US voting systems: Full of holes, loaded with pop music, and 'hacked' by an 11-year-old
Hackers of all ages have been investigating America’s voting machine tech, and the results weren't great. For instance, one 11-year-old apparently managed to hack and alter a simulated, albeit deliberately hobbled, Secretary of State election results webpage in 10 minutes. The Vote Hacking Village, one of the most packed-out …
COMMENTS
-
-
-
Monday 13th August 2018 19:56 GMT BillG
Security by Design?
What does it take to put all external I/O ports under a secure, locked cover tied to an alarm? What does it take to make sure SSL certificates are up-to-date?
How do you allow voting machines with such easy security flaws to exist, unless they were meant to have these security flaws?
-
Tuesday 14th August 2018 07:12 GMT Anonymous Coward
Re: Security by Design?
They are implemented to save staff time counting ballot papers.
The argument (flawed I know) is the human can't vote twice or write on the ballot paper to make their vote unclear (hanging chads anyone).
Unforutnately the marketeers were selling an electronic voting machine...not a secure computing system.
-
-
-
Monday 13th August 2018 17:53 GMT Version 1.0
Re: Obligatory
"At first I hoped that such a technically unsound project would collapse but I soon realized it was doomed to success. Almost anything in software can be implemented, sold, and even used given enough determination. There is nothing a mere scientist can say that will stand against the flood of a hundred million dollars. But there is one quality that cannot be purchased in this way - and that is reliability. The price of reliability is the pursuit of the utmost simplicity. It is a price which the very rich find most hard to pay." - C.A.R. Hoare
-
Tuesday 14th August 2018 15:55 GMT sisk
Re: Obligatory
To be fair to the issues raised in the XKCD comic, planes that have someone trying to make them crash don't typically fair very well. Nor, I think, would elevators that had a person knowledgeable about them trying to make them fall.
But, yes, security on electronic voting machines is a joke. From what little I've seen of them (which isn't much because my state thankfully still uses paper) I've got better security on the wifi enabled light switches I built and scattered around my house.
-
Wednesday 15th August 2018 19:09 GMT Michael Wojcik
Re: Obligatory
planes that have someone trying to make them crash don't typically fair very well
"fare", not "fair". And actually they do generally fare pretty well, unless that person has access to the flight deck, which is much less common after 11 September 2001.
Nor, I think, would elevators that had a person knowledgeable about them trying to make them fall.
And that's even more difficult, even if you're knowledgeable.1 It's certainly more difficult than hacking one of these direly unsafe voting systems.
1It's quite straightforward to make an elevator that can't fall without massive compromise of the car or shaft. For example, put an asymmetric weight on the car, so that if it's not under tension from the lift mechanism, it will tilt to one side. Then, if that doesn't provide sufficient braking force on its own, add a ratchet to the side of the shaft that the bottom of the car will press against when it's tilted. There are other purely-mechanical safety mechanisms that achieve the same result.
-
-
-
Monday 13th August 2018 14:45 GMT LeahroyNake
uh oh
'one enterprising 11 year-old named Emmet managed to hack a simulated Secretary of State election results page in 10 minutes.'
My smallest one is a little younger that that but his technical skills are quite impressive. Gave him an intel compute stick to play with and we were watching The Grand Tour via Amazon Prime within half hour on the family TV. I really should change that Amazon password.... no idea how he knew it, I don't even know it :o
Besides we are totally safe, you can't vote until you are 18 /sarc
-
-
-
Monday 13th August 2018 16:13 GMT Anonymous Coward
Re: Old joke!
"...voting machines....sold to Canada..."
I've never seen a voting machine in Canada, but news reports indicate that they might have been used for the first time recently (Ontario provincial election in the Spring of 2018).
We don't even use pens in the voting booth because somebody might swap them out for one containing disappearing ink. So it's short stubby pencils only.
To date, elections in Canada have been explicitly trustworthy.
-
-
Tuesday 14th August 2018 14:50 GMT Sam Therapy
Re: Old joke!
Ordinary graphite pencils, yes. Coloured pencils are more difficult, having a mixture of clay and wax in the core. That's the sort used in voting booths in the UK. It takes a bit of time and preparation to erase a mark made with one of those and, unless you're really careful, tampering is evident.
-
Tuesday 14th August 2018 15:37 GMT steviebuk
Re: Old joke!
No they are not. If anyone ever actually did election work they'd know. The stubby pencils leave a VERY clear mark that they've been rubbed out. When on election work you'd also know you don't even get time to rub any marks out. The counts are counted IN FRONT of councillors/MPs or whoever is standing. They can stand and watch counts and request recounts. The conspiracy theory nut jobs that claimed "Here's a video of election staff rubbing out votes" clearly don't understand how any of it works. The votes are counted, then put on a specific bit of paper that is then taken to the front where all the election staff (can't remember their specific names) are there to verify the counts match the tally they have. If they don't they are asked to go back and recount. THAT is the number they were rubbing out. The incorrect tally count.
Simple when you've worked it and know there is no conspiracy. There are so many checks in place you'd easily get caught unless you paid off EVERYONE in the room which itself would be spotted.
-
Wednesday 15th August 2018 13:41 GMT Gordon861
Re: Old joke!
I've worked on nearly every election in my area for the last 20 years and every year we get some nut coming in claiming that the whole thing is a fix or that we can change the votes if we want. It got even worse during the Brexit vote when we had a visit from the police to warn us that some groups were planning to follow staff when they left the station to make sure we didn't stop somewhere.
Even if you could fix the vote in one polling station, which would involve a lot of work and chances to be caught, you would have to hit a lot of stations at once to make any real difference. On top of paying off the staff you'd also need a printer willing to spend some serious time inside if caught to print the papers, which would have to match the real ones accurately. All it would take is a candidate or agent to come in an apply their own seal to the box and you'd be screwed.
The UK elections are about as secure as you can make them, except for the postal votes.
-
Monday 20th August 2018 14:38 GMT steviebuk
Re: Old joke!
Agreed. Postal Votes are where the flaw is, although still quite secure because there are so many people you'd have to pay off.
You can have the Postal Vote scanner just reject the verification form (I think it was called), although the Postal Vote Scanner never actually sees the votes. Again, you'd have to pay off several people in the room. Actually you'd probably have to pay off the whole room including senior management. Everyone being aware if/once caught, they all will get jail time.
Only election staff are allowed in the room. Then you have the people opening the votes. They count those and they go to the postal vote scanner. That person scans in and verifies by eye the scan matches what is in the database and that the scanner software read it correctly. The amount of mums and dads that sign for their kids because the kid is at Uni is mad. Do they really think we won't spot that? Anyway. That is the point you could just reject and those votes wouldn't then be counted. However, it is then up to a deputy returning officer/s to double check that they also agree with your rejections. A senior member of the elections team may also check.
So even Postal Voting is quite secure. Not as secure as it could be, but still not as bad as people think. Blame the public for Postal Votes. It was them that wanted it.
All these people would need to be paid off and you do get serious jail time if caught.
https://www.telegraph.co.uk/news/uknews/law-and-order/5259918/Six-jailed-over-election-fraud.html
-
-
-
Tuesday 21st August 2018 16:11 GMT Claptrap314
Re: Old joke!
For example, a precinct chairman "helpfully" doing the rounds at an old folk's home with the ballots all filled out, "just sign here". Or a mailman "losing" ballots from a neighborhood that votes the wrong way.
There are a lot of elections that are decided by a few hundred votes. It's not easy to swing a state-wide or congressional election, but locals? Sure.
-
-
-
-
-
-
-
-
-
Wednesday 15th August 2018 19:16 GMT Michael Wojcik
Re: Old joke!
They are in at least some states.
Yes. And this is an important factor in the problem domain - the US is far from a voting-system monoculture. It varies from state to state, and often from district to district within a state.
So on the one hand, it's difficult to hack enough votes to alter a Presidential election, or in many cases even one for the Senate or other office with a statewide electorate. The real payoffs are in House elections and others with smaller electorates, which are more likely to present a single target; and in general from sowing uncertainty and cynicism about the validity of the process.
On the other hand, that makes it that much harder to get all of the vulnerable machines replaced, because you have to persuade many sets of election officials and the legislatures that control their budgets.
-
-
-
-
Monday 13th August 2018 16:57 GMT Anonymous Coward
Only for purely electronic voting machines. That's why there's been a big move in the US generally away from those machines and back to ones with paper trails. Still won't stop vote cheating tho, but cheating will have to be done the old ways, here in meatspace, where we have a chance to catch them up.
-
Tuesday 14th August 2018 15:59 GMT Anonymous Coward
Still won't stop vote cheating tho
I suspect a certain state official in charge of the voting process and who appears to be obsessed with voter fraud here has tampered with at least a couple elections. Sadly I've only suspicions - which I'm not alone in but am apparently in the minority in - and the people who would be in a position to investigate don't seem interested in doing so.
-
-
-
Monday 13th August 2018 14:56 GMT a pressbutton
It suits the current political agenda to have insecure voting machines.
(easy to point fingers at the Republicans but Dems do not have clean hands)
If you win, there was 'no significant' tampering and 'no evidence' of interference
If you lose - we was robbed!!!!
It is a symptom in the growth of distrust in the US and I can see someone just not accepting the result of an election over t he next 20-30 years
After all the alternative facts are out there....
-
Monday 13th August 2018 14:57 GMT Ugotta B. Kiddingme
how about
we return to the good old mechanical lever voting machines?
One disadvantage is a delay in results because such devices cannot report results to an off-site governmental agency tasked with tallying the votes. This means that, GASP, a living breathing human must read the vote totals and report the results manually. The other disadvantage is the fact that these machines mostly no longer exist in this country. The advantages are that it's nigh on impossible to hack a non-electrical, mechanical-only device, and although slow it's still faster to tabulate than paper ballots.
-
Monday 13th August 2018 16:11 GMT Thought About IT
Re: how about
They have their own problems, as Al Gore will attest after losing to George W Bush due to hanging chads.
-
Monday 13th August 2018 16:19 GMT Mark 85
Re: how about
They have their own problems, as Al Gore will attest after losing to George W Bush due to hanging chads.
Actually, no. The old mechanicals that the OP mentions had no paper at all. Some models did have a paper roll inside for a backup tally but they were rare. So no chads, just a very satisfying "clunk - clunk" as you pulled the lever to register your votes.
-
Monday 13th August 2018 16:48 GMT Claptrap314
Re: how about
And... I remember an investigation where someone familiar with the technology showed just how easy it was to "fix" the results on those mechanical voting machines.
JUST SAY NO.
If it's not fill-in-the-oval-just-like-you-did-for-twelve/sixteen-years-of-school, it's creating opportunities for fraud.
-
-
-
Wednesday 15th August 2018 19:42 GMT Michael Wojcik
Re: how about
As Claptrap314 and Big John wrote, mark-sense ballots (which are typically "fill in the oval" or "connect the arrow" or the like), while not perfect, seem to be the best compromise. They can be machine-tabulated and also manually verified; they are easy for voters to use, provided the ballots are well designed.
Hand-counted paper ballots, lever machines, and mark-sense systems significantly outperformed the alternatives on fraction of residual votes (undervotes and misvotes) in the well-known MIT / Caltech Voting Technology Project study. Mark-sense has no statistically significant difference from lever in this respect. Mark-sense provides immediate visual confirmation of the vote for the voter, and unlike lever doesn't need a separate paper trail, since the voter is marking up a paper ballot.
There's some thought that voters are more comfortable with mark-sense ballots than with lever machines, thanks to school training, as Big John suggested. The MIT/Caltech paper mentions this.
It also notes that mark-sense optical scanning machines were somewhat more mechanically reliable. That may just be a fluke.
-
-
Monday 13th August 2018 15:01 GMT Terje
I'm continuously amazed at how a system that is known to be broken so far beyond repair that it should just be tossed on the scrapheap is still used.
While pieces of paper are nowhere near as fashionable they are as far as I know not prone to being hacked by anyone and his mother with a wifi bluetooth or other wireless device.
-
-
-
This post has been deleted by its author
-
-
-
Monday 13th August 2018 15:13 GMT Anonymous Coward
Why does it matter?
Elections aren't there to choose a leader anyway. Elections allow people to think they've had a choice in order to stop them complaining later on. It's not like the US system is democratic anyway with all the money changing hands and "lobbyists" around the place. Regardless who's in office you can buy whatever laws you feel you need, or prevent them for that matter. Disney copyright laws and gun control for the NRA are just two recent examples of politicians "doing the right thing" aka $$$KERCHING$$$
-
-
Tuesday 14th August 2018 13:04 GMT Giovani Tapini
Re: US Elections
I don't know about that. From the closing statements of the article, I just read that war is more of a priority than democracy anyway. Therefore election fraud is just a distraction, or indeed the US can have a Zimbabwe style election when the incumbent wins but no one is certain of the fairness of the votes and counting...
-
-
Monday 13th August 2018 15:34 GMT Teiwaz
The problem isn't the voting machines it's the voters.
Dern' tootin'. Either side of the Atlantic.
Even if somehow, the Election manages not to get hacked, and several lorries of votes don't get switched or dumped somewhere, the 'grass roots' nut jobs will have arranged buses for the paranoid extremists, headcases, to vote and hang around afterwards intimidating, fired up by a dollar-eyed politico spewing cliched empty promises. The masses will as usual buy into the promises of some coiffed up borderline preacher type charismatic or pig headed business nut and insist for several years afterward any day now everythings going to be wonderful despite mounting evidence to the contrary.
-
Wednesday 15th August 2018 19:48 GMT Michael Wojcik
The problem isn't the voting machines it's the voters.
The voting machines cause problems with the voters.
Weaknesses in the voting equipment and process discourage voters, and reduce participation in the electorate. And that means most of the people voting are ideologues of one stripe or another, who will tend to favor single-issue candidates that focus on their particular fetish. That does not improve the quality of representation.
Democracies do better when more people who aren't certain of their convictions come to believe that their participation is important, spend at least a little time researching the candidates and issues, and then vote for what they believe is the best (or least bad) choice. That tends to reduce relative support for fanatics and demagogues, and encourage the election of politicians who make an effort to compromise.
-
-
Monday 13th August 2018 15:22 GMT Jemma
In other news
The kid called Emmet was later identified on CCTV buying parts for a 1982 Delorean DMC12...
Does it really matter anyway? The Russians are running the elections as it is, and I'm sure ole Vladimir would look great in Zeyd cloth.. The Drunk Lord of the Sith.
Arguably the US is a failed state as it is, eco terrorist, arguably terrorist terrorist (what do you call invading Iraq after 9/11?, there was no way Saddam was involved, he hated the Islamic fundies more than the Americans did/do), run by the most dangerous idiot since Caligula retired and full of buck toothed retards who think cancer/hiv/sti's (and practically every other illness) is divine retribution for homosexuality and voting democrat.
EARLY CUYLER FOR PRESIDENT!!!!! (oh wait, that happened...)
-
-
Monday 13th August 2018 15:34 GMT Anonymous Coward
Re: Electronic voting in the US...
Diebold Nixdorf sold off the US Elections systems Premier division of its business several years ago.
They're still providing the infamous warsaw plugin, a POS software supposed to "provide trust in electronic transactions" that made several machines I've tested get very slow and crash constantly. Unfortunately this plugin is required by some banks, so I got an already old laptop to access those sites.
-
-
Monday 13th August 2018 16:04 GMT Daedalus
System? What system?
Yet again the lack of understanding. Each state is in charge of its own elections, period. The Feds have no business funding state election machinery. Results not good? Too bad. And note that "Secretary of State" elections are strictly for state officials, not Federal ones. Only a few states elect such an office anyway.
-
Tuesday 14th August 2018 13:10 GMT FrozenShamrock
Re: System? What system?
And, the federal government could set standards for federal elections and since states would not want to pay for two different systems they would run the state elections using the same standards. And, actually, most states elect the Secretary of State (35 of the 47 states with the office). ISIS is a security threat, drug cartels are a public safety threat, but very few things are existential threats to a democracy. Compromising the democratic process so the governed no longer feel as if they are truly represented is the biggest existential threat to any democracy. Whether that be due to the influence of money, foreign interference, voter suppression, or insecure voting.
-
Monday 13th August 2018 16:29 GMT Antron Argaiv
Important to note
Some states (mine included) will have nothing to do with voting by machine, and use hand-marked paper ballots, which are optically scanned, and then saved in case a manual recount is necessary.
Please note that technology is used where it provides a benefit (fast optical counting of ballots) and NOT where it is a significant risk (recording of the actual vote). Whether this seemingly obvious distinction is ignored due to malice or ignorance in other states is left for others to decide.
https://ballotpedia.org/Voting_methods_and_equipment_by_state
-
Monday 13th August 2018 16:33 GMT Cronus
The real news of course is the stuff the adults did. The 11-year-olds hacking websites set up as replicas really doesn't show anything beyond kids can hack poorly secured web servers. It's not actually got anything to do with the voting results because they're just replicas no doubt with intentional not very hard to exploit bugs.
-
-
Tuesday 14th August 2018 05:25 GMT JulieM
Re: Engineers???
Not really. It's mathematically impossible to build a voting machine that is more secure than pencil and paper Nothing anyone could invent will make it possible because the limitation is one of the universe, not one of technology. You can't blame anyone for failing. Continuing to try to do something once you know it's impossible, on the other hand .....
-
Tuesday 14th August 2018 11:32 GMT Antron Argaiv
Re: Engineers???
It's mathematically impossible to build a voting machine that is more secure than pencil and paper Nothing anyone could invent will make it possible because the limitation is one of the universe, not one of technology.
However, these machines, unreliable as they may be, are very effective moneymakers for the manufacturers (who also charge to maintain and configure them).
One might be forgiven for thinking that the whole "Help America Vote Act" nonsense, was merely a handout by Dubya's Republican administration to some politically well-connected voting machine manufacturers.
I couldn't possibly comment.
-
-
-
-
-
Tuesday 14th August 2018 05:32 GMT bazza
Re: Voting needs to be Convenient, Accurate, and Fast ...
There's a constituency here in the UK that specialises in doing the paper count by hand, really quickly. It takes organisation, and plenty of volunteers. They're really good at it.
There's a lot to be said for doing it this way. If an optically scanned result is challenged then you have to count it by hand, ultimately. If you've not got the organisation or people ready and practised to do that, you've got a disaster on your hands.
Sometimes the old ways are the best.
-
-
Wednesday 15th August 2018 13:00 GMT Richard 12
Re: Voting needs to be Convenient, Accurate, and Fast ...
Sure, you can hack the scanners.
The point is that the ballots themselves physically exist and can be counted.
If a result is very close, the candidates demand a physical recount.
If a result seems odd, the candidates demand a physical recount.
Random samples of ballots should also be counted by hand, and if the optical scanner gave a notably different result, the CEO of the scanner manufacturer is executed and the ballots are all recounted by hand.
-
-
-
-
-
Monday 13th August 2018 20:41 GMT Jemma
Re: I heard that ...
The British government did too - but they got left on the 10:18 to Swansea... And haven't been seen since.
Does it depress any one else that despite the fact the uk is a dirty, garbage and pothole ridden*, conservative "voting" craphole - there are *still* worse places to live? It's the 21st century for heavens sake.
*My parents recently did a 4200 mile journey across Europe to Russia and back - didn't see a single pothole outside of the UK and saw more roadside rubbish in the journey between Harwich & Colchester than in the entire of Europe including Poland, Lithuania, Latvia & Russia itself.
PS : Getting a visa for Russia is *the* most deranged process on the planet. Think you're worried about Google snooping. They want the numbers and details of your kids and grandkids passports - even if they're not going and every single country you've ever even *driven* through or flown over..
-
Monday 13th August 2018 22:47 GMT Kev99
The US did just fine with paper ballots for over 200 years until the idiots in Florida couldn't figure out how to read a punch card. Now the idiots in Washington have foisted a solution that's worse than the supposed problem. Do a quick survey and see how many other countries use electronic voting machines, especially ones connected to the internet. Very few. Which is one reason why no one will ever hack into Russia or China's voting system. Their smart enough to still use paper.
-
Tuesday 14th August 2018 18:55 GMT Daedalus
Florida ballots
The US did just fine with paper ballots for over 200 years until the idiots in Florida couldn't figure out how to read a punch card.
To be fair, the notorious "hanging chads" were a very real issue, though the problem wouldn't have been nearly as bad if the paper ballots had been properly designed to fit into the holders. Or the holders had been made big enough to accommodate even the wildest of ballot papers. Let's be clear: the election officers are at the mercy of every interest group that can get enough signatures on a petition and pay the necessary fees. Anybody who thinks that the ballot consisted only of "Electors for Gore, Democrat" and "Electors for Bush, Republican" is severely mistaken. I wouldn't be surprised if some counties had "Cuban Exiles for Bush" on the ballot.
Nor is it fair to disparage all of Florida's counties. Some were using the same optically scanned paper ballots that have been mentioned in other comments. One officer boasted that if required to do a recount, it would take a few hours at most and would almost certainly return the same result as was already announced.
-
Tuesday 14th August 2018 21:10 GMT Claptrap314
Florida, still & again
The problem was not "Florida". The problem was one specific county in Florida. The same county that had Federal indictments for voter fraud in 1996.
Moreover, a statistical analysis of the "hanging chad" & multiple vote problems was strongly consistent with what would be expected if you took a stack of ballots that had already been voted and punched "Gore" through the stack.
Like I said, anything beyond paper ballots (and by that I meant grease pencil marked) is basically a recipe for fraud.