California Testers Find Flaws In Voting Machines

quanticle writes "According to Ars Technica, California testers have discovered severe flaws in the ES&S voting machines. The paper seals were easily bypassed, and the lock could be picked with a "common office implement". After cracking the physical security of the device, the testers found it simple to reconfigure the BIOS to boot off external media. After booting a version of Linux, they found that critical system files were stored in plain text. They also found that the election management system that initializes the voting machines used unencrypted protocols to transmit the initialization data to the voting machines, allowing for a man-in-the-middle attack. Altogether, it is a troubling report for a company already in hot water for selling uncertified equipment to counties."

Comments

heh

[Anonymous Coward]

I guess they do run linux after all.

Re:heh

[JavaBear]

Man, as first posts go, I'd rather have that just said "First Post!".

If it's that easy to break into, I guess the machines used some form of snake-oil and build it's security on the assumption of obscurity. Bad choice any day.

I haven't seen which OS they use.

Re:heh

[Anonymous Coward]

The paper seals were easily bypassed

If the foil on a medicine bottle was broken, that is an indicator that the contents have been tampered with. Too bad they chose to use paper seals, since those foil ones are soooo much harder to get past.

WhiteHat Voting

[JavaBear]

I have 2 solutions to all these problems.

1: Do like the rest of the world, and use a HB #2 pencil.

2: EFF and the rest of the American White hats get together and develop an Open Voting system, that are freely implementable by any state, that can withstand public scrutiny and peer review.

Re:WhiteHat Voting

[jacekm]

HB #2 pencile has a serious flaw. It is suspectible to the man in the middle with cheap eraser.

JAM

Re:WhiteHat Voting

[morgan_greywolf]

My wishlist of features:

• All data is stored encrypted and signed.
• All communications protocols are authenticated, encrypted and signed.
• There are multiple, redundant backups of all data, including a hard copy paper trail that can be authenticated by a unique signature printed on each ballot
• Voting machine is all open source -- no binary-only anything, no exceptions. This includes the OS -- so Linux or *BSD. It also includes the firmware, so something like OpenFirmware or whatever.
• Source and binaries on each machine are independently verifiable
• Ability for independent auditors to audit each machine at hardware level, application level and OS level.
• No wireless networks
• Machines have airgap security WRT the Internet
• Machines use encrypted filesystems.
• Machines have tamper-evident seals over everything
• Good secure configurations -- no unnecessary services running, secure authentication methods, OS patches kept up to date, software consistently audited for security
• 
  
  • 
    
    All in all, I want a machine that is custom-configured for electronic voting and locked down so tight the NSA would have trouble getting in.
    
    

Re:WhiteHat Voting

[pev]

1: Do like the rest of the world, and use a HB #2 pencil.

Hm, I could use an eraser to get around that. Do you realise that if paper was software, we could close down all the producers and distributers of erasers (or probably office equipment in gerneral!) in the states for selling devices for circumnavigating security?

~Pev

Re:WhiteHat Voting

[Frnknstn]

The eraser still leaves evidence of the tampering behind, with a slight stain and the indentation on the paper.

Re:WhiteHat Voting

[JavaBear]

# All data is stored encrypted and signed.

All data should be stored in plain text, and signed with multiple hashes, keys and/or ciphers.

# All communications protocols are authenticated, encrypted and signed.

Only to the extend tat no one can say that for instance booth #5 voted on candidate X.

You don't want to shroud the data in mystery or obscurity, merely make them tamper-proof (resistant).

# There are multiple, redundant backups of all data, including a hard copy paper trail that can be authenticated by a unique signature printed on each ballot

Partially.
Use memory cards. The cards should be one-time use WORM memory. They contain the voting setup, in for instance XML. When the voting machine is initialized, the card is tagged with machine ID, timestamp, election official and authorization information, along with machine and software version keys. This should render the WORM card unreadable in any other machine. A crash and/or power outage should be recorded to the memory card if possible, and the machine should be reset using a new memory card, or the machine detects that the card is indeed it's own, and insert a new initialization header, preserving the original data.

During voting, each vote is written to the card, tagged with some sort of security and padded to a fixed length.

At the end of the day, this card is bundled with the paper trail, printed throughout the day like the internal tape in a cash register, and finalized with totals and signatures from election officials.

After the election, the card content must be dumped to an official and freely accessible server along with a scanned version of the paper tape.

Re:WhiteHat Voting

[Anonymous Coward]

you forget the pragmatic american approach to things:

1a) Diebold increases 5% the campaign funding to all directions

1b) Inquiries are buried, arbitrary decisions by governors/counties/districts are taken to increase electronic voting machine presence without even a paper trail record being kept

1c) People complain but are called liberals/american haters and dismissed

1d) Diebold profits!

Re:WhiteHat Voting

[Bearhouse]

In other words, you want commodity software that anyone could easily, and cheaply copy/use.
Great for citizens & taxpayers, not so good for the manufacturers. They might actually have to do real work to demonstrate the added value of machine x against machine y.

So, sorry, it's about as likely to happen as M$ open-sourcing Windows, (although in other news, I hear that they've offered to show the Chinese Gov. ALL of the windows source code in order to ally suspicions of backdoors - probably in fear of the Chinese Gov. throwing their resources behind some local version of Linux, as the Koreans - both North and South - have recently done).

Re:WhiteHat Voting

[Walkingshark]

Hmm, I wouldn't depend on any kind of encryption at all. Instead, security for this kind of thing should be handled by making the entire process human readable and verifiable by any literate person.

The setup is simple. You have one machine that has some sort of electronic interface (touchscreen, keyboard, mouse, scroll wheel, whatever), and this machine lets a voter select all their candidates and other votes. Once they confirm that they are satisfied, they hit a "vote" button, and that machine prints out a human readable ballot that indicates each race and the candidate or option (in the case of referendum votes) selected. The voter than signs this ballot and inserts it into the secure optical scanner, which reads the votes and registers them electronically. The ballot, once read, is dropped into a secure hopper where it is stored.

If there are any questions or a recount is needed, ballots can either be re-scanned or they can be hand-counted by human beings. This is the vital part of the "paper trail" that some people seem to miss. Its not having paper in the process, its having paper that has been verified by each voter and that can be read by a human.

Re:WhiteHat Voting

[bhmit1]

Once you have a voter verifiable paper trail the rest becomes redundant. Though having enough security on the machine so you don't have to rely on the paper trail is a good thing.

But honestly, I don't see why the geeks are so upset here. This is our chance to rock the vote, and make sure that our votes actually count... more than once. If the current politicians aren't going to fix the voting machines, then lets flip a few bits, "elect" the EFF into office, and have this, plus copyright, patent, and net neutrality issues solved in one quick term.

Re:WhiteHat Voting

[Gregb05]

You can't circumnavigate the security on paper, it's flat!

Re:WhiteHat Voting

[caluml]

You've thrown the word encrypted around a lot. I think signing is more important. But how do you ensure voter anonymity, but yet retain a way of checking that the machine hasn't just created 1000000 keypairs, and 1000000 votes, and signed them? Sure, let me generate my own keypair on my Linux, and sign my vote with them (perhaps encrypting with the Voting Authority public key), but that doesn't stop fake votes being introduced into the system, unless I somehow register my public key with the system, thereby losing my voter anonymity.
It's just not like securing a standard box.

Re:WhiteHat Voting

[Feyr]

[quote]
# All data is stored encrypted and signed.

All data should be stored in plain text, and signed with multiple hashes, keys and/or ciphers.
[/quote]

i think you nailed that one. most people forget that encryption is no good if you already have access to the key, and the software must have the key if it's supposed to make use of the data in the file. thus, a hacker has the key

remember people: signing good. crypting, not so good

Re:WhiteHat Voting

[JavaBear]

That IS an interesting problem.

The keys used for signing must be a combination between the memory card, the hardware and the software keys. Add a timestamp to the vote, and raise hell if there are a timestamp mismatch (new vote is stamped before the previous vote).

The use-once WORM memory card I mentioned previously could be nice here as well, it could have an interface that simply disallowed accessing a specific address in it, you write to it by sending it a byte stream, and you read it by asking for data which would return a character stream from address 0 to the end of data.

Re:WhiteHat Voting

[MtViewGuy]

Much of California votes using mark sense ballots similar to filling out a Scantron sheet when you do your SAT or ACT college entrance exams. While that's a good idea, you do need to consider two things:

1) Make sure you fill out the ballot with a permanent-ink pen--pencil marks can be erased and cause no end of troubles in terms of ballot readability and the potential for ballot fraud.

2) Ballots could end up being tremendously huge in size--when I voted in the 2006 general elections in November 2006 the paper ballot size--even with having to fill out both sides of the ballot--was huge.

Re:WhiteHat Voting

[morgan_greywolf]

In other words, you want commodity software that anyone could easily, and cheaply copy/use.
Great for citizens & taxpayers, not so good for the manufacturers. And the government's job is to protect the interests of those citizens and taxpayers, not the interests of the manufacturers.

Re:WhiteHat Voting

[JavaBear]

2) Ballots could end up being tremendously huge in size--when I voted in the 2006 general elections in November 2006 the paper ballot size--even with having to fill out both sides of the ballot--was huge.

Define "huge".

The one I used in the recent Danish election was close to 15x100 cm, if not more. (It was folded 3 times on it's long axis, and folded it was roughly 15x30 cm).

Re:WhiteHat Voting

[Bearhouse]

Yup - and a fine record they have of doing that, eh?

http://www.youtube.com/watch?v=J6wNyTYzja8

Oldie, but goodie

Re:WhiteHat Voting

[Storlek]

How can you accurately differentiate this from the voter accidentally filling in the wrong box and erasing it themselves? You're getting into dangling-chad territory here.

Re:WhiteHat Voting

[JavaBear]

How can you accurately differentiate this from the voter accidentally filling in the wrong box and erasing it themselves?

The easy answer, and incidentally the correct one, is: You don't.

If you put your X on the wrong candidate, you exit the booth and get a new ballot, while the old one is ripped in half.

Re:WhiteHat Voting

[JavaBear]

On THAT note.
Elections should be run by competent people, so politicians should really just stay away from the process.

Re:WhiteHat Voting

[simong]

Certainly in the UK, if you make a mistake, you are supposed to return the incorrect ballot paper to the invigilators who will void it and give you another paper. The voided papers are also accounted for in the count.

Re:WhiteHat Voting

[Bearhouse]

Totally agree. Shame that all recent attempts to get redistricting out of the hands of gerrymandering politicos got nowhere, as our demcratically-elected** representitives decided that they were better-qualified to draw electoral boundaries than independant experts.

**In November of 2004, 401 of the 435 sitting members of the U.S. House of Representatives sought reelection. Of those 401, all but five were reelected. In other words, incumbents seeking reelection to the House had a better than 99% success rate. In the U.S. Senate, only one incumbent seeking reelection was defeated. Twenty-five of twenty-six (96%) were reelected.

So, when it comes to hanging on to power, I guess you could say they're actually pretty competent. Now, if they could only display the same talent in managing the budget deficit, health-care reform...

Re:WhiteHat Voting

[bvimo]

In the UK we don't use rubbers, we start again with a virgin sheet.

Re:WhiteHat Voting

[bvimo]

It sounds to me that you have a stable country without any significant issues, or is your democratic process corrupt?

Re:WhiteHat Voting

[xENoLocO]

If you translate that to american... it's a pretty funny sentence. :)

Re:WhiteHat Voting

[jinxidoru]

My wishlist of features
* tosses out all votes for republicans.

Re:WhiteHat Voting

[morgan_greywolf]

It sounds to me that you have a stable country without any significant issues, or is your democratic process corrupt? Yes (for both).

Re:WhiteHat Voting

[Manfred_MAN]

How can this EFF firm develop such an insecure system for voting? Didn't they try to break into there own system before allowing it to be tested by researchers? I wonder if these firms develop insecure systems on purpose (for the sake of allowing easy vote tampering). We are at the point where there is no way a private company can be trusted to develop a proprietary voting system. As for the Open Voting system, that should be the first and most important security requirement for a voting system.

Re:WhiteHat Voting

[jacekm]

I just pointed the exaggeration of California "discovery". The so called "researchers" bypassed security (I wonder how they "bypassed" seals), picked the lock and were surprised to find files stored inside in "plain text". If I would have unrestrained access to the ballot box in any country in the world, I would find out that it is "easy" to open the box (in most cases traditional boxes are locked with a cheapo Chinese made lock or none at all) and surprise, surprise find ballot box full of paper files in plain text !!! What a horror !!!. Instead of having knowledge how to reprogram BIOS all I had to do is to either use cheap eraser or throw out ballots that I don't like or if I'm more sofisticated, replace them with my own prepared copies. Electronic machine with unrestrained access is as difficult to cheat as traditional ballot box.

JAM

Re:WhiteHat Voting

[Anonymous Coward]

Then you should vote those incompetents out....

... oh ... $h1t

Re:WhiteHat Voting

[Phleg]

At the end of the day, this card is bundled with the paper trail, printed throughout the day like the internal tape in a cash register, and finalized with totals and signatures from election officials.

Storage as you describe would allow the order and time of votes to be reconstructed, destroying anonymity.

Re:WhiteHat Voting

[JavaBear]

Storage as you describe would allow the order and time of votes to be reconstructed, destroying anonymity.

I did think of that, but couldn't come up with a solution on that one right away.
Reintroduce the curtains, and disallow outsiders to record who uses which machine, and you might get around that with sufficient randomness to protect the voters from being tied to a specific vote.
Maybe removing the timestamp as well. But I can't see us getting around the order without risking compromising the integrity of the votes, unless there are an intermediate memory, battery backed in case of power failure, that tallies votes in batches of for instance 25 votes, and streams that intermediate result to the memory card.

Re:WhiteHat Voting

[fgouget]

2: EFF and the rest of the American White hats get together and develop an Open Voting system, that are freely implementable by any state, that can withstand public scrutiny and peer review. Does not work: on election day you have no way to make sure that the machine you vote on is running the EFF's public, reviewed and trusted software rather than a hacked version.

Re:WhiteHat Voting

[Techman83]

Scangrade: *Spits out papers* Some infidel did not use a Number 2 Pencil!!

Re:WhiteHat Voting

[Vombatus]

The voter than signs this ballot and inserts it into the secure optical scanner

Well, there goes the concept of a "Secret" ballot!

In Australia, an electoral official initials each and every ballot paper before handing it to the voter. This reduces the possibility of someone stuffing the ballot box with fraudulent ballots.

Re:WhiteHat Voting

[Anonymous Coward]

I think we should make it as hard as possible for someone else to steal another election in this country. Make it so they would have to buy off a freaking army of people all over the country. Forget any computers, WhiteHat Voting has the right idea. Computers can be altered/programmed/hacked in a multitude of ways. The KISS principle definitely applies here. This is off the cuff, so I'm sure not everything is thought out, but I would appreciate feedback.

Make it a national holiday so everybody votes. All absentee ballots have to meet extremely stringent criteria, be vetted, and counted beforehand. Have mass transit made available where needed -- friends and neighbors encouraged to volunteer to bring folks that need a ride. You bring multiple forms of identification with you, licenses, credit cards, bills, whatever you can. If you prove you live in that district, you vote -- no provisional ballots or any of that crap -- they all use the same ballots. Have signs detailing platforms of all candidates outside the voting area along the lines, so that all candidates have a chance and we don't have to rely on the bought & paid-for media for our information. Take volunteers from all parties -- if there are long lines, set up another table/booth immediately. Make it paper ballots with pens (duplicate or triplicate), you vote, you sign it, you hand it to a poll worker, they verify who you are voting for by actually reading it back to you, they sign it, they immediately record all of your votes on a big board (electronic or whiteboard) while you are standing there (heck they could even write the current counts on your ballot), another poll worker sits with them to verify everything, they place their copy of the ballot in a clear plastic case in front of everyone. Votes are double and triple counted right then and there by volunteers from all parties -- you could even move along 3 tables of poll workers and verify & have them sign your ballot each time -- and have separate plastic cases containing the duplicate ballots. And the voter keeps a copy themselves. Press records everything and broadcasts voting counts in all districts in real time. Alternate recordings are made watching the entire area, especially the ballot cases. They aren't moved until everything is said and done. Recounts are allowed by any and all interested parties and they are guarded and watched at all times, including the absentee ballots. If there are any discrepancies whatsoever, recounts are mandatory. And I love what they did with the purple finger -- after you vote you dip to prove you voted that day with an ink that must fade over a few days -- can't be washed off and run to another district. I think that would be a great incentive when other people see you voted for them to get down to the polls.

Yes, this would take longer, but I seriously doubt it would cost more than those outrageous voting machines!!! I don't care about polls closing at a certain time, have them open 24 hours, or 48 hours. Isn't it more important that EVERYONE gets a chance to vote than making everything happen in one day? Maybe this throws anonymity out the window, but if they didn't want everyone to know their vote for president, they wouldn't be there in the first place!

ATM Machines

[Anonymous Coward]

For the last time - issue a voter card and use the cash machines / ATM machines / or whatever you call it in ur location.

It will even print a receipt.

If it good enough for your money it is good enough for your vote

Re:ATM Machines

[courteaudotbiz]

Hmmmmm... Didn't you hear about debit card frauds?

Re:ATM Machines

[JavaBear]

Now, that begs the question, Are the ATM's good enough for your money? They are after all made by the same companies that can't make voting machines.

And I distinctly recall a past story about a DIEBOLD ATM playing music at some campus...

I just hope DIEBOLD live up their name, and die boldly...

Re:ATM Machines

[oliverthered]

but the problem is you can tell who voted for who and that's bad.

Re:ATM Machines

[tacet]

oh really? http://http//it.slashdot.org/article.pl?sid=06/09/25/1919256/

Re:ATM Machines

[Anonymous Coward]

For the last time

Good, because that idea is rubbish. Votes are supposed to be secret and unprovable and elections are supposed to be transparent. So far nobody has figured out a way to meet all three requirements when a computer is involved. Your proposition doesn't meet even a single requirement.

Re:ATM Machines

[rucs_hack]

but the problem is you can tell who voted for who and that's bad.

Only for the people who don't vote the way you want. It would only take a couple of elections and you could make them all go away anyway.

See? Nice and tidy :-)

Re:ATM Machines

[Anonymous Coward]

These are just issues that can be overcome like:

1. chip and pin
2. an abstraction layer between real voter details and the card - real identity not matched up
3. Available on "high security classed" ATMs only - like those in the bank wall put an audit/checking process in place on these.

etc etc

Re:ATM Machines

[Sen.NullProcPntr]

Now, that begs the question, Are the ATM's good enough for your money? They are after all made by the same companies that can't make voting machines. I have never lost any money due to an ATM. Although banks have.

The problem is that the ATM/Voting Machine manufacturers look at their equipment as only needing protection from the outside. The unwashed masses that use the equipment to get cash or cast a vote can't be trusted at all. The insiders at the bank can be trusted, after all bankers wouldn't steal their own money (in most cases). That trusting of the insider mind set is being transfered to voting machines where the same thing can't be said about election officials.

The manufactures need to make their hardware and software tamper proof from both the inside and outside. Not sure about the hardware maybe make it a safe/vault with a two key system where one key is held by a local official and the other by a regional official? Software is much more complex than a vault or safe mechanism so probably an open approach where many eyes can find the faults is the best method.

No system will ever be 100% protected but there is a lot more that can be done.

Re:ATM Machines

[apt142]

And your finger prints aren't all over the card that you turn in currently?

If the ATM had a firmware upgrade that reported a hash of your bank account number with the vote, that would be sufficient to verify uniqueness and avoid double voting. And it wouldn't be traceable. The only problem I have is that the banks would be facilitating this. I'd have a hard time letting a company, who's main goal is to make money, get involved in the voting process.

Re:ATM Machines

[sdpuppy]

Perhaps Diebold should go back to what they do best...

... manufacture daisy wheel printers.

:-)

Re:ATM Machines

[Anonymous Coward]

What?? According to the ES&S website they have "next generation voting solutions" coming out that have "Greater efficiency, accessibility, and security."

All we need are next generation solutions. Didn't you get the memo? Next generation man...that's the answer.

On a non-sarcastic note..you'd think their products wouldn't need greater efficiency. Imagine an ATM that needed greater efficiency. "Sorry sir, our ATM is only efficient enough to give you $80 of the $100 you requested."

Re:ATM Machines

[Nomen Publicus]

Voting is confidential, not secret. If it were _truely_ secret, voting fraud would be almost impossible to detect and prosecute. The use of ATM machines is a very good idea that should be developed.

Re:ATM Machines

[Anonymous Coward]

The connection between voters and votes is secret, not confidential. If it can be found out who voted for whom or if a voter can prove whom he voted for, then the election is not free. Voting fraud is detected by finding process violations.

Re:ATM Machines

[pikine]

Then can you please tell Bank of America not to install any more Diebold ATM machines?

Re:ATM Machines

[Anonymous Coward]

>but the problem is you can tell who voted for who and that's bad.

No it doesn't for example
- card number has say one vote allocation on a topic

- current vote allocation remaining recorded in one system - this is related to the card number

- actual vote selection (who was voted for) recorded in a separate system - this just records that a 1 vote has been placed for x candidate

with no data maintained correlating card number and vote selection - only that a card number has completed a vote and can't vote again on the same topic.

I am sure some organisation with $ behind it could come up with something better...

Re:ATM Machines

[Bent Mind]

According to Donald Kerr, a deputy director of national intelligence, privacy no longer can mean anonymity.

Re:ATM Machines

[Anonymous Psychopath]

All the ATM manufacturers run WinXP these days, anyway. It'll come off like a troll, but we didn't have these types problems with ATMs back when they all ran OS/2. Fugly but effective.

Re:ATM Machines

[hey!]

Well, the worst thing that happens when the bad guys tamper with an ATM is the bank is out a few thousand dollars.

The worst thing that happens when bad guys tamper with a voting machine is that you lose control of the country. That's worth a lot more than all the cash in all the ATMs in the country.

So, a voting machine must be much more secure than an ATM, which typically is not particularly secure (and it doesn't matter).

Re:ATM Machines

[Werelock]

So you don't use the card for the actual vote but at the check-in station. Then they give you some form of temporary card for the voting booth with no identifiers back to your check-in.

Re:ATM Machines

[porpnorber]

People always worry about the loss of the secret ballot in electronically verifiable schemes, and I don't get it. The voter registration service mails you two random numbers (which include some checksum mechanism against typos, of course). You enter one of them. Voter identity and voter preference can be completely segregated. What's the difficulty?

You can even check that the counting mechanism is being applied correctly by issuing 'probe votes'. These are additional pseudo-voters, indistinguishable at the electronic level from actual voters, with pre-determined uniformly distributed votes that are entered into the system during the election process and subtracted out again after vote counting. If the subtraction step fails, then you have evidence of fraud. (There is no significant overhead this way, because if all passes off as it is supposed to, each candidate receives the same number of probe votes, and you just subtract this number from their tally. The probe votes serve only to provide a supply of electors who do not mind revealing their identity in order to validate their votes with the central authority and force a recount if necessary.)

Re:ATM Machines

[igb]

``If it good enough for your money it is good enough for your vote''

But it isn't my money: it's the bank's. If they install a system that leaks money, they have an incentive to fix it (money). If they install a system that leaks money against my name, legislation is in place (although not as strong as it should be) to pass the risk back to the bank. In a voting system, the people operating the election have no incentive to fix anything.

Moreover, an ATM is designed to tie you to the transaction as clearly as possible; a voting machine is the precise opposite.

ian

Re:ATM Machines

[igb]

``The voter registration service mails you two random numbers (which include some checksum mechanism against typos, of course). You enter one of them. Voter identity and voter preference can be completely segregated. What's the difficulty?''

How do you demonstrate that at the end of the election you aren't going to join the tables together and print a list of who voted for whom?

Re:ATM Machines

[porpnorber]

One of the tables you plan to join should not exist. Voter registration passes to vote counting the list of 'red' numbers and the list of 'blue' numbers, but no record is kept of who gets which number. Yes, ensuring that there are no side channels requires auditing the process, as do some parts of any electoral mechanism, but at considerably less effort than, say, thwarting conventional distributed ballot-stuffing attacks.

Re:ATM Machines

[fgouget]

If the ATM had a firmware upgrade that reported a hash of your bank account number with the vote, that would be sufficient to verify uniqueness and avoid double voting. Right. One bank account, One vote. That's one of the main tenets of democracy. Maybe we should push it a bit further: One dollar, One vote!

Re:ATM Machines

[vuffi_raa]

the problem really isn't with the voting so much as the vote counting- there needs to be a UID issued at the time of the vote and an online account that can be used over an encrypted transfer to access and check the UID so that if your vote is incorrect you can register a grievance- which would allow you to register a vote change (before results are posted, and we would have NO early return numbers)

"common office implement"

[jolyonr]

Do they really think this sounds more impressive than "paperclip" ?

Jolyon

Re:"common office implement"

[Anonymous Coward]

I guess the point is that it sounds less insulting and isn't as much of an "instruction" as calling the thing by its name.

Re:"common office implement"

[Torodung]

In a security situation, despite how obvious this was, it's important not to spill the beans on exactly how it was done.

It's the difference between, "can be hacked with a few lines of Perl," and listing the script out so that any script kiddie can do it.

There may be states with laws and certifications processes not as stringent as California still using these devices. Best not to tell everyone precisely how to break into them. I hope other states will insist that their machines be retooled, but that might drive this company out of business, and then they have to repurchase all of their machines without a likelihood of getting their money back.

Best to keep it vague. You'd probably look at the lock and say, "Gee, I bet I could get in with a paper clip." They're not concerned about you. They're worried about giving a 15-year-old explicit instructions on how to hard hack some other state's machines.

--
Toro

Re:"common office implement"

[oahazmatt]

Do they really think this sounds more impressive than "paperclip" ?

Because it's obligatory:

"Hi! Looks like you're trying to right the election! Need some help?"

Re:"common office implement"

[jddj]

Might've been "a ballpoint pen"

Re:"common office implement"

[davesays]

It was probably defeated by a "Bic Pen" not a paperclip. Most of the Pseudo-secure technology stuff I've seen uses the cylindrical lock/key setup. Cheaper ones are very easy to defeat ueing the proper size of ball point pen with the end ripped out. Just 'Jam and Turn'. An article with link to video - http://www.engadget.com/2004/09/14/kryptonite-evolution-2000-u-lock-hacked-by-a-bic-pen/ .

Re:"common office implement"

[jolyonr]

Could well be!

In which case, that would probably work on the UK's previous stock of nuclear weapons too.

See:

http://news.bbc.co.uk/1/hi/programmes/newsnight/7097101.stm

Why are we still allowed to buy these dangerous biros?

Jolyon

Re:"common office implement"

[Anonymous Coward]

No, but we didn't want to break common secutiry practice by disclosing the exact tool for breaking in.
It could have been a stapler, a pencil, a ruler, sissors, two pieces of paper entwined together to form a wedge; just about anything.

Thanks a lot, sir, for ruining our community trust!

Sincerely,
    The Testing Community of California

Criticism?

[Anonymous Coward]

It's not actually that hard to find sources that say these voting machines are dreadful.

That said though, they do have a lot going for them, they just need to iron out the kinks.

Give me a pencil and paper any day though!

Re:Criticism?

[Anonymous Coward]

do NOT click that first "voting machines are dreadful" link.

GNAA crap.

Re:Criticism?

[JavaBear]

What about the second one? (My Antivirus software won't let me load that page).

Paper please!

[courteaudotbiz]

I'm sure it's hard to hack a sheet of paper and a cardboard box. Please, leave democracy "unhackable", because where there's no paper for voting, there's no hard proof that you really did it...

Re:Paper please!

[DeeQ]

Even with paper there would be problems. For instance I took the SATS. SAT board lose my scores and say I never took them. Grats? (Although this is partially my fault for losing my recipt but thats not the point in making the connection) Human error will still happen.

Re:Paper please!

[courteaudotbiz]

Well yes, but with a paper ballot, you can recount hard paper, not bits and bytes... We can also get back to hands-up voting at the acropolis, it's safer! ;)

Re:Paper please!

[Notquitecajun]

Actually, there are problems there as well. Illinois in the Kennedy/Nixon race. LBJ in Texas. Louisiana in...well, pick a year. Gerrymandering/re-districting. Keeping the electoral college/getting rid of the electoral college. Nothing is, has been, or will be perfect with the vote...we just have to continue to hold people accountable and try and make it as publicly accessible while keeping the ballot secret. I'm pretty far-right, but I think at the LEAST there should be limited open-source scrutiny of any private contracting of voting, and it should probably be entirely run by the Federal or State Election commissions.

Re:Paper please!

[Anonymous Coward]

We can also get back to hands-up voting at the acropolis, it's safer! ;)

I say we should have an arena and fight to the death, whoever wins becomes president.

"Two men, hand to hand.
No jury, no appeal, no parole...

Two men enter, one man leaves."

Re:Paper please!

[eightball01]

Same here. I scored fairly well on my SAT. The grade was lost, but by the time I managed to get to college I didn't need it because I was "nontraditional." My first college lesson was that there was a new word for old. :(

Re:Paper please!

[Radar Penguin]

Absolutely! Works to rid yourself of right wing loonies - at least it did down here recently.

I've never understood the fondness/obsession in the US for mechanising/automating simple things & making them complicated.

Re:Paper please!

[Richy_T]

We'd have a better government if whoever loses becomes president :)

Rich

Re:Paper please!

[MtViewGuy]

Oh, yes you certainly can "hack" a paper ballot--remember the 2000 Florida voting fiasco?

I would go with mark-sense ballots filled out in permanent ink. Reasons are simple: 1) mark-sense ballots are easily readable in both machine and hand counts and 2) filling out in permanent ink means positive proof of the vote, which avoids the issue of pencil marks on a ballot being erased, which can cause problems with unreadable ballots and possible ballot fraud.

Re:Paper please!

[mOdQuArK!]

Better yet, organize a nationwide competition like that. After all the fighting is done, the people left over can shoot the winner & then go about electing a president based on intelligence & wisdom rather than aggression.

How much more does it take?

[Opportunist]

Those machines have been proven time and again that they're insecure, not reliable and that it takes special knowledge to even start verifying their results. Now we add ease of manipulation to the fold.

How much more does it take to see that it is a BAD idea?

Yes, paper voting is costy. But we're not talking something where cost is the deciding factor. Democracy is about two things: People participating in the government of their country, and people trusting the government of their country. In a democracy, people have (ok, should have) a say in their country's behaviour. And this in turn should give them a feeling of belonging, they should feel their country takes them serious and as more than just peons who can be ordered around, because they chose their government themselves. This usually means more trust and faith in their rulers, because they themselves chose them (not some divine right to rule or military force, they installed their government).

Especially the latter part is at risk. If you cannot easily debunk any claims of voting fraud, because the means to vote offer themselves for easy manipulation, you open your country for claims of illegal manipulations that cannot be disproved. You destroy the faith people have in their country and the support. Not that it was really necessary these days, people already started losing faith in the democratic process and democracy altogether. But this has the potential to be the last straw.

Cost is not an argument when it comes to voting. If you want people to support the government as wanted by the majority, you have to make sure that it will be seen as the will of the majority. If fraud is easy, dissenting people will always claim foul play and you will not have any chance to call them bad losers. You can't prove them wrong, quite the opposite, we have seen now time and again that they have every reason to be suspicious.

Re:How much more does it take?

[tjstork]

Those machines have been proven time and again that they're insecure, not reliable and that it takes special knowledge to even start verifying their results. Now we add ease of manipulation to the fold

The problem is, a lot of people don't trust the human counters.

Re:How much more does it take?

[Opportunist]

So you don't believe our count? No problem at all. Here's the ballot, count as much as you like.

See? Easy to shoot down any claims of voting fraud. You can count, you can read, you can verify the voting count.

Now please tell me how I, common man, aged past 30 and let's assume I'm not an IT expert, should verify some "count" done by a voting machine.

Re:How much more does it take?

[Anonymous Coward]

Really? And that paper that you gave me with those nice votes on it - I didn't see them the whole time that the people voted before you carried them away in a car and took them to some government building's basement and SAID that you counted them. Now I don't know for sure if you were counting them or making more - that voted the way you wanted. Sure, it would take collusion - but in reality so would the other "hack" on the voting machines. Now, the thing that remains scary is that you could change a whole lot of votes really fast with the computerized systems where it takes a lot more time to "update" the votes on paper based systems.

But it would be silly to assume that nobody could tamper with paper based elections. My parents actually work during the elections as people running one of the California election stations. They did the paper ones and they now do the computer one. After hearing all about how they have had to do both, I have no doubt at all that they could have tampered with the outcome of EITHER the paper or the computer ones if they had wanted to (and wanted to risk the penalties).

Re:How much more does it take?

[CastrTroy]

How is paper voting any more expensive than machine assisted voting? From my understanding, it's extremely cheap.

Re:How much more does it take?

[Selfbain]

To tamper with millions of paper ballots would require a massive conspiracy. To tamper with electronic voting machines, apparently all you need is a 16 year old kid and a computer.

Re:How much more does it take?

[CastrTroy]

That's why with paper voting they have other people watching the counters and verifying their results. People from all interested parties can easily watch what's going on, to make sure everything is on the up-and-up. The same can't be said for machine, as it's really hard to verify that a machine is counting correctly.

Re:How much more does it take?

[Hotawa Hawk-eye]

How much more does it take to see that it is a BAD idea?

I think we're only going to see people turn against electronic voting machines that do not have a paper trail once someone manipulates a vote using those machines so far that it's impossible to ignore. If, for instance, ALL the votes in the state of California (over 50 electoral votes -- I believe 271 or thereabouts gets you the White House) were changed to vote for CowboyNeal, that would be a situation that couldn't be ignored. The major news organizations would _have_ to cover that story. It would take that level of outrage (or the level of having all the votes in the state of New York be modified to be votes for Osama bin Laden, for example) to get the message through that these machines are not secure and that we shouldn't be trusting our votes to them.

Re:How much more does it take?

[Insect Eater]

To toot my own horn, I published a statistical analysis of the machine inaccuracies here: 1 Percent Tally

Re:How much more does it take?

[porpnorber]

The trouble is, we live in a world where the resources of the adversaries of the electoral system seem to be immense. It appears to be feasible for them to 'buy' (or in any case control) significant numbers of the polling stations, and to manipulate their procedures on a grand scale. As such, an electronic voting system that worked would be a big help: it would make verifiability a centralised problem that organisations with some clout could get involved with. To put is differently, we are currently allowing the enemies of democracy to employ distributed fraud. Centralised fraud is easier to detect, and (at least in principle) easier to audit.

Think about it as a protocol problem. As I've said elsewhere today, they can give you a printed sheet bearing two random numbers. On voting day, you enter one of the random numbers into the voting system, by an insecure channel if you like. Only the tallying system knows which numbers are 'red' and which are 'blue'. At the end of the election, all the votes are published: a sorted list of all the numbers counted for each candidate. Voters can choose themselves between being paranoid and destroying their information sheets as soon as they have cast their votes, or retaining them and verifying that their votes were correctly counted.

Fixed numbers of dummy votes (indistinguishable from real ones) can be inserted for each candidate (and then subtracted off the candidates' totals at the end, of course) to provide for detection of systematic fraud without revealing anyone's vote.

Does this scheme have any flaws worse than those of a paper ballot? Is it difficult to implement? The only disadvantages I really see are that it doesn't make a lot of money for anyone's friends, and it makes the election's outcome hard to manipulate, neither of which is attractive to the kinds of people we find in contemporary politics :(.

Re:How much more does it take?

[laron]

The security of paper based voting stems from procedures. If you count behind closed doors, it is of course insecure.
Around here, after the polling station is closed for voting, they open the box and count the votes right in the same room where the voting happened. And everyone is free to stay and watch.

Re:How much more does it take?

[Opportunist]

It's similar here. The counting takes place in the largest hall in town (or district, depending on the amount of votes), a few policement in case someone tries something funny (the duty is usually very popular, since all you gotta do is stand around and get paid for it), one delegate from every major party and whoever wants to watch the whole procedure.

Re:How much more does it take?

[Opportunist]

Well, you need a lot of people every time, and it usually takes some time to count all the votes. But yes, considering the price of those voting machines (and probably the contracts attached to them), paper voting could be a whole lot cheaper, too.

But like I said, money is no issue in this case. Democracy may cost a little. I'm willing to pay my taxes for that.

Re:How much more does it take?

[Opportunist]

What would keep a fraudster from adding more numbers to the system and having those phantoms cast votes in favor of his candidate?

Re:How much more does it take?

[Opportunist]

Oh c'mon, you should know better than that. The outcome would be a manhunt for the bastard who dared to attack democracy and the American way of life, he would be caught and turned into a terrorist. Then we'd hear that the hole he used was plugged (whether or not it was, who cares) and the voting machines get back to work.

Re:How much more does it take?

[porpnorber]

That's a problem with all voting systems, indeed all government. Which citizens, in fact, exist, and therefore have rights? I tend to favour secure centrally administered ID schemes in which there's a trusted token associated with each person, but one that can manage multiple logical personae; but clearly that's also a politically hot question. But in any case, I think we need to separate voter enumeration from voting per se (indeed, that's exactly the point of secret ballot).

easy solution

[Anonymous Coward]

1 ban linux and paperclips
2 ???
3 profit!

This begs the question

[oliverthered]

Does it make paperclips and Linux illegal in Germany now that they can be used for hacking?

Re:This begs the question

[matt me]

Does it make paperclips and Linux illegal in Germany now that they can be used for hacking? Shit, are you an insider? How else would know that the "common office implement" in question are papercl*ps?

Whats the point of e-voting

[gmthor]

I believe the most important thing about e-voting is that you can't pic up a random person from the street, explain him how it works, and after it ask him if the process of voting was done correctly. Paper voting on the other side is so easy that manipulation is easy to realize. I mean the only point of e-voting is that some poor government officials can go home earlier. I want Democracy for everybody.

Re:Whats the point of e-voting

[Twisted Willie]

The point of e-voting is to remove human error (in all shapes and forms) from the counting process. Assuming that at one point the electronic voting machines can be made secure enough, it's a much better way of getting accurate numbers than by paper voting.

Re:Whats the point of e-voting

[Opportunist]

That is exactly the problem with e-voting: You have to trust.

With normal pen-and-paper voting, all skill you need is being able to count and discriminate between various candidates being chosing on the paper. You don't believe my count? You think I'm trying to fix elections? Here's the ballot, count for yourself.

With e-voting, you face a problem. You need very special skills to actually conduct a recount (if it is possible at all). Don't believe me that I'm not trying to fix elections in my favor? Sucks to be you if you don't happen to have the skills.

Re:Whats the point of e-voting

[Firethorn]

electronic voting machines can be made secure enough

That's currently the big if right now. It's just not transparent enough, and it's like all the companies building machines forgot completely about security; substituting a little theater instead. In addition, I don't like how a single machine or media failure can take out all of a machine's votes for the election. Two or three of those can throw elections today.

In addition, most of the advocates of paper voting have been talking about optical scan ballots. This opens up recounts to multiple solutions - Company X's scanner, Company Y's scanner, verified by hand if deemed necessary.

I am not one of those who believe that hand counting is automatically the most accurate - but optical scanning is old tech at this point, very accurate, and most importantly - auditable.

Secure and accurate Voting is always going to be complicated and tough - especially when you figure that you normally have at least two parties with people willing to cheat, who may be in the system.

Re:Whats the point of e-voting

[will_die]

This has to be meant as a joke.
If not please look into Florida and the problems that they had with paper ballots. Then look into the dead voting in Chicago and Texas and see how easy that was to detect when paper ballots were used. That is not even mentioning all the times ballots were found in people car trunks, uncounted votes were found during the following election and ballots that are cast out because they have extra markings.
The reason that e-voting is being pushed is because it is better, the reason you hear about all this stuff with e-voting is that it is easy to detect and flag.

Re:Whats the point of e-voting

[CastrTroy]

Exactly. I'm a software developer. Most people would say I'm a pretty smart guy. However, it would still take me a lot of research to be able to verify that an electronic voting system is even secure. If I could verify it at all. And still when I walk up to the machine on voting day, it would be impossible for me to verify that the machine was running the correct software, unmodified hardware, and was actually doing what the original design said, and not something else.

Re:Whats the point of e-voting

[Rob the Bold]

Paper voting on the other side is so easy that manipulation is easy to realize.

Not to be pedantic, but the system in question does use paper (just not easily human readable). People mark machine readable paper ballots, and the PBC can be used to check the ballot before they turn it in to ensure that it is not over- or under-voted, etc. From the description of how they are using the PBCs, it sounds like they are trying to avoid some of the kinds of problems reported in Florida 2000, by letting a voter see how the machine will tally their vote.

The votes are counted electronically, but paper is still used -- in a fashion.

Re:Whats the point of e-voting

[oliphaunt]

I mean the only point of e-voting is that some poor government officials can go home earlier.

You're far too kind. The only point of e-voting is to allow Republicans to steal elections that they could not win legitimately.

Re:Whats the point of e-voting

[porpnorber]

E-voting is only hard to understand if you don't choose the right protocol. Actually, the internal details of how paper votes are manipulated are pretty arcane; it's only at the 'count the tokens' level of abstraction it seems easy. So—make sure your electronic voting scheme has a 'count the tokens' layer, already!

Re:Whats the point of e-voting

[georgeav]

With normal pen-and-paper voting, all skill you need is being able to count and discriminate between various candidates being chosing on the paper. You don't believe my count? You think I'm trying to fix elections? Here's the ballot, count for yourself.
In my country paper voting is done this way: there is a big list with all the legal voters (mostly... 18+ years), and when you go there, you show your ID and sing next to your name on the list and they give you a paper where you have to tick one of the candidates and put it in an ballot.
There are two problems for this, the guys controlling the voting in some areas could sign for some of the people who didn't show up and add some extra papers in the ballot... count the ballot, no problem !
Another way, during the voting you can be in a different city and you would be pissed off if you weren't allowed to vote; so there are temporary lists; they add you to this temporary list and you swear you didn't vote before. Well, getting all this temporary lists and checking all the names there if they have already vote is some PITA, so I don't think they sweat to much checking this; so there are a lot of reports of this kind of things happening; in some rural area, the party X got a bus full of people and visited all the villages in that area, etc, etc.
So, paper voting can't be accurately audited either.

With e-voting, you face a problem. You need very special skills to actually conduct a recount (if it is possible at all). Don't believe me that I'm not trying to fix elections in my favor? Sucks to be you if you don't happen to have the skills.
What about this.. two separate networks with two kinds of electronic machines run by two different organizations. You go to the first "voting booth" and using buttons or touchscreen you check the candidate, the vote gets automatically sent to server where is counted and the machine prints a piece of paper with the chosen candidate, you take that piece of paper and insert it in the slot of the second machine which runs some simple OCR on that one, shows the selection to the voter asking for confirmation and if ok, the info gets sent to the second server, and the paper stored for auditing. As the paper is standard and it's stacked by a machine it can be stored pretty easy and create baxes which could be feed in a "auditing machine" (think punch-cards).
OK, somebody could hack both machines and make them display something and check something else on the paper and send to the server; but you can also add generate an ID for each vote, print it on the paper and for validating the votes on a machine get some random papers from that machine and check against the databases.. what is printed vs what's in the database. You could also use this id to check for inconsistencies between the two databases.

Re:Whats the point of e-voting

[Opportunist]

Well, the problem of ticking off people who didn't come and toss a vote for "their" candidate has been eliminated quite efficiently here: Every party has the right to put a representative into the voting comittee to sit there and watch out that nobody does something like that.

And if you're not at home, you can't vote. Period. You have to vote where you're registered. If you have no chance to vote at home, there are various options available to you. If you're abroad, you can have an official voting card sent to you (which are quite hard to forge, think money bills) and send in your vote that way. There are voting comitees going through hospitals and retirement homes to collect votes there. And so on.

A clean, fraud-proof voting system can be implemented with pen and paper, without a lot of technology surrounding it. Yes, it takes manpower. But it's worth it.

Let's do it like the ancient Greeks ...

[Ihlosi]

I'm sure it's hard to hack a sheet of paper and a cardboard box. Please, leave democracy "unhackable", because where there's no paper for voting, there's no hard proof that you really did it...

... and scratch our votes into shards of pottery. How's that for hard proof ?

Alternatively, just use a whole brick.

Don't kid yourself...

[fahrbot-bot]

I mean the only point of e-voting is that some poor government officials can go home earlier.

...there's more money to be made than with paper and pencil voting. Producing cheap, insecure machines without a paper trail increases companies' profit margins. Lawmakers have be lax and slow to respond, probably because their hands are so comfortable in those companies' pockets. Obviously, the only ones who care are "some" of the voters. Hopefully, that will become "most".

I, for one, like seeing my vote on hardcopy.

Sounds good!

[4D6963]

The paper seals were easily bypassed, and the lock could be picked with a "common office implement". After cracking the physical security of the device, the testers found it simple to reconfigure the BIOS to boot off external media. After booting a version of Linux, they found that critical system files were stored in plain text. They also found that the election management system that initializes the voting machines used unencrypted protocols to transmit the initialization data to the voting machines, allowing for a man-in-the-middle attack.

Well, sounds good enough! What are we waiting for to adopt this thing?! Do these guys make avionics software as well? Because I'd be delighted to put my life in the same hands we put our democracy in!

common office implement

[Threni]

What, a service pack?

I saw Heroes last night ...

[ThirdPrize]

and all you need is one of them little kid things to rig the election.

Translation...

[daninspokane]

"Common office implement" AKA: Paper clip and some whiteout I hear Richard Dean Anderson was on the testing team, so really, that's their own fault.

Why the effort to prove it wrong?

[Anonymous Coward]

Why are so many working so hard to prove how insecure these systems are? Is it not true that the current paper system and methods are less secure than any of these electronic systems? These researchers into the security of these systems should also use their smarts to improve and provide more secure systems rather than waiting for the next release of a voting machine to scan over and point out its flaws. It seems like the market is open for someone to actually put together a secure system. If they are smart enough to find the flaws in these systems then they should be able to put together a venture and build a real secure system. With their experience debunking other systems they can continue to use this skill to counter the claims of their competitors.

So much effort proving the system is faulty rather than working to improve it. If to much time is put in proving the electronic system is faulty we will never be able to move away from our existing faulty system.

Re:Why the effort to prove it wrong?

[Anonymous Coward]

Is it not true that the current paper system and methods are less secure than any of these electronic systems?

No, it is not true, and that is the point. Proponents of electronic voting systems want something which is inherently unfit for the purpose. Elections must be transparent. No computer system can achieve the transparency of collecting pieces of paper in a ballot box and counting them under public supervision. Electronic voting systems try to achieve transparency in a multitude of ways, but all systems either don't achieve transparency or they violate one of the other two requirements: secret and unprovable votes (nobody must know who you voted for and it must be impossible for you to prove who you voted for.) The people who expose the flaws in electronic voting systems don't try to build a better electronic voting system because they know the futility of the task. As long as that insight hasn't reached the masses, they must refute every flawed instance of e-voting.

Re:Why the effort to prove it wrong?

[deniable]

Um, #|brain>mouth ?

Let me tell you about our recent federal election. We had two pieces of paper to fill out. I marked them with a pencil and placed them in boxes being watched by multiple election officials. These boxes are then transported to a central location by multiple officials. Each ballot is then counted with officials from each party watching. We had a result by midnight and nobody is crying foul.

How is this less secure?

Re:Why the effort to prove it wrong?

[Anonymous Coward]

Why are so many working so hard to prove how insecure these systems are? Is it not true that the current paper system and methods are less secure than any of these electronic systems?

If you check surveys, overwhelmingly computer experts and computer security experts believe that electronic voting systems are inherently insecure and LESS secure than traditional paper counting methods. Ironically, the uneducated public generally believes that the computer-based systems are more secure. Therefore, people are working hard to demonstrate what the computer security experts already know in a clear way to the uneducated public.

If to much time is put in proving the electronic system is faulty we will never be able to move away from our existing faulty system.

The existing systems are not really very faulty in comparison. An entirely computer-based system can be completely compromised, without anyone knowing, and the vote can result in a completely different candidate being selected rather than the one desired by the voters, without anyone even noticing the difference. In actual fact, studies have shown that this may have ALREADY happened, and statistical analysis is the only residual evidence because the electronic voting process cannot be audited!

In comparison, manual counting of paper ballots IS secure because you can have an arbitrary number of people stand over a person's shoulder and watch them count, and you can also have multiple people count the ballots until the results agree. The act of observation and the ability to perform an audit changes an election from a flimsy facade to functionally secure. Any anonymous vote which is counted by entirely electronic means cannot be trusted. This is fundamental, and has been known for quite some time.

The best you can hope to obtain by introducing computers into the mix is the use of computers to print out a paper ballot which can be verifiably counted. This does have the benefit of allowing the disabled to vote by computer system, plus with the benefit that there cannot be any "hanging chad" problems with a clearly printed paper ballot. But most importantly, it also allows a counting process which can be observed and audited.

Paper Seals = DoS?

[kieran]

If the machines have paper seals in an accessible place, then you could very easily DOS the vote of a district that is known to be unfavourable to you simply by slicing the seal with your thumbnail, without ever having to hack the machine at all!

Re:Paper Seals = DoS?

[Rob the Bold]

If the machines have paper seals in an accessible place, then you could very easily DOS the vote of a district that is known to be unfavourable to you simply by slicing the seal with your thumbnail, without ever having to hack the machine at all!

That's true, but anything accessible to the public could be potentially vandalized. At least the jurisdiction in question is using the PBCs to let the voters check their ballots, and not necessarily for counting the precinct results. If the machine were vandalized, the precinct operation would be degraded -- by not providing a way for voters to check the ballot -- but not totally offline, since the marked ballots could be counted elsewhere on an intact machine.

You're still right, making it so easy to vandalize by using paper seals instead of something a little more durable was not a very good choice.

Criminal organizations

[paulproteus]

If I defrauded a state and sold it uncertified voting equipment, I'd be in jail.

Why isn't this organization, which has clearly committed a criminal act, in jail?

Re:Criminal organizations

[gznork26]

"Why isn't this organization, which has clearly committed a criminal act, in jail?"

Because you can only put people in jail, not organizations. Even though corporations have usurped some of the rights of personhood, they do not have to bear the risks, and if they're careful, they never die.

But what if they could be jailed? What if they could even be executed for murder? I'm a writer, so I decided to find out, by running a little thought experiment in the form of short stories. The series (there are 8 stories so far) starts with a tale called "Logical Conclusion", which begins like this...

=====
Would you just look at all these lawyers. The glare from all that dental work is worse than the TV lights I've been staring into lately. I'm glad I remembered my sunglasses. Lawyers. You'd think this case was going to set off a litigation frenzy the way they're swarming.

I just hope none of them gets a good look at me. I swear, if one more photographer wants a copy of my face, I'll take his in trade. It's gotten so bad lately that I've even started to avoid looking at mirrors.
=====
The whole thing is located here:
http://klurgsheld.wordpress.com/2007/08/30/short-story-logical-conclusion/

The stories have a convenient forward link at the end, so it's easy to track through it if you want. Of course, if you want to know what happens after the most recent one, "Unvarnished Siding", you'll have to check back once in a while. I'll be adding the ninth installment this weekend.

Re:Criminal organizations

[Anonymous Coward]

people are jailable. They're singular entities that exist in one place. One person is accountable.

corporations are groups of individuals, who all can pass blame on someone else. Sometimes CEOs get fired if the corporation gets caught being overtly malicious, but more often than not its some nobody on the factory floor who gets fired for "making a mistake". On those rare instances the CEO gets fired, the company proceeds as it was, just being careful not to get caught. Would you jail everyone involved with the company, even the janitors? The investors? Perhaps if investors did receive some form of punishment (fines, etc), they'd be _very_ interested in making darn sure that those companies they invested in behaved well, which would in turn make CEOs and the like very interested.

Corporations benefit from many of the perks of being legally regarded as an 'individual', but instead of people they more often than not the remind more of some Lovecraftian elder evil or metaphysical trout that bends the wills of mortals.

Audit

[conureman]

Anyone is free to come in, hang around, and watch the election. If it happens inside a black box, there ain't much to see. I've been a poll worker for many years here in the People's Republic of California, and you should see the tin-foil-hat-types that come in to be poll watchers. Comedy. That said, although all the precinct workers' primary goal seems to be upholding the integrity of the system, I don't think I'd advise any one to trust a system that CAN be gamed.

Psh

[kitsunewarlock]

Find me a machine that can't be hacked by a paperclip and I'll find you the episode of Mc Guyver that'll prove you dead wrong.

What's next?

[InvisblePinkUnicorn]

Next authorities will be cracking down on the creators of vi for releasing software capable of hacking the electoral process.

And then what?

[InvisblePinkUnicorn]

Authorities will start cracking down on the creators of vi for releasing software capable of hacking the electoral process.

Ban all paper clips

[flyingfsck]

Well, obviously the solution is to ban all 'common office implements' since they constitute 'anti-circumvention devices'... sigh...

Moving into the electronic age...

[doit3d]

...can be a good thing, but this really concerns me. I'm all for changing with the times, don't get me wrong. I just feel that electronic and software items which play such a critical role in the much corrupt political system we have today do need more oversight from public entities, not private companies or political agencies. I feel we are far from where we need to be for electronic voting in the US to be reliable or trustworthy. I do have hope that it can be an option in the future though.

I opt to kill a few trees to retain the paper method for now. I was forced to use an electronic voting machine (Diebold) in my district during the last local election in my state. I will not be using one regardless come the next election. Anyone can manipulate the machine behind the privacy fence surrounding the machine, without anyone knowing about it. Who is to say it cannot be tampered with even before the people are given access to the machine to cast their vote. I do not feel comfortable using an electronic voting device at this time.

I am almost 100% convinced that major elections do not matter anymore in this country in this day and age. The rich, and the corrupt have a strangle hold on our government and the media. Just look at the biased mass media coverage that is happening today. It is as if the media has already made the decisions for us about the elections, and those who own the media have very powerful ties to the government. There are no real debates between candidates, but they are still called debates. There are no tough questions, and there are no truthful straight forward consistent answers but from a couple of candidates, which are silenced and kept from the publics knowledge by powerful people whom are in control. I do have some hope, but it is fading fast.

I honestly feel that there will be another civil war in this country if things continue the way they are. It will not be the Whites against the Blacks, against the Hispanics, etc... It will be the poor against the rich. You know where the corporations and the corrupt politicians will stand when this happens. Change takes ballots or bullets. Sooner or later people will be tired of trying to make change peacefully with ballots.

It may not happen in my lifetime, but I think it will happen sooner than anyone thinks if the current path is followed. All it will take is someone high up in the military to finally get fed up with the corruption to take the action of cleaning house. We have already seen first hand the dissent in the military ranks all the way to the top. Several generals have peacefully resigned/retired and spoken in protest to the insane, illogical decisions made by the current administration and the path it has taken us down. Sooner or later someone with a bigger set of balls will do something about it if this continues.

It would not be a good thing to have this happen, but if things continue the way they are I would sadly be in support of it. It would be a rough road, but change is needed in a bad way. We are currently on a path of assured economic destruction, which will have effects far and wide around the world. We should learn from the past history of other, once large and powerful Republics. It seems to me that we are doomed to repeat history unless there is change.

I hold the hope though, that this vast information highway called the internet will tip the field in the favor of the people in due time. The option to see and read more news from many sources, rather than the few sources force fed to the masses controlled by the powerful and corrupt few. The internet has broadened my view of things. This too may not happen in my lifetime, but I hold hope that it will foster a peaceful change in time.

I hope for a peaceful change, but I am very afraid of what could and might happen.

Re:Moving into the electronic age...

[StickyWidget]

...he said from his armored concrete bunker in Western Colorado while cleaning his .30-06 rifle and wearing full jungle camouflage.

~Sticky
/Removed my Karma bonus from this one, cause it's flamebait.

Re:Moving into the electronic age...

[Anonymous Coward]

Well said. It's a shame that the majority of U.S. citizens seem to be unaware of the decay of our republic.

Re:Moving into the electronic age...

[elvisjagger]

You've said almost exactly what I've been thinking...

REALLY open the voting...

[zippthorne]

Every vote is assigned to an ID. Not your ID, but a relatively random numerical one. When the voting is done, the entire votes database is made available on DVD (or whatever medium is appropriate to storing 300 million records. I wouldn't expect much space at all, I'd bet the IDs take up more space than the actual data.

Then independent organizations can tally the votes themselves and verify that the election was on the up and up. They can also allow people to check their votes in the database to verify individually that the database itself is correct. Assuming the database has been distributed in whole to all of the various organizations, mis-votes should be easy enough to discover.

Then it only remains that you need to protect people's anonymity. A ticket that can be used to verify an individual vote on behalf of a person can also be used to verify that vote to the satisfaction of a vote-buying machine (or worse.)

A solution is to obscure the information by giving each voter not one, but a list of ID numbers and told which one is theirs privately. That way, nefarious organizations wouldn't be able reliably say they've been given the correct number, which should kill their scheme. It's not a perfect solution, though, and I can already see flaws in it, but that just means it needs a bit more work before it's ready for prime time.

Re:REALLY open the voting...

[naturaverl]

Great idea, but there's still one loophole: You've covered mis-votes, great. But how do you prevent some organization from adding "fake" votes in favor of one candidate? Without requiring a voter name and/or identifying ID to be recorded, legitimate voters could verify their legitimate votes as much as they want, but they'd be none-the-wiser about the additional fake votes.

Re:REALLY open the voting...

[Opportunist]

The whole procedure still requires me to believe that every vote punched into the machine was counted, and counted correctly. When I already doubt the machine and its ability to assign votes actually to where they were meant to go, it's moot. What you suggest is akin to someone counting the votes and then handing me a list telling me that vote number 10 voted for party A. Do I trust that person? No.

In a pen/paper voting process, I have the exactly same item in my hands at counting time that the person voting had when he cast his vote. His sheet of paper where he made his cross.

Re:REALLY open the voting...

[Anonymous Coward]

A solution is to obscure the information by giving each voter not one, but a list of ID numbers and told which one is theirs privately. That way, nefarious organizations wouldn't be able reliably say they've been given the correct number, which should kill their scheme. It's not a perfect solution, though, and I can already see flaws in it, but that just means it needs a bit more work before it's ready for prime time.

It's possible to give voters partial receipts that can't prove how they voted but can still be used to check the vote tally. These techniques require sophisticated cryptography on the back end, but the process can be made transparent to voters. For example, see Scantegrity.

Re:REALLY open the voting...

[zippthorne]

The entire list of votes should be published in multiple locations. Then, you can go to any of these locations and verify that your vote is correctly recorded. Copy holders, which could be anyone who can afford the print cost since the data is anonymized, would be able to compare their copies of the lists to make sure that they did, in fact, receive identical copies.

Everyone need not check their vote from multiple copies, but the copies should be ubiquitous enough that they have plenty of opportunity to if they choose.

Copy holders would then be able to run the tallying software (or tallying software of their own design. The format of the database should be an open standard) and compare that to the official tally.

That confirms that the lists are the same lists, and that the checked entries are correct, but as pointed out in another reply, it fails to confirm that unchecked votes are real. If many people check their entries, there would be a high probability that real unchecked votes are also unmodified, but no guarantee that fake votes (which the faker would know had zero chance of being checked) are not present in the system. An upper bound on fraudulent votes can be determined by keeping lists of checked votes. The total number cannot exceed the number of unchecked votes.

howitzer for flies method

[Anonymous Coward]

..really. computerized voting is not needed, a waste of resources (cash, manufacturing effort, etc, maintenance), inherently insecure (there is no possible way for a set of normal voters eyeballs to verify a count), it allows for the potential for widescale vote tampering,way way beyond any previous efforts where it had to be done precinct by precinct by corrupt individuals en masse, costs bundles of cash compared to paper and an empty box, and already has a track record of being possibly implicated in massive vote fraud that lead to profound differences in the apparent wishes of the electorate (using exit polls) and what allegedly happened (the alleged accurate vote count). Just look at Ohio in the last presidential race there. That badboy was hacked, no getting around it.

Computers have a place in our society, using them for elections is not one of them. Sometimes the complicated method is not the preferred method, ie, using howitzers to shoot down flies. Look at the wishlist of complicated crap you want to try and make it secure. I mean, really, just don't use computers in the first place. Make the vote a 24 hour period, and a national holiday so there is little excuse to not vote, and use paper ballots. Every fix the computers scheme out there always falls back on a paper trail. duh, just use paper then! Eliminate that complicated middleman. That and instant runoff voting or something like that combined with severe caps on campaign financing (it shouldn't take hundreds of millions of dollars to run campaigns, and face reality, these are almost pure bribes once you look at them hard, set a hundred dollar cap on all combined contributions per human per election cycle) would improve the political process immensely, Computerized voting machines are designed to be voting manipulation devices,and taxpayer cash suckers, fullstop. It's just generally a totally bad idea, this trying to fix computerized voting is turd polishing.

Are voting machines worse than ATMs?

[dpbsmith]

I'm very curious to know. Are the vendors of voting machines just cynical, and believe that nobody really cares about security and that they can pull the wool over the eyes of the people who make the buying decisions?

Or do they find that the people who buying voting machines are equally cynical, and really just want cheapjack machines, paying only lip service to protecting the public that uses them?

Or, if the truth were known, are ATM machines really just as bad?

(Anyone know what the relative cost is? Judging by general appearance, size, weight, and geek guesswork, I'd think an ATM might cost $50,000 exclusive of installation, an electronic voting machine might cost $5,000, a "traditional" levers-and-counters no-electricity mechanical voting machine about the same, and a punched-card voting machine $500... anyone know the real numbers?)

Re:Are voting machines worse than ATMs?

[doom]

dpbsmith wrote:

I'm very curious to know. Are the vendors of voting machines just cynical, and believe that nobody really cares about security and that they can pull the wool over the eyes of the people who make the buying decisions?

Well, you're asking for speculation about motives (essentially you're asking the "malice or ignorance?" question), which makes it difficult to say anything with any certainty, but the major voting machine companies are run by people with personal connections to each other, and these people are politically connected with well-known Republican biases.

Further, there was an interesting incident with a programmer whistle-blower who claimed he had been approached by someone who wanted to be able to rig elections.

So myself, I think the answer is "malice": these machines are designed with election rigging in mind.

Easily explained to Congressmen and the Media

[smchris]

Those were _HACKERS_! They booted a linux CD!

In other news...

[proxy318]

Ocean found to contain water.

Make it stop!

[Anonymous Coward]

You guys are all tech-inclined so you care about whether or not somebody can boot a voting machine into Linux and in what format the files are saved.

Seriously, this is not how voter fraud happens in this country. I keep saying this every time some idiot posts an article like this. Voter fraud in the U.S. consists of people signing the poll-book for voters who did not show up, and then voting on the machine for that voter. There is no booting into fucking Linux.

(By the way, this happens no matter whether you're using computer systems, lever machines, or an "HB #2 pencil.")

Welcome to the real world, kids.

Re:Make it stop!

[MLease]

It's true that this is the way it's happened in the past, and probably continues to happen now. However, it's a lot harder to produce massive fraud this way than it is using a technological approach. What you describe is a retail version of vote fraud; the technological approach is a wholesale version. One person can affect many more votes by hacking the machines than by usurping the votes of legitimate voters who didn't show, and the more people you have involved in a conspiracy, the greater likelihood that someone will spill the beans.

-Mike

I WIN THE NEXT VOTE

[Anonymous Coward]

Because I am the worst and most evil party you can imagine, and all I need to do is to pay fewer and fewer people .. find out yourself if I payed voting machine companys or only for IC manufactures that deliver to voting machine companys .. maybe I also only payed one single programmer within one of those companys .. well, hopefully you'll never find out so I CAN RULE THE WORLD!

How about this for a ballot?

[thirty-seven]

How about a ballot like this, marked with a pencil? And after you mark it, you fold it and present it to a poll worker, who looks at the folded ballot and verifies there is only one, valid ballot and initials it, then hands it back to you and you put it in a simple cardboard ballot box. The votes are counted at each polling place by the poll workers, and representatives of each candidate can observe, and it is open to public observation. Is this just too simple?

Who Cares?

[AK Marc]

Electronic voting machines don't have to be secure at all. If they make a paper trail, you can hack every single one of them and not affect the outcome of the election. The push for "more secure" eelctronic voting systems is completely missing the point. Using electronic voting should be required. They have options not available to paper voting. And, yes, electronic voting is more reliable (even if every single machine is hacked) than paper voting (presuming it isn't a DOS, in which case paper can be used). So whenever someone complains about them not being secure and their suggestions are either that electronic voting is bad or that electronic voting security can be improved, I can only think they completely missed the answer.

But this is paper voting!

[b00tang]

I know this is slashdot so no one RTFA, but I'm sorry, I got curious so I did, and its all FUD.

This report IS talking about paper voting. The system they hacked is an optical scan reader. The only difference with your HB #2 is that they use a pen instead.

There was never any e-voting here. In fact, this system (the article calls it the "inkavote" system) doesn't even have anything to with counting votes! It just makes sure that the ballot was marked properly so that the problem can be caught before the ballot is brought to the central vote counter. All it is is a simple system to help make sure people don't vote for 2 presidents or something like that.

Then don't even get me stared on the "selling uncertified equipment" FUD. The equipment in question was certified by the federal government for a insignificant change and when a new politician stepped up in California suddenly the federal certification wasn't good enough. And again the machine in question wasn't there to count votes, just to help people make sure they voted correctly (I think it was for disabled people at that).

I just don't get it, there are a bunch of engineers working to make these voting machines, and its all the politicians who are creating all this FUD... this is slashdot, usually aren't people biased on the engineer's side?

Re:But this is paper voting!

[Darinbob]

I want to mod this up, but I need to reply instead because I both agree and disagree...

You're right. The machine is question is not being used to count ballots. It is being used to verify that voters have marked the ballots correctly, allowing ballots to be redone if the ballot is blank or there were overvotes. There is also an audio component to allow verification of ballots by blind voters.

However this particular machine is designed to be able to count ballots also. It just happens to not be used for that purpose in the County and City of Los Angeles.

So, in the context of "this machine is never used to count ballots" I would say that there is a lot more panic than necessary. If these machines were compromised the result would be to possibly deny votes to some people when poll workers keep telling them they voted incorrectly. Yes this is a problem but it would be difficult to rig an election this way. An attacker would likely compromise the machines in order to make the elections look bad and to claim voting irregularities (as we all know governments always ignore claims of irregularities since it's too impractical to start the election over from scratch).

However since the machine was designed to count ballots, there are some extra considerations. The design of this system says bad things about the company's products. The company obviously assumed its security was "good enough" for ballot tabulation somewhere. Should other products from this company be trusted? Maybe the security blind spots this company has spreads to their other produtcs. While this product is ok to use as a vote verification device, it should raise lots of alarm about the quality of voting machines in general.

and when a new politician stepped up in California

As for California's Secretary of State, I'm glad she's doing her job this way. It is a good quality in a secretary of state to be suspicious and wary. Previous office holders were too much like other election board members - too trusting of e-voting machine marketting more concerned about election worker convenience than in accuracy and reliability.

...suddenly the federal certification wasn't good enough.

Who cares if the federal government certified these machines? The fed standards should be the minimum standards, not the maximum. Individual states should be allowed to have better standards than the feds if they want. This isn't a commerce issue where higher state standards cause auto-makers to gripe. This is an issue over the fundamentals of democracy.

usually aren't people biased on the engineer's side?

And I'm an engineer. That does not prevent me from pointing out bad engineering where it exists. There's no logical reason for me to side with an engineer over a politician just because we're in the same field. I'm in no union that demands solidarity over competence.

Re:But this is paper voting!

[b00tang]

I agree with what Darinbob said, and as I am not an expert in this field I appreciate his corrections and clarifications. On the one hand these election companies should have higher standards, but on the other hand I just have to stop and ask: why aren't they producing voting machines with decent security? I just can't believe that their engineers are incapable of installing even the most basic security. So I wonder where there might be other sources of error. Perhaps it is unoriginal but I'm suspicious of Secretary's of State and County Clerks (politicians in general I suppose) in this case.

Strict certification standards are great, but if it costs around one million dollars (or I assume that it is at least a few hundred thousand) to obtain certification just so that you can improve the lock on the machine or make some other small change then I could see a significant reason not to update that machine. Similarly I could imagine that they might use these low security machines in low security situations because they are already certified and the company doesn't want to spend all that money trying to certify a new machine.

I've also seen people suggesting in these comments that the companies making e-voting prefer it to paper ballots because they can make so much more money, but I just don't see how these companies could be making much of any money. They are constantly getting sued for large sums of money based on improperly navigating minor differences in details of the election laws between counties.

I understand that people want to maintain state's rights but in this case I think the whole election system would be greatly improved if all the states could just agree on one set of election rules to all abide by. If say Ohio's voting laws make it more secure than Montana (just an imaginary example) does it really make sense for all Montana residents to get hosed?

If you bypass physical security, it's all over

[mdvolm]

The first round of tests focused on the physical security of the Polling Ballot Counter (PBC), which the Red Team researchers were able to circumvent with little effort. "In the physical security testing, the wire- and tamper-proof paper seals were easily removed without damage to the seals using simple household chemicals and tools and could be replaced without detection," the report says. "Once the seals are bypassed, simple tools or easy modifications to simple tools could be used to access the computer and its components. The key lock for the Transfer Device was unlocked using a common office item without the special 'key' and the seal removed."

You can stop reading the article here. Once physical security has been breached it's all over. With the machine open, you now have complete control over it, even to the point of changing out the hardware. This also applies to any machine that handles money, including ATM's.

All the software security measures in the world won't protect you if physical security is breached. So, if the physical security of a voting machine cannot be maintained at least as well as an ATM, or better yet a slot machine in a casino (constant surveillance), then using the voting machine in the first place is NOT secure.

Re:If you bypass physical security, it's all over

[mdvolm]

And I should have added "... regardless of what software is running on the machine or what security measures said software has implemented." to the end of the previous comment.

Re:If you bypass physical security, it's all over

[Rebycman]

Most of us here know how much of a joke these machines are. They MUST have a paper trail for every machine or I can alter every vote that has been registered on a single machine with a simple degausser. *Poof* no votes stored on that machine and I didn't even have to open the case! Better yet its irrelevant if its Linux, Windows, or even plain text/encrypted hard drive. Really the only thing that will stop this is as you said surveillance or a paper trail. Its true you cant affect a large number of votes this way but you can affect some votes (and at times a few votes altered is enough, even if they are just removed). What if me and 9 friends went to 10 different polling stations in democratic neighborhoods and wiped just one machine at each location, how many democrat votes could we affect? Its stupid but there are a great number of political fanatics out there and I wouldn't put it past them to do something like this if given the chance.

Let the conspiracy theories begin!

Better Solution

[protolith]

I have a better solution.
Every voting machine should print out a receipt for the voter with a unique number printed on the receipt that is also associated with the votes cast and retained on the storage card. The vote number can be a combination of the serial number of the voting machine coupled with the date and a simple sequence number (or a function of the sequence number)

The votes collected should then be hosted in an online database that can be searched by the receipt number. This would allow any voter to review the vote cast and ensure that what was received on the receipt is the same as what was officially cast.

Anyone skeptical of the e-voting method would obviously jump right on this chance to participate in this kind of scrutiny. More importantly, any report of a discrepancy would result in a flood of voters checking on their cast votes.

Anyone trying to tamper could not know who will check to confirm their vote, and would have to allow every cast vote to be retained as cast. Solid verifiable evidence of widespread tampering would either result in demand for a revote, possibly using a different method like a paper ballot , or would result in civil uprising.

To prevent ballot stuffing, the people working the election booths would be required to count the number of voters that use each machine and enter that number with the date and the machine number. This number would be entered independently in the online database (perhaps through a secure login). From the searchable database, the number of votes for any given machine could be calculated from the recorded vote ID numbers and compared to the independent count for the date. Third party oversight could be as simple as allowing people to watch a machine from a distance and count the number of voters that step in the booth. Because all of this information would be made immediately available to everyone, the number of eyes scrutinizing the data would make it difficult to screw with an election with any significance.

They don't even try, do they?

[Jesus_666]

Seriously, how can someone implement electronic voting without making at least EAL5 for all involved components as well as for the system as a whole a mandatory requirement? (I'd demand EAL6, but let's stay somewhat realistic.) If I'd be the lawmaker, I'd be pretty paranoid about e-voting; I'd let at least three reknowned e-security experts draft up lists of requirements independently of each other and then combine them together in the most restrictive way possible. Encrypted transmissions, encrypted file storage, encrypted everything. Steel casings locked down with combination physical/induction key locks (the key contains an induction dongle), complete with tampering detection hardware. Mandatory submission of the device to several security shops at least one year in advance; if any feasible attacks (whether compromization or DOS) are found until three months before the election, the devices get red-lighted.

My voting machines would make mil-spec computers look like $199 Walmart junk. Of course the user interface would undergo similarly rigorous testing before being standardized - if there's any chance any reasonable voter can get confused the whole UI and, by extension, all voting machines aren't worth jack.

Then again I'm not a politician. They know best what's in their interest; certifiably secure elections might not be.

ES&S Machine Not All Horrible

[Bo0bMeIsTeR]

Yes the ES&S machines may be vulnerable, but who honestly cares, consider, during election, these machines are never left with one person. The machine are dropped at the beginning of the election, empty. VST protocol requires the technician to verify that nothing is stored on the machines, with another poll worker. The VST will then load the ballot to the machine for the day. During the day, there is no way someone could physically hack these machines, between poll workers, poll watches, and voters, i think i would be noticed booting linux from a CD or using paper clips, etc. etc. After the election is closed, the master PEB is placed in each machine and the votes are all removed. Results are printed, and PEB's are placed in a box, sealed with a plastic seal which is serial numbered and recorded by the SOE. The PEB's are taken to a drop point, and the seal is broken, and data is extracted off the PEB's and combined with all precincts. I think the biggest problem is that the people do not understand the procedures used in these voting machines. After working in elections multiple times as a VST in South FL, i would say unless the entire precinct is in on rigging the machines, (we're talking 10-15 people) then it would not be feasible. Consider who works elections, (55+ crowd + linux = no profit)

N-Version Scanning

[natoochtoniket]

If we standardize the format of the paper ballots and the marking devices (say, #2 pencil), then multiple parties can independently develop optical scanners for that ballot format. If each political party provides its own scanner, and each of those scanners is used to scan the ballots, and if all of them agree on a count, then we can be pretty sure that the count is accurate.

An additional level of verification is possible if some of the scanning devices capture the image of each page into a file. A file containing the photographic images of the ballots for a precinct could be put on a server, to be downloaded and counted by anyone who wants to do so. Each party could provide the images from its own scanner on its own server. If multiple sets of images are provided by different parties, any manipulation of the image files could be detected.

If any of the several independent counts disagrees with the others, we can easily see which one does not agree. That one party would then be on the spot to explain why their machine got the count wrong. In reality, the incentive to cheat is removed, because of the extremely high probability that any cheating will be discovered.

This can provide better verification that is possible with hand-counted paper ballots. With hand counted paper ballots, the number of people who can actually see each ballot is limited to the number of people who can fit in the room during the counting. As a practical matter, only a few people can be close enough to actually see the marks on each ballot.