Slashdot Mirror
Software To Capture Votes in Upcoming National Election is Insecure (vice.com)
Hackers could have manipulated the results of the upcoming election in Germany by using "trivial" attacks against a program used to count and transmit voting results, researchers warned on Thursday. From a report: White hat hackers from the Chaos Computer Club (CCC), a well-known hacking organization in Germany, claim to have found a series of serious vulnerabilities in PC-Wahl 10, software used by German authorities to count and transmit voting results. The researchers said their attacks show the software is in a "sad state" and that malicious hackers could have compromised it with "one click." "The amount of vulnerabilities and their severity exceeded our worst expectations," Linus Neumann, one of the researchers who conducted the study, said in a press release. The good news, however, is that the researchers believe it would have been hard for malicious hackers to get away with such attacks during the upcoming German election on September 24 without anyone noticing. "Technically, manipulation would be possible in several ways, but it is unlikely that manipulation would remain undetected," Thorsten Schroder, another researcher involved in the study, wrote in an op-ed for the magazine Der Spiegel.
No doubt if there's an unexpected outcome in the German election, this will be blamed on Russia. Just like in the United States, there's rampant racism against Russians in Germany. Rather than accepting that the people don't want leftist policies to continue lowering their standard of living, the left will turn to racism and blame the Russians. It's time we call out the left for their rampant bigotry, whether it's their hate of Christians or their constant blaming of Russians.
The globalists wouldn't want to have another Trump on their hands in the most powerful nation in Europe!
The only people who you really have to worry about hacking the vote are based out of Brussels, not Moscow.
It is not difficult to build a highly secure e-voting system with highly robust, highly secure reporting.
This is the minimum standard that should be considered acceptable.
Ok, so how do you do this?
1. A system is no better than the platform it is on. So you want a formally verified, tamper-proof platform with no extraneous physical connections.
2. The software should be designed using formal methods (coloured petri nets will work because there are only a fixed number of well-known arcs under well-known conditions, learning from SEL4 won't kill anyone either).
3. Votes should be retained in encrypted form, each voter's public key being on their voter registration card in a computer-readable form (but not remotely readable), and stored in multiple locations. This eliminates the possibility of any database admin trying to delete or insert votes, as the hashes won't tally. Blockchain can be used to ensure majority consent on the hashes, thus excluding corrupt institutions.
4. The server that generates the public/private key pairs should feed the private keys only to official Orange Book A1 servers for counting.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Sure it will take longer to count votes with people instead of software, but I'm fine with that. I'd rather it take hours for paper ballots to be counted than have the possibly of government officials or hackers corrupting the voting system. Politicians will bend over backwards to stay in power, giving them an easy way to manipulate votes in their favor makes me uneasy.
So far here in Alberta all federal and provincial elections I've participated in have used paper-based voting systems and been counted by hand (AFAIK), hopefully it stays this way.
In Germany, we use paper ballots which are counted manually. The software is only used for transmitting and aggregating results. Every part of the process that is handled by the software is observable by the public and can be verified by the public. If the people who do the counting at the polling places make a note of the result and check that it matches what is published upstream and that the aggregation is done correctly upstream (from public input to public output according to defined, simple algorithms), then any manipulation that a hacker could inject through the flaws in this software is detectable.
Everyone involved hopes to exploit the system to their own benefit, they're not interested in a fair, honest, open system. That's why ballot stuffing is a thing and why we have secret ballots so people can't be reliably threatened or bribed for their votes.
Then there's the fact that there is a lot of money on the line, and you can bet lobbying (both honest and dishonest) is going on to keep that money flowing.
It seems very strange that there's so much wrangling over how to create a ballot until you recognize that the parties involved WANT it to be confusing because they're hoping they'll have enough name recognition to be the default choice.
It's pretty simple:
* Allow each person on the ballot to have a representative at every polling station if they wish.
* Have a ballot with a list of names with empty circles beside them. (Include party affiliation under the name if required).
* Give voters a pencil to mark one appropriate circle (per section of ballot if adding a referendum or something).
* Have the voter feed the ballot through a scanner that empties into a secure ballot box.
* If you have reason to think the scanner system has been corrupted... manually count ballots the old fashioned way.
* If you're worried about people voting multiple times under fake IDs... go that route so wonderfully demonstrated in Iraq - one vote, one purple-stained finger.
Water has been confirmed to be wet by leading scientists.
Given:
1) The critical importance of voting in Democratic societies,
2) The ease at which eVoting devices appear to be compromised,
3) The effectiveness paper voting as proven over untold millennium
4) The inherent lack of accountability in current eVoting ,
No logs, Insecurely stored, No validation, etc
It begs the question, why even bother with eVoting machines? Just because it’s “new”, “electronic”, can be “web enabled”, seems insufficient to perch the entire construct of Democracy on such weaknesses
Quick, send them the Voter Integrity Commission, Kris Kobach, Mike Pence, and the rest.
I'm sure they have a prison or something in Germany.
The update process is completely unsecured as well. However, the current problems are not a real issue since the software will receive an online updare that fixes the discovered vulnerabilities before the upcoming election.
Slashdot is a website read around the world. When posting an article of this type about a "national election", it would make a shitload of sense to add, in the title, the name of the country the election is for.
It's true but this has been well known in the security industry for years, if not decades..
http://www.hawknest.com/
In the US, if you are a liberal supporting the DNC you are a racist.
-DNC started war to keep slavery in place
-DNC put in Jim Crow laws to keep blacks oppressed
-DNC attempted to keep blacks from voting
-DNC opposed civil rights
-DNC senator, Robert Byrd, was KKK leader and a top DNC senator for life
-DNC nominated Al Gore Jr for president, son of well known racist Al Gore Sr
-DNC nominated H. Clinton for president, who claimed her hero and mentor was Robert Byrd (the KKK Senator)
-DNC supports planned parenthood, an organization whos founded wanted to rid the US of blacks through abortion
-DNC president JFK spied on MLK illegally and labeled him a troublemaker
Sorry, but the current "globalist" in the US at least, are the racists. They have a long history of it and it still appears to be continuing today.
If you support the DNC and call people who don't support the DNC "A NAZI!!!" you are a racist. Support the bigots, you are a bigot.
Which voting technology is the most secure is secondary, really, when the whole process is fundamentally flawed by the fact that voters can't be bothered to learn the actual facts or even turn up to vote, and when elections are completely overwhelmed by deliberate misinformation campaigns. As it is, it would be fairer to play dice for the presidency. Simpler too, and it might even engage people more.
http://www.paul-robinson.us/index.php/2008/10/25/the_robinson_method_a_really_simple_way_?blog=5
Every time I post this up, nobody comments on it, as if it's too much to comprehend - a simple, hackproof method of voting.
All the results would be streamed live on video on the internet, so thousands (or more) people could capture each stream onto their PC, and all the results would be available as VIDEO, within one hour (at most) of the end of polling. With no ability to cheat.