14 ms·

CISA: The November 3rd election was the most secure in American history

147 points by cmurf 6y ago

maxharris 6y ago
https://sneak.berlin/20201112/your-computer-isnt-yours/ https://sneak.berlin/20201112/your-computer-isnt-yours/
- auslegung 6y ago
  I don’t understand the connection to the OP url
  - zepto 6y ago
    There is no connection. ‘Maxharris’ is astroturfing.
    - bfuclusion 6y ago
      Yeah, this is the second article I've run across with a non-sequitur link.
      - deleted 6y ago
        [deleted]
    - dang 6y ago
      You broke the site guidelines with this, as well as being quite mistaken. (These are two legit users with no connection to each other, one of whom went a bit overboard with linking to a post.) Would you please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules? They include: "Please don't post insinuations about astroturfing, shilling, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data." In the future, if you are genuinely concerned about astroturfing, please follow the rules and email us. We will investigate and get back to you. It's important for community here that HN users get out of the habit of cheaply smearing each other in response to something they don't like. It's 100x harder to respond to swipes like these than it is to post them in the first place, plus it's off topic. There's lots of past explanation here: https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix=true&page=0&query=by:dang%20astroturf https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...
  - maxharris 6y ago
    The possible connection I see: who watches the watchers? What's the difference in trusting CISA vs PRISM? I have no ill intent, and I find all of this stuff distressing.
    - sneak 6y ago
      Please do not spam links to my website, on HN or anywhere else.
      - maxharris 6y ago
        Ok, I won't. Sorry!
deleted 6y ago
[deleted]
nmlnn 6y ago
TIL, electronic voting machines are CLOSED SOURCE (hardware and software) - that should be completely unacceptable in an open democracy. It makes me wonder how a statement like this can be proved. > There is no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised When it comes to something as important as elections the mantra should be: don't trust. verify.
- kube-system 6y ago
  I don’t see security flaws with closed source software that prints backup paper ballots. If anything, it’s better than an open source machine that doesn’t print a paper backup. Those paper backups can be even audited by the voter at the moment they vote. You’re not going to be dumping the source code from a voting machine that is in use.
  - noworriesnate 6y ago
    There’s no need to compromise. When it comes to making elections trustworthy, we should pull out all the stops, even if it’s slightly inconvenient to make the software open source.
    - kube-system 6y ago
      Does any company offer a competitive voting machine with open source software?
  - callinOutLiars 6y ago
    Security through obscurity is a horrible way to secure anything, but especially voting machines.
  - dllthomas 6y ago
    > I don’t see security flaws with closed source software that prints backup paper ballots. There's room for asymmetric errors in input, in the direction of a favored candidate. Still way better than the kinds that are electronic only, but not as good as paper-first.
Someone1234 6y ago
Eight states[0] still have electronic voting systems without paper backups. They're un-auditable. I'm not going to weigh in on the current politics of this situation, but US Election security is awful, now, and since at least 2000. I actually did my degree thesis on designing electronic voting systems (and built one), and ultimately concluded it was impossible to make them fully secure. The best you can do is paper backups and random audits to detect anything illicit followed by a full audit if that fails. No paper backups results in it being undetectable. Computers are good at making things more efficient, but in terms of election security the inefficiency is a feature (i.e. it takes more people to alter votes, and the more people you add the harder a lie is to keep). [0] https://thehill.com/policy/cybersecurity/457168-report-says-eight-states-to-use-paperless-voting-in-2020-despite https://thehill.com/policy/cybersecurity/457168-report-says-...
- exabrial 6y ago
  I'd rather have someone hack 1700 local elections than one 'national standard' quite frankly. The inefficiency delights me
  - vvanders 6y ago
    People are always rallying to add blockchain for voting without realizing that the paper ballot is a proof of work that predates it by a significant margin.
    - exabrial 6y ago
      Yep. I approve both measures
  - blackflame7000 6y ago
    Yea that's the only way to do it.... instead of some sort of software that's bad like a malicious software or Malware if you will that changes votes silently
  - mehrdadn 6y ago
    I don't think you need to hack 1700 local elections to swing the vote.
endtime 6y ago
No chain of custody, closed source voting machines, ballots sent to people who didn't ask for them based on known-bad voter rolls...but sure, I'll just take some random government agency's word for it.
- idlewords 6y ago
  Better than taking some Hacker News rando's blanket dismissal of the work of thousands of poll workers across the country.
  - shripadk 6y ago
    10,000 votes were discarded by a Court in Pennsylvania [1]. At least someone in US is bothered about making sure the elections were held in a legit manner rather than some Hacker News rando's blanket dismissal of allegations of voter irregularities! [1]: https://www.forbes.com/sites/alisondurkee/2020/11/12/pennsylvania-judge-rules-in-favor-of-trump-campaign-orders-state-cant-count-some-ballots/?sh=e754e536c122 https://www.forbes.com/sites/alisondurkee/2020/11/12/pennsyl...
    - tylerhou 6y ago
      These dismissed ballots weren’t even electronic; they were mail-in ballots that were cured during an extended deadline. While I disagree with throwing out any vote, the ballots were thrown out because they didn’t comply with the law, not because a third party interfered or hacked the election system. You can disagree with the law (and disagreeing in this case is reasonable!), but that doesn’t mean our elections are insecure.
      - shripadk 6y ago
        > While I disagree with throwing out any vote, the ballots were thrown out because they didn’t comply with the law, not because a third party interfered or hacked the election system. I am sorry but I never said or implied anywhere that a secure electoral system means it cannot be interfered/hacked. You don't need to hack if you have insiders do the bidding for you. But let us keep conspiracies aside for a minute. The issue is not even someone attacking the system. The system is weak in and itself. Why? There have been many "software glitches" that switch votes from one candidate to another literally overturning the election result. Be it Antrim County or Oakland County. These "glitches" or in some cases "human errors" show the elections are not secure. How can you call something "secure" when you have 6000 votes switching from one candidate to another? You don't even need a foreign actor to destabilize the elections when the system is so poorly designed that it can screw up on its own! https://www.freep.com/story/news/local/michigan/oakland/2020/11/06/oakland-county-election-2020-race-results/6184186002/ https://www.freep.com/story/news/local/michigan/oakland/2020... Quoting: “Apparently, there was a technical glitch in Rochester Hills. And so I actually ended up winning by a little over 1,100 votes,” said a chuckling Kochenderfer. The margin was 1,127 votes, to be exact. That gave him a 51.67% share of the total (with 48.23% going to his opponent, Hartman). The fresh result buoyed the incumbent’s spirits but also had him worried about how to prevent future election errors, he said. “I’m very grateful to the officials who caught the error, but we need to ensure that we catch these issues, or prevent them entirely,” Kochenderfer said. "People are acting like fixing our elections is a partisan thing when it shouldn't be partisan," he said, adding, "we do have a very, very good clerk in Rochester Hills." “A computer issue in Rochester Hills caused them to send us results for seven precincts as both precinct votes and absentee votes. They should only have been sent to us as absentee votes,” Rozell said in a text message.
leric 6y ago
oh, really
threatofrain 6y ago
The head of CISA will likely be forced out for this. https://www.politico.com/news/2020/11/12/cyber-official-chris-krebs-likely-out-436342 https://www.politico.com/news/2020/11/12/cyber-official-chri...
- deleted 6y ago
  [deleted]
- andrewflnr 6y ago
  That would be sad. For a politician/executive type, he seems like a decent fellow.
Hawkenfall 6y ago
How was this quantified? If there are numbers to demonstrate it's the most secure compared to previous years, why not show them? Qualitative statements with no foundation only draw speculation.
blackflame7000 6y ago
This is just patently ridiculous.
refurb 6y ago
The first thing that came to mind was that quote from the Richard Jewell movie (which is a good watch). Jewell's lawyer has a secretary with an Eastern European accent and they are talking about a newspaper article where the gov't says they have evidence that Jewell is the Olympic Park bomber. “Where I come from, when the government says someone's guilty that's how you know they're innocent,” she says. “It's different here?”
- TechBro8615 6y ago
  Incidentally, that same lawyer is now working on election fraud cases for Trump.
Thorentis 6y ago
On what basis? Because there aren't any rumors of Russian meddling being sowed by the opposition this time? There are multiple states with no paper audit trail, closed source electronic voting machines, multiple dubious last-minute decisions made around postal ballots due to COVID, no easy way to verify the voter roll. Making a claim like this reeks of partisanship.
- getlawgdon 6y ago
  Your comment assumes the nature of wrongdoing is equivalent on both sides.
  - chordalkeyboard 6y ago
    Isn't that the null hypothesis?
- chiefalchemist 6y ago
  "Unprecedented" times. An "unprecedented" election. An "unprecedented" election process. And no problems. Really? FEMA, also a gov-based entity, has had multiple "practice rounds" and it still can't get it right. Rare does the gov get it right, let alone first time. I have to stick with the tried and true: Trust but verify. And self-verification isn't good enough.
- jkhdigital 6y ago
  Wow this comment has been here for 2 hours and isn’t drowning in downvotes...
- rsynnott 6y ago
  > Making a claim like this reeks of partisanship. Ah, yes, CISA, that noted partisan Democrat-loving group: > The Cybersecurity and Infrastructure Security Agency (CISA) was established on November 16, 2018 when President Donald Trump signed into law the Cybersecurity and Infrastructure Security Agency Act of 2018 [..] > On November 13, the United States House of Representatives voted unanimously to pass legislation creating the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security (DHS). Very partisan, assuming you accept that the Democrats and Republicans are one party.
throwawydedbee 6y ago
Many techies want Biden. Others want Trump. Many would probably prefer someone else. But very, very few would see the integrity of this election as more than an intern-level joke. If you've ever worked in an environment where money was changing hands (banking, trading, etc) or where security was the real deal (three-letter agencies), or even in the insurance industry, you know that election integrity controls are a half-baked freshman project by comparison. (For myself, I don't care who wins. I don't believe it matters. But don't piss on me and tell me it's raining.)
ncal 6y ago
talk about bullshit..
motohagiography 6y ago
Was there a reason CISA needed to release a statement? I haven't seen anything controversial in the news. As they say, if you have to say it... I have a few comments going back a couple of years predicting how electronic voting will cause civil unrest because it is so vulnerable to being discredited. Edward Snowden even recently tweeted a prof's video about the same thing. Everybody who had given the issue any serious thought at all already knew it was an inevitable problem. Luckily, the U.S. has a process for dealing with contested election results, and the parties will litigate it to its final state. I'm just hoping for a very cold winter to keep people inside.
- deleted 6y ago
  [deleted]
- evan_ 6y ago
  > Was there a reason CISA needed to release a statement? I haven't seen anything controversial in the news. You haven’t been paying attention, then. Trump has been screaming fraud for days. This statement is a direct response to a completely baseless, evidence-free claim he made earlier today that 2.7 million votes for him were destroyed.
- untog 6y ago
  > Was there a reason CISA needed to release a statement? I haven't seen anything controversial in the news. Perhaps not if you read reputable outlets but if you take a look on Facebook, Twitter (including the President’s account) and YouTube you’ll find a frenzy of conspiracy theories about voter fraud. None of it with any real evidence attached, but it’s spreading like wildfire in many social circles. Of course, this statement won’t really do anything. If you were the “Deep State” rigging an election this is exactly what you’d order CISA to say!
- mapme 6y ago
  It has been all over the news in the US of trump claiming voter fraud. Apnews fact check has been full of the debunked claims in the last few days. https://apnews.com/article/election-2020-ap-fact-check-joe-biden-donald-trump-technology-13c104367924b8192b4fcecf334f7806 https://apnews.com/article/election-2020-ap-fact-check-joe-b... https://apnews.com/article/ap-fact-check-election-dead-voter-claims-fc7ba254fd37059f63ea764c18c2a4cb https://apnews.com/article/ap-fact-check-election-dead-voter... https://apnews.com/article/election-2020-joe-biden-donald-trump-politics-media-1bf96bf3910bdcbe0f125958357c8f1a https://apnews.com/article/election-2020-joe-biden-donald-tr... https://apnews.com/article/election-2020-joe-biden-us-news-media-michigan-43bdaa186e3b8d9d897cae3bd0c6cdc0 https://apnews.com/article/election-2020-joe-biden-us-news-m... https://apnews.com/article/election-2020-ap-fact-check-joe-biden-donald-trump-virus-outbreak-79c34b72633683af195ae945503883fe https://apnews.com/article/election-2020-ap-fact-check-joe-b...
shripadk 6y ago
https://www.forbes.com/sites/alisondurkee/2020/11/12/pennsylvania-judge-rules-in-favor-of-trump-campaign-orders-state-cant-count-some-ballots/?sh=e754e536c122 https://www.forbes.com/sites/alisondurkee/2020/11/12/pennsyl... I don't understand how you can say the Election was the "most secure" when you literally have a Court in Pennsylvania throw out 10,000 ballots! If the system was so "secure" it shouldn't have even gone to the Courts in the first place and instead the electoral system should have found out the discrepancies on its own! The truth is that US electoral system is full of flaws and it showed through this election!
- dragonwriter 6y ago
  > I don't understand how you can say the Election was the "most secure" when you literally have a Court in Pennsylvania throw out 10,000 ballots! Because that wasn't an election security issue, and it wasn't (at least you source does not say it was) 10,000 ballots. “It is unclear how many ballots will be affected by the ruling, but [...] Philadelphia County, the largest county in the state, only flagged 2,100 ballots that had identification issues.” And this wasn't affecting all the ballots flagged with ID issues, only those that were cured after the original deadline and before the challenged extended deadline. > If the system was so "secure" it shouldn't have even gone to the Courts in the first place and instead the electoral system should have found out the discrepancies on its own! It...did detect them on its own. The Court case is about the legal authority for the administrative mitigation.
  - shripadk 6y ago
    I answered in more detail here: https://news.ycombinator.com/item?id=25078905 https://news.ycombinator.com/item?id=25078905 > (at least you source does not say it was) 10,000 ballots It does. Quoting: "The U.S. Supreme Court could also still potentially invalidate Pennsylvania’s extended mail-in voting deadline, which allowed mail-in ballots postmarked by Election Day to be accepted as long as they were delivered by Friday, Nov. 6. That ruling would only affect approximately 10,000 ballots, elections officials have said—which are being segregated and are not included in the current vote count—and thus invalidating them would not affect Biden’s win in Pennsylvania." The idea being that it doesn't have anything to do with who won or lost. It is more to do with the fact that the ballots are being contested in the Courts when it should have been the electoral system actually ensuring integrity. Court should be the last resort. I give my reasons in the answer above.
throwawaysea 6y ago
In order to secure the vote we need open source machines, verifiable ballots (including online verification), complete chain of control, body cams on anyone handling ballots, transparency to public and party observers via cameras, multiple isolated tabulations (verifying they all agree), and also strongly verifiable voter ID. Nothing in this process should be left up to chance. I don’t accept the stance that a lack of evidence of fraud means that fraud isn’t happening or that a better process shouldn’t be designed.
- aw1621107 6y ago
  > verifiable ballots (including online verification) Is this at odds with secret ballots?
  - airstrike 6y ago
    Not if you split the info on the ballot in two halves, who voted vs. who they voted on
    - aw1621107 6y ago
      Ah, that's a slightly different definition of verifiable than I had in mind. I was thinking of schemes to allow voters to not only verify that they voted, but that their vote counted towards their intended candidate. I suppose it depends on what precisely is to be verified. The scheme you describe allows for verification that a ballot has been received/sent/counted, depending on details, which may or may not be verifiable enough depending on who you ask.
0xy 6y ago
A laptop and USB drive used to program voting machines were stolen right before the election according to the Associated Press. [1] The company who claims they cannot be used to manipulate machines has a laundry list of serious security lapses and incompetence. [2] Including remote-access to voting machines?!?! uncovered by the New York Times in 2018. [3] [1] https://apnews.com/article/voting-machines-voting-custodio-elections-philadelphia-f8a6453dc9e211ef20e9412d003511b1 https://apnews.com/article/voting-machines-voting-custodio-e... [2] https://en.wikipedia.org/wiki/Election_Systems_%26_Software#Controversies https://en.wikipedia.org/wiki/Election_Systems_%26_Software#... [3] https://www.nytimes.com/2018/02/21/magazine/the-myth-of-the-hacker-proof-voting-machine.html https://www.nytimes.com/2018/02/21/magazine/the-myth-of-the-...
ponker 6y ago
Everyone is saying this because Donald Trump is a dangerous moron but the fact is that the election process in the US is a complete basket case, most notably in the number of people it excludes from voting by design.
jungletime 6y ago
This can't be True, when 6000 votes where reversed in Michigan county from one of these machines. This is a fact. Not some made up BS. You either have a machine tallying the votes that works 100% of the time during the election. Otherwise, everyone can reasonably question the results from a machine that works 99% of the time. 6000 votes can't be going to the wrong candidates and the same time the election be "secure" in the mind of most reasonable people. Here's the story. https://www.youtube.com/watch?v=YeEW1oeLaVE https://www.youtube.com/watch?v=YeEW1oeLaVE
- ttul 6y ago
  You’re actually linking to a Sean Hannity segment on YouTube as your source?
  - jungletime 6y ago
    New York Post Article, hope this satisfies. https://nypost.com/2020/11/06/michigan-gop-claims-software-issue-undercounted-trump-votes/ https://nypost.com/2020/11/06/michigan-gop-claims-software-i...
    - detaro 6y ago
      An error happening, being discovered and corrected through validation (that at least according to some reports is going to be always done before certification of the result: https://mobile.twitter.com/jhalderm/status/1325163300699648000 https://mobile.twitter.com/jhalderm/status/13251633006996480... ) seems like the overall system working just fine? Something to fix (why have the early machine result if it's so easily broken), but doesn't seem that different than someone fat-fingering a number while reporting etc.
      - jungletime 6y ago
        You either have a machine tallying the votes that works 100% of the time during the election. Otherwise, everyone can reasonably question the results from a machine that works 99% of the time.
Animats 6y ago
"All of the states with close results in the 2020 presidential race have paper records of each vote, allowing the ability to go back and count each ballot if necessary."
jungletime 6y ago
Its so secure you can't even post a link to anything claiming it was not secure, without it being flagged on here. This is bonkers. On the same level as Iran claiming not to have gay people. Hint hint hint ... because they kill the ones that admit to being gay.
jariel 6y ago
A possible solution to the electronic/paper issue might be literally just receipts. You vote in a 'machine' and it prints a 2 receipts - one for the 'backup' and one that you keep with some kind of encrypted/encoded data for non-repudiation. You go online with your private receipt number and it can validate your vote. If the electronic count is not accepted, the physical 'receipts' are coded so they can be counted very quickly by laser scanner.
- aw1621107 6y ago
  > You go online with your private receipt number and it can validate your vote. What precisely do you mean by "validate" here? Would this scheme make the ballot non-secret?
  - 01100011 6y ago
    If each ballot has a unique ID and there is no association between the person voting and the ID, then the voter can retain that number, possibly by tearing off a section of the ballot as is done in CA, and check that number online to verify their vote was tallied as expected.
    - deleted 6y ago
      [deleted]
    - aw1621107 6y ago
      > there is no association between the person voting and the ID, then the voter can retain that number This seems somewhat contradictory. The voter retaining possession of the ID creates a link between the ballot and the voter, doesn't it? Then again, it does open the door to plausible deniability, though correctly pulling that off could introduce new complications and/or avenues of attack. > and check that number online to verify their vote was tallied as expected. "as expected" is the key phrase here. If it includes seeing what candidate(s) the voter voted for (i.e., trying to verify that the ballot was read correctly), then that seems like it would break the secret ballot. If it means just checking that the ballot was included in the count without revealing precisely what candidate(s)/issue(s) the vote was for, then that might work.
jungletime 6y ago
Sine I get flagged when I post anything contrary or questioning the narrative of this story that this was the most secure election... I might as well post a better story. "The Dear Leader Kim Jong-Il was born inside of a log cabin beneath Korea’s most sacred mountain, where upon the moment he came into this world, a shooting star brought forth a spontaneous change from winter to summer, and for the icing on the birthday cake: a double rainbow."
rendall 6y ago
There are lots of good ideas to make US elections more secure and trustworthy that are low-hanging fruit, easily implemented. Here's my prediction: None of these excellent ideas will be implemented by either party, and so people will continue to be baffled by the US system. "How is it possible that the US has such chaos every election season?" The potential for bumping up "our guy" in a close race is way too appealing to the party in power. When the reigns change hands, the new party could take the time to tighten election security, but to what benefit? They are now in control. Making things more fair to the other team would only hurt their chances. Election fraud is deeply ingrained in the long democratic political history of the US, from the very beginning. Direct democracy was an untried, unknown concept when the country started. No one but a few ivory tower eggheads who read dense philosophy books really understood what it was all about: "You mean if our guy gets more pieces of paper into that box than the other guy, we can award ourselves all of the government contracts?" It didn't even necessarily start out as nefarious or unethical, just clueless.
Fnoord 6y ago
See also "2020 Is An Election Security Success Story (So Far)" [1] which Bruce Schneier referenced and summarized here [2] [1] https://www.lawfareblog.com/2020-election-security-success-story-so-far https://www.lawfareblog.com/2020-election-security-success-s... [2] https://www.schneier.com/blog/archives/2020/11/2020-was-a-secure-election.html https://www.schneier.com/blog/archives/2020/11/2020-was-a-se...

147 points by cmurf 6y ago

maxharris 6y ago

https://sneak.berlin/20201112/your-computer-isnt-yours/ https://sneak.berlin/20201112/your-computer-isnt-yours/

auslegung 6y ago
I don’t understand the connection to the OP url
- zepto 6y ago
  There is no connection. ‘Maxharris’ is astroturfing.
  - bfuclusion 6y ago
    Yeah, this is the second article I've run across with a non-sequitur link.
    - deleted 6y ago
      [deleted]
  - dang 6y ago
    You broke the site guidelines with this, as well as being quite mistaken. (These are two legit users with no connection to each other, one of whom went a bit overboard with linking to a post.) Would you please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules? They include: "Please don't post insinuations about astroturfing, shilling, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data." In the future, if you are genuinely concerned about astroturfing, please follow the rules and email us. We will investigate and get back to you. It's important for community here that HN users get out of the habit of cheaply smearing each other in response to something they don't like. It's 100x harder to respond to swipes like these than it is to post them in the first place, plus it's off topic. There's lots of past explanation here: https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix=true&page=0&query=by:dang%20astroturf https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...
- maxharris 6y ago
  The possible connection I see: who watches the watchers? What's the difference in trusting CISA vs PRISM? I have no ill intent, and I find all of this stuff distressing.
  - sneak 6y ago
    Please do not spam links to my website, on HN or anywhere else.
    - maxharris 6y ago
      Ok, I won't. Sorry!

deleted 6y ago

[deleted]

nmlnn 6y ago

TIL, electronic voting machines are CLOSED SOURCE (hardware and software) - that should be completely unacceptable in an open democracy. It makes me wonder how a statement like this can be proved. > There is no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised When it comes to something as important as elections the mantra should be: don't trust. verify.

kube-system 6y ago
I don’t see security flaws with closed source software that prints backup paper ballots. If anything, it’s better than an open source machine that doesn’t print a paper backup. Those paper backups can be even audited by the voter at the moment they vote. You’re not going to be dumping the source code from a voting machine that is in use.
- noworriesnate 6y ago
  There’s no need to compromise. When it comes to making elections trustworthy, we should pull out all the stops, even if it’s slightly inconvenient to make the software open source.
  - kube-system 6y ago
    Does any company offer a competitive voting machine with open source software?
- callinOutLiars 6y ago
  Security through obscurity is a horrible way to secure anything, but especially voting machines.
- dllthomas 6y ago
  > I don’t see security flaws with closed source software that prints backup paper ballots. There's room for asymmetric errors in input, in the direction of a favored candidate. Still way better than the kinds that are electronic only, but not as good as paper-first.

Someone1234 6y ago

Eight states[0] still have electronic voting systems without paper backups. They're un-auditable. I'm not going to weigh in on the current politics of this situation, but US Election security is awful, now, and since at least 2000. I actually did my degree thesis on designing electronic voting systems (and built one), and ultimately concluded it was impossible to make them fully secure. The best you can do is paper backups and random audits to detect anything illicit followed by a full audit if that fails. No paper backups results in it being undetectable. Computers are good at making things more efficient, but in terms of election security the inefficiency is a feature (i.e. it takes more people to alter votes, and the more people you add the harder a lie is to keep). [0] https://thehill.com/policy/cybersecurity/457168-report-says-eight-states-to-use-paperless-voting-in-2020-despite https://thehill.com/policy/cybersecurity/457168-report-says-...

exabrial 6y ago
I'd rather have someone hack 1700 local elections than one 'national standard' quite frankly. The inefficiency delights me
- vvanders 6y ago
  People are always rallying to add blockchain for voting without realizing that the paper ballot is a proof of work that predates it by a significant margin.
  - exabrial 6y ago
    Yep. I approve both measures
- blackflame7000 6y ago
  Yea that's the only way to do it.... instead of some sort of software that's bad like a malicious software or Malware if you will that changes votes silently
- mehrdadn 6y ago
  I don't think you need to hack 1700 local elections to swing the vote.

endtime 6y ago

No chain of custody, closed source voting machines, ballots sent to people who didn't ask for them based on known-bad voter rolls...but sure, I'll just take some random government agency's word for it.

idlewords 6y ago
Better than taking some Hacker News rando's blanket dismissal of the work of thousands of poll workers across the country.
- shripadk 6y ago
  10,000 votes were discarded by a Court in Pennsylvania [1]. At least someone in US is bothered about making sure the elections were held in a legit manner rather than some Hacker News rando's blanket dismissal of allegations of voter irregularities! [1]: https://www.forbes.com/sites/alisondurkee/2020/11/12/pennsylvania-judge-rules-in-favor-of-trump-campaign-orders-state-cant-count-some-ballots/?sh=e754e536c122 https://www.forbes.com/sites/alisondurkee/2020/11/12/pennsyl...
  - tylerhou 6y ago
    These dismissed ballots weren’t even electronic; they were mail-in ballots that were cured during an extended deadline. While I disagree with throwing out any vote, the ballots were thrown out because they didn’t comply with the law, not because a third party interfered or hacked the election system. You can disagree with the law (and disagreeing in this case is reasonable!), but that doesn’t mean our elections are insecure.
    - shripadk 6y ago
      > While I disagree with throwing out any vote, the ballots were thrown out because they didn’t comply with the law, not because a third party interfered or hacked the election system. I am sorry but I never said or implied anywhere that a secure electoral system means it cannot be interfered/hacked. You don't need to hack if you have insiders do the bidding for you. But let us keep conspiracies aside for a minute. The issue is not even someone attacking the system. The system is weak in and itself. Why? There have been many "software glitches" that switch votes from one candidate to another literally overturning the election result. Be it Antrim County or Oakland County. These "glitches" or in some cases "human errors" show the elections are not secure. How can you call something "secure" when you have 6000 votes switching from one candidate to another? You don't even need a foreign actor to destabilize the elections when the system is so poorly designed that it can screw up on its own! https://www.freep.com/story/news/local/michigan/oakland/2020/11/06/oakland-county-election-2020-race-results/6184186002/ https://www.freep.com/story/news/local/michigan/oakland/2020... Quoting: “Apparently, there was a technical glitch in Rochester Hills. And so I actually ended up winning by a little over 1,100 votes,” said a chuckling Kochenderfer. The margin was 1,127 votes, to be exact. That gave him a 51.67% share of the total (with 48.23% going to his opponent, Hartman). The fresh result buoyed the incumbent’s spirits but also had him worried about how to prevent future election errors, he said. “I’m very grateful to the officials who caught the error, but we need to ensure that we catch these issues, or prevent them entirely,” Kochenderfer said. "People are acting like fixing our elections is a partisan thing when it shouldn't be partisan," he said, adding, "we do have a very, very good clerk in Rochester Hills." “A computer issue in Rochester Hills caused them to send us results for seven precincts as both precinct votes and absentee votes. They should only have been sent to us as absentee votes,” Rozell said in a text message.

leric 6y ago

oh, really

threatofrain 6y ago

The head of CISA will likely be forced out for this. https://www.politico.com/news/2020/11/12/cyber-official-chris-krebs-likely-out-436342 https://www.politico.com/news/2020/11/12/cyber-official-chri...

deleted 6y ago
[deleted]
andrewflnr 6y ago
That would be sad. For a politician/executive type, he seems like a decent fellow.

Hawkenfall 6y ago

How was this quantified? If there are numbers to demonstrate it's the most secure compared to previous years, why not show them? Qualitative statements with no foundation only draw speculation.

blackflame7000 6y ago

This is just patently ridiculous.

refurb 6y ago

The first thing that came to mind was that quote from the Richard Jewell movie (which is a good watch). Jewell's lawyer has a secretary with an Eastern European accent and they are talking about a newspaper article where the gov't says they have evidence that Jewell is the Olympic Park bomber. “Where I come from, when the government says someone's guilty that's how you know they're innocent,” she says. “It's different here?”

TechBro8615 6y ago
Incidentally, that same lawyer is now working on election fraud cases for Trump.

Thorentis 6y ago

On what basis? Because there aren't any rumors of Russian meddling being sowed by the opposition this time? There are multiple states with no paper audit trail, closed source electronic voting machines, multiple dubious last-minute decisions made around postal ballots due to COVID, no easy way to verify the voter roll. Making a claim like this reeks of partisanship.

getlawgdon 6y ago
Your comment assumes the nature of wrongdoing is equivalent on both sides.
- chordalkeyboard 6y ago
  Isn't that the null hypothesis?
chiefalchemist 6y ago
"Unprecedented" times. An "unprecedented" election. An "unprecedented" election process. And no problems. Really? FEMA, also a gov-based entity, has had multiple "practice rounds" and it still can't get it right. Rare does the gov get it right, let alone first time. I have to stick with the tried and true: Trust but verify. And self-verification isn't good enough.
jkhdigital 6y ago
Wow this comment has been here for 2 hours and isn’t drowning in downvotes...
rsynnott 6y ago
> Making a claim like this reeks of partisanship. Ah, yes, CISA, that noted partisan Democrat-loving group: > The Cybersecurity and Infrastructure Security Agency (CISA) was established on November 16, 2018 when President Donald Trump signed into law the Cybersecurity and Infrastructure Security Agency Act of 2018 [..] > On November 13, the United States House of Representatives voted unanimously to pass legislation creating the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security (DHS). Very partisan, assuming you accept that the Democrats and Republicans are one party.

throwawydedbee 6y ago

Many techies want Biden. Others want Trump. Many would probably prefer someone else. But very, very few would see the integrity of this election as more than an intern-level joke. If you've ever worked in an environment where money was changing hands (banking, trading, etc) or where security was the real deal (three-letter agencies), or even in the insurance industry, you know that election integrity controls are a half-baked freshman project by comparison. (For myself, I don't care who wins. I don't believe it matters. But don't piss on me and tell me it's raining.)

ncal 6y ago

talk about bullshit..

motohagiography 6y ago

Was there a reason CISA needed to release a statement? I haven't seen anything controversial in the news. As they say, if you have to say it... I have a few comments going back a couple of years predicting how electronic voting will cause civil unrest because it is so vulnerable to being discredited. Edward Snowden even recently tweeted a prof's video about the same thing. Everybody who had given the issue any serious thought at all already knew it was an inevitable problem. Luckily, the U.S. has a process for dealing with contested election results, and the parties will litigate it to its final state. I'm just hoping for a very cold winter to keep people inside.

deleted 6y ago
[deleted]
evan_ 6y ago
> Was there a reason CISA needed to release a statement? I haven't seen anything controversial in the news. You haven’t been paying attention, then. Trump has been screaming fraud for days. This statement is a direct response to a completely baseless, evidence-free claim he made earlier today that 2.7 million votes for him were destroyed.
untog 6y ago
> Was there a reason CISA needed to release a statement? I haven't seen anything controversial in the news. Perhaps not if you read reputable outlets but if you take a look on Facebook, Twitter (including the President’s account) and YouTube you’ll find a frenzy of conspiracy theories about voter fraud. None of it with any real evidence attached, but it’s spreading like wildfire in many social circles. Of course, this statement won’t really do anything. If you were the “Deep State” rigging an election this is exactly what you’d order CISA to say!
mapme 6y ago
It has been all over the news in the US of trump claiming voter fraud. Apnews fact check has been full of the debunked claims in the last few days. https://apnews.com/article/election-2020-ap-fact-check-joe-biden-donald-trump-technology-13c104367924b8192b4fcecf334f7806 https://apnews.com/article/election-2020-ap-fact-check-joe-b... https://apnews.com/article/ap-fact-check-election-dead-voter-claims-fc7ba254fd37059f63ea764c18c2a4cb https://apnews.com/article/ap-fact-check-election-dead-voter... https://apnews.com/article/election-2020-joe-biden-donald-trump-politics-media-1bf96bf3910bdcbe0f125958357c8f1a https://apnews.com/article/election-2020-joe-biden-donald-tr... https://apnews.com/article/election-2020-joe-biden-us-news-media-michigan-43bdaa186e3b8d9d897cae3bd0c6cdc0 https://apnews.com/article/election-2020-joe-biden-us-news-m... https://apnews.com/article/election-2020-ap-fact-check-joe-biden-donald-trump-virus-outbreak-79c34b72633683af195ae945503883fe https://apnews.com/article/election-2020-ap-fact-check-joe-b...

shripadk 6y ago

https://www.forbes.com/sites/alisondurkee/2020/11/12/pennsylvania-judge-rules-in-favor-of-trump-campaign-orders-state-cant-count-some-ballots/?sh=e754e536c122 https://www.forbes.com/sites/alisondurkee/2020/11/12/pennsyl... I don't understand how you can say the Election was the "most secure" when you literally have a Court in Pennsylvania throw out 10,000 ballots! If the system was so "secure" it shouldn't have even gone to the Courts in the first place and instead the electoral system should have found out the discrepancies on its own! The truth is that US electoral system is full of flaws and it showed through this election!

dragonwriter 6y ago
> I don't understand how you can say the Election was the "most secure" when you literally have a Court in Pennsylvania throw out 10,000 ballots! Because that wasn't an election security issue, and it wasn't (at least you source does not say it was) 10,000 ballots. “It is unclear how many ballots will be affected by the ruling, but [...] Philadelphia County, the largest county in the state, only flagged 2,100 ballots that had identification issues.” And this wasn't affecting all the ballots flagged with ID issues, only those that were cured after the original deadline and before the challenged extended deadline. > If the system was so "secure" it shouldn't have even gone to the Courts in the first place and instead the electoral system should have found out the discrepancies on its own! It...did detect them on its own. The Court case is about the legal authority for the administrative mitigation.
- shripadk 6y ago
  I answered in more detail here: https://news.ycombinator.com/item?id=25078905 https://news.ycombinator.com/item?id=25078905 > (at least you source does not say it was) 10,000 ballots It does. Quoting: "The U.S. Supreme Court could also still potentially invalidate Pennsylvania’s extended mail-in voting deadline, which allowed mail-in ballots postmarked by Election Day to be accepted as long as they were delivered by Friday, Nov. 6. That ruling would only affect approximately 10,000 ballots, elections officials have said—which are being segregated and are not included in the current vote count—and thus invalidating them would not affect Biden’s win in Pennsylvania." The idea being that it doesn't have anything to do with who won or lost. It is more to do with the fact that the ballots are being contested in the Courts when it should have been the electoral system actually ensuring integrity. Court should be the last resort. I give my reasons in the answer above.

throwawaysea 6y ago

In order to secure the vote we need open source machines, verifiable ballots (including online verification), complete chain of control, body cams on anyone handling ballots, transparency to public and party observers via cameras, multiple isolated tabulations (verifying they all agree), and also strongly verifiable voter ID. Nothing in this process should be left up to chance. I don’t accept the stance that a lack of evidence of fraud means that fraud isn’t happening or that a better process shouldn’t be designed.

aw1621107 6y ago
> verifiable ballots (including online verification) Is this at odds with secret ballots?
- airstrike 6y ago
  Not if you split the info on the ballot in two halves, who voted vs. who they voted on
  - aw1621107 6y ago
    Ah, that's a slightly different definition of verifiable than I had in mind. I was thinking of schemes to allow voters to not only verify that they voted, but that their vote counted towards their intended candidate. I suppose it depends on what precisely is to be verified. The scheme you describe allows for verification that a ballot has been received/sent/counted, depending on details, which may or may not be verifiable enough depending on who you ask.

0xy 6y ago

A laptop and USB drive used to program voting machines were stolen right before the election according to the Associated Press. [1] The company who claims they cannot be used to manipulate machines has a laundry list of serious security lapses and incompetence. [2] Including remote-access to voting machines?!?! uncovered by the New York Times in 2018. [3] [1] https://apnews.com/article/voting-machines-voting-custodio-elections-philadelphia-f8a6453dc9e211ef20e9412d003511b1 https://apnews.com/article/voting-machines-voting-custodio-e... [2] https://en.wikipedia.org/wiki/Election_Systems_%26_Software#Controversies https://en.wikipedia.org/wiki/Election_Systems_%26_Software#... [3] https://www.nytimes.com/2018/02/21/magazine/the-myth-of-the-hacker-proof-voting-machine.html https://www.nytimes.com/2018/02/21/magazine/the-myth-of-the-...

ponker 6y ago

Everyone is saying this because Donald Trump is a dangerous moron but the fact is that the election process in the US is a complete basket case, most notably in the number of people it excludes from voting by design.

jungletime 6y ago

This can't be True, when 6000 votes where reversed in Michigan county from one of these machines. This is a fact. Not some made up BS. You either have a machine tallying the votes that works 100% of the time during the election. Otherwise, everyone can reasonably question the results from a machine that works 99% of the time. 6000 votes can't be going to the wrong candidates and the same time the election be "secure" in the mind of most reasonable people. Here's the story. https://www.youtube.com/watch?v=YeEW1oeLaVE https://www.youtube.com/watch?v=YeEW1oeLaVE

ttul 6y ago
You’re actually linking to a Sean Hannity segment on YouTube as your source?
- jungletime 6y ago
  New York Post Article, hope this satisfies. https://nypost.com/2020/11/06/michigan-gop-claims-software-issue-undercounted-trump-votes/ https://nypost.com/2020/11/06/michigan-gop-claims-software-i...
  - detaro 6y ago
    An error happening, being discovered and corrected through validation (that at least according to some reports is going to be always done before certification of the result: https://mobile.twitter.com/jhalderm/status/1325163300699648000 https://mobile.twitter.com/jhalderm/status/13251633006996480... ) seems like the overall system working just fine? Something to fix (why have the early machine result if it's so easily broken), but doesn't seem that different than someone fat-fingering a number while reporting etc.
    - jungletime 6y ago
      You either have a machine tallying the votes that works 100% of the time during the election. Otherwise, everyone can reasonably question the results from a machine that works 99% of the time.

Animats 6y ago

"All of the states with close results in the 2020 presidential race have paper records of each vote, allowing the ability to go back and count each ballot if necessary."

jungletime 6y ago

Its so secure you can't even post a link to anything claiming it was not secure, without it being flagged on here. This is bonkers. On the same level as Iran claiming not to have gay people. Hint hint hint ... because they kill the ones that admit to being gay.

jariel 6y ago

A possible solution to the electronic/paper issue might be literally just receipts. You vote in a 'machine' and it prints a 2 receipts - one for the 'backup' and one that you keep with some kind of encrypted/encoded data for non-repudiation. You go online with your private receipt number and it can validate your vote. If the electronic count is not accepted, the physical 'receipts' are coded so they can be counted very quickly by laser scanner.

aw1621107 6y ago
> You go online with your private receipt number and it can validate your vote. What precisely do you mean by "validate" here? Would this scheme make the ballot non-secret?
- 01100011 6y ago
  If each ballot has a unique ID and there is no association between the person voting and the ID, then the voter can retain that number, possibly by tearing off a section of the ballot as is done in CA, and check that number online to verify their vote was tallied as expected.
  - deleted 6y ago
    [deleted]
  - aw1621107 6y ago
    > there is no association between the person voting and the ID, then the voter can retain that number This seems somewhat contradictory. The voter retaining possession of the ID creates a link between the ballot and the voter, doesn't it? Then again, it does open the door to plausible deniability, though correctly pulling that off could introduce new complications and/or avenues of attack. > and check that number online to verify their vote was tallied as expected. "as expected" is the key phrase here. If it includes seeing what candidate(s) the voter voted for (i.e., trying to verify that the ballot was read correctly), then that seems like it would break the secret ballot. If it means just checking that the ballot was included in the count without revealing precisely what candidate(s)/issue(s) the vote was for, then that might work.

jungletime 6y ago

Sine I get flagged when I post anything contrary or questioning the narrative of this story that this was the most secure election... I might as well post a better story. "The Dear Leader Kim Jong-Il was born inside of a log cabin beneath Korea’s most sacred mountain, where upon the moment he came into this world, a shooting star brought forth a spontaneous change from winter to summer, and for the icing on the birthday cake: a double rainbow."

rendall 6y ago

There are lots of good ideas to make US elections more secure and trustworthy that are low-hanging fruit, easily implemented. Here's my prediction: None of these excellent ideas will be implemented by either party, and so people will continue to be baffled by the US system. "How is it possible that the US has such chaos every election season?" The potential for bumping up "our guy" in a close race is way too appealing to the party in power. When the reigns change hands, the new party could take the time to tighten election security, but to what benefit? They are now in control. Making things more fair to the other team would only hurt their chances. Election fraud is deeply ingrained in the long democratic political history of the US, from the very beginning. Direct democracy was an untried, unknown concept when the country started. No one but a few ivory tower eggheads who read dense philosophy books really understood what it was all about: "You mean if our guy gets more pieces of paper into that box than the other guy, we can award ourselves all of the government contracts?" It didn't even necessarily start out as nefarious or unethical, just clueless.

Fnoord 6y ago

See also "2020 Is An Election Security Success Story (So Far)" [1] which Bruce Schneier referenced and summarized here [2] [1] https://www.lawfareblog.com/2020-election-security-success-story-so-far https://www.lawfareblog.com/2020-election-security-success-s... [2] https://www.schneier.com/blog/archives/2020/11/2020-was-a-secure-election.html https://www.schneier.com/blog/archives/2020/11/2020-was-a-se...