10 ms·

American Elections Will Be Hacked

103 points by hourislate 10y ago

youdontknowtho 10y ago
I did get a very sinky feeling when they scanned my vote and I didn't get a paper copy. Lowest bidder development doesn't seem like it should be the way we engineer everything. Don't Blame Me, I Voted for Kodos...
- undersuit 10y ago
  The FEC should be in charge of the entire voting process. What is worse: a custom designed U.S. government voting machine for all federal elections made by the FEC, or tens of different companies, selling their closed source machines to state governments for profit. I see issues in both systems, and in fact I'll take the current set up because my proposal requires me trusting the government more than I do now.
  - eridius 10y ago
    Part of the problem is voting is run at the local level. I'm not sure the federal government even has the authority to tell states and counties that they must use a particular voting machine.
    - undersuit 10y ago
      So you make it so the states and counties and cities and voting districts that want to use a different process for their elections don't have to use the federal machines for anything but federal votes, but you still allow the federal machines to be used for down-ballot processes.
      - eridius 10y ago
        You're still assuming that the federal government has the authority to dictate the voting process used for federal elections. IANAL and I don't actually know what the legality here is, but my assumption is the federal government doesn't have that authority, given that if it did, it probably would have exercised it by now.
      - gohrt 10y ago
        Even simpler, just ask the President to decide who won each Federal race.
  - jerf 10y ago
    "What is worse: a custom designed U.S. government voting machine for all federal elections made by the FEC, or tens of different companies, selling their closed source machines to state governments for profit." Um, I see what you're getting at, but the government would definitely create a monoculture and may create a single point of failure. The choice is less obvious than you may think is based on your phrasing. To which I'd say the solution is less about getting the FEC to do it, and more about the process. This needs to be an open and very public affair. It doesn't help us to have the FEC do it if they do it behind closed doors and create a closed-source computer-based system that requires all voting machines to be hooked over insecure networks to a central closed-source insecure server or something.
    - undersuit 10y ago
      >It doesn't help us to have the FEC do it if they do it behind closed doors and create a closed-source computer-based system that requires all voting machines to be hooked over insecure networks to a central closed-source insecure server or something. I did say the FEC isn't a good option now and I didn't really want to enumerate all my reasons, but you are covering a good number of them.
  - gohrt 10y ago
    The incumbent government should NOT control the vote-counting machines.
    - undersuit 10y ago
      The incumbent government is somehow more of a threat of hacking the elections than the private corporations now? I can understand your opposition to the government as is, it's a closed off and opaque system with little interest in citizen affairs. How about you come up with some ways that we can make the government better and suggest those instead of just stopping the conversation with a big flat "no"?
- DennisP 10y ago
  You don't get a copy so nobody can bribe or coerce you.
  - grzm 10y ago
    There are ways of providing receipts that prove you voted and can be used to prove your vote was included in the final tally without revealing (by choice or otherwise) who you voted for. See Punchscan[0] or Scantegrity[1] for examples. Pretty interesting stuff from a comp sci point of view. [0]: https://en.wikipedia.org/wiki/Punchscan https://en.wikipedia.org/wiki/Punchscan [1]: https://en.wikipedia.org/wiki/Scantegrity https://en.wikipedia.org/wiki/Scantegrity
    - DennisP 10y ago
      Also see the Rivest and Smith secure voting protocols: http://rangevoting.org/RivSmiPRshort.html http://rangevoting.org/RivSmiPRshort.html
      - grzm 10y ago
        Thanks for the link!
jedberg 10y ago
Had a funny conversation on Facebook on Tuesday related to this. It basically went like this: "It'll take a while to find out how the election went in California because we don't use computers" "You're the biggest state in the country and you don't use freakin computers?!" <-Texas resident "You work in IT, you of all people should know why we don't use computers"
- d0lph 10y ago
  Texas is bigger than California too (by area at least).
  - undersuit 10y ago
    Texas is bigger than California by area, but Alaska is bigger than either by area. So a well informed reader would look at the statement: "You're the biggest state in the country" and make the correct assumption that the speaker was talking about population and not area.
    - stcredzero 10y ago
      In Alaska, people joked about dividing the state in two, just to make Texas the 3rd largest state in the US.
      - undersuit 10y ago
        As a Montana I would object to the demotion to 5th place too.
        UhUhUhUh 10y ago
        As a Delaware I couldn't care less.
        labster 10y ago
        How are the Lenape people doing these days?
triplesec 10y ago
And the unacknowledged problem is, we don't really know if it's already happened. To quote from the article: 'Electronic voting machines can be hacked, and those machines that do not include a paper ballot that can verify each voter's choice can be hacked undetectably. Voting rolls are also vulnerable; they are all computerized databases whose entries can be deleted or changed.' It doesn't need visible chaos or detection on voting day.
- paulmd 10y ago
  Also, even the machines that generate paper trails are never actually recounted unless there's a problem. If you don't test your restore procedure then the value of a backup is effectively zero. A lot of the paper trails aren't necessarily even in machine-readable form. We are drastically unprepared for a large-scale recount (anything more than a county is going to take weeks+). Also, the backup is effectively the checksum here too - unless you actually look for an error, how would you ever know if one occurred? We need x% of counties to be randomly recounted from the paper trail to validate the tabulations.
- rdiddly 10y ago
  My thoughts exactly. A successful hack job or covert operation is one that you don't hear about. Non-detection is one of the goals and one of the criteria for defining success. So the ones that are found out, should be assumed to be the low end of the competency/success scale. Edit: Sort of a form of survivorship bias going on. The ones that "survive" (i.e. get found out) can't be used to draw conclusions about the others.
- specialist 10y ago
  "...we don't really know if it's already happened." What measure of proof do you require? Voter Action proved in a court of law that Kerry won New Mexico. No votes cast on spanish language were recorded. Hacking? Bad code? Bad set up? Either way, what's the difference? Regardless of intent, outcome is the same. Voter Action chose NM because its electoral votes wouldn't the outcome (less controversy) and they had ample evidence. This is not a unique story. In fact, its depressingly common.
Retric 10y ago
American Election(s) Have been hacked. This may or may not have changed the outcomes, but looking at various machines that where used at various times the odds that nobody hacked any of them, ever, is very low.
- deleted 10y ago
  [deleted]
coldcode 10y ago
Hacking individual voting machines is possible but not on scale one at a time. Far more likely is hacking at the place where the votes go later, in the end they are just a few numbers. As Stalin said, it doesn't matter who votes, it matters who counts the votes.
- DennisP 10y ago
  Unless you deploy a virus that can spread to thousands of voting machines, as researchers demonstrated a few years ago: https://www.technologyreview.com/s/406525/how-to-hack-an-election-in-one-minute/ https://www.technologyreview.com/s/406525/how-to-hack-an-ele...
- Retric 10y ago
  People are spending 10's of $ per vote in some areas, flipping a few per machine would easily be worth it. Just the presidential race can spend up to 40$ per vote, add in senators and local officials and votes are worth quite a bit. Remember some poling places have 10,000+ votes. If you change 500 votes that's both hard to detect and frankly likely to tip many local elections. Now, different people doing this to a few different locations and well it adds up.
  - coldcode 10y ago
    However both parties are equally able to do the same thing. So would it make a material difference?
    - Retric 10y ago
      Not all voting systems are easy to compromise or standardized across states. Simply crashing the machines to create long lines is some areas is enough to tip a close election. Sure this might not be a denial of service attack but map long lines with party preferences and well... http://www.nbcnewyork.com/news/local/Polling-Problems-New-York-New-Jersey-Connecticut-Vote-Report-Issue-400380091.html http://www.nbcnewyork.com/news/local/Polling-Problems-New-Yo...
imgabe 10y ago
If it's not (and I think it isn't) the code used in the voting machines needs to be open source and publicly available in a government repo. That would be a start. There's still the issue of ensuring that that code is the code that is running on the actual machines, and that the compiler used to compile that code hasn't been compromised, and that the source for the compiler is available and on and on.... I'm not a security expert, but what would be a good way to publicly verify all this?
- marcosdumay 10y ago
  You still didn't got on the level of tampered hardware. There's just no good wat to verify this.
- dcherman 10y ago
  I'm not a security expert either, but my very first thought was that if we've successfully maintained a public ledger of financial transactions ( blockchain via bitcoin ), then that technology seems useful for large scale voting which is nothing more than another series of transactions. Maybe someone more educated about blockchain could illustrate some of the pros/cons about using it in this manner?
  - eridius 10y ago
    An immediate huge problem is the fact that the blockchain works because the signer can prove their ability to sign, but voting is supposed to be anonymous. If every vote was a transaction then every vote would be public knowledge, but anonymity of voting is one of the cornerstones of our voting process.
    - paulmd 10y ago
      Probably solvable. Here's one solution that would only require registration of write-ins (which many states already do). Issue everyone a secret key (the digital equivalent of a ballot). They publish hash($key, $name). There are only N values for $name so that can be solved in O(N) time, but without knowledge of $key you couldn't determine whom someone voted for. For the sake of the user you could even pre-compute the hash values so it literally becomes "publish this string to vote for X". You could authenticate the user by having them give their pubkey at their secretary of state. The pubkey signs the hash like a standard blockchain transaction.
pmoriarty 10y ago
The possibility of voting fraud will make a blip in the news and then be forgotten, just as it was in the much more contentious election of Bush v Gore.
- greeneggs 10y ago
  "Voting fraud"? That wasn't an issue in 2000 (or ever in the US, as far as I know). There were famously problems with Florida's ballot. I don't know what Florida did, if anything, but there was federal legislation in 2002. This is how everyone got the money to buy electronic voting machines. https://en.wikipedia.org/wiki/Help_America_Vote_Act https://en.wikipedia.org/wiki/Help_America_Vote_Act
  - pmoriarty 10y ago
    You are correct. I meant Bush v Kerry, 2004. That's when the whole electronic voting machine debacle happened.
jandrese 10y ago
I wonder what the odds are that the voting machines are hacked vs. abuse of absentee ballots? It seems to me that any solution that requires a person to physically appear at scattered polling places and tamper with hundreds of machines in a single day is probably not a huge problem. If you can mass mail fake ballots to the registrar then that could be more of a problem. I would presume that most absentee ballot systems have some sort of check that they're not receiving a ballot back from someone who did not request one, but I also know that this sort of thing could fall through the cracks if there aren't proper safeguards in place.
- deleted 10y ago
  [deleted]
- scottcha 10y ago
  At least in Washington there is a 1:1 mapping between your registered address and the envelope send your ballot in (I don't believe its to the ballot itself but I could be wrong). Once you send in your ballot you can verify on the county voting site that your ballot has been counted. I'm guessing this is the main way they check that fraudulent ballots aren't being submitted as you would then have > 1:1 mapping in many cases.
  - jandrese 10y ago
    That makes sense, but has anyone verified that the check is being performed?
    - r00fus 10y ago
      And that's the problem with US elections - I would love to see a public showing (instead of the incessant back and forth) after the election of a good old review/audit of the election process. Even if it's only a few who participate/watch, knowing the process is audited would make me a lot more invested in it.
    - specialist 10y ago
      Yes. Ballot tracking enables the ballot chasing (GOTV) that every one hates.
CyberSkull5702 10y ago
hi
CyberSkull5702 10y ago
hi
blizkreeg 10y ago
Ok, so it's 2016 and I'm not naive in suggesting this but does anybody think that we should figure out how people can vote from their homes/phones? DoS attacks are a massive threat to this but wouldn't voting percentages go way up if we could make this happen?
- joveian 10y ago
  The Oregon/Washington/Colorado vote by mail system is very convenient. We get paper ballots by mail which can be returned by mail or dropped in official boxes and the results are scanned. This leaves a paper trail that is possible to recount if necessary. Voters in a little over half of US states can vote at home[0], but they need to explicitly request ballots. The ability to vote at home does seem to increase voting percentages. It is hard to compare before/after since all states that have so far switched entirely to vote by mail had a popular option for a while before, but all three states seem to do fairly well in national rankings, maybe particularly so in non-presidential election years. I found a site that collects such data [1] (relative to voting eligible population not registered voters) and in 2014 Colorado was 4th highest, Oregon #5, and Washington #21. For this election it looks like Colorado was #6, Oregon #13, and Wasington #16. So voting percentages might not go way up if everyone did this, but seem likely to go up some at least. [0] https://en.wikipedia.org/wiki/Absentee_ballot#United_States https://en.wikipedia.org/wiki/Absentee_ballot#United_States [1] http://www.electproject.org/home/voter-turnout/voter-turnout-data http://www.electproject.org/home/voter-turnout/voter-turnout...
deleted 10y ago
[deleted]
MichaelBurge 10y ago
I wouldn't mind seeing electronic machines that print paper ballots. They could even record the count into a database somewhere for ease of use. And it's important for the voter to see the paper ballot that gets printed, before he drops it in. That way, we can all find out who won in real-time, while the counties recount the paper ballots by hand over the next week to confirm. When you count the ballots, record a video and allow independent citizen auditors to view the video.
1stPostLastPost 10y ago
https://www.wired.com/wp-content/uploads/2015/08/WINVote-final.pdf https://www.wired.com/wp-content/uploads/2015/08/WINVote-fin... Windows XP Embedded not patched since 2004. WEP network password 'abcde' RDP open on voting machine. User: 'Administrator' password: 'admin' MS Access database, password 'shoup' (company that made the machine) The machine I used was a Hart eSlate with comic sans fonts, microsoft clipart graphics, and exposed ports. What happens when I plug in a rubber ducky that presses shift 5 times? If you Google the secretary of state election results sites (where everyone scrapes the information from), you see html tables straight out of the 90s, and some of the servers run Windows Server 2003. https://www.google.com/search?q=secretary+of+state+election+results&oq=secretary+of+state+election+results&aqs=chrome..69i57.6255j0j7&sourceid=chrome&ie=UTF-8 https://www.google.com/search?q=secretary+of+state+election+... Were some hacked? You tell me.
- linkregister 10y ago
  The first link is broken.
  - 1stPostLastPost 10y ago
    Huh, they took it down recently. Here's a mirror: https://www.wired.com/wp-content/uploads/2015/08/WINVote-final.pdf https://www.wired.com/wp-content/uploads/2015/08/WINVote-fin... and another just in case: https://www.documentcloud.org/documents/2167420-winvote-final.html https://www.documentcloud.org/documents/2167420-winvote-fina...
tmcbride23 10y ago
After the 2000 election the yongest bush's company created the new voting systems in Florida and ohio. Check who sits on diebold's board.
piotrjurkiewicz 10y ago
> The risks of ineligible people voting, or people voting twice, have been repeatedly shown to be virtually nonexistent How someone like Bruce Schneier can be so ignorant to facts?
losvedir 10y ago
It's interesting thinking about the threat models of the way the U.S. is designed. For example, when I voted in MA I didn't have to show ID or anything, just said my name and confirmed my address; I think the idea here is we're protecting from disenfranchising citizens who don't have IDs? And there's no national ID because I think the founders didn't want there to be a single record of all citizens at the federal level? Or was it just a logistical reason? I know that was part of the reason the SSN system is so brittle and crappy - there was great pushback against a national database, but it still ended up as one, kind of, but it's a shitty one because it wasn't designed for it. Another example is you don't really have a way to verify your vote was counted / tallied. Imagine if when you voted you got a UUID, and all votes were made public and searchable at the end of the election: UUID, Voting District, Vote. This system would let everyone verify that their vote was counted and correct, and statistics could be done per voting district to try to make sure no extra votes were included. However, it's susceptible to vote-buying, which is a major part of the current election system's threat model. But is that really still a concern? I feel like catching and prosecuting vote buying in my scenario is a lot easier than identifying large-scale vote fraud, hacking, or errors, in the current scenario. Or maybe there's a solution that fixes both?
- jedimastert 10y ago
  >However, it's susceptible to vote-buying, which is a major part of the current election system's threat model. This isn't the only issue with making votes public. There's an issue of political discrimination as well. For instance, a Hilary supporter could be found and attached, or an employer could fire all of his employees for voting for Trump.
- dragonwriter 10y ago
  > Another example is you don't really have a way to verify your vote was counted / tallied. At least for vote by mail, in CA you can verify that your vote was tallied, but not how it was tallied.
- grzm 10y ago
  There are known methods of vote verification and auditing that prevent the actual vote from being disclosed, voluntarily or otherwise. See Punchscan or Scantegrity for examples. Pretty interesting stuff from a comp sci point of view. [0]: https://en.wikipedia.org/wiki/Punchscan https://en.wikipedia.org/wiki/Punchscan [1]: https://en.wikipedia.org/wiki/Scantegrity https://en.wikipedia.org/wiki/Scantegrity
riprowan 10y ago
Also note that because American elections tend to hinge on a handful of swing states (and then, often only on particular counties in those states) you do not need to commit fraud on a wide scale to commandeer the election. It should be possible to measurably influence the election by hacking a handful of influential counties, actually.
jefurii 10y ago
We need to have voter registration and vote tally databases that have the characteristics of Git repositories. Because every piece in a Git repo has a SHA1 hash, you can verify that each and every piece is what it says it is and has the correct relationships to each and every other piece. You can verify that copy A is exactly the the same as copy B and has not been tampered with. All modifications are recorded; you may not know exactly who made each change (author info can be falsified) but you can at least know exactly what changes were made.

103 points by hourislate 10y ago

I did get a very sinky feeling when they scanned my vote and I didn't get a paper copy. Lowest bidder development doesn't seem like it should be the way we engineer everything. Don't Blame Me, I Voted for Kodos...

undersuit 10y ago
The FEC should be in charge of the entire voting process. What is worse: a custom designed U.S. government voting machine for all federal elections made by the FEC, or tens of different companies, selling their closed source machines to state governments for profit. I see issues in both systems, and in fact I'll take the current set up because my proposal requires me trusting the government more than I do now.
- eridius 10y ago
  Part of the problem is voting is run at the local level. I'm not sure the federal government even has the authority to tell states and counties that they must use a particular voting machine.
  - undersuit 10y ago
    So you make it so the states and counties and cities and voting districts that want to use a different process for their elections don't have to use the federal machines for anything but federal votes, but you still allow the federal machines to be used for down-ballot processes.
    - eridius 10y ago
      You're still assuming that the federal government has the authority to dictate the voting process used for federal elections. IANAL and I don't actually know what the legality here is, but my assumption is the federal government doesn't have that authority, given that if it did, it probably would have exercised it by now.
    - gohrt 10y ago
      Even simpler, just ask the President to decide who won each Federal race.
- jerf 10y ago
  "What is worse: a custom designed U.S. government voting machine for all federal elections made by the FEC, or tens of different companies, selling their closed source machines to state governments for profit." Um, I see what you're getting at, but the government would definitely create a monoculture and may create a single point of failure. The choice is less obvious than you may think is based on your phrasing. To which I'd say the solution is less about getting the FEC to do it, and more about the process. This needs to be an open and very public affair. It doesn't help us to have the FEC do it if they do it behind closed doors and create a closed-source computer-based system that requires all voting machines to be hooked over insecure networks to a central closed-source insecure server or something.
  - undersuit 10y ago
    >It doesn't help us to have the FEC do it if they do it behind closed doors and create a closed-source computer-based system that requires all voting machines to be hooked over insecure networks to a central closed-source insecure server or something. I did say the FEC isn't a good option now and I didn't really want to enumerate all my reasons, but you are covering a good number of them.
- gohrt 10y ago
  The incumbent government should NOT control the vote-counting machines.
  - undersuit 10y ago
    The incumbent government is somehow more of a threat of hacking the elections than the private corporations now? I can understand your opposition to the government as is, it's a closed off and opaque system with little interest in citizen affairs. How about you come up with some ways that we can make the government better and suggest those instead of just stopping the conversation with a big flat "no"?
DennisP 10y ago
You don't get a copy so nobody can bribe or coerce you.
- grzm 10y ago
  There are ways of providing receipts that prove you voted and can be used to prove your vote was included in the final tally without revealing (by choice or otherwise) who you voted for. See Punchscan[0] or Scantegrity[1] for examples. Pretty interesting stuff from a comp sci point of view. [0]: https://en.wikipedia.org/wiki/Punchscan https://en.wikipedia.org/wiki/Punchscan [1]: https://en.wikipedia.org/wiki/Scantegrity https://en.wikipedia.org/wiki/Scantegrity
  - DennisP 10y ago
    Also see the Rivest and Smith secure voting protocols: http://rangevoting.org/RivSmiPRshort.html http://rangevoting.org/RivSmiPRshort.html
    - grzm 10y ago
      Thanks for the link!

jedberg 10y ago

Had a funny conversation on Facebook on Tuesday related to this. It basically went like this: "It'll take a while to find out how the election went in California because we don't use computers" "You're the biggest state in the country and you don't use freakin computers?!" <-Texas resident "You work in IT, you of all people should know why we don't use computers"

d0lph 10y ago
Texas is bigger than California too (by area at least).
- undersuit 10y ago
  Texas is bigger than California by area, but Alaska is bigger than either by area. So a well informed reader would look at the statement: "You're the biggest state in the country" and make the correct assumption that the speaker was talking about population and not area.
  - stcredzero 10y ago
    In Alaska, people joked about dividing the state in two, just to make Texas the 3rd largest state in the US.
    - undersuit 10y ago
      As a Montana I would object to the demotion to 5th place too.
      - UhUhUhUh 10y ago
        As a Delaware I couldn't care less.
        labster 10y ago
        How are the Lenape people doing these days?

triplesec 10y ago

And the unacknowledged problem is, we don't really know if it's already happened. To quote from the article: 'Electronic voting machines can be hacked, and those machines that do not include a paper ballot that can verify each voter's choice can be hacked undetectably. Voting rolls are also vulnerable; they are all computerized databases whose entries can be deleted or changed.' It doesn't need visible chaos or detection on voting day.

paulmd 10y ago
Also, even the machines that generate paper trails are never actually recounted unless there's a problem. If you don't test your restore procedure then the value of a backup is effectively zero. A lot of the paper trails aren't necessarily even in machine-readable form. We are drastically unprepared for a large-scale recount (anything more than a county is going to take weeks+). Also, the backup is effectively the checksum here too - unless you actually look for an error, how would you ever know if one occurred? We need x% of counties to be randomly recounted from the paper trail to validate the tabulations.
rdiddly 10y ago
My thoughts exactly. A successful hack job or covert operation is one that you don't hear about. Non-detection is one of the goals and one of the criteria for defining success. So the ones that are found out, should be assumed to be the low end of the competency/success scale. Edit: Sort of a form of survivorship bias going on. The ones that "survive" (i.e. get found out) can't be used to draw conclusions about the others.
specialist 10y ago
"...we don't really know if it's already happened." What measure of proof do you require? Voter Action proved in a court of law that Kerry won New Mexico. No votes cast on spanish language were recorded. Hacking? Bad code? Bad set up? Either way, what's the difference? Regardless of intent, outcome is the same. Voter Action chose NM because its electoral votes wouldn't the outcome (less controversy) and they had ample evidence. This is not a unique story. In fact, its depressingly common.

Retric 10y ago

American Election(s) Have been hacked. This may or may not have changed the outcomes, but looking at various machines that where used at various times the odds that nobody hacked any of them, ever, is very low.

deleted 10y ago
[deleted]

coldcode 10y ago

Hacking individual voting machines is possible but not on scale one at a time. Far more likely is hacking at the place where the votes go later, in the end they are just a few numbers. As Stalin said, it doesn't matter who votes, it matters who counts the votes.

DennisP 10y ago
Unless you deploy a virus that can spread to thousands of voting machines, as researchers demonstrated a few years ago: https://www.technologyreview.com/s/406525/how-to-hack-an-election-in-one-minute/ https://www.technologyreview.com/s/406525/how-to-hack-an-ele...
Retric 10y ago
People are spending 10's of $ per vote in some areas, flipping a few per machine would easily be worth it. Just the presidential race can spend up to 40$ per vote, add in senators and local officials and votes are worth quite a bit. Remember some poling places have 10,000+ votes. If you change 500 votes that's both hard to detect and frankly likely to tip many local elections. Now, different people doing this to a few different locations and well it adds up.
- coldcode 10y ago
  However both parties are equally able to do the same thing. So would it make a material difference?
  - Retric 10y ago
    Not all voting systems are easy to compromise or standardized across states. Simply crashing the machines to create long lines is some areas is enough to tip a close election. Sure this might not be a denial of service attack but map long lines with party preferences and well... http://www.nbcnewyork.com/news/local/Polling-Problems-New-York-New-Jersey-Connecticut-Vote-Report-Issue-400380091.html http://www.nbcnewyork.com/news/local/Polling-Problems-New-Yo...

imgabe 10y ago

If it's not (and I think it isn't) the code used in the voting machines needs to be open source and publicly available in a government repo. That would be a start. There's still the issue of ensuring that that code is the code that is running on the actual machines, and that the compiler used to compile that code hasn't been compromised, and that the source for the compiler is available and on and on.... I'm not a security expert, but what would be a good way to publicly verify all this?

marcosdumay 10y ago
You still didn't got on the level of tampered hardware. There's just no good wat to verify this.
dcherman 10y ago
I'm not a security expert either, but my very first thought was that if we've successfully maintained a public ledger of financial transactions ( blockchain via bitcoin ), then that technology seems useful for large scale voting which is nothing more than another series of transactions. Maybe someone more educated about blockchain could illustrate some of the pros/cons about using it in this manner?
- eridius 10y ago
  An immediate huge problem is the fact that the blockchain works because the signer can prove their ability to sign, but voting is supposed to be anonymous. If every vote was a transaction then every vote would be public knowledge, but anonymity of voting is one of the cornerstones of our voting process.
  - paulmd 10y ago
    Probably solvable. Here's one solution that would only require registration of write-ins (which many states already do). Issue everyone a secret key (the digital equivalent of a ballot). They publish hash($key, $name). There are only N values for $name so that can be solved in O(N) time, but without knowledge of $key you couldn't determine whom someone voted for. For the sake of the user you could even pre-compute the hash values so it literally becomes "publish this string to vote for X". You could authenticate the user by having them give their pubkey at their secretary of state. The pubkey signs the hash like a standard blockchain transaction.

pmoriarty 10y ago

The possibility of voting fraud will make a blip in the news and then be forgotten, just as it was in the much more contentious election of Bush v Gore.

greeneggs 10y ago
"Voting fraud"? That wasn't an issue in 2000 (or ever in the US, as far as I know). There were famously problems with Florida's ballot. I don't know what Florida did, if anything, but there was federal legislation in 2002. This is how everyone got the money to buy electronic voting machines. https://en.wikipedia.org/wiki/Help_America_Vote_Act https://en.wikipedia.org/wiki/Help_America_Vote_Act
- pmoriarty 10y ago
  You are correct. I meant Bush v Kerry, 2004. That's when the whole electronic voting machine debacle happened.

jandrese 10y ago

I wonder what the odds are that the voting machines are hacked vs. abuse of absentee ballots? It seems to me that any solution that requires a person to physically appear at scattered polling places and tamper with hundreds of machines in a single day is probably not a huge problem. If you can mass mail fake ballots to the registrar then that could be more of a problem. I would presume that most absentee ballot systems have some sort of check that they're not receiving a ballot back from someone who did not request one, but I also know that this sort of thing could fall through the cracks if there aren't proper safeguards in place.

deleted 10y ago
[deleted]
scottcha 10y ago
At least in Washington there is a 1:1 mapping between your registered address and the envelope send your ballot in (I don't believe its to the ballot itself but I could be wrong). Once you send in your ballot you can verify on the county voting site that your ballot has been counted. I'm guessing this is the main way they check that fraudulent ballots aren't being submitted as you would then have > 1:1 mapping in many cases.
- jandrese 10y ago
  That makes sense, but has anyone verified that the check is being performed?
  - r00fus 10y ago
    And that's the problem with US elections - I would love to see a public showing (instead of the incessant back and forth) after the election of a good old review/audit of the election process. Even if it's only a few who participate/watch, knowing the process is audited would make me a lot more invested in it.
  - specialist 10y ago
    Yes. Ballot tracking enables the ballot chasing (GOTV) that every one hates.

CyberSkull5702 10y ago

blizkreeg 10y ago

Ok, so it's 2016 and I'm not naive in suggesting this but does anybody think that we should figure out how people can vote from their homes/phones? DoS attacks are a massive threat to this but wouldn't voting percentages go way up if we could make this happen?

joveian 10y ago
The Oregon/Washington/Colorado vote by mail system is very convenient. We get paper ballots by mail which can be returned by mail or dropped in official boxes and the results are scanned. This leaves a paper trail that is possible to recount if necessary. Voters in a little over half of US states can vote at home[0], but they need to explicitly request ballots. The ability to vote at home does seem to increase voting percentages. It is hard to compare before/after since all states that have so far switched entirely to vote by mail had a popular option for a while before, but all three states seem to do fairly well in national rankings, maybe particularly so in non-presidential election years. I found a site that collects such data [1] (relative to voting eligible population not registered voters) and in 2014 Colorado was 4th highest, Oregon #5, and Washington #21. For this election it looks like Colorado was #6, Oregon #13, and Wasington #16. So voting percentages might not go way up if everyone did this, but seem likely to go up some at least. [0] https://en.wikipedia.org/wiki/Absentee_ballot#United_States https://en.wikipedia.org/wiki/Absentee_ballot#United_States [1] http://www.electproject.org/home/voter-turnout/voter-turnout-data http://www.electproject.org/home/voter-turnout/voter-turnout...

deleted 10y ago

[deleted]

MichaelBurge 10y ago

I wouldn't mind seeing electronic machines that print paper ballots. They could even record the count into a database somewhere for ease of use. And it's important for the voter to see the paper ballot that gets printed, before he drops it in. That way, we can all find out who won in real-time, while the counties recount the paper ballots by hand over the next week to confirm. When you count the ballots, record a video and allow independent citizen auditors to view the video.

1stPostLastPost 10y ago

https://www.wired.com/wp-content/uploads/2015/08/WINVote-final.pdf https://www.wired.com/wp-content/uploads/2015/08/WINVote-fin... Windows XP Embedded not patched since 2004. WEP network password 'abcde' RDP open on voting machine. User: 'Administrator' password: 'admin' MS Access database, password 'shoup' (company that made the machine) The machine I used was a Hart eSlate with comic sans fonts, microsoft clipart graphics, and exposed ports. What happens when I plug in a rubber ducky that presses shift 5 times? If you Google the secretary of state election results sites (where everyone scrapes the information from), you see html tables straight out of the 90s, and some of the servers run Windows Server 2003. https://www.google.com/search?q=secretary+of+state+election+results&oq=secretary+of+state+election+results&aqs=chrome..69i57.6255j0j7&sourceid=chrome&ie=UTF-8 https://www.google.com/search?q=secretary+of+state+election+... Were some hacked? You tell me.

linkregister 10y ago
The first link is broken.
- 1stPostLastPost 10y ago
  Huh, they took it down recently. Here's a mirror: https://www.wired.com/wp-content/uploads/2015/08/WINVote-final.pdf https://www.wired.com/wp-content/uploads/2015/08/WINVote-fin... and another just in case: https://www.documentcloud.org/documents/2167420-winvote-final.html https://www.documentcloud.org/documents/2167420-winvote-fina...

tmcbride23 10y ago

After the 2000 election the yongest bush's company created the new voting systems in Florida and ohio. Check who sits on diebold's board.

piotrjurkiewicz 10y ago

> The risks of ineligible people voting, or people voting twice, have been repeatedly shown to be virtually nonexistent How someone like Bruce Schneier can be so ignorant to facts?

losvedir 10y ago

It's interesting thinking about the threat models of the way the U.S. is designed. For example, when I voted in MA I didn't have to show ID or anything, just said my name and confirmed my address; I think the idea here is we're protecting from disenfranchising citizens who don't have IDs? And there's no national ID because I think the founders didn't want there to be a single record of all citizens at the federal level? Or was it just a logistical reason? I know that was part of the reason the SSN system is so brittle and crappy - there was great pushback against a national database, but it still ended up as one, kind of, but it's a shitty one because it wasn't designed for it. Another example is you don't really have a way to verify your vote was counted / tallied. Imagine if when you voted you got a UUID, and all votes were made public and searchable at the end of the election: UUID, Voting District, Vote. This system would let everyone verify that their vote was counted and correct, and statistics could be done per voting district to try to make sure no extra votes were included. However, it's susceptible to vote-buying, which is a major part of the current election system's threat model. But is that really still a concern? I feel like catching and prosecuting vote buying in my scenario is a lot easier than identifying large-scale vote fraud, hacking, or errors, in the current scenario. Or maybe there's a solution that fixes both?

jedimastert 10y ago
>However, it's susceptible to vote-buying, which is a major part of the current election system's threat model. This isn't the only issue with making votes public. There's an issue of political discrimination as well. For instance, a Hilary supporter could be found and attached, or an employer could fire all of his employees for voting for Trump.
dragonwriter 10y ago
> Another example is you don't really have a way to verify your vote was counted / tallied. At least for vote by mail, in CA you can verify that your vote was tallied, but not how it was tallied.
grzm 10y ago
There are known methods of vote verification and auditing that prevent the actual vote from being disclosed, voluntarily or otherwise. See Punchscan or Scantegrity for examples. Pretty interesting stuff from a comp sci point of view. [0]: https://en.wikipedia.org/wiki/Punchscan https://en.wikipedia.org/wiki/Punchscan [1]: https://en.wikipedia.org/wiki/Scantegrity https://en.wikipedia.org/wiki/Scantegrity

riprowan 10y ago

Also note that because American elections tend to hinge on a handful of swing states (and then, often only on particular counties in those states) you do not need to commit fraud on a wide scale to commandeer the election. It should be possible to measurably influence the election by hacking a handful of influential counties, actually.

jefurii 10y ago

We need to have voter registration and vote tally databases that have the characteristics of Git repositories. Because every piece in a Git repo has a SHA1 hash, you can verify that each and every piece is what it says it is and has the correct relationships to each and every other piece. You can verify that copy A is exactly the the same as copy B and has not been tampered with. All modifications are recorded; you may not know exactly who made each change (author info can be falsified) but you can at least know exactly what changes were made.