Electronic Vulnerability | CTVotersCount.org

How Do We Know? Two cases tell the tale

Bradblog has an instructive post bringing home the limitations and possibilities of optical scan paper ballot elections: Caught on Tape: Election Officials Behaving Badly

Bradblog has an instructive post bringing home the limitations and possibilities of optical scan paper ballot elections: Caught on Tape: Election Officials Behaving Badly <read>

As we have often said in Myth 9:

Myth #9 – If there is ever a concern we can always count the paper.

Reality

The law limits when the paper can be counted.

Brad brings an example from Ohio, where complying with a reasonable request could put legitimate concerns to rest:

Beiersdorfer is a geology professor, fracking expert and supporter of the ProtectYoungstown.org anti-fracking initiative. As you’ll here, at the meeting of the Elections Board, he politely asked for a hand-count of paper ballots regarding the ballot initiative, after a post-election poll appeared to offer contradictory results to those reported by the unverified computer optical-scan tabulation systems used in the county. (An electronic tabulation system, I’ll note, which has failed in election after election elsewhere.) In response, Betras freaks out and charges that Beiersdorfer has accused him of “rigging an election”.

“You just basically accused this board of elections of election fraud!,” Betras, a Democratic, snaps in outraged response, as caught on tape. “I find it highly offensive you’d accuse me of a crime!” His fellow election commissioner, Munroe, a Republican, takes similar offense.

All of that, simply because a voter wished to oversee the results of an election to confirm that computer-reported results were accurate — in a town with a history of election problems and where some of the same election officials reportedly spent some $30,000 of tax-payer money in a failed effort to keep the initiative off the ballot in the first place (before being overruled by the state Supreme Court.)

Instead of satisfaction and confidence in government, Ohioans are left with suspicion and doubt. Suspicion and doubt fueled by contradictory evidence, and the appearance of cover-up.

On the plus side, Brad points to a county in New York that demonstrates and alternative that provides confidence:

[Virginia]Martin, the Democratic co-chair of the Columbia County, NY Board of Elections — one of the few counties in the nation to publicly hand-count every paper ballot before certifying any election (my recent interview with Martin and her Republican co-chair on that specific topic is here) — explains on today’s show: “We election officials often find ourselves in the crosshairs. There’s always somebody in the public who’s not happy about something that’s transpired at the Board of Elections. There’s a winner and there’s a loser, so we often are in a position of having to defend ourselves. I can understand why they would be very sensitive.”

But, she adds, that type of concern simply doesn’t come up in her county, given that the public is invited to oversee the hand-count of paper ballots for every election. As an election official, she insists on hand-counts, she says, because: “I wasn’t comfortable with trusting what the computer said, because I know computers can make mistakes. I know that computers can be programmed incorrectly — inadvertently. I also know they can be manipulated, they can be tampered with. I personally can’t know how a computer counts anything, because I don’t get to see that. So how am I going to know that the result is correct?”

We do not insist on counting all paper ballots by hand after every election, yet it does automatically contribute to confidence. We recommend sufficient post-election audits, close-vote recounts, and economical means for the public to access all paper ballots or cause selective publicly verifiable manual recounts.

For further details and links to videos and related posts, see the Bradblog post. <read>

VW demonstrates the Myths of Conspiracy Theories

Myth: Conspiracies don’t exist

Truth: Conspiracies exist. People, corporations, and governments are frequently discovered to have committed conspiracies, often charged, and even convicted of Conspiracy to Commit [some crime]. The recent Libor financial scandal comes to mind, the Tobacco companies covering up studies linking tobacco to cancer, the recent disclosure that Exxon hid studies predicting global warming for decades, the NSA cover ups exposed by Snowden, and the FBI conspiring with Whitey Bolger, to name a few.

Myth: If Conspiracy X were true, too many people would know and it would have come out by now.

Truth: There are may conspiracies that remain unknown or not well-known for years or decades. Some may never be known. Many actually take only a few individuals who are highly motivated by fear of consequences, real intimidation, or perceived intimidation. Many suspected conspiracies are not investigated, even some where participants come forward publicly or surface their concerns through channels.

Several years ago a Connecticut Secretary of the State publicly referred to election integrity activists as “Conspiracy Theorists” which was followed by an apology after one of us objected. Actually I am a conspiracy theorist, as many people are, in regard to one thing or another. Calling someone “Conspiracy Theorist” is almost as derogatory, and similarly often as misleading, as calling someone a “Terrorist” or “Communist”.

Myth: Conspiracies don’t exist

Myth: If Conspiracy X were true, too many people would know and it would have come out by now.

Case in point, the VW emissions conspiracy, which just became widely know in the last few days. Now we learn from two articles in the New York Times that there were suspicions going back to 2007.

As Volkswagen Pushed to Be No. 1, Ambitions Fueled a Scandal <read>

Volkswagen’s unbridled ambition is suddenly central to what is shaping up as one of the great corporate scandals of the age. On Tuesday, Volkswagen said it had installed software in 11 million diesel cars that cheated on emissions tests, allowing the vehicles to spew far more deadly pollutants than regulations allowed…

Disabling the emissions controls brought major advantages, including much better mileage — a big selling point in Volkswagen’s push to dominate in America…

Volkswagen’s current crisis has its roots in decisions made almost a decade ago. In 2007, it abandoned a pollution-control technology developed by Mercedes-Benz and Bosch and instead used internal technology.

At the same time, the determination by Mr. Winterkorn, the company’s hard-charging chief executive, to surpass Toyota put enormous strain on his managers to deliver growth in America…

Cheating on emissions tests solved several issues at once. Not only were drivers rewarded with better mileage and performance, but the automaker also avoided more expensive and cumbersome pollution-control systems.

While Volkswagen cheated behind the scenes, it publicly espoused virtue…

It is not Volkswagen’s first run-in with regulators over emissions. When the United States began regulating tailpipe pollutants in the 1970s, Volkswagen was one of the first companies caught cheating. It was fined $120,000 in 1973 for installing what became known as a “defeat device,” technology to shut down a vehicle’s pollution control systems…

Over the last year, when confronted with evidence that its system was not performing as promised, Volkswagen aggressively pushed back, saying that regulators were not doing the testing properly…

The same year Mr. Winterkorn made his speech in Chattanooga [four years ago], officials from California’s environmental regulator began hearing about a problem from their European Union counterparts:

They were finding discrepancies between the emissions of diesels in the lab and on the road across the industry…

In 2013, a nonprofit group, the International Council on Clean Transportation, proposed testing on-road diesel emissions from cars in the United States — something never done before…

The transportation council, staffed by a number of former E.P.A. officials, did not expect to catch Volkswagen, or anyone else, cheating. In fact, it assumed that American diesel cars would run much cleaner than their European counterparts…

“If you’re idling in traffic for three hours in L.A. traffic, we know a car is not in its sweet spot for good emissions results,” said Arvind Thiruvengadam, a research professor at West Virginia University, which was hired to conduct the tests. “But when you’re going at highway speed at 70 miles an hour, everything should really work properly. The emissions should come down. But the Volkswagens’ didn’t come down.”

It was difficult to know what was going on: When the two Volkswagens were placed on a “car treadmill” known as a dynamometer, they performed flawlessly.
“It just didn’t make sense,” Mr. German said. “That was the real red flag.”

The normal response is blame the testers or the conspiracy theorists:

Volkswagen fired back. “They tried to poke holes in our study and its methods, saying we didn’t know what we were doing,” Mr. Thiruvengadam said. “They were very aggressive.”

The company offered many explanations: Weather conditions. Driving styles. Technicalities that it claimed the researchers and regulators did not
understand. “There was always some story, some reason they’d come up with each time,” Mr. Young said. “Meeting after meeting, they would try to explain it away, and we’d go back to the lab and try again. But we’d get the same results.”

The back-and-forth lasted for months. Finally, in April, Volkswagen made an offer: It would conduct a voluntary recall, or service campaign, to fix the problem in certain model year 2010 to 2014 diesel vehicles.

Regulators got the software update for their test vehicles and returned to the lab. The results were not good. “It didn’t solve the problem,” Mr. Young said.
Confronted again, Volkswagen continued to maintain that there was a problem with the testers, not the vehicles…

“It was the repeated answers that did not add up that really led to the discovery of the problem in the first place,” Mr. Young said. “They were kind of hoisted on their own petard.”

The revelations were so stunning that some executives at Volkswagen Group of America were kept in the dark about the pending E.P.A. violation until just before it was announced, according to two people familiar with the situation who spoke on condition of anonymity.

Another article outlines the risks and difficulties of protecting the complex software running vehicles. Even so, we are aware of “Conspiracy Theories” claiming that surprising, untimely plane, and more to the point here, car accidents, that could have been caused by the rigging of car computers. Even in the face of individuals with obvious motivation. Without investigation, we cannot prove the rigging of software, even without such proof after an investigation its difficult to be certain, since you cannot prove a negative. Yet, without an investigation, we are left with the old adage, “Where there is smoke there is fire” now, “When their is no transparent investigation, there is suspicion.

Complex Car Software Becomes the Weak Spot Under the Hood <read>

And for those skeptical of a cover-up and a partially known problem: From the Hartford Courant News Briefing this morning:

VW was told of fake emissions years ago

BERLIN — German media reported Sunday that Volkswagen was warned years ago about the use of illegal tricks to defeat emissions tests.

German weekly Bild am Sonntag reported that VW’s internal investigation found a 2007 letter from parts supplier Bosch warning Volkswagen not to use the software during regular operation. Separately, the Frankfurter Allgemeine Sonntagszeitung reported that a VW technician raised concerns about illegal practices in 2011.

For a summary of the analogy and application of similar risks to voting, see this post by Barbara Simons at the Verified Voting Blog <read>

And from Bruce Schneier <read>

My worry is that some corporate executives won’t interpret the VW story as a cautionary tale involving just punishments for a bad mistake but will see it instead as a demonstration that you can get away with something like that for six years.

“Who Could Have Imagined” System rigged to make tests look good.

Over the years, we an others have pointed out that voting systems cannot be tested to assure performance before an election. Not the system itself before it is setup/programmed for a particular election. Not a setup and programmed system either. Not even if a system is completely secured and is somehow proven to run approved/certified software.

Here is some proof, not from a voting system – from a crime by an automaker. In this case it only puts the environment and lives in danger, rather than Democracy.

Here is some proof, not from a voting system – from a crime by an automaker. In this case it only puts the environment and lives in danger, rather than Democracy. Jeremy Epstein explains the analogy at Freedom To Tinker: <read>

In particular, computer scientists have noted that clever (that is, malicious) software in a voting machine could behave “correctly” when it detects that L&A testing is occurring, and revert to its improper behavior when L&A testing is complete. Such software could be introduced anywhere along the supply chain – by the vendor of the voting system, by someone in an elections office, or by an intruder who installs malware in voting systems without the knowledge of the vendor or elections office. It really doesn’t matter who installs it – just that the capability is possible.

It’s not all that hard to write software that detects whether a given use is for L&A or a real election. L&A testing frequently follows patterns, such as its use on dates other than the first Tuesday in November, or by patterns such as three Democratic votes, followed by two Republican votes, followed by one write-in vote, followed by closing the election. And the malicious software doesn’t need to decide a priori if a given series of votes is L&A or a real election – it can make the decision when the election is closed down, and erase any evidence of the real votes.

Such concerns have generally been dismissed in the debate about voting system security.

Read the entire post for more of the convincing details.

Of course voting machines are not autos. Unfortunately, voting machines are more vulnerable; Voting machines are not subject independent testing by trained professionals; Voting machines are not under lock and key by those who are hurt in general by pollution. Voting machines are not under lock and key by those likely to be impacted by declining value in their now illegal or poor performing vehicles. Voting machines are certified by those in the employ of the vendors, tested before election days by amateurs, responsible for their safekeeping. Some of those amateurs may actually have the motive and opportunity to fix results and cover up errors.

The solution when it comes to elections is voter verified paper ballots, sufficient ballot security, sufficient independent audits, and recounts (aka Evidence Based Elections).

Larry Wilkerson on Computerized Elections

Are Larry Wilkerson’s concerns justified? Without sufficient audits and recounts, we can never be certain. As he tells us, history tends toward cheating whenever it is possible.

Our position is that paper ballots and optical scanning followed by sufficient security, audits, and recounts is the optimum system available. Yet, in Connecticut we need stronger security, audits, and recounts to achieve justified integrity and confidence in our elections.

Are Larry Wilkerson’s concerns justified? Without sufficient audits and recounts, we can never be certain. As he tells us, history tends toward cheating whenever it is possible.

NonScience Nonsense, another claim of electronic voting security

In late June a respected source published a non-peer-reviewed article: The case for election technology Which despite its title is actually a marketing piece disguised as science, not for election technology but for electronic voting, including Internet voting. The case actually made is for skepticism and peer-review.

That skepticism is well addressed in posts by Jeremy Epstein and E. John Sebes: How not to measure security and A Hacked Case For Election Technology

In late June a respected source published a non-peer-reviewed article: The case for election technology <read>. Which despite its title is actually a marketing piece disguised as science, not for election technology but for electronic voting, including Internet voting. The case actually made is for skepticism and peer-review.

That skepticism is well addressed in posts by Jeremy Epstein and E. John Sebes: How not to measure security <read> and A Hacked Case For Election Technology <read>

From Epstein:

But the most outrageous statement in the article is this:

The important thing is that, when all of these methods [for providing voting system security] are combined, it becomes possible to calculate with mathematical precision the probability of the system being hacked in the available time, because an election usually happens in a few hours or at the most over a few days. (For example, for one of our average customers, the probability was 1×10-19. That is a point followed by 19 [sic] zeros and then 1). The probability is lower than that of a meteor hitting the earth and wiping us all out in the next few years—approximately 1×10-7 (Chemical Industry Education Centre, Risk-Ed n.d.)—hence it seems reasonable to use the term ‘unhackable’, to the chagrin of the purists and to my pleasure.

As noted previously, we don’t know how to measure much of anything in security, and we’re even less capable of measuring the results of combining technologies together (which sometimes makes things more secure, and other times less secure). The claim that putting multiple security measures together gives risk probabilities with “mathematical precision” is ludicrous. And calling any system “unhackable” is just ridiculous, as Oracle discovered some years ago when the marketing department claimed their products were “unhackable”. (For the record, my colleagues in engineering at Oracle said they were aghast at the slogan.)

As Ron Rivest said at a CITP symposium, if voting vendors have “solved the Internet security and cybersecurity problem, what are they doing implementing voting systems? They should be working with the Department of Defense or financial industry. These are not solved problems there.” If Smartmatic has a method for obtaining and measuring security with “mathematical precision” at the level of 1019, they should be selling trillions of dollars in technology or expertise to every company on the planet, and putting everyone else out of business.

We would add that just because an election happens over a short period is not a reason to claim any increased level of security or reduced vulnerability:

Programming election systems occurs months and weeks ahead of the election. Systems are vulnerable for their whole life up to and including each election. Its like saying air traffic control systems are not vulnerable to errors because directing each airplane occurs over a very short period of time in each control center. Of course that never happens.
And the rush to provide results quickly, all including the work of tired, lightly trained, technically challenged, and often partisan officials increases the vulnerability.
And the very suggestion of less vulnerability actually can have the effect of reducing vigilance, and increasing risk.

From Sebes:

I also disagree with most of Mugica’s comparisons between eVoting and paper voting because from a U.S. perspective (and I admit this review is all from a U.S.-centric viewpoint) it’s comparing the wrong two things: paperless eVoting verses hand-marked hand-counted paper ballots. It ignores the actual systems that are the most widely used for election integrity in the U.S.

Now, perhaps Mugica’s argument is for eVoting more broadly, without insisting on the paperless part. But in that case, most of America already has some form of eVoting, using voting machines and paper ballots or records, coupled with some form of paper ballot audit to detect malfunctioning machines. In that case, you don’t need to claim mythical security properties along with implied mythical perfect performance. If some equipment doesn’t work right – whether from hacks or good old fashioned software bugs – the audit can detect and correct the results.

1. The Article Misses the Point

This paper completely misses the point that it is not paper-voting vs. electronic-voting, but rather that each is insufficient. In reality, transparent (in technology and process), accurate, secure, and verifiable elections require a combination of people + paper + process + computers, each cross-checking the other. The majority of U.S. election officials now commonly understand this as the norm. Either that, or the author assumes that eVoting includes support for ballot audit (more below), and is arguing against paper-only hand-count elections—a practice that is no longer relevant in the U.S.

2. The Article Ignores Common U.S. Election Practices

“The security of a paper-based, manual vote with a manual count is extremely low. Single copies of each vote make them easy to tamper with or destroy.”

True, but only for the most procedurally simple methods of conducting hand counts or hand audits. Just last week, the state of Wisconsin conducted a public manual ballot audit that was a model of transparency and integrity.

Security is not the main issue for either hand count or machine count. Accuracy is.

We have long held that optical scan, including strong ballot security, sufficient audits and recounts is the best available system today.

Online Voter Registration: Vulnerable too!

An independent report by the state auditor general found Florida’s voter registration database flawed.

Susanna Randolph, one of the candidates running for Alan Grayson’s 9th district congressional seat, sent a letter today asking Attorney General Loretta Lynch to launch a Department of Justice probe into the state’s voter system.

Report from Florida station, WMFE: Randolph Calls on DOJ Probe into Florida’s Voter Registration System <read>

An independent report by the state auditor general found Florida’s voter registration database flawed.

Susanna Randolph, one of the candidates running for Alan Grayson’s 9th district congressional seat, sent a letter today asking Attorney General Loretta Lynch to launch a Department of Justice probe into the state’s voter system. The request comes less than one month after an independent report by the state auditor general found flaws with the nine-year-old registration database.

The audit found the system at risk of a security breach, citing unauthorized access to voter data by Department of State employees. It also labeled the system overdue for upgrades and a disaster recovery plan evaluation.

Department of State officials said they have changed the system’s software and plan to train staff before voters prepare to cast their ballots in the 2016 elections.

This is one of several ways of hacking a voting system. Records could be altered, deleted, the system taken down, or simply fail. As we said, last month:

Just this week we understand that the Connecticut voter registration system was down for a day – a day when registrars were attempting to print party voter lists on the last legal day for party caucuses. This year the Legislature said that same system could be used for voters to register during Election Day Registration (EDR) – if we got used to relying on that system and it failed on its own or with a little help from hackers – in a large turnout election, it could result in long lines and turned away/turned off voters!

Unfortunately, we took a shot that was pretty close last month!

Last month, after a report of drone hacking, I speculated wildly, according to some:

My concern is that if cars can be hacked, why not police vehicles, especially, those armored military vehicles now in the hands of our local police?

“>Its even worse than we thought. A couple demonstrate graphically the hacking and controlling of a sniper rifle.

Last month, after a report of drone hacking, I speculated wildly, according to some:

My concern is that if cars can be hacked, why not police vehicles, especially, those armored military vehicles now in the hands of our local police?

“>Its even worse than we thought. A couple demonstrate graphically the hacking and controlling of a sniper rifle.

Top Six Ways Hackers Could (have) Disrupt(ed) an Election

The election system is particularly vulnerable because it involves a combination of state, local, and federal government agencies with their own systems, software, hardware, and security protocols. Often, government departments are running old “legacy” computer systems that are extremely vulnerable to malware and hacking; and even if they have new systems, these are often put into place without a comprehensive security audit and performance review.

Who exactly is in charge of securing these overlapping networks isn’t always clear in government either.

From the Huffington Post: Top Six Ways Hackers Could Disrupt an Election <read>

Our own headline emphasizes that we have no reason to believe that these risks only apply to future elections. There is no reason to believe that some or all have not been used in past elections. From the article:

Hacking just a few electoral districts could allow an attacker to swing an election in a close race. The U.S. has had close elections multiple times in the past. In 1960, John F. Kennedy squeaked out a victory over Richard Nixon by just 0.1%. In the 2000 presidential election, the decision came down to just a few votes in Florida. In the end, the Supreme Court had to determine the winner.

The election system is particularly vulnerable because it involves a combination of state, local, and federal government agencies with their own systems, software, hardware, and security protocols. Often, government departments are running old “legacy” computer systems that are extremely vulnerable to malware and hacking; and even if they have new systems, these are often put into place without a comprehensive security audit and performance review.

Who exactly is in charge of securing these overlapping networks isn’t always clear in government either…

According to Verizon’s 2015 Data Breach Investigations report, the public sector has the highest rate of “crimeware” infections of any industry sector…

If foreign governments can hack into U.S. government and defense systems, why would anyone think that foreign interests couldn’t also hack into U.S. elections? It’s important that we start talking about these risks because a “hack attack” could happen sooner than we think. Fixing this won’t be easy which is why we need to start preparing/safeguarding now!

The author lists his top six risks:

Hack a voting machine
Shut down the voting system or election agencies
Delete or change election records
Hijack a candidate’s website
Doxing a candidate
Target campaign donors

Just this week we understand that the Connecticut voter registration system was down for a day – a day when registrars were attempting to print party voter lists on the last legal day for party caucuses. This year the Legislature said that same system could be used for voters to register during Election Day Registration (EDR) – if we got used to relying on that system and it failed on its own or with a little help from hackers – in a large turnout election, it could result in long lines and turned away/turned off voters! In fact, that system is used today by officials on election day for EDR and for checking voter registrations when issues arise with the lists in pollbooks.

Another potential hack not mentioned would be attacking a local elections website. A hacker could change polling place locations, switch polling places and streets between polling places. Or simply knock out the web, preventing voters from obtaining polling place information on election day.

Of course, all these risks also apply, even more strongly to Internet voting where there are no paper backups to survive system failures, for audits, and for recounts.

“Security online today, is not up to the task of online voting today.”

My friend, Duncan Buell, sent along a .pdf with a blog post of his, Computer Security and the Risks of Online Voting, along with another blog post about drones Meet A.I. Joe

My friend, Duncan Buell, sent along a .pdf with a blog post of his, Computer Security and the Risks of Online Voting, along with another blog post about drones Meet A.I. Joe <read>

They are both worth reading and contemplating. Duncan’s focus is on the unique responsibility of computer scientists to warn the World of the dangers of Internet/Online voting. It is also a quick, high-level introduction to the relevant history and arguments:

many election officials around the country and around the world seem enchanted with the marketing hype of Internet voting software vendors and are buying in to the notion that we could—and should—vote online now and in the very near future.
Never mind the almost-daily reports of data breaches of financial organizations with deep pockets to spend on securing their computers. Never mind that governments, with shallower pockets, are routinely hacked…Election officials seem in awe of ill-defined vendor terms like “military-grade encryption.”…
Many U.S. states are toying with the notion of online voting, contracting their elections to private companies whose code has never been given a public vetting. As scientists, we would all probably rather be doing science than trying to find ways to convince the public and election officials that security online today is not up to the task of voting online today.

The second article highlights a risk similar to one that I have been contemplating myself, the take over of drones by opposing forces. In short we could fund and provide an enemy, including terrorists the power to defeat, kill, and terrorize us:

Even worse, can robots be hacked? The Iranians claim to have hacked an American drone and brought it down safely on their territory back in 2011.However it happened, they have it, and refused to return it when President Obama somewhat cheekily asked for it back. This incident should prompt us to consider the question: What if robots could be taken over and turned on their masters?

My concern is that if cars can be hacked, why not police vehicles, especially, those armored military vehicles now in the hands of our local police?

The Power of Partnership: Do you know what your election officials have been watching?

Direct from the Dominion web, a marketing video featuring Denver election officials.services from Dominion.

We recommend caution for election officials, along with concern and skepticism for voters and taxpayers.

https://www.youtube.com/watch?v=Zyqg-LcAkC0
Direct from the Dominion web, a marketing video featuring Denver election officials. The apparently intended message from the officials is “See how great we are. See all the great things we are doing for you voters, with your money.” The apparently intended message from Dominion is “See how happy we can make officials. We can make you look good for your voters too. If you play with us we will promote you.”

Yet, I hope the questions raised for voters in Denver and elsewhere are:

Where are the testimonials from happy voters or average voters recruited to test and provide feedback on the human factors.
Where are the evaluations from independent security experts, election integrity experts, and human factors experts?
Did wining and dining of officials have anything to do with the product selection or supper happy evaluation?
How much did this system cost or save for Denver?
Should voters question the integrity of this or any other future purchase of equipment and services from Dominion?

Reminds us of those travel promotion ads featuring Connecticut Governors that somehow tend to be shown during election season, touting the benefits of vacationing in Connecticut to residents of Connecticut. Or those register and vote billboards in that same season prominently featuring the Secretary of the State.

We recommend caution for election officials, along with concern and skepticism for voters and taxpayers.