Slashdot Mirror
Brazilian Breaks Secrecy of Brazil's E-Voting Machines With Van Eck Phreaking
After the report last week that Brazil's e-voting machines had withstood the scrutiny of a team of invited hackers, reader ateu writes with news that a hacker has shown that the Linux-based voting machines aren't perfectly safe; he was able to eavesdrop on them (translated from Portuguese) by means of Van Eck phreaking.
What options do you have to protect your self from Van eck phreaking? Lead casing? Foil voting boxes? Honest replies welcome.
Eat sleep die
"Listening in" and actually breaking the security of the machine are two entirely different things. What's the most someone could do with this exploit? Basically it just allows for a more accurate exit-poll. As far as I see it, the machine's security has still yet to be bested.
So the cheap devices he used only worked inches away. A more powerful device might work up to 20 meters away. Now, I assume a more powerful antennae is going to mean a bigger one. Isn't this going to stand out? I would hope that there is someone in charge that would notice a foot long antennae being pointed at voting areas. You can secure the machine itself, but if you don't have real people doing their part, it doesn't matter how secure your voting machine is.
Besides all the shielding options, perhaps this is a good use for E-paper displays? The persistent nature of the display would minimize the constant refreshing. The slow screen response would be unlikely to be an issue with a ballot.
As discussed here in 2006, the Dutch had to modify their voting machines back in 2006 due to exactly this sort of attack. http://politics.slashdot.org/article.pl?sid=06/10/14/1641239
What options do you have to protect your self from Van eck phreaking? Lead casing? Foil voting boxes?
Honest replies welcome.
Put rubbish on the screen and send all your actual output through the caps lock LED with xled.
Not very useful outside in the real world, I know.
http://michaelsmith.id.au
If we could somehow reach a level where e-voting was secure, think of the possibilities. The people might actually be heard! Now whether you think that is a good thing or not, I leave as an exercise for the reader. But what I'm trying to say is, imagine voting from your home computer on issues that matter to you. No longer will your representatives be able to hand wave about what their constituency wants, heck, you might not even need representatives.
Not to say that secrecy isn't important, but once it requires a certain level of technology to eavesdrop then surely you just pick some random people and rough them up anyway telling the people you are intimidating that you have this "magic" eavesdropping technology.
Don't be silly.
Secret ballot is one of the cornerstones of democracy.
In a secret ballot, you don't get bribed to vote for a particular person because you can
always say you voted for him while voting for him.
Likewise, about getting pressured about voting for someone.
This is why I love the Canadian method: paper with circles, make an "X" in the circle you want, fold the paper and put it in the ballot box. Good luck hacking that on a large scale (what with scrutineers from multiple parties watching the election and the count and each other, plus the people there as independent scrutineers watching everyone else), and monitoring it (little cardboard voting booth on a table, voila, privacy. The only argument I could imagine is finger prints on the ballots, but you can wear gloves if you want.
Why does the electronic voting machine have to be a touch screen? Why not a list of the options with buttons with an LED in them that light up when you press the button? The list could be on a separate display next to the buttons but nothing changes therefore the 'van eck phreaker' would only get the data on the screen, not the option picked... but I have no knowledge of this sort of stuff.
Maybe some places do that, but where I live we do vote by mail.
Among the others, enabling a non-FPTP system.
If anyone isn't aware of how FPTP has hosed democracy, they should start here.
The primary concern I recognize is that FPTP collapses your system into a two-party system and makes third parties non-viable. Just try voting for Nader or Kucinich.
There is no "REAL" anonymous vote since the sums of votes in a voting station is publicly available...
You bribe half city; then check (on the publicly available channels) how many votes you got there... if you got less than expected... someone cheated and you "don't pay".
If your idea is not to bribe a huge amount of persons we don't care.
Bribe is another problem.. and can't really be solved by the voting machine itself.
While in principle it is a good method for snooping a single monitor, it would take a ton of disentangling signals to read every monitor consistently at a polling place from any distance. It is not a practical way to screw with an election, considering that any party willing to snoop this aggressively is probably willing to do a lot more than just snoop.
Frankly, it shows just how effective Brazil's security measures are that hackers have to go this deep into the playbook to get even one sort of result.
I scream. You scream. I assume that means we're both acquainted with the problem. We proceed.
The people who think that secrecy matters so much are the ones living in a dream world.
In many of those countries, the secrecy of your vote hardly matters anyway. After all, they've already done most of the voting for you.
You might even get your hands chopped off for just daring to show up to vote.
In places where you can have voter intimidation without the police stepping in (or the police being the culprits), secrecy of your vote is not much of a concern.
And in some countries the voting system is so fast and efficient that everyone knows the results before they vote.
That's the reality.
As for nonintimidation cases - e.g. selling their votes, if someone wants to sell their vote for USD5, so what? Willing buyer, willing seller.
A far bigger problem is gerrymandering. That's what makes buying and selling of votes and other tricks viable - if you can make 1000 votes count more than 100,000 votes, then it's cost effective to buy those 1000 voters. Make 1000 voters happy instead of the other 100,000 voters.
Then there's the postal votes stuff. In many countries it's probably easier to just cheat via the postal votes.
Simple electronic voting machine that is successfully used by the largest democracy in the world :-
http://en.wikipedia.org/wiki/Indian_voting_machines
btw, these machines are used in all sorts of conditions. In some remote places with no electricity.