Hacker News Reader

Comment by berdario | Hacker News Reader

I was curious to understand what exactly are those raw images of the voting records.

Apparently the ID of https://en.wikipedia.org/wiki/Tarek_William_Saab is publicly known ( 8.459.301 )

So, thanks to that I've been able to check the "acta de escrutinio" of the El Carmen paroquia...

That indeed looks plausible, but do we have any Venezuelan here that can corroborate that this website shows the same "acta de escrutinio" that locals can request from their polling station?

I mean, allegedly this is a grassroots effort with all of the acta painstakingly aggregated... But the website is controlled by the opposition, so they could've just been made up (just like the numbers from CNE could be made up)

View on HN

The images can be corroborated by the random string that is printed at the bottom. It’s a digitally signed hash of the tally for that machine.

Political parties have access to the signing key and can verify that the signature matches.

Do you have any details about the kind of mechanism that they used?

If it's a private/public kind of mechanism, they should be able to disclose the public key for signature verification.

If it's not, and it's some kind of a HMAC, and the political parties have all access to the key... Then this doesn't protect at all against the threat implied (the different parties don't trust each other, and both claim that they are trying to "steal" the election), since these signatures could be forged by any of the political parties with access to the key

Even in the former case, it could be possible that a machine could be compromised, and could have emitted two tallies (one for the actual election, and another one with different numbers and forged signatures). In that case, we would still want to check that the local polling station can confirm that the Acta that we're seeing is congruent with what they have

Here’s a FAQ about the security features of the voting machines https://www.smartmatic.com/wp-content/uploads/2022/11/FAQ_Cy...

I also agree the parties should disclose the public key and the parameters to calculate the hash.

The code and the keys are stored in a database that is audited by political parties before the election. What I’m not certain about is whether they have access to it at this time.

Proving the validity of the acts should be trivial, especially for any party who had access to the audited database. There is little point in forging fake ones.

The locals probably can’t request shit because those records are in custody of the military.

Many Venezuelan people have verified their records. Including the “witnesses” who have signed all the records. The signatures can be seen on the pictures.

There’s nothing stopping anyone from doing OCR on the images to extract the count and just do the math. (Which is what I am doing but not as easy as it sounds)

There is no need to do any difficult OCR, the QR code contains the tally in machine-readable format. You just need a phone and copy the result to a csv file

Oh cool, I had no idea what the QR code was.

There’s over 20k images so using a phone isn’t feasible. But programmatically cropping the QR code and scanning it seems doable.

Thank you for your input

> Many Venezuelan people have verified their records. Including the “witnesses” who have signed all the records. The signatures can be seen on the pictures

The thing is that these witness signatures could be forged (together with the tallies)

I assume that with "verified their records" you mean exactly what I'm asking for (but since I don't know any Venezuelan living in Venezuela, I haven't seen anyone verifying that stuff)

You could make a public spreadsheet so others can join in on the crowdsourced effort

Just make a list of every precinct and whether or not we have a screenshot for them. People can help by uploading more pictures and which precinct it corresponds to and also manually reading the results and updating the spreadsheet

Reply on news.ycombinator.com