US mid-terms: Hackers expose 'staggering' voter machine flaws
bbc.co.uk
bbc.co.uk
The whole point of automation is to save on labor, at the cost of simplicity. Machines are excellent at handling complexity that some experts can come up with and can execute it reasonably well. Except that this is precisely the opposite of what's desired in an election.
Voting is one situation where it is DESIREABLE to have many people manually involved in a simple process. Auditing voting machines requires a pretty in-depth knowledge of information systems and experience with a lot of edge cases.
Proprietary voting machines only make auditing worse, basically hiding all flaws behind a curtain of marketing and legal threats. Over 95% of the citizens have no way of auditing the integrity of the results and have to put blind faith in for-profit corporations who are (1) disincentivized from disclosing flaws and (2) do not suffer penalties when security flaws are found to be present by researchers.
In a paper scheme, it takes more human effort to tally an election, but every citizen can participate in that process, and the others can safely observe and easily understand what's going on. The only downside is that it may take a few hours instead of seconds. But latency is infinitely preferable over opacity and potential inaccuracy.
I used to think e-voting would be OK if there was a requirement to use open-source voting software but even that is problematic. As a software engineer, it would be my pride to be able to help, however that would still be depriving non-software people from the ability to participate in the process, and I feel that is wrong. Now that my focus at work is on building resilient systems, I believe paper is the way to go, especially considering one of the other requirements is secrecy.
Not really. If done properly they would allow faster and cheaper vote counting, a more secure audit trail and the ability for voters to verify that their vote was recorded properly.
But they do seem to be one of those things where the government is happy to just hand out bags of money to rubbish vendors and then wonder why it doesn't work. Reminds me of the NHS digitisation fiasco.
> cheaper
You realize we get to use volunteer labor here.
> more audit
That's broadly dissented unless you presume a given-by-god form of "done properly" and no-true-scotsman your way out of any constructive discussion.
> ability for voters to verify their vote
ALSO broadly dissented or at best extremely nontrivial. Blinded cryptographic operations are the territory you're talking about if you want to be in the ballpark of correct, and while the theory exists, the practice is again... not a given. I'm not even sure the theory is fully available for this domain.
Remember, one of the core concepts in a functional democracy is a secret ballot. This is essential to avoiding Some Very Nice People hovering just outside the polling place to make sure everyone in the area voted "correctly".
If you can prove who you voted for you can collect a payment for voting a particular way. I can't believe people keep advocating for "proof" systems without recognizing this fatal flaw.
But it is pretty easy to have a system that lets you verify to yourself that your vote was recorded correctly.
No I am not. It is simple really - when you vote you get some kind of a receipt with a vote ID on it. And on the screen it tells you an easy-to-remember number (for example 0-9). When you want to verify your vote you go online and check that the verification digit matches.
You still can't prove to anyone else how you voted (unless you take a photo, but that is true already and is a reason taking photos is banned).
> Over 95% of the citizens have no way of auditing the integrity of the results and have to put blind faith in for-profit corporations who are (1) disincentivized from disclosing flaws and (2) do not suffer penalties when security flaws are found to be present by researchers.
It is WELL UNDER 5%, I would be surprised if quality security engineers constitute 0.1% of the population.
Voting machines are pretty crap, but they can and occasionally do solve some real problems.
Voting machines can help visually disabled people vote without human assistance and potential vote manipulation. Although that's not super helpful when it often makes systematic vote manipulation easier.
Voting machines can make it much easier to handle giving eligible voters the proper ballots if they show up at a precinct other than their home precinct; which enables things like pooled early voting locations and show up at any polling place in the county. It can be a lot easier to show up during voting hours to vote somewhere near work or school or on your way than somewhere near your house; but most elections have a mix of national, state, and local issues to vote on, and districts are not always well aligned. In the 2016 Presidential election, Santa Clara County had 247 different types of ballots.
Paper plus optical scan is probably the best thing going: Quick tallies, on-the-spot verification, complete paper trail.
Sure, you can hack the optical scan machines, but if you do, a double-check of paper ballots will quickly show the problem.
Not the best example of "unhackable" system...
Once you enter the voting building, you give your ID, sign the register, go to the voting cell, put your vote in an envelope, give your sealed envelope to be counted in a sealed box that has a mechanical counter for each envelope it gets.
Unhackable, because anyone can check the counter, count the signatures, and participate to the closing count of cast votes.
The real issue is if you can get inscribed on two different voting neighborhoods though... is that what you describe? (which shouldn't happen, given how long it takes to get your name on one voting list, since the gvt probably crosses your name out of all other voting neighborhoods when you do)
That's racist. (According to some in the US)
EDIT: So how would you design a system where you don't need an ID to vote (like many places in the US)?
Don't be so patronizing to minority groups, they are just as capable as everyone else and already have to get ID for numerous other activities.
The US is less racist than most other countries on Earth, yet somehow it is the US that couldn't properly implement voter ID cards?
Racism in America has dropped dramatically in the last 50 years according to multiple lines of research, the perception that racism is on the rise is false and misguided.
It's a shame voter ID can't be implemented on a nationwide basis in the US just because people have concerns that are longer valid.
We absolutely could properly implement voter ID. We just don’t.
Edit: I would encourage skeptics to look up the history of voter literacy tests. How can a literacy test be racist? Are you implying that minorities can’t learn to read? And yet they were highly effective at suppressing the minority vote for a long time.
Unusually, this links to the actual court result: https://www.nytimes.com/interactive/2016/07/29/us/document-A...
The bill was specifically and deliberately amended to choose only those specific forms of ID that African-Americans were least likely to hold.
If anything just to avoid the time and energy spent insinuating things and discussing if IDs are racist or not.
A country like India with more poverty and issues like open defecation somehow managed to get everyone an ID but here it this insurmountable problem, that everyone talks about yet nothing is done about it.
This is not an impossible question by any means. You can absolutely design such a system. But the differences between that hypothetical system and the real systems used in the US are important and instructive.
Sort of similar to all the Republican shills who get caught trying to commit in person voter fraud while "proving" how easy it I'd to commit.
He was indeed convicted and he also didn't believe it was bad to show off like that.
For those who don't know, Switzerland sends all the material at home, you then can go to the ballot and post it or send it by post if it's not an important votation (if i remember correctly).
You can only have one main residency, you cannot possibly be on two lists.
If you register for voting per snail mail you get pulled from your community list, if you come to vote the will know you mail voted and will be questioned by law enforcement.
If you want to show up twice law enforcement will get you out, if needed.
This is in a commune with ~1000 people, so it may be a bit different in bigger ones (but AFAIK, there's a certain limit to voter count at any voting point).
You effectively would need to corrupt >= 8 people (three election helpers are working any time, but they work in shifts, in total there 5 to 6 election helpers), as often outside law enforcement comes in this is particular hard to do. Also you get a fixed number of voting forms and all protocols are checked against by other gov. parts, so to pull this off without any notice would be close to impossible, IMO.
At least way easier to do this on proprietary, known error prone, voting machines... Get them open source, let them be verified and looked close upon by the public and some good pen-testers/security researches and you'd would have a really good system going....
The report itself [2] goes into more detail on the exact nature of the vulnerabilities.
[1] I admit I didn't watch the whole video; I find video to be an extremely tedious medium for transmitting information like this, but from skimming bits of it it seems that the speaker is more focused on distributed systems for voting and online voting systems, which are both horrifying ideas; although Oregon and Washington have made a good go at absentee-only voting.
[2] https://defcon.org/images/defcon-26/DEF%20CON%2026%20voting%... (discussion at https://news.ycombinator.com/item?id=18112172)
We have very old fashioned voting machines that scan ballots marked by voters by hand. The paper ballots are retained in the machine after being scanned, and are picked up at the end of the day by sheriffs deputies.
There is another army of mostly city employees working all day and night, for several days, suporting the polling places (in a dozen languages) and processing all of the ballots. So it is indeed a costly system.
We have been able to vote by mail for many years, but for various reasona, about half of the voters prefer to come to the polling place to cast their ballot (and get an "I voted" sticker).
Meanwhile, Washington, Oregon and Colorado have only voting by mail. No voting machines no polling places, no army of workers all over town. No doubt there are issues with processing those ballots as well, but it removes the voting machines from the vulnerable spots in church dining halls and residential garages all over town.
That's generous. In Germany, the usual compensation for working 12-14 hours at a polling place is 30-50 € (35-57 $). Yet there are plenty volunteers (including me). Many like the idea of fulfilling some civic duty, especially one that's a one-day job instead of a long-term office.
Both systems can be broken by propaganda anyway. That one is also well tested.
The supposed impetus for the change was the hanging chads controversy in florida in 2000.
Recently I had an idea about how to go at this: The elephant in the room is that you're trusting a single for-profit party with the accuracy of the result. If you want to assure much more tamper-proof results, the key would be making this an adversarial task between a voting and a verification machine. Have a voting machine count the vote and print a receipt. Standardize an interface between the voting and the verification machine which is a transparent plastic window where the voter can physically view his choice before pushing the button at the verification machine that draws in the voting ticket, verifies the vote, counts it again and stores the physical paper for retrieval (and regular, infrequent audit).
Make the voting and verification machine vendors adhere to the standard interface, let them face steep penalties for any deviation between voting and verification result, forbid any common ownership between the companies and never let any of these companies supply more than 50% of machines for any given election.
Then it goes into a scanner/lock box, so there's a count available right when the poll closes...
It's also not really expressed as an affirmative mandate per se; you have to request time off, in some cases it's the employer's choice when the time is taken, and if they "retaliate" or fire you then you can complain after the fact. So now you're in a dispute with your employer and you missed your chance to vote...hooray.
It's also an occasion to speak all day long with people with whom you completely disagree politically, which is much too uncommon :)
Votes happen what, every few months at most? I would say saving a few hours every 100 days isn't worth that investment.
Who cares about all this, when we can avoid hacked elections with said alternatives?
- specify long. It already takes >8 hours (here in France) for voters to all come cast their vote (8am -> 4pm, and sometimes later in large cities). What's a few more hours for the final count?
- specify tedious. Taking shortcuts can't cut it, and sounds like a recipe for disaster. Counting envelopes and ballots is not the most exciting job ever, but it can be made easy if you have lots of "voting neighborhoods" with e.g. <750 voters
- non-realtime. Who cares? If TV and radio want to spread the news, they can question people coming out of the voting building. In France, we know that final vote counts are published on voting day at 8pm. (Or is it the day after?) Anything published before are estimates, as should be.
Also, why would you give any control of elections to third-parties (and require financial audits, technical limitations, etc.)? The people (e.g. randomly drawn) + the current municipal staff can handle counting envelopes.
Why trust every single voter individually (peer into the glass window), when you can have a "hive" check what they do? (https://news.ycombinator.com/item?id=18111861)
It really isn't. But even if it were, I fail to see the importance of any of these properties when balanced against voting fraud and the validity of our representative democracy.
That was in 2009.
That was in 2007: https://www.ccc.de/system/uploads/3/original/nedapReport54-1...
[1] https://defcon.org/images/defcon-26/DEF%20CON%2026%20voting%...
Some result where 10 times the voters all vote for one candidate.
It's illegal and dangerous to whomever does this. But at some point, nothing but blunt disobedience works.
There should be zero trust in an election. Citizens don't have to trust the party or any machine.
No-one here seems to be asking 'WHY' there's even a need for electronic voting machines? Paper and pencil manual voting will always be safer as it's almost impossible to game the system when there's 10,000+ unpaid volunteers double checking each others counting.
Electronic Voting is a solution looking for a problem. It's only advocated by the losing parties, as they are convinced that making it 'easier' to vote (really? It's not like it's hard) will get more bums off seats and into polling stations, which will increase their chances of winning said election.
NASA spent millions on a space pen, that never worked properly; The Soviet Union just used a pencil.
Someone has to, might as well be me. The reason you want a pen in space instead of a pencil is that graphite can chip off, and cause lethal danger to electronics and (consequently) crew.
https://en.wikipedia.org/wiki/Writing_in_space
Grease pencils and felt tipped markers were among the early alternatives.
Why care specifically about the country you are leaving?
Compare results to statistical polls?