Slashdot Log In
Worst Ever Security Flaw in Diebold Voting Machine
Posted by
timothy
on Mon Jul 31, 2006 01:25 PM
from the oh-but-that's-a-feature dept.
from the oh-but-that's-a-feature dept.
WhiteDragon writes "The folks at Open Voting Foundation got their hands on a Diebold AccuVote TS touchscreen voting machine. They took it apart (pictures here), and found the most serious security flaw ever discovered in this machine. A single switch is all that is required to cause the machine to boot an unverified external flash instead of the built-in, verified EEPROM."
Related Stories
[+]
Backslash: Voting Isn't Easy, Even if Cheating Is 260 comments
The Open Voting Foundation's disclsosure that only one switch need be flipped to allow the machine to boot from an unverified external flash drive instead of the built-in, verified EEPROM drew more than 600 comments; some of the most interesting ones are below, in today's Backslash story summary.
[+]
News: US Voting Machines Standards Open To Public 115 comments
Online Voting writes "The U.S. Election Assistance Commission has published new voting systems testing and certification standards for 190 days of public comment. For all the critics of electronic voting, this is your opportunity to improve the process. This will be the second version of the federal voting system standards (the first version is the VVSG 05). To learn more about these Voluntary Voting System Standards see this FAQ."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
When Will Politicians Wake Up? (Score:5, Insightful)
Here's a hint for politicians: If in a population of 300,000,000 only 1,000,000 are capable of understanding how the voting system works, and if only 1,000 people are actually allowed to see how it works, and if there's no verifiable paper trail or any simple and legitimate verification system, then democracy is a farce.
wrong question (Score:5, Insightful)
Parent
Re:wrong question (Score:5, Insightful)
Parent
Re:wrong question (Score:5, Funny)
Parent
Re:wrong question (Score:5, Insightful)
Good point. I guess I figured the one thing politicians should know something about is voting. If it's up to the people then we're pretty much doomed, because the American people don't know and don't care about politics. At this point we're so swamped between work and entertainment that the only way to generate political awareness is if it becomes a fad like it did in the Vietnam era. Either that or a lot more Katrina-style disasters to destroy people's television sets.
Parent
Re:wrong question (Score:5, Informative)
http://www.youtube.com/v/7WmC4grXdIk [youtube.com]
http://www.house.gov/feeney/ [house.gov]
very interesting video. The computer programmer explains what he was asked to do. He gets stupid at the end though and starts rambling off topic, but I blame that on too much time on Slashdot.
Parent
Re:wrong question (Score:5, Funny)
A flaw? Nahh that one is definitively someone's feature.
Parent
Re:When Will Politicians Wake Up? (Score:5, Funny)
That's not a bug, it's a feature. Using your numbers, that's 1000 government-approved whitew^Wsecurity auditors, and 9,999,000 potential crackers.
Politicians will wake up when President Stallman of the GNU/Hurd Party is sworn in on January 21, 2009, after taking 53% of the votes, against 47% for the OSS Party, led by candidate Eric Raymond. (Raymond credits his near-victory to having a landslide amongst the "Retired CIA/NSA Agents" demographic, on account of his party having "a more intel-friendly acronym" :)
Parent
Re:When Will Politicians Wake Up? (Score:5, Insightful)
Of course we do. But you presume that security was a design goal for these machines. I put it to you that this was certainly NOT a design goal of these machines.
There's a reason that Diebold's banking and ATM machines are massively secure and auditable, and their voting machines, well, aren't either of those things.
Parent
Re:When Will Politicians Wake Up? (Score:5, Informative)
Parent
Lever action! (Score:5, Insightful)
I attribute most of these errors to poor design, not anything intentional. Personally I like the old fashioned lever machines my district uses. It is very hard to hack those, I hear. Unlike computers and paper cards, you never hear bad things spoken about lever voting machines.
Re:Lever action! (Score:5, Interesting)
Parent
Not a bug, but a feature (Score:5, Insightful)
"AccuVote" (Score:5, Funny)
At least their marketing department has a sense of humor.
Let's switch to American Idol call-in voting (Score:5, Funny)
1. They still have the electoral college, so it's not like a spam vote will elect the "wrong" candidate.
2. Since the NSA monitors all phone calls, they could track cheaters really easily, compared with this mess we have now.
3. Way more voter participation, you don't have to go anywhere, you just call in with your social or something, etc.
yarrr (Score:5, Insightful)
Re:yarrr (Score:5, Funny)
Parent
Bug or Feature? (Score:5, Insightful)
What's wrong with paper ballots? (Score:5, Insightful)
Why? (Score:5, Insightful)
Seems to me that manual counting of votes would be vastly more secure as it would take a huge conspiracy to affect the result either way.
Counting a hundered million votes is hard, counting a thousand votes in a hundered thousand locations is easy.
Physical access ALWAYS means all bets are off. (Score:5, Insightful)
Don't you think that a flaw that would allow people to vote multiple times or a flaw in the security by which the voting machine uploads results to the central server or flaws in the central server itself are worse than this.
Gee, we have physical access to the guts of a machine and we can do things to it. I'm not terribly impressed.
If you value your country, you need to be (Score:5, Insightful)
Electronic Voting machines are not a trustworthy technology. They can be made reasonably trustworthy, but only with significant and constant public involvement and oversight. The core element to this happens to be our requirement of anonyminity for our votes. Being unable to link votes to voters means we must then capture the actual votes themselves if we are to be sure the election is just and true.
Roughly 80 percent of Americans will be using these machines in the coming elections. That should scare the tar out of every one of you, regardless of your political bent.
In 2004, this number was about 30 percent and the problems were so great, we really have no assurance our election results actually reflect the will of the American people, whatever that may be.
Think of it this way. Let's say I'm the voting machine counting votes. You tell me what your vote is, and I update my mental count. Can you see that I updated the count correctly? I could report your vote back to you correctly, yet still maintain a different internal count. There is no way to really know is there? That's the problem we face with electronic votes.
The votes are encoded into states stored on devices nobody can directly observe, other than via the proxy of other electronic technology. Essentially, we are voting by proxy when we vote electronically. Without an accounting in the form of a serial voter-verified paper record, or the use of vote storage that is both human and machine readable, we cannot oversee the election results in a manner that brings confidence to the whole affair.
These machines are general purpose computers for the most part. We all know how easily these things are tinkered with because it's what most of us do! Biggest problems are:
-no direct accountability on elections officials to actually hold a just and true election. Technology can and will be blamed for problems, leaving these folks off the hook for failed / unjust elections. Not good. Where the incentive for corruption and manupulation exists, you can bet it's happening. There is too much at stake for it to be otherwise.
-poor understanding of the core technology differences between paper voting and electronic voting. I summarized it above and have a longer, easy to understand, paper here. Mail it to your legislators along with a request for their position on the matter. If you do the mailing, please also do the request. That forces a response, which helps increase the overall perception of the importance of the issue. http://www.opednews.com/dingusDoug_112604_electron ic_voting.htm [opednews.com]
Said poor understanding extends to all of us really, legislators and citizens alike. Too many people consider electronic data processing systems as being better than they actually are. Consider this: If they are so infallable, why do ATM machines deliver receipts? Also, be careful about ATM comparisons. The primary difference between an ATM machine and an electronic voting machine lies in the anonymous nature of voting. ATM transactions are keyed to people, electronic voting records are not --thus the need for a voter-verified paper trail.
What do we need to ask for?
Voter verified paper trails that are human readable, serial in nature and easily handled / processed for recounts. Flimsy, thermal rolls that can discolor from improper storage and or handling won't cut it.
Audits at the precinct level. These can catch abnormalities easily and quickly before too much damage is done. Use the paper record to verify issues and act accordingly.
Strong exit polling. Notice how that is being downplayed now? The reason is simple. In 2004, the exit polls did not jive with the voting records, yet we have been exit polling for a good long time. The differences did not appear in this way until the advent of the electronic machines.
Legislation that reinfo
Tamper seal?? (Score:5, Insightful)
Voting in the USA (Score:5, Informative)
Everyone who says that Diebold is too incompetent to create a secure voting maschine is following the wrong trail.
Re:About the only way they'll ever "fix" these thi (Score:5, Interesting)
Not so sure about that. Here in Maryland, our (Republican) governor budgeted $20,000,000 to allow us to use paper ballots instead of the Diebold crap -- and he was shot down by our State Senate (democrat)and prinicpally by our State Administrator of Elections, who claimed that going back to old-style ballots would "stifle development."
I'm sure you can find the parties flip-flopped in other states. The point is that if a) people actually gave a shit and b) people really understood the issue instead of blindly assuming "computer = good, paper = bad," any cronyist jackass who supported Diebold would get booted stratight out of office next election -- assuming their evil scheme hadn't yet been implemented. ;-)
Parent