9 ms·

The Security of Our Election Systems

95 points by yarapavan 10y ago

DanielBMarkham 10y ago
Timely, well-reasoned, and excellent article by Schneier. But there's a problem. Elections are managed by state governments by design. This is to prevent centralized political corruption. Having the feds "take the lead" is a little too nebulous to be practical. What could be done is a certification system for electronic voting that requires a paper audit trail and individualized printed receipts for each voter. (Which would be encrypted to prevent others from determining which votes were cast) The big leap is that electronic-only systems are never going to work. For various reasons, I don't think most folks are ready to go there. That is the major problem that must be solved. After that's fixed, the other stuff will at least be easier to address.
- thaumasiotes 10y ago
  > Timely, well-reasoned, and excellent article by Schneier. I thought it was pretty breathless. He says >> Retaliation is politically fraught and could have serious consequences, but this is an attack against our democracy. We need to confront Russian President Vladimir Putin in some way politically, economically or in cyberspace and make it clear that we will not tolerate this kind of interference by any government. (my emphasis) I don't see that the New York Times, releasing the same information, would come in for criticism, much less this level of demonizing. If other countries want to interfere in our elections by giving us accurate information, what's the problem supposed to be? That's the whole point of having elections.
  - DanielBMarkham 10y ago
    To be clear, my complaint was that it skimmed the surface. Your "breathless" was my "you missed some important parts" I'm willing to cut him slack for adding his own politics in to the article. With the election approaching, it's like the Ponn Farr here in the states. If anything, it was a bit reserved. His over-arching points are important and need attention. 1) We are basically in an ongoing cyber-war with other major international powers, and 2) we've been busy buying electronic voting systems that are terribly insecure. It's a message that needs to be transmitted, and he's one of the best folks to transmit it. I don't think there's any demonizing going on. This is the state of affairs. We must be aware of it and act accordingly.
    - thaumasiotes 10y ago
      > It's a message that needs to be transmitted, and he's one of the best folks to transmit it. > I don't think there's any demonizing going on. Ok, what is it that we're not supposed to tolerate from Russia? They spied on our documents and released them for public review. Schneier himself would be the first to tell you that they're not going to stop spying on us and we shouldn't expect them to. The phrase "attack against our democracy" can only refer to making accurate public representations to our electorate. That's not an attack against democracy.
      - jonathankoren 10y ago
        Accurate or not, foreign influence is something to worry about. Let's be honest here. Governments don't release intelligence on foreign leaders in some sort of magnanimous and innocent gesture to help inform the foreign populace. No. They do it for influence. They choose what to release and when. For the sake of argument, let's say that your had evidence that a major candidate for office in a strategically important foreign country was engaged in, or had recently engaged in some tawdry or perhaps illicit affair. What do you do with it? Realpolitik dictates that all that matters is that if it's more advantageous for the candidate to lose or not. If you want the candidate to lose, but he's winning, you release it. If not, you don't. Sure, it's transparency, but it's outside influence, for your gain, not the foreign country's.
        thaumasiotes 10y ago
        So what? You appear to be defending the idea I originally mocked, that this is a good thing when the New York Times does it and a bad thing when Pravda does it. You won't ever be able to make that argument coherently; all information releases serve the goals (or are intended to) of the person releasing the information, and those goals are never your goals. Why are Russia's US federal policy goals more nefarious than Salt Lake City's US federal policy goals? If they are, how does it matter?
        jonathankoren 10y ago
- specialist 10y ago
  VVPATs just demonstrate that the printer is working. Nothing more. Receipts remove voter privacy. The Australian Ballot, private voting / public counting, remains the gold standard for election integrity. (Forgive the repetition.)
Dowwie 10y ago
There's a strong moral argument in favor of the DNC leaks: the American people ought to know that its political process was corrupted by powerful actors within its own institutions. Schneier said, "This kind of cyberattack targets the very core of our democratic process. " In this case, though, the attack targeted actors who prevented democratic process. Were we exposed to fictitious narratives intended to advance pro-Russian agendas? Was truth revealed, without manipulation of content? It seems to be the latter. Attacking the polls would be unacceptable and deserve retaliation, but it hasn't happened yet. Attacking a whistle blower who has helped to reveal a corrupt political process isn't something I'd agree with. Schneier speculates that foreign influence will continue into the polls -- I guess we had better strengthen the election process and ensure transparency, then.
- DanielBMarkham 10y ago
  Yeah. This is another moral question along the Snowden/Manning lines. Here's the thing: breaking into somebody's house is illegal. If you do it, you're a criminal and should face some kind of legal proceeding. If you break into their house and leave some personal items along the curb, like nude photographs? I'm probably going to gawk at them as I drive by. I don't like the fact that I do it, but I am human. You are still a criminal, and as long as I don't start sharing your personal items, I'm not. I'm just a schmuck. If, however, you leave evidence of moral or criminal wrongdoing out on the curb for everybody to see? Then the community has an obligation to take action both against the robber and the person who's house was broken into. Simply because you were robbed doesn't mean that you get out of consequences for your actions once they become public. I'm tempted to view the ramifications of the leaked emails as a purely internal DNC affair. Having said that, I am reading partisan attacks that say there are illegal activities in there. If so? Well, somebody needs to face some kind of legal proceeding. And somebody else is still a robber. Whatever our views, it's important to come up with standards that apply no matter who's "side" you're on.
  - retox 10y ago
    If you break into someone's house and find evidence of a murder or sexual assault, should you reveal those details? I would say yes, the crime of breaking and entering (and theft of the evidence) is still a crime, but a smaller one in the grand scheme of things. I would say both parties should be charged. It's not so clear cut though; if I break into your house and find a few joints should that be treated the same way? I suppose it boils down to where on the continuum of severity you place corruption of the democratic process. Encouraging someone to break into private property looking for evidence would still be a crime, IMO.
revelation 10y ago
I think you would be quite silly to just outright accept intelligence agency declarations of "it was Russia". As history shows, not only are these people frequently ignorant to technical realities, but political reasons at every single layer of these organizations obscure and pervade the truth.
- jonathankoren 10y ago
  Of course it's not just intelligence agencies saying this. There's plenty of independent investigations [0] and they are pointing the same direction. There's the metadata on the leaked files indicating that at least the metadata was modified with a cyrillic computer. There's reports from two separate security firms implicating the same two Russian based actors. There's the fact that "Guccifier 2.0" had no online presence until after the the Crowdstrike report implicating Russian intelligence services. There's the fact that "Guccifier 2.0" claims to Romanian, but can't type fluent Romanian (I've heard this independently from a Romanian I know), and drops smilies typical in Russian forums, but not Romanian. None of this is fire, but there's plenty of smoke. [0] https://www.wired.com/2016/07/heres-know-russia-dnc-hack/ https://www.wired.com/2016/07/heres-know-russia-dnc-hack/
  - chvid 10y ago
    I think this a good article explaining why there is not enough evidence in the public linking the DNC hack to Russian secret service: https://medium.com/@jeffreycarr/can-facts-slow-the-dnc-breach-runaway-train-lets-try-14040ac68a55#.r5o053fbs https://medium.com/@jeffreycarr/can-facts-slow-the-dnc-breac... The IP-address (176.31.112.10) that links the DNC hack to the Bundestag hack is a machine in France (appearantly) controlled by a Pakistani hosting company. This article says the machine was closed because of abuse over a year ago. The material in the DNC hack is just one month old: https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/ https://netzpolitik.org/2015/digital-attack-on-german-parlia...
- leviself 10y ago
  I agree with this very much. The WMDs are an example of intelligence errors as casus belli. It's important to keep in mind the political context as well, with Cold War II emerging from the last NATO summit http://www.salon.com/2016/07/12/the_west_escalates_with_russia_make_no_mistake_a_second_cold_war_is_now_official_nato_policy/ http://www.salon.com/2016/07/12/the_west_escalates_with_russ...
chvid 10y ago
Why is this not flag killed like all the other (politically biased) articles on the DNC hack?
- jacquesm 10y ago
  Because it is Bruce Schneier who tends to have a technical rather than an outright political angle.
  - chvid 10y ago
    Well - not here.
- mtbcoder 10y ago
  Where is the political bias on Schneier's part here? Perhaps you simply just disagree with his position?
  - rpgmaker 10y ago
    Are we supposed to ignore that the media is 100% unified in stopping Trump from becoming president? I'm against Trump (who I believe to be a fascist and psychologically unstable) but I'm not going to pretend that it is honest to say that Trump literally asked Russia to hack Hillary's emails. I watched the entire press conference btw. If the election pitted Sanders against Bush the media would not hesitate to be this dishonest when attacking Sanders, it just so happens that by far the biggest outsider this year happens to be the biggest asshole too.
youngButEager 10y ago
This is a WHISTLE BLOWER situation. First identify who is trying to persecute the whistleblower. There, you've found the party that has committed untoward acts who is now trying to SILENCE THE WHISTLEBLOWER/CHANGE THE SUBJECT. I was a Bernie supporter. A LOT of people were/are. Not at all happy with the DNC. Having a whistleblower confirm our idea that the DNC was trying to hurt Bernie -- -- now I know how a parent feels when they finally solve the tragedy of a missing family member. REALLY CATHARTIC. And really depressing.
- eternalban 10y ago
  Possibly related [1] Seth Conrad Rich, DNC's Data Director [2]. And the late Mr. Rich was not Russian. [1]: http://www.nbcwashington.com/news/local/Man-Shot-Killed-in-Northwest-DC-386316391.html http://www.nbcwashington.com/news/local/Man-Shot-Killed-in-N... [2]: https://www.reddit.com/r/The_Donald/comments/4v34fk/this_is_seth_conrad_rich_the_dncs_27_year_old/ https://www.reddit.com/r/The_Donald/comments/4v34fk/this_is_...
troiter 10y ago
What influence? It's called exposing lies and corruption within the DNC. If anything, I praise Putin for it. Let's not lose perspective of reality thinking about tech security.
- rpgmaker 10y ago
  There's no reason why you can't do both: worry that another country could influence the electoral process via hacking and see the value in having this information exposed. The media and the Democrats only want people to focus on the former.
eternalban 10y ago
The OP is a shameful blot on Bruce Schneier's record [imo]. For "evidence" we are directed to The New York Times -- a political organization. This sort of evidence certainly suffices for the non-technical set but that HN is accepting this without subjecting the assertion to the rigor that we apply to topics that are not conflated with emotional and psychological triggers is disconcerting. I would like to pose the question here to my fellow geeks: Do you really think Russians are so incompetent that they would not avail themselves of e.g. Tor to cover their tracks? [edit: take courage & answer the question instead of downvoting.]
- toth 10y ago
  Well, even if it wasn't Russia that hacked the DNC (and now the Clinton campaign) it is still the case that someone did, and that's still reason enough to take the measures Bruce Schneier's advocates.
  - eternalban 10y ago
    Please answer the question. Leaks may also be from disgruntled staffers whose idealism shattered on encountering the hard realities of American political system.
    - toth 10y ago
      The question about about TOR? Sure, they could have used TOR, but that doesn't make them automatically untraceable. I am definitely not an expert on this kind of forensics, but in past cases the "smoking gun" pointed to by experts tends to be some sort of metadata (i.e., text files encoded using cyrillic character set), not an ip. Also, there's been some claims that NSA and other agencies are running TOR exit nodes. Not sure if there's anything to it, but the point is state level actors have resources that nobody else does. Besides, I am not sure what is your point. "Russian hackers would have covered their tracks, therefore it must not have been Russian hackers"?
- chvid 10y ago
  Of course you cover your trails if you do a hack. As a minimum you get a server to work from (and have your backdoors point back to) that does not directly link back to you. Typically another hacked machine - not necessarily hacked by you - you can buy them cheaply on dark net market places. DNC has an obvious interest in spinning this and they seem to have done this very successfully. What bothers me is that no-one seems to be able to separate politics from technical assessment. Even people with deep technical insights such as mr. Schneier. I think the chance of Trump's presidency scares a lot of people and that scare clouds judgement. I don't have any say in the american election but I think that people overestimate what the presidential post means and underestimate the check-and-balances of the rest of democratic system (congress, legal system, existing GOP apparatus, press and so on).
lr 10y ago
For once in my life, I am glad we have the Electoral College.
fncndhdhc 10y ago
And yet a Democratic Party IT administrator was shot and killed in DC two weeks ago. The media is trying to attribute it to a mugging, but no items were found taken off of his body. http://www.nbcwashington.com/news/local/Man-Shot-Killed-in-Northwest-DC-386316391.html http://www.nbcwashington.com/news/local/Man-Shot-Killed-in-N...
- e40 10y ago
  I don't own a tinfoil hat, but... man, that incites all sorts of ideas.
brudgers 10y ago
A political party's computers are not part of the "critical election infrastructure" unless the party [or parties] has become the state. Exceptionalism is political crack. States seek to influence elections in other states. Always have, always will. Having a candidate aligned explicitly aligned with the interests of a foreign state is quite common in Americas. As is having a foreign state explicitly align themselves with a candidate.
- rpgmaker 10y ago
  Not to mention that the US has a particularly awful history of subverting other countries' elections.
specialist 10y ago
"This means voting machines with voter-verified paper audit trails..." I've attended "audits" of VVPATs. They merely verify that the printer still worked as expected. Nothing more. This turf has been hashed and rehashed. The Election Verification Network (academics, administrators, activists) have covered this many times. Auditing electronically mediated elections is impractical and adds little more certainty in the results. No, crypto voting doesn't help.
buddapalm 10y ago
I'm surprised most all comments latch onto the political nature of the DNC hack vs. the point Bruce is making: the act demonstrates overt attempts of a foreign government to mess with our election system, and the ___voting portion of the system ___ is what remains vulnerable despite many years of warnings from industry experts. We ignore this at our peril.
cwisecarver 10y ago
Schneier is weaving two problems into one. Yes, our election systems could be compromised by foreign (or domestic) attackers. This is something we should all fight against. I don't think any voter would agree that our votes shouldn't count. Computer security is hard and the companies running and making voting machines have time and again been proven incompetent. We should work to fix that. The separate issue is that in our two party system it's come out that one party was proven to have worked to influence an election for one of the candidates of that party. Sure, Bernie was an outsider. Sure, Hillary was practically anointed from the start. Sure, it was fairly obvious that the DNC was favoring HRC and working harder for her than for Sanders. But there's actual proof now. If it came from a lone-wolf domestic hacker, or from Snowden, or from Putins own laptop I don't think it matters. It matters that it happened and the people need to know it did. No media is talking about that at all. Not even NPR. I think any organization that's working to get someone elected by the people, in order to work for the people should want it's emails to be public. Why wouldn't it want that? Why shouldn't the media have the option to investigate and shine a bright spotlight on everything regarding our elections? They just had this opportunity and they're wasting it to instead talk about Russia influencing our elections. Since we're internally influencing our own elections maybe we should worry about that first.

95 points by yarapavan 10y ago

Timely, well-reasoned, and excellent article by Schneier. But there's a problem. Elections are managed by state governments by design. This is to prevent centralized political corruption. Having the feds "take the lead" is a little too nebulous to be practical. What could be done is a certification system for electronic voting that requires a paper audit trail and individualized printed receipts for each voter. (Which would be encrypted to prevent others from determining which votes were cast) The big leap is that electronic-only systems are never going to work. For various reasons, I don't think most folks are ready to go there. That is the major problem that must be solved. After that's fixed, the other stuff will at least be easier to address.

thaumasiotes 10y ago
> Timely, well-reasoned, and excellent article by Schneier. I thought it was pretty breathless. He says >> Retaliation is politically fraught and could have serious consequences, but this is an attack against our democracy. We need to confront Russian President Vladimir Putin in some way politically, economically or in cyberspace and make it clear that we will not tolerate this kind of interference by any government. (my emphasis) I don't see that the New York Times, releasing the same information, would come in for criticism, much less this level of demonizing. If other countries want to interfere in our elections by giving us accurate information, what's the problem supposed to be? That's the whole point of having elections.
- DanielBMarkham 10y ago
  To be clear, my complaint was that it skimmed the surface. Your "breathless" was my "you missed some important parts" I'm willing to cut him slack for adding his own politics in to the article. With the election approaching, it's like the Ponn Farr here in the states. If anything, it was a bit reserved. His over-arching points are important and need attention. 1) We are basically in an ongoing cyber-war with other major international powers, and 2) we've been busy buying electronic voting systems that are terribly insecure. It's a message that needs to be transmitted, and he's one of the best folks to transmit it. I don't think there's any demonizing going on. This is the state of affairs. We must be aware of it and act accordingly.
  - thaumasiotes 10y ago
    > It's a message that needs to be transmitted, and he's one of the best folks to transmit it. > I don't think there's any demonizing going on. Ok, what is it that we're not supposed to tolerate from Russia? They spied on our documents and released them for public review. Schneier himself would be the first to tell you that they're not going to stop spying on us and we shouldn't expect them to. The phrase "attack against our democracy" can only refer to making accurate public representations to our electorate. That's not an attack against democracy.
    - jonathankoren 10y ago
      Accurate or not, foreign influence is something to worry about. Let's be honest here. Governments don't release intelligence on foreign leaders in some sort of magnanimous and innocent gesture to help inform the foreign populace. No. They do it for influence. They choose what to release and when. For the sake of argument, let's say that your had evidence that a major candidate for office in a strategically important foreign country was engaged in, or had recently engaged in some tawdry or perhaps illicit affair. What do you do with it? Realpolitik dictates that all that matters is that if it's more advantageous for the candidate to lose or not. If you want the candidate to lose, but he's winning, you release it. If not, you don't. Sure, it's transparency, but it's outside influence, for your gain, not the foreign country's.
      - thaumasiotes 10y ago
        So what? You appear to be defending the idea I originally mocked, that this is a good thing when the New York Times does it and a bad thing when Pravda does it. You won't ever be able to make that argument coherently; all information releases serve the goals (or are intended to) of the person releasing the information, and those goals are never your goals. Why are Russia's US federal policy goals more nefarious than Salt Lake City's US federal policy goals? If they are, how does it matter?
        jonathankoren 10y ago
specialist 10y ago
VVPATs just demonstrate that the printer is working. Nothing more. Receipts remove voter privacy. The Australian Ballot, private voting / public counting, remains the gold standard for election integrity. (Forgive the repetition.)

Dowwie 10y ago

There's a strong moral argument in favor of the DNC leaks: the American people ought to know that its political process was corrupted by powerful actors within its own institutions. Schneier said, "This kind of cyberattack targets the very core of our democratic process. " In this case, though, the attack targeted actors who prevented democratic process. Were we exposed to fictitious narratives intended to advance pro-Russian agendas? Was truth revealed, without manipulation of content? It seems to be the latter. Attacking the polls would be unacceptable and deserve retaliation, but it hasn't happened yet. Attacking a whistle blower who has helped to reveal a corrupt political process isn't something I'd agree with. Schneier speculates that foreign influence will continue into the polls -- I guess we had better strengthen the election process and ensure transparency, then.

DanielBMarkham 10y ago
Yeah. This is another moral question along the Snowden/Manning lines. Here's the thing: breaking into somebody's house is illegal. If you do it, you're a criminal and should face some kind of legal proceeding. If you break into their house and leave some personal items along the curb, like nude photographs? I'm probably going to gawk at them as I drive by. I don't like the fact that I do it, but I am human. You are still a criminal, and as long as I don't start sharing your personal items, I'm not. I'm just a schmuck. If, however, you leave evidence of moral or criminal wrongdoing out on the curb for everybody to see? Then the community has an obligation to take action both against the robber and the person who's house was broken into. Simply because you were robbed doesn't mean that you get out of consequences for your actions once they become public. I'm tempted to view the ramifications of the leaked emails as a purely internal DNC affair. Having said that, I am reading partisan attacks that say there are illegal activities in there. If so? Well, somebody needs to face some kind of legal proceeding. And somebody else is still a robber. Whatever our views, it's important to come up with standards that apply no matter who's "side" you're on.
- retox 10y ago
  If you break into someone's house and find evidence of a murder or sexual assault, should you reveal those details? I would say yes, the crime of breaking and entering (and theft of the evidence) is still a crime, but a smaller one in the grand scheme of things. I would say both parties should be charged. It's not so clear cut though; if I break into your house and find a few joints should that be treated the same way? I suppose it boils down to where on the continuum of severity you place corruption of the democratic process. Encouraging someone to break into private property looking for evidence would still be a crime, IMO.

revelation 10y ago

I think you would be quite silly to just outright accept intelligence agency declarations of "it was Russia". As history shows, not only are these people frequently ignorant to technical realities, but political reasons at every single layer of these organizations obscure and pervade the truth.

jonathankoren 10y ago
Of course it's not just intelligence agencies saying this. There's plenty of independent investigations [0] and they are pointing the same direction. There's the metadata on the leaked files indicating that at least the metadata was modified with a cyrillic computer. There's reports from two separate security firms implicating the same two Russian based actors. There's the fact that "Guccifier 2.0" had no online presence until after the the Crowdstrike report implicating Russian intelligence services. There's the fact that "Guccifier 2.0" claims to Romanian, but can't type fluent Romanian (I've heard this independently from a Romanian I know), and drops smilies typical in Russian forums, but not Romanian. None of this is fire, but there's plenty of smoke. [0] https://www.wired.com/2016/07/heres-know-russia-dnc-hack/ https://www.wired.com/2016/07/heres-know-russia-dnc-hack/
- chvid 10y ago
  I think this a good article explaining why there is not enough evidence in the public linking the DNC hack to Russian secret service: https://medium.com/@jeffreycarr/can-facts-slow-the-dnc-breach-runaway-train-lets-try-14040ac68a55#.r5o053fbs https://medium.com/@jeffreycarr/can-facts-slow-the-dnc-breac... The IP-address (176.31.112.10) that links the DNC hack to the Bundestag hack is a machine in France (appearantly) controlled by a Pakistani hosting company. This article says the machine was closed because of abuse over a year ago. The material in the DNC hack is just one month old: https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/ https://netzpolitik.org/2015/digital-attack-on-german-parlia...
leviself 10y ago
I agree with this very much. The WMDs are an example of intelligence errors as casus belli. It's important to keep in mind the political context as well, with Cold War II emerging from the last NATO summit http://www.salon.com/2016/07/12/the_west_escalates_with_russia_make_no_mistake_a_second_cold_war_is_now_official_nato_policy/ http://www.salon.com/2016/07/12/the_west_escalates_with_russ...

chvid 10y ago

Why is this not flag killed like all the other (politically biased) articles on the DNC hack?

jacquesm 10y ago
Because it is Bruce Schneier who tends to have a technical rather than an outright political angle.
- chvid 10y ago
  Well - not here.
mtbcoder 10y ago
Where is the political bias on Schneier's part here? Perhaps you simply just disagree with his position?
- rpgmaker 10y ago
  Are we supposed to ignore that the media is 100% unified in stopping Trump from becoming president? I'm against Trump (who I believe to be a fascist and psychologically unstable) but I'm not going to pretend that it is honest to say that Trump literally asked Russia to hack Hillary's emails. I watched the entire press conference btw. If the election pitted Sanders against Bush the media would not hesitate to be this dishonest when attacking Sanders, it just so happens that by far the biggest outsider this year happens to be the biggest asshole too.

youngButEager 10y ago

This is a WHISTLE BLOWER situation. First identify who is trying to persecute the whistleblower. There, you've found the party that has committed untoward acts who is now trying to SILENCE THE WHISTLEBLOWER/CHANGE THE SUBJECT. I was a Bernie supporter. A LOT of people were/are. Not at all happy with the DNC. Having a whistleblower confirm our idea that the DNC was trying to hurt Bernie -- -- now I know how a parent feels when they finally solve the tragedy of a missing family member. REALLY CATHARTIC. And really depressing.

eternalban 10y ago
Possibly related [1] Seth Conrad Rich, DNC's Data Director [2]. And the late Mr. Rich was not Russian. [1]: http://www.nbcwashington.com/news/local/Man-Shot-Killed-in-Northwest-DC-386316391.html http://www.nbcwashington.com/news/local/Man-Shot-Killed-in-N... [2]: https://www.reddit.com/r/The_Donald/comments/4v34fk/this_is_seth_conrad_rich_the_dncs_27_year_old/ https://www.reddit.com/r/The_Donald/comments/4v34fk/this_is_...

troiter 10y ago

What influence? It's called exposing lies and corruption within the DNC. If anything, I praise Putin for it. Let's not lose perspective of reality thinking about tech security.

rpgmaker 10y ago
There's no reason why you can't do both: worry that another country could influence the electoral process via hacking and see the value in having this information exposed. The media and the Democrats only want people to focus on the former.

eternalban 10y ago

The OP is a shameful blot on Bruce Schneier's record [imo]. For "evidence" we are directed to The New York Times -- a political organization. This sort of evidence certainly suffices for the non-technical set but that HN is accepting this without subjecting the assertion to the rigor that we apply to topics that are not conflated with emotional and psychological triggers is disconcerting. I would like to pose the question here to my fellow geeks: Do you really think Russians are so incompetent that they would not avail themselves of e.g. Tor to cover their tracks? [edit: take courage & answer the question instead of downvoting.]

toth 10y ago
Well, even if it wasn't Russia that hacked the DNC (and now the Clinton campaign) it is still the case that someone did, and that's still reason enough to take the measures Bruce Schneier's advocates.
- eternalban 10y ago
  Please answer the question. Leaks may also be from disgruntled staffers whose idealism shattered on encountering the hard realities of American political system.
  - toth 10y ago
    The question about about TOR? Sure, they could have used TOR, but that doesn't make them automatically untraceable. I am definitely not an expert on this kind of forensics, but in past cases the "smoking gun" pointed to by experts tends to be some sort of metadata (i.e., text files encoded using cyrillic character set), not an ip. Also, there's been some claims that NSA and other agencies are running TOR exit nodes. Not sure if there's anything to it, but the point is state level actors have resources that nobody else does. Besides, I am not sure what is your point. "Russian hackers would have covered their tracks, therefore it must not have been Russian hackers"?
chvid 10y ago
Of course you cover your trails if you do a hack. As a minimum you get a server to work from (and have your backdoors point back to) that does not directly link back to you. Typically another hacked machine - not necessarily hacked by you - you can buy them cheaply on dark net market places. DNC has an obvious interest in spinning this and they seem to have done this very successfully. What bothers me is that no-one seems to be able to separate politics from technical assessment. Even people with deep technical insights such as mr. Schneier. I think the chance of Trump's presidency scares a lot of people and that scare clouds judgement. I don't have any say in the american election but I think that people overestimate what the presidential post means and underestimate the check-and-balances of the rest of democratic system (congress, legal system, existing GOP apparatus, press and so on).

lr 10y ago

For once in my life, I am glad we have the Electoral College.

fncndhdhc 10y ago

And yet a Democratic Party IT administrator was shot and killed in DC two weeks ago. The media is trying to attribute it to a mugging, but no items were found taken off of his body. http://www.nbcwashington.com/news/local/Man-Shot-Killed-in-Northwest-DC-386316391.html http://www.nbcwashington.com/news/local/Man-Shot-Killed-in-N...

e40 10y ago
I don't own a tinfoil hat, but... man, that incites all sorts of ideas.

brudgers 10y ago

A political party's computers are not part of the "critical election infrastructure" unless the party [or parties] has become the state. Exceptionalism is political crack. States seek to influence elections in other states. Always have, always will. Having a candidate aligned explicitly aligned with the interests of a foreign state is quite common in Americas. As is having a foreign state explicitly align themselves with a candidate.

rpgmaker 10y ago
Not to mention that the US has a particularly awful history of subverting other countries' elections.

specialist 10y ago

"This means voting machines with voter-verified paper audit trails..." I've attended "audits" of VVPATs. They merely verify that the printer still worked as expected. Nothing more. This turf has been hashed and rehashed. The Election Verification Network (academics, administrators, activists) have covered this many times. Auditing electronically mediated elections is impractical and adds little more certainty in the results. No, crypto voting doesn't help.

buddapalm 10y ago

I'm surprised most all comments latch onto the political nature of the DNC hack vs. the point Bruce is making: the act demonstrates overt attempts of a foreign government to mess with our election system, and the ___voting portion of the system ___ is what remains vulnerable despite many years of warnings from industry experts. We ignore this at our peril.

cwisecarver 10y ago

Schneier is weaving two problems into one. Yes, our election systems could be compromised by foreign (or domestic) attackers. This is something we should all fight against. I don't think any voter would agree that our votes shouldn't count. Computer security is hard and the companies running and making voting machines have time and again been proven incompetent. We should work to fix that. The separate issue is that in our two party system it's come out that one party was proven to have worked to influence an election for one of the candidates of that party. Sure, Bernie was an outsider. Sure, Hillary was practically anointed from the start. Sure, it was fairly obvious that the DNC was favoring HRC and working harder for her than for Sanders. But there's actual proof now. If it came from a lone-wolf domestic hacker, or from Snowden, or from Putins own laptop I don't think it matters. It matters that it happened and the people need to know it did. No media is talking about that at all. Not even NPR. I think any organization that's working to get someone elected by the people, in order to work for the people should want it's emails to be public. Why wouldn't it want that? Why shouldn't the media have the option to investigate and shine a bright spotlight on everything regarding our elections? They just had this opportunity and they're wasting it to instead talk about Russia influencing our elections. Since we're internally influencing our own elections maybe we should worry about that first.