Reports

RoundUp: Spy vs Spy, while Officials and Voters lose

Almost every day lately there is news on the potential of future and past hacking, including election hacking. Today we suggest three recent articles and a report.

The N.S.A. bans its analysts from using Kaspersky antivirus at the agency, in large part because the agency has exploited antivirus software for its own foreign hacking operations and knows the same technique is used by its adversaries.

If Russia can attack our election, so can others: Iran, North Korea, ISIS, or even criminal or extremist groups.

Exactly a year after U.S. intelligence issued a stern warning about Russian interference in the 2016 presidential election, the Trump administration has failed to fill key homeland security posts responsible for preventing another Kremlin assault on the voting system…

It sounds like science fiction, or at least “Ocean’s 11,” but cybersecurity experts are frantically waving their hands, trying to get Americans to see that in foreign capitals, the American voting system just looks like easy opportunity.

Skepticism now, Skepticism tomorrow, Skepticism forever

Recent events are a reminder that we must be eternally skeptical. We need to be especially skeptical of the mainstream media as well as other sources.

Today we add the most recent flurry about the “21 states hacked by Russia before the 2016 election”, and more.  The story continues to fall apart, bit by bit. Yet, we suspect the truth is far from common knowledge.

And an Intercept story by Kim Zetter reviewing a report by Kaspersky Lab Masquerading Hackers Are Forcing a Rethink of How Attacks Are Traced. The title pretty much says it all.  Attribution is difficult, yet often possible.

Report: Presidential Election Audit: Suffers Two Blows to Credibility

Citizen Audit: Two Blows to Connecticut Election Audits
Leave Them Weaker, Less Credible

 

From the Press Release:

In spite of growing national concerns about election integrity, election credibility in Connecticut has suffered two devastating blows:

  • The Connecticut General Assembly cut post-election audits in half from 10% to 5% of voting districts, and failed to fix glaring weaknesses in the state’s audit law.
  • Shockingly, Connecticut has become the first state to replace verifiable hand-count audits with unverifiable electronic audits. Now the public can’t verify audit results.

“It need not be this way. Electronic audits can be manually verified without sacrificing efficiency,” said Luther Weeks, Executive Director of Connecticut Citizen Election Audit. “Because audits are conducted by the same officials responsible for conducting elections, audits must be transparent and publicly verifiable,” he said.

The Citizen Election Audit also found continuing problems with how municipalities conducted audits. “The Secretary’s Office should take the lead in ensuring that audits are complete, credible, and publicly verifiable,” Weeks said. “The public, candidates, and Secretary Merrill should expect local election officials to organize audits that produce accurate audit reports,” he said.

Evidence-Based Elections

We favor “Evidence Based Elections”.  We recently reread this 2012 paper by Phil Stark and David Wagner,  Evidence-Based Elections

It covers at a high level the requirements to provide the public and losing candidates the evidence necessary to convince that its very likely the candidate favored by the voters actually was declared the winner of an election (or determining, if possible, the winner).

Compared to all the states in the Union, Connecticut would rank slightly above average, yet far from approaching credible evidence-based elections. We have paper ballots, inadequate post-election audits, close-vote recanvasses, no compliance audits, and atrociously weak ballot security.  This is a case where a rating/ranking should be the result of multiplying the factors, rather than adding them:

Paper Ballots(1.0)  x  Post-Election Audits(0.3)  x  Self-Correcting(0.4)  x  Compliance(0) = 0

April Presidential Primary Audit – Does Not Make the Grade

Checks on State Voting Machines Do Not Make the Grade
Do Not Provide Confidence in Election System, Says Citizen Audit

From the Press Release:

Audits of the recent presidential primaries are so faulty that exact final vote tallies cannot be verified, says the non-partisan Connecticut Citizen Election Audit. Unless state and local election officials make changes, the same will be true for the November elections.

“State law requires audits to verify the accuracy of optical scanner voting machines as a check for errors and a deterrent to fraud. Local registrars gather officials to manually count paper ballots and compare their totals to the totals found by the scanners, explains Luther Weeks, Executive Director of Connecticut Citizen Election Audit.

Issues reported by the group were:

  • Incomplete or missing official reports of vote counts from town registrars;
  • The lack of action on the part of the Secretary of the State’s Office to check that all required reports are submitted and all submitted reports are completed fully;
  • Of 169 municipalities required to submit lists of polling places before the election, the Secretary of the State’s Office recorded only 68, with 101 missing;
  • Poor security procedures to prohibit ballot tampering;
  • Not following procedures intended to ensure “double checking” and “blind counting” rather than having scanner counts as targets while counting manually;

“The public, candidates, and the Secretary of the State should expect local election officials to organize proper audits and produce accurate, complete audit reports. The public and candidates should expect the Secretary of the State’s Office to take the lead in ensuring the audits are complete. Yet, due to a lack of attention to detail and follow-through the audits do not prove or disprove the accuracy of the reported primary results,” Weeks said.

<Press Release .pdf> <Full Report pdf> <Detail data/municipal reports>

Highly Recommended: Hacking Elections Is Easy!

From the Institute for Critical Infrastructure Technology: Hacking Elections Is Easy <read>. It is the most layperson accessible comprehensive overview of the problems we face protecting our elections that I have seen in a long time.  It is 23 pages yet very readable.  The main points are:

  • We face multiple risks our elections:  Registration systems, voting systems, reporting systems, and ballot security.
  • We face risks from multiple actors: Nations with interests in manipulating our elections, corporations, U.S. Government agencies, sophisticated hackers, and insiders at all levels.
  • For the unsophisticated, Hacking Is Easy.  There are simple insider attacks, simple cyber attacks, and kits on the Internet to compromise results or simply disrupt elections.
  • Most election officials are of high integrity.  Yet, blind trust in all officials, machines, and that hacking is difficult is perhaps our greatest risk.

Just a couple excerpts from the Introduction:

To hack an election, the adversary does not need to exploit a national network of election technology. By focusing on the machines in swing regions of swing states, an election can be hacked without drawing considerable notice. Voter machines, technically, are so riddled with vulnerabilities that even an upstart script kiddie could wreak havoc on a regional election, a hacktivist group could easily exploit a state election, an APT could effortlessly exploit a national election and any corrupt element with nothing more than the ability to describe the desired outcome could order layers of exploits on any of the multitude of deep web forums and marketplaces. Yes, hacking elections is easy…

Report: Secret Ballot At Risk

A new report from the Electronic Privacy Information Center, articulates some of the risks of losing the the Secret Ballot: Secret Ballot At Risk: Recommendations for Protecting Democracy <Exec Summary> <Report>

We recommend reading the Executive Summary and at least the section of the report covering the history of and the need for the secret ballot, pages 4-9 and the section for your state, e.g. Connecticut pages 54-55.

Our only criticism is that the report does not cover the risks to the secret ballot and democracy posed by photos, most often seen in selfies of voters with the voted ballot taken in the voting booth.  Nor does it cover the risks  to the secret ballot posed by absentee voting.

Study Shows Connecticut Municipal Websites Do Not Serve Voters

Most fail to provide information voters need to register and vote
Citizens must be better served and municipalities could save money

From the press release:

April 6, 2016: The Connecticut Citizen Election Audit released a study evaluating election information provided to voters by Connecticut’s 169 municipalities. Information was collected by volunteer evaluators just prior to the 2015 November election.

Citizen Audit spokesperson Luther Weeks stated, “Many towns do not provide the information most sought by voters across Connecticut, such as ‘What is on the ballot?’ or ‘Where do I vote?’. Many failed to inform citizens of online registration, which could increase registration and cut municipal expenses.”

Municipal website findings include:

  • Only 33% answered “What is on the ballot?”
  • Only 56% answered “Where do I vote?”
  • Only 58% provided the date of the next election.
  • Only 28% provided registration deadlines.
  • 5 provided an incorrect election date.
  • 2 provided incorrect registration information.
  • 51% had no link to Online Registration. 28% had no link to Online Registration or to a Mail-In Registration form.
  • Only 17% posted results of their 2014 election.
  • Only 15% provided Voter ID information.

Weeks said, “The Secretary of the State’s web has much of this information, yet studies show that voters go first to their local web. Registration information is important for new voters, and all voters want the election date, ‘Who is on the ballot?’, ‘Where do I vote?’ and voter ID requirements.”

The report also includes recommendations to municipalities, the Secretary of the State, and a low-cost sample website for a whimsical town, http://NutmegtonCT.wordpress.com

<Press Release (.pdf)> <Full Report (.pdf)>

Citizen Audit Cites Flaws in Official Election Audits

Again accuracy declined and write-in votes handled incorrectly
November 2015 Post-Election Audit Report

From the Press Release:

The Connecticut Citizen Election Audit has released its report on its observation of the November 2015 official post-election audits. The audits, required by state law, are intended to verify the accuracy of elections at the municipal level.

Citizen Audit spokesperson Luther Weeks stated, After 9 years of official audits, voters should expect accuracy. Yet the audits have gone from poor to worse.”

The group’s observers found that official audit results do not inspire confidence because of continued:

  • Discrepancies between machine counts and hand counts of votes reported to the Secretary of the State by municipal registrars of voters.
  • Lack of investigation of such discrepancies, and the lack of standards for triggering investigations.
  • Lack of consistency, reliability, and transparency in the conduct of the audit.
  • Weaknesses in ballot chain-of-custody and security.

The group’s report noted:

  • 28% of official audits cited “Human Error” in counting ballots and votes. Registrars of voters should be expected to take the necessary effort to count accurately.
  • Significant decreases in audit integrity, and accuracy.
  • In three towns audits detected districts where officials fed write-in ballots through scanners a second time on election night.
  • If the group’s recommendations from last year had been mandated and followed, all write-in ballots would have been counted accurately.

“Problems discovered counting write-ins two years in a row shows the value of the official audits. But the report also reveals the decline in official attention to the audits, demonstrating that independent citizen observation and reporting are essential to election integrity.” Weeks emphasized.

<Press Release .pdf> <Full Report pdf>  <Detail data/municipal reports>

Brennan Center: Election Integrity: A Pro-Voter Agenda

Whenever we open a report with multiple recommendations we start from a skeptical point of view. We expect to agree with some proposals and disagree with others.  A new report from the Brennan Center for Justice is the exception.  We agree with every recommendation:
Election Integrity: A Pro-Voter Agenda

It starts with the right criteria, it has a great agenda, strong supporting arguments, and ends with an appropriate call to action

Page 1 of 812345...Last »