Slashdot Mirror
DC Suspends Tests of Online Voting System
Fortran IV writes "Back in June, Washington, DC signed up with the The Open Source Digital Foundation to set up an internet voting system for DC residents overseas. The plan was to have the system operational by the November general election. Last week the DC Board of Elections and Ethics opened the system for testing and attracted the attention of students at the University of Michigan, with comical results. The DC Board has postponed implementation of the system for 'more robust testing.'" Update: 10/06 02:42 GMT by T : University of Michigan computer scientist J. Alex Halderman provides an explanation of exactly how the folks at Michigan exploited the DC system.
has there been robust testing yet or not?
Every critical government system like this should be required to pass through a period of open public review before even being considered for use.
They could actually use prizes to be paid by the government contractor who submitted the bid. If they do a shoddy job on security, they'll not only lose the bid, but they'll also lose additional money (a refundable deposit) to whoever finds their security flaws.
Voting machines should definitely be electronic.
Online voting seems to be so problem-prone as to be useless. Something as simple as a smurf attack could potentially block every voter from casting their ballot in time.
DC elections are decided in the Democratic primary.
This will just be used by The Powers That Be as further evidence that the current system of notoriously shady Diebold voting machines is the Best Alternative and ensure that election results can only be hacked by Rich White Men.
One of the articles mentioned that some browsers submitted blank forms because they don't support inline PDF forms. Who, exactly, thought that using PDF was a good idea? The whole point of the web is that it provides layout standards. Why even bother using a web browser if you're just going to try to hack around it by using a completely different content format, PDF, shoved in using browser plug-ins. It might has well have been Flash. Use the web or do not. There is no halfway.
And of course, their servers were obviously insecure, as evidenced by someone managing to alter content on the servers.
What does all this tell us? Well, it tells us that:
Not that this shouldn't have been anything less than obvious to anyone with even a basic understanding of computer security.... Real secure networks built on top of HTTP use client applications that verify signatures on the content that the servers provide, ensuring that it is legitimate before acting on it. This also, of course, requires that people obtain the client software in a secure fashion, which is a problem in and of itself, in much the same way that obtaining the client on-the-fly from a web server is a problem, and for precisely the same reason.
Check out my sci-fi/humor trilogy at PatriotsBooks.
How many of our brethrean like to voice their opinion? I appreciate the voice. No wonder suspended. Though we do want a mass vote. I tell ye. Mass vote is in. Let's do it let's do it secure and singular.
I find it scary that at the same time as trying to make it unlawful to use encryption that the government doesn't have a "backdoor" into, they are also trying to push "secure" internet voting. Goodbye democracy, we hardly knew you...
Many years ago there was a GNU project to create an online secure voting software. It's a great idea.
In 2002, they finally stopped development. They explain why here: http://www.gnu.org/software/free/
Quoting from that page:
"As Bruce Schneier points out "a secure Internet voting system is theoretically possible, but it would be the first secure networked application ever created in the history of computers."
and...
"Mr.Schneier points out, 'building a secure Internet-based voting system is a very hard problem, harder than all the other computer security problems we've attempted and failed at. I believe that the risks to democacy are too great to attempt it.'"
I think anyone wanting to build a secure online voting system should give those quotes some really serious thought before starting. Then before they write any code, they should be to explain why they believe they are right and one of the field's most respected experts is wrong.
I suppose its a good thing they tested the system.
Isn't this the type of thing testing is supposed to identify?
Has anybody the comments section in the Washington Post website? It is disgusting to see how much hatred and ignorance is going on there. I hope they're not a representative sample of the USian population.
Meanwhile, in Brasil, we just had a presidential and local election. About 100 million people voting, in an all-electronic process. There were no reports of fraud whatsoever, and the election results were available just 2 hours after the polling stations closed.
Can't the US do better? Your voting system is just laughable.
entropy happens
online voteing just makes it so the boss can force you to vote his way or you can lose your job.
The failure of the system now indicates fatal flaws in the design and testing process. Although the current vulnerabilities might be patched there are probably many more. They need to learn from NASA about software design (read Feynman's comments about NASA software design in the Challenger report).
Every time someone refers to "The Victors" as "Hail to the Victors" I die a little inside.
Good work. Go Blue!
~MMB '01-'05
They need to pay more attention to that crack problem and spend less money on frivolity like evoting systems. Evoting is a great idea but voter turnout has been less than stellar since I can remember so what are we really hoping acomplish here?
"We are just a war away from Amerikastan. When god vs god the undoing of man." Dave Mustaine
Sorry I'm not following here. If the man can't see your votes while you are behind the curtain how is he going to know when you send your vote in from home.
"We are just a war away from Amerikastan. When god vs god the undoing of man." Dave Mustaine
I see the OSDV Foundation's slogan is "Re-inventing How America Votes".
If you *have* to make your vote behind a private curtain, the man can't see it. If you can make your vote from any internet connection, then the man can use his power to insist that you vote while he watches.
Yes, this applies to absentee balloting as well. That's why absentee balloting *used* to be controlled with the voter needing to demonstrate a need for it before being allowed an absentee ballot, and why it disturbs me that it is now generally allowed without any controls at all.
Really? We're going to blow over a quarter of a million dollars in tax money on a project damn near every IT pro in the US can say "This is a bad idea". Where we've already seen horrendous results from states and local municipalities trying ot impliment digital voting. Really? There was nothing better to spend $300,000 on? No other small business grants that could have been funded? No research grants? Nothing?
I mean, it's not a huge amount of money, when compared to the scope of the budget. But it is could have been a huge amount of money for a few start ups, small businesses, or researchers.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
I can check my bank accounts online.
I can pay my bills online.
I can order almost anything imaginable online.
I can participate in auctions online.
I can date online.
I can gamble online.
I can see my credit reports online.
I can file my taxes online.
Why is voting so different?
I tried to get an absentee ballot in Michigan so I could avoid going to the polls. I read the fine print and the restrictions made it so that I would have to perjure myself to do so. I opted not to get an absentee because of that.
Yeah? Fuck Ohio State -USC Fan
Who in their right mind uses a web served application for something such as this?
This calls for a secured, encrypted application, with a protocol that maintains it's own data security.
It can be done. I built one for the government in 2001:
On a server with one side connected to a classified network (here it would be the counting facility) and one connected to an unclassified network (here it would be the Internet). Gee, it took me and another guy less than 2 weeks from design to active testing.
You would need physical access to the server in order to compromise the end to end system.
Total cost of the demonstration system (excluding our ~60 hours total development) was less than $2000 in 2001. Imagine what we could do with modern equipment.
And ye shall know the truth, and the truth shall make you free.
John 8:32(King James Version)
So it's all held together with Ruby scripts and duct tape. If you're going to open something like this up to the world you need to digitally sign everything and continuously validate against an isolated server that can shut everything down when it detects a compromise.
I am becoming gerund, destroyer of verbs.
These are military personnel voting (absentee) from overseas. I can guarantee you that I can control the originating network, the terminating network and the client machine.
See above. If the machines which are eligible to be used to cast the vote are not under some sort of control, there is no way of doing this. However, the number of machines can easily be limited to the command and control structure, which makes this facet of the problem trivial.
If you are talking about people being to vote from home, I heartily agree with Bruce Schneier that the problem may well be intractable, not for reasons of malware, but for the impossibility of testing every potential configuration.
If you limit the problem to the overseas (or otherwise deployed) military, where the time between the absentee ballot becoming available and the last available date to return it, the problem becomes manageable, simply because the change management process for the available terminals can be controlled. Hell, simply send (under cover) a live cd with the software on it to each deployed service member. Now, no malware, no unknown configuration (at least what matters) and enhanced security.
BTW, see my post below.
And ye shall know the truth, and the truth shall make you free.
John 8:32(King James Version)
A random anecdote having nothing to do with e-voting, but probably a lot to do with the quality of voting IT systems: Last year, I asked for an absentee ballot, and never received it. This year, I asked for an absentee ballot, and received three, sent at different times, over the course of several days.
Electronic voting may be a disaster, but there are some other really fundamental flaws in the system:
Get decent administrative systems run by competent people in place first. Then, maybe, we can think about electronic voting.
Enjoy life! This is not a dress rehearsal.
Making the hack obvious before the "results" were in was exactly the wrong thing to do.
The right thing to do would have been to subvert the results, then mail the chosen numbers and other evidence that you'd owned the system to various news outlets just prior to the tally being announced. Let them embarrass themselves by claiming that the system worked and was secure.
Remember, the worst vulnerability is the one you never discover, or admit to.
If you were blocking sigs, you wouldn't have to read this.
That kid can do anything, except tie his shoes.
"The problem, which geeks classify as a "shell-injection vulnerability," .. By formatting the string in a particular way, we could cause the server to execute commands on our behalf" link
...
In this day-and-age, how could the programmers be so f*****g dumb, what are they teaching them in tech school lately
Internet voting system would be great, great thing! I could finally observe, with 100% profe, that my wife votes correctly.
You don't know what you don't know.
This should be a competition at the two yearly Blackhat conventions, which I suspect will prove it impossible to come up with a bulletproof e-voting system. What is wrong with paper ballots again? Oh yeah; Conservatives know millions of dead people and illegal aliens taint every election. As opposed to partisan election officials with untraceable access to a vote tally database and no paper trail to prove shenanigans.
Not to be outdone, an Ohio State CS Professor had his class change the logo of the Federal Election Commission to a Buckeye urinating on a Michigan Wolverine.
Never underestimate the potential of Human stupidity. -Heinlein
"There were no reports of fraud whatsoever" != "no fraud."
But officials now say the voters will only be able to download their ballots via the system and will then have to send them in separately — via post, e-mail or fax – to be counted.
Thank goodness they had such unquestionably secure systems to fall back on.
Wait...
Online voting is a fail from the start, there are too many attack vectors and the stakes are too high.
Electronic voting could be done, but it would require paper ballots anyway, if the results are going to be verifiable:
1) sign into polling place
2) enter booth, cast vote on computer
3) computer prints out ballot that has vote printed in ascii (unicode whatever) and some optical scan code on something like receipt paper
4) voter verifies that the ballot is correct, places it in the ballot box
5) votes are counted by scanning the code, a random sample is also scanned to ensure that the scan matched the ascii text
6) local counts are sent via signed/encrypted email and snail-mailed paper (redundant to detect forgery), the paper could again be a scan/ascii receipt
This would allow the voter to trust that their vote was cast as they intended, repeat counts of the ballots if called for, quick counting (scan-code) or verifiable counting (ascii), a reduction in the amount of paper used.
If they know who the absentee voters are why not just mail them a ballot instead of spending the typical fortune that gov. bodies spend on such useless projects?