Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×

Hardware Hacking a Voting Machine in 4 Minutes 482

Posted by Zonk from the ready-set-vote dept.
goombah99 writes "Bev Harris of BlackBoxVoting.org has acquired an actual Diebold Acu-vote ballot scanner. Rummaging through King County's trash, she managed to get her hands on some of their tags and seals. She has since demonstrated a successful penetration of the seals without breaking them ... all in under 4 minutes with no training or technical skills required. There's a nice how-to with photos over at Verified Voting New Mexico." More from goombah99 below.
"The demo is particularly relevant in light of the recent experience in Ohio in which there were large discrepancies between the electronic record and the paper trail, and also since many counties still permit the machines to be taken home by individuals before voting day (as a means of distributing them to precincts). These 'sleepover' machines were involved in the contentious narrow-margin San Diego Election, and are in continued practice in many states. Moreover, it's common practice for counties to contract out deliveries to third parties, such as in New Mexico where in one election, unlicensed delivery drivers took the machines on an unauthorized field trip and only got caught when they crashed the delivery truck after a stop at Hooters. The good news here is that the penetrated Diebold system in the photo essay is an optical scan system. It's not a touchscreen electronic voting system, so there is a paper trail. What hack really shows is that without mandatory random spot checks on the paper ballots, these may be as potentially vulnerable as the touchscreen direct recording electronic voting systems. It's perhaps worth noting that the open source voting system being developed by the Open Voting Consortium features a 100% reconciliation of every single paper ballot with an independent electronic record."
This discussion has been archived. No new comments can be posted.

Hardware Hacking a Voting Machine in 4 Minutes More

Hardware Hacking a Voting Machine in 4 Minutes

Comments Filter:

  • My Perception Has Changed Again (Score:5, Insightful)

    by eldavojohn ( 898314 ) * <eldavojohnNO@SPAMgmail.com> on Tuesday September 05, 2006 @11:46AM (#16045581) Journal
    My initial concerns about these voting machines was someone obtaining one through other means than stealing one from the government and then creating trojan software for it. I mean, if other people can buy these ... then they can study them and learn how to hack them. On the converse, if we can't study them, how do we know the government isn't rigging them?

    So there was this interesting catch-22 where you couldn't let them into the general population for fear of a trojan being created and inserted into a group of normal ones on election day. But you also can't trust your government [alternet.org]. Especially not the current one in the United States and considering the voluntary resignation of the Diebold CEO [slashdot.org], I think we should at least ask for third party verification of these machines. In fact, I for one consider Black Box Voting to be a champion protector of my right to vote for publishing this information. You might not feel as strongly about them but had I not read two articles from them, I would still be ready to use a voting machine in the next presidential election.

    Black Box Voting had me convinced these machines were at least a liability and at best a luddite's fear. After reading this quick "how-to" about these machines, my perception is no longer that we need to define how these machines are bought, sold & handled ... but instead my opinion is now that we may be trying to use something that shouldn't be used at all.

    Product created with shoddy security features. Get rid of Diebold and hope the market brings a new contestant into the ring for the much sought after prize of the American public's voting machine contract!

    The Diebold Acu-vote has failed as a product that requires the utmost security. I am a dissatisfied consumer and I sincerely hope every citizen of the United States agrees with me.

    • Re:My Perception Has Changed Again (Score:5, Insightful)

      by Anonymous Coward on Tuesday September 05, 2006 @11:51AM (#16045639)
      "The Diebold Acu-vote has failed as a product that requires the utmost security. I am a dissatisfied consumer and I sincerely hope every citizen of the United States agrees with me."

      Unfortunately, you're not Diebold's customer. The elected officials who in turn buy the machines responsible for reelecting themselves are Diebold's customers.

    • Re:My Perception Has Changed Again (Score:4, Insightful)

      by Chaffar ( 670874 ) on Tuesday September 05, 2006 @12:29PM (#16045989)
      The Diebold Acu-vote has failed as a product that requires the utmost security.
      Honestly how hard would it have been for them to adapt their ATM's to become a voting machine?

      Press the button next to the name of the person you want to vote for. Thank you for voting. Yes, it IS as simple as that.

      This is the part where you're suppose to realize that it's because Acu-Vote was never designed to be "secure" :)

    • Re: (Score:3, Insightful)

      by AngryNick ( 891056 )
      Product created with shoddy security features.

      I have two locks on my front door AND an alarm system. Hell, even my crappy 1999-era desktop came with a case alarm. You'd think that DieBold would have installed something that would start beeping, flashing, or explode after you open the top on the case or pull the memory card.

      Did Blackbox look for other, less obvious, IDS that may be in place?

  • What about hacking paper ballots? (Score:4, Interesting)

    by CPE1704TKS ( 995414 ) on Tuesday September 05, 2006 @11:49AM (#16045615)
    I hate Diebold and electronic voting as much as anyone else, but has there been any attempts to figure out exactly how easy it is to rig fake paper votes? There's a lot of effort put into showing the weaknesses of electronic voting, but what are the weaknesses of paper voting and how do they compare against e-voting?

    • Re: (Score:2)

      by Kenja ( 541830 )
      paper is much harder. With a paper ballot you need to alter every bit of paper for each vote you want to skew. With an digital system, you just make up the numbers at a ceneteral location.

    • Re:What about hacking paper ballots? (Score:5, Insightful)

      by Zenaku ( 821866 ) on Tuesday September 05, 2006 @12:05PM (#16045779)
      Depends on what you mean by "rigging." If you wanted to say, register in 5 different precincts, then vote at each one, you might get away with it. But that's 4 extra votes. If you wanted to say, change every 5th vote from a district, or just plain "lose" the results of the district entirely, you'd have a hard time doing it on paper.

      In general, I'd say that any kind of large-scale vote rigging done by paper ballots would require a conspiricy involving multiple staffers and observers at the polling places. You'd need to physically replace thousands of paper ballots with fake ones. Good luck doing that by yourself. And afterwards, if the results look fishy, there is a good chance that the fraud could be discovered on a recount.

      With these Diebold machines, on the other hand, any one person, even one without any special access given to election workers, could modify as many votes as they want, while arousing no suspicion, leaving no physical evidence in the form of discarded ballots, and leaving no trace of the original results should a recount or investigation be ordered.

      There will always be some dishonest people who see democracy as a game they can "cheat" at to win. But if a voting machine doesn't produce a solid meat-space record that can be guarded, stored, and re-examined, the effects of those cheaters on the outcome is greater by orders of magnitude.

      • Re: (Score:3, Informative)

        by CommandNotFound ( 571326 )
        There will always be some dishonest people who see democracy as a game they can "cheat" at to win. But if a voting machine doesn't produce a solid meat-space record that can be guarded, stored, and re-examined, the effects of those cheaters on the outcome is greater by orders of magnitude.

        Not to mention that fact that these electronic systems are so expensive compared to the best voting method I've used, that is the "connect the arrow with a sharpie pen". No chads or punch systems, just thick paper and mar

      • Re: (Score:3, Informative)

        by Zontar_Thing_From_Ve ( 949321 )
        In general, I'd say that any kind of large-scale vote rigging done by paper ballots would require a conspiricy involving multiple staffers and observers at the polling places. You'd need to physically replace thousands of paper ballots with fake ones. Good luck doing that by yourself. And afterwards, if the results look fishy, there is a good chance that the fraud could be discovered on a recount.

        Your comments could be applied to the Ukrainian Presidential runoff of 2004 [wikipedia.org] where massive vote fraud was don

    • Re:What about hacking paper ballots? (Score:5, Interesting)

      by Anonymous Coward on Tuesday September 05, 2006 @12:20PM (#16045920)
      Here's how it goes (I've experienced it firsthand):

      The various parties have a representative sit in each room and oversee that proper pratices are taken by all the officials and voters, and that no tampering takes place. At all times they are privy to the process, EXCEPT WHILE BALLOTS ARE MARKED (obviously). When I was one of these people I even had to follow the box around when the election officers helped people in wheelchairs by bringing the box outside (the building was not wheelchair accessible).

      Proper practices are this:

      Prior to the booth being opened the total number of ballots are accounted for, and their serial numbers recorded. The cardboard ballot box is built (from the provided cutout) and taped with security tape.

      Each person has a voter card or is eligible to vote. They are provided one ballot and their name is stroked from the list. They mark their ballot and fold it in private. They present the folded ballot to the elections officer. The officer then removes the "receipt" portion, which only has a serial number on it, stores it aside, and then they hand the ballot to the voter. The voter places the ballot into the ballot box. Repeat as necessary.

      At the end of the election, the ballot box is opened. The ballots are counted in front of the party representatives, and any ballots anyone isn't happy with are contested. Contested ballots are recorded as contested. Damaged/misused ballots are accounted for. Serial strips are checked against the number of voters and the amount of votes in the box to ensure there are none missing / too many. All information is recorded. The box is resealed with new (different) security tape, this time also sealing the section one drops the ballots into, all documents are sealed, EVERYONE involved (including the representatives) signs all the envelopes and the tally sheet. Once everyone is happy (if there is much to contest, this may take HOURS) the ballot box is driven to the head office for the city and held for a period (I believe this period is YEARS).

      Should there be enough contested votes that it would throw the election, there are recounts, recounts, and more recounts.

      The nice part of this process is it provides third party verification at all times. Since all parties are assumed they may have their own interests in throwing the election, by allowing all parties on the ballot to sit there and watch EVERYTHING, no one party has the opportunity to throw the election. They only have the opportunity to delay it and whine a whole bunch.

      It takes a bit more work, but by golly, find me a "crack" for that system and I'd be happy to see it work.

      Oh, and yes, if someone contests all the ballots, recounts can be held indefinitely until someone gives. Did I mention during this entire time nobody is allowed to leave the election room, even if it is for the facilities or for food/water? And, of course, nobody else is allowed in. Permission is usually given if all the parties co-operate, but serious filibusters are nigh impossible.

    • Re:What about hacking paper ballots? (Score:5, Insightful)

      by Smidge204 ( 605297 ) on Tuesday September 05, 2006 @12:30PM (#16046001) Journal
      Paper ballots are certaintly not perfect. They can easily be altered, lost or destroyed... but so can electronic records and the physical media they are stored on.

      However, changing one vote on a paper ballot requires modifying or replacing a sheet of paper. Changing 100,000 votes requires changing or modifying 100,000 sheets of paper. Changing one electronic vote requires a few keystrokes. Changing 100,000 electronic votes requries... a kew keystrokes.

      Even better, to alter a paper ballot you need physical access to the ballot. To change an electronic vote you do not necessarily need physical access to the computer on which is resides.

      100,000 paper ballots also takes up a bit of volume, os it is not something that can be easily concealed without having a lot of people in on the plot, and would take some time to prepare, swap and dispose of the evidence. A memory card holding 100,000 electronic votes can be slipped into a shirt pocket, can be prepared in minutes, and all traces of the original data can be destroyed almost instantly.

      Lastly, anyone can read and verify a paper ballot. Only people with the proper equipment, software, and technical knowledge (and cryptographic keys, if any are used) will be able to look at and verify the electronic votes.
      =Smidge=
  • It is not needed.

    We geeks love to bitch about solutions in search of a problem; is there a clearer example?

    • Not always.
      In India, the introduction of EVMs [eci.gov.in] reduced the election expences by a magnitude of 10.
      Also, since there is a huge potential number of votes (upto 500 Million), it can reduce the time taken for the counting by a huge amount.
      Another point to be taken to consideration is that there was a lot of invalid votes (when people unknowingly pressed the marker between two candidates in the ballot) esp in places where illetracy is abound. In some places, the invalid votes was more than the difference of votes beween the winning and second candidates. The EVMs meant that invalid votes are no longer an issue.
      Also, there was an issue wherein a group of people will barge in a polling booth, and stuff some hundreds or thousands of ballots to the ballot box and run out. This invariably caused either
      (a) wrong counts or
      (b) re-voting in that booth.
      Now this is no longer an issue since there is a time limit between votes and if too many votes come in, it goes in to lock mode(i dont know whether the second option is used now, but the first one is still there - time limit is around 20 seconds or so).

      So I guess, it is needed, in many enviornments.
    • It is not needed.

      Indeed.

      Us Canadians use plain old paper ballots, and are able to count them all within a few hours, even after a federal election. The votes are the paper trail.

      I'm reminded of the election in The Moon is a Harsh Mistress.

      ...laura

    • OK, so here's the theory.

      Electronic voting machines can be designed to be easier to use and more accessible to people with disabilities than traditional voting machines. Blind people can connect a pair of headphones and have their choices read to them. People who don't speak English well can choose a different language such as Spanish or Korean or whatever. Touchscreens may be easier to operate for people with physical disabilities. The order of the candidates can be randomized for each voter, so alphab

    • Re: (Score:3, Insightful)

      by sgt_doom ( 655561 )
      Well, the "solution" to everything from this administration has been to "privatize" it...that is, to contract it out for fraudulent overbilling, embezzling, and plain not getting the job done -- but receiving the taxpayer's funds in payment anyway. The clear solution is to quit "privatizing" everything

  • Ok (Score:5, Interesting)

    by Billosaur ( 927319 ) * <wgrother@opto[ ]ne.net ['nli' in gap]> on Tuesday September 05, 2006 @11:49AM (#16045625) Journal

    So it's easy to compromise the security of a Diebold voting machine -- news? This has been going on for a while in one form or another ever since Diebold got into the business. I'd have been more shocked if they would have found that you couldn't force it without breaking the seal.

    If states/counties are smart, they'll avoid Diebold like the plague and stick to the old voting systems until a virtually fool-proof system can be designed and built. In the meantime, this won't have much effect on voting, since fewer and fewer people vote all the time.

    BTW, that website with the detail is a trociously put together.

    • That was also quite an "a trocious" spelling mistake :)

    • Re: (Score:3, Insightful)

      by A beautiful mind ( 821714 )

      until a virtually fool-proof system can be designed and built

      You've already given the reason why it won't happen.

      The elections not only have to be fool-proof, but fool-accountable too, so that the common voter can clearly understand, and verify the process of voting. That alone means no electronic voting, because 99% of the voters don't understand it, and even if they do, they can't verify the process.

      The paper ballot is the only way, since that is the only voting process every voter understands, and e

      • Re: (Score:3, Insightful)

        by lynx_user_abroad ( 323975 )
        You make an excellent point here, but you don't make it strongly enough.

        The elections not only have to be fool-proof, but fool-accountable too, so that the common voter can clearly understand, and verify the process of voting. That alone means no electronic voting, because 99% of the voters don't understand it, and even if they do, they can't verify the process.

        The Diebolds and the Mexico's of the world are just now starting to understand this: It doesn't matter if the voting machine actually rigs the v

  • Good Enough for Government Work (Score:5, Insightful)

    by stealie72 ( 246899 ) on Tuesday September 05, 2006 @11:50AM (#16045631)
    Seriously, it seems like the voting system is just shoddy, not specifically corrupt. But the shoddyness sure does help the corruption.

    If only people thought their vote mattered, they might be concerned about this.

    • Re:Good Enough for Government Work (Score:5, Insightful)

      by monoqlith ( 610041 ) on Tuesday September 05, 2006 @12:08PM (#16045807)
      Exactly. It's a vicious cycle. People are convinced that their vote doesn't matter; therefore, our election administrators can get away with an opaque, shoddy, and potentially corrupt election system. Then, stories like this come out which confirms people's mistrust, cynicism, and resulting apathy, entrenching the popular opinion that the individual vote doesn't matter. Instead of being galvanized, most people(including myself, but not anymore) just sit back and declare that the ideal of popular representation has been dead for many years already or they wait for other people(the government?) to take care of the problem. Or they declare that there is no difference between the platforms; that all politicians are the same nihilistic creatures. Or they just don't feel like worrying about it. Or they don't understand why having a privatized election system administered by political appointees and elected officials, entails a conflict of interest. There are failures of curiosity at every level of public life.

      This is not at all to say that stories like this are bad at all. They are very very good. They bring attention to probably the most important issue of our time; if we have no say in our government, then every other political issue is quite literally irrelevant. I applaud black box voting for taking this seriously, and hope that I can justify their efforts by helping to galvanize people to demand transparent voting. It is absurd that our election process is subject to error at all.

        As I've said before, it's just counting

      Why can't we get it unequivocally right? It is so easy that there has to be some interest behind not making it as transparent and rigorously accurate as humanly possible. We need to draw out these interests and cancel out any undue influence they have over our system.

      • The vote is already subverted (Score:5, Interesting)

        by myowntrueself ( 607117 ) on Tuesday September 05, 2006 @02:02PM (#16046667)
        You can make the process of voting, the counting of the vote, secure, you can introduce all the technical and physical security you want.

        But the vote is *already* subverted by a social engineering attack which is practically unstoppable; media coverage of politics.

        This subverts democracy at the earliest stage; right where the voter forms the desire to vote one way or another.

        If you think this is bullshit consider advertising.

        Billions of dollars, shekels, yen and pounds are spent on the advertising of products. Does it work? Well I think that it would be foolish to assume that its money wasted.

        If advertising works for things like consumer products, foodstuffs, whiteware etc, shaping the way that people spend their money, why wouldn't it work for shaping the way that people spend their vote?

        A vote is just an item of currency that everyone has just one of and gets to spend it every so many years. Shaping voting patterns is exactly the same as shaping spending patterns.

        Problem is, without a crack-down on media presentation of politics its impossible to stop this kind of subversion. And if that were to happen, what would be the point in having a democracy in the first place?

        I don't think that democracy can exist in the modern world. A better term for what we *call* 'democracy' would be 'mediacracy'.
  • She has since demonstrated a successful penetration of the seals without breaking them ... all in under 4 minutes with no training or technical skills required.

    I don't see why there's not more outrage about this. Do people not understand that every liberty that we have (and used to have) stems from the ability to vote, and have your vote counted?
    • But I think there is an assumption that the people running the polls will not allow a team of hackers to sit there at the Diebold machine prodding and prying at it, soldering logic boards onto it, and all the other funky stuff they've been doing to Diebold machines to make them mess up. I could just drive a truck into it, that would be even easier than hacking it!

      • Re:Just my guess (Score:5, Insightful)

        by Osty ( 16825 ) on Tuesday September 05, 2006 @12:09PM (#16045813)

        But I think there is an assumption that the people running the polls will not allow a team of hackers to sit there at the Diebold machine prodding and prying at it, soldering logic boards onto it, and all the other funky stuff they've been doing to Diebold machines to make them mess up. I could just drive a truck into it, that would be even easier than hacking it!

        It's not people at the polling place that they're concerned with. Its the corrupt officials who get to take the machine home with them, who could replace valid vote data with a trumped up memory card showing a clear majority win for whoever is paying them the most. The "tag" on the metal cover is supposed to prove that the machine has not been tampered with. This article proves that you can tamper with the data all you like without breaking that tag.

        In a sense, this is even worse than a hacker attacking the machine right at the polling place. In this scenario, you feel like you've excercised your right to vote and contributed to the process of making things better, but in reality your vote never got counted at all. It was replaced by a dummy vote.

  • As Seen on TV! (Score:4, Funny)

    by Hahnsoo ( 976162 ) on Tuesday September 05, 2006 @11:52AM (#16045650)
    Their idea of a security update probably will amount to a flashy new star-shaped sticker over the rim of the case that says "Now with new tougher security action! 25% more secure than our previous model!"
  • ... would be to tamper with the seals on a few voting machines used in an election and see if anyone even notices. Based on my experiences here (the aforementioned San Diego, where technology-adept voters were helping poll workers reboot the machines and reinstall the software because the program was in RAM and the batteries ran down while the machines sat unpowered for days before the election), nobody'd even bother to check.

    • Re: (Score:3, Insightful)

      by rjstanford ( 69735 )
      Even worse. Let's say that you're in a district where your candidate is in the minority, but that's not the case overall. You can reasonably expect most of the votes on whatever machine you're given to vote on are for her opponent. Well, simply rip the tag! Worst case, nothing happens. Best case (for you, although not for the rest of us) all of the votes on that machine get tossed out.

  • So okay wait. (Score:2, Insightful)

    by /dev/trash ( 182850 )
    If Democrats win in the fall elections, and these machines are still being used, will there still be an uproar?

    I'm doubtful.

    • Re: (Score:3, Funny)

      by MindStalker ( 22827 )
      I'm more worried about what will happen if the Democrats don't win. I'll have to hear about it for years to come.. :(

    • Re: (Score:3, Insightful)

      by lawpoop ( 604919 )
      Yes there will be an uproar -- from the other side. If these machines are this easily hacked, then the other side can hack them also.

      Personally, I don't care who fixes the system as long as the system is fixed.

      • Re: (Score:3, Funny)

        by Paladin144 ( 676391 )
        Personally, I don't care who fixes the system as long as the system is fixed.

        Oh, don't worry; the system is definitely fixed. Very fixed.

    • Re: (Score:3, Insightful)

      by Overzeetop ( 214511 )
      You mean in general, or just on slashdot?

      If the Democrats win in the fall, and they are skewed from the exit polling data, then yes, there will even be an uproar on slashdot. Now, it will mostly be split between "we need a goddamned paper trail" and the new favorite "we told you there should have been a paper trail, but nobody listened to us." The national "mainstream" (center-left) media will do their obligatory piece on it and let it die. The far left will be unusually quiet. The conservative media will,

      • Re:So okay wait. (Score:4, Insightful)

        by Red Flayer ( 890720 ) on Tuesday September 05, 2006 @12:58PM (#16046238) Journal
        The national "mainstream" (center-left) media will do their obligatory piece on it and let it die.

        Still buying that piece of horse-crap? The news media is center-right. Yes, even ABC, NBC, etc.

        Also, you need to rethink your definitions of left and right. Do you mean just regarding social issues? Or also fiscal issues? Because honestly, your post made almost no sense without a definition of terms.

        /., on the whole, leans moderately left.
        If that were so, we wouldn't see so many posts like yours getting modded up. It's a guaranteed upmod -- just spout some nonsense about some tangentially liberal/conservative dichotomous issue, and then say slashdot leans left.

        Newsflash: the center has moved to the right, largely due to the media and the greater birth rate among conservatives. What you consider left-of-center used to be the center.

    • Re:So okay wait. (Score:5, Insightful)

      by Red Flayer ( 890720 ) on Tuesday September 05, 2006 @12:36PM (#16046052) Journal
      If Democrats win in the fall elections, and these machines are still being used, will there still be an uproar?
      I'm doubtful.
      C'mon, don't make this a partisan issue. Democrats are making a lot of noise about it right now because they were the ones most recently burned. Plenty of Republicans, Libertarians, Greens, and independents are just as upset about it.

      Oh, and a big difference -- the Republican party has been demonstrably messing with the election process. From worse gerrymandering (of course the Dems do it too), to manipulation of the voter rolls, Republican control of the voting apparatus has lessened the democracy of the US. When the Democrats are also demonstrated to have systematically abused the voting apparatus to rig elections, then there will be just as large an uproar.

      And one final note -- what uproar? I haven't seen one. The MSM hasn't covered this to any extent. Joe Q. Public is unaware there is a problem. If you're trying to say in your post that the media is biased, or that coverage of the issue is biased, or that Democrats are only making an issue of this because they lost, you'e way off base. It isn't the Democratic party that's making an issue of this.

      • Re: (Score:3, Insightful)

        by workindev ( 607574 )
        the Republican party has been demonstrably messing with the election process

        I can only assume that you actually meant "allegedly" when you typed "demonstrably" because nobody has demonstrated anything about the election process being "messed" with by the Republican party. There sure have been plenty of baseless allegations, though.

      • Re: (Score:3, Insightful)

        by Thundersnatch ( 671481 )

        When the Democrats are also demonstrated to have systematically abused the voting apparatus to rig elections, then there will be just as large an uproar.

        Umm... you've never heard of the city of Chicago and the "Democratic Machine [wikipedia.org]"? Over 70 years of outright fraud, including swinging the 1960 presedential election in favor of Kennedy (ballot stuffing to the tune of 91% of the vote!). Newer crimes and misdemeanors by the Chicago Machine are uncovered almost weekly [nytimes.com], with Mayor Daley and Governer Rod Blagojevi

  • why is it secured in the first place? (Score:5, Insightful)

    by wfberg ( 24378 ) on Tuesday September 05, 2006 @11:56AM (#16045687)
    What I wonder is: why is it secured in the first place?

    No really, why should a memory card containing results need to be secured with a coverplate? It's the contents of the card that matters. Can't the authenticity of the card's content be ascertained without needing it NOT to fall in wrong hands? Is there no encryption used, no message authentication? Is there no protocol whereby officials at least sign off on a print-out containing the count, and some checksums? Wouldn't there need to be no need to secure the card itself? I mean, the machine (and it's RAM), obviously, but the card should only contain a copy of the results - a copy that will be in tomorrows papers anyway.

    The fact that someone (at Diebold even!) saw the need to put a coverplate in front of the memory card speaks volumes as to the system's design assumptions. That the machines are left with people overnight only makes things much, much worse.

    And that website's "web 2.0" ajaxy slidey photo thingy makes me dizzy and kinda nauseuous..

    • Re:why is it secured in the first place? (Score:4, Informative)

      by Jarnis ( 266190 ) on Tuesday September 05, 2006 @12:11PM (#16045824)
      Because the braindead system can be r00ted using a memory card - if a specially prepared card is in at boot, it can boot from the card and utterly pwn the software inside.

      Logic being 'ease of updating', but the safeguards in place against inserting something other than an authorized, verified and certified update are close to nonexisting.

      So, in essence, if you have access to the memory card slot, some time, and capability to reboot the machine, you can pwn the election. And it will most likely be untraceable.
  • Joke aside, isn't it illegal to go through people's trash (although perhaps mostly unenforced?) I though even cops need search warrant to go through suspect's trash can.

    • Re: (Score:3, Insightful)

      by joe 155 ( 937621 )
      in England it would be, here it blongs to the person who originally owned it until it is collected by the bin men, then it is owned by the council. I've seen on CSI them saying that the cops can take it... something about being discraded - it might work the same way for any citizen. Although CSI is about the depth of my knowledge on your laws (perfect for /.)

    • Re: (Score:3, Funny)

      by mOdQuArK! ( 87332 )
      Not necessarily.

      There's a pretty funny story in Portland, Oregon where local law enforcement was caught going through various peoples' trash, and they claimed that once the trash had been put out on the curb (never mind that in some cases the trash was still on the peoples' properties), that it was available to the public.

      Whereupon one of the local papers took it upon themselves to look through the Mayor's & the Chief of Police's trash, and reported what they found. Fortunately for the two officials, th

  • A Negative Negative (Score:5, Interesting)

    by w33t ( 978574 ) on Tuesday September 05, 2006 @11:57AM (#16045707) Homepage
    Here's a ridiculous idea.

    Have the voters fill out a scantron-type ballot. And then have the voter/user feed that ballot through two different voting machines made by two different manufacturers.

    This way there would be a paper record and two, seperate databases to compare to each other.

    This would double the effort (or perhaps square it at best) for hacking and would allow manual recounts from random sample districts to test the accuracy of the two machines.

    • Re: (Score:3, Interesting)

      by hackstraw ( 262471 ) *
      Here's a ridiculous idea.

      Have the voters fill out a scantron-type ballot. And then have the voter/user feed that ballot through two different voting machines made by two different manufacturers.

      This way there would be a paper record and two, seperate databases to compare to each other.

      This would double the effort (or perhaps square it at best) for hacking and would allow manual recounts from random sample districts to test the accuracy of the two machines.

      I'm confused how reduculous this is supposed to be.

      I

  • Some things should NOT be electronic (Score:5, Insightful)

    by Unlikely_Hero ( 900172 ) on Tuesday September 05, 2006 @12:05PM (#16045781)
    This just goes to show that there are a great number of things that should not be computerized/network connected etc.
    Just as one should not have an internet accessible refrigerator "mom! someone hacked the fridge again and turned the cooling off! Oh god the smell!!"
    One should not have electronic voting machines. Seriously, why the hell do we need electronic voting other than that a great deal of people were, excuse my honesty, too goddamn stupid to understand how to use a paper ballot.
    Another case of the ignorant masses rising up, bitching about how things are "too hard" and overcoming those of us who can follow simply printed instructions with their sheer moronic numbers.
    Fellow /.ers (particularly those of us in the states). Do you ever feel like you're strapped to a chair with a wet towel over your head surrounded by people who can't tie their own shoes without managing to injure themselves?

    • Re:Some things should NOT be electronic (Score:4, Insightful)

      by Volante3192 ( 953645 ) on Tuesday September 05, 2006 @12:36PM (#16046050)
      The problem isn't that it's electronic, the problem is it's not being held to any sort of secure criteria. Just compare Nevada slot machines to a Diebold device. Hell, compare Diebold ATMs to Diebold voting machines. It's a world of difference.

      It also shows the importance we place on money versus our government...

      I'm all for this, but no one has proven they can do it right. Maybe we should just replace voting machines with slot machines...

  • Site is unreadable. (Score:3, Interesting)

    by Animats ( 122034 ) on Tuesday September 05, 2006 @12:06PM (#16045792) Homepage

    The site referenced is so crapped up with "Web 2.0" junk that it doesn't work. The picture links result in a neat animated effect in which a translucent rectangle grows. Then it disappears without displaying the picture, at least in Firefox 1.5.

    If you have something important to say, use standard HTML. Especially if it's something important enough that it should be archived. Using "TiddlyWiki" with images on Flickr means your site will not be archived properly, and many search engines won't even index it with all that Javascript.

  • obligatory (Score:5, Funny)

    by gsn ( 989808 ) on Tuesday September 05, 2006 @12:07PM (#16045801)
    In Soviet Russia machine cast your vote for you... wait shit that happens here too

  • Most gratuitous use of Javascript yet! (Score:5, Funny)

    by darien ( 180561 ) <{darien} {at} {gmail.com}> on Tuesday September 05, 2006 @12:10PM (#16045816)
    Impressive. They hacked a Diebold voting machine in less time than it took me to work out how to navigate their photo-story!

  • Format of the linked article (Score:3, Informative)

    by ergo98 ( 9391 ) on Tuesday September 05, 2006 @12:10PM (#16045819) Homepage Journal
    Try viewing it [mac.com] without JavaScript (e.g. like those of us with NoScript). Look at the source -- OMG.

    That now qualifies as the most atrocious use of JavaScript I've ever seen - Jesus, render this garbage on the server. Feeding some oddball marked up nonsense to the browser, yielding a circa-1997 page, seems a little...unnecessary.

  • Kind of goofy article (Score:3, Interesting)

    by brunes69 ( 86786 ) <slashdot AT keirstead DOT org> on Tuesday September 05, 2006 @12:43PM (#16046108)
    So... if you have physical access to the machine, you can take it apart and alter it to hack into it(yes, that is what they did. RTFA).

    How is this news? The same can be said of any computer system.

    You have to at least operate under the assumption that these machines are audited before and after the electoral process, just like the ballot boxes were... if not, then *there* is the flaw in the system. The flaw isn't "hey, I can open this computer and alter it to change how it functions", it is "I can open this computer without anyone else knowing".

    • Wrong Comparison (Score:3, Insightful)

      by JetScootr ( 319545 )
      It's wrong to compare the security of a computer voting machine to other computers. It's better to compare the voting machine's security to the paper ballots they replace.
      If any granny can hack the box while supposedly voting, using $12 worth of tools bought at a grocery store, then it's not as secure as paper.
      Yes, any computer that you have physical access to you can hack, but can you hack a payphone to cough up its coins in 4 minutes??
      Security of a voting machine must be at least as solid as security of

    • Re: (Score:3, Informative)

      by goombah99 ( 560566 )
      The issue here is that previously a software hack on the memory card was shown last year. The hrutsi attack was successful done on a live voting machine that altered the votes and no election official test could show it was rigged. Diebold called the attack purely hypothetical and said it could neve be done in reality since access to the memory card is impossible due to seals and oversight. Well high speed, non-techincal attack, espeically in light of the sleep-over system sort of makes a mockery of that.

  • Fear the DMCA. (Score:4, Insightful)

    by Peter Trepan ( 572016 ) on Tuesday September 05, 2006 @12:51PM (#16046165)
    I'm not a lawyer, but I think these instructions should immediately be posted to sites hosted outside the U.S., so that Diebold can't get an injunction to shut the site down under the DMCA, and so they'll have less reason to take legal action against the poster, since doing so won't erase the evidence.

  • Here is my solution (Score:4, Insightful)

    by deadline ( 14171 ) on Tuesday September 05, 2006 @12:51PM (#16046166) Homepage

    If the SSN, home address, home phone, etc. of all the legislators who voted for the machines were placed on the memory card (and the officers of the companies that made them), then you can be damn sure the machines would be tamper proof and there would be a well documented chain of custody of each machine as well.

    Better, yet put all their pension money in an Swiss bank escrow account and place the number in the memory card. Then things get serious.

    Good security is possible. My guess is that the Diebold machines, rather than being some diabolical plot, are just a sloppy product designed for the government feeding trough. The whole e-voting thing is a windfall for these companies. It is mandated business.

  • To Trust or Not To Trust (Score:4, Informative)

    by misterhypno ( 978442 ) on Tuesday September 05, 2006 @12:55PM (#16046205)
    That is the question. And, considering the declining number of people voting every election, the rising number of complaints about the elctronic systems being used to tally the votes, the complaints about the butterfly ballots, the delays in counting the votes, the political maniuplations OF the votes when a dispute happens, the public seems to be getting ready to say, "To hell with the whole system!"

    And that's bad.

    Very few people trust the election system as it now stands on a national basis. There is NO national standard, NO overwatch that is politically independent and NO way to VERIFY the states that are using the electronic-only voting methods.

    The gaps are obvious: we need a national standard for the voting process; one that allows verification of EVERY vote on a papertrail basis; we need an independent overwatch OF the voting process; and we need an electronic voting system that is far more secure than the one that is currently being used.

    And the probability of that happening amounts to one Big FAT CHANCE.

    The excuses? It costs too much, it will take too much time to put into place, it violates State's Rights, there is no way to keep the politics out of the system and no system is completely secure.

    How much are we willing to spend to defend our shores from attack? Is .01% of that too much to ask to put into place a secure election system? How about siphoning off some of that pay hike the Congress just voted itself for this instead?

    With regards to State's Rights, this is for a national election. Sorry kiddies, doesn't apply as far as standards of the systems themselves go. You still have control of WHO votes and that's where the REAL power resides, so STFU. Keeping the politics out of the system? Well, there's no easy fix for that, but making the election review board similar to the Supremes, but with a requirement of 4 and 4 from each party and only 1 being appointed by the LAST sitting Prez might work... subject to Congressional approval and all that, of course. And secure? Well, nothing is ever totally secure, but we should be able to do better than a four-minute, no-break-the-seal-non-techie-hack!

    Lee Darrow,
    Chicago, IL

  • Private Voting, Public Counting (Score:5, Informative)

    by mrosgood ( 105043 ) on Tuesday September 05, 2006 @01:01PM (#16046262) Homepage
    There's lots of good posts. I'm glad we geeks are talking about this important issue.

    I spoke briefly with Bev Harris recently. See below.

    I'm at work, so I need to make this brief. Just four points.

    First, the two pillars of our democracy (United States of America) are private voting and public counting. We adopted the Australian Ballot [wikipedia.org] (aka secret ballot [wikipedia.org]) a while back. Things like electronic voting and forced mail voting (e.g. 100% vote by mail) take away the secret ballot. Here in Washington State, our constitution says we need a secret ballot. Disagree if you want. There's lots of ideas. Like voting receipts and no more secret ballots. But please start by changing our laws. Meanwhile, any attempt to take away the secret ballot (private voting) is unconstitutional.

    Second, there is no technical way to have an electronic voting system which both preserves the secret ballot and the public vote count. If the ballots are secret, then there's no verifiability, meaning no public count. If the system is verifiable, then there's no secret ballot. You can have one or the other, but not both. Electronic counting, as with the precinct-based optical scanners, can be done constitutionally.

    Third, currently the most reliable way to vote in the USA is to use a voter-correctable precinct-based optical scanner (PBOS). Sorry, I don't have the cites handy (my bad), but dig a little and you can find the research on this. Brennan Center, GAO reports, MIT Voter Project, etc. The basic idea is that you mark a ballot and feed it into a machine. If there's a problem, the machine spits the ballot back out, giving the voter a chance to correct the problem. Yes, these machines need to be better designed, open source, yadda, yadda. But before anyone proposes a better system, please work to understand the best system currently available. (Thank you for your patience.)

    Many juridictions have wisely moved away from touchscreens and other DREs and adopted PBOS systems with a low-cost, verifiable solution for disabled voting. TrueVoteCT.org just had a huge win. And Voter Action [voteraction.org] sued and got the touchscreens in New Mexico replaced with PBOS systems. (Please visit both orgs and give them cash. Activism is not cheap!)

    Fourth, and lastly, Bev Harris made an incredibly important point: Our elections have to be understandable for all the voters. Blackbox Voting has spents years digging and researching. I've personally spent 2 years learning all that I can about elections, voting, and these systems. I'm a computer geek and I readily admit that I had to work pretty hard to understand stuff. Bev has a lot of contact with experts, computer scientists, security dudes, etc. Her point is that we cannot rely on those sage gurus to weigh in on our election systems. We all need to understand how our democracy works. Not just the wonks. That means our election and voting systems must be simple and straightforward.

    (PS- I saw Bev during King County Washington's "logic and accuracy testing" of our new Diebold AccuVote TSx touchscreens last Tuesday. You can read "Report: Testing of Diebold AccuVote TSx" on my blog [blogspot.com], on WashBlog [washblog.com], or on dailyKos [dailykos.com]. Please holler if anyone has questions. I'll do my best to reply in a timely fashion.)

  • Fair and Balanced Vote Fraud (Score:5, Insightful)

    by Doc Ruby ( 173196 ) on Tuesday September 05, 2006 @02:06PM (#16046704) Homepage Journal
    Has anyone found any independently verified evidence of any of these digital voting devices used in an election won by a Democrat?

    • Re: (Score:3, Interesting)

      by lynx_user_abroad ( 323975 )
      Has anyone found any independently verified evidence of any of these digital voting devices used in an election won by a Democrat?

      But they were all won by Democrats, it's just that the rigged machines said they were won by Republicans... :|

      We can both maintain a poker-face, and neither of us will win.

  • Until someone does this in an actual election.. (Score:4, Insightful)

    by TomRC ( 231027 ) on Tuesday September 05, 2006 @02:19PM (#16046794)
    Until someone does this in an actual election, and then announces that they've skewed the results (and they'd better do it anonymously, or jail awaits them), no on in power is going to pay any attention. Reform only happens after actual problems get the public upset.

    • And here's how someone can prove to have done it (Score:4, Interesting)

      by rbarreira ( 836272 ) on Wednesday September 06, 2006 @09:18AM (#16051942) Homepage
      And how would he/she prove that claim was true? Just asking, not saying it's impossible. Oh wait, here is the method:

      One week before election day, the person posts a message to any publicly acessible place (such as a newsgroup, but surely there are better alternatives which give more trust for being more verifiable) containing one or more hash of the following sentence (MD5, SHA-1, whatever):

      "In state X, county Y, candidate A will have exactly 1144 votes and candidate B will have exactly 905 votes because I will have rigged the election. A week after the counting, I shall reveal this message to prove this claim. Cryptographical hashes of this message have been posted one week before election day at alt.foobar.org"

      One week after the election, the person unleashes this message and then everyone can verify the hashes and conclude that at least one of the following is true:

      (1) The person is very lucky at doing predictions
      (2) The person can predict the future and should play the lottery
      (3) The person has cracked all of those hashing algorithms
      (4) The person has in fact rigged the election

  • Non-violent protest (Score:4, Insightful)

    by hairykrishna ( 740240 ) on Tuesday September 05, 2006 @02:21PM (#16046803)
    I keep reading about how these machines are insanely easy to hack. Surely the next election will be determined by the patriotic hackers of america? Apply yourself people.

  • we're almost there! (Score:4, Funny)

    by mikemulvaney ( 24879 ) on Tuesday September 05, 2006 @02:40PM (#16046933)
    This is getting close, but its still too difficult to deal with a modchip. Someone stick "007 Agent Under Fire" in there and get a softmod working.

  • So... (Score:3, Insightful)

    by JustNiz ( 692889 ) on Tuesday September 05, 2006 @04:53PM (#16048027)
    Bush must have shares in Diebold or something.

    Diebold have been the butt-end of so many serious security failures its not funny any more. Its obvious they don't have a clue about security and aren't likely to get a clue anytime soon judging from their ongoing record.

    Why are we still using this company's products? How many more times are the government going to allow Diebold to screw up?? Is there no-one else that makes a better system?

    • Re: (Score:3, Informative)

      by doom ( 14564 )

      Bush must have shares in Diebold or something.

      You think that that's just a joke? Ken Blackwell, the secretary of state of Ohio has approved using machines from Diebold, and then did an "oops, I guess I own stock in that company!" Here's one version of the story [cleveland.com].

      Anyway, it appears that the three big "electronic voting" companies are Republican shills, just going by the 2004 election data (exit poll discrepancies were bigger in districts using electronic voting, and all discrepencies were in the fav

  • Soviet Amerika! (Score:3, Insightful)

    by dbIII ( 701233 ) on Tuesday September 05, 2006 @09:05PM (#16049371)
    Where convicted felons can't vote but they can be involved in the development and production of voting machines! If you wan't a kleptocracy just keep on going down that path.

Slashdot Top Deals

The reward of a thing well done is to have done it. -- Emerson

Close