Ohio Study Confirms Voting Systems Vulnerabilities

bratgitarre writes "A comprehensive study of electronic voting systems (PDF) by vendors ES&S, Hart InterCivic and Premier (formerly Diebold) found that 'all of the studied systems possess critical security failures that render their technical controls insufficient to guarantee a trustworthy election'. In particular, they note all systems provide insufficiently protection against threats from election insiders, do not follow well-known security practices, and have 'deeply flawed software maintenance' practices." Some of these machines are the ones California testers found fault with last week.

With all due respect... this is news?

[Slartibartfast]

I think we've seen sufficient evidence that Diebold has been inhaling deeply, if you will. And we, as a relatively technology-savvy audience, are acutely aware of the potential for disaster -- just imagine, if you will, a virus that infects just voting machines. Personally, while it pains me to say it, I think we should stick with the solution we use here in New Hampshire: good ol' SAT-like ballots. Darken the oval next to the candidate's name, and you're done. The Machine will either accept it, or reject it (in which case you do a new ballot, and the old one gets destroyed). Simple, easy, accountable. Yes, being able to use a computerized voting machine for tabulation is incredibly seductive, but voting is already something inherently prone to attempts at manipulation. Let's not introduce yet more potential, shall we?

Re:Right... "election insiders"...

[Anonymous Coward]

If systems like PGP and Freenet are possible, why not a secure voting system?

Instead of contracting out to private businesses, whose best efforts are, apparently, pitifully inadequate, why don't they hold an open, international competition? (Wasn't the AES algorithm the result of an open request?)

Re:Wrong!

[rvw]

What would the impact be of a carbomb going off in one of the vehicles transporting the ballots? If a district were known to be heavily in favor of a certain candidate, wouldn't the destruction of those ballots negate their votes?

Let's say there is an accident, not a bomb. The car catches fire, the votes are destroyed. How many votes are in this car? 500? 5.000? I suppose there won't be 50.000 votes in it. Let's say 5.000 votes are destroyed. I think that's a high number (but I may be wrong). You could simply calculate if this would change any of the results. Probably it won't matter if all those votes of this one accident went to candidate A or B. And not all those votes will be for one candidate alone. So if those votes couldn't change the results, the accident is no problem. But what if they could make a difference? The boxes are probably tagged with an id, so they could check which boxes are missing. Then they could have another vote for this district/voting office alone. But maybe the candidates agree not to do this.

What you're suggesting is what happens if many cars had accidents or were bombed. Then it could seriously influence the elections. But one car won't make much of a difference.

Who cares?

[hyades1]

I don't see what all the fuss is about. When your only choice is between the Democrats and the Republicans, who gives a crap whether the machine you vote on is rigged? It's like being offered a choice of getting thrown in a shark tank or a piranha tank.

Power Corrpution Apathy

[djfake]

The fact that the US cannot come up with a definitive "voting tabulation method" tells you that the whole thing is crooked from the git-go. And even if we did, we'd still have (at least) fifty different electoral commissions for national elections. Why is it so difficult to comprehend a system that tabulates votes and leaves an audit trail? But what's even more reprehensible is that the majority of Americans don't even consider the integrity of our elections when voting - or do they? The US has one of the lowest turnouts in the Western world (http://en.wikipedia.org/wiki/Voter_turnout [wikipedia.org]). Democracy at its best.

Re:Right... "election insiders"...

[Opportunist]

First of all, if you think the people managing the booth aren't trustworthy, offer to do it yourself. I honestly see no reason why you shouldn't be able to do it.

And second, yes, a meteor striking or a truck crashing the voting site would certainly crush a voting booth. But since it's as likely as me getting abducted by aliens, I'm actually willing to take that risk.

I'm honestly amazed how people keep using incredible horror scenarios as an excuse for something not working (or, in case of terrorism, being necessary), without even considering that it's so unlikely that it doesn't matter at all. There is a minuscle chance that you die in the shower from lightning or some other freak accident, does that mean you don't shower anymore now?

Re:We have the technology to do this right....

[Opportunist]

I don't have to trust ATM machines. I have a full paper trail from the moment I get my money to the moment I get my statement. I punch in my desired amount, I get money. I can count that money and verify that it is as much as I wanted. I get a recept, stating the same. And a day later I can see on my account info that the amount was deducted from my account. And I can verify every single step thereof, and should there be the slightest discrepancy, I can immediately notice that.

Now, how should I notice whether my vote has been counted correctly or whether it has been twisted around?

Re:Right... "election insiders"...

[BadAnalogyGuy]

So if there is a miniscule chance of these horror scenarios occuring, then what's to say that your (meaning "security experts") horror stories regarding voting booth irregularities aren't just another bunch of horror stories to be tossed aside as statistical anomolies? If we are going to say that deliberate tampering is a big problem with electronic voting booths, then how can we overlook the deliberate tampering with non-electronic systems?

We've been blessed with a populace who is generally honest enough that we aren't plagued by voter fraud that has any sort of significant influence on the outcome of elections. The reason for this is simple, anyone with enough ability to undertake a plan of that sort of enormity will eventually realize that the cheapest way to influence an election is physical removal of opponents.

(p.s. Hi, NSA Guys!)

Re:Right... "election insiders"...

[Goaway]

Whether you set up the process with electronic voting or you use old fashioned paper slips, someone somewhere can either cause votes to disappear or have extra votes sent to a certain candidate. It doesn't matter what system is in place.

Yes, it does matter what system is in place. Namely, the system where elections are handled by volunteers, and you never leave any part of the process in the hand of a single person, nor do you let people pick their own tasks. You just make sure that chances are that there is always one honest person in place at each step.

And you have routines in place for dealing with what happens if votes are lost in an accident, such as re-doing the election.

This isn't difficult stuff, it's been worked out centuries ago.

Re:We have the technology to do this right....

[dupup]

...or do you not trust ATM machines?

When you undertake a transaction with an ATM machine, the machine is just the conduit to the bank. You're trusting in the bank's paranoia about money to keep everything square. And the bank provides sufficient paperwork and even a dispute resolution process in case of a discrepancy. The ATM does not balance your account nor even decide if you have enough money to withdraw, the bank does. Before Diebold set about fixing^H^H^H^Hmaking voting machines, they made ATMs.

With electronic voting machines, though, there isn't the equivalent of the backing bank in which you can trust. The intelligence, if you will, is in the ATM machine alone, something the bank would never allow. It's like assuming that the pen with which you sign a contract somehow guarantees your rights in the deal. It's not the pen, it's the court system behind the pen.

re:power corruption apathy

[ed.han]

why is it so very gorrammed hard to follow the method used in india (http://techaos.blogspot.com/2004/05/indian-evm-compared-with-diebold.html [blogspot.com])? is that so very difficult?

i think it's pretty clear that american manufacturers of e-voting devices are either unforgiveably incompetent or deliberately introducing devices with obvious non-security. i'm not sure which prospect i find more troubling, but to be honest, what i find even more troubling is the fact that the media largely appears to be ignoring the matter.

ed

Re:Could learn from Venezuela

[Homology]

I read the Newsweek article but is difficult to believe what "mainstream" media like Newsweek write. Too often they are very wrong and just spout out state propaganda justifying whatever upcoming war.