Decertifying the worst voting machine in the US

https://freedom-to-tinker.com/blog/jeremyepstein/decertifying-the-worst-voting-machine-in-the-us/

by germinalphrase • 11 years ago

296 201 11 years ago

so the real question is where is the startup with the solution of $35 tablet "voting machines" on $10 stands and a $30 SBC "voting server" in a $15 lockbox that can deliver 4 "deluxe voting terminals" with a "server" for $2,000? (89% profit)

The references of the current players in the industry I see talk upwards of $3,000 per terminal! The industry standard pricing for this would be $12,000. $12,000 for buggy, insecure, closed-source, non-updateable, unverifiable, crappity crap. Awesomes.

How about this ... a voter walks into the polling station and can either use a terminal or their own smart-phone - connect to the open wireless "voting hotspot" where they can enter in an anonymous token at something that we use as the "hot spot sign-in page" that they are given by the people who volunteer the polling station that they can use to cast their ballot without waiting in line.

It's not like secure voting is an open problem. There just needs to be some crotchety capitalist company with people in suits selling it. Open source, anonymous, verifiable voting machines on open hardware with an optional paper trail (cups + network printer). We can do this making comfortable profits and at atleast a 60% savings to the tax payer.

The best part is that if the company goes out of business, everything is open source and documented, so we don't put communities at risk of the security issues with code rot.

So ... who wants to make some money? email me: kristopolous (at) gmail

bhickey• 11 years ago

How about this: A voter takes a paper ballot. The voter marks the ballot with a felt pen a deposits it in a bin. Polling place staff mark the voter's thumb with indelible ink.

Electronic voting is a problem looking for a problem. You need voter verifiable ballots with a high degree of tamper resistance. As far as trustworthiness goes it's hard to complete with ballot boxes and adversarial observers.

jaredklewis• 11 years ago

I don't see how your proposal can prevent double voting. Voting happens over a period of several days not to mention absentee voting.

Plus, it seems to me the process is not particularly tamper resistant during the ballot tallying phase, when compared with what is possible using cryptographic techniques.

kristopolous8• 11 years ago

I appreciate the consumer advocacy, but if the machines are going to exist (and they are), they should be done well.

agarden4• 11 years ago

The attack on paper voting is not flipping votes, it is invalidating votes. In Chicago, election officers counting the votes used to hide a small piece of pencil lead under their finger nail. If there were too many Republic votes, they would start putting an extra mark on some of them, thus invalidating the vote because of stray marks.

I think the solution is to crowd-source verifying the vote. If every ballot were given a unique number or code, and when the ballot was counted each ballot with who it was counted for as available for download on the web, third parties could verify that the numbers were counted correctly. And each voter now has an anonymous number that he can use to look at how the vote was counted and verify that it was counted correctly. If it wasn't, he complains. The political parties would be happy to urge their loyal constituents to check that their vote was correctly counted and to sue should they have a sufficient number of members claim theirs was wrong.

maxerickson• 11 years ago

In the couple jurisdictions where I've done most of my voting, the ballot box for the paper ballots has been an electronic tabulator.

I don't see much downside to this sort of system, there is a paper ballot for any checks that are needed or desired, and the vote tally is readily available when the election ends.

minikites• 11 years ago

Will a $30 voting machine be accessible by those with vision/motor disabilities?

kristopolous8• 11 years ago

Nope. You can have a special machine for them - just like you have a special porta-potty --- no need to increase the cost of every unit for that.

sdrinf• 11 years ago

Cost of customer acqusition. States have to be bagged one-by-one, each with an insanely long sales cycle, your profits have to cover those nice salespeople's salaries, while leaving you with sufficient profit to cashflow expansion. This is not a dev problem; the sort of orgs which are prepared, and can cashflow these sort of sales simply don't have (nor are they incentivized to have) any dev culture whatsoever.

kristopolous8• 11 years ago

first, that margins are pretty standard on accounting for sales and overhead

but even if they aren't enough here then you sell the machines to those people to flip them to the states at a higher cost. Don't be in THAT sales game. Otherwise, sure, you can add 30% to the cost ... it's not going to be another 600% just to sell the thing.

And even if it was, I'm sure I can personally, in my spare time, produce a far better product than the one outlined in the article.

krapp5• 11 years ago

where they can enter in an anonymous token that they are given by the people who work the station

That doesn't seem very anonymous. In fact, it seems like a possible way of deanonymizing votes, since in many places you have to sign a ledger or provide identification before voting.

kristopolous8• 11 years ago

you don't have to couple the two.

barsonme2• 11 years ago

Well, it could happen like this:

- Walk in, present some form of ID

- You sign the slip or give a thumbprint so they record that you've voted

- Random token is generated and given to you

- You enter the token in order to vote

- You keep the token as one way to verify your vote was cast

It'd be hard to match the voter to the token if they don't write down the token and associate it with your name.

nosuchthing2• 11 years ago

Please do better than these folks who just won a bid for elections in Los Angeles, and previously held elections in South Dakota, New Jersey, Chicago, IL, Cook County, IL, Denver, CO, Oregon, New South Wales, El Paso, CO, Utah, West Virginia, Honolulu, HI, Franklin County, WA, Swindon Borough, UK: http://www.everyonecounts.com

  so the real question is where is the startup with the
  solution of $35 tablet "voting machines" on $10 stands and 
  a $30 SBC "voting server" in a $15 lockbox that can deliver 
  4 "deluxe voting terminals" with a "server" for $2,000?

They appear to be using an iPad with their "SaaS voting app": http://www.everyonecounts.com/voting-unit/

kristopolous8• 11 years ago

I don't understand this race to the iPad ... the LAUSD (Los Angeles School District) had this bizarre iPad for every student program (http://www.scpr.org/news/2015/04/24/51241/lausd-developing-n...).

I say it's bizarre because I know you can get tablets in bulk for $30-$35 each while the lowest price iPad is $400.

After getting past "why does every student need a tablet computer" we get to "why from a single vendor with prices that are 1,333% higher than the cheapest competition?"

I'm not saying the Apple product isn't nice - it's just I don't see why so many tax dollars should be spent when there's other options.

Going back to the voting machine ... we'd not really care about some wonderful durability of the cheap tablet because the owner would only be using it a few days a year at the most; in ideal conditions, without moving it; the thing will survive fine.

owlish• 11 years ago

I'm curious, what security measures are in place for human vote counters?

wglb• 11 years ago

One member from each party, minimum of two, involved in the count.

rdsnsca• 11 years ago

Thats pretty much how they do it here in Canada. One member from each party plus an Elections Canada official. The ballot box is sealed in front of at least two voters , who determine that it is empty before sealing and then sign the seals. ( I know this because I was so early to vote the last election I had to wait for another voter to show up).

lazaroclapp2• 11 years ago

Humans are harder to compromise at scale. A single exploit can be replicated against hundreds of thousands of machines without heightening the risk of discovery by that much. Compromising hundreds of thousands of human vote counters without getting exposed due to a mistake is harder... although not impossible (it's in fact standard practice in plenty of countries)

realityking2• 11 years ago

I can only talk about Germany. Election helpers are sourced from the population of the community where the vote is held. (You can be compelled to do it if there are not enough volunteers), at least two election helpers have to be with the urn at any time. Anybody is permitted to stay in the room from the moment it's checked that the ballot box is empty until the vote result is announced. The vote itself is made in a way that loudly announces each individual count.

Afterwards the result from every polling station is posted online. So if you want, you can make sure your vote is accounted.

Now I'v been an election helper since 2009, I've never seen anybody stick around for the vote. It's mainly the election helpers keeping each other in check.

gpvos2• 11 years ago

Last time with the European Parliament elections in the Netherlands, there was a small uproar because the elections were held on Thursday (all other elections here are held on Wednesday), but the results could not be announced until Saturday or Sunday because most other European countries held their elections then. However, keeping the final result undercover for a few days is actually against Dutch election rules.

So, a critical web site organized a nationwide system where people could sign up for their polling station, to stay around during the counting and then report the results back to the web site. They got about 70% coverage I think; in the large cities it was near 100%. It was quite interesting. It was a close vote, and their result was slightly off, but close.

I am considering to alternate each election between being an official election helper and unofficial self-appointed monitor.

mrweasel• 11 years ago

Depends on the country, here in Denmark members of different parties are counting the votes. So they have every reason to keep an eye on the person next to them, which is from a different party. Also the votes are recounted by multiple different people.

germinalphrase2• 11 years ago

It likely speaks to my ignorance, but my gut reaction to using electronic voting machines has always been that they are inherently insecure and can't/shouldn't be trusted to provide an accurate tally. There is so much money (available) and motive to cheat an election count that I have a hard time believing large and significant races haven't already been victims of tampering in the US (even if we haven't seen hard evidence of such).

Is this cynicism misplaced?

flashman2• 11 years ago

At the very minimum, I would expect a voting machine to create two paper receipts after each vote: one provided to the voter and another stored internally. These would hopefully be on something more durable than thermal paper, though that might suffice. The receipt would contain the machine ID, timestamp and vote recorded.

Administrators could get a quick count from the machine memory, then perform a verification by pulling a sample of votes from the printed receipt and comparing them to the electronic values with the same timestamp. And any voter can compare their receipt with publicly-available voting records.

Of course, then you have to worry about exploits that can cause the machine to print votes on demand, because those would appear legitimate, especially if the voter's receipt printout can be suppressed - there'd be no incriminating receipt trail hanging out of an unattended machine.

hughw2• 11 years ago

You can't print out a person's vote on a receipt an admin could see; that's not a secret ballot. And, using that receipt, the voter can do little to verify his vote was counted.

Edit: the timestamp gives the voter away

sb0572• 11 years ago

Or you could just use a pencil and a piece of paper.

steveax• 11 years ago

You give the voter a paper ballot that they can visually confirm and deposit, themselves, in a ballot box, that can then be consulted to verify the electronic tallies in the event of a challenge. Honestly though, as an Oregon resident, I don't see why all states don't have vote by mail like we do.

speeder• 11 years ago

I am from Brazil, our machines are made by Diebold and a venezuelan company.

I personally think that the 2014 elections were faked, also the machines had been proven to be easy to cheat with, and there are evidence that cheating did happen. (example: in one state election here, the number of votes was higher than the number of voters, one of the candidates complained, and got fined for complaining...)

There is even a video on youtube showing how to cheat elections in a "impossible to trace" manner using diebold machines.

Also the Dutch banned voting machines that don't print a paper copy of the vote (that you then use to put on a normal ballot).

gilney• 11 years ago

Could you please provide some links?

x3n0ph3n3• 11 years ago

Your cynicism can be easily mistaken for just being a Luddite, but it doesn't seem too off the mark.

germinalphrase2• 11 years ago

I'm not suggesting we go back to voting with shards in a pot; I am just skeptical that voting machine have been/are secure from tampering. Seems like the kind of question that matters a lot.

Strilanc3• 11 years ago

It entirely depends if it's using cryptography or not [1]. For example, using zero knowledge proofs you can be given a receipt that lets you verify your vote was included in the total (without allowing you to prove to an attacker which party you voted for).

Using the computers as glorified counters is a security nightmare. Using them for what they're good at (crypto) would be a security boon, with the main downside being how hard it would be for non-computer-scientists to understand the nature of the security.

1: https://www.youtube.com/watch?v=ZDnShu5V99s

gizmo6862• 11 years ago

I don't think the non expert voters not understanding the security is that big of a concern. Assuming that the security undisputed amongts experts, the media could convey this to the general population (absent some well supported opposition like climate science faces). At this point, the security points that need to be conveyed to the voters are relatively simple:

1) The receipt you are given may be used to confirm that your vote was correctly counted. Here is a list of websites/programs that you can use to verify your receipt.

2) It is impossible to use your receipt to prove to a third party how you voted.

If we could get major news source (New York Times, CNN, Fox News, etc) to publish their own tools for (1), then I suspect that should give a fair amount of credibility for the general public.

The problem I see is that any technical system of plausible deniability I can think of, would require that a voter is able to forge a receipt that would correctly validate as the incorrect vote. Otherwise, if an attacker wanted to verify that Alice voted Democrat, he could assume she voted Republican and attempt to verify the receipt.

Lawtonfogle3• 11 years ago

How could it prove to you that your vote was included in the correct total without also being able to transfer that knowledge to a third party that is right there with you?

Say A and B were the options. Anywhere you take the receipt to verify it has to then display if it counted towards A or towards B. Someone there with you could then see which it confirms.

mcv4• 11 years ago

Is this cynicism misplaced?

I'd call it caution rather than cynicism, and I'd say it's entirely justified.

krapp5• 11 years ago

I kind of feel like "worst voting machine in the US" is a meaningless standard without knowing how much better the "best" such machine is. Or, to restate, are there any of these electronic voting machines that aren't crap?

hughw2• 11 years ago

Without giving details, the author says Diebold machines are 100 time more secure.

agarden4• 11 years ago

And still horrendously bad. http://gizmodo.com/200693/how-to-steal-an-election-with-a-di...

kennydude• 11 years ago

No. Pencil and paper will always work better

lazaroclapp2• 11 years ago

Voting machines are a very hard problem from a security standpoint to solve. So even a well designed and audited voting machine might still not be safe enough to use when compared with manual voting (which is not perfectly secure, but at least is more generally understood).

This, however, is stuff out of a Dilbert cartoon: "The wireless connection uses WEP (which we knew). What we didn’t know is that a few minutes of wireless monitoring showed that the encryption key is “abcde”, and that key is unchangeable"

vizeroth• 11 years ago

Don't forget the hard-wired Administrator password: "admin"... and no logging to let someone know that someone may have removed into the machine and replaced the Access database holding the votes.

gizmo6862• 11 years ago

In fairness, at this point I don't think "abcde" is any less secure of a WEP password then something like "dahslkgjhalgihao". WEP is really broken at this point.

seanp2k2• 11 years ago

Yeah, it just highlights the fact that they didn't even seemingly try to make it secure.

peterwwillis2• 11 years ago

Are ATMs also a hard problem from a security standpoint? Because we have relied on them to exchange currency around the world, 24 hours a day, 7 days a week, for decades. And they are basically identical in function to a voting machine, except of course for having more functionality.

Why don't we just use ATMs as voting machines?

jeltz4• 11 years ago

Some of the companies building these horribly insecure voting machines are originally ATM companies, so I do not think we have any reason to think that ATMs are secure. There have also been incidents where ATMs have been hacked.

ATMs are also an easier problem since they do not care about anonymity, part of the cryptography is done on the card, and they do not have to work without a netowrk connection.

zurn• 11 years ago

ATMs are actually a pretty fruitful point of comparison since people have a good idea of how ATMs work in their heads already. Some differences in the threat model come to mind:

- ATMs and their backend systems invest heavily into making complete transaction records, voting systems must be anonymous.

- ATM transactions can be undone.

- ATM operators can better afford to take a reactive approach, monitoring fraud levels and first taking a liability hit, until they can fixing the systems or must do a temporary network shutdown to stop the losses.

- ATMs get by with fewer controls for insider fraud due to above controls

- ATMs don't worry about nation state level adversaries

- Amount of damage from ATM compromise is clearly bounded, unlike legislation/election

leni536• 11 years ago

Maybe, note that XP still lives in the form of POSready partly because ATMs. But banks really put effort into logging transactions (why voting isn't a similar transaction is beyond me though), also I don't think you can find ATMs with unnecessarily exposed ports.

Here is a guy playing angry birds on an ATM:

https://www.youtube.com/watch?v=LHXP-1WpOIs

mikeash4• 11 years ago

Follow the money.

People who buy ATMs have a strong vested interest in their security, both physical and virtual. If the machines can be broken into or hacked, the people who buy the machines lose real actual cash. If the machines merely malfunction, it upsets their customers, which then costs the machine owners.

Ultimately, you can run the numbers on security to see how much money it's worth, how much it costs, and find the ideal tradeoff.

Voting machines have completely different incentives. The buyers have no vested interest in their security whatsoever. I would actually argue that they have a bit of a vested interest in insecurity, because a successful voting machine hack would probably cost people their jobs if it came to light, and if a machine is so insecure that you can't even detect hacks then this risk goes away. And if the machines malfunction, users often can't even tell. Even if they can tell, their unhappiness typically won't financially impact the people who buy the machines.

And thus we can see why, for example, Diebold builds good ATMs but craptastic voting machines.

DanielBMarkham• 11 years ago

E-voting, at least to me, looks completely idiotic. Why would we trust our most important civic duty, voting, to a collection of hardware that's known to be extremely vulnerable to attacks in every other job we give it?

Having said that, I think you could make it work with a paper audit trail that contained both the current vote tally and the current vote -- and was distributed to the person voting at the time they voted. (Then do random audits) (And of course that information would be obscured in some way, perhaps using encryption)

sb0572• 11 years ago

I feel the need to share this video again:

https://www.youtube.com/watch?v=w3_0x6oaDmI

viraptor3• 11 years ago

I'm having a hard time understanding the way voting machines are created these days. Why are they complete operating systems? Why do they have ports? Why do they look like they're overengineered in so many ways?

What's stopping the companies from producing a closed box with SoC+board connected to: N buttons, display, card reader/scanner, printer, wifi/ethernet. All you need is to take cards, register the result, add it to some continuously hashing database, print vote proofs, periodically upload data (again, public-key encrypted). If they need to be updated, allow only signed code. (ARM SoCs have secure-boot-like capabilities)

Am I missing something? Why do we get multiple iterations of machines with exposed ports, running XP, having hardcoded passwords, allowing admin access, having physical locks which can be opened without a key, etc. How can these things be created without at least one person saying "this shit is unacceptable"?

rurounijones• 11 years ago

Most of your questions can be answered "Because it is cheaper" and "Because certifying boards are useless"

krapp5• 11 years ago

Am I missing something?

Probably - corruption involving the contracts, outsourced or incompetent engineers (chances are, the best and the brightest are working on things that actually turn a profit), and neither party really having a strong interest in a system they couldn't subvert if they wanted to.

jaawn• 11 years ago

Hurray Capitalism?

Gibbon1• 11 years ago

I sort of chalk it up to the sort of stuff you get with hucksters that sell stuff to municipalities.

The business is a little different than when some random person buys a phone, because while they are technically inept, there is a layer of brokers/buyers between the manufacturers and the stores. Those guys are smart and know their markets well. If you ever sold something into that market you need to produce a few thousand units, for those guys to beat on. And they have to be perfect, or they won't place orders.

This doesn't exist for something like a voting machine.

So think 'stuff thrown together as quickly and cheaply as possible' in order to land the contract. Quality will vary a lot.

vinceguidry• 11 years ago

For most of the technology governments use, they are reliant on off-the-shelf hardware and software. Only the military has the budget to design solutions from scratch. Police equipment has traditionally been either ancient, or repurposed military hardware, only recently have budget blown up to where it's profitable for companies to design products specifically for police departments.

The private sector literally doesn't have any use, at all, for voting machines. The problem they solve never arises in modern life. So there's no commercial solution available to repurpose. Add that to the fact that election boards are always hideously underfunded and understaffed, there's no one out there to hold the contractors' feet to the fire.

Really, state and local election boards need to just go back to the older systems, but there's nobody making them do it, and you will sound like a Negative Nancy trying to take away all their fancy new kit.

What really needs to happen is for POTUS to make it an issue. With one swipe of his pen he could issue an executive order to throw federal money at a new department whose job is to maintain a body of standards for electronic voting machines and mandate that all new machines have to adopt on a certain time table. They probably won't be secure, but it'll be the department's job to respond to reported vulnerabilities and ensure that they get fixed.

BurningFrog• 11 years ago

How much would it cost to produce a decent secure voting machine design? No more than a few tens of millions, right?

Maybe a few of the tech billionaires that read HN could pass around a hat and get this done?

"Saved American democracy" would be a good legacy for anyone!

jsprogrammer• 11 years ago

Governments didn't make this device. They hired a contractor and/or purchased from a vendor (which likely specifically set up its business to profit from government contracts for voting machines). The vendor is almost exclusively interested in getting paid money from the contract, not with actually delivering a highly secure device that a democracy can depend on.

Commercial viability of a solution is a non-issue. A device is either highly secure or it isn't.

_pmf_• 11 years ago

Only the military has the budget to design solutions from scratch.

Define from scratch. It's perfectly reasonable and economically feasible to develop a SoM or SoC based hardware platform.

Maxious• 11 years ago

Why put in all that cost/effort when you can sell laptops with MS Access voting apps for the same price?

viraptor3• 11 years ago

Can you? When we're talking about N machines per each voting point, even volume pricing of MS Access may be larger than a dedicated box. Of course the price of designing a dedicated box is non-zero. But if you can reduce the dedicated box spec to <=$100 and reduce the scope of any review (you're not reviewing the whole OS anymore), I'm not sure laptops would be cheaper.

spacecowboy_lon• 11 years ago

which is secure?

cm2187• 11 years ago

What I don't get is why using access. If it's just to keep count of the number of button pressed, even a text file is good enough.

drewcrawford• 11 years ago

What you are missing is that the technical part is not the hard part. The hard part is all the rest of it.

For example, here [0] is a link to the 200-page "volume 1" of the federal standards, merely one of a complex web of certifications that these things go through.

One random paragraph is illustrative:

Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand, without disruption of normal operation or loss of data, electrical fast transients of: a. +2 kV and −2 kV on External Power lines (both AC and DC) b. +1 kV and −1 kV on Input/Output lines(signal, data, and control lines) longer than 3 meters c. Repetition Rate for all transient pulses will be 100 kHz

Now I am a software engineer, and quite frankly I have no idea whether these are large tolerances which would require specialized equipment to withstand or whether e.g. my laptop would sail through this kind of event. Nor do I have any idea how I would demonstrate compliance with these requirements to the satisfaction of a federal examiner.

And that is what voting machines are. They are checkboxes on a specification. That means that you can buy them with confidence that somebody else's ass will be on the line when they turn out to be awful. The fact that they actually record votes is ancillary at best, the primary feature and the reason for buying them is that they tick the checkboxes.

As to why they seem overpriced, the reason is that it costs a lot of money to have an engineer hook the thing up to his fancy oscillator and write you a report that yes, this machine complies with requirement 4.1.2.6.c, over and over again.

[0] http://www.eac.gov/assets/1/Documents/VVSG.1.1.VOL.1.FINAL.p...

nitrogen• 11 years ago

That kind of testing is par for the course for electronics manufacturing at scale, though it does seem these requirements are quite stringent. The 100kHz repetition rate sounds odd though, and some of the other specs aren't completely clear. But regulatory testing of electronics is, in general, a solved problem, as are the mitigations for voltage surges.

reilly3000• 11 years ago

Not to mention how hard it is to sell to the government. It can take months to get into the system then you need to wait for the RFP process to have a request that matches your capabilities. Then procurement. It's a huge barrier to entry for startups.

ferongr• 11 years ago

Actually, those requirements are par of the course when designing mains-powered devices . You'd be surprised the kind of transient voltage spikes AC motors generate when starting, and I'd assume all devices sold in the US satisfy the same or similar standards.

Having engineers design and test electronics with such kind of safety standards is good practice. You don't want a failed USB power supply to fail in a way that sends mains voltage to the USB for example.

msravi5• 11 years ago

I used to consult for a company that made WiMax base station equipment in India. Typically, the way government would work, is that they'd send out request for information to multiple vendors. Then, they'd take the list of parameters that they got from each vendor, create a master list of parameters, and pick the "best" under each parameter as a requirement. Then, they'd send out a request for quotes to all vendors with a list of requirements that would be impossible to meet simultaneously.

tripzilch• 11 years ago

Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand, without disruption of normal operation or loss of data, electrical fast transients of: a. +2 kV and −2 kV on External Power lines (both AC and DC) b. +1 kV and −1 kV on Input/Output lines(signal, data, and control lines) longer than 3 meters c. Repetition Rate for all transient pulses will be 100 kHz

The real question seems to be, they apparently have all these stringent electrical engineering requirements set up in the standards, ones that seem to be made with detailed input from a professional electrical engineer, ones that can only be properly understood and tested by someone with electrical engineering knowledge.

So why did all these requirements on electrical engineering get into the standards, but requirements on software security did not?

msravi5• 11 years ago

Electronic voting machines used in Indian elections are custom built for the purpose, and cost about $100.

https://en.wikipedia.org/wiki/Indian_voting_machines

All it has is N buttons, accumulators to store presses of each button in non-volatile memory, and a seven-segment LED display to indicate status (ready-to-vote, vote cast, etc.). Vote counting is done offline by connecting to a controller. No wifi or any other remote-access capability.

All that really needs to be done to create a paper trail is to add a printer.

Not implying that they're completely secure, but any breach at least needs physical access to the box. And physical security of the machines is on the same level as those provided for traditional ballot boxes.

Edit 1: The balloting unit does not even have a 7-segment display - just individual LEDs next to their buttons to provide feedback that the button has been pressed.

Edit 2: More details on the internals of the EVM: https://jhalderm.com/pub/papers/evm-ccs10.pdf

codeN2• 11 years ago

Indian EVMs are not as secure as ballot boxes. It is dead simple to "inspect" a ballot box once received for any backdoor that might be there, but not the same for Indian EVMs, in fact there is an attack where the attacker can change a single IC, and make the machine remotely editable, or "distribute" votes, and that can be turned on and off. https://www.youtube.com/watch?v=apkSkb6Ak3I

mtgx2• 11 years ago

I think the main party to blame here is Microsoft. They're pushing this "one-size fits all" solution into everything - from embedded systems to super-computers. To them it doesn't matter if Windows is "over-engineered" for a voting machine - it's just another license sold.

If it were up to me no embedded system would ever use the same operating system that's on a billion PCs. That's just asking for trouble.

pjc504• 11 years ago

Define "embedded system" here: a ban on kiosk PCs? Could you apply the same logic to Linux, which is on hundreds of millions of PCs and also embedded routers? Is the problem just proprietary software?

pjc504• 11 years ago

Because the important thing is getting it through the procurement process, which is largely a political wining-and-dining process. The procuring governments have no way of assessing their requirements or whether they're getting a good product.

The solution you describe is the cryptographer's one, the result of taking security seriously. The contract goes to those who take the politics of procurement seriously (and, frankly, pushing unsuitable and unnecessary solutions to non-problems). It's still questionable whether electronic voting is necessary at all.

A lot of the early bad ones were from Diebold, who make ATMs. The ATMs also run WinXP, but are much more physically protected.

madaxe_again2• 11 years ago

A simple but elegant product is unlikely to wow the politician making the purchasing decision.

If it's complicated and over engineered, it'll probably be expensive too. Both factors in favour for a politician, as if it's expensive it's a safe bet.

If it's a boring little eight-segment display and a pair of buttons, the voters will go "we spent $10m on this cheap looking crap?!".

So you go for the one with the shiny gui, the crazy price tag, and you've chosen sensibly - or as sensibly as one can in our batshit insane system of the world.

gambiting• 11 years ago

Because those things are decided on basis of what's cheapest, not what's the best. I'm 100% certain that designing your own box with custom buttons is more expensive than buying cheap laptops with XP already pre-installed.

"How can these things be created without at least one person saying "this shit is unacceptable"?"

Because the people who decide what the money is getting spent on have absolutely no idea what is acceptable and what isn't.

kyleblarson• 11 years ago

Grandfathered in lucrative government contracts.

wmeredith• 11 years ago

I've said it before many times, but the government's operating procedures are (accidentally (sort of)) tailored to explicitly filter out all the things that make for good hackers/programmers. This is an old essay I wrote on this subject that I usually post in repsonse to comments like this: http://wademeredith.com/2011/05/why-the-dmv-website-sucks/

chrischen• 11 years ago

I'd say that for most people if you aren't hacked, or had your identity stolen, it's because no one has tried.

m_mueller• 11 years ago

So this machine has now been decertified. Fine. What I'd like to know: How could it ever get certified? What does certified even mean if not accountability of a certifier in case a system doesn't do what it's certified to do? Or is the certification process flawed? In that case I guess that should be fixed next.

bbanyc• 11 years ago

The certification was done by the Election Assistance Commission, created in the wake of the Florida 2000 punchcard ballot debacle. The EAC hastily certified the first batch of electronic voting machines, issued grants to the states to buy them before the ink on the certifications was dry, and then was promptly forgotten about. (There was a 3-year period when the EAC was unable to do business because all the seats on its board were vacant.)

jMyles2• 11 years ago

A commission apparently tasked with ensuring that the hijincks observed in Florida and Ohio are permitted to continue and proliferate.

gpvos2• 11 years ago

Why didn't they just fall back to paper and pencil, and manual counting? We've been doing that in the Netherlands since election machines were discredited after a successful campaign by hackers. Haven't had any real problems with it.

itburnswheniit• 11 years ago

Most voters aren't relevant anymore.

Princeton confirmed it in a study earlier this year. It's neatly summed up here: https://www.youtube.com/watch?v=5tu32CCA_Ig

cjslep• 11 years ago

An interesting documentary is "Hacking Democracy" (2006) [0] that championed open voting machines and open election processes to help prevent election fraud. The documented fraud that occurred in the early 2000's really lifted some of my childhood innocence from my teenage brain.

When mistakes that happen are chalked up to "computer glitches", but it only takes such a few bugs in a few key locations to change the outcome of an election, the results can be game-changing.

The full documentary was pretty concerning, and I have carried very little faith in the voting process since.

[0] https://www.youtube.com/watch?v=5Qk95SVRdEo (Last minute contains the section where the grandmother "steals" proprietary Diebold Election Systems code off an open webpage)

[1] https://en.wikipedia.org/wiki/Hacking_Democracy

mikeash4• 11 years ago

It's very much worth reading the comments on this one, in which a Virginia elections official who was involved with these machines repeatedly defends them in a delightfully earnest but disturbingly clueless manner.

One of the points he's stuck on is that WiFi is short-range and unreliable from outside a building. Thus hacking these things from the parking lot would be impractical because you couldn't get access. Apparently the very concept of directional antennas is completely unfamiliar to this person.

Another strange point is that these defects weren't known when Virginia chose these machines. To him, that seems to mean "therefore it was a reasonable decision." To me, it raises the question: why didn't anyone look into their security as the choice was being made? Apparently the process by which Virginia chooses its voting machines, or at least the process it used at the time, involves no third-party security evaluation. What the hell?

enraged_camel• 11 years ago

>Apparently the process by which Virginia chooses its voting machines, or at least the process it used at the time, involves no third-party security evaluation. What the hell?

Government RFPs pretty much never have a third-party evaluation process. Those cost money, which is almost certainly not in the budget.

Also, the vast majority of the time the government already has a preferred vendor, and the RFP is simply a legally-required formality.

nmrm25• 11 years ago

Apparently the very concept of directional antennas is completely unfamiliar to this person.

IMO that was not the disturbing part. I don't expect elections officials to know anything about RF.

What's disturbing to me is that several experts explain in very plain terms why his assumptions are wrong, and he persists in his misunderstanding.

mikeash4• 11 years ago

I certainly wouldn't expect advanced RF knowledge, but satellite dishes are a common sight in this country, so I would hope that passing familiarity with the basic concept of directional antennas (even if they don't know what to call them) would exist.

Even barring that, I would at least expect an official to know the depths of their own ignorance. If you don't know anything about WiFi, fine, but then don't try to make arguments about it.

And yes, persisting in making those arguments, not only being ignorant of the subject but after being corrected by people who know, is a special kind of ridiculous.

83457• 11 years ago

They should sit every government official down and make them watch Mr. Robot to scare the crap out of them on cybersecurity

avivo• 11 years ago

It would be fascinating to see if there is a correlation between potential signal strength of an external attacker, and votes for a particular candidate. This seems like the only good way to see at this point if there was any tampering by a (somewhat limited) adversary. While this would only work to detect external wifi based attacks, those seem like the most likely.

Perhaps a "simple" first pass could be done by looking at building type (concrete vs. wood?) via aerial maps, and correlating that to local polling data. If anyone does do an analysis like this, I'd love to see the results!

maze-le• 11 years ago

Voting machines should be called voting computers. That is what they are, they "compute" a vote-count (with all problems and fallacies that word implies).

Vespasian2• 11 years ago

Why is there the need to use these machines in the first place? IMHO the overengineering started when using a tech solution for a non tech problem.

Voting on paper seems to work for most democratic countries and it's definitely harder to rig than the electronics. I just don't see any siginificant advantage in using technology here (and no, a few $/€ saved every other year is not significant in my honest opinion)

madaxe_again2• 11 years ago

So it's easier to rig elections. Honestly, can't think of another reason.

jeltz4• 11 years ago

Another reason is if you have some buddies who are ATM manufacturers who you want to give some lucurative government contracts.

ekimekim• 11 years ago

Manual vote counting takes significant time and effort, and a properly implemented electronic system would have advantages in tamper-proofness. It also could have advantages in being interactive so users can't fill things out incorrectly, can be guided through the process, etc, which is especially important for people with disabilities.

Unfortunately, all the advantages rely on implementing a good system, so I doubt we'll be seeing them any time soon.

Vespasian2• 11 years ago

I agree with your conclusion. Some remarks though.

I don't think the voting process itself gets sped up a lot just because you tap a screen instead of crossing a field.

The tamper-proofness is certainly attractive, however what we have on the market today is so far from that goal that one has to consider it less secure than paper by several orders of magnitude.

Slighty oftopic: I just found out how embarissing little I knew about accessibility processes in elections. Therefore thank you for mentioning that ;)

verytrivial• 11 years ago

Electronic voting machine implementation, testing and deployment also takes a significant time and effort. Tamper-proofness obviously has a original and natural physical implmentations that do not require first chosing two large prime numbers: tape and sign the damn box! Though you didn't raise the point, some argue that the time it takes to manually count is a problem, as if people seriously can't wait an extra half-day. Just WAIT. It's important.

The clear advantage of paper voting is everyone--the entire electorate-- can see and understand the process. The legitimacy of the outcome depends on this understanding and trust.

mcv4• 11 years ago

Can they really be tamper proof? How do you know they're tamper proof? The only way to really be sure is if anyone can check the correct functioning of the machine. If it's only in the hands of a company and a few officials, there's no way for us to check. There has to be a verifiable paper trail that can be checked to verify everything happened correctly.

As convenient as it might be, I fear electronic voting will always remain vulnerable.

antimagic• 11 years ago

Electronic systems introduce single-points-of-failure into the voting process - figure out a way to compromise the machines / vote collection process, and you can steal the election. Doing the same thing with a manual system requires cheating on a massive scale, which is pretty much impossible to do discretely, making it much safer.

ash• 11 years ago

German Constitutional Court agrees with you, having ruled e-voting unconstitutional in 2009:

While in a conventional election with ballot papers, manipulations or acts of electoral fraud are … only possible with considerable effort and with a very high risk of detection, which has a preventive effect, programming errors in the software or deliberate electoral fraud committed by manipulating the software of electronic voting machines can be recognised only with difficulty. … The voters themselves must be able to understand without detailed knowledge of computer technology whether their votes cast are recorded in an unadulterated manner as the basis of vote counting, or at any rate as the basis of a later recount.

http://electiondefensealliance.org/germany_rules_evoting_unc...

http://history.edri.org/edri-gram/number7.5/no-evoting-germa...

mcv4• 11 years ago

I'm not sure if they've been ruled constitutional in Netherland, but in 2009 the government decided not to use them anymore after pressure from an organization called "Wij vertrouwen stemcomputers niet" ("We don't trust voting computers"), lead by hacker and pioneering ISP founder Rop Gonggrijp.

I'm actually still kind of impressed that a protest from the hacker community was so successful in convincing the government.

patrickk• 11 years ago

I'd be curious to get HN's opinion on crypto/blockchain voting ideas such as http://www.bitcongress.org.

It seems many of the disadvantages of traditional e-voting machines and the speed/counting effort of paper-based voting are done away with.

Marazan2• 11 years ago

Why does America have alove affair with voting machines? What is wrong with paper and pencil?

uptown• 11 years ago

Paper and pencil aren't a perfect solution either. This page shows a few examples of where things have gone wrong.

http://blogs.mprnews.org/newscut/2008/12/timewasters_the_bal...

In the case of the Florida Presidential vote, they ran into the problem of "hanging chads" where parts of the page that were intended to be fully punched-out so a machine could detect the vote were still attached to the page, leading to further scrutiny over deciphering the true intent of the voter's ballot.

slasaus7• 11 years ago

That was not a pencil but still a lot of technology/mechanics. But you're right, paper and pencil are not perfect, just the most secure we can practically achieve these days and probably for the upcoming decade. See this video of J. Alex Halderman on e-voting in Estonia and about electronic voting in general [0]. (Halderman is a professor also known from the cold boot attack and the more recent vulnerabilities in a lot of Diffie-Hellman implementations).

https://www.youtube.com/watch?v=JY_pHvhE4os

Marazan2• 11 years ago

The chads was due to yet more voting machines not pencil and paper.

maxki• 11 years ago

The only reason I can think of, is that the " paper+pencil+sealed cardboard box" solution isn't good at giving lucrative contracts to buddies of election officials. The "speed of counting" argument does not hold : in Canada we get the final results of elections just a few hours after the closing of the vote. Tallying is all manual, and the counting of each box is done under the supervision of members of antagonistic parties.

Lawtonfogle3• 11 years ago

Because it is easy to see how in a single case a paper and pencil vote can be cheated. Switching votes, a bad counter, throwing away some votes from the guy you don't like... all of these are easy to imagine. In comparison, the types of attacks needed to take out a voting machine seem much more complicated. And so many people seem to assume that this means that voting machines are more secure.

In my own experience, most people who view it this way don't consider scaling. While pen and paper is an easier attack for a single voting station, it is far more difficult to scale. Every voting place brought in on the scheme has more people who could be caught or decide to go public, and that is assuming you are able to get in contact with those people in time to ensure they are able to intercept the voting. With voting machines, one good exploit, especially for wifi enabled machines, can easily infect larger numbers.

As to why other countries don't have people viewing it this same way... I don't think it is because they have better ability to consider scaling attempts to exploit a system.

Sami_Lehtinen• 11 years ago

Why do you need voting machines, when everyone got smartphone, tablet or computer? http://estonia.eu/about-estonia/economy-a-it/e-voting.html

kakoni• 11 years ago

Some controversy on that topic https://pacsec.jp/psj14/PSJ2014_Hursti-MacAlpine_Estonia-Pac...

slasaus7• 11 years ago

Mirror in the Netherlands, Amsterdam: http://controleerbareverkiezingen.nl/pub/PSJ2014_Hursti-MacA...

TazeTSchnitzel2• 11 years ago

Estonia's Internet voting is worse, because it uses cryptography, so people assume it is safer.

slasaus7• 11 years ago

See this video from last December at the CCC in Berlin a famous research professor presents his findings: https://www.youtube.com/watch?v=JY_pHvhE4os

They filmed the whole NOC because they wanted to be transparent, but then it became clear there were passwords sticked on paper on the wall :) Never forget or undermine operational security.

Beltiras• 11 years ago

50$ android tablets with USB tethered networking and WiFi physically removed (take out the antenna). Software solution has been described ad nauseum both in this thread and elsewhere. This would be at least as secure as the current state of affairs and you could actually get this up and running quickly.

mcv4• 11 years ago

This is unbelievable. How did they even get certified in the first place? What standards are there for voting machines in the US?

A couple of years ago, a Dutch group of hackers (led by Rop Gongrijp) argued very strongly against the use of any kind of voting machine. Not because they're so easily hacked (I assume the Dutch voting machines were fairly secure), but simply because they're a black box and you simply have to trust that whatever comes out is correct, and there's no paper trail you can verify to check whether it actually is correct. If they've been tampered with, you most likely don't know, and even if you do know, there's no way to correct it.

Netherland has very specific voting laws to ensure that elections are reliable and verifiable, and when voting computers were introduced, an exemption was added to the law because voting computers couldn't possibly meet those rules.

The hackers successfully argued their case, so we're back to voting with pencils again. Cumbersome, but we know (and can verify) that it works.

davotoula• 11 years ago

"If an election was held using the AVS WinVote, and it wasn’t hacked, it was only because no one tried."

Ouch!

m3h• 11 years ago

Is this really America you are talking about? O.o

JulianMorrison• 11 years ago

It's going to be interesting to see who suddenly gets voted out, as soon as these are replaced.

Decertifying the worst voting machine in the US

Related Stories