Slashdot Mirror


California Testers Find Flaws In Voting Machines

quanticle writes "According to Ars Technica, California testers have discovered severe flaws in the ES&S voting machines. The paper seals were easily bypassed, and the lock could be picked with a "common office implement". After cracking the physical security of the device, the testers found it simple to reconfigure the BIOS to boot off external media. After booting a version of Linux, they found that critical system files were stored in plain text. They also found that the election management system that initializes the voting machines used unencrypted protocols to transmit the initialization data to the voting machines, allowing for a man-in-the-middle attack. Altogether, it is a troubling report for a company already in hot water for selling uncertified equipment to counties."

15 of 167 comments (clear)

  1. WhiteHat Voting by JavaBear · · Score: 5, Insightful

    I have 2 solutions to all these problems.

    1: Do like the rest of the world, and use a HB #2 pencil.

    2: EFF and the rest of the American White hats get together and develop an Open Voting system, that are freely implementable by any state, that can withstand public scrutiny and peer review.

    1. Re:WhiteHat Voting by Feyr · · Score: 2, Insightful

      [quote]
      # All data is stored encrypted and signed.

      All data should be stored in plain text, and signed with multiple hashes, keys and/or ciphers.
      [/quote]

      i think you nailed that one. most people forget that encryption is no good if you already have access to the key, and the software must have the key if it's supposed to make use of the data in the file. thus, a hacker has the key

      remember people: signing good. crypting, not so good

    2. Re:WhiteHat Voting by JavaBear · · Score: 2, Insightful

      How can you accurately differentiate this from the voter accidentally filling in the wrong box and erasing it themselves?

      The easy answer, and incidentally the correct one, is: You don't.

      If you put your X on the wrong candidate, you exit the booth and get a new ballot, while the old one is ripped in half.

    3. Re:WhiteHat Voting by JavaBear · · Score: 2, Insightful

      On THAT note.
      Elections should be run by competent people, so politicians should really just stay away from the process.

  2. Paper please! by courteaudotbiz · · Score: 2, Insightful

    I'm sure it's hard to hack a sheet of paper and a cardboard box. Please, leave democracy "unhackable", because where there's no paper for voting, there's no hard proof that you really did it...

    1. Re:Paper please! by Notquitecajun · · Score: 2, Insightful

      Actually, there are problems there as well. Illinois in the Kennedy/Nixon race. LBJ in Texas. Louisiana in...well, pick a year. Gerrymandering/re-districting. Keeping the electoral college/getting rid of the electoral college. Nothing is, has been, or will be perfect with the vote...we just have to continue to hold people accountable and try and make it as publicly accessible while keeping the ballot secret. I'm pretty far-right, but I think at the LEAST there should be limited open-source scrutiny of any private contracting of voting, and it should probably be entirely run by the Federal or State Election commissions.

  3. How much more does it take? by Opportunist · · Score: 5, Insightful

    Those machines have been proven time and again that they're insecure, not reliable and that it takes special knowledge to even start verifying their results. Now we add ease of manipulation to the fold.

    How much more does it take to see that it is a BAD idea?

    Yes, paper voting is costy. But we're not talking something where cost is the deciding factor. Democracy is about two things: People participating in the government of their country, and people trusting the government of their country. In a democracy, people have (ok, should have) a say in their country's behaviour. And this in turn should give them a feeling of belonging, they should feel their country takes them serious and as more than just peons who can be ordered around, because they chose their government themselves. This usually means more trust and faith in their rulers, because they themselves chose them (not some divine right to rule or military force, they installed their government).

    Especially the latter part is at risk. If you cannot easily debunk any claims of voting fraud, because the means to vote offer themselves for easy manipulation, you open your country for claims of illegal manipulations that cannot be disproved. You destroy the faith people have in their country and the support. Not that it was really necessary these days, people already started losing faith in the democratic process and democracy altogether. But this has the potential to be the last straw.

    Cost is not an argument when it comes to voting. If you want people to support the government as wanted by the majority, you have to make sure that it will be seen as the will of the majority. If fraud is easy, dissenting people will always claim foul play and you will not have any chance to call them bad losers. You can't prove them wrong, quite the opposite, we have seen now time and again that they have every reason to be suspicious.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    1. Re:How much more does it take? by Opportunist · · Score: 2, Insightful

      So you don't believe our count? No problem at all. Here's the ballot, count as much as you like.

      See? Easy to shoot down any claims of voting fraud. You can count, you can read, you can verify the voting count.

      Now please tell me how I, common man, aged past 30 and let's assume I'm not an IT expert, should verify some "count" done by a voting machine.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  4. Re:ATM Machines by oliverthered · · Score: 4, Insightful

    but the problem is you can tell who voted for who and that's bad.

    --
    thank God the internet isn't a human right.
  5. Whats the point of e-voting by gmthor · · Score: 5, Insightful

    I believe the most important thing about e-voting is that you can't pic up a random person from the street, explain him how it works, and after it ask him if the process of voting was done correctly. Paper voting on the other side is so easy that manipulation is easy to realize. I mean the only point of e-voting is that some poor government officials can go home earlier. I want Democracy for everybody.

    --
    How do I uncompress my MD5 archive?
    1. Re:Whats the point of e-voting by Twisted+Willie · · Score: 2, Insightful

      The point of e-voting is to remove human error (in all shapes and forms) from the counting process. Assuming that at one point the electronic voting machines can be made secure enough, it's a much better way of getting accurate numbers than by paper voting.

    2. Re:Whats the point of e-voting by Opportunist · · Score: 4, Insightful

      That is exactly the problem with e-voting: You have to trust.

      With normal pen-and-paper voting, all skill you need is being able to count and discriminate between various candidates being chosing on the paper. You don't believe my count? You think I'm trying to fix elections? Here's the ballot, count for yourself.

      With e-voting, you face a problem. You need very special skills to actually conduct a recount (if it is possible at all). Don't believe me that I'm not trying to fix elections in my favor? Sucks to be you if you don't happen to have the skills.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  6. Let's do it like the ancient Greeks ... by Ihlosi · · Score: 2, Insightful
    I'm sure it's hard to hack a sheet of paper and a cardboard box. Please, leave democracy "unhackable", because where there's no paper for voting, there's no hard proof that you really did it...

    ... and scratch our votes into shards of pottery. How's that for hard proof ?


    Alternatively, just use a whole brick.

  7. Paper Seals = DoS? by kieran · · Score: 4, Insightful

    If the machines have paper seals in an accessible place, then you could very easily DOS the vote of a district that is known to be unfavourable to you simply by slicing the seal with your thumbnail, without ever having to hack the machine at all!

  8. howitzer for flies method by Anonymous Coward · · Score: 2, Insightful

    ..really. computerized voting is not needed, a waste of resources (cash, manufacturing effort, etc, maintenance), inherently insecure (there is no possible way for a set of normal voters eyeballs to verify a count), it allows for the potential for widescale vote tampering,way way beyond any previous efforts where it had to be done precinct by precinct by corrupt individuals en masse, costs bundles of cash compared to paper and an empty box, and already has a track record of being possibly implicated in massive vote fraud that lead to profound differences in the apparent wishes of the electorate (using exit polls) and what allegedly happened (the alleged accurate vote count). Just look at Ohio in the last presidential race there. That badboy was hacked, no getting around it.

    Computers have a place in our society, using them for elections is not one of them. Sometimes the complicated method is not the preferred method, ie, using howitzers to shoot down flies. Look at the wishlist of complicated crap you want to try and make it secure. I mean, really, just don't use computers in the first place. Make the vote a 24 hour period, and a national holiday so there is little excuse to not vote, and use paper ballots. Every fix the computers scheme out there always falls back on a paper trail. duh, just use paper then! Eliminate that complicated middleman. That and instant runoff voting or something like that combined with severe caps on campaign financing (it shouldn't take hundreds of millions of dollars to run campaigns, and face reality, these are almost pure bribes once you look at them hard, set a hundred dollar cap on all combined contributions per human per election cycle) would improve the political process immensely, Computerized voting machines are designed to be voting manipulation devices,and taxpayer cash suckers, fullstop. It's just generally a totally bad idea, this trying to fix computerized voting is turd polishing.