16 ms·

Voting Machine Used in Half of U.S. Is Vulnerable to Attack, Report Finds

297 points by briatx 8y ago

moviuro 8y ago
sigh https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI
- rectang 8y ago
  This video is about electronic voting. The article is about a device used to count paper ballots.
  - moviuro 8y ago
    Paper ballot counting happens to be mentioned in the video at ~4:20
    - rectang 8y ago
      It would have been helpful if you had noted that in your original post. Just pointing to a opaque video URL without summary is inconvenient for the rest of the readers. Therefore, I posted quickly (without watching the entire video) in an attempt to spare others from having to waste their time.
- rohit2412 8y ago
  Lot of generalizations and stupid assumptions in that video, like where he argues that of course the ballots will be uploaded over the internet without any authentication/checksum. I don't see why a digital counting machine which is kept completely offline and is transported physically cannot be used, specially if we can verify it's counting functions by randomly verifying a few of those machines (also keep paper ballots, just use the machine to count ballots), or statistics, and use an external randomization/derandomization module.
  - mdorazio 8y ago
    Hang on. You want to use a counting machine, and then physically transport it around to avoid security issues instead of just using proven human counters and physically transported ballots because....???? Why? Just why? What problem is this solving? Does getting your results a few hours sooner make a single bit of difference to merit this madness?
    - hvdhh7 8y ago
      Perhaps because counting tens of thousands of near-identical pieces of paper is exactly the sort of repetitive, robotic task we've entrusted machines to perform more accurately than humans since at least the 1940s.
      - monocasa 8y ago
        You realize that the article in question is about hacks against vote tabulating machines right?
        hvdhh7 8y ago
        I do. But a non-hacked vote tabulating machine will still do the job better than non-hacked humans. Add a high enough percentage of random hand audits of the machine but counts to ensure they're functioning correctly, and you should get a reasonably high confidence that you have the most accurate count.
        monocasa 8y ago
        But why? The number of humans to count votes scales linearly with the number of votes cast.
        moviuro 8y ago
        > Add a high enough percentage of random hand audits of the machine but counts to ensure they're functioning correctly, and you should get a reasonably high confidence that you have the most accurate count. Defies the purpose of electronic machines completely. Why use machines + lots of auditors, when just more counters (worth less than auditors) could do the same job, with a much higher cost to corrupt?...
erikb 8y ago
> Voting Machine Used in Half of U.S. Is Vulnerable to Attack, Report Finds Too much attention seeking in this headline. We knew from day one that there would be vulns. It doesn't matter how many people use them. Good that some have been found now. Let's support them by public reporting in seriously investigating the flaws they know about.
return-value 8y ago
I work for the municipality of Skanderborg, Denmark. We have what we call digital elections, but what’s digitized is the registration process. Basically every adult gets a voting card with their information + a barcode, we scan those barcodes when they turn up to receive their ballot(is that the right word for voting list?), and then they are registered. The actual voting takes place on paper, and while it takes time to prepare the ballots and count the votes, the process of voting doesn’t take very longer than a few minutes for the individual citizen. From they enter the voting place till they are done. I think that’s the way to digitize elections, you make them speedy for the citizens, but safe for democracy. I can’t for the life of me understand why you would ever do a digital vote. It’s just so risky. I guess you save money by adding effectiveness to the process surrounding an election, preparing ballots and counting votes, but those parts of the process are owned by the public sector and I don’t think the government should ever value the safety of our democracy as less important than money. We count votes by enlisting employees of the municipality, members of political parties and paid help from local NGOs, and everything is monitored and counted a few times. It’s a little taxing, but everyone involved enjoy the process, and financially it’s not that expensive compared to paying a license for voting machines.
- dev_dull 8y ago
  Believe it or note, requiring ID to vote in the United States is considered controversial.
  - return-value 8y ago
    We don’t require ID as such. Every citizen is issued a little piece of paper that they can trade in for a ballot for that specific election. We used to look people up in big books, that are printed for the occasion, to make sure their piece is valid and they haven’t already voted - which took a long time and led to queues. That’s the part we digitized. But you can vote without ID as long as you have that piece of paper and know your birthdate. I’m actually not sure how the homeless vote (they can’t receive the piece of paper), but I guess they probably do a mail vote at their local municipality.
olivermarks 8y ago
HBO 2006 documentary 'Hacking Democracy' on Youtube https://youtu.be/iZLWPleeCHE https://youtu.be/iZLWPleeCHE 'The film investigates the flawed integrity of electronic voting machines, particularly those made by Diebold Election Systems, exposing previously unknown backdoors in the Diebold trade secret computer software. The film culminates dramatically in the on-camera hacking of the in-use / working Diebold election system in Leon County, Florida - the same computer voting system which has been used in actual American elections across thirty-three states, and which still counts tens of millions of America's votes today.' https://en.wikipedia.org/wiki/Hacking_Democracy https://en.wikipedia.org/wiki/Hacking_Democracy Same company in 2018, same issues
Chardok 8y ago
With all of this discussion in Washington about Russian hacking and Russian voter influencing, why are these demonstrably vulnerable voting machines hardly mentioned? It would seem to me this should be a number one priority to prevent outside interference.
- sp527 8y ago
  I've wondered about this and also the fact that 'hacking' our election isn't terribly difficult when all you have to do is manipulate a very small number of swing counties. My conclusion thus far has been that even the media must be necessarily complicit in the farce of a free and fair election system. There's a strong incentive for everyone to believe this in order to maintain stability.
- nonbel 8y ago
  In fact the voting system seems to be getting more, rather than less, shady in some places. Eg, LA county: https://news.ycombinator.com/item?id=17823702 https://news.ycombinator.com/item?id=17823702
- pjc50 8y ago
  The short unhappy answer seems to be that the parties are happy with a corruptible voting system.
  - rootusrootus 8y ago
    That does seem like a logical conclusion. Conveniently, the GOP has made disenfranchisement part of their platform, which of course the Democrats then oppose by supporting zero-id elections, and we end up with a silly stalemate, hackable voting systemc, etc. Staff up the FEC and then make it their job to seek out and provide ID to every single eligible voter in the country. Kinda like the census, be proactive and don't make disenfranchisement a thing. And then make it so polling places are open for days, maybe a week, including a full weekend, so everyone gets a chance to vote. Or vote-by-mail. We've established it works.
- dogcomplex 8y ago
raverbashing 8y ago
As much as electronic voting has its issues, it allows for quick counting and would allow for more fairer ways of voting, like priority lists (I mean, you could do that using paper, but it is a PITA and very subject to mistakes) Ideally printed/machine readable votes (one that the voter doesn't take with them) sounds like could be an answer
kaycebasques 8y ago
The HN consensus seems to be that digital voting is very difficult to do right. I trust the consensus opinion, but this also makes me sad. The bigger picture that I think we’re missing here is the opportunity for huge-scale direct democracy. I know the usual debates against DD, but I think there’s ways to safeguard against those problems. E.g. you can’t vote on an issue without hearing both sides of it and passing a test that demonstrates that you understand the pros and cons of each side. Idealistic, I know, but I’m a firm believer that most people act more responsibly when you give them more responsibility.
- learc83 8y ago
  >a test that demonstrates that you understand the pros and cons of each side Then you just moved the controversial part of the process back to what the pros and cons are, or another step further still to who decides what the pros and cons are.
  - kaycebasques 8y ago
    Yes, the gatekeeper problem is tricky. I ultimately think that each side would submit pros and cons, with no rules around what they can submit. Otherwise we run into the gatekeeper problem. So some sides would submit sensational, false claims. And we’d have to trust the people to decide what’s true and false. We’re already trusting us, the people, to make these decisions when we elect representatives. We might as well directly face the consequences of our choices, rather than shifting blame to a representative.
- Loughla 8y ago
  >I’m a firm believer that most people act more responsibly when you give them more responsibility. Honestly, I believe the literal opposite. People act irrationally if they believe it's in their own self-interest. What leads to to think that way? I'm genuinely curious.
  - kaycebasques 8y ago
    Some random thoughts, starting with personal experience: * When my team gives me ownership over a project, I take pride in that project and produce higher-quality work. This is loosely related to "people act more responsibly when you give them more responsibility" in the sense that direct democracy will make people feel like they have more ownership over issues. * Homeowners tend to take better care of their place of living than renters. * When people have kids, most tend to mature and act more responsibly in general. Not all, but most. In this case "having a child" is a proxy for "having more responsibility" in general. In terms of studies, I'm intrigued by experiments [1] where people are assigned leadership roles randomly. They seem to suggest that people tend to make better decisions when given more responsibility. An even more radical idea that is more closely related to this study would be to assign random citizens to be in charge of a certain political issue, say for 6 to 12 months. [1] http://bobsutton.typepad.com/my_weblog/2011/10/is-it-sometimes-rational-to-select-leaders-randomly-a-cool-old-study.html http://bobsutton.typepad.com/my_weblog/2011/10/is-it-sometim...
TheRealPomax 8y ago
I don't understand these headlines. "After More Than A Decade of Vulnerable Voting Machines, US Still Uses Those Same Voting Machines" would be more accurate.
carapace 8y ago
Of course it is. If you vote by machine you are ruled by the best hackers. "Hackocracy"
kelvin0 8y ago
Also vulnerable to attacks: Automobiles, Air gapped computer, many routers, cell phones, ATMs, Gouvernment infrastructure... https://www.wired.com/story/car-hack-shut-down-safety-features/ https://www.wired.com/story/car-hack-shut-down-safety-featur... https://en.wikipedia.org/wiki/Air_gap_malware https://en.wikipedia.org/wiki/Air_gap_malware https://arstechnica.com/information-technology/2018/05/hackers-infect-500000-consumer-routers-all-over-the-world-with-malware/ https://arstechnica.com/information-technology/2018/05/hacke... https://koolspan.com/hack-a-cell-phone/ https://koolspan.com/hack-a-cell-phone/ https://www.cnn.com/2013/10/24/world/europe/uk-phone-hacking-scandal-fast-facts/index.html https://www.cnn.com/2013/10/24/world/europe/uk-phone-hacking... Is anyone shocked yet?
amptorn 8y ago
We should routinely red-team elections. It would literally be amazing if I were kidding.
sj4nz 8y ago
This story comes out every fall for every major-ish November election period. The resolution is always the same: WONTFIX.
motohagiography 8y ago
Voting is necessarily a proof of work algorithm, and when you represent the result, you only simulate its effect. Sure, people don't care if it's simulated when they win, but when they lose, they care a lot. Feel like I'm a lone voice in the wilderness on this one but I really feel like I need to shout from the rooftops that electronic voting courts violence, and it is culpable hubris to state otherwise.
drawkbox 8y ago
We need to run elections through something like the finance system, digital, data always present and researchable, always able to be looked up that your vote was counted and correct, and fraud day one can be reversed as well as anomalies. Finance systems expect fraud, and systems in place to detect and revert it. Voting has none of those protections. The problem is so many voting systems, so many ways to fix the vote, recounts are impossible to trust. People trust their money in their accounts and they trust that the financial system and software can track that. We need to move to something like that pronto with receipts, digital voting, ability to check your vote, data tracking, ability for researchers to get access to it, fraud protection and more.
wpdev_63 8y ago
It's asinine that we are still debating this. There really isn't much to debate at this point.
macawfish 8y ago
Sounds like a feature, not a bug (sadly)
TomMckenny 8y ago
Voting machine manufacturers have vast funds and lobbyists. Even when congress did manage to in a act bipartisan manner, lobbyists persuaded the white house to kill it.[0] You'll find plenty of incredibly destructive practices (nearing national suicide actually) caused by money in politics and worsened catastrophically by Citizens United. [0]Secure Elections Act. https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2018/08/31/the-cybersecurity-202-why-the-latest-election-security-bill-is-stalled-in-congress/5b8829fb1b326b3f31919eaa/?noredirect=on&utm_term=.706defb93737 https://www.washingtonpost.com/news/powerpost/paloma/the-cyb...
neonate 8y ago
http://archive.is/g1sAr http://archive.is/g1sAr

297 points by briatx 8y ago

moviuro 8y ago

sigh https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI

rectang 8y ago
This video is about electronic voting. The article is about a device used to count paper ballots.
- moviuro 8y ago
  Paper ballot counting happens to be mentioned in the video at ~4:20
  - rectang 8y ago
    It would have been helpful if you had noted that in your original post. Just pointing to a opaque video URL without summary is inconvenient for the rest of the readers. Therefore, I posted quickly (without watching the entire video) in an attempt to spare others from having to waste their time.
rohit2412 8y ago
Lot of generalizations and stupid assumptions in that video, like where he argues that of course the ballots will be uploaded over the internet without any authentication/checksum. I don't see why a digital counting machine which is kept completely offline and is transported physically cannot be used, specially if we can verify it's counting functions by randomly verifying a few of those machines (also keep paper ballots, just use the machine to count ballots), or statistics, and use an external randomization/derandomization module.
- mdorazio 8y ago
  Hang on. You want to use a counting machine, and then physically transport it around to avoid security issues instead of just using proven human counters and physically transported ballots because....???? Why? Just why? What problem is this solving? Does getting your results a few hours sooner make a single bit of difference to merit this madness?
  - hvdhh7 8y ago
    Perhaps because counting tens of thousands of near-identical pieces of paper is exactly the sort of repetitive, robotic task we've entrusted machines to perform more accurately than humans since at least the 1940s.
    - monocasa 8y ago
      You realize that the article in question is about hacks against vote tabulating machines right?
      - hvdhh7 8y ago
        I do. But a non-hacked vote tabulating machine will still do the job better than non-hacked humans. Add a high enough percentage of random hand audits of the machine but counts to ensure they're functioning correctly, and you should get a reasonably high confidence that you have the most accurate count.
        monocasa 8y ago
        But why? The number of humans to count votes scales linearly with the number of votes cast.
        moviuro 8y ago
        > Add a high enough percentage of random hand audits of the machine but counts to ensure they're functioning correctly, and you should get a reasonably high confidence that you have the most accurate count. Defies the purpose of electronic machines completely. Why use machines + lots of auditors, when just more counters (worth less than auditors) could do the same job, with a much higher cost to corrupt?...

erikb 8y ago

> Voting Machine Used in Half of U.S. Is Vulnerable to Attack, Report Finds Too much attention seeking in this headline. We knew from day one that there would be vulns. It doesn't matter how many people use them. Good that some have been found now. Let's support them by public reporting in seriously investigating the flaws they know about.

return-value 8y ago

I work for the municipality of Skanderborg, Denmark. We have what we call digital elections, but what’s digitized is the registration process. Basically every adult gets a voting card with their information + a barcode, we scan those barcodes when they turn up to receive their ballot(is that the right word for voting list?), and then they are registered. The actual voting takes place on paper, and while it takes time to prepare the ballots and count the votes, the process of voting doesn’t take very longer than a few minutes for the individual citizen. From they enter the voting place till they are done. I think that’s the way to digitize elections, you make them speedy for the citizens, but safe for democracy. I can’t for the life of me understand why you would ever do a digital vote. It’s just so risky. I guess you save money by adding effectiveness to the process surrounding an election, preparing ballots and counting votes, but those parts of the process are owned by the public sector and I don’t think the government should ever value the safety of our democracy as less important than money. We count votes by enlisting employees of the municipality, members of political parties and paid help from local NGOs, and everything is monitored and counted a few times. It’s a little taxing, but everyone involved enjoy the process, and financially it’s not that expensive compared to paying a license for voting machines.

dev_dull 8y ago
Believe it or note, requiring ID to vote in the United States is considered controversial.
- return-value 8y ago
  We don’t require ID as such. Every citizen is issued a little piece of paper that they can trade in for a ballot for that specific election. We used to look people up in big books, that are printed for the occasion, to make sure their piece is valid and they haven’t already voted - which took a long time and led to queues. That’s the part we digitized. But you can vote without ID as long as you have that piece of paper and know your birthdate. I’m actually not sure how the homeless vote (they can’t receive the piece of paper), but I guess they probably do a mail vote at their local municipality.

olivermarks 8y ago

HBO 2006 documentary 'Hacking Democracy' on Youtube https://youtu.be/iZLWPleeCHE https://youtu.be/iZLWPleeCHE 'The film investigates the flawed integrity of electronic voting machines, particularly those made by Diebold Election Systems, exposing previously unknown backdoors in the Diebold trade secret computer software. The film culminates dramatically in the on-camera hacking of the in-use / working Diebold election system in Leon County, Florida - the same computer voting system which has been used in actual American elections across thirty-three states, and which still counts tens of millions of America's votes today.' https://en.wikipedia.org/wiki/Hacking_Democracy https://en.wikipedia.org/wiki/Hacking_Democracy Same company in 2018, same issues

Chardok 8y ago

With all of this discussion in Washington about Russian hacking and Russian voter influencing, why are these demonstrably vulnerable voting machines hardly mentioned? It would seem to me this should be a number one priority to prevent outside interference.

sp527 8y ago
I've wondered about this and also the fact that 'hacking' our election isn't terribly difficult when all you have to do is manipulate a very small number of swing counties. My conclusion thus far has been that even the media must be necessarily complicit in the farce of a free and fair election system. There's a strong incentive for everyone to believe this in order to maintain stability.
nonbel 8y ago
In fact the voting system seems to be getting more, rather than less, shady in some places. Eg, LA county: https://news.ycombinator.com/item?id=17823702 https://news.ycombinator.com/item?id=17823702
pjc50 8y ago
The short unhappy answer seems to be that the parties are happy with a corruptible voting system.
- rootusrootus 8y ago
  That does seem like a logical conclusion. Conveniently, the GOP has made disenfranchisement part of their platform, which of course the Democrats then oppose by supporting zero-id elections, and we end up with a silly stalemate, hackable voting systemc, etc. Staff up the FEC and then make it their job to seek out and provide ID to every single eligible voter in the country. Kinda like the census, be proactive and don't make disenfranchisement a thing. And then make it so polling places are open for days, maybe a week, including a full weekend, so everyone gets a chance to vote. Or vote-by-mail. We've established it works.
dogcomplex 8y ago

raverbashing 8y ago

As much as electronic voting has its issues, it allows for quick counting and would allow for more fairer ways of voting, like priority lists (I mean, you could do that using paper, but it is a PITA and very subject to mistakes) Ideally printed/machine readable votes (one that the voter doesn't take with them) sounds like could be an answer

kaycebasques 8y ago

The HN consensus seems to be that digital voting is very difficult to do right. I trust the consensus opinion, but this also makes me sad. The bigger picture that I think we’re missing here is the opportunity for huge-scale direct democracy. I know the usual debates against DD, but I think there’s ways to safeguard against those problems. E.g. you can’t vote on an issue without hearing both sides of it and passing a test that demonstrates that you understand the pros and cons of each side. Idealistic, I know, but I’m a firm believer that most people act more responsibly when you give them more responsibility.

learc83 8y ago
>a test that demonstrates that you understand the pros and cons of each side Then you just moved the controversial part of the process back to what the pros and cons are, or another step further still to who decides what the pros and cons are.
- kaycebasques 8y ago
  Yes, the gatekeeper problem is tricky. I ultimately think that each side would submit pros and cons, with no rules around what they can submit. Otherwise we run into the gatekeeper problem. So some sides would submit sensational, false claims. And we’d have to trust the people to decide what’s true and false. We’re already trusting us, the people, to make these decisions when we elect representatives. We might as well directly face the consequences of our choices, rather than shifting blame to a representative.
Loughla 8y ago
>I’m a firm believer that most people act more responsibly when you give them more responsibility. Honestly, I believe the literal opposite. People act irrationally if they believe it's in their own self-interest. What leads to to think that way? I'm genuinely curious.
- kaycebasques 8y ago
  Some random thoughts, starting with personal experience: * When my team gives me ownership over a project, I take pride in that project and produce higher-quality work. This is loosely related to "people act more responsibly when you give them more responsibility" in the sense that direct democracy will make people feel like they have more ownership over issues. * Homeowners tend to take better care of their place of living than renters. * When people have kids, most tend to mature and act more responsibly in general. Not all, but most. In this case "having a child" is a proxy for "having more responsibility" in general. In terms of studies, I'm intrigued by experiments [1] where people are assigned leadership roles randomly. They seem to suggest that people tend to make better decisions when given more responsibility. An even more radical idea that is more closely related to this study would be to assign random citizens to be in charge of a certain political issue, say for 6 to 12 months. [1] http://bobsutton.typepad.com/my_weblog/2011/10/is-it-sometimes-rational-to-select-leaders-randomly-a-cool-old-study.html http://bobsutton.typepad.com/my_weblog/2011/10/is-it-sometim...

TheRealPomax 8y ago

I don't understand these headlines. "After More Than A Decade of Vulnerable Voting Machines, US Still Uses Those Same Voting Machines" would be more accurate.

carapace 8y ago

Of course it is. If you vote by machine you are ruled by the best hackers. "Hackocracy"

kelvin0 8y ago

Also vulnerable to attacks: Automobiles, Air gapped computer, many routers, cell phones, ATMs, Gouvernment infrastructure... https://www.wired.com/story/car-hack-shut-down-safety-features/ https://www.wired.com/story/car-hack-shut-down-safety-featur... https://en.wikipedia.org/wiki/Air_gap_malware https://en.wikipedia.org/wiki/Air_gap_malware https://arstechnica.com/information-technology/2018/05/hackers-infect-500000-consumer-routers-all-over-the-world-with-malware/ https://arstechnica.com/information-technology/2018/05/hacke... https://koolspan.com/hack-a-cell-phone/ https://koolspan.com/hack-a-cell-phone/ https://www.cnn.com/2013/10/24/world/europe/uk-phone-hacking-scandal-fast-facts/index.html https://www.cnn.com/2013/10/24/world/europe/uk-phone-hacking... Is anyone shocked yet?

amptorn 8y ago

We should routinely red-team elections. It would literally be amazing if I were kidding.

sj4nz 8y ago

This story comes out every fall for every major-ish November election period. The resolution is always the same: WONTFIX.

motohagiography 8y ago

Voting is necessarily a proof of work algorithm, and when you represent the result, you only simulate its effect. Sure, people don't care if it's simulated when they win, but when they lose, they care a lot. Feel like I'm a lone voice in the wilderness on this one but I really feel like I need to shout from the rooftops that electronic voting courts violence, and it is culpable hubris to state otherwise.

drawkbox 8y ago

We need to run elections through something like the finance system, digital, data always present and researchable, always able to be looked up that your vote was counted and correct, and fraud day one can be reversed as well as anomalies. Finance systems expect fraud, and systems in place to detect and revert it. Voting has none of those protections. The problem is so many voting systems, so many ways to fix the vote, recounts are impossible to trust. People trust their money in their accounts and they trust that the financial system and software can track that. We need to move to something like that pronto with receipts, digital voting, ability to check your vote, data tracking, ability for researchers to get access to it, fraud protection and more.

wpdev_63 8y ago

It's asinine that we are still debating this. There really isn't much to debate at this point.

macawfish 8y ago

Sounds like a feature, not a bug (sadly)

TomMckenny 8y ago

Voting machine manufacturers have vast funds and lobbyists. Even when congress did manage to in a act bipartisan manner, lobbyists persuaded the white house to kill it.[0] You'll find plenty of incredibly destructive practices (nearing national suicide actually) caused by money in politics and worsened catastrophically by Citizens United. [0]Secure Elections Act. https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2018/08/31/the-cybersecurity-202-why-the-latest-election-security-bill-is-stalled-in-congress/5b8829fb1b326b3f31919eaa/?noredirect=on&utm_term=.706defb93737 https://www.washingtonpost.com/news/powerpost/paloma/the-cyb...

neonate 8y ago

http://archive.is/g1sAr http://archive.is/g1sAr