Electronic Voting - Tilted Forum Project Discussion Community

espi · 08-05-2004, 02:30 PM

I just got back from Defcon, and while I was there I saw a great lecture called "Hack the Vote: Election 2004" by Rebecca Mercuri and Bev Harris. They spoke about the problems with the current electronic voting machines and why we need a user verifiable paper trails.

Bev Harris spoke first and told a story about she heard evidence of problems with electronic voting equipment. When she started investigating further she found all kinds of scary information about past problems with electronic voting machines from Diebold and Sequoia Voting Systems. For example, she found that the voting tabluation software provided by Sequoia Systems is written in VisualBasic Script, using an Access backend. Votes can simply be changed by opening the Access database and modifying the vote table. If that's not amazing enough, the table doesn't use a primary key, so you could delete a whole block of votes, and there would be proof that the votes ever existed. To make matters worse, in 2003 a vendor selling Sequoia equipment left the software in an unprotected FTP directory.

Diebold has similar problems, such as using "1111" as the secure password to access the backend administrative functions. The soure code for the Diebold systems were left on an unprotected website, which was then later analyzed by Avi Rubin, the directory Information Security Institute at John Hopkins University, who concluded that a talented 15 year old could rig the system and vote multiple times. Diebold machines were also decertified by the State of California when it was found that uncertified software patches were installed on some machines prior to the March 2004 Primary Election.

So, sure, the software is buggy and insecure, but has that actually led to any problems? According to VerifiedVoting.org, yes. In March 2002, Wellington, Florida held a run off election with only two candidates on the ballot. The election was decided by four votes, but 78 ballots were found to have no recorded vote. Elections Supervisor Theresa LePore came to the conclusion that 78 people must have come to their polling place, yet chose not to vote for either candidate in the only race. More examples of e-voting malfuctions can be found in a PDF document on VerifiedVoting's website.

The second part of the lecture was delivered by Dr. Mercuri who discussed the need for Voter Verified Paper Audit Trail. This paper trail could simply be a print out of the voters choices that once approved drops into a sealed box giving a backup method of verifying the electronic voting results.

This paper trail is currently be considered as a requirment before more electronic voting machines can be approved for use in the State of California. If a county finds that it's existing equipment cannot produce a paper trail they must provide paper ballots on request.

I know I'm going to come off as a hand waving activist here, but if you think it's import that your vote is counted as you intend, you need to get involved in your county's election process. Read some of the URLs I've included, and then make your own decisions if electronic voting can be trusted. If, like myself, you don't think evoting is secure, get involved. Volunteer to be a poll worker, or join VerifiedVoting.org's TechWatch program to monitor the vote count on November 2.

Related websites/articles:
http://msnbc.msn.com/id/5353926/
http://www.blackboxvoting.org/
http://www.notablesoftware.com/evote.html
http://www.verifiedvoting.org/

Wax_off · 08-05-2004, 05:51 PM

This is why e-voting software should be open source. Think of all those privacy advocate/code geeks pouring over the code. You'd get something that might not be totally easy to use, but would be incredibly secure and reliable.

Dwayne · 08-05-2004, 05:56 PM

In my town the way the voting works is both by electronics and good old paper ballots. You black out a circle that is clearly for each candidate and then put it in a machine at the table in the front. The machine then tells you if the ballot is readable or not. If it isnt you can redo the paper. It would be easy enough to put some people on duty whos job it is to make sure that no one is messing with the machines. The problem then is the right to not have to disclose who you vote for, since the people watching might glance and what you put down.

SecretMethod70 · 08-07-2004, 07:05 AM

Ironically, I just came in here to post about this. There was a related article on Slashdot yesterday:

link to full article: http://www.computerworld.com/securit...,95094,00.html

abstract:

Quote:

The Ponemon Institute surveyed 2,933 members of the general public and then 100 DEFCON and Black Hat attendees to get their views on electronic voting. 'The degree of difference was startling,' said director Larry Ponemon. It was the biggest split between 'experts and the public he'd ever found. For example, 83% of the experts said e-voting is less or much less secure against election tampering than paper ballots, compared with just 19% of the general public.

An interesting graph:

It scares me how much the general public trusts technology and how little they understand about how consistently terrible government implementations of technology can be. I truly worry about the trend towards e-voting the way in which it's being done.

pan6467 · 08-07-2004, 07:50 AM

When the president of the manufacturing company (Diebold), that provides a vast majority of the e-voting machines, says publicly, that he will deliver Ohio and the election to Bush; one has to question the legitimacy of it all.

djtestudo · 08-07-2004, 09:18 AM

The state of Maryland is running ads on the TV and radio trying to dispell fears about the electronic voting systems they are going to be using.

I think the fact they need to advertise really scares me.

pan6467 · 08-07-2004, 11:19 AM

Well, the President of Diebold really put this election in doubt now.

In all honesty, I don't think it's going to be close I think (and God I hope I am wrong) Bush will win in a Reaganesque landslide.

I just think Kerry isn't getting his message across the way he needs to, in order to win. He, unfortunately is riding this "anybody But Bush" attitude too much and his issues are getting lost in the shuffle.

I think the ONLY way Kerry can win is to start getting the little guy involved and have town meetings and meet the people instead of having closed door fund raisers and events where he seperates himself. A handshake, a nod and an affirmation of existence goes a long way with a lot of voters, Kerry works too hard to seperate himself, I think Edwards would have done a much much better job at this.

Clinton won (both times) because he had the town meetings and showed in both elections he would go out and meet the common man and talk to him. Until Kerry does this his campaign will flounder.

An incumbant has all the advantages (and disadvantages) and the challenger has to get out and work harder and show he wants it more, Kerry has yet to do that.

BUT I digress, with the president of the voting machines guaranteeing Bush the election, he opens himself up to a lot of people saying the election was fixed and a more disgruntled opposition, especially if some GOP win traditionally Dem areas.

espi · 08-09-2004, 07:45 AM

Not only did the President of Diebold, Walden W. O'Dell, promise the state of Ohio to Bush, he held a $1,000 a dinner fund raiser for Bush/Chaney in his home. Conflict of interest? Nah...

Since the fundraiser and O'Dell's statement, the Diebold Board of Directors has banned political donations by it's Senior Executives.

The Ponemon Survey mentioned above was also presented at Defcon. It was an excellent (albiet short) presentation during the awards ceremony. Unfortunately, it's kinda preaching to the masses - I just hope the more mainstream media picks up on it.

08-05-2004, 02:30 PM	#1 (permalink)
espi Crazy Location: This is not my beautiful house	Electronic Voting I just got back from Defcon, and while I was there I saw a great lecture called "Hack the Vote: Election 2004" by Rebecca Mercuri and Bev Harris. They spoke about the problems with the current electronic voting machines and why we need a user verifiable paper trails. Bev Harris spoke first and told a story about she heard evidence of problems with electronic voting equipment. When she started investigating further she found all kinds of scary information about past problems with electronic voting machines from Diebold and Sequoia Voting Systems. For example, she found that the voting tabluation software provided by Sequoia Systems is written in VisualBasic Script, using an Access backend. Votes can simply be changed by opening the Access database and modifying the vote table. If that's not amazing enough, the table doesn't use a primary key, so you could delete a whole block of votes, and there would be proof that the votes ever existed. To make matters worse, in 2003 a vendor selling Sequoia equipment left the software in an unprotected FTP directory. Diebold has similar problems, such as using "1111" as the secure password to access the backend administrative functions. The soure code for the Diebold systems were left on an unprotected website, which was then later analyzed by Avi Rubin, the directory Information Security Institute at John Hopkins University, who concluded that a talented 15 year old could rig the system and vote multiple times. Diebold machines were also decertified by the State of California when it was found that uncertified software patches were installed on some machines prior to the March 2004 Primary Election. So, sure, the software is buggy and insecure, but has that actually led to any problems? According to VerifiedVoting.org, yes. In March 2002, Wellington, Florida held a run off election with only two candidates on the ballot. The election was decided by four votes, but 78 ballots were found to have no recorded vote. Elections Supervisor Theresa LePore came to the conclusion that 78 people must have come to their polling place, yet chose not to vote for either candidate in the only race. More examples of e-voting malfuctions can be found in a PDF document on VerifiedVoting's website. The second part of the lecture was delivered by Dr. Mercuri who discussed the need for Voter Verified Paper Audit Trail. This paper trail could simply be a print out of the voters choices that once approved drops into a sealed box giving a backup method of verifying the electronic voting results. This paper trail is currently be considered as a requirment before more electronic voting machines can be approved for use in the State of California. If a county finds that it's existing equipment cannot produce a paper trail they must provide paper ballots on request. I know I'm going to come off as a hand waving activist here, but if you think it's import that your vote is counted as you intend, you need to get involved in your county's election process. Read some of the URLs I've included, and then make your own decisions if electronic voting can be trusted. If, like myself, you don't think evoting is secure, get involved. Volunteer to be a poll worker, or join VerifiedVoting.org's TechWatch program to monitor the vote count on November 2. Related websites/articles: http://msnbc.msn.com/id/5353926/ http://www.blackboxvoting.org/ http://www.notablesoftware.com/evote.html http://www.verifiedvoting.org/ __________________ If it weren't for my horse, I never would've spent that year in college.

08-07-2004, 07:50 AM	#5 (permalink)
pan6467 Lennonite Priest Location: Mansfield, Ohio USA	When the president of the manufacturing company (Diebold), that provides a vast majority of the e-voting machines, says publicly, that he will deliver Ohio and the election to Bush; one has to question the legitimacy of it all. __________________ I just love people who use the excuse "I use/do this because I LOVE the feeling/joy/happiness it brings me" and expect you to be ok with that as you watch them destroy their life blindly following. My response is, "I like to put forks in an eletrical socket, just LOVE that feeling, can't ever get enough of it, so will you let me put this copper fork in that electric socket?"

08-07-2004, 09:18 AM	#6 (permalink)
djtestudo Baltimoron Location: Beeeeeautiful Bel Air, MD	The state of Maryland is running ads on the TV and radio trying to dispell fears about the electronic voting systems they are going to be using. I think the fact they need to advertise really scares me. __________________ "Final thought: I just rented Michael Moore's Bowling for Columbine. Frankly, it was the worst sports movie I've ever seen." --Peter Schmuck, The (Baltimore) Sun

08-07-2004, 11:19 AM	#7 (permalink)
pan6467 Lennonite Priest Location: Mansfield, Ohio USA	Well, the President of Diebold really put this election in doubt now. In all honesty, I don't think it's going to be close I think (and God I hope I am wrong) Bush will win in a Reaganesque landslide. I just think Kerry isn't getting his message across the way he needs to, in order to win. He, unfortunately is riding this "anybody But Bush" attitude too much and his issues are getting lost in the shuffle. I think the ONLY way Kerry can win is to start getting the little guy involved and have town meetings and meet the people instead of having closed door fund raisers and events where he seperates himself. A handshake, a nod and an affirmation of existence goes a long way with a lot of voters, Kerry works too hard to seperate himself, I think Edwards would have done a much much better job at this. Clinton won (both times) because he had the town meetings and showed in both elections he would go out and meet the common man and talk to him. Until Kerry does this his campaign will flounder. An incumbant has all the advantages (and disadvantages) and the challenger has to get out and work harder and show he wants it more, Kerry has yet to do that. BUT I digress, with the president of the voting machines guaranteeing Bush the election, he opens himself up to a lot of people saying the election was fixed and a more disgruntled opposition, especially if some GOP win traditionally Dem areas. __________________ I just love people who use the excuse "I use/do this because I LOVE the feeling/joy/happiness it brings me" and expect you to be ok with that as you watch them destroy their life blindly following. My response is, "I like to put forks in an eletrical socket, just LOVE that feeling, can't ever get enough of it, so will you let me put this copper fork in that electric socket?" Last edited by pan6467; 08-07-2004 at 11:22 AM..

08-09-2004, 07:45 AM	#8 (permalink)
espi Crazy Location: This is not my beautiful house	Not only did the President of Diebold, Walden W. O'Dell, promise the state of Ohio to Bush, he held a $1,000 a dinner fund raiser for Bush/Chaney in his home. Conflict of interest? Nah... Since the fundraiser and O'Dell's statement, the Diebold Board of Directors has banned political donations by it's Senior Executives. The Ponemon Survey mentioned above was also presented at Defcon. It was an excellent (albiet short) presentation during the awards ceremony. Unfortunately, it's kinda preaching to the masses - I just hope the more mainstream media picks up on it. __________________ If it weren't for my horse, I never would've spent that year in college.

08-05-2004, 05:51 PM	#2 (permalink)
Wax_off No Avatar, No Sig.	This is why e-voting software should be open source. Think of all those privacy advocate/code geeks pouring over the code. You'd get something that might not be totally easy to use, but would be incredibly secure and reliable.

08-05-2004, 05:56 PM	#3 (permalink)
Dwayne Crazy Location: New England	In my town the way the voting works is both by electronics and good old paper ballots. You black out a circle that is clearly for each candidate and then put it in a machine at the table in the front. The machine then tells you if the ballot is readable or not. If it isnt you can redo the paper. It would be easy enough to put some people on duty whos job it is to make sure that no one is messing with the machines. The problem then is the right to not have to disclose who you vote for, since the people watching might glance and what you put down.