your grandmother can use without assistance requires a LOT of attention to detail and is much more complicated than what you've described.

Re:no its not

[Anonymous Coward]

But platform code that is obtained from a third party vendor should be acceptable provided that it is widely used as a general purpose platform and there is a reliable demonstration that the code has not been modified.

You're obviously aware of the possibility that the platform the voting machine is running may not be the same platform everyone else thinks it is running, but how do you suggest the vendor can "demonstration that the code has not been modified." without providing the source code?

A signed note from Bills mom?

Re:no its not

[complete loony]

Banks have got great machines for counting money. If you want to automate any part of voting, automate the counting process. Just try to reduce the risk of mis-counting votes.

Re:no its not

[Nazlfrag]

But platform code that is obtained from a third party vendor should be acceptable provided that it is widely used as a general purpose platform and there is a reliable demonstration that the code has not been modified.

Like, for instance, providing the source code for analysis?

Re:no its not

[urbanradar]

Designing an intuitive user interface that your grandmother can use without assistance requires a LOT of attention to detail and is much more complicated than what you've described.

For comparatively complex tasks like word processing, e-mail and web-browsing... perhaps. But for a system that is only used for answering simple questions? You only need a "yes" button, a "no" button, a number pad and a text-only screen for that. You'd have to try pretty hard to make *that* interface overly complex. It's about as complex as your average standard-issue fixline telephone. If that's still too hard, issue some documentation to voters beforehand. Shouldn't take much more than a page.

Re:no its not

[maskedau]

I got two words for ya. Open Source.

Re:no its not

[probablyandy]

There is NOTHING wrong with a paper vote other than taking so long.

I tend to agree that paper is safer than electronic voting, but a pure paper and pencil ballot (e.g., checkboxes on identical anonymous sheets of paper), are not completely safe. Someone could stuff the ballot box, for example. Even if they are caught, it may be difficult to distinguish the real and fake ballots. Forcing a new election is often infeasible and probably a win for the attacker.

Re:no its not

[xrobertcmx]

Like Windows for Warships?

Re:no its not

[Old Benjamin]

if its only printing out onto paper, then wouldn't it be really easy to print ballots out at home, and bring extras? what if they were ripped? folded? smudged? not to mention it would be expensive to print a piece of paper for over 150 million people easily, and the ink.

Re:no its not

[Ex-MislTech]

microsoft trustworthy computing platforms

For a minute there I thought this was a joke...

Re:no its not

[u8i9o0]

There's a better system than that - your vote is stored in a database, but your vote is also printed out for you to review. You then put the paper in a box that is kept under lock and key. For quick results, the database count is the one that is looked at. However, any third party can request to count the paper votes and compare them to the database count. If they do not match, then there is a physical audit trail to show that someone was monkeying with the software. This way, we get fast results, and verification.

Trust, then verify, is the solution in this case.

That requires that the auditing process be changed. Currently, an audit only occurs if there is a closely contested election - when the leaders in a race have a nearly identical tally. For example, the 2006 Sarasota (FL) vote was audited only because one race (US Congress) was close (about 400 votes difference) and only then did they notice that 18,000 people (~13%) did not register a vote for that race while the US Senate race had no such non-votes. Of course, in that case the audit was just looking at the same tally twice, since there was no other record. My point here is that they probably never would have noticed if the results were not close.

To exploit this, make certain that an audit never occurs by adjusting the totals to offer the 'winner' a comfortable lead. A landslide may prompt scrutiny, so some balance would be required. Given the voting history of a district it would not be difficult to undermine the system in this way.

Mandated audits would defend against this exploit, but that's not how it currently works.

Re:no its not

[mrchaotica]

Bullshit! We're talking about picking a choice from a list, not AutoCAD or something! I mean, you don't even need an operating system for that (see e.g. GRUB).

Re:no its not

[BlargIAmDead]

If it's simple enough it shouldn't have to be intuitive. I think what the GP was talking about is a simple "put your mark here to vote for this candidate" with a possible "straight ticket" option at the top. Seperate all these options onto different pages with large letters at the top to show you what you're voting for and viola. Insta-election. And I also hate to sound like a jerk but if someone doesn't have the....mental capacity, acuity, or flexability to use whichever system is in use, they shouldn't be voting. I would tell my own grandmother this much less someone else's. The addendum being that if the system is so complex that the majority of people can't use it then you should change the system. You can only make things so simple before you're in the booth with them voting for them.

A small victory ...

[WrongSizeGlass]

... in a long battle for transparent eVoting, but I'll take it.

Sucks to be MSFT...

[Penguinisto]

...or any other proprietary vendor.

Sorry Steve, Bill - but some of us want to see what these things actually do when we use 'em to cast a vote.

Meanwhile, I'm damned sure that somebody in Diebold went all Ballmer on the furniture... though I can't wait to see their source code ; I'm sure it's gonna be worth some huge laughs @ your nearest code-monkey pit, punctuated with lots of sounds along the lines of: "WTF were these asshats THINKING!?".

/P

Re:Sucks to be MSFT...

[Kalriath]

You sure as hell wont be seeing it. It'll be shown to a couple of high profile professional auditors who will give it the green or red light, and that's that. At NO point will the public see it.

Re:Sucks to be MSFT...

[Penguinisto]

You sure as hell wont be seeing it. It'll be shown to a couple of high profile professional auditors who will give it the green or red light, and that's that. At NO point will the public see it.

Not even with a FIOA - like request? I'm sure New York has to have some sort of public records transparency law.

/P

Re:Sucks to be MSFT...

[Kalriath]

Not even then. The code will not be visible to us regular people, period. You might be able to read the results of the audit, but that's it.

Re:Sucks to be MSFT...

[Alien Being]

Yeah, Dick Cheney can probably hook them up with some old Anderson/Enron crooks.

Re:Sucks to be MSFT...

[Anonymous Coward]

No, just sucks to be a Voting Machine vendor whose system uses Windows. Sorry, boys, looks like you can't sell your machines to New York.

Glad to see NYS grew a pair...

[Coopjust]

After that amendment passed, I was worried about NYS letting this fly. I'm glad to see that the legislators are attentive.

The real question is: What does Microsoft have to hide from election officials?
-Are they worrying that the source will be leaked?
-Due to the above fear, is MS afraid of getting crap from the DRM loving media cartels?
-Is there something in the code that MS doesn't want seen?
-Are they afraid this mentality hurts the "security through obscurity" idea?

Of course this is all speculation. I'm just so curious why Microsoft is so opposed to sharing their code with a state government.

Re:Glad to see NYS grew a pair...

[Coopjust]

...and, of course, by "passed", I mean "proposed". That's what happens when you spend more time rambling then proofreading. X(

Re:Glad to see NYS grew a pair...

[The Warlock]

Microsoft doesn't want to put the Windows source code in escrow because if they do, it will hit everyone's favorite Swedish website the very same day. They aren't stupid. They know that some near-minimum-wage state employee would jump at the chance to leak something like that, damn the concequences.

That said, sucks to be them. We need to see all the code that's in any computerized voting machine. If they can't afford to put their source code in escrow, sucks to be them. They can either write something from scratch for voting machines or just leave the whole field.

Re:Glad to see NYS grew a pair...

[WrongSizeGlass]

I'm no fan of MS in any way, shape or form, but I can completely understand their reluctance to hand over their source code. In this day and age there is a good chance that it would be leaked faster than you can say BitTorrent.

If the price of admission into the eVoting game is handing over their source code then they made a wise business decision. It's far too small of a market for MS to chance exposing Windows source (and all the security breaches that would soon follow). In the big picture of things, MS made the right decision. That aside, they still suck for trying to sneak that amendment in.

Re:Glad to see NYS grew a pair...

[MightyMartian]

This has been my feeling all along. To be honest, I doubt Microsoft really gives a damn, precisely because it's such a small market. But the fact is that some guys out there have written voting software on their platform. I don't really blame Microsoft for this one. I blame the lazy turds who wrote the voting software. Now they're going to have to seek out a platform that they will be able to put in escrow.

Re:Glad to see NYS grew a pair...

[DragonWriter]

To be honest, I doubt Microsoft really gives a damn, precisely because it's such a small market.

I bet they do, because the more access to source code becomes a recognized priority in the public sphere (and while e-Voting is the hot area right now in the US, policies with a much broader scope, and requiring more than disclosure, have been implemented elsewhere, so MS certainly sees the threat that this could be a wedge in the US) the less advantage Microsoft is going to have over open source alternatives, which in many areas are now its biggest competitors.

Re:Glad to see NYS grew a pair...

[MightyMartian]

The worst case here for Microsoft is that New York State refuses to allow any voting machines that run Windows. New York State isn't going to force Microsoft to anty up the code to Windows, unless Microsoft decides that they do want to be part of an incredibly small and specialized market. Microsoft is making a declaration of principle here, and one I don't blame them for. The people who are going to be on the hotseat are those companies who are running their voting software on top of Windows.

Re:Glad to see NYS grew a pair...

[drinkypoo]

The worst case here for Microsoft is that New York State refuses to allow any voting machines that run Windows.

You are thinking way too small here.

The worst case for Microsoft is that this is the first step towards all government computers being forced to run freely auditable code. That means no Windows.

This is frankly the only responsible thing to do from a security standpoint, and barring illegal collusion we would probably be there already.

Re:Glad to see NYS grew a pair...

[Anonymous Coward]

I don't thing there's any "big secret" or "really dodgy code" lurking in there.

I think they're fighting this for 3 reasons:
- as a corporate entity, i.e. at the upper levels, Microsoft has this conception that IP in general, and source code in particular, is their crown jewels and their sister's virginity, to be protected at all cost. Remember billg whiney "open letter to hobbyists", remember that Microsoft was built on the source they kept out of IBM's paws. This is quite visceral - which is why they did everything the MPAA and RIAA was asking for in Vista - but that's another topic.
- they don't want to open the floodgates by accepting that under certain circumstances they would release code. Otherwise militaries and security agencies, then governments, then corporations would ask for it.
- at the same time, they don't want to stay out of that market, not because it matters financially, but because they still have the ambition that all computers will one day run windows.

Re:Glad to see NYS grew a pair...

[The Warlock]

Please. "Illegal collusion"? Have you ever actually worked for the New York State Government, in an IT role or otherwise? I had an internship for a while (in a department that will remain nameless, since I don't know if I'm supposed to be talking about this). It isn't collusion, so stop the conspiracy theory bullshit. It's pure laziness. The desktop stuff has been running on Windows since before Linux was a viable platform. They pretty much rely on Lotus Notes because it would be too much work to shift anything over to a better system, and there's a whole bunch of little windows-specific custom programs that nobody wants to re-code.

"Illegal collusion". Right. Pull your head out of your ass and stop assuming malice when incompetence combined with apathy is the obvious answer.

Re:Glad to see NYS grew a pair...

[garcia]

In this day and age there is a good chance that it would be leaked faster than you can say BitTorrent.

Too bad we're even having this discussion in the first place. The devices are not necessary as pen and paper work just fucking fine. Since the morons at the state and federal levels believe these pointless machines are good then they should have been all open and presented to the public (even via BitTorrent) for comment.

That wouldn't make for good drama though.

Re:Glad to see NYS grew a pair...

[poopdeville]

Well, the real worst case is the complete and utter destruction of the universe immediately after you read this post. But, like your prediction, it is an unlikely case.

Re:Glad to see NYS grew a pair...

[ratboy666]

Complete bullshit.

If that was the concern, Microsoft wouldn't trust its OWN employees. The "web of trust" MUST be extended to electoral overseers.

And, if Microsoft doesn't want the software 'vetted, the election machines simply cannot be based on Microsoft software.

In order to maintain secrecy -- all copies of the source can be tagged (an example is to add a pattern of whitespace to the code). If a copy leaks, it can be traced back to the source. At that time, damage can be assessed.

So, whatever.

Re:Glad to see NYS grew a pair...

[Anonymous Coward]

Absolutely. The LAST thing Microsoft wants to see is "no security through obscurity" become a widely-accepted premise among lay people. If their OS can't be trusted to count votes, why in the world are we trusting it to handle the President's email?

E-voting is a small market, but selling Windows to the government is probably one of their largest profit centers. They don't want anyone to start spreading the obvious fact that half the government is running on an OS written by people without any security clearances whatsoever, some of whom are likely Chinese nationals.

Re:Glad to see NYS grew a pair...

[Anonymous Coward]

all copies of the source can be tagged (an example is to add a pattern of whitespace to the code). Yes, because leakers don't know how to use a code beautifier.

Re:Glad to see NYS grew a pair...

[Kalriath]

No, but I've seen strategic misspellings used as an identifying feature of code before. "Your honour, I KNOW he leaked it because 'fuck' is spelled as 'fcku' in that comment!"

Re:Glad to see NYS grew a pair...

[Paradise Pete]

...in a department that will remain nameless

I'll bet they had trouble getting their mail.

What I want to know..

[jcr]

Is why the HELL anyone is trying to build a voting machine around an unsecureable platform in the first place? If these vendors want to sell systems that have specific requirements for auditability and securability, they can either comply with the requirements or fuck off.

-jcr

Re:What I want to know..

[WrongSizeGlass]

Is why the HELL anyone is trying to build a voting machine around an unsecureable platform in the first place? Because you can't rig an election if the voting machines are secure.

Re:What I want to know..

[JoeCommodore]

A) Its cheaper and faster (more profit)
B) Nobody has complained (much) before about it
C) They don't really posses the skillset to do it properly
D) Because someone ignorant of the above, probably paid them to.

Re:What I want to know..

[jimicus]

You have a point, but you're not thinking like a government.

AFAICT, government officials - at least the ones tasked with dreaming up projects like this - don't know the first thing about technology. All they see is a magic black box that can count votes a lot more quickly and easily than a bunch of people can, so "magic black box takes votes and counts them" is about the only thing on their list of requirements.

You or I or anyone in IT knows full well that the "magic black box" that people consider their computer to be could be doing literally anything inside. If the person who programmed it wanted a specific party to win - dead easy. But the government official probably never even considered the possibility that the "magic black box" they were commissioning might not return complete and correct numbers.

Re:What I want to know..

[bhmit1]

Is why the HELL anyone is trying to build a voting machine around an unsecureable platform in the first place?

I suspect the answer is "that's business." Companies don't always get the best programmers, and programmers use what they know. The technical requirement to be secure was likely never considered, but rather user friendly enough for the retiree old manning the machine and profitable enough to make a business out of it.

What I want to know is why the states don't band together, form a group to write the application on a hardened OS (MS is good enough for some DoD requirements, but so are a lot of other OS's), and place it under and open/public license for their citizens to be able to review. We can significantly reduce the cost to our voting budget by only purchasing hardware instead of the hardware, software, a markup (businesses are in it for the profit), and training costs associated with multiple companies offering these products.

Re:What I want to know..

[Anonymous Coward]

What I want to know is why the states don't band together, form a group to write the application on a hardened OS (MS is good enough for some DoD requirements, but so are a lot of other OS's), and place it under and open/public license for their citizens to be able to review.

Because if they did that, the political opponents of whichever politicians made that decision would accuse them at the next election of having wasted taxpayers' money developing expensive software that they could just have bought from existing vendors. And guess who would be only too pleased to pay for those campaign ads?

Why settle for less?

[Anonymous Coward]

> But platform code that is obtained from a third party vendor should be acceptable provided that it is widely used as a general purpose platform and there is a reliable demonstration that the code has not been modified.

I disagree. I remember the backdoor !seineewerasreenigneepacsten password that sat in the IIS codebase for... how many years was it again?

> I would rather see voting platforms built on microsoft trustworthy computing platforms without code review of the platform part of the system than built on a platform where I cannot be sure what code is running.

I would rather have both and I can see no good reason not to demand both! Besides, it's not like they can't use BSD if they really want to. You can write GUIs for things other than Windows, you know.

Re:Why settle for less?

[Anonymous Coward]

Insightful? Check your memory, " !seineewerasreenigneepacsten " was not a backdoor password...

http://news.zdnet.co.uk/itmanagement/0,1000000308, 2078460,00.htm

Re:Nothing to see here. Move along.

[Vulva R. Thompson, P]

I click on them all the time.

It's a deliciously satisfying way of transferring cold hard cash from Microsoft's wallet to Slashdot and Google.

Don't Trust Microsoft With Our Elections...

[Eric Damron]

It seems to me that what Microsoft is asking is that we "trust them" without having earned that trust. Without seeing the code how do I know that there isn't a backdoor?

Microsoft's security record has been dismal to put it politely. I certainly don't want to gamble my freedoms on a company that can't secure its own operating system and a company who has shown flagrant disregard for our laws.

As far I'm concerned Microsoft has shown that it will do almost anything to get what it wants. We don't need the fairness of our elections endangered by a company unwilling to provide transparency.

Re:Don't Trust Microsoft With Our Elections...

[MightyMartian]

I think what Microsoft is saying is "We're not going to give your our source code." E-voting is such a small market that it's not worth their time. I'm no fan of Stinky Ballmer and Co., but on this one, I don't blame them. This wasn't a fight they picked. It was some dumbass software developers who, for whatever reason, didn't ponder the possibility that voting authorities might actually want to know what's going on beneath the hood, all the way down. It's those stupid bastards who you should be directing your venom at.

Re:Don't Trust Microsoft With Our Elections...

[Nasarius]

Actually, I don't really see the problem. Microsoft already releases their source code, or at least large parts of it, to some educational institutions. Why would it be a problem to release it to a government agency, under similar terms?

Re:Don't Trust Microsoft With Our Elections...

[secPM_MS]

Microsoft's software can be configured for high security applications -- otherwise it would not be found suitable for use in classified environments. Consumer - focused feature-rich configurations have a far larger attack surface than minimal hardened configurations. Rich products such as OSX, Linux, and Open Office have been doing no better and in many ways worse than Microsoft's newer products. This does not mean that any of them are suitable for a high assurance application -- none of them are high assurance products.

I assume the Microsoft product in question here is Embedded XP, which would be a reasonable foundation for such an application. When building Embedded XP, the builder should include only the needed components. This is standard for embedded system programming. The real question here is what is the electronic voting machine vendor doing? What is their code doing and what modules are included? What interfaces are exposed? How is the system composed and what are the relevant data flow diagrams and associated threat models?

We have trained the world to know and love GUI's. If you are trying to build a high assurance target, you would have a much easier time doing so with a text-based approach. Once you start going down that road, you soon realize that your assurance objectives are starting to get in the way of useability. Having something that is high assurance, but unuseable by a significant fraction of the population is unacceptable as well.

Using paper ballots which are then scanned is a more robust solution in that it allows examination of the original ballots and provides support for recounting.

Re:Don't Trust Microsoft With Our Elections...

[Kalriath]

Actually, governments can get the ENTIRE source code. The NY state could probably ask the federal government to review such things as ntoskrnl.c and green light it for them, since they probably already have it.

Re:Don't Trust Microsoft With Our Elections...

[TENTH SHOW JAM]

Question is, how long will it take to code the voting software using GTK librarys? If they did that, then multiple paths of already available and scrutinised software becomes available. The voting machine manufacturers don't deserve my sympathy on this one. MS can keep it's code secret. Whilst BSD, GNU/Linux, xorg and (my|postgres)SQL are available as stacks that will do the job, this problem comes down to bad design.

Re:Don't Trust Microsoft With Our Elections...

[MightyMartian]

I agree completely. There are no lack of open source alternatives out there. I simply won't bash Microsoft for an issue which really isn't their fault. If I owned a propietary operating system and New York State demanded that I turn over the source code because some potential e-Machine suppliers are running their software on it, I'd probably do a quick mental calculation as to the risk of a few hundred or thousand Windows seats not being sold versus the risk of some civil servant leaking my code. Now maybe the latter isn't much of a possibility, but even at the assessment of a low risk, the potential profit loss is so miniscule that there's no reason at all for me to co-operate.

Re:Don't Trust Microsoft With Our Elections...

[Eric Damron]

"This does not mean that any of them are suitable for a high assurance application -- none of them are high assurance products."

I guess that depends on you definition of "high assurance products." If you mean products that are stable enough to be used in critical application I would say that embedded Linux is way more stable than Microsoft's offerings.

"We have trained the world to know and love GUI's."

If by "we" you mean Microsoft I have to disagree. XWindows on Unix and Apple products were doing the GUI thing way before Microsoft. Microsoft's dominance only came about because Microsoft chose to stab IBM in the back with regards to OS2. OS2 was by far the superior product.

Re:Don't Trust Microsoft With Our Elections...

[Eric Damron]

"his wasn't a fight they picked. It was some dumbass software developers who, for whatever reason, didn't ponder the possibility that voting authorities might actually want to know what's going on beneath the hood, all the way down."

The fact that a third party used a proprietary OS isn't Microsoft's fault. The fact that Microsoft came in with a resolution that would gut a bill designed to give transparency to the process IS Microsoft's fault. I find that action more offensive than the use of a closed source OS in voting machines. The manufacturer of the voting machines may not of realized how stupid their decision was but Microsoft knew all too well what it was doing.

I wouldn't trust a company like Microsoft for one second when it comes to ensuring fairness. Fairness is a subject they know nothing about.

Re:Don't Trust Microsoft With Our Elections...

[secPM_MS]

By we, I did not mean Microsoft. I first worked on a GUI on a Xerox Star in 82 when I joined Siemens Research. The SW researchers were working on windowing systems on Perq's at that time. Apple picked it up from Xerox.

Open Source Voting Machine?

[Anonymous Coward]

Why isn't there an open source voting machine?

It should be constructed of off-the-shelf parts and it should run open source code!

Re:Open Source Voting Machine?

[ChatHuant]

Why isn't there an open source voting machine?

It should be constructed of off-the-shelf parts and it should run open source code!

I'd be careful about what "off the shelf" means, given the requirements of the NY law. You can't really use modern processors - the BIOS, the firmware on the CPU and the firmware on all other components wouldn't be in escrow, would they? Anyway, if you want to be thorough the schematics of all versions of the voting machines, all the chip fabrication masks, the schematics of the industrial tools and processes in all the factories making and assembling the chips and the voting machines should be in escrow as well; an intruder could intervene at any of those steps and create backdoors usable for falsifying the vote. I don't really see how you can control all those factors, so the NY legislature seems fairly clueless (not that that surprises me).

Of course, we need to draw a line somewhere; do we trust Lenovo, or whoever gets to assemble the voting machines themselves? Do we trust the BIOS writer? Do we trust Intel? Do we trust the OS writer? Do we trust the voting software manufacturer? The network provider?

Pen and paper don't seem to have all those issues - why not use those?

Re:Open Source Voting Machine?

[MightyMartian]

Pen and paper don't seem to have all those issues - why not use those?

It's an awfully good question, and one that I think Americans should have been asking themselves since the 2000 election.

Up here in Canada, federal elections are administered by a single Federal body; Elections Canada. That means the ballot you get in Toronto is identical in structure to the ballot you'll get on Baffin Island. There's a single standard for marking and counting ballots. The provinces have control of their own elections, obviously, but tend to follow standards very close to that set out by Elections Canada. Only at the lower levels can things be a little different. In my city, they have vote-counting machines and those ballots where you color in the selections you want. Still, even with that automated system (which has been in use in many jurisdictions in North America for decades) there is still the key paper trail, so that if the election is contested, you can go back to a good ol' fashioned recount.

The only argument I've seen against pen and paper ballots for the US is that, unlike some countries, a lot of different elections get tossed on top of congressional, presidential or state elections. Various local positions, voter initiatives, referrenda and the like get tossed into the brew, so that paper ballots could get to be quite volumnious, and possibly confusing, and I guess there is some advantage there to an electronic voting system which can make display of such complicated ballots much easier.

Re:Open Source Voting Machine?

[foniksonik]

There is... it's called a paper ballot ;-p Can't get more Opensource that that (I'm a fan of electronic voting though... preferably in an election, rather than for American idol)

Re:Open Source Voting Machine?

[Anonymous Coward]

There is just such an e-voting system is Australia. It's called eVACS, is open source, and runs on Linux with off the shelf hardware:

http://www.wired.com/techbiz/media/news/2003/11/61 045

Don't stop at the code. Schematics too

[EmbeddedJanitor]

Since it is more than just theoretically possible to hijack a voting machine via hardware methods, all aspecs of the design should be held for review.

heh... microsoft = hacked voting

[nawcom]

I'm not saying that because it's microsoft it always will have a backdoor or exploit... it's just if you take a look in history - major microsoft release = 20 holes found. i don't exactly have info on how the voting system would work, especially network wise, but i am curious to find out.

i would trust any software or firmware developer over microsoft any day, especially since it would be counting my vote.

Re:heh... microsoft = hacked voting

[Anonymous Coward]

Why are you so worried?
We all know Kang will win anyway.

Re:heh... microsoft = hacked voting

[qzulla]

Hello. I am software developer in Nigeria and I specilize in voting machines. I happy to make your aquantaince.

My boss, the master programer, died....

You know the rest.

qz

That's great and all...

[r_jensen11]

Now don't mod me troll, but remind me again, what is so horrific about paper ballots? I know Florida had a huge fiasco in 2000 with them, but that had to do with punches, not filling in a bubble or anything....

Re:That's great and all...

[WrongSizeGlass]

Now don't mod me troll, but remind me again, what is so horrific about paper ballots? I'm sure there are many opinions on this but I believe a primary problem with paper ballots is: speed. We want the results now, now,

• now

! We don't want to wait until tomorrow or the day after. I could blame the media or the internet or a few other things - but it comes down to all of us (well, not Linux users, their pretty cool, but the rest of us).

We live in an impatient society that doesn't want to wait. Not reading the articles on /. is a prime example (of which I too am guilty from time to time). Now that I read this post, I think I have a case of Linux envy.

Re:That's great and all...

[dnormant]

The amount of time it takes to count the votes. I still prefer a paper ballot as the final count but it would be nice to get the counts quicker.

Re:That's great and all...

[jabuzz]

Rubbish, paper votes can be counted rapidly. Very rapidly if there is a will, just take a look a UK parliamentary elections as an example. They can get the result for a constituency in less than an hour after the polls close.

Basically vote counting has trivial to extract parallelism, and scales very well. The problem in Florida is having a stupid punched card system which is then tried to be counted by machines. A simple piece of paper with a cross, and counted by hand works much better.

Re:That's great and all...

[Anonymous Coward]

Maybe in a tiny borough with very low voter turnout. Less that half the population bothered to vote on Blair's last "victory", other polls, and you're lucky to get a 25% turnout. US polls also have other local items to vote on, it's not just selecting a personality like you muppets do in the UK.

So spare us the limey snaggle-tooth BS please, it smells more that your halitosis.

Re:That's great and all...

[Max Littlemore]

We use paper counting in Australia. We also have compulsory voting. If you don't vote, you get a fine so we tend to have high turnouts. We also get preliminary election results within a few hours of polls closing. Of course final results take longer, due to absentees, etc.

I mean I understand you're just trolling and all, but really, everything you posted was total bullshit. Even that bit about how Americans vote on issues, and Brits on personality! Hahahahahahahahahahahahaha.

Hahahahahahahahahahahahahahahahahahahaha

Re:That's great and all...

[AaxelB]

I think he was referring to how the Brits vote for a party rather than for individuals, and each party gets their share of seats in Parliament (I think). On a ballot in Britain, I infer, you basically choose a party and you're done. In America, you can just pick a party, but lots of people pick and choose for each office and have a mixed ballot. Also, I don't know how it is in Britain, but in America there are many more things on a ballot than just elected officials, like sometimes amendments or propositions and also more local officials and issues as well. So Americans vote on those issues on the ballot specifically. In summary: on a single American ballot, you vote on a bunch of things, including issues. In Britain, you pretty much choose the party (based on its personality, maybe?) you like best, at least in the general election.

Note: I have no personal experience of any voting systems, because I am freshly 18 and have never voted, so if any of that is glaringly wrong, please do forgive me.

Re:That's great and all...

[qzulla]

The amount of time it takes to count the votes. I still prefer a paper ballot as the final count but it would be nice to get the counts quicker.

Why? Why would you want it faster? Who cares if it takes a few days to do an accurate count? Only FOX and the ones that report inaccurate results during the election.

But really. What is your reasoning here? Why do you need to know RIGHT NOW who won other than bragging rights and bets?

I'm willing to wait, oh, a week or better as long as it is an accurate count.

qz

Re:That's great and all...

[CastrTroy]

Especially when the vote is in November, and the inauguration isn't until January. There's lots of time to count votes there.

Re:That's great and all...

[pjviitas]

You have over 300 million people to do the counting...figure it out.

I am a little disappointed at this since up here in Canada I have always admired how ingenious Americans are.

I realize that this is what may be driving your quest for a different voting solution however, with something as important as this wouldn't it be better to stick with a tried and true solution?
Hedghog

Re:OSS doesn't solve security issues

[Anonymous Coward]

Yikes, dude! No more caffeine for you today ... and maybe cut back on the sugary snacks too.

I don't want to rain on everyone's parade but.....

[putch]

the legislature didn't actually "reject" it. they just didnt pass it. and yes, they concluded their regularly scheduled legislative session last week. BUT, they're expected back for a "special" session in July, and the governor has implied that he will call them back several times.

students of the NYS legislature will also tell you that the "special" sessions tend to be when the sneakiest things go on in NYS because, in general, they garner less attention and most of the legislators just want to make it as quick as possible and get back to their families.

that being said, NY does have a very strong voting rights coalition with a number of very smart and talented people working very hard to make sure that this DOESNT go through.

one good thing did happen at the end of session. is that NYVV's (New Yorker's for Verified Voting) Bo Lipari (who's been leading the charge AGAINST microsoft's lobbyists) has been granted a seat at the table. the citizen's advisory board now has statutory authority. which means that when the board of elections makes decisions about this stuff he's got a seat at the table to help shape the outcome.

Not too far removed

[HumanSockPuppet]

Wouldn't be surprised if MS tried to consolidate voting procedures the same way they have tried to do with the entertainment market.

"New to the Xbox Live Marketplace, vote for your favorite U.S. Presidential Puppet in the new 'Red Vs. Blue' civic action feature."

Re:Not too far removed

[revengebomber]

"New to the Xbox Live Marketplace, vote for your favorite U.S. Presidential Puppet in the new 'Red Vs. Blue' civic action feature."

No doubt, someone would complain because it wasn't "Red Vs. Blue Vs. Nader".

Don't knw what version of Windows

[Utopia]

these voting machines use. But if they are based of Windows CE 6.0 then the machine vendors have nothing to complain.
Windows CE 6.0 source code is available under a shared source code license.

If they are indeed using CE 6.0 then vendors not releasing code are just using Microsoft as a ruse to protect access to their own code.

Voting machines should be open

[Cracked Pottery]

Open architecture, open source, public. There are ways to secure the verification of the vote, and more importantly, the counting of the vote. People are always going to try to cheat elections. An individual can steal a limited number of votes, but a dishonest supervisor of elections, or Secretary of State, can cheat in the tens of thousands. A consortium of universities should design and program the voting system in the open, with off the shelf parts. All of the elements are part of a very mature technology for which there is no justification for any proprietary claim. There is always pen and paper and a mix of human eyes. That is too damn simple, I guess.

Windows for Classified

[DragonHawk]

Microsoft's software can be configured for high security applications -- otherwise it would not be found suitable for use in classified environments.

Every AIS (Automated Information System, the NSA TLA for "computer") I've ever seen running a Microsoft OS that was also processing classified information ran in "system high" or "dedicated" mode -- where you treat the whole system as classified, only let cleared people touch it, and lock the whole thing up. The security of the OS is practically inconsequential. MS-DOS can be, was, and likely still is used in this way.

I'm not saying you can't secure MS Windows (well, not in this post, anyway); I'm just saying "It's used for classified processing" isn't a good argument.

Re:Windows for Classified

[secPM_MS]

All single level OS's run in system high. Systems intended for use with sensitive data have to be appropriately configured. In the past, you started for this by running the hisec template with the security configuration editor to reset system ACL's and permissions. Microsoft publishes very lengthy security guides that allow security administrators to appropriately configure systems. One of the most important issues is to have users run as normal users without administrative privledges. There is a definite tradeoff between security and functionality. In the Vista security guide there is a chapter titled "Specialized Security - Limited Functionality".

I am writing this from a notebook that is running a beta of LongHorn Server. As a standard server, I do not have the client UI -- it looks rather like Win 2K (no glass, sidebar, or media support). My account is not a member of the admin group and IE is in locked down mode. It is quite secure. It is also faster.

There is a virtually universal tradeoff between functionality and security. With attacks moving from the OS to the user-space apps, we are seeing wide ranging compromises of sensitive user data without associated system compromise. The issue in this thread concerns the quality of the voting machine code itself.

Third parties do have access to the Microsoft source code. The evaluation laboratories that do the Common Criteria evaluations have essentially unlimited access to internal documentation and source code (under appropriate non-disclosure).

Re:Windows for Classified

[DragonHawk]

Systems intended for use with sensitive data have to be appropriately configured.

"Appropriately", yes. For example, on Win XP, you need to enforce the use of strong passwords. But for, say, a Win 98 or DOS box, there's really not much to do, except make sure you lock it up when you're done. Which was my point: If a Win 98 box can be approved to operate in a classified environment (and it can), your original statement ("Microsoft's software can be configured for high security applications -- otherwise it would not be found suitable for use in classified environments") is not valid.

The rest of your post is interesting, but not really relevant to that point. I did want to respond to one other thing, though:

In the past, you started for this by running the hisec template with the security configuration editor to reset system ACL's and permissions.

While that's a good idea, and something I recommend, it's not required per NISPOM or the DSS CTG. That's the NISP world, though. Other CSAs have different requirements.

Paper ballots

[Nick Driver]

There is NOTHING wrong with a paper vote other than taking so long.
Oh yeah? What about the honesty of the people who are counting those paper votes.

Ballot-stuffing and outright deliberate miscounts can and still do happen with paper votes. Even right here in the USA, and even right here in my home state of Texas not that very long ago.

Re:Paper ballots

[timmarhy]

thats why you don't trust them, and make them count in pairs with strict oversight, rotating the pairs and doing random checks. clearly you know nothing of how they count ballots.

Re:Paper ballots

[Kadin2048]

What's your point? If the election staff are compromised, then no voting system in the world (at least as long as you want one that's anonymous) is going to save you. An electronic system certainly isn't -- in fact it's going to make vote-tampering that much harder to detect.

Oversight and complete transparency are the only weapons against corruption.

Re:Paper ballots

[lawpoop]

The thing with paper ballots is that attempts at fraud leave a much wider trail of evidence. There are more people involved, You know that boxes of votes are missing, or you can actually determine if particular ballots are a result of stuffing by examining them. And you can count the again, leaving out whatever fraudulent ballots might exist.

The fact that you can point to clear cases of paper election fraud shows the resiliency of this system.

Meanwhile, it is within the realm of possibility that the electronic systems that were used in the 2000 and 2004 elections could have all been hacked, remotely, by a single individual, leaving no evidence of election fraud other than the results not matching the exit polls. And the debate about whether or not the 2004 elections were stolen continues.

Re:Paper ballots

[edwdig]

Oh yeah? What about the honesty of the people who are counting those paper votes.

Every voting system's weakness is the people who read the results. The best you can do is make it hard for them to get away with reporting the wrong results.

Re:Paper ballots

[ultranova]

What's your point? If the election staff are compromised, then no voting system in the world (at least as long as you want one that's anonymous) is going to save you.

Wrong. A system which can be monitored by anyone at any stage will save you.

1. Bring the box which will contain the votes to the election room. Display to everyone within that it is empty, and seal it. Do all this in front of the public.
2. Provide seats for anyone who wishes to remain in the election room and keep an eye on the box for the entire election.
3. After the votes have been cast, open the box and start counting. Again, anyone who wants can sit behind you and see for themselves that you'll counting the votes correctly.
4. After the local votes have been counted, phone the central location and tell them what you got. Then hand over the phone to any member of the public present so they can talk to their associates there so those associates can make sure that the votes are correctly added.
5. If neccessary, repeat the previous step to move towards even larger centers.

The voting system should not require trust. Build one where anyone who wants can personally ensure that his vote is included in the totals correctly, and no extra ones appear out of nowhere.

Re:Paper ballots

[jabuzz]

Hum, in the UK all ballot boxes (while still sealed) are taken to a central location for counting under police escort. Any boxes with a broken seal will be put to one side and investigated (most likely rejected). Makes oversight of the counting easier.

Re:Paper ballots

[Anonymous Coward]

And people will argue for 2 days over a single vote that has a smudge which might possibly be a double vote but we can't really tell. So they take it to court and we don't know the results of the election for another year as the entire voting process spirals into an undetermined state because we used something easily screwed up that isn't deterministic..

Paper has major issues, cost being one that is all too often ignored. A simple mechanical system is simply better than paper and nearly as easy to implement as electronic and probably even more secure. I can simply 'twiggle' a paper election by making sure that 'swing' areas end up with less paper, it gets damage, has bad marks on it to begin with or is simply 'contested' over votes that are 'conflicting'.

People have been rigging/messing with Paper votes for centuries and we've never found a way to prevent that from happening without also allowing people to know what YOU personally voted.. which then leads into vote buying and such issues.

Re:Paper ballots

[pjviitas]

This horse has been beat to death so many times I just can't believe it hasn't sunk in yet.

Up here in Canada it doesn't take any longer to count the ballots on election night than it takes in the U.S.

I hear so many people spouting the same old crap about how the U.S. has 10 times as many people and therefore 10 times as many votes blah blah blah without thinking about how stupid this sounds. You have 10 times as many people!!! Use some of them to count the votes!!! I mean use just a little bit of imagination here for crying out loud!!! Living next to you guys and getting to know you a little bit for all these years, I can honestly say that this kind of excuse is simply...unamerican

Regarding the comment about cheating on the vote count I again shake my head. Cheating when counting votes can happen regardless of what system you use. What makes the difference is the paper trail which brings me to my next point. Paper ballots leave a clear paper trail. How much more accountable of a system can you get!!! One piece of paper = one vote...plain and simple!!! And in case you thinking that what will stop anyone from just throwing a bunch of extra paper ballots in the can...you make it so a part of each paper ballot is torn off by the voting booths staff. If these tear aways dont match the number of paper ballots then someone is cheating.

I simply don't understand how something so simple can be made to seem so hard!!!

Hedghog

Re:Paper ballots

[AndrewM1]

Here in Canada, every candidate from the election is entitled to have a rep. present at the counting, to combat this...

Sorry, I missed that...

[msauve]

damn Proxomitron.

Wait a minute; I LIKE it.

[WindBourne]

We may finally get a decent and honest candidate that way.

Re:Nothing to see here. Move along.

[jamie]

You rock!!

Re:Nothing to see here. Move along.

[lena_10326]

I click on them all the time. It's a deliciously satisfying way of transferring cold hard cash from Microsoft's wallet to Slashdot and Google.

And you're also diluting the CPA, which is the real measure of ad performance. http://en.wikipedia.org/wiki/Cost_Per_Action

Of course, you by yourself won't have much impact but there would be if 1% of Slashdot's reader base did.

Re:Nothing to see here. Move along.

[Anonymous Coward]

its not like you are going to buy a site license for IIS through an MS advertisement link. There isn't a shopping cart .NET widget for that type of purchase.

Australian e-voting

[MrKaos]

Well this is good news, but I doubt M$ will give up quietly.

Australia has some e-voting software that is open sourced, http://www.elections.act.gov.au/Elecvote.html also has a link to the source code.

Why is M$ software even on voting machines........

[Joe The Dragon]

Why is M$ software even on voting machine in the first place?
Why is it on ATM systems as well at least there it is more
slot and video Casino games must have there source code turned over the NGC and if windows was being used as the os then that code may have be turned over well. Windows may not even pass the testing need for Casino games as it may crash in the middle of a game. I once had a slot slow down and crash on me and it still slowly finished the bonus round and printed out the ticket then it disabled it self.

This is funny...

[Tuoqui]

Is it just me or are we all over analyzing what is effectively a glorified bean counter.

Sure we want it to be secure and transparent which means Open Source has the best option for this to occur. Anything that is closed source should *NOT* be trusted. This includes the platform/OS the system runs on.

And is it *REALLY* that hard to ask that there be a god damn paper trail? I think just about every single person on /. has agreed that a paper trail is necessary. Anyone including Diebold who refuses to make a machine with a paper trail is definitely up to no good and likely WANTS their machine to be insecure in order to allow for vote stuffing/miscounting/false results/etc... I mean its not like it hasnt been done before.

Re:This is funny...

[Anonymous Coward]

And nobody on slashdot has ponied up the cash to maintain the closed environment areas to store the millions of ballots New York State would produce each time for the dozens of races and other issues being decided on ballots around the state. Nor the cost of transporting them with police protection, or other security features to these secured, environmentally sound locations to prevent tampering before a recount might be called. Or how they will then be destroyed in such as way as to prevent vote marking from becoming a part of the entire race and people buying votes outright.

How complicated could it be?

[twifosp]

I am not a programmer, so maybe I'm way off base here, but how complicated could this code be?

I can't think of any reasons why Microsoft is being difficult here. I can't think of any complex algorithms you'd have to invent and therefore protect to display and count votes.

All you need functions for: Security Wrapper. ID voter. Display Choices. Input Choices Into Database.

How is that going to be so complicated that it needs trade secret protection? Or is the final fucntion like, Collect Choices and Voter IDs into secondary database to be sold to politicians at the highest bidder?

Can any programmers tell us what complicates a voter system so much that microsoft feels the need to protect itself?

Re:How complicated could it be?

[ChatHuant]

I am not a programmer, so maybe I'm way off base here, but how complicated could this code be?

I can't think of any reasons why Microsoft is being difficult here. I can't think of any complex algorithms you'd have to invent and therefore protect to display and count votes.

If I understand the problem correctly (please correct me if not - but I did RTFA, and went to the source, Bo Lipari's blog as well, and also to his organization's web site), the requirement is not for MS to escrow the code for the *voting* software; MS aren't writing it anyway, Diebold and others are. The requirement is that, since some manufacturers of the above-mentioned voting software wrote it for Windows, MS is supposed to escrow all the *Windows* source code to NYC. This is very silly IMHO (from an engineering point of view), but of course reason needn't apply.

Obviously, MS doesn't want to escrow all the Windows source to a bunch of political hacks. This has been presented on Slashdot as an attack by Microsoft on democracy and mum' apple pie, but what I believe is really hapenning is just a local political maneuver, as follows:
The hullabaloo was started by a certain Mr. Lipari who seems to have a complete dislike for any kind of electronic voting. IMHO, he invented this specific requirement knowing it's totally ridiculous. He presented it as defending democracy, and managed to sell it to the public. His intention is rather, I believe, to torpedo the whole e-voting concept in NY by getting ignorant politicians to vote for impossible requirements. Well, good for him - he seems to have succeeded. And if e-voting companies switch to Linux of FreeBSD or Windows CE (or any OS with available source code) he'll then ask for the BIOS, and the CPU firmware, and so on, until they give up.

Re:How complicated could it be?

[Anonymous Coward]

MS is supposed to escrow all the *Windows* source code to NYC

NYS.

NYS != NYC

There is a *very* big difference :).

Re:How complicated could it be?

[revengebomber]

And if e-voting companies switch to Linux of FreeBSD or Windows CE (or any OS with available source code) he'll then ask for the BIOS, and the CPU firmware, and so on, until they give up. Gee, what will we ever do? Possibly get an open CPU core? And make the damn thing simple enough that it doesn't need a huge BIOS outside of the voting software?

They're overthinking this whole thing. Why the hell do you need Windows, or FreeBSD, or a GNU system, just for voting? It's an obscene waste of processing power.

Re:How complicated could it be?

[Alsee]

if e-voting companies switch to Linux of FreeBSD or Windows CE (or any OS with available source code) he'll then ask for the BIOS, and the CPU firmware, and so on, until they give up.

To be honest I don't know much about CPU firmware, but that part about requiring BIOS source code too sounds peachy to me.

-

Re:How complicated could it be?

[TobascoKid]

he'll then ask for the BIOS, and the CPU firmware

SPARC is an open CPU design http://www.opensparc.net/

You should be able to build a machine based entirely on open components, from the CPU, through the firmware to the OS and finally up to the voting software.

Re:How complicated could it be?

[TobascoKid]

simple enough that it doesn't need a huge BIOS outside of the voting software

BIOSes are a PC legacy. It's little more than a crippled boot loader, and all the work it does is thrown away by modern 32 bit OSes. Embedded systems don't use them (they tend to just use a plain boot loader or just use a small, simple OS and skip boot loading entirely, even x86 based embedded systems). Non x86 machines never had BIOSes and tended to have more advanced booting firmware (such as OpenBoot/Open Firmware). It's even slowly dying out on x86 - the Intel Macs use EFI instead.

Re:How complicated could it be?

[Shotgun]

And if e-voting companies switch to Linux of FreeBSD or Windows CE (or any OS with available source code) he'll then ask for the BIOS, and the CPU firmware, and so on, until they give up.

As well he should, as any of those components can completely invalidate any security measures placed on top of it. Furthermore, anything beyond the CPU firmware is pointless and unnecessary. This is a dedicated machine, meant to perform one small, well-defined function. Your car's ECU doesn't run one Windows. Your handheld GPS doesn't need FreeBSD. Why would you want Windows CE on a MP3 player? A BIOS and an OS are nothing more that added complexity that cannot enhance a well designed voting machine.

Re:How complicated could it be?

[ChatHuant]

You should be able to build a machine based entirely on open components, from the CPU, through the firmware to the OS and finally up to the voting software.

You should be able, indeed; and, as another poster says, there is no technical requirement to run voting software on a full general-purpose computer; a dedicated machine would be safer, avoid a lot of unnecessary complication and close a lot of potential holes.

Let me note though that using a dedicated machine, even if it ran completely open software won't close all security issues. As I mention somewhere else, an intruder may intervene during the assembly of the machine (for example, replacing the trusted CPU with a backdoored chip in similar packaging), the compilation of the code (see the famous article on trusting trust), so all those steps will need to be certified. Naysayers like Mr. Lipari will surely attack those potential vulnerabilities if the OS escrow gets somehow resolved. And, in the end, such a dedicated machine and the security-enhanced fabrication will very probably be quite expensive, so Mr Lipari will have a good economic argument for discarding e-voting.

In the end, I think e-voting should happen sooner or later, but the current approach is doomed to failure. You can't trust the current unholy combination of code developed in secrecy by private firms, some of them with known political biases, difficulty of verification by external parties, interested politicians and many other issues discussed here and in other places. Until a well-designed solution emerges, pen and paper are still better - and very probably cheaper as well

Re:How complicated could it be?

[m50d]

Gee, what will we ever do? Possibly get an open CPU core? And make the damn thing simple enough that it doesn't need a huge BIOS outside of the voting software?

Already exists; run it on a sparc with open firmware.

But the US is a federation.

[Ungrounded Lightning]

Up here in Canada, federal elections are administered by a single Federal body; Elections Canada. That means the ballot you get in Toronto is identical in structure to the ballot you'll get on Baffin Island. There's a single standard for marking and counting ballots.

Given that Canada is a single republic and the provinces are divisions of it, that is easy to do.

But the US is a federation of separate republics - the "several states" - which banded together, creating a central mechanism to handle defense, foreign policy, and inter-republic trade.

As such, the elections are the business of the individual states. The federal government only has an interest when federal officials are being elected, the fed is exercising its constitutional mandate to insure that the governmental forms in each of the states continue to be some kind of republic, or some other election-related constitutional issue (such as voting rights) is in play.

So while the Fed gets to make some requirements and veto some things, the states get to make the decisions on how the elections are run. With 50 of 'em and wildly different circumstances among them you get a lot of variation.

Re:But the US is a federation.

[Anonymous Coward]

While you are correct that Canada is a federated state and not a confederation, it looks like you need to learn a bit more about the difference between a Confederation and a federated state and how the US Civil War changed the rules for the USA. There's a reason why the Southern states were called the Confederates, and some fallout from their loss.

So what now?

[Anonymous Coward]

So what happens now? Voting machine vendors have presumably already sold their machines to the local election boards. Now they are required to produce all the source. They can produce their own source, easily, but they probably don't even have Microsoft's code and couldn't legally turn it over if they did. So, are their contracts voided, and the election boards have to scramble to replace them? Or do they get hit with a fine? Or does New York somehow force Microsoft to turn over their code because a third party violated the law?

Risk analysis

[grcumb]

So the only reason someone would disagree with your point of view is that they are paid to do so?

Without agreeing with the rhetorical gist of the GP, I believe the point being made was that the suggestion was so absurd that nobody would put it forward unless they were paid to do so.

I disagree with that premise, but I do agree that obscuring any aspect of a voting system that is being used to decide, among other things, the next president of the United Sates is the height of folly.

Security is risk control, not risk elimination. In this particular case the risk of a trapdoor in the platform code is a lower concern than the risk of the running code being substituted on the final machine.

Risk is measured as a combination of:

• How easy it is to attack using a particular vector;
• What the payoff will be for the attacker;
• What the cost will be to the defender if the exploit succeeds;
• What the cost of securing that vector is.

In this case, the prize is political control of the most powerful nation in the world. So we need to ask ourselves: How much are fair and free elections worth? What, in effect, is the price of the democratic process in the US?

I think it's worth billions of dollars. That means stringent code review, impeccable chain of custody and constant supervision. Saving a few bucks by using an off-the-shelf operating system - especially one that is orders of magnitude more complex than what is actually required - that's absurd, in my opinion.

Re:Risk analysis

[Anonymous Coward]

In this case, the prize is political control of the most powerful nation in the world.

You're talking about China, right ?

Live CD

[Ikester8]

I've always thought that the best way to create a proper e-voting system would be to run open source voting software from a live CD certified by the election board. Networked computers could transmit votes over the Net, and the results would be available as soon as the polls closed. Paper ballots are always a necessity, of course, but in this case, as a backup. Print two: one for the voter, on for the election board.

Re:Live CD

[T-Ranger]

The second copy also makes it easy to take home, and to show to the guy either threating you with the baseball bat, or tempting you with a brown paper bag with rum in it. Good job, there.

Simplify the hardware

[Stephen Ma]

Simplify the hardware; you don't need the latest, fanciest CPU if all you want to do is count.

Buy a batch of Z-80s or even 8080s; they are still being made. The design is so old that it's unlikely to have been compromised; but if you are really paranoid, the circuitry of an 8-bit CPU is simple enough that you could easily verify it by hand. Build a little voting box around one of those chips, and you're done.

The design would take half a year and cost less than a $1 million -- which is peanuts when the goal is to ensure the honesty of a democracy's most important event.

Still missing the problem

[Touvan]

Source code or not, you can't look inside the machine and see what's running on it while it's running. Not ever. It doesn't matter who has access to whatever source code. It's just too easy for a very small number of people (or even just one) to tamper with these machines, and leave absolutely no meaningful trace. Anyone caught up in the source code debate has missed the problem.

Re:Still missing the problem

[Touvan]

Sorry to reply to myself, but isn't it hypocritical to expect a software vendor to turn over their source code, without requiring the hardware makers to turn over their specifications? It would be just as possible (and there's plenty of motivation to do it) to hide malicious vote stealing code in the hardware somewhere. Why this focus on the software only?

Re:Still missing the problem

[tele_player]

I agree completely, and I'll go further. The disadvantages of electronic voting cannot be gotten around - it cannot be trusted. Ever. We don't need it, and it's just another step away from a functional democratic system. We don't need printers and paper trails. We need traditional, diverse, impossible-to-centrally-subvert voting systems. I'm a computer geek - but this is one area where computers do not belong.

Re:Still missing the problem

[revengebomber]

It's just too easy for a very small number of people (or even just one) to tamper with these machines, and leave absolutely no meaningful trace. Build a one-time-programmable ROM into the CPU. Have people verify the source code as it's programmed in. Have the same people follow the CPU as it finds its way into a finished machine. Fill the whole thing in with epoxy when it's all assembled.

Re:Still missing the problem

[JetScootr]

Agreed. At most, tabulating machines to count'em up, simple pulse coded numerical uploads to a central tabulator. But those machines don't even havta be programmable.

Re:Still missing the problem

[Touvan]

The problem with that is that the machines will have to go through a small number of centralized hands, and then get shipped out. And look at how complicated (and costly) that would be, then compare it to hand counted paper ballots (the kind they have standardized in those European democracies). The voting process is simply too important (and too tempting a target for manipulation) to be left in the hands of the few. That said, I'm not apposed to a small number of touch screen machines to be deployed for the impaired, as long as they print a piece of paper that must then be hand counted along with the rest of them.

Re:Nothing to see here. Move along.

[Anonymous Coward]

It would take an herculean effort to suck more then MS.

IBM Wins

[Doc Ruby]

This battle in the NY state legislature was between Microsoft's lobbyists for proprietary voting machines vs IBM's lobbyists to make the machines open and auditable outside the closed certification system that is totally rigged to sell vendor products.

IBM has won this battle. Possibly because it's a NY state based company (Armonk, NY). The trick will be seeing this victory applied elsewhere in the country.

NY is famous for being tough, smart and understanding security. I hope other people in other states are lucky enough to follow our lead.

Just make the database public

[Solandri]

Read-only access of course. But given the size of computer storage nowadays, it should be pretty simple to make the whole voting record publicly available on the Internet.

The voting machine has a public/private key pair. It generates a random public/private key pair in between votes which stays resident only in memory (is not written to disk). When you vote, your votes are coded. It's then encrypted with the voter's private key and the voting machine's public key. The voter's plaintext vote, an index number, the encrypted vote, his private key, and the voting machine's public key are then printed on a piece of paper the voter can take home. The voting machine then stores the encrypted vote and the voter's public key. Nothing else.

When tallying the votes, each machine runs through its stored votes, decrypting the record of encrypted votes using each voter's public key and the machine's private key. All this information is then sent to a central vote tallying database. The unencrypted votes are used for the official tally. The encrypted votes are used as proof against tampering. The index is used to allow voters to query the database.

Once home, the voter can log into the vote tally web site. He can query the database to make sure it's recorded his vote right. He asks it to send the vote recorded with his index number. It takes the unencrypted vote, encrypts it with the voting machine's private key and the public key associated with that index and sends it to him. His computer then uses the voting machine's public key and his private key to decrypt it. If all went well, it should match what's on his printout.

• The system does not record who voted which way. The only way to link a vote with the voter is via the index number and private key printed on the voter's slip, which he is free to shred, eat, burn, whatever. I think it may even be possible to validate that the votes match by comparing the encrypted votes, without ever looking at the plaintext vote. It's been a while since I did the RSA key pair stuff.
• Nobody can tamper with the votes in the database because the encrypted version is encrypted with the voter's private key, and only he has a copy of that key. If someone modifies his vote, they need to use a new public/private key pair. The voter's private key will no longer work against the returned result when he queries the vote counting database, tipping him off that something fishy is going on.
• The voter cannot tamper with his printout to fake vote counting fraud. To change it so his plaintext vote and the encrypted vote match, he needs the voting machine's private key.
• By virtue of the previous two bullets, if there is a discrepancy, you can localize where the problem occurred. The voter needs the voting machine's private key to alter his vote. The vote tallying people need the voter's private key to alter his vote (the encoded and unencoded vote on his paper would be encrypted with the voting machine's private key, authenticating that his printout is genuine).
• Don't do anything stupid like seed the RNGs in all the voting machines with the same seed, so they all generate the same key pairs. Include something like the millisecond the vote was cast in the seed.

The only way I can think of to commit vote fraud against this system would be by stuffing the ballot box with false votes. And even there you could do a sanity check by comparing the number of votes cast by the number of voters the precinct operators counted (they mark off your name after you vote, so it's fairly easy to count how many names they've marked off).

That's all I can think of off the top of my head.

Re:Just make the database public

[swillden]

The only way I can think of to commit vote fraud against this system would be by stuffing the ballot box with false votes.

How about: You vote the way I tell you to, and you bring your receipt home to prove it in front of me. If you can't prove it, I break your kneecaps.

Re:Just make the database public

[ASBands]

I like it - you're almost there, but you've got some problems. If I'm mistaken, feel free to correct me.

• Bringing a plaintext vote out of the ballot box is bad and should not be done. While it may seem ridiculous, we don't want members of organized crime checking who voted which way. Only have the index number and an encrypted vote - they can check to see if the values are the same. This ensures that the vote has been properly recorded, beyond that doesn't really matter (we're running DRM - the user shouldn't need to know the private key). (see below for my continued objection)
• As far as seeding goes, you shouldn't use milliseconds the vote was counted, as this leads to predictable keys. The voter's private key can be generated at any point until the transaction to the SQL (or other) database, so base it on an MD5 of their name, xored with the position of the strokes on the touchscreen, times the bits of the value of the cosine of the average time between strokes...you get the idea: 128 bits of completely random.
• Assuming we're allowing the system to be as open as we can get, we'll let anyone query the database for anything. Which means that somebody could (easily) figure out who voted which way by decrypting every single vote. It's not exactly brute force when there are eventually only 2 major values to pick from. This means that you could take somebody's voting slip, look up their number in the database and, using all the information publicly available, find out who they voted for. Take away the printout, have the voter turn it in for recount purposes and removing public access to the database would fix this problem.
• 
  
  

  Anyway, the problem of ensuring the voting remains anonymous seems to run counter to ensuring that the voter's vote is counted properly. Your solution would work if you didn't allow public access to the database but...security through obscurity?

Re:Just make the database public

[Phroggy]

The system does not record who voted which way. The only way to link a vote with the voter is via the index number and private key printed on the voter's slip, which he is free to shred, eat, burn, whatever. I think it may even be possible to validate that the votes match by comparing the encrypted votes, without ever looking at the plaintext vote. It's been a while since I did the RSA key pair stuff. If you vote for my candidate, then bring me your slip with the private key so I can verify it online, I'll pay you $20.

Re:Just make the database public

[simong]

Why would the voting database be available online? That is exactly the reason why it shouldn't be. The main part of secret ballot is secret and the electoral authority should take all steps possible to make sure it's secret. A key pair would produce a checksum to confirm that someone had voted but except in the case of provable electoral fraud should never divulge how someone voted.

Re:Just make the database public

[volpe]

If you vote for my candidate, then bring me your slip with the private key so I can verify it online, I'll pay you $20. You misspelled "let you keep your job".

Re:Nothing to see here. Move along.

[Anonymous Coward]

I have a social problem, and I blame Microsoft too.

Sounds like they want open source

[WarJolt]

I'd feel more safe if the thing was running on linux. That being said...

Even the GPL allows linking to C libraries. The runtime does not need to be covered by the GPL.
http://www.gnu.org/licenses/gpl-faq.html#WindowsRu ntimeAndGPL
The reasoning behind this exception would be the same reasoning for why microsoft should be able to keep their code private.
Basically you have to trust the runtime, which is used by dozens of applications and has already been tested. They do realtively simple functions and don't in general govern what the program actually does. I don't think microsoft could successfully commit voting fraud simply by supplying the OS and the C libraries.

If the government can't trust microsoft then I demand that they uninstall every single microsoft product from every system(probably not a bad idea anyway).

I want to know how much coding Barbara Lifton has actually done. When will they stop making legislation about things they know nothing about?!?!?!

Re:Sounds like they want open source

[Anonymous Coward]

"I don't think microsoft could successfully commit voting fraud simply by supplying the OS and the C libraries."
          In theory, Microsoft could certainly supply a "security patch" that dicks with elections.. as a practical matter I'm certain they wouldn't..

          The big concern, though, is if these voting machines are on any sort of network, has you put in a card or stick to vote, etc., a Microsoft-based setup has a poor track record in terms of security in these situations. Now, if it was a Windows CE based setup, that wouldn't be too bad. But, with the regular Windows line, even with Windows embedded, I've read about ATMs getting crashed out by viruses and the like. The embedded one is supposed to be stripped down to avoid security problems! Now imagine instead of a random virus, you've got a known vulnerability instead; some evildoer with enough knowledge of the voting software to change it can subvert the underlying OS to patch the software arbitrarily. If there's any remote or local exploits (or both) an evildoer could:
a) infect the machines via internet (if they're actually on a non-private network.. this doesn't require a local exploit but seems unlikely.)
b) infect one or two machines via local exploit (memory key, or whatevever with an exploit on it..) These would infect the rest via local net, and/or send something up to the vote server.
c) infect 'em all via a local exploit. If it's sticking a card into the machines for a second or two while it executes the 'sploit, someone could just do it while they're being installed, if physical securiy isn't tight.

          On the other hand, with a setup that's audited all the way through.. well, look at ssh. Code like that, they got past actual exploits years ago, and got up to stuff like putting random delays in parts of the code, to avoid theoretically having the timing be an information source for a 3rd party getting the connection key and decrpyting it. That's attention to detail, and I suspect an audited voting machine setup would be similarly high quality all the way to the bare I/O drivers.

          A good standard is casino slot machines. They are custom software all the way through, and well audited to prevent casinos from cheating on the payout rates they report to regulators.

they gave source to China, why not us?

[r00t]

The really sick thing is that they gave source to China after testifying in court that exposing the source code could endanger national security. By their own words, under oath in court, they are clearly traiters.

Maybe the situation changed? Twice? It was bad to expose the source, then perfectly fine for a brief while, then bad again. Yeah, sure, that's it.

like California air standards

[r00t]

Machines are made to work in the most restrictive state so that they can be sold everywhere. Cars, voting machines, whatever...

Re:like California air standards

[TobascoKid]

I thought there were differences between cars sold in different states - ie, a certain model of a car in NY will be slightly different from that same model of car in CA, because the emission requirements in CA are so strict that it makes the cars more expensive, so to keep costs down only the cars meant for CA meet the CA emissions regulations.

Re:like California air standards

[Doc Ruby]

Why would you think that? It's common knowledge that CA emissions standards force car makers to sell one model to not only that single largest market, but also to to the entire USA, rather than lose scale economies to different factories/lines/models for different states. Not only do other US states set their requirements to follow California, but so do many countries around the world. "California emissions" is a market many times larger than California's 35M population.

And the costs of meeting it aren't that high in the car, compared to tweaking different models. The car industry's entire economy is based on Henry Ford's original mass production model. Parts are shared across not just markets, but across models, across model years, across manufacturers. Mass manufacturing and standardization are so economical that most parts and systems are redundant across even competing manufacturers, supplied from the same 3rd party sources. It's one reason why a given garage can service so many different competing brands.

California's leading standards are consistent with economy and ecology. That's why the original US emissions standards were defined to match them, even though they were the strictest in the country, and specified reducing hydrocarbons by 72%, CO by 56%, crankcase emissions 100%, in just 5 years. And they did it.

Somebody is overlooking the obvious

[Whuffo]

I don't think that Microsoft would take the chance of attempting to rig an election; the chance of getting caught is non-zero and the penalty would be astronomical. Besides, if all they supply is the OS and maybe a runtime library - they'd have a hard time affecting the operation of a vote counting program in a useful way.

The real problem with using a Microsoft OS under a voting platform is the swiss cheese security model they seem to use. There's an awful lot of black hat coders that specialize in compromising Windows for a price; a political party could easily meet that price, and the resulting exploit could manipulate votes. A specialized exploit like this could be very stealthy and not be noticed until well after the election is certified - if ever.

The problem isn't so much that Microsoft won't open their code for inspection - the real problem is that the bad guys have been poking and prodding at Microsoft's products for years and they have a fine knowledge of the exploitable flaws standing by and ready to use. Combine that with an inability to verify the code - this just isn't acceptable. Windows is too darned easy to compromise; it's not suitable as a platform for a vote counting system.

What's really needed is a custom made vote machine. This isn't a complex function; a simple CPU and about 1K of code would do the trick. As a unique hardware based design (code in PROM) it'd be very difficult to compromise - and the code would be simple enough that reviewing it and verifying its integrity would be fairly simple.

You can bet that there'd be a lot of lobbying from Diebold and Sequoia to keep this from happening. Are those companies honorable? I don't know - but something that I've noticed is that Diebold ATM machines seem to be very, very secure and accurate. I've also seen some of the Diebold voting machine code that got published a while back. Not impressed with that at all; almost looked like it was designed to be easy to compromise. Hard to believe that a company with so much experience in secure computing would do such a thing.

Even if the vendors allow their source code to be viewed, you can be sure that only a few special people will get to look at it. We the people won't get that opportunity. That just creates another "soft spot" in the system; a stack of cash in the right hands would get most anything approved (assuming a sufficient quantity of cash).

As far as I'm concerned, we should be sticking with paper ballots until the security problems in electronic voting are completely identified and workable solutions are found and tested. The current crop of electronic voting machines are far too easy to compromise. Not just the machine itself, but also due to the small number of people who maintain / prepare / operate these systems. Compromise one of these individuals and you can control the vote...

Re:Nothing to see here. Move along.

[Alsee]

It's a deliciously satisfying way of transferring cold hard cash from Microsoft's wallet to Slashdot and Google.

Sticking it to Microsoft, one cent at a time!

-

Re:YOU are overlooking the obvious

[JetScootr]

Sorry for the flame-baitish subject, but it had to be said...

I don't think that Microsoft would take the chance of attempting to rig an election
This is the company that was caught falsifying evidence right in front of a federal judge. Would they rig an election behind the scenes? Without a second thought.

The problem isn't so much that Microsoft won't open their code
Yes, this is a problem. Microsoft's customers are its business partners, not the people who buy computers. MS has been putting 'hooks' in their code for years to allow marketing access to the millions of MS users worldwide. There's a very reasonable probability that MS has similar hooks for gov't access. Gov't access to the voting booth and the ballots is a very, very dangerous thing. And yes, non-gov't black hats are also a worry.

As a unique hardware based design (code in PROM) it'd be very difficult to compromise
This is called 'security thru obscurity' and no, it doesn't work, even a little bit. All that's required is for one copy of the machine to be made publicly available. This has been proven in real world experiences time and again.

Diebold ATM machines seem to be very, very secure
HOW do you know? Please offer citations, including links to skilled, unbiased research. Diebold fought (and still fights) so hard to prevent its voting machines from being researched that I'd be surprised to find any trustworthy research on their ATMs.

...vendors allow their source code to be viewed, ... only a few special people will get to look at it
The obvious answer here of course is open source code. Don't wait on Diebold or someone else to write it; we the people need to. I have no people-organizing skills of my own, but I am a good programmer. I'd be willing to put many, many free hours into this, if there were a project out there doing it.

Verifiable vote

[JetScootr]

Some guys (I can't find cite, sorry) came up with a really cool verification scheme. Machine prints two copies of the voter's ballot, one for the voter, and one that gets stored and counted. The voter's ballot is transparent except for the printing.
The ballot paper is printed with a dot-matrix code. Normally, dot-matrix text is (for example) 9 * 16 dots. In this dot-matrix, however, each dot is subdivided into nine or more smaller dots. The 9*16 matrix is edge to edge. Each character printed only gets a few of the smaller dots, chosen by encrypted method. If you eyeball the ballot, all you see is white noise.

The characters on the two ballots are a one's complement of each other. The two ballots must be laid one over the other to correctly form the letters of the voter's choices. The voter could then verify, over the internet, that what the central counting system received matches the ballot the voter placed. The central system's website would put up a lifesize graphic of the ballot received and counted. The voter would place his/her transparent ballot directly on the monitor, overlaying the image. Together, the dots would line up and the voter's choice is clearly spelled out.
The voter's choice is kept secret; the encrypted ballot is hard to fake, impossible to replace (if the voter verifies); the overall system is verifiable at every level. And the actual vote is still paper.

8-bit voting

[Nurgled]

char voteCount;

...

// FIXME: This won't work if a candidate ever gets more than 255 votes,
// but that'll probably never happen
voteCount++;

Re:8-bit voting

[Anonymous Coward]

Well, nobody would be smart enough to replace the "char" with a "long", would they? Nobody could be smarter than you, obviously.

And all those assembler programs I wrote for the 8080, that could count to several hundred million -- they couldn't have existed, could they?

Learn some assembler language programming, kid, before you make a bigger fool of yourself. Hint: the 8080 has a machine instruction called ADC.

Better yet

[Skapare]

Better yet, just use the direct machine totals to give the media for its election night news coverage so they can report who probably won by 9 PM. Then run all the machine printed (for consistency) paper ballots through scanners to get a vote certification. If the results vary, then do the investigation to verify the votes. The difference here is no one need request the paper count; it always gets done as part of certification. This way, we get fast results, and always get a verification.

Duh to that.

[jotaeleemeese]

In Mexico, since elections are clean, you have a representative of each party and candidate on each locality where voting is taking place.

These people witness that the count is fair and accurate as well as ensuring no tricks are played.

new york

[ralph1]

Stuck the dick right up bills ass hard some people after whats best for america if only everyone did.

Re:There's nothing wrong with paper...

[Anonymous Coward]

You might want to ask the tree's about that. Paper consumption is a real world problem, too. Not to mention all those pencils.

I'm not a tree hugger by any means, but isn't it far more efficient and enviromentally friendly to use computer-based systems. It's got to be cheaper, too.

I think that its worth it to get this right, elections can be manipulated in paper based systems, too. All it take is the money and the will to do it.

Galactic population counting

[Stephen Ma]

// FIXME: This won't work if a candidate ever gets more than 255 votes,
// but that'll probably never happen

Nobody should take the 255-vote "limitation" seriously, of course. An 8-bit CPU like the 8080 can use multi-precision arithmetic to count as high as it needs to, with no delay perceptible to the voter. All the voters in the universe could not exhaust the counting ability of a single 8080 chip.

Does anybody besides me...

[AnalogDiehard]

...find it dangerous for a company heavily investing in lobbying to be selling voting machines...?

Re:YOU are overlooking the obvious

[Whuffo]

To successfully rig an election takes more than just a tweaked voting machine - it also requires that the people managing the election not look closely enough to detect the fraud. Vote fraud coming from a political party would probably have the necessary connections, desire, and funding to pull it off successfully in isolated areas.

Microsoft isn't in a position to make subtle changes that would slip by in specific elections. Their lobbying arm isn't sufficiently "connected" in any local election to allow the technical fraud to slide by undetected. If they were to move their activities into areas where they could support this kind of activity it'd attract attention; there's a lot of media pundits that focus on nothing but Microsoft. I suspect the best they could do if they tried would be to subtly alter election results in Washington; this wouldn't make a lot of difference in the grand scheme of things.

The reason for PROM based voting machines is so the code can't be changed after the machine is in place. Did you know that many of the current crop of voting machines accept software updates through the same interface the voter plugs his authorization card into? Just one person in that district could step into the booth, insert a programming card, and that machine is compromised. One machine per polling place would be more than enough to control the election outcome.

And my proposal for a simple machine running bespoke code from PROM isn't to obscure the code - the code could be published for the world to see. Counting votes isn't complicated - even Microsoft could write this code and leave no bugs or exploitable holes. If there were holes, the "many eyes" looking at the source would find them - and since the physical machine runs from PROM, it can't be altered (easily) while in operation.

By keeping it simple, it's simple to validate the code. It also reduces the possibilities for vote fraud. Heck, you're a smart guy - what do you thing of Diebold building a voting machine that stores its counts in an Access database? Can they really guarantee that the counts will be correct?

Re: Sorry, wasn't clear...

[JetScootr]

To successfully rig an election...
I was addressing the part that went "I don't think that Microsoft would take the chance of ...", not what it would take to do so. I agree, it would be complex. With programmable voting machines, it would first require technical hooks into the machinary. And that makes the morality of MS a relevant issue.
It's all just a dream, anyway. I doubt elected officials would care or think the risk great enough to do anything this drastic.
And as for guarantees with Access databases, allow me ;) to quote Microsoft:
To the maximum extent permitted by law, Microsoft ... disclaim[s] all ... warranties ... including ... fitness for a particular purpose
(From the Access 2000 EULA)
Not just a little bit of uncertainty in their product, but the maximum uncertainty allowed by law.

Why not?

[jotaeleemeese]

Sorry, but I don't see the rationale behind what you are saying.

Even if the solution is proprietary, it would be protected by copyright, and what the heck, it should be licensed with a free license as far as I am concerned.

Re:Why not?

[Kalriath]

Well, I'm not saying that what will happen is good or bad. I'm simply making an assertion what will happen based on my experiences with governments and corporations.

Now, that said, asking Microsoft to hand over their code because some retarded third party decided to build their voting platform on Windows is pretty bullshit, and I can understand Microsoft telling New York to shove it. Hell, I'd do it myself. But then, I'd also be utilising that little used clause in the EULA - and revoking Diebold's (and others) right to use it too. And I'd be whipping out that indemnification clause. Hell, it's Diebold, you'd probably do it too - no matter how "evil" it is.