Slashdot Mirror
Diebold Admits ATMs Are More Robust Than Voting Machines
An anonymous reader points out a story in the Huffington Post about the status of funding for election voting systems. It contains an interesting section in which Chris Riggall, a spokesman for Premier (formerly Diebold) acknowledged that less money is spent making an electronic voting machine than on a typical ATM. The ironically named Riggall also notes that security could indeed be improved, but at a higher price than most election administrators would care to pay. Also quoted in the article is Ed Felten, who has recently found some inconsistencies in New Jersey voting machines. From the Post:
"'An ATM is significantly a more expensive device than a voting terminal...' said Riggall. 'Were you to develop something that was as robust as an ATM, both in terms of the physical engineering of it and all aspects, clearly that would be something that the average jurisdiction cannot afford.' Perhaps cost has something to do with the fact that a couple of years ago, every single Diebold AccuVote TS could be opened with a standard key also used for some cabinets and mini-bars and available for purchase over the Internet."
Polotics and money, what a great parallel. We should just combine the two. "Would you like an extra $5 to vote for candidate X?"
I don't think they need to be as physically secure, there's always a voting official in the room in plain sight and several other people working there. It doesn't need to be built like an ATM that will be randomly placed in dark alleys.
I hate to play devil's advocate, but an ATM is an extremely complicated mechanical device. It doesn't shock me in the slightest that they're more expensive to produce than an electronic voting booth.
Of course, their voting products do suck, although I don't think that cost has terribly much to do with it.
-- If you try to fail and succeed, which have you done? - Uli's moose
This is just a travesty. That we put our democracy in the hands of for-profit, Republican-supporting companies like Diebold is beyond belief. The fact that they are required to make ATM machines better is a sign of how out of touch Americans are with our voting process. ATMs are more robust because people demand it. People DON'T (yet) demand the same amount of robustness in their voting machines because they are UNAWARE of how crappy the machines are. That really stems from our politicians who WANT to keep the sorry state of the voting machines secret.
Riggall? That's rich. Yeah, mod me offtopic, I just Felten urge to post this.
Oh, yeah, it's not easy to pad these out to 120 characters.
But the voting officials cannot enter the booth, so any attacker could do something to the machine without it being noticed until after the elections.
As usual, cost isn't the question.
It's science -- bad science -- of two types:
1. Bad application of technology, including massive security holes.
2. Bad management science, leading to sloppy security and confused product design.
An ATM should be more expensive than a voting machine; the ATM has to dispense cash and be used 24-7 to do so.
A voting machine however should be secure, have an audit trail, and a clear interface so the average person can understand what they're voting for.
technical writing / development
...unless that money can be used to buy votes elsewhere
The candidate doesn't matter; HE'S the one for sale. The scandal isn't the buying of votes, it's the buying of legislators. When you've donated ten million to the Democrat and another ten million to the Republican, it doesn't matter who loses, you win.
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
'Cause election jurisdictions can afford to buy entire systems they have to throw away once they're discovered to be inadequate.
Politicians love to say one thing and then pay for another.
And voters want more expensive services but refuse to pay higher taxes to pay for them. Bad combo.
No institution other than one that can compel funding and compliance could ever operate with the sort of gross incompetence and lack of priorities that government frequently has. A few obvious examples:
1) The Bush Administration has $500B to spend on prescription pills for the elderly, but cannot find $100M to fund 10,000 new border patrol agents on the southern border.
2) New Orleans had plenty of money to waste on welfare programs and such, but didn't have any money to spend on getting its own fixes for the levies, even if they were only gradual repair contracts.
3) All of the pork barrel spending that goes on in Congress.
4) The congressional hearings over steroid use in professional sports. I don't agree that it is the state's business at all, but isn't this what we have the DEA for?
5) Doing things like setting up honeypots to catch people who might have a passing interest in child porn when there are still people getting away with the actual production of the same in U.S. territory, child molesters and Americans flying overseas to do the same.
6) Passing and enforcing drug laws when there isn't even enough room due to the War on Drugs to guarantee that someone who commits 1st degree murder will get life in prison. Same thing for how the WoD has made it much easier to argue that the system just cannot handle the burden of locking up dangerous criminals permanently.
And shoddy/insecure design... As something they can't afford to do without?
I call BS. The customer has an expectation of the manufacturer doing a good job of designing their devices and not selling defective product lines: there would be no sale if the manufacturer were honest and told the product was not robust. There can be no excuse for letting a generic key open the device, when individualized locks are easily purchased.
The customer would keep going until they found a vendor that told them the product was robust and stable, and offered them the lowest price.
Cost of the result is something the manufacturers get to compete over. If you can't design a product well and robust enough at the price point the customer wants to get you the amount of profit you want, then you get two choices (1) don't make it, or (2) tell the customer about the weak design up front. Option (3) ignore defects and admit them later is highly dishonest.
Voting terminals may not be as proven as ATMs, since they are a newer technology, but there is no reason for the design to be weaker.
ATM makers already have robust ATM designs that can be used as a basis for the design of voting terminals and other products.
There is really no excuse for a new voting terminal design to not be as robust as a new ATM design.
The design will cost more, but that cost is supposed to be absorbed by the manufacturer. The high price that state governments pay for these terminals is plenty to justify proper design.
Due to the nature of software, it can be understood that there may be some aesthetic or annoying bugs early versions of terminal software that QA couldn't find.
But they should not be because of non-robust design, QA adn testing should verify the critical elements of the application are bug-free, and later versions should eliminate bugs without adding features that risks incorporating more bugs.
A voting machine that prints off a paper ballot which the voter deposits in a lockbox still seems the best option to achieve this.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
I'm not sure this is a valid conclusion. The same people aren't making decisions in each case. And while we like to think we place a high value on the integrity of our voting system, it's hard to put a dollar figure on that, which is what the people running the budget need.
Banks, on the other hand, can easily place a dollar figure on the value of their ATMs' security, and show their decision-makers that X dollars spent on securing them will easily pay for itself.
I'm not happy with the situation, but I don't think you've got a single set of people saying "transactions are more important than votes."
Security depends both on the voting / counting process and on the technology (this is true for paper ballots as well). The problem is when the technology can easily be changed in a hidden way that is unverifiable by elections officials.
A simple machine, that has been tested and verify can be sealed with stickers with signatures of election officials.
A machine (think diabold) with all kinds of inputs (think keyboard plugs) and complexity (think OS, DB etc...) cannot be easily sealed and verified by election officials.
I found two interesting articles about India's EVM
The two things I found interesting:
1) EVM cost = $230 (hard to tamper with, and relies on election officials to keep secure)
2) Diebold cost = $3300 (easier to tamper with, and relies on election officials to keep secure)
This points out two things: voting systems don't have to be complicated or expensive to work well, and that security depends both on the machine and the voting process.
Just like with paper ballots the election officials need to ensure security of the voting and counting process.
In Canada we have some electronic voting at the municipal level in some cities (mostly optical scan machines).
A comparison of EVM and Diebold
http://techaos.blogspot.com/2004/05/indian-evm-compared-with-diebold.html
Wikipedia
http://en.wikipedia.org/wiki/Indian_Voting_Machines
The issue is not about cost. The issue is crappy design, and politics in the selection of voting machine vendors.
----- "Profanity is the one language that all programmers understand."
The obvious solution. Banks reload their ATM software for voting on election day. The candidates can buy your votes all the more easily -- cash comes out of the slot.
Fiat Lux.
The comparison between security in voting machines and ATM's is a strawman designed to get government officials to throw more money at 'secure as an ATM' voting machines. ATM's are secure because a somebody owns them, runs them, and controls access to them, with voting machines the opposite is true. The slimebags at Diebold cannot be so stupid as to not understand this, they are simply hoping to milk 'upgrade' money out of the taxpayer.
BTW: By voting machine I mean one that counts your ballot, not one that prints your ballot.
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
The ballot must be anonymous. "Show me your voting receipt or you're fired."
Voting machines most certainly do NOT have to cost as much as an ATM to be appropriatly secure!
An ATM must be tamper proof. That implies heavy steel construction all around. It has to be larger because it has to hold a store of cash. That sort of construction is where bug costs come in. They are generally unattended for most of the day and they contain cash!
A voting machine just has to be tamper evident. Heavy ABS plastic construction (for durability) with unique keys would be adequate there. They are generally either secured away or attended by election officials. They contain nothing all that valuable to someone who would break in. (the only value to be had requires breaking in without leaving visible evidence) Tamper evident design is quite sufficient.
The card readers on those things are just plain excessive. You'll note when you push the card in, there's a rather solid clunk as it locks in. That speaks of a heavy mechanism with an oversized solinoid and spring. That in turn implies heavy relays and a big power supply. A mechanism more like the floppy drives on an old Mac would have been more appropriate to the problem and considerably cheaper.
Those savings could have gone towards uniquely keyed locks, better software, and perhaps a POS style receipt printer.
I've only used an e-voting system a couple of times, but in every instance I was always visible to the voting officials. They couldn't see who I was voting for but they would have certainly noticed if I did anything other than tap the touch screen.
Physical security isn't really the problem. There are always election workers and volunteers in the proximity of the voting machines. What is a problem is that smoke and mirrors are used instead of openness. I want to understand exactly how the votes will be tallied and what protections there are from tampering (and hiding the source code isn't a protection IMHO).
Here in Alabama (yankees joke all you want) we use a paper ballot that you fill in with a black marker. They are tallied by machines but there is still that piece of paper to go back to. Hanging chads, that was stupid, using IBM punchcards for ballots. The last time I used one of those was in Chicago (where the dead could vote). Electronic 1's and 0's. Making it all virtual, making it all into a SQL database, eck... There is something fundamental about using a marker to fill in a inch square box next to a name. So much of this is driven by the media's desire to have an instant tally. Elections should take hours to count. Election judges should sit in the basement of the county courthouse and each look at a ballot to certify the election. We have thrown the baby out with the bathwater. We willingly forfeit our right to a representative government when we make it so easy for any single person or group of people to pervert elections.
Tisha Hayes
It doesn't surprise me that voting machines are not built as well as ATMs. ATMs are filled with thousands and even tens of thousands of dollars. It would be a rich target for all potential thieves. The voting machine electronics must be protected from all sorts of assaults. Voting machines only contain vote totals, so fewer people would be after them. After all, if you smash an ATM, you still get the money. You smash a voting machine, and you simply lose the votes.
The problem is we're stuck on machines vs. voting procedures. New York and New Jersey had voting machines that did not produce a paper trail for almost 100 years, and this was by design. The voting fraud problem in the Northeast was ballot stuffing. Voting machines, by eliminating paper ballots were designed to eliminate this type of voter fraud. The voting machines were designed around voting procedures. A voter had to register before hand. They had to sign in. Their signature was compared to their signature on their original application. The voter was handed a ticket. They handed that to a poll worker who would place the ticket in the voting machine, and pull a big lever which unlocked the machine. The voter would enter the machine, pull another lever to close the curtains and vote. When they finished, they pulled the lever to open the curtains. This cast the ballot and locked the machine. Poll watchers oversaw the whole process.
This machine/procedure combination eliminated ballot stuffing. The voter could only vote a single time before the machine locked up. The poll worker couldn't unlock the machine without the poll watchers noticing. Voter counts were taken from the machine totals, the tickets on the machines, and the sign in list. Since the voting machines were purely mechanical, they were trusted by all parties. All parties could watch the machines being setup and make sure there were no problems. Poll watchers would run tests before the polls opened to verify the machines. This didn't kill the political machines which simply switched tactics, and it didn't entirely eliminate voting fraud, but it certainly helped.
What we need to do is set a procedure up to ensure that elections are fair. Ballots must be secured and watched over by all parties. In Zimbabwe, they counted the votes locally at the polls and posted the results at each poll. This prevents the ruling party from manipulating the ballots. You could go from poll to poll, and add up the election results yourself. We also must ensure that each voter votes only once, and that each voter's vote is totaled as they intended. That was the issue in Florida with the punch card system.
So, we need to think beyond the "technology" aspect of the voting. It isn't paper ballots are simply better. It's about ensuring that we have confidence in the tabulation of the votes and whether it truly reflects the view of the populous. So, think of how you'd secure the paper ballots, how they would be counted. Who would oversee the procedure? How would the ballot boxes be protected from additional votes being added? How do we ensure that voters only vote once and not sneak in additional ballots? How do we verify the ballots? How can we ensure the entire procedure is fair?
The problem with the current Diabold style voting machines is that they are mystery boxes and we cannot tell if they tabulate the vote fairly. We would have to ensure the firmware, the software, and hardware has not been tampered with. A paper trail can help since paper is easier to verify. But, paper is easy to duplicate, toss, and manipulate which is why the Northeast went to the mechanical paperless machines to begin with.
Unless you think of the entire voting process, and ensure the voting process is easy to verify, it doesn't matter how voters cast their ballots.
You have hit the name on the head!
The problem I have with these electronic voting machines is that their internals are completely closed! Understand that the state of Nevada has more strigent controls over it's slot machines than it's voting machines...
Note, I'm taking this content from an awesome graphic I found on the internet... Thanks to whomever came up with it!!!
Software:
Slot Machine: State of Nevada has access to all software. Illegal to use software that is not on file
Voting Machine: Software is a trade secret.
Spot Checking:
Slot Machine: State gaming inspectors show up unannounced at casinos to compare computer chips with those on file. If there is a discrepancy, the machien is shut down and investigated.
Voting Machine: No checks are required. Election officals have no "known good" to compare against.
Background Security:
Slot Machine: Manufacturers subjected to backgroundchecks. Employees are investigated for criminal records.
Voting Machine: Citizens have no way of knowing, for example, whether programmers have been confvicted of fraud or have conflict of interest issues.
Equipment Certification:
Slot Machine: By a public agency at arm's length from manufacturers. Public questions invited.
Voting Machine: By for-profit commpanies chosen adn paid by the manufacturers. No public information on how the testing is done.
Dispute Handling:
Slot Machine: Casino must contact the Gaming Control Board, which has investigators on call around the clock. They can open up machines to inspect internal mechanisms and records of recent gambling outcomes.
Voting Machine: In most cases, a voter's only recourse is to call a number at the board of elections and lodge a complaint.
I do understand that a slot machine and an ATM works in a much more hostile environment where people are constantly working to break the system.
However, our Democracy is more important than some ATM and thus any system that's put in place that becomes an arbitrator of our Democracy's citizens to choose their elected officals should be held to even a higher standard.
Yes Francis, the world has gone crazy.
New Hampshire and several other states use black markers, a scan tron sheet, and just a few scanners at each polling location.
Quite frankly I don't see the need, under any circumstance, to get more complicated than this.
Simple voting procedure, quick electronic counting, and a clear & easily verifiable paper trail.
If you wanted multiple voting reciepts, then it would be a (relatively) simple matter to hook up a printer to spit out a copy/reciept of each ballot inserted- but I don't really think that's necessary either.
Alcohol, Tobacco and Firearms should be the name of a store, not a government agency.
ATMs are the target of physical attacks far more often than voting machines are. ATMs are installed in unmonitored locations. Voting machines are not. The object of an attack on an ATM is to get the money out. Leaving evidence of damage behind isn't an issue with an ATM. OTOH, voting machines can be secured with simple tamper seals.
When was the last time you saw a surveillance video of a couple of yahoos chaining a voting machine to the back bumper of a pickup truck and dragging it away?
Have gnu, will travel.