Source code of Polish electoral voting system?

https://github.com/wybory2014/Kalkulator1/blob/master/Kalkulator1/ClassMd5.cs

by tartle • 12 years ago

111 62 12 years ago

tartle2• 12 years ago

Context: State Electoral Commission declared a computer glitch is delaying the vote count. The problem persists, and election results are not yet available.

desdiv• 12 years ago

Here's a Google Translate of the README.md file:

Based on a cursory analysis of the executable file and application development can be concluded that the performance of the Election Calculator entrusted single Studénka, probably working for external contractors. Ms. Agnieszka, I really sympathize, we are with you!

Poland is a country in which the fate of thousands of members of the committee rests on the shoulders of the novice programmer.

striking• 12 years ago

A "more English" translation could read:

Based on a cursory analysis of the executable and application development, it's clear that the act of writing the Election Calculator was entrusted to a single (female) student, who was probably working for external contractors. Ms. Agnieszka, we really sympathize, we are with you!

Poland is a country in which the fate of thousands of committee members rests on the shoulders of a novice (female) programmer.

q3k5• 12 years ago

The fact that the programmer is female is mentioned implicitly - the female version of the “programmer” pronoun is used, the fact is not really stated anywhere.

So it should not to taken as „the shoulders of a novice, female programmer” (in which the fact that she is female is stated explicitly and could be used to further put down the person's programming abilities) but as „the shoulders of a novice programmer”.

userbinator• 12 years ago

To be fair it's a voting system, i.e. a program whose main function is to count, and unless the definition of "novice" these days is not what it used to be, it should be well within the ability of a "novice" programmer to write one.

lvh• 12 years ago

It is probably worth nothing that "female" is really a parenthetical. Source is simply using the appropriate Polish word (which is gendered). The translation could be read as implying that the person's gender has anything to do with the issues they've had, but source's wording doesn't really imply that. (They may have in fact wanted to imply that; but we can't determine that from the wording.)

gaius• 12 years ago

Is the definition of a secure system, that it is still secure even if you have the source code?

coyotebush• 12 years ago

By Kerckhoffs's principle, yes. https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

fleitz• 12 years ago

Leaked? Is the source code not public anyway? I mean generally you'd want to know what method they are using to count votes.

cryptoz• 12 years ago

Tens of millions of US voters use closed-source voting machines during our elections. The companies who make the machines are generally a little too friendly with the Republican party (Diebold, Premier Election Systems, or whatever they recently changed their name to).

I'm shocked at how few people care that so many votes are "counted" through Republican-friendly voting computers.

lukifer• 12 years ago

Funny, I googled "programmer testifies..." and the first autocomplete was "...about rigging elections": https://www.youtube.com/watch?v=tjvtSquZkhs

Journalist Greg Palast also has evidence of electronic voter in Ohio in 2004. (Disclaimer: I have not delved deep on his claims, but the mere fact of their plausibility is deeply concerning.)

http://www.gregpalast.com/how-they-stole-ohio/

kornakiewicz• 12 years ago

The method is widely known, but last weekend there were election with new system for reporting protocols from electoral commisions etc. and it appears to be quite huge swindle since it's been made in three months before elections and failed as fuck. Finally some of votes needed to be counted in Excel.

Feel free to ask about details, because I'm from Poland and hadn't found any sufficient article about it.

xamebax2• 12 years ago

That's a pretty good article in Polish, tackles the issue from more than one perspective: http://niebezpiecznik.pl/post/problemy-w-pkw-zliczanie-gloso...

jakozaur• 12 years ago

Likely a fake. The company which wrote the system is recruiting just PHP developers, while this is written in C#.

Of course this is all speculation. It may be truth and someone reconstruct the original version by decompiling it. e.g.: https://github.com/wybory2014/Kalkulator1/commit/cdff9cb67b8...

dgregd2• 12 years ago

You can download the installation package here http://zapasdlakbw.home.pl/kalkulator-wyborczy/kalkulator/ and decompile it. pdf file was included.

tartle2• 12 years ago

According to media PHP is used server-side (the system was written using CakePHP). This is decompiled client app that is used by electoral commissions (the one that is hardly working at the moment).

abalkan_msft• 12 years ago

Electoral voting system written in PHP. Sounds like a good idea.

sarciszewski6• 12 years ago

Why not? WordPress runs 23% of the Internet. (WordPress is written in PHP of course.)

_RPM• 12 years ago

It is amazing that I knew your comment was sarcastic. But, a computer parsing this sentence would never be able to tell. This is a reason that humans are special :)

q3k5• 12 years ago

The sourcecode wasn't leaked - an internal website (with the software, written in C#) [1] was leaked, and then the program was decompiled and pushed to GH.

EDIT: The website leak itself is actually pretty old news, but the decompilation and public shaming of the code itself is relatively new. “Zaufana Trzecia Strona” has more information [2] about the leak itself (in Polish).

[1] http://zapasdlakbw.home.pl/kalkulator-wyborczy/kalkulator/

[2] http://zaufanatrzeciastrona.pl/post/wersja-testowa-systemu-p...

orian• 12 years ago

Aren't you talking about backend? The code on github is a client used by a polling place and it was publicly available (this is how they've it distributed)

hdabrows• 12 years ago

Summary of the more interesting comments here[1]: - the ITT (invitation to tender) had 26 pages - questions from the contractors were answered with "this information is not required to define the price/scope of the feature but it has to be implemented anyway" - huge scope (9 modules) + training + administering the system - everything has to be finished in 1.5-2.5 months from when the results of the tender are published

It seems that only a single company has entered the auction for the tender because everyone else could see that the project was destined for failure. The company also allegedly employs three people and pays its programmers around 2000 zł/month (which is very low even by polish standards).

[1] http://www.poselska.nazwa.pl/wieczorna2/media/system-pkw-do-...

dang• 12 years ago

Can anyone who knows about this recommend an accurate and neutral title for the post?

Kociub• 12 years ago

Just to make it clear to everybody, this is not an electronic voting system. This is only a set of applications to accelerate vote counting before the official results. All of the votes must be counted and submitted the "old fashion way". You couldn't mess with the actual results by hacking this "appkenstein".

Reef3• 12 years ago

Haven't we all frowned upon picking on females in tech industry just yesterday?! It is NOT okay to wildly imply that the author of this code is of certain age and gender.

EDIT: it was shown by the comment below that it was actually written by someone with a popular Polish female name. I was shaken by the article yesterday and thus oversensitive. Sorry about that.

xamebax2• 12 years ago

Totally agree. That was my first reaction after reading this. Not cool.

q3k5• 12 years ago

Well, the implications are pretty well founded:

- the binary has strings like `C:\Users\Agnieszka\...\Visual Studio 2013\Projects\Kalkulator1`. Agnieszka is a female Polish name -> the programmer is female. Although nobody really is using this as a discussion point anywhere, but hey, the fact is there if it's interesting to you.

- the code logic and layout is pretty convoluted and looks duct taped together, even considering it's decompiled from binary form -> the author is probably young and inexperienced, and/or this was extremely rushed.

Also, I'm not realy sure where anyone is “picking on females” here.

readerrrr• 12 years ago

I don't know, I wouldn't judge a decompiled code.

Can you give a few examples why is it so bad?

Reef3• 12 years ago

I was not aware of those paths. I give up.

At least she used a fairly recent version Visual Studio...

szopa• 12 years ago

What is more, it is possible to find an Agnieszka working at Nabino through a Polish LinkedIn clone...

xxxyy• 12 years ago

See, this is the kind of problem I have with feminism (and a few other things). It was just a feature of the language, exhibited heavily by most slavic languages (which have much richer grammars than English f. eg.) and thus impacting thought process, yet it was your a natural response to "defend the beatnen".

If you position yourself as a victim, don't be surprised when you are treated this way.

A1kmm• 12 years ago

https://github.com/wybory2014/Kalkulator1/blob/master/Kalkul... - if you can't connect to https://syswyb.kbw.gov.pl/, try an unencrypted connection to http://klk.kbw.gov.pl/.

It also looks like (unless I am missing something) 'liceneses' (signatures of authorised officials as far as I can tell) are checked for common name / organisational unit, but there is no check that the certificate trust chain is anchored on a trusted certificate.

dgregd2• 12 years ago

https://github.com/wybory2014/Kalkulator1/blob/master/Kalkul... Is this correct generation of salt? It looks like someone just c&p an example from http://www.cprogramdevelop.com/1263984/

stogi• 12 years ago

I'm still amazed that in the century of the Internet people still write stuff like that as a desktop app. Not to mention it was waaaaaay to late to do it in the first place (they picked the company to implement it in August 2014).

Kiro• 12 years ago

And, decompiled or not; this is not the result of proper C#- or for that matter any modern language- coding:
r = r + "<code>" + this.hardErrors[i] + "</code>";

What's wrong with this?

nitrogen• 12 years ago

Assuming that r contains XML and this.hardErrors[i] is already escaped for XML safety, that is probably what you'd expect to see a code-generated XML generator doing, as well as hand-generated XML (if generating text directly and not an intermediate abstract representation of the XML).

ndz2• 12 years ago

In few words - whole Polish voting system is dead now and the votes are counted by the people. What is more interesting: in the tender for the software started one company and of course won it - random case? I don't thing so.. greets from Poland:)

pawelk• 12 years ago

I like to believe it was the only company crazy (or inexperienced) enough to participate in a project of this scale on such a short notice. Which would be a sign of maturity of the Polish IT sector.

grn• 12 years ago

The government messed up the public procurement. They wanted to have the system done in a very short time (one month?). Only one company submitted an offer.

ndz2• 12 years ago

LOL, really belive that? Sorry but IMO it was set - app costs was around $120k so..

Source code of Polish electoral voting system?

Related Stories