Slashdot Mirror
Contest To Hack Brazilian Voting Machines
An anonymous reader writes "Brazilian elections went electronic many years ago, with very fast results but a few complaints from losers, of course. Next month, 10 teams that accepted the challenge will have access to hardware and software (Google translation; original in Portuguese) for the amount of time they requested (from one hour to four days). Some will try to break the vote's secrecy and some will try to throw in malicious code to change the entered votes without leaving traces."
for those who do not RTFA.
The teams can bring any software or equipment they want to try and break the machines' security.
And there is even a bounty of a little more than USD$2000,00 paid by the government to the team that gets closer to the goal.
-- SouNerd.com
The simplest way to win this is to hack the judging process so that your team is announced the winner, with a false claim that you hacked one of the machines.
That is a lot of voting machines...
winners will be executed
We are in Brazil not in the USA.
transport the results out of the voting location with the votes and hashs seperately and count then use the hash to verify that the count wasn't tampered with in transit etc.
If you mod me down, I will become more powerful than you can imagine....
Actually the puzzling thing to me is why is electronic voting so "popular". Why do the people in charge keep promoting it?
Most electronic voting systems are bad at a very important requirement:
Convincing the loser (and enough of his supporters) that he lost.
The system doesn't just have to work correctly, it has to be accepted as working correctly (enough).
With various fancy cryptography and systems it is possible to have an electronic system that is anonymous, verifiable and reasonably secure (see: http://www.youtube.com/watch?v=ZDnShu5V99s for ideas on how this could be done), but as far as I can tell, they're not going for such systems.
So why not just stick with paper ballots in a process where almost everything is done in the open? That way the eventual loser's representatives, 3rd party observers, various other people can observe every count of each vote. It's simple enough to understand. While postal votes can still be used to rig stuff, most electronic voting systems are also vulnerable to that same problem.
That paper based system may take a bit more time, but it scales reasonably well - the more voters there are, the more volunteers there should be for counting. I'm assuming that it's not a case where too many of the citizens either can't count or are too lazy to do so.
I like this idea. Voting systems corporations claim their solution is accurate and secure, let them put their money where their mouth is and let people try and crack it. If their machine's security depends on nobody being allowed to even try then it's all theater.
USA doesn't kill people...
Right, first declare them enemy combatants.
Or at the very least, afterwards...
I don't care if you have a provably correct system (in the sense of a formal mathematical proof AND a code audit AND a hardware audit) because I cannot verify that that is the system I am indeed interacting with! On the other hand with paper and pencil I can easily verify that my vote was recorded correctly (did I make an X in the circle I wanted? .. yup.) and I can also EASILY verify that the vote is counted correctly (anyone is legally allowed to watch the count including people not affiliated with political parties, referred to as Electoral observation).
Exactly. I have a PhD in computer science and a lot of experience debugging other peoples' code. If you gave me the source code to an electronic voting system, I could not be more than 50% sure that I had found all of the potential ways of exploiting it. Even if I do manage to convince myself that it is bug free, which might be possible if it were developed using formal methods, then I still have no way of verifying that the software that I audited is the software I am using to vote. More than 99% of the population is likely to be less able to audit the code.
We don't use electronic (or mechanical) voting here, we use a pen and paper. I can look at the paper and validate that it has the mark next to the candidate that I wanted. I can then put it in a box. If I want, I can volunteer to watch the box and see that no one removes ballots from it before it is counted. I can then watch, or even participate in, the counting. The number of votes counted is then published and I can check the totals match for the constituency. Anyone with basic numeracy can validate this mechanism. Most people don't choose to, but each of the candidates will nominate people that they trust to do so and they can select these people from the entire population, not just from some technical priesthood.
I am TheRaven on Soylent News
- You OUGHT to vote if you are a Brazilian citizen between 18 and 70, and is not illiterate. You get in a lot of trouble if you don't.
- You don't register for avery election; you have a "voting ID" valid for every public election.
- You have to vote in a specific designated place (noted in your "voting ID"), generally the closest voting section from the address you provided when getting your "voting ID". If you are away, you have to justify the absence (preferably on a mail office, at the election day)
- Election happens in one day, throughout the country (there may be 2-phase elections, for example for mayor, governor or president, when in the 1st phase the winner does not get more than 50% of the votes - oh, yes, we DIRECTLY vote for president - every citizen's vote has the same "weight").
- Although the voting machine is electronic, when you get to the voting section there are PAPER books with all voters for that section listed, and your ID is checked against that. You sign the book and get a "receipt" detached from it (you have to prove you voted, as it is a legal obligation).
Soo, the electoral authority "knows" how many votes should appear in the results. Generally we do not have Disney characters, dead people, etc. voting, nor people voting in several electoral sections.
As far as I can remember, results have matched the pre-election polls (from multiple sources) quite well. Generally people know in advance what the result will be from each city or even city area, and that can be seen in real time as the electronic counting unfolds at election night (yes, we generally get most results in the night of the election day). I can't recall results being seriously contested by the losing parties (we have MANY parties).
Results are manipulated by "social engineering": Sending buses/boats to collect people from remote locations for voting in "exchange" for voting, trading dental treatment promises, money, death threats, etc. Illegal too, but easier and more difficult to trace than manipulating after the votes were cast.
I trust that there are so many crooks in politics in my country that if a party found a way to manipulate the results after elections, there would be so many me-too-or-else-I'll-tell that it would spread like a wildfire and the results would be awkward enough to be laughable. It is a self-regulating system. If a hacker found a way to manipulate the results, he would not stop at selling the method to one single candidate. I believe the same applies for other voting methods (except the ones which allow Mickey Mouse to register, of course) - it is not the system itself that prevents fraud, but the fact that fraud works both ways, and that the result is not a complete surprise.
In recent international elections you can see in the news that if the results do not match what the population though it would be, it is noticed at once, and people get to the streets (sometimes there wasn't even a fraud, it's just that some people won't accept the losing). It hasn't happened here so far, so we still trust the way it's been done.
A lot of people seem to believe that hacking an election that uses electronic voting machines is so hard it's the stuff of science fiction.
However some time ago I came across an article describing how an unknown group hacked the Vodafone-Panafon cell-phone system. To me this hack conclusively proves that these groups have the technical and financial resources necessary to steal an electronic voting election.
Consider: