Senators ask why vendors sell voting machines with ‘known’ vulnerabilities’

https://techcrunch.com/2019/03/27/senators-security-voting-machines/

by Ours90 • 7 years ago

111 70 7 years ago

Regardless of one's political leanings, it's frightening that only one of the two major American political parties is even feigning interest at fixing what is clearly a vulnerable system.

This shouldn't be a partisan issue, but it somehow continues to be.

lisper4• 7 years ago

That's because one of the two political parties has only minority support and thus depends on a long list of dirty tricks to remain in power.

burlesona• 7 years ago

That's a gross misunderstanding of the electorate. The Republicans didn't have the national majority vote this presidential election, but in Congress that's irrelevant. Have you been to Utah, or any of the other heartland states? They have overwhelming majority support.

One of the worst problems in the country right now is that things have become so geographically polarized. Many people live so deep in their (red|blue) bubble that they don't even know anyone who votes for the other side.

samfriedman2• 7 years ago

I think it'd be disingenuous to call either party's support a "minority" when they collectively represent 55% of voters as of 2014. https://www.people-press.org/interactives/party-id-trend/

duxup2• 7 years ago

In the US voting machine decisions are also a very local decision. So even if it was a party decision... it really would have to be very local party decisions.

Often times national party decisions in the US do not translate into local action even by folks in the same part as obviously things change on the ground.

elliekelly• 7 years ago

The federal government could set certain minimum standards for voting machines used in federal elections. That would effectively set the standard for all elections since I can't imagine any local governments could justify a set of machines for federal elections and a different set for local.

coldcode• 7 years ago

If the ability to alter an election in your favor can be done invisibly, and you value being reelected over transparency, then buying these products make perfect sense. It's not an American thing, rigging elections is probably as old as having them.

cdoxsey3• 7 years ago

This isn't true.

The Secure Elections Act was introduced by a Republican: https://www.congress.gov/bill/115th-congress/senate-bill/226....

raquo2• 7 years ago

It also went nowhere, stalled in a republican controlled senate by a republican controlled committee.

save_ferris3• 7 years ago

This is absolutely true.

As someone else pointed out, it didn't even make it out of the committee controlled by the ruling party, and certainly wouldn't have made it out of the Republican-controlled Senate.

This legislation would pass in a Democratic Congress and White House, but absolutely will not in a GOP-led government. Full stop.

dubyah• 7 years ago

As a counterpoint: the FEC over the past decade.

The Republican voting bloc has stymied enforcement actions for much of that time.

bshipp• 7 years ago

Criticisms of the underlying hardware/software aside, my intuitive answer to the headline question is "because governments are buying them."

Perhaps the esteemed Senators should undertake a short naval-gazing exercise and ask "how could there only be three major players in such a lucrative segment, each selling ancient hardware and crappy software products?"

I'm going to go out on a limb and guess at the answer to that question, and it likely shows those three companies as being the only ones with the patience and tenacity to get those models approved.

So Mr./Ms. Senator(s), I suggest you rephrase your question as follows: "how can we simplify the procurement process to make sure we, the government, are receiving the greatest value for our expenditures?"

maxxxxx3• 7 years ago

"because governments are buying them."

The main problem in american politics is that a lot of decisions are made either to damage the "other" party or to accommodate some donor. When you look at Congress they barely think about doing something right.

tru3_power• 7 years ago

Off topic question- but this is always something that interested me: do you have any blatant examples of a high level politician solely choosing a product to accommodate a donor?

munificent3• 7 years ago

"how could there only be three major players in such a lucrative segment, each selling ancient hardware and crappy software products?"

Because all markets tend towards cartels and consolidation unless vigilant, enforced regulation prevents it?

Why do Coca-Cola and Pepsico have >60% of the soft drink market? Why do the largest two or three meat processing companies have the majority market share in almost every category? Why does Nestle have more annual revenue than the GDP of Sri Lanka?

linuxftw• 7 years ago

Why do Coca-Cola and Pepsico have >60% of the soft drink market?

Well, this one is probably simple: government. I'm unsure whether it would be copyright, or trademark infringement, but if you release a product that tastes exactly like coke or pepsi, you'll probably find yourself in expensive litigation.

justin66• 7 years ago

So Mr./Ms. Senator(s), I suggest you rephrase your question as follows: "how can we simplify the procurement process to make sure we, the government, are receiving the greatest value for our expenditures?"

Hey guys, let's drop this important task we are working on and go look for the holy grail!

Bluestrike2• 7 years ago

They don't actually have any influence in the purchase decisions, as it's a state matter. Machines are bought by local governments, with varying state regulations on what can be purchased depending on the state in question. Most machines were paid for by local jurisdictions with a mix of federal funding (HAVA), and in some cases, state funds for part of the cost. Some states have uniform systems; others do not.[0] On election day, there isn't just "one" election but thousands taking place.

There's no single procedure for procuring voting machines, well, anywhere.

To make matters worse, each jurisdiction and the states are fiercely protective of their power in this matter. A federally uniform system, or even just something beyond the very basic requirements set by the Help America Vote Act in 2002, is right now very unlikely and would be a massive political and legal mess. Or, more accurately, a series of messes.

0. http://www.ncsl.org/research/elections-and-campaigns/the-can...

ams6110• 7 years ago

There's no single procedure for procuring voting machines, well, anywhere.

And that's probably a good thing. Heterogeneity in this sort of thing is desirable, as it makes large-scale fraud harder to pull off.

specialist6• 7 years ago

In addition, there's no uniform certification process. EAC.gov made things a wee bit better, but it's an advisory role.

amanaplanacanal2• 7 years ago

And nobody apparently wants to spend any more money on elections, even though it's actually going to take money to fix the problems.

Macross82992• 7 years ago

I suppose it's more politically expedient to blame the companies trying to rationally minimize cost rather than risk reprimanding and alienating state and local officials who sign contracts for voting machines without any sort of serious security, auditing or compliance provisions.

This sure does seem like grandstanding from these senators. Probably not unrelated to fallout from the Mueller report.

munificent3• 7 years ago

reprimanding and alienating state and local officials who sign contracts for voting machines without any sort of serious security, auditing or compliance provisions.

What other options do these officials have?

The companies have the choice to improve their security of their hardware at the possible expense of lowering their profit margins.

Whenever you're deciding who to point the finger at, one simple rule is "Can this person actually effect change?" If the answer is "no", then blaming them isn't helpful.

Macross82992• 7 years ago

What other options do these officials have?

Paper voting, for one. If no system is offered that is secure enough, then the default should be no electronic voting system at all and just paper voting. It's scaled fine for hundreds of years and has clear processes in place for custody of ballots.

The companies have the choice to improve their security of their hardware at the possible expense of lowering their profit margins.

You can't expect companies to just "make a choice" to lower profit margins without some sort of (dis)incentive or external pressure like regulation. It's unrealistic. Companies exist to make their principals money. It's the government's job to check that and make sure that the companies are acting in public interest while they pursue profit.

Local and state officials definitely can effect change on this level since they are often the ones in charge of the procurement process.

BenMorganIO• 7 years ago

Note: this article is of the United States.

ddingus4• 7 years ago

They ALL have a known vulnerability. Works like this:

Pretend the machine is a person in a secure room only they are in, and only they know the contents of.

You approach a window, tell them your vote. They say it back and optionally hand you a piece of paper.

Then, in that room, they do whatever they want, and the final tally, winner of the election is determined by whatever they did in the room.

Voters have no chain of trust between their expression of intent, and the record used for the final tally. When voters make physical expressions, and those expressions are counted, voters know the election, on a basic level, can be trusted to reflect the collective intent of the people.

When they use electronics, they have no idea. They push a button, or mash a screen, and the display will tell them something and that something could be anything. They cannot know.

None of us can without forensic level examination of the machine. Even then, we can only verify function and infer a voter intent was correctly recorded and or used for the tally.

Secondly, should there be error, or controversy, the enduring record of voter intent both walked out of the building and or is a collection of grease smears on input devices.

Useless in a court of law.

The only way around this is to make vote records personally identifiable and basically use the systems for banking. (Who gets around this problem with multiple, redundant records created at the time of transaction)

misterprime• 7 years ago

The problem with public vote records is that people may be incentivized financially or coerced via threat to vote a certain way. The bad actor in this situation can verify with public record if the victim followed through.

Somehow I think this is less of a threat than our "black box" vote tallies, but it is valid.

ddingus4• 7 years ago

Precisely! I think electronic voting records are wrong. We should use paper ballots, and Counting them electronically with something simple and robust like Optical scan works really well. Let the statisticians run some Audits and we can be really confident. My state does that. Oregon.

Slippery_John• 7 years ago

Why not have paper ballots that can be read by a machine? It doesn't get around the issue entirely, but you can always look at the physical ballots for a recount. It's a lot harder to tamper with an election at scale when you need to handle physical ballots.

Or just abandon electronic voting entirely. Ireland tried electronic voting, but scrapped it for just these reasons. You could even keep the ballots in a machine-readable format for sanity checks if necessary.

ddingus4• 7 years ago

This!

I don't have any real concerns about machine counting given a physical record, basic statistical means can tell us all we need to know.

dbcurtis• 7 years ago

My precinct in Sunnyvale has been doing this for decades. Paper ballot, marked with ink (no “hanging chad”). Ballot is machine readable, and cheap. And easy to process. And has no reliance on high tech on voting day — you could vote by candle light if the power goes out.

danaris• 7 years ago

In New York State, we have exactly this: optical-scan ballots. We fill in the bubbles of the candidates and issues we support with a black marker, then personally feed them into a voting machine that both securely stores and automatically tabulates them. If they needed to be hand-recounted, that could easily be done.

The one significant improvement I would prefer in this process is verifying on the optical-scan machine's screen which options you have voted for, with the option to retrieve your ballot and fix it if anything shows up wrong.

gumby2• 7 years ago

I think it's pretty straightforward to understand: the buyer likely has little to no expertise in the important issues. This is not in any way a slur on election officials, simply the recognition of the (statistically) likely experience of someone who is a local election official.

In addition the way the question is structured by the senators isn't really fair either: if you have n bugs to fix before the ship date, you'll prioritize them and then ship (presumably) the best product you can by the immovable target date. That is also reality.

Though voting is a local matter the Federal Government has a constitutional interest (Article 1, Sections 4 and 5) in the elections to Congress and can mandate minimal standards for voting just as the DoT mandates minimum standards for automobiles. So they could require that whatever machines used are verifiable and non-repudiatable. They could also mandate procedures although those are harder to enforce. If States need to buy equipment suitable for congressional elections they'll presumably use the same equipment for all other elections too.

specialist6• 7 years ago

In my experience, the buyers (election administrators) at the state and local levels know exactly what's going on. Like every where else, there's a revolving door between govt election administrators and the private vendors & consultants.

gumby2• 7 years ago

Hmm, perhaps I was thinking too fine-grained.

gafferongames• 7 years ago

The better question is, why do they keep buying them?

Senators ask why vendors sell voting machines with ‘known’ vulnerabilities’

Related Stories