7 ms·

Diebold voting machines can be hacked by remote control

97 points by FreeKill 15y ago

Aloisius 15y ago
Oh for the love of Pete. Why are the voting machines connected to the tallying devices? Wouldn't it be safer to have the voting machine output a machine readable ballot that is then read by a generic non-election specific scantron-like machine that has no understanding of what it is scanning?
cantastoria 15y ago
Ah I see they're already gearing up for their "Republicans stole the election (again)" series when Obama loses next year. Although I think this is jumping the gun a bit. Funny how these lab tests never seem to be done when it look like a Democrat is going to win (or won).
- jcromartie 15y ago
  There was plenty of voting machine hack news in 2008.
  - cantastoria 15y ago
    Maybe but nothing like 2004. The RFK Rolling Stone article, HBO documentaries, hell Black Box Voting was founded that year. In 2008, the NYT was publishing opinion pieces about "The Myth of Voter Fraud" http://www.nytimes.com/2008/05/13/opinion/13tue1.html http://www.nytimes.com/2008/05/13/opinion/13tue1.html Trust me this will be a front page issue again in 2012 The irony of course is that calling into question the validity of an election is the oldest form of election rigging there is.
    - bluedanieru 15y ago
      Nope, it was a big deal both times. This is confirmation bias on your part, simple as that.
- william42 15y ago
  That's what happens when a major voting machine company publically states that they are going to deliver the election to the Republicans.
mrinterweb 15y ago
Tampering attempts could be easily detected with a paper log of votes. All that is needed is a paper based receipt logger installed in each voting machine. If tampering is suspected, review the paper log.
- ejames 15y ago
  Unfortunately, it's not quite that simple. An advantage of electronic voting is that the machines can be designed for use by the blind. This is in fact one of the goals written into the act of Congress which funded the development of the machines originally. Political advocacy groups for the blind oppose using paper logging, because it would mean that the only authoritative record of the vote is the one that blind people cannot personally confirm. A machine could read the paper out to the blind vote, but that just changes which electronic device you have to trust to report the vote correctly. A sighted person could confirm the ballot for them, but that was already possible in the past (and was how the blind voted until now). Electronic voting was an advance for the blind specifically because an individual could vote on their own with no assistance other than that provided by the machine. From a security perspective, it is at least as plausible that the sighted assistant would manipulate the vote of the blind person as it is plausible that a hacker would manipulate the votes on an electronic system. It can be argued that although both scenarios are plausible, hacking is more likely and has a larger impact, but arguments based on relative costs and benefits are a poor match for an emotional debate on civil rights.
  - specialist 15y ago
    > An advantage of electronic voting is that the machines can be designed for use by the blind. Could be, but aren't. If you'd ever tried the 'accessibility' features of a touchscreen voting machine, you'd see the UX fail firsthand. (I've worked as a poll inspector.) There were other truly accessible solutions. The VotePad for instance. Low-tech plastic wrapper for existing ballots. Preserving both the secret ballot and public vote count. Alas, the inexpensive VotePad couldn't complete with the well financed crony capitalism juggernaut which brought us HAVA.
  - JonnieCache 15y ago
JonnieCache 15y ago
For a very comprehensive rundown of all the awful things about electronic voting from someone who has been researching it for 12 years, see the following hour long talk given at google: Electronic and Internet Voting (The Threat of Internet Voting in Public Elections) http://www.youtube.com/watch?v=_GjmRwfkRXY http://www.youtube.com/watch?v=_GjmRwfkRXY It goes through all the highly nontrivial challenges around holding an election, and discusses the major failings of the technology over the years. (Mostly diebold gear as you might imagine.)
rbanffy 15y ago
It's really a shame, because Diebold knows how to do better. While not perfect, I think the Brazilian electronic ballots are not vulnerable to most of the attacks I see being demonstrated against Diebold machines used elsewhere (they are certainly not as easy to attack as the one on the video). And Diebold has the know-how in house because they acquired Procomp, the company who won the last couple competitions to provide them. I worked on the Unisys version (which was the last competition Diebold/Procomp didn't win, IIRC) and I distinctly remember our discussions about possible exploit scenarios and how to counter them (sometimes, with physical handling protocols and tamper-proof seals).
sp332 15y ago
Funny, the attack only requires an "eighth grade science education" to execute but it took the Vulnerability Assessment Team of the Nuclear Engineering Division of the Argonne National Laboratory to develop it. edited for clarity.
- blahedo 15y ago
  So? Some web exploits can be used by script kiddies while others require active skilled-programmer intervention, although both kinds require a clever hacker to figure them out in the first place, and we find that a useful distinction to make as well.
- dasil003 15y ago
  It's better than squirting-water-guns-into–ATMs exploit (was that Diebold?) which can be employed by attackers with nothing but a kindergarten playground education.
- VladRussian 15y ago
  P != NP
sp332 15y ago
I'll just leave this resource here: http://www.blackboxvoting.org/ http://www.blackboxvoting.org/
- waqf 15y ago
  If that resource wants to be taken seriously it could start by getting a web design that doesn't scream "quack".
gasull 15y ago
More info (although old news): http://www.bradblog.com/?p=1839 http://www.bradblog.com/?p=1839 http://www.bradblog.com/?p=3467 http://www.bradblog.com/?p=3467
ChuckMcM 15y ago
Obligatory shout out: http://homepage.mac.com/rcareaga/diebold/adworks.htm http://homepage.mac.com/rcareaga/diebold/adworks.htm This is another interesting case to follow. Matt Blaze's work here is also telling (they found a bunch of software exploits). I wonder about the forces pushing electronic voting when there are so many issues unresolved. Perhaps Anonymous should elect itself President. That would wake some folks up.
- specialist 15y ago
  I like the "vapor" poster. I wish I had thought of "voter verified vapor audit trail" back when I was fighting against these touchscreens.
misterbwong 15y ago
Someone with more knowledge of this please tell me: Why is physical access to the voting machine innards allowed at all? Why isn't the machine glued shut with some color changing seals to show tampering? It doesn't seem like poll workers (or anyone other than the manufacturer, for that matter) would need access to the internals. If a machine is broken, send it back or fall back to paper voting.
- specialist 15y ago
  The short answer is all the election administration gear is rushed to market. The HAVA boondoogle created a gold fever land grab mentality. The products are shit. Not just insecure, but just complete garbage. Not to downplay the security concerns, but the poor reliability is a bigger threat. Especially since these systems fail silently and "testing" was a puppet show. The longer answer is that all voting gear I've seen (in the USA) treat security as an afterthought. Gear in use typically get "tamper evident" seals. But they're really lame (e.g. fall off) or the gear can be backdoored. I'm just talking the hardware here. The software situation is totally, scales of magnitude, worse.
- rhizome 15y ago
  For no particular reason, the prevailing stance is to avoid paper fallback so they want to preserve the ability for pollworkers to deal with problems themselves. I know, "what could possibly go wrong with that?" There is nothing in the electronic voting debate that won't make you scratch your head wondering why they don't use known-good techniques. The only time-worthy thing to do is to oppose them until open-source solutions are accepted. Everything else will be a through-and-through scam by Diebold or one of their cohorts.
  - jerf 15y ago
    "The only time-worthy thing to do is to oppose them until open-source solutions are accepted." Meh, I'm still unconvinced by the virtues of electronic voting at all, open source or otherwise. Little electronic currents simply have less mass than pencil marks on paper, and I mean that in a number of ways, including the fully literal one. A full accounting of cost/benefits shows the costs to be staggering once one accounts for the risks of tampering and the difficulty of preventing it, and the benefits mind-bogglingly tiny. (Heck, even if one merely accounts for the costs of materials the cost/benefit analysis isn't all that great.) If it wasn't so darned shiny and high tech nobody would even consider electronic voting. It's just technofetishism run amok.
DanielBMarkham 15y ago
Having thought about this a bit, I don't see how you do electronic voting without giving the voter a receipt that contains a sequence number, timestamp, and current status of the machine. All encrypted, of course. That way the paper trail can be reassembled if necessary to see if it matches the end state. Hope that was explanatory enough. It also partially distributes oversight authority to all the voters instead of having it all at the poll.
- InclinedPlane 15y ago
  There's no point in maintaining a distributed paper trail, since actually making use of it would violate anonymity and be a gigantic hassle, you might as well just keep the paper trail centralized. And if you're doing that then you might as well just go back to electronically scanned paper ballots.
- ugh 15y ago
  Secret electronic voting is just too much hassle. Manual counting really isn't that big of a deal, at least with current election systems.
- binbasti 15y ago
  For elections to be considered democratic, they must not only be fair and anonymous, but also comprehensible to all. As any electronic voting system (even an insecure one) is only comprehensible to some, electronic voting is by definition not democratic and should therefore be forbidden in any country that claims itself to be that. Actually, in Germany the highest court declared electronic voting to be unconstitutional on the grounds of deficient comprehensibility in 2009. Maybe we can use this argument in other countries, too.
stinky613 15y ago
Obligatory xkcd reference: http://xkcd.com/463/ http://xkcd.com/463/
janesvilleseo 15y ago
Why can't I verify my vote? Get a print out, then go online, punch in my number and confirm my vote. Wouldn't this solve a lot of problems? Of course not everyone would confirm their vote, but I am sure the math can be done to see if everything checks out. Just like exit polls.
- nitrogen 15y ago
  In line with what atlbeer said, it would be difficult or impossible to preserve voter anonymity (i.e. the inability to link a voter with who or what they voted for).
- atlbeer 15y ago
  Not giving poll receipts comes from a sorted history of people coercing people to vote got a certain candidate. "Vote for the right person or you'll be fired. Show me the receipt"
chester_wilton 15y ago
Paper. It works. There is a _physical_ backup for recounts. It's verifiable. Its trustworthy, and it's secret. If you want results faster. Volunteer at the voting place. If you don't trust a voting place. Send an observer. All of this can and should happen in secret in plain sight. I know this is hard for us nerds to admit, but there are systems that do not need to be, nor should be computerized.
- jonknee 15y ago
  > There is a _physical_ backup for recounts. It's verifiable. Its trustworthy, and it's secret. If you want results faster. Volunteer at the voting place. If you don't trust a voting place. Send an observer. All of this can and should happen in secret in plain sight. I know this is hard for us nerds to admit, but there are systems that do not need to be, nor should be computerized. Sort of. But a poll worker could toss out ballots and you'd have no idea. A voter could toss in multiple (stolen) ballots and no one could stop it. Etc etc. There are serious problems with electronic voting, but paper ballots aren't immune to problems. Physical backups mean shit when the source is fraudulent.
  - aw3c2 15y ago
    No idea where you live but in Germany you can be a volunteer if you desire to monitor the process. Also you cannot put in multiple ballots. Each voter is checked off a list, a mismatch between "people who came to vote" and "ballots in the box" would be easy to spot.
    - jonknee 15y ago
      You can volunteer here in the US too, but what if the volunteer commits fraud? If there's a mismatch, what would you do? It's a secret ballot so you can't throw out the extra votes, you'd have to throw out all the votes in that ballot box.
  - dagw 15y ago
    Every time I've voted (in Sweden), at least two observers check that the right number of ballot papers have been received and then they place the ballot papers in the sealed ballot box in full view of both the voter and the observers. It would be basically impossible (barring a conspiracy between the poll workers and observers) to either toss out a ballot or chuck in an extra ballot without being spotted.
Natsu 15y ago
I thought they were called Premier Election Systems these days. Or am I confused?

97 points by FreeKill 15y ago

Oh for the love of Pete. Why are the voting machines connected to the tallying devices? Wouldn't it be safer to have the voting machine output a machine readable ballot that is then read by a generic non-election specific scantron-like machine that has no understanding of what it is scanning?

cantastoria 15y ago

Ah I see they're already gearing up for their "Republicans stole the election (again)" series when Obama loses next year. Although I think this is jumping the gun a bit. Funny how these lab tests never seem to be done when it look like a Democrat is going to win (or won).

jcromartie 15y ago
There was plenty of voting machine hack news in 2008.
- cantastoria 15y ago
  Maybe but nothing like 2004. The RFK Rolling Stone article, HBO documentaries, hell Black Box Voting was founded that year. In 2008, the NYT was publishing opinion pieces about "The Myth of Voter Fraud" http://www.nytimes.com/2008/05/13/opinion/13tue1.html http://www.nytimes.com/2008/05/13/opinion/13tue1.html Trust me this will be a front page issue again in 2012 The irony of course is that calling into question the validity of an election is the oldest form of election rigging there is.
  - bluedanieru 15y ago
    Nope, it was a big deal both times. This is confirmation bias on your part, simple as that.
william42 15y ago
That's what happens when a major voting machine company publically states that they are going to deliver the election to the Republicans.

mrinterweb 15y ago

Tampering attempts could be easily detected with a paper log of votes. All that is needed is a paper based receipt logger installed in each voting machine. If tampering is suspected, review the paper log.

ejames 15y ago
Unfortunately, it's not quite that simple. An advantage of electronic voting is that the machines can be designed for use by the blind. This is in fact one of the goals written into the act of Congress which funded the development of the machines originally. Political advocacy groups for the blind oppose using paper logging, because it would mean that the only authoritative record of the vote is the one that blind people cannot personally confirm. A machine could read the paper out to the blind vote, but that just changes which electronic device you have to trust to report the vote correctly. A sighted person could confirm the ballot for them, but that was already possible in the past (and was how the blind voted until now). Electronic voting was an advance for the blind specifically because an individual could vote on their own with no assistance other than that provided by the machine. From a security perspective, it is at least as plausible that the sighted assistant would manipulate the vote of the blind person as it is plausible that a hacker would manipulate the votes on an electronic system. It can be argued that although both scenarios are plausible, hacking is more likely and has a larger impact, but arguments based on relative costs and benefits are a poor match for an emotional debate on civil rights.
- specialist 15y ago
  > An advantage of electronic voting is that the machines can be designed for use by the blind. Could be, but aren't. If you'd ever tried the 'accessibility' features of a touchscreen voting machine, you'd see the UX fail firsthand. (I've worked as a poll inspector.) There were other truly accessible solutions. The VotePad for instance. Low-tech plastic wrapper for existing ballots. Preserving both the secret ballot and public vote count. Alas, the inexpensive VotePad couldn't complete with the well financed crony capitalism juggernaut which brought us HAVA.
- JonnieCache 15y ago

JonnieCache 15y ago

For a very comprehensive rundown of all the awful things about electronic voting from someone who has been researching it for 12 years, see the following hour long talk given at google: Electronic and Internet Voting (The Threat of Internet Voting in Public Elections) http://www.youtube.com/watch?v=_GjmRwfkRXY http://www.youtube.com/watch?v=_GjmRwfkRXY It goes through all the highly nontrivial challenges around holding an election, and discusses the major failings of the technology over the years. (Mostly diebold gear as you might imagine.)

rbanffy 15y ago

It's really a shame, because Diebold knows how to do better. While not perfect, I think the Brazilian electronic ballots are not vulnerable to most of the attacks I see being demonstrated against Diebold machines used elsewhere (they are certainly not as easy to attack as the one on the video). And Diebold has the know-how in house because they acquired Procomp, the company who won the last couple competitions to provide them. I worked on the Unisys version (which was the last competition Diebold/Procomp didn't win, IIRC) and I distinctly remember our discussions about possible exploit scenarios and how to counter them (sometimes, with physical handling protocols and tamper-proof seals).

sp332 15y ago

Funny, the attack only requires an "eighth grade science education" to execute but it took the Vulnerability Assessment Team of the Nuclear Engineering Division of the Argonne National Laboratory to develop it. edited for clarity.

blahedo 15y ago
So? Some web exploits can be used by script kiddies while others require active skilled-programmer intervention, although both kinds require a clever hacker to figure them out in the first place, and we find that a useful distinction to make as well.
dasil003 15y ago
It's better than squirting-water-guns-into–ATMs exploit (was that Diebold?) which can be employed by attackers with nothing but a kindergarten playground education.
VladRussian 15y ago
P != NP

sp332 15y ago

I'll just leave this resource here: http://www.blackboxvoting.org/ http://www.blackboxvoting.org/

waqf 15y ago
If that resource wants to be taken seriously it could start by getting a web design that doesn't scream "quack".

gasull 15y ago

More info (although old news): http://www.bradblog.com/?p=1839 http://www.bradblog.com/?p=1839 http://www.bradblog.com/?p=3467 http://www.bradblog.com/?p=3467

ChuckMcM 15y ago

Obligatory shout out: http://homepage.mac.com/rcareaga/diebold/adworks.htm http://homepage.mac.com/rcareaga/diebold/adworks.htm This is another interesting case to follow. Matt Blaze's work here is also telling (they found a bunch of software exploits). I wonder about the forces pushing electronic voting when there are so many issues unresolved. Perhaps Anonymous should elect itself President. That would wake some folks up.

specialist 15y ago
I like the "vapor" poster. I wish I had thought of "voter verified vapor audit trail" back when I was fighting against these touchscreens.

misterbwong 15y ago

Someone with more knowledge of this please tell me: Why is physical access to the voting machine innards allowed at all? Why isn't the machine glued shut with some color changing seals to show tampering? It doesn't seem like poll workers (or anyone other than the manufacturer, for that matter) would need access to the internals. If a machine is broken, send it back or fall back to paper voting.

specialist 15y ago
The short answer is all the election administration gear is rushed to market. The HAVA boondoogle created a gold fever land grab mentality. The products are shit. Not just insecure, but just complete garbage. Not to downplay the security concerns, but the poor reliability is a bigger threat. Especially since these systems fail silently and "testing" was a puppet show. The longer answer is that all voting gear I've seen (in the USA) treat security as an afterthought. Gear in use typically get "tamper evident" seals. But they're really lame (e.g. fall off) or the gear can be backdoored. I'm just talking the hardware here. The software situation is totally, scales of magnitude, worse.
rhizome 15y ago
For no particular reason, the prevailing stance is to avoid paper fallback so they want to preserve the ability for pollworkers to deal with problems themselves. I know, "what could possibly go wrong with that?" There is nothing in the electronic voting debate that won't make you scratch your head wondering why they don't use known-good techniques. The only time-worthy thing to do is to oppose them until open-source solutions are accepted. Everything else will be a through-and-through scam by Diebold or one of their cohorts.
- jerf 15y ago
  "The only time-worthy thing to do is to oppose them until open-source solutions are accepted." Meh, I'm still unconvinced by the virtues of electronic voting at all, open source or otherwise. Little electronic currents simply have less mass than pencil marks on paper, and I mean that in a number of ways, including the fully literal one. A full accounting of cost/benefits shows the costs to be staggering once one accounts for the risks of tampering and the difficulty of preventing it, and the benefits mind-bogglingly tiny. (Heck, even if one merely accounts for the costs of materials the cost/benefit analysis isn't all that great.) If it wasn't so darned shiny and high tech nobody would even consider electronic voting. It's just technofetishism run amok.

DanielBMarkham 15y ago

Having thought about this a bit, I don't see how you do electronic voting without giving the voter a receipt that contains a sequence number, timestamp, and current status of the machine. All encrypted, of course. That way the paper trail can be reassembled if necessary to see if it matches the end state. Hope that was explanatory enough. It also partially distributes oversight authority to all the voters instead of having it all at the poll.

InclinedPlane 15y ago
There's no point in maintaining a distributed paper trail, since actually making use of it would violate anonymity and be a gigantic hassle, you might as well just keep the paper trail centralized. And if you're doing that then you might as well just go back to electronically scanned paper ballots.
ugh 15y ago
Secret electronic voting is just too much hassle. Manual counting really isn't that big of a deal, at least with current election systems.
binbasti 15y ago
For elections to be considered democratic, they must not only be fair and anonymous, but also comprehensible to all. As any electronic voting system (even an insecure one) is only comprehensible to some, electronic voting is by definition not democratic and should therefore be forbidden in any country that claims itself to be that. Actually, in Germany the highest court declared electronic voting to be unconstitutional on the grounds of deficient comprehensibility in 2009. Maybe we can use this argument in other countries, too.

stinky613 15y ago

Obligatory xkcd reference: http://xkcd.com/463/ http://xkcd.com/463/

janesvilleseo 15y ago

Why can't I verify my vote? Get a print out, then go online, punch in my number and confirm my vote. Wouldn't this solve a lot of problems? Of course not everyone would confirm their vote, but I am sure the math can be done to see if everything checks out. Just like exit polls.

nitrogen 15y ago
In line with what atlbeer said, it would be difficult or impossible to preserve voter anonymity (i.e. the inability to link a voter with who or what they voted for).
atlbeer 15y ago
Not giving poll receipts comes from a sorted history of people coercing people to vote got a certain candidate. "Vote for the right person or you'll be fired. Show me the receipt"

chester_wilton 15y ago

Paper. It works. There is a _physical_ backup for recounts. It's verifiable. Its trustworthy, and it's secret. If you want results faster. Volunteer at the voting place. If you don't trust a voting place. Send an observer. All of this can and should happen in secret in plain sight. I know this is hard for us nerds to admit, but there are systems that do not need to be, nor should be computerized.

jonknee 15y ago
> There is a _physical_ backup for recounts. It's verifiable. Its trustworthy, and it's secret. If you want results faster. Volunteer at the voting place. If you don't trust a voting place. Send an observer. All of this can and should happen in secret in plain sight. I know this is hard for us nerds to admit, but there are systems that do not need to be, nor should be computerized. Sort of. But a poll worker could toss out ballots and you'd have no idea. A voter could toss in multiple (stolen) ballots and no one could stop it. Etc etc. There are serious problems with electronic voting, but paper ballots aren't immune to problems. Physical backups mean shit when the source is fraudulent.
- aw3c2 15y ago
  No idea where you live but in Germany you can be a volunteer if you desire to monitor the process. Also you cannot put in multiple ballots. Each voter is checked off a list, a mismatch between "people who came to vote" and "ballots in the box" would be easy to spot.
  - jonknee 15y ago
    You can volunteer here in the US too, but what if the volunteer commits fraud? If there's a mismatch, what would you do? It's a secret ballot so you can't throw out the extra votes, you'd have to throw out all the votes in that ballot box.
- dagw 15y ago
  Every time I've voted (in Sweden), at least two observers check that the right number of ballot papers have been received and then they place the ballot papers in the sealed ballot box in full view of both the voter and the observers. It would be basically impossible (barring a conspiracy between the poll workers and observers) to either toss out a ballot or chuck in an extra ballot without being spotted.

Natsu 15y ago

I thought they were called Premier Election Systems these days. Or am I confused?