Electronic voting

[vonork]

http://www.nytimes.com/2004/01/31/opinion/31SAT1.html

How to Hack an Election

Published: January 31, 2004

Concerned citizens have been warning that new electronic voting technology being rolled out nationwide can be used to steal elections. Now there is proof. When the State of Maryland hired a computer security firm to test its new machines, these paid hackers had little trouble casting multiple votes and taking over the machines' vote-recording mechanisms. The Maryland study shows convincingly that more security is needed for electronic voting, starting with voter-verified paper trails.

When Maryland decided to buy 16,000 AccuVote-TS voting machines, there was considerable opposition. Critics charged that the new touch-screen machines, which do not create a paper record of votes cast, were vulnerable to vote theft. The state commissioned a staged attack on the machines, in which computer-security experts would try to foil the safeguards and interfere with an election.

They were disturbingly successful. It was an "easy matter," they reported, to reprogram the access cards used by voters and vote multiple times. They were able to attach a keyboard to a voting terminal and change its vote count. And by exploiting a software flaw and using a modem, they were able to change votes from a remote location.

Critics of new voting technology are often accused of being alarmist, but this state-sponsored study contains vulnerabilities that seem almost too bad to be true. Maryland's 16,000 machines all have identical locks on two sensitive mechanisms, which can be opened by any one of 32,000 keys. The security team had no trouble making duplicates of the keys at local hardware stores, although that proved unnecessary since one team member picked the lock in "approximately 10 seconds."

Diebold, the machines' manufacturer, rushed to issue a self-congratulatory press release with the headline "Maryland Security Study Validates Diebold Election Systems Equipment for March Primary." The study's authors were shocked to see their findings spun so positively. Their report said that if flaws they identified were fixed, the machines could be used in Maryland's March 2 primary. But in the long run, they said, an extensive overhaul of the machines and at least a limited paper trail are necessary.

The Maryland study confirms concerns about electronic voting that are rapidly accumulating from actual elections. In Boone County, Ind., last fall, in a particularly colorful example of unreliability, an electronic system initially recorded more than 144,000 votes in an election with fewer than 19,000 registered voters, County Clerk Lisa Garofolo said. Given the growing body of evidence, it is clear that electronic voting machines cannot be trusted until more safeguards are in place.

Know we had a thread about this, thought we could re-start that discussion...

I can only say that electronic voteing with no paper trial is not something I would trust, even if it was hack-prof it could still crash. Sure the ballot-box can burn.

I belive an electronic voting station that prints out a paper the voter can look at and then but into a box would be good. If the voter has pressed the wrong button on the mashine they can se that the wrong candidate is printed on the paper end redo the vote. Then the printed papers can have a marking so it can be counted both by an machine and by hand.

 

[Stapel]

Not having electronical votign systems seems rather backward to me.

There is no way ro exclude fraud 100%, but there are ways to minimise it.

 

[Archer 007]

We need to make sure there are proper protections against fraud before the start of a digetalized system.

 

[Kinniken]

As a CS student who has been following the development in electronic voting pretty closely, I have to say that I am appealed at the way Diebold's voting machines works. Security is almost non-existent, the softwares are closed source meaning that it all relies on Diebold's honesty, they have an horrible track record in security and there is no way to check anything. And maybe I am paranoiac, but to top that the Diebold CEO is a committed Republican involved in Bush's campaign in his home state - something which by itself is not too much of a problem but hardly inspire trust.
While the problems cited above are the most glaring to date, it's hardly the first time it has happened; I remember a local election where the files containing parts of the votes transited via an FTP account with no access protection
I'm not against electronic voting per see, well done it can indeed save time, money and be more accurate than older systems, but it must leave a paper trail, manual recount must be done in random districts to check the results and the source code must be open-source and available both to the local officials and to the public. Until then, I very much prefer France's system of volunteers hand-counting votes with six persons seeing each vote and representatives of each party free to move around and check that nobody is cheating. Tedious, but safe and efficient. And the results are available two hours after the end of the vote in general.

 

[funxus]

AccuVote-TS

Is it AccuPoll who has made the software? Or do they have a part in it? Me and my parents just put quite a lot of money into that company (binding it for a year...), and this sounds alarming.

Otherwise, I'm much in favor of electronic voting. From what I can see, these aren't on line though. We test-tried a system for voting on line here in Sweden on all high-school students (not allowed to vote anyway), and I think they had some issues with servers going down.

 

[10Seven]

Sounds pretty dangerous to use machines made in your own country - perhaps better to get them overseas.

In the country I live, it costs approximately $1.50 per vote - to pay for the process - I imagine it gets a lot better in bigger countries, but, still, the USA must spend at least one hundred million every election. An electronic system could save a great deal. But... safety first, surely.

 

[Marla_Singer]

Whatever is the system, the best way to minimize fraud is that someone representing both parties are present in all bureaux to agree there was no fraud.

 

[Hitro]

I'm strongly opposed to electronic voting as that simply is an open invitation for fraud. If someone really believes a hack-safe electronic voting system could be constructed he is delusional.

In fact no kind of machines should be used, what's wrong with the good old cross?

And who cares if it takes a little longer and is a little more expensive if it is alot more secure?

 

[Marla_Singer]

Originally posted by Hitro
I'm strongly opposed to electronic voting as that simply is an open invitation for fraud. If someone really believes a hack-safe electronic voting system could be constructed he is delusional.

In fact no kind of machines should be used, what's wrong with the good old cross?

And who cares if it takes a little longer and is a little more expensive if it is alot more secure?

I agree.

 

[10Seven]

I think having representatives present would defeat the purpose of an electronic system.

Also thinking that the biggest prevention of fraud in paper election is having so many different people involved - and the bigger the election, surely, the lesser the chance of fraud - more people to bribe and coerce.

But it's my understanding that the last US presidential election was dodgy it's certainly dodgy when a panel of republican dominated judges 'impartially' decides a republican won

 

[funxus]

Originally posted by funxus

Is it AccuPoll who has made the software? Or do they have a part in it? Me and my parents just put quite a lot of money into that company (binding it for a year...), and this sounds alarming.

Apparently both Accupoll and Diebold use Accu in their names, which is confusing since their in the same line of business, but it appears Accupoll doesn't have anything to do with this. So, although it's not good for the electronic voting business in general, I guess it's a good thing for accupoll (and me)...

 

[Kinniken]

Originally posted by 10Seven
Also thinking that the biggest prevention of fraud in paper election is having so many different people involved - and the bigger the election, surely, the lesser the chance of fraud - more people to bribe and coerce.

I could not agree more. That, and let every citizen who so desire take part in the counting, like it's done in France. When you have four volunteers handling each vote (one to open the envelop and take the slip with the candidate's name out, the other taking the slip from the first's hand and reading the name aloud before placing it on the table fully in view, a third to note the vote, and a fourth to check no mistakes were committed) with officials from the city hall and the different parties moving from tables to tables observing the procedures, the potential for mistake and vote-buying is very, very low... And it's even pretty fast (the results are generally in two-three hours after the end of the voting, not three month laters )