5 ms·

Disregarding your viewpoints/our bias, as this is HN, here is a technical question: what, if anything, would a router show at this point in time. Do these rout

Disregarding your viewpoints/our bias, as this is HN, here is a technical question: what, if anything, would a router show at this point in time. Do these routers use store logs that would still be accessible? Are they trying to find some rhetorical bamboo in the switch (trying to be funny though those beliefs definitely are not in my book...)?

dukeofdoom 5y ago
I know my cheap home router stores logs. I'm pretty sure a commercial grade router would store logs for sure. Though this is not my background. So maybe someone that's a network admin knows more on what kind of routers they might use and how long the logs are typically stored.
jcrawfordor 5y ago
My assumption is that they want to have an outside expert examine the configuration of the routers, which could provide some indication whether or not there was access to the internet, for example. Of course it would be difficult to establish whether or not that configuration had been changed in the meantime, and in my experience a lot of election administrators set up their EMS only on a temporary basis, so I would be unsurprised if supporting equipment like network appliances had been repurposed or returned to a lease provider. That said, the EMS is usually a small half-rack setup and I'd be surprised for there to be a router at all. Often it's a single machine. The vendors usually tell you to either never connect it to outside networks, or to do so only for setup and disconnect it before you start election preparation. Most, usually all, in-election connectivity to the machines is via sneakernet. Any kind of detailed network logging becomes a big undertaking at organizational scale, so it's very unlikely that there are any kind of useful persistent traffic logs on the routers. Any such logs would have been kept on a dedicated system like a netflow collector or SIEM, the routers don't have the storage (or storage write endurance). The fact the senate didn't subpoena for such a system suggests it doesn't exist, which is unsurprising. Mass-retention of network traffic logs is a sufficiently expensive and complex thing that not a lot of organizations do it.
- dillondoyle 5y ago
  Thank you!! That was my guess on logs. Really cool to learn more! You sound like you work in the industry. I'm sorry for that ;( Recent WaPo article on election workers was scary.
- missblit 5y ago
  > That said, the EMS is usually a small half-rack setup and I'd be surprised for there to be a router at all There isn't, you can actually see their EMS diagram here: https://recorder.maricopa.gov/justthefacts/pdf/Maricopa%20EMS%20Diagram%20V2.pdf https://recorder.maricopa.gov/justthefacts/pdf/Maricopa%20EM... (Switches yes, but no routers)
- dukeofdoom 5y ago
  I just read the counties response on their website. https://recorder.maricopa.gov/justthefacts/pdf/Maricopa%20EMS%20Diagram%20V2.pdf https://recorder.maricopa.gov/justthefacts/pdf/Maricopa%20EM... It shows the EMS rack and the ballot scanners in a network configuration. Since this seems to be windows based from a video I've seen. At least the software they were using to adjudicate votes. Source: https://rumble.com/vbqj0b-dominon-voting-machines-walkthrough-on-how-they-scan-and-adjudicate.html https://rumble.com/vbqj0b-dominon-voting-machines-walkthroug... I expect the EMS rack have a network port and not a wifi port. Back when I was using windows, connecting to the internet through the network port required a setup step, for things like DHCP server for the dynamic ip. I'm curious, does windows remember the configurations it has used in the past? And does windows keep a log file of the network connections it makes, and how often are those logs rotated typically?
  - jcrawfordor 5y ago
    I see, they do some scanning and adjudication on the EMS which means it's a bigger setup - not necessarily the EMS itself, but it needs workstations hooked up to it for the tabulators and adjudicators to use. Based on some research, the way Maricopa County runs things ballots rejected by the precinct tabulators (due to ambiguous markings usually) are sent in to the central office for adjudication, which is what the scanners and workstations connected to the EMS are for. Probably this is done using the sorter bin feature of the ImageCast tabulator but I'm not sure. I have never used the Dominion adjudication system, it depends on the election administrator and state law how they handle rejected ballots and the two states I have familiarity with have made a decision to return them to the voter instead of sending them in (usually asking the voter to complete a new ballot). There are pros and cons either way. But you can see they use a Netgear switch, so we don't even know if it's managed but I'd guess it's not because Netgear's managed line just isn't that popular. There's probably nothing of interest that could be extracted from that switch. Yes, as far as I know all of Dominion's management software is Windows-based. There's a potentially huge amount of forensic data available from the Windows machines but whether or not you could demonstrate internet access just depends. It's the kind of thing you could probably only prove in the positive. Windows does not keep network logs per se, just there are lots of other logs that can be used to infer certain network activity. The reality is that network traffic is so high volume and low value that it's unusual for anything to record it in much detail, it'd just eat a lot of storage and I/O to never get looked at.

dukeofdoom 5y ago

I know my cheap home router stores logs. I'm pretty sure a commercial grade router would store logs for sure. Though this is not my background. So maybe someone that's a network admin knows more on what kind of routers they might use and how long the logs are typically stored.

jcrawfordor 5y ago

My assumption is that they want to have an outside expert examine the configuration of the routers, which could provide some indication whether or not there was access to the internet, for example. Of course it would be difficult to establish whether or not that configuration had been changed in the meantime, and in my experience a lot of election administrators set up their EMS only on a temporary basis, so I would be unsurprised if supporting equipment like network appliances had been repurposed or returned to a lease provider. That said, the EMS is usually a small half-rack setup and I'd be surprised for there to be a router at all. Often it's a single machine. The vendors usually tell you to either never connect it to outside networks, or to do so only for setup and disconnect it before you start election preparation. Most, usually all, in-election connectivity to the machines is via sneakernet. Any kind of detailed network logging becomes a big undertaking at organizational scale, so it's very unlikely that there are any kind of useful persistent traffic logs on the routers. Any such logs would have been kept on a dedicated system like a netflow collector or SIEM, the routers don't have the storage (or storage write endurance). The fact the senate didn't subpoena for such a system suggests it doesn't exist, which is unsurprising. Mass-retention of network traffic logs is a sufficiently expensive and complex thing that not a lot of organizations do it.

dillondoyle 5y ago
Thank you!! That was my guess on logs. Really cool to learn more! You sound like you work in the industry. I'm sorry for that ;( Recent WaPo article on election workers was scary.
missblit 5y ago
> That said, the EMS is usually a small half-rack setup and I'd be surprised for there to be a router at all There isn't, you can actually see their EMS diagram here: https://recorder.maricopa.gov/justthefacts/pdf/Maricopa%20EMS%20Diagram%20V2.pdf https://recorder.maricopa.gov/justthefacts/pdf/Maricopa%20EM... (Switches yes, but no routers)
dukeofdoom 5y ago
I just read the counties response on their website. https://recorder.maricopa.gov/justthefacts/pdf/Maricopa%20EMS%20Diagram%20V2.pdf https://recorder.maricopa.gov/justthefacts/pdf/Maricopa%20EM... It shows the EMS rack and the ballot scanners in a network configuration. Since this seems to be windows based from a video I've seen. At least the software they were using to adjudicate votes. Source: https://rumble.com/vbqj0b-dominon-voting-machines-walkthrough-on-how-they-scan-and-adjudicate.html https://rumble.com/vbqj0b-dominon-voting-machines-walkthroug... I expect the EMS rack have a network port and not a wifi port. Back when I was using windows, connecting to the internet through the network port required a setup step, for things like DHCP server for the dynamic ip. I'm curious, does windows remember the configurations it has used in the past? And does windows keep a log file of the network connections it makes, and how often are those logs rotated typically?
- jcrawfordor 5y ago
  I see, they do some scanning and adjudication on the EMS which means it's a bigger setup - not necessarily the EMS itself, but it needs workstations hooked up to it for the tabulators and adjudicators to use. Based on some research, the way Maricopa County runs things ballots rejected by the precinct tabulators (due to ambiguous markings usually) are sent in to the central office for adjudication, which is what the scanners and workstations connected to the EMS are for. Probably this is done using the sorter bin feature of the ImageCast tabulator but I'm not sure. I have never used the Dominion adjudication system, it depends on the election administrator and state law how they handle rejected ballots and the two states I have familiarity with have made a decision to return them to the voter instead of sending them in (usually asking the voter to complete a new ballot). There are pros and cons either way. But you can see they use a Netgear switch, so we don't even know if it's managed but I'd guess it's not because Netgear's managed line just isn't that popular. There's probably nothing of interest that could be extracted from that switch. Yes, as far as I know all of Dominion's management software is Windows-based. There's a potentially huge amount of forensic data available from the Windows machines but whether or not you could demonstrate internet access just depends. It's the kind of thing you could probably only prove in the positive. Windows does not keep network logs per se, just there are lots of other logs that can be used to infer certain network activity. The reality is that network traffic is so high volume and low value that it's unusual for anything to record it in much detail, it'd just eat a lot of storage and I/O to never get looked at.