6 ms·

Forget the problems electronic voting has if it's implemented well, this sort of stuff is the real reason to be worried about systems like this. Because there's

by CM30 9y ago

Forget the problems electronic voting has if it's implemented well, this sort of stuff is the real reason to be worried about systems like this. Because there's a tendency for governments and councils to outsource the work to whatever contractors are the cheapest or to hire developers who don't know a thing about security. A secure evoting system is hard enough to implement, and even a well done version is worse than a paper ballot. But it's the kind of system described here that'd be the likely result of electronic voting being implemented in countries like the US. A hacked together, insecure piece of junk that's wide open to being compromised by bad actors at every level.

majewsky 9y ago
> there's a tendency for governments and councils to outsource the work to whatever contractors are the cheapest Not just a tendency. When choosing a contractor, government offices in Germany are required to choose the lowest bidder who fulfils (or rather, claims to fulfil) the requirements stated in the call for bids.
- Angostura 9y ago
  To be fair, that is more a rationale for having rally good people speccing your system and producing detailed requirements.
  - pfg 9y ago
    That's certainly not wrong, but it also is somewhat at odds with how we know modern software projects should be managed, which is a reasonable explanation for why so many government projects work out the way they do.
  - deleted 9y ago
    [deleted]
  - wiz21c 9y ago
    Ok, let's just do that : spec a voting system. Such a system should be as secure as physical paper and anybody should be able to assess its security by inspecting it (good luck with that one).
  - laumars 9y ago
    The level of detail your talking about to prevent the kind of mistakes they made is so specific that you might as well just develop the thing in house since you clearly already have the experience. Maybe what we need is a rules that any critical government infrastructure should be independently pen tested before it's bought. This should hopefully put off the inexperienced from taking on such projects and offer a way out for governments should the contract go sour.
    - carlmr 9y ago
      I agree, this is often an issue. In my company a lot of people only make specs, and the "development" for a lot of components is outsourced. But these specs are basically developed already, so in the end, we're only making the expensive developers write a spec that's so detailed that it's more work to write the detailed spec, than if you programmed it directly from a non-detailed spec.
- germanier 9y ago
  They are bound to take the most economical offer which is not necessarily the cheapest. Cost must always be a significant factor but others can be included. The criteria must be fixed before starting the process and can include follow-up cost, technical aspects, environmental considerations, duration, user experience, or anything else that is quantifiable, appropriate, and non-discriminatory. It is far easier to just look at the cost but it's absolutely not uncommon to have other criteria included in a tender. An offer that is unusually cheap has to withstand additional scrutiny. It is not allowed to choose such an offer (even if it's the cheapest) if it's price-dumping or unlikely to be completed due to the tight calculation.
- rjzzleep 9y ago
  Yes, but that's only half of the story. We just spent 40 mio on a thing that had 10 year old cabling contracts. We managed to fix it, but there's plenty of trash that we didn't manage to fix. The problem is that there is close to zero accountability on senior management. Germany is full of stuffed old guys, who have no reason to be afraid of ANYTHING. Nothing is ever going to happen to them. All the people that screwed up the major government construction projects went straight to go on to continue doing the next government construction projects. Same with every other industry here. Blaming the "Ausschreibung" or bidding stuff is only a tiny part of the problem. Every time I see the people responsible for this crap I almost puke when I see them give each other a pat on the back. Oh and while I'm at it. We have a software contractor that has a contract that basically lets them build anything they want and bill it to us. Add to that I'm supposed to architect their software and micromanage, so they get to bill us for the work. On top of it we pay them to get training in Angular 2.0, which we will then pay for to have them train us. I asked management to change the contract so they couldn't do what they want, but they just don't want to touch it. They were not chosen as part of the bidding process btw. I've seen the same in the US. It's the same crap you have in any other country.
andrepd 9y ago
> even a well done version is worse than a paper ballot. It is not. There are many voting schemes that offer all the benefits of paper voting together with the verifiability and transparency of cryptographically verifiable vote counting.
- pfg 9y ago
  All experts I've heard from on this agree that we're decades from being able to implement such systems in a secure way, if it's possible at all. Most people trying to tell you that's not true are trying to sell you something, usually with some vague blockchain reference. I'd recommend the various talks and papers J. Alex Halderman has given/written on this topic, especially on Estonia's e-voting system.
  - pdkl95 9y ago
    I also recommend Andrew Appel's talk on the mechanics of voting. In addition to the dangers inherent in any complex electronic system, he also discusses how we invented the secret paper ballot. It may look "low tech", but the secret paper ballot is several hundred years of bugfixes and security features that we would be foolish to ignore. https://www.youtube.com/watch?v=abQCqIbBBeM https://www.youtube.com/watch?v=abQCqIbBBeM
- pbhjpbhj 9y ago
  Could you link to details of one such scheme (perhaps the one you feel is best), please? When I've thought about e-voting it's seemed tractable except the conflict between verifiability and keeping the ballot secret. I'd be interested to see how such schemes manage this point in particular.
  - davidsong 9y ago
    From what I understand, verifiability and transparency is something you don't really want because it enables vote selling. In a secret ballot, someone dishonest enough to sell you their vote is probably dishonest enough to vote the other way.

by CM30 9y ago

majewsky 9y ago

> there's a tendency for governments and councils to outsource the work to whatever contractors are the cheapest Not just a tendency. When choosing a contractor, government offices in Germany are required to choose the lowest bidder who fulfils (or rather, claims to fulfil) the requirements stated in the call for bids.

Angostura 9y ago
To be fair, that is more a rationale for having rally good people speccing your system and producing detailed requirements.
- pfg 9y ago
  That's certainly not wrong, but it also is somewhat at odds with how we know modern software projects should be managed, which is a reasonable explanation for why so many government projects work out the way they do.
- deleted 9y ago
  [deleted]
- wiz21c 9y ago
  Ok, let's just do that : spec a voting system. Such a system should be as secure as physical paper and anybody should be able to assess its security by inspecting it (good luck with that one).
- laumars 9y ago
  The level of detail your talking about to prevent the kind of mistakes they made is so specific that you might as well just develop the thing in house since you clearly already have the experience. Maybe what we need is a rules that any critical government infrastructure should be independently pen tested before it's bought. This should hopefully put off the inexperienced from taking on such projects and offer a way out for governments should the contract go sour.
  - carlmr 9y ago
    I agree, this is often an issue. In my company a lot of people only make specs, and the "development" for a lot of components is outsourced. But these specs are basically developed already, so in the end, we're only making the expensive developers write a spec that's so detailed that it's more work to write the detailed spec, than if you programmed it directly from a non-detailed spec.
germanier 9y ago
They are bound to take the most economical offer which is not necessarily the cheapest. Cost must always be a significant factor but others can be included. The criteria must be fixed before starting the process and can include follow-up cost, technical aspects, environmental considerations, duration, user experience, or anything else that is quantifiable, appropriate, and non-discriminatory. It is far easier to just look at the cost but it's absolutely not uncommon to have other criteria included in a tender. An offer that is unusually cheap has to withstand additional scrutiny. It is not allowed to choose such an offer (even if it's the cheapest) if it's price-dumping or unlikely to be completed due to the tight calculation.
rjzzleep 9y ago
Yes, but that's only half of the story. We just spent 40 mio on a thing that had 10 year old cabling contracts. We managed to fix it, but there's plenty of trash that we didn't manage to fix. The problem is that there is close to zero accountability on senior management. Germany is full of stuffed old guys, who have no reason to be afraid of ANYTHING. Nothing is ever going to happen to them. All the people that screwed up the major government construction projects went straight to go on to continue doing the next government construction projects. Same with every other industry here. Blaming the "Ausschreibung" or bidding stuff is only a tiny part of the problem. Every time I see the people responsible for this crap I almost puke when I see them give each other a pat on the back. Oh and while I'm at it. We have a software contractor that has a contract that basically lets them build anything they want and bill it to us. Add to that I'm supposed to architect their software and micromanage, so they get to bill us for the work. On top of it we pay them to get training in Angular 2.0, which we will then pay for to have them train us. I asked management to change the contract so they couldn't do what they want, but they just don't want to touch it. They were not chosen as part of the bidding process btw. I've seen the same in the US. It's the same crap you have in any other country.

andrepd 9y ago

> even a well done version is worse than a paper ballot. It is not. There are many voting schemes that offer all the benefits of paper voting together with the verifiability and transparency of cryptographically verifiable vote counting.

pfg 9y ago
All experts I've heard from on this agree that we're decades from being able to implement such systems in a secure way, if it's possible at all. Most people trying to tell you that's not true are trying to sell you something, usually with some vague blockchain reference. I'd recommend the various talks and papers J. Alex Halderman has given/written on this topic, especially on Estonia's e-voting system.
- pdkl95 9y ago
  I also recommend Andrew Appel's talk on the mechanics of voting. In addition to the dangers inherent in any complex electronic system, he also discusses how we invented the secret paper ballot. It may look "low tech", but the secret paper ballot is several hundred years of bugfixes and security features that we would be foolish to ignore. https://www.youtube.com/watch?v=abQCqIbBBeM https://www.youtube.com/watch?v=abQCqIbBBeM
pbhjpbhj 9y ago
Could you link to details of one such scheme (perhaps the one you feel is best), please? When I've thought about e-voting it's seemed tractable except the conflict between verifiability and keeping the ballot secret. I'd be interested to see how such schemes manage this point in particular.
- davidsong 9y ago
  From what I understand, verifiability and transparency is something you don't really want because it enables vote selling. In a secret ballot, someone dishonest enough to sell you their vote is probably dishonest enough to vote the other way.