11 ms·
US mid-terms: Hackers expose 'staggering' voter machine flaws
- michaelmrose 8y agoThe big question is what do we do about it? What do we do if an election is actually stolen?
- close04 8y agoThe only correct answer should be hack them. But hack them in a way that's so obvious and outrageous nobody will ever try to claim they're "good enough" or "the only way forward".
- sshagent 8y agoThis i like. Reminds me of the Blackadder politics/voting episode where despite there being 1 voter there is 16,472 votes. Some result where 10 times the voters all vote for one candidate.
- close04 8y agoAny result where one candidate can have a landslide win with 120% of the votes.
- jimhefferon 8y agoGeorgia just had all these things happen, including one precinct with a 243% turnout. https://arstechnica.com/tech-policy/2018/08/georgia-defends-voting-system-despite-243-percent-turnout-in-one-precinct/ https://arstechnica.com/tech-policy/2018/08/georgia-defends-... No outrage appeared.
- deleted 8y ago[deleted]
- simias 8y agoI'm sure that even if you're doing it with good intentions getting caught hacking voting machines could put you in a lot of troubles. If people here seriously want to try that make sure you understand the risks you're taking.
- maxden 8y agoI think an effective way of doing it would be to make numbers very close to an expected result but they have a simple mathematical relationship to each other, so they get widely published and aren't picked up straight away and hidden, and then show that they are all divisible by 46 or something.
- dwiel 8y agoYou would just be labeled a conspiracy theorist for pointing out such a coincidence.
- tetha 8y agoYou just gave me the mental image of a worm which targets voting machines and has them run pacman or space invaders. Bonus points if it quickly re-infects machines, or persists in ways they cannot remove. That'd be something to launch during a major election. It's illegal and dangerous to whomever does this. But at some point, nothing but blunt disobedience works.
- ataturk 8y agoMy theory is that exactly what you suggested was done in the 2016 election. The remaining patriots at the NSA and other places knew about the massive fraud and got together and fixed it right under the noses of the corrupt. That is my theory and in probably 20 years the history will be finally told after it all gets declassified.
- moviuro 8y agoGo back to manual count, have people count the votes, and citizens check over their shoulders, as it should be. It's still the case in e.g. France (larger voting pop than any one US state). There should be zero trust in an election. Citizens don't have to trust the party or any machine. https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI
- Jaruzel 8y agoThe UK is the same. No-one here seems to be asking 'WHY' there's even a need for electronic voting machines? Paper and pencil manual voting will always be safer as it's almost impossible to game the system when there's 10,000+ unpaid volunteers double checking each others counting. Electronic Voting is a solution looking for a problem. It's only advocated by the losing parties, as they are convinced that making it 'easier' to vote (really? It's not like it's hard) will get more bums off seats and into polling stations, which will increase their chances of winning said election. NASA spent millions on a space pen, that never worked properly; The Soviet Union just used a pencil.
- TeMPOraL 8y ago> NASA spent millions on a space pen, that never worked properly; The Soviet Union just used a pencil. Someone has to, might as well be me. The reason you want a pen in space instead of a pencil is that graphite can chip off, and cause lethal danger to electronics and (consequently) crew.
- maxerickson 8y agoIt's just a silly urban legend anyway. Fisher developed the space pen independently. https://en.wikipedia.org/wiki/Writing_in_space https://en.wikipedia.org/wiki/Writing_in_space Grease pencils and felt tipped markers were among the early alternatives.
- Jaruzel 8y agoI knew it was. I forgot to put the /s sarcasm on my post!
- code_duck 8y agoBased on the last 20 years, nothing. There is no effective recourse.
- eru 8y agoVoting with your feet is highly effective.
- code_duck 8y agoThat doesn’t truly set things right, though. It’s a compromise for you, and doesn’t fix things for the country itself. In fact the ‘good’ people leaving makes the country even worse.
- eru 8y agoMoves more people into better countries. (So the population-weighted average country gets better, too.) Why care specifically about the country you are leaving?
- yostrovs 8y agoIt depends on the party in power. What you think should, won't matter. Most people accept the opinions, decisions, and accusations of the party they support.
- go_away_nsa 8y agoimpossible, Obama assured us last election that it was impossible to hack an election and that anyone complaining was just a conspiracy theorist or a sore loser. All these conspiracy theories are making me tired, everybody should just go to sleep and stop worrying about our voting machines being compromised
- thanatropism 8y agoThe bigger question is -- how do you know? Compare results to statistical polls?
- latchkey 8y agoI'd love to see someone hack a major election in such a way that the election is undeniably invalid. I'm guessing make the vote count 0. That is probably the only way to get this resolved. While we can endlessly bring the hacking of machines into the light, it has yet to prove itself to be enough to change anything. Especially if some of these hacks have been around for a decade.
- coldcode 8y agoI consider it completely unimportant who in the party will vote, or how; but what is extraordinarily important is this — who will count the votes, and how - Stalin.
- mikeash 8y agoI don’t think that would do anything. It would be immediately noticed and corrected, and people’s lesson would be that the system works.
- swarnie_ 8y agoI'll admit i started skimming the article from about half way though but i didn't see any mention of what these flaws actually are?
- andrewla 8y agoApparently there is a report from Defcon that describes in more detail what the vulnerabilities are [1]. I have not yet had a chance to make a more detailed review. [1] https://defcon.org/images/defcon-26/DEF%20CON%2026%20voting%20village%20report.pdf https://defcon.org/images/defcon-26/DEF%20CON%2026%20voting%...
- JdeBP 8y agoLess skimming and more following hyperlinks leads from this news coverage to the actual report, where details can be found. * https://news.ycombinator.com/item?id=18112172 https://news.ycombinator.com/item?id=18112172
- marcyb5st 8y agoI love [this video](https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI) from Tom Scott in which he explains quite well why e-voting is inherently bad. I am very happy that here in Switzerland, even if we have to vote several times every year, we still do it the old fashion way :).
- moviuro 8y agoObligatory XKCD: https://xkcd.com/2030/ https://xkcd.com/2030/
- marcyb5st 8y agoYES!
- kwhitefoot 8y agoOne of his best! I especially like the tooltip.
- ben_utzer 8y ago..and then you see people on Facebook bragging with more than one voting form/letter in their hands.. Not the best example of "unhackable" system...
- marcyb5st 8y agoStill, having few people casting two or more votes is much more secure of potentially having a successful attacker changing votes for thousands or even millions. We are talking about several orders of magnitude in difference. So yes, I take the paper system every day.
- moviuro 8y agoDepends how it's done. In France, we register only once in the country, in our "voting neighborhood". Once you enter the voting building, you give your ID, sign the register, go to the voting cell, put your vote in an envelope, give your sealed envelope to be counted in a sealed box that has a mechanical counter for each envelope it gets. Unhackable, because anyone can check the counter, count the signatures, and participate to the closing count of cast votes. The real issue is if you can get inscribed on two different voting neighborhoods though... is that what you describe? (which shouldn't happen, given how long it takes to get your name on one voting list, since the gvt probably crosses your name out of all other voting neighborhoods when you do)
- endymi0n 8y agoUnfortunately, the current alternative to e-voting is long, tedious and non-realtime. Recently I had an idea about how to go at this: The elephant in the room is that you're trusting a single for-profit party with the accuracy of the result. If you want to assure much more tamper-proof results, the key would be making this an adversarial task between a voting and a verification machine. Have a voting machine count the vote and print a receipt. Standardize an interface between the voting and the verification machine which is a transparent plastic window where the voter can physically view his choice before pushing the button at the verification machine that draws in the voting ticket, verifies the vote, counts it again and stores the physical paper for retrieval (and regular, infrequent audit). Make the voting and verification machine vendors adhere to the standard interface, let them face steep penalties for any deviation between voting and verification result, forbid any common ownership between the companies and never let any of these companies supply more than 50% of machines for any given election.
- maxerickson 8y agoI've had the good luck to vote in elections where I just mark a paper ballot with a, uh, marker. I wouldn't call it tedious, it takes longer to read the names for a seat or an issue than it does to make a mark. Then it goes into a scanner/lock box, so there's a count available right when the poll closes...
- wazoox 8y agoCome on, it's a couple of hours of work, and it's the occasion to understand the democratic process and do your civic duty by participating to the ballot count. Having fair elections beats real-time results hands down.
- bochoh 8y agoNot to mention that you get mandated time off (iirc 4 hours unimpeded by work) to vote on election days here in the states. There are some caveats and restrictions on getting this time but it does ensure you can get to the polls even with a odd work schedule.
- aasasd 8y agoI still remember how Diebold's machines turned out to be insecure. That was in 2009.
- majewsky 8y agoI remember when the CCC installed a chess program on a NEDAP machine. That was in 2007: https://www.ccc.de/system/uploads/3/original/nedapReport54-1.pdf https://www.ccc.de/system/uploads/3/original/nedapReport54-1...
- Moru 8y agoHow many years of debugging the manual system for flaws, how many security bugs have been fixed already? The paper system has been tried and tested for many many years and we all agree that it's working and is secure. Why do we want to throw this out for having live results? Is it about saving money? How much do we save if something goes wrong? Both systems can be broken by propaganda anyway. That one is also well tested.
- ataturk 8y agoThe paper system is not "working and secure." Witness the election of Al Franken in MN and how trunkloads of hitherto unknown ballots arrived just in time to tip the scales in his favor. Realize that such an occurrence happens with alarming frequency in many lesser elections around the US. Left or right, doesn't matter--I demand a better voting system first and foremost, one with with ID checks as well as fraud prevention mechanisms that are taken seriously. BTW, my sister-in-law's first job as a prosecutor was to try voter fraud cases because that's the shit work they give to newbies. Voter fraud cases are the lowest priority type of cases in the county I reside in. Also, she was given two cases and failed to prosecute either one even though both parties were guilty as hell and had voted multiple times in the 2012 election. It could not be more clear what is going on and who is behind it all, but nobody wants to fix it because it would expose all kinds of other wrongdoing and it would call into question the integrity of the entire system. Can't have that! It's just like when Americans lived under the British Crown--all manner of corruption and wrongdoing was swept under the rug for reasons of incompetence, covering for "old boys" in the network, or just because an aura of perfection had to be created so that the huddling masses would not rebel. Here's the truth: The US needs to get rid of its autocrats and oligarchs and restore the power to the people.
- empath75 8y ago> Why do we want to throw this out for having live results? The supposed impetus for the change was the hanging chads controversy in florida in 2000.
- cyborgx7 8y ago*voting computers
- athenot 8y agoVoting machines are a solution in search of a problem. The whole point of automation is to save on labor, at the cost of simplicity. Machines are excellent at handling complexity that some experts can come up with and can execute it reasonably well. Except that this is precisely the opposite of what's desired in an election. Voting is one situation where it is DESIREABLE to have many people manually involved in a simple process. Auditing voting machines requires a pretty in-depth knowledge of information systems and experience with a lot of edge cases. Proprietary voting machines only make auditing worse, basically hiding all flaws behind a curtain of marketing and legal threats. Over 95% of the citizens have no way of auditing the integrity of the results and have to put blind faith in for-profit corporations who are (1) disincentivized from disclosing flaws and (2) do not suffer penalties when security flaws are found to be present by researchers. In a paper scheme, it takes more human effort to tally an election, but every citizen can participate in that process, and the others can safely observe and easily understand what's going on. The only downside is that it may take a few hours instead of seconds. But latency is infinitely preferable over opacity and potential inaccuracy. I used to think e-voting would be OK if there was a requirement to use open-source voting software but even that is problematic. As a software engineer, it would be my pride to be able to help, however that would still be depriving non-software people from the ability to participate in the process, and I feel that is wrong. Now that my focus at work is on building resilient systems, I believe paper is the way to go, especially considering one of the other requirements is secrecy.
- IshKebab 8y ago> Voting machines are a solution in search of a problem. Not really. If done properly they would allow faster and cheaper vote counting, a more secure audit trail and the ability for voters to verify that their vote was recorded properly. But they do seem to be one of those things where the government is happy to just hand out bags of money to rubbish vendors and then wonder why it doesn't work. Reminds me of the NHS digitisation fiasco.
- heavenlyhash 8y agoThose are just some assertions you made, most of which are considered "wrong" by experts who have spent time in this domain. > cheaper You realize we get to use volunteer labor here. > more audit That's broadly dissented unless you presume a given-by-god form of "done properly" and no-true-scotsman your way out of any constructive discussion. > ability for voters to verify their vote ALSO broadly dissented or at best extremely nontrivial. Blinded cryptographic operations are the territory you're talking about if you want to be in the ballpark of correct, and while the theory exists, the practice is again... not a given. I'm not even sure the theory is fully available for this domain. Remember, one of the core concepts in a functional democracy is a secret ballot. This is essential to avoiding Some Very Nice People hovering just outside the polling place to make sure everyone in the area voted "correctly".
- daphneokeefe 8y agoI am a pollworker in San Francisco. On voting day, there is an army of us temps working at polling places all over town from 6am until 10pm or later, for about $150. The city is having a very hard time recruiting people for those long hours on a work day. We have very old fashioned voting machines that scan ballots marked by voters by hand. The paper ballots are retained in the machine after being scanned, and are picked up at the end of the day by sheriffs deputies. There is another army of mostly city employees working all day and night, for several days, suporting the polling places (in a dozen languages) and processing all of the ballots. So it is indeed a costly system. We have been able to vote by mail for many years, but for various reasona, about half of the voters prefer to come to the polling place to cast their ballot (and get an "I voted" sticker). Meanwhile, Washington, Oregon and Colorado have only voting by mail. No voting machines no polling places, no army of workers all over town. No doubt there are issues with processing those ballots as well, but it removes the voting machines from the vulnerable spots in church dining halls and residential garages all over town.
- majewsky 8y ago> On voting day, there is an army of us temps working at polling places all over town from 6am until 10pm or later, for about $150. That's generous. In Germany, the usual compensation for working 12-14 hours at a polling place is 30-50 € (35-57 $). Yet there are plenty volunteers (including me). Many like the idea of fulfilling some civic duty, especially one that's a one-day job instead of a long-term office.
- daphneokeefe 8y agoFor comparison, that is below the local minimum wage of $15 per hour.
- majewsky 8y agoYes, and the same applies to my example, even more extremely in fact. 12 hours of minimum wage would be around 100€, so 30-50€ is not even half of that.
- throwawaymanbot 8y agoThis is by design.. Its actually a mechanism for allowing a particular grand ole party that's not as popular as it makes out (what with shifting demographics etc) and unable to win elections (due to their insane policies) win elections.