Slashdot Mirror
DC Suspends Tests of Online Voting System
Fortran IV writes "Back in June, Washington, DC signed up with the The Open Source Digital Foundation to set up an internet voting system for DC residents overseas. The plan was to have the system operational by the November general election. Last week the DC Board of Elections and Ethics opened the system for testing and attracted the attention of students at the University of Michigan, with comical results. The DC Board has postponed implementation of the system for 'more robust testing.'" Update: 10/06 02:42 GMT by T : University of Michigan computer scientist J. Alex Halderman provides an explanation of exactly how the folks at Michigan exploited the DC system.
Every critical government system like this should be required to pass through a period of open public review before even being considered for use.
They could actually use prizes to be paid by the government contractor who submitted the bid. If they do a shoddy job on security, they'll not only lose the bid, but they'll also lose additional money (a refundable deposit) to whoever finds their security flaws.
Voting machines should definitely be electronic.
Online voting seems to be so problem-prone as to be useless. Something as simple as a smurf attack could potentially block every voter from casting their ballot in time.
One of the articles mentioned that some browsers submitted blank forms because they don't support inline PDF forms. Who, exactly, thought that using PDF was a good idea? The whole point of the web is that it provides layout standards. Why even bother using a web browser if you're just going to try to hack around it by using a completely different content format, PDF, shoved in using browser plug-ins. It might has well have been Flash. Use the web or do not. There is no halfway.
And of course, their servers were obviously insecure, as evidenced by someone managing to alter content on the servers.
What does all this tell us? Well, it tells us that:
Not that this shouldn't have been anything less than obvious to anyone with even a basic understanding of computer security.... Real secure networks built on top of HTTP use client applications that verify signatures on the content that the servers provide, ensuring that it is legitimate before acting on it. This also, of course, requires that people obtain the client software in a secure fashion, which is a problem in and of itself, in much the same way that obtaining the client on-the-fly from a web server is a problem, and for precisely the same reason.
Check out my sci-fi/humor trilogy at PatriotsBooks.
I find it scary that at the same time as trying to make it unlawful to use encryption that the government doesn't have a "backdoor" into, they are also trying to push "secure" internet voting. Goodbye democracy, we hardly knew you...
I suppose its a good thing they tested the system.
Isn't this the type of thing testing is supposed to identify?
Has anybody the comments section in the Washington Post website? It is disgusting to see how much hatred and ignorance is going on there. I hope they're not a representative sample of the USian population.
Meanwhile, in Brasil, we just had a presidential and local election. About 100 million people voting, in an all-electronic process. There were no reports of fraud whatsoever, and the election results were available just 2 hours after the polling stations closed.
Can't the US do better? Your voting system is just laughable.
entropy happens
They could also be collected by political parties from voters through theft, bribery or coercion then used to cast multiple votes.
It's thoughts like those that land coders in trouble.
We have an expert on the record saying it's very very hard, and an AC posting saying the opposite. Who to trust???
What if there's a flaw in the smart card hardware that allowed votes cast to be transmitted differently? What if the master key were to be exposed and someone launched a MITM attack? What if there's an exploitable flaw in the operating system of the server collecting or collating the votes?
You have a solution to just one tiny part of the giant jigsaw puzzle. Still think it wouldn't be hard?
I can check my bank accounts online.
I can pay my bills online.
I can order almost anything imaginable online.
I can participate in auctions online.
I can date online.
I can gamble online.
I can see my credit reports online.
I can file my taxes online.
Why is voting so different?
A lot of them miss out another important requirement for elections and voting systems, at least in actual democracies.
;) ). So that puts a limit to the cheating - so when enough voters get pissed off enough with you, despite your efforts you can still lose the elections - there are just so many postal votes to go around.
:).
;)), and they can't seem to be able to do it right at home... With Diebolded elections and all that.
Requirement #0: Convincing enough of the losers that they've lost.
Doesn't matter if your fancy system is actually secure and proven. If the losers think they lost because "too much magic" happened, you could have riots on the streets or even civil war.
While paper votes have problems, they are easier to explain to voters. And if you do them right, the losers tend to agree with the results- they might dispute with a few problem constituencies, but you won't get massive riots.
You get riots when you do them wrong e.g. having one party do the counting in secret. And riots might even be justified or at least understandable since since having just one party count paper votes secretly is rather fishy.
In my country I think they rig it with postal votes. The counting is done in front of various observers from different political parties and a few 3rd parties even.
So where they can rig it is with postal votes, or in places which are more obscure - nobody bothers to show up to watch the counts, ballot boxes etc (but those places often don't make much of a difference
Whereas most electronic voting systems tend to do their counts in a way that cannot be observed by others. There's too much magic
And all for what? Make things faster? You want to do it right, take the time and money to do it right. What's so hard about scaling? Your education system should be good enough so that you have enough volunteer counters who can actually count.
I find it funny that the US spends billions to supposedly hold elections in Iraq (regime change right?