Slashdot Mirror
California Testers Find Flaws In Voting Machines
quanticle writes "According to Ars Technica, California testers have discovered severe flaws in the ES&S voting machines. The paper seals were easily bypassed, and the lock could be picked with a "common office implement". After cracking the physical security of the device, the testers found it simple to reconfigure the BIOS to boot off external media. After booting a version of Linux, they found that critical system files were stored in plain text. They also found that the election management system that initializes the voting machines used unencrypted protocols to transmit the initialization data to the voting machines, allowing for a man-in-the-middle attack. Altogether, it is a troubling report for a company already in hot water for selling uncertified equipment to counties."
I have 2 solutions to all these problems.
1: Do like the rest of the world, and use a HB #2 pencil.
2: EFF and the rest of the American White hats get together and develop an Open Voting system, that are freely implementable by any state, that can withstand public scrutiny and peer review.
For the last time - issue a voter card and use the cash machines / ATM machines / or whatever you call it in ur location.
It will even print a receipt.
If it good enough for your money it is good enough for your vote
Do they really think this sounds more impressive than "paperclip" ?
Jolyon
Please read my Canon EOS tech blog at http://www.everyothershot.com
I'm sure it's hard to hack a sheet of paper and a cardboard box. Please, leave democracy "unhackable", because where there's no paper for voting, there's no hard proof that you really did it...
Those machines have been proven time and again that they're insecure, not reliable and that it takes special knowledge to even start verifying their results. Now we add ease of manipulation to the fold.
How much more does it take to see that it is a BAD idea?
Yes, paper voting is costy. But we're not talking something where cost is the deciding factor. Democracy is about two things: People participating in the government of their country, and people trusting the government of their country. In a democracy, people have (ok, should have) a say in their country's behaviour. And this in turn should give them a feeling of belonging, they should feel their country takes them serious and as more than just peons who can be ordered around, because they chose their government themselves. This usually means more trust and faith in their rulers, because they themselves chose them (not some divine right to rule or military force, they installed their government).
Especially the latter part is at risk. If you cannot easily debunk any claims of voting fraud, because the means to vote offer themselves for easy manipulation, you open your country for claims of illegal manipulations that cannot be disproved. You destroy the faith people have in their country and the support. Not that it was really necessary these days, people already started losing faith in the democratic process and democracy altogether. But this has the potential to be the last straw.
Cost is not an argument when it comes to voting. If you want people to support the government as wanted by the majority, you have to make sure that it will be seen as the will of the majority. If fraud is easy, dissenting people will always claim foul play and you will not have any chance to call them bad losers. You can't prove them wrong, quite the opposite, we have seen now time and again that they have every reason to be suspicious.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Does it make paperclips and Linux illegal in Germany now that they can be used for hacking?
thank God the internet isn't a human right.
I believe the most important thing about e-voting is that you can't pic up a random person from the street, explain him how it works, and after it ask him if the process of voting was done correctly. Paper voting on the other side is so easy that manipulation is easy to realize. I mean the only point of e-voting is that some poor government officials can go home earlier. I want Democracy for everybody.
How do I uncompress my MD5 archive?
Alternatively, just use a whole brick.
I, for one, like seeing my vote on hardcopy.
It must have been something you assimilated. . . .
What, a service pack?
"Common office implement" AKA: Paper clip and some whiteout I hear Richard Dean Anderson was on the testing team, so really, that's their own fault.
Slashdot is too nerdy for me.
If the machines have paper seals in an accessible place, then you could very easily DOS the vote of a district that is known to be unfavourable to you simply by slicing the seal with your thumbnail, without ever having to hack the machine at all!
If I defrauded a state and sold it uncertified voting equipment, I'd be in jail.
Why isn't this organization, which has clearly committed a criminal act, in jail?
|/usr/games/fortune
I opt to kill a few trees to retain the paper method for now. I was forced to use an electronic voting machine (Diebold) in my district during the last local election in my state. I will not be using one regardless come the next election. Anyone can manipulate the machine behind the privacy fence surrounding the machine, without anyone knowing about it. Who is to say it cannot be tampered with even before the people are given access to the machine to cast their vote. I do not feel comfortable using an electronic voting device at this time.
I am almost 100% convinced that major elections do not matter anymore in this country in this day and age. The rich, and the corrupt have a strangle hold on our government and the media. Just look at the biased mass media coverage that is happening today. It is as if the media has already made the decisions for us about the elections, and those who own the media have very powerful ties to the government. There are no real debates between candidates, but they are still called debates. There are no tough questions, and there are no truthful straight forward consistent answers but from a couple of candidates, which are silenced and kept from the publics knowledge by powerful people whom are in control. I do have some hope, but it is fading fast.
I honestly feel that there will be another civil war in this country if things continue the way they are. It will not be the Whites against the Blacks, against the Hispanics, etc... It will be the poor against the rich. You know where the corporations and the corrupt politicians will stand when this happens. Change takes ballots or bullets. Sooner or later people will be tired of trying to make change peacefully with ballots.
It may not happen in my lifetime, but I think it will happen sooner than anyone thinks if the current path is followed. All it will take is someone high up in the military to finally get fed up with the corruption to take the action of cleaning house. We have already seen first hand the dissent in the military ranks all the way to the top. Several generals have peacefully resigned/retired and spoken in protest to the insane, illogical decisions made by the current administration and the path it has taken us down. Sooner or later someone with a bigger set of balls will do something about it if this continues.
It would not be a good thing to have this happen, but if things continue the way they are I would sadly be in support of it. It would be a rough road, but change is needed in a bad way. We are currently on a path of assured economic destruction, which will have effects far and wide around the world. We should learn from the past history of other, once large and powerful Republics. It seems to me that we are doomed to repeat history unless there is change.
I hold the hope though, that this vast information highway called the internet will tip the field in the favor of the people in due time. The option to see and read more news from many sources, rather than the few sources force fed to the masses controlled by the powerful and corrupt few. The internet has broadened my view of things. This too may not happen in my lifetime, but I hold hope that it will foster a peaceful change in time.
I hope for a peaceful change, but I am very afraid of what could and might happen.
"This is America... where the will of the few outweigh the outrage of the many..." - Unknown
Every vote is assigned to an ID. Not your ID, but a relatively random numerical one. When the voting is done, the entire votes database is made available on DVD (or whatever medium is appropriate to storing 300 million records. I wouldn't expect much space at all, I'd bet the IDs take up more space than the actual data.
Then independent organizations can tally the votes themselves and verify that the election was on the up and up. They can also allow people to check their votes in the database to verify individually that the database itself is correct. Assuming the database has been distributed in whole to all of the various organizations, mis-votes should be easy enough to discover.
Then it only remains that you need to protect people's anonymity. A ticket that can be used to verify an individual vote on behalf of a person can also be used to verify that vote to the satisfaction of a vote-buying machine (or worse.)
A solution is to obscure the information by giving each voter not one, but a list of ID numbers and told which one is theirs privately. That way, nefarious organizations wouldn't be able reliably say they've been given the correct number, which should kill their scheme. It's not a perfect solution, though, and I can already see flaws in it, but that just means it needs a bit more work before it's ready for prime time.
Can you be Even More Awesome?!
..really. computerized voting is not needed, a waste of resources (cash, manufacturing effort, etc, maintenance), inherently insecure (there is no possible way for a set of normal voters eyeballs to verify a count), it allows for the potential for widescale vote tampering,way way beyond any previous efforts where it had to be done precinct by precinct by corrupt individuals en masse, costs bundles of cash compared to paper and an empty box, and already has a track record of being possibly implicated in massive vote fraud that lead to profound differences in the apparent wishes of the electorate (using exit polls) and what allegedly happened (the alleged accurate vote count). Just look at Ohio in the last presidential race there. That badboy was hacked, no getting around it.
Computers have a place in our society, using them for elections is not one of them. Sometimes the complicated method is not the preferred method, ie, using howitzers to shoot down flies. Look at the wishlist of complicated crap you want to try and make it secure. I mean, really, just don't use computers in the first place. Make the vote a 24 hour period, and a national holiday so there is little excuse to not vote, and use paper ballots. Every fix the computers scheme out there always falls back on a paper trail. duh, just use paper then! Eliminate that complicated middleman. That and instant runoff voting or something like that combined with severe caps on campaign financing (it shouldn't take hundreds of millions of dollars to run campaigns, and face reality, these are almost pure bribes once you look at them hard, set a hundred dollar cap on all combined contributions per human per election cycle) would improve the political process immensely, Computerized voting machines are designed to be voting manipulation devices,and taxpayer cash suckers, fullstop. It's just generally a totally bad idea, this trying to fix computerized voting is turd polishing.
The first round of tests focused on the physical security of the Polling Ballot Counter (PBC), which the Red Team researchers were able to circumvent with little effort. "In the physical security testing, the wire- and tamper-proof paper seals were easily removed without damage to the seals using simple household chemicals and tools and could be replaced without detection," the report says. "Once the seals are bypassed, simple tools or easy modifications to simple tools could be used to access the computer and its components. The key lock for the Transfer Device was unlocked using a common office item without the special 'key' and the seal removed."
You can stop reading the article here. Once physical security has been breached it's all over. With the machine open, you now have complete control over it, even to the point of changing out the hardware. This also applies to any machine that handles money, including ATM's.
All the software security measures in the world won't protect you if physical security is breached. So, if the physical security of a voting machine cannot be maintained at least as well as an ATM, or better yet a slot machine in a casino (constant surveillance), then using the voting machine in the first place is NOT secure.