6 ms·

Argentinean programmer's house raided after he found a security breach

santiagobasulto 11y ago
Some context: He found a security breach in the public voting system of Buenos Aires city, Argentina (elections are tomorrow). He brought it to awareness yesterday: http://www.lanacion.com.ar/1807352-denuncian-un-agujero-de-seguridad-en-el-sistema-de-votacion-electronica-que-se-usara-el-proximo-domingo http://www.lanacion.com.ar/1807352-denuncian-un-agujero-de-s... The tweet reads: After finding a vulnerability in the voting system they're raiding my house, people from computer forensics.
r721 11y ago
Broad summary of what's been going on the last few days in Buenos Aires, Argentina (by /u/sebadoom): https://gist.githubusercontent.com/sebadoom/f0eedcba2f39e3e07a1c/raw/c168b48210bf7f85029545743891e7e4f8c95df4/gistfile1.txt https://gist.githubusercontent.com/sebadoom/f0eedcba2f39e3e0...
embik 11y ago
What kind of people orders such a raid? What's the mindset behind that decision? Their own team wasn't good enough to catch the breach (hell, the whole thing sounds like a train wreck) and now they try to silence people who reveal their incompetence?
- jamra 11y ago
  The same administration that just assassinated a prosecutor that had written out an arrest warrant against her.
  - demian 11y ago
    Wrong. The federal goverment is from a different political party, they are NOT the same people that are running the local city goverment. The police that raided this guy's house was the metropolitan police (BA city police), not the federal police.
    - hobarrera 11y ago
      Important correction: the "metropolitan police" is not the city police. Legally speaking, it's more of a private army that only answer to the executive branch of the city's government. Yes, it's incredibly amazing that such a thing exists. "Police" it just a word in the name of the institution.
      - dancingcat 11y ago
        I, and many others have proven in public/open court, that the police/military are completely compromised around the world, and that they are not allowed to act-as or call themselves the police or military anymore. It was scrubbed... Again, and again, and again... :-(
      - demian 11y ago
        Thanks for the correction, I didn't knew.
  - marcosdumay 11y ago
    Just to add, an arrest warrant against her for aiding Iran terrorists that attacked Argentina. If embik thinks he does not know what those people think, I guess he should turn that into a certainty from now on.
  - nmrm2 11y ago
    There are a lot of examples in the US of the government harrasing citizens who report vulnerabilities. The DMCA is typically used to justify this behavior. I'm not sure what the appropriate conclusion is here.
- Semiapies 11y ago
  If we're that charitable towards their motivations, I'd generally expect the sort of people who end up in large city administrations to do that more than not. Another possibility is that they had arranged a good setup for vote manipulation, and someone exposed it.
- MichaelCrawford 11y ago
  You must not know much about history. In Argentina specifically, there was Juan Peron. The broadway play and movie "Evita" is about his wife. I once read her biography. Some astronomers I once met were at cerro tololo inter-american observatory in chile when some heavily armed men turned up to look after the nearby radio towers. Conspiracy theories abound with respect to JFK's assassination. No one really believes that communists torched the Reichstag. On December 8, 1941, the pearl harbor base commander found a letter from the US state department in his mailbox, to let him know that the japanese might give him trouble sometime soon. "Gentlemen do not read each others' mail.". That was the stated reason that the US stopped its codebreaking work. I dont believe it really did. The best way to read a gentleman's mail is if he doesnt think he needs to encrypt it. Josef Stalin once knocked over a bank, then gave all the loot to Lenin.
  - maxpupmax 11y ago
    With all due respect... What the hell are you talking about?
    - mattdeboard 11y ago
      One of my great fears is that posts like the one you responded to turn out, years later, to be 100% legitimate, despite how weird they sound now.
      - MichaelCrawford 11y ago
        Every starving writer just loves to hear about it when a fan appreciates his work.
    - polymatter 11y ago
      I think his ultimate point was that embik is being naive. That it is just a simple coverup with a thin, obviously untrue excuse.
    - MichaelCrawford 11y ago
      Have a read of the parent post that mine is a reply to.
- threeseed 11y ago
  Why wouldn't you order a raid ? A security vulnerability in a voting system has been exposed. Yes this guy may have done nothing with it but I would damn want to make 100% sure that was the case. And I would definitely want to make sure that the vulnerability wasn't recklessly revealed. This isn't like finding a browser bug we are talking about, you can radically alter the course of a nation.
- MichaelCrawford 11y ago
  You must not know much about history. In Argentina specifically, there was Juan Peron. The broadway play and movie "Evita" is about his wife. I once read her biography. Some astronomers I once met were at cerro tololo inter-american observatory in chile when some heavily armed men turned up to look after the nearby radio towers. Conspiracy theories abound with respect to JFK's assassination. No one really believes that communists torched the Reichstag. On December 8, 1941, the pearl harbor base commander found a letter from the US state department in his mailbox, to let him know that the japanese might give him trouble sometime soon. "Gentlemen do not read each others' mail.". That was the stated reason that the US stopped its codebreaking work. I dont believe it really did. The best way to read a gentleman's mail is if he doesnt think he needs to encrypt it. Josef Stalin once knocked over a bank, then gave all the loot to Lenin.
demian 11y ago
There are several bugs in the system reported by local engineers, like being able to add multiple votes to a sigle voter's RFID chip. This is a scandal and a complete failure at several levels, not only for the local city goverment but for respected institutions like the University of Buenos Aires which got paid to audit the system. And this is all happening in the same day as the America Cup (Copa America) Final between Chile and Argentina, so people are numb to most of this news.
alvare 11y ago
He is accused of leaking the private information of 2000 people involved in the electoral operation. That's why he was raided. Not because of the alleged vulneravilities he found.
- wmt 11y ago
  That would sound more reasonable, do you have a source for that or is that just heresay?
  - madaxe_again 11y ago
    It was that and the WMDs in his cellar.
  - alvare 11y ago
    https://twitter.com/fraudevotar https://twitter.com/fraudevotar http://justpaste.it/votarleaks6 http://justpaste.it/votarleaks6
- angry_octet 11y ago
  You don't raid someone for doing that, you raid someone to silence them, then use that as a justification. Some people will totally accept that explanation. And some people will pretend to accept it, even though they know it is a sham.
hobarrera 11y ago
He posted the same on the python argentina mailing list last night. Unbelievable; he merely published security holes on publicly available code. Nothing wrong (nor legally, nor morally) there. It's not the first hole to get published recently either.
- threeseed 11y ago
  It IS legally and morally wrong to reveal security holes before there has been an opportunity for it to be fixed though. Security researchers almost always do the "right thing" before potentially unleashing mayhem. Not saying he didn't do this just that it isn't a black/white issue.
  - lawnchair_larry 11y ago
    No, it is neither illegal nor immoral.
  - madaxe_again 11y ago
    If it's less than 24 hours before the election, it's absolutely right to go public. Or are you in favour of electoral fraud? Republican, perchance? Work for diebold?
    - DanBC 11y ago
      He should have disclosed it to the regulators before going public.
      - NickNameNick 11y ago
        The debate between 'responsible disclosure' and public or 'full disclosure' has been argued ad nauseum elsewhere. but it really comes down to trust. If you don't trust the people you are responsibly disclosing to, to actually fix the problem, or worse to not sue you or attempt to get you charged as a criminal (the CFAA is particularly abusable), then full, public disclosure may be your only option to force the vendor to fix their product or service. Remember, it's already broken, and you may not be the first person to have noticed.

Some context: He found a security breach in the public voting system of Buenos Aires city, Argentina (elections are tomorrow). He brought it to awareness yesterday: http://www.lanacion.com.ar/1807352-denuncian-un-agujero-de-seguridad-en-el-sistema-de-votacion-electronica-que-se-usara-el-proximo-domingo http://www.lanacion.com.ar/1807352-denuncian-un-agujero-de-s... The tweet reads: After finding a vulnerability in the voting system they're raiding my house, people from computer forensics.

r721 11y ago

Broad summary of what's been going on the last few days in Buenos Aires, Argentina (by /u/sebadoom): https://gist.githubusercontent.com/sebadoom/f0eedcba2f39e3e07a1c/raw/c168b48210bf7f85029545743891e7e4f8c95df4/gistfile1.txt https://gist.githubusercontent.com/sebadoom/f0eedcba2f39e3e0...

embik 11y ago

What kind of people orders such a raid? What's the mindset behind that decision? Their own team wasn't good enough to catch the breach (hell, the whole thing sounds like a train wreck) and now they try to silence people who reveal their incompetence?

jamra 11y ago
The same administration that just assassinated a prosecutor that had written out an arrest warrant against her.
- demian 11y ago
  Wrong. The federal goverment is from a different political party, they are NOT the same people that are running the local city goverment. The police that raided this guy's house was the metropolitan police (BA city police), not the federal police.
  - hobarrera 11y ago
    Important correction: the "metropolitan police" is not the city police. Legally speaking, it's more of a private army that only answer to the executive branch of the city's government. Yes, it's incredibly amazing that such a thing exists. "Police" it just a word in the name of the institution.
    - dancingcat 11y ago
      I, and many others have proven in public/open court, that the police/military are completely compromised around the world, and that they are not allowed to act-as or call themselves the police or military anymore. It was scrubbed... Again, and again, and again... :-(
    - demian 11y ago
      Thanks for the correction, I didn't knew.
- marcosdumay 11y ago
  Just to add, an arrest warrant against her for aiding Iran terrorists that attacked Argentina. If embik thinks he does not know what those people think, I guess he should turn that into a certainty from now on.
- nmrm2 11y ago
  There are a lot of examples in the US of the government harrasing citizens who report vulnerabilities. The DMCA is typically used to justify this behavior. I'm not sure what the appropriate conclusion is here.
Semiapies 11y ago
If we're that charitable towards their motivations, I'd generally expect the sort of people who end up in large city administrations to do that more than not. Another possibility is that they had arranged a good setup for vote manipulation, and someone exposed it.
MichaelCrawford 11y ago
You must not know much about history. In Argentina specifically, there was Juan Peron. The broadway play and movie "Evita" is about his wife. I once read her biography. Some astronomers I once met were at cerro tololo inter-american observatory in chile when some heavily armed men turned up to look after the nearby radio towers. Conspiracy theories abound with respect to JFK's assassination. No one really believes that communists torched the Reichstag. On December 8, 1941, the pearl harbor base commander found a letter from the US state department in his mailbox, to let him know that the japanese might give him trouble sometime soon. "Gentlemen do not read each others' mail.". That was the stated reason that the US stopped its codebreaking work. I dont believe it really did. The best way to read a gentleman's mail is if he doesnt think he needs to encrypt it. Josef Stalin once knocked over a bank, then gave all the loot to Lenin.
- maxpupmax 11y ago
  With all due respect... What the hell are you talking about?
  - mattdeboard 11y ago
    One of my great fears is that posts like the one you responded to turn out, years later, to be 100% legitimate, despite how weird they sound now.
    - MichaelCrawford 11y ago
      Every starving writer just loves to hear about it when a fan appreciates his work.
  - polymatter 11y ago
    I think his ultimate point was that embik is being naive. That it is just a simple coverup with a thin, obviously untrue excuse.
  - MichaelCrawford 11y ago
    Have a read of the parent post that mine is a reply to.
threeseed 11y ago
Why wouldn't you order a raid ? A security vulnerability in a voting system has been exposed. Yes this guy may have done nothing with it but I would damn want to make 100% sure that was the case. And I would definitely want to make sure that the vulnerability wasn't recklessly revealed. This isn't like finding a browser bug we are talking about, you can radically alter the course of a nation.
MichaelCrawford 11y ago
You must not know much about history. In Argentina specifically, there was Juan Peron. The broadway play and movie "Evita" is about his wife. I once read her biography. Some astronomers I once met were at cerro tololo inter-american observatory in chile when some heavily armed men turned up to look after the nearby radio towers. Conspiracy theories abound with respect to JFK's assassination. No one really believes that communists torched the Reichstag. On December 8, 1941, the pearl harbor base commander found a letter from the US state department in his mailbox, to let him know that the japanese might give him trouble sometime soon. "Gentlemen do not read each others' mail.". That was the stated reason that the US stopped its codebreaking work. I dont believe it really did. The best way to read a gentleman's mail is if he doesnt think he needs to encrypt it. Josef Stalin once knocked over a bank, then gave all the loot to Lenin.

demian 11y ago

There are several bugs in the system reported by local engineers, like being able to add multiple votes to a sigle voter's RFID chip. This is a scandal and a complete failure at several levels, not only for the local city goverment but for respected institutions like the University of Buenos Aires which got paid to audit the system. And this is all happening in the same day as the America Cup (Copa America) Final between Chile and Argentina, so people are numb to most of this news.

alvare 11y ago

He is accused of leaking the private information of 2000 people involved in the electoral operation. That's why he was raided. Not because of the alleged vulneravilities he found.

wmt 11y ago
That would sound more reasonable, do you have a source for that or is that just heresay?
- madaxe_again 11y ago
  It was that and the WMDs in his cellar.
- alvare 11y ago
  https://twitter.com/fraudevotar https://twitter.com/fraudevotar http://justpaste.it/votarleaks6 http://justpaste.it/votarleaks6
angry_octet 11y ago
You don't raid someone for doing that, you raid someone to silence them, then use that as a justification. Some people will totally accept that explanation. And some people will pretend to accept it, even though they know it is a sham.

hobarrera 11y ago

He posted the same on the python argentina mailing list last night. Unbelievable; he merely published security holes on publicly available code. Nothing wrong (nor legally, nor morally) there. It's not the first hole to get published recently either.

threeseed 11y ago
It IS legally and morally wrong to reveal security holes before there has been an opportunity for it to be fixed though. Security researchers almost always do the "right thing" before potentially unleashing mayhem. Not saying he didn't do this just that it isn't a black/white issue.
- lawnchair_larry 11y ago
  No, it is neither illegal nor immoral.
- madaxe_again 11y ago
  If it's less than 24 hours before the election, it's absolutely right to go public. Or are you in favour of electoral fraud? Republican, perchance? Work for diebold?
  - DanBC 11y ago
    He should have disclosed it to the regulators before going public.
    - NickNameNick 11y ago
      The debate between 'responsible disclosure' and public or 'full disclosure' has been argued ad nauseum elsewhere. but it really comes down to trust. If you don't trust the people you are responsibly disclosing to, to actually fix the problem, or worse to not sue you or attempt to get you charged as a criminal (the CFAA is particularly abusable), then full, public disclosure may be your only option to force the vendor to fix their product or service. Remember, it's already broken, and you may not be the first person to have noticed.