Electronic Vulnerability | CTVotersCount.org

Aging Voting Machines Sitting Rusts for Hacking

Over the last few years, we have provided many posts on the real risks of Internet voting. A new report and article highlighting that report, remind us all of the risks of voting machines in use several years ago: Hack the vote: Cyber experts say ballot machines easy targets

Reminder: We are still using those machines.

Voter fraud is nearly as old as elections themselves, and different states and precincts use different voting systems and machines. But in many cases, even the electronic ballots could be manipulated remotely, according to a new report by the Commonwealth Security and Risk Management for the Virginia Information Technologies Agency. That report found that the AVS WINVote machines Virginia has used since 2002 have such flimsy security that an amateur hacker could change votes from outside a polling location.

“This means anyone could have broken into the machines from the parking lot,” said Cris Thomas, a strategist with the Columbia, Md.-based Tenable Network Security, one of the nation’s leading cyber and enterprise security firms. “…

“Anyone who thinks that there are not folks out there – from lone hackers to foreign governments – who are willing to exploit the security vulnerabilities of our election system is living in a fantasy world,” said [Hans] von Spakovsky…
[Chris] Thomas said. Manufacturers are not sufficiently testing systems before selling them to municipalities, often using off-the-shelf hardware and software with minimal security; and local government certification agencies seldom have the time, resources or knowledge to properly test machines for vulnerabilities and often just accept the manufacturer’s claims for security…

Too Reliable Computers: A threat to life and to democracy!

Most people are aware of the risks of unreliable computers, yet tend to be oblivious to the distinct risk of too reliable computers. If computers were as unreliable as people, we would not be at risk of excess trust and overconfidence.

One particular anecdote from lasts night’s Newshour highlights the risks of computers that are too reliable, yet not perfect. When it comes to medicine (or robotic weapons) too reliable computers can cause harm, including death. When it comes elections too reliable computers can kill democracy.

This week the Newshour is covering Artificial Intelligence, a subject first covered in the McNeil-Lehrer Report in 1985, if I recall correctly. Last night’s segment was Why We’re Teaching Computers to Diagnose Cancer <read/video>

Here is the critical excerpt:

DR. ROBERT WACHTER: A lot of medicine kind of lives in that middle ground, where it’s really messy. And someone comes in to see me and they have a set of complaints and physical exam findings all that. And it could be — if you look it up in a computer, it could be some weird — it could be the Bubonic plague, but it probably is the flu.

HARI SREENIVASAN: Wachter is also concerned about fatal implications that can result from an over-reliance on computers. In his book, he writes about a teenage patient at his own hospital who barely survived after he was given 39 times the amount of antibiotics he should have received.

DR. ROBERT WACHTER: So, in two different cases, the computers threw up alerts on the computer screen that said, this is an overdose. But the alert for a 39-fold overdose and the alert for a 1 percent overdose looked exactly the same. And the doctors clicked out of it. The pharmacists clicked out of it. Why? Because they get thousands of alerts a day, and they have learned to just pay no attention to the alerts.

Where the people are relegated to being monitors of a computer system that’s right most of the time, the problem is, periodically, the computer system will be wrong. And the question is, are the people still engaged or are they now asleep at the switch because the computers are so good?

There are several related problems all contributing to increase the risk of too reliable computers:

High Reliability: Most of the time the computers are more accurate than people, especially when the people are unsure of the diagnosis or remedy.
Irrational Trust: The people are told and correctly believe the machine is more reliable than they are, especially when they are unsure or outside their expertise. Its likely our nature instilled by evolution to trust what has proven accurate. Its only irrational when the trust exceeds the risk. People are good at estimating accuracy, but not so good at intuiting the risks of lower probability events. We have biases for irrational fear and irrational trust, both can be costly, yet in different ways.
Mesmerization: We get jaded or used to things going a particular way and miss the details that may indicate something is different. Here it is medical staff used to seeing irrelevant or low level warnings, missing the implications of a similar significant risk. Airline pilots, railroad engineers, drivers, doctors, and dentists among many others are subject to Mesmerization.

Another similar situation is too great a trust in vehicle electronics. Either a manufacturer relying on electronics to always apply the break or accelerator correctly when the pedal is pushed, or people trusting that car computers always work as designed and tested, with no danger of being hacked.

How does this apply by analogy to elections and too reliable voting machines?

It seems that almost everyone trusts electronic voting machines. We are used, for the most part, to computers working when they seem to work. When we use a spreadsheet we tend to assume it is working properly. Yet, beyond the chance of error in the spreadsheet software, we tend to trust the formulas put into spreadsheets by people. Even though we are flawed individuals,we tend to forget that equally flawed individuals (even ourselves) may have made a simple error in creating formulas e.g. adding up only some of the numbers, double counting others, or made a “small, harmless” change after testing the spreadsheet.

Election officials tend to have trust in voting machines. They are told that all types of voting machines or online voting machines are created by very smart people and include certification and “military grade” security. Yet, we are given no effective proof of those claims and typical officials are not able to judge such proofs. Officials see reports of tests and post-election audits that claim the machines are flawless, increasing their trust in the machines. Typically if they count ballots by hand and they do not match the machine counts, they count again and usually the machine was accurate.

On the other hand, those that are familiar with election equipment, computers and computer science know:

No computer or software can ever be proven error free. In fact, most, even modestly complex, software is very likely to have multiple undetected bugs.
It has not happened often, but computers and computer systems have counted incorrectly. Including in CA, FL, N.J., D.C., and in Connecticut.
Without paper ballots and effective post-election audits there is no reason to trust that machines count accurately, or to know how often they do not.
Machines are programmed for each election and voting district, so errors can be introduced into the system at any time.
Beyond errors, insiders have multiple means of changing election results. Often a single individual insider can change results alone or with the help or by the intimidation of outsiders.
A voting machine can be entirely accurate, yet its results or the total result can be changed independently of the voting machine. Unless the results are audited end-to-end or in each step of the process, the result cannot be legitimately trusted.

What about Connecticut?

We have post-election audits, but they are not conducted in a manner that gives justified confidence. Errors in machine results have been detected, yet most differences between machine results and manual audits have been accepted as a human counting error without investigation. This makes common sense since usually when results are checked the human was wrong the first time – common sense that is at least as risky and unjustified as the unjustified trust in medical artificial intelligence directives in the Newshour story above.
Connecticut is considering legislating Machine Audits, based on procedures to be approved by the Secretary of the State. Common sense supports a method demonstrated by UConn and the Secretary of the State’s office and touted in a paper presented at a conference – unjustified common sense. There is no scientific justification for that method demonstrated, and worse, every reason to believe that it would be subject to unjustified official trust in computers and mesmirization. Professor Alex Shvartsman of UConn has agreed that the procedures is insufficient to provide public verification.

Fortunately, there is a very effective solution available. We have proposed a sound method of Machine Assisted Audits based on proven scientific methods. Using Machine Assisted Audits in an effective manner could result in more accurate, trusted audits at less cost and stress to local election officials. If machine audits become law, we will work to insist on effective transparent and publicly verifiable procedures are employed. (Still, we would much prefer a law that mandated sufficient requirements now, that could not be weakened by a future Secretary of the State) <read more in our comments on the bill before the Connecticut General Assembly>

Elections and Voting Summit Joseph Kiniry: Technical Tradeoffs

Last January I attended the annual Elections and Voting Summit. I was most interested in a presentation by Joseph Kiniry on Technical Trade0ffs. It is a relatively brief presentation, with some important thoughts: Online voting convenience vs. risks, transparent systems vs. proprietary rights etc.

Last January I attended the annual Elections and Voting Summit. I was most interested in a presentation by Joseph Kiniry on Technical Trade0ffs. It is a relatively brief presentation, with some important deep ideas: Online voting convenience vs. risks, transparent systems vs. proprietary rights, etc.

Internet Voting Roundup: At the Not-OK Corral

Texas likes to do things big. But when it comes to Internet voting it is as they say “All hat and no cattle”.

We always tend to side with science and the best independent expert analysis, and tend to be skeptical of vendors seeking profit and officials looking for the easy way to look good.

Texas likes to do things big. But when it comes to Internet voting it is as they say “All hat and no cattle”. As reported in Election Line Bexar County successfully tests email ballots for military members<read>

Under a bill approved by the Texas Legislature, in 2014 Callanen was allowed to not only email ballots to service members, but she was also able to accept voted ballots via email from military members serving in hostile fire zones.

According to a report from the secretary of state’s office, the pilot program in Bexar was a success even if the numbers were small. In the May 2014 primary the county received three ballots via email and in the November 2014 general election eight ballots were returned via email.

Service members must first sign an affidavit confirming that they are indeed in a hostile fire zone. Then they are assigned a one-time use secure email address, are sent their ballot, allowed to vote it and return it to the county.

Three ballots, eight ballots pretty slim test an not much success to fill much of a hat. We point out that there is not much to a “secure email address” unless those service members use some very very strong and difficult encryption methods along with the county. Others wonder how that email address was sent to those service members – Was it through some secure email address developed by the service member? Perhaps they could help out Sony, whose email was allegedly hacked by North Korea, and with those same emails provided for all to see at Wikileaks. We wonder how much did such security such cost to develop our purchase? – we will learn this a bit later.

“It took a lot of push and shove,” Callanen said “[Because] the presumption was that it was so close to Internet voting. We had to make sure it was absolutely secure.”

That seems to be a pretty common error – that emails are somehow sent without the Internet or somehow do not constitute Internet voting. Emails use the Internet and if anything are less secure that online voting. Perhaps because, in addition to compromise in transit, they are easily and often, must be, seen by people – local election officials:

The county has a dedicated computer set up in the tabulation room to receive the ballots. Only three people in the office, all who have also signed sworn affidavits, including Callanen, have access to the computer. Once received, the ballot is remade onto an optical scan ballot, put in a secrecy envelope and treated like any other ballot.

And apparently that “secure email” came at very little cost and effort:

“We did this on a thin dime,” Callanen said. “Sure it takes some time to have the computer people set up the emails, but we’ve gone from mailing thousands of ballots to emailing them.”

We can be sure it works because they did an apparently confidential (secure?) survey that proved how wonderful it was. They actually claim about 1400% a response rate from the small base of users, supposedly in combat zones:

Following the elections, Callanen surveyed the service members using Survey Monkey to find out how they felt about the process and got back more responses to the survey — 117 — than they did ballots.

“The general response was that it’s wonderful,” Callanen said. “I wish you could see the raw, unedited comments we got.”

Obviously they did not use a secure email to send the survey to the actual users.

Meanwhile, just how secure is Internet/Email voting? Some good and not so good news from McClachyDC: As states warm to online voting, experts warn of trouble ahead <read>

The not so good news and some good news:

A Pentagon official sat before a committee of the Washington State Legislature in January and declared that the U.S. military supported a bill that would allow voters in the state to cast election ballots via email or fax without having to certify their identities.

Military liaison Mark San Souci’s brief testimony was stunning because it directly contradicted the Pentagon’s previously stated position on online voting:

It’s against it.

Along with Congress, the Defense Department has heeded warnings over the past decade from cybersecurity experts that no Internet voting system can effectively block hackers from tampering with election results.

And email and fax transmissions are the most vulnerable of all, according to experts, including officials at the National Institute of Standards and Technology, which is part of the Commerce Department.

San Souci declined to comment. A Pentagon spokesman, Lt. Cmdr. Nathan Christensen, said the Defense Department “does not advocate for the electronic transmission of any voted ballot, whether it be by fax, email or via the Internet.”

The Washington state legislation is dead for this year. But the episode provides a window into how the voting industry, with an occasional boost from the Pentagon, is succeeding in selling state and local officials on the new technology, despite predictions of likely security breaches.

It’s also put state lawmakers and election officials at odds with their counterparts in the other Washington: the nation’s capital…

Susannah Goodman, director of a voting integrity project for the citizens’ lobby Common Cause, worries that many state officials lack the technical expertise to avoid being manipulated by the vendors.

“I’ve seen the vendors characterize their products as being secure when the most prominent cybersecurity experts in the country will tell you they’re not,” she said. “The state legislators and the election officials are only hearing from one side. . . . That’s putting our democracy at risk.”

For example, election officials in Washington’s Pierce and King counties, which include the Tacoma and Seattle metro areas, offer voters the option of faxing or emailing ballots. They said the process was not online voting – even though emails travel over the Internet.

We always tend to side with science and the best independent expert analysis, and tend to be skeptical of vendors seeking profit and officials looking for the easy way to look good.

S.B. 1051: Too much, too little, too risky

Last week the Government Administration and Elections Committee passed a modified version of S.B. 1051, hailed by the Secretary of the State and ROVAC (Registrars Of Voters Association of Connecticut) as a ‘bipartisan’ compromise.

Yet, all the compromising seems to be the agreement of election officials on a bill that would make registrars jobs easier while adding largely undefined and unchecked powers for the current and future Secretaries of the State.

Two members of the Republican minority voted against the bill primarily because it would give the Secretary sole authority decide to temporarily remove registrars from office for any complaint filed by the Secretary or failing to maintain certification. We agree it goes too far in that provision. It should and does provide a more objective means for permanently removing registrars. We fail to see where a provision for the Secretary to temporarily remove registrars would have solved the recent problems noticed in the heat of election days. If that were the only weak and risky provision we might be able to live with the bill and some of its helpful provisions.

We are all in favor of effective training, certification, and fair procedures for removing registrars from office. The bill has what we suspect will turn out to be relatively weak certification requirements and an alternate procedure for removal by charges from the state’s attorney and any superior court judge. Even that seems to be a bit weak, requiring only a single judge to rule on removing an elected official from office. Consider:

Their is an ‘advisory’ committee to create certification. In the existing law, never implemented, the committee was not advisory. Now the current or future Secretary of the State approves the certification program.
The committee consists of six members, five appointed by the Secretary.
Decertifying a registrar does take concurrence of a majority of the committee.
Strengthening the existing law, sitting registrars must be certified within two years of taking office, except perhaps untended, the law requires registrars who are appointed to fill the remainder of two-year terms to complete certification by the end of the term.
We can hope that the actual certification, examination, and continuing education result in relevant, meaningful requirements.

We support professionalization. Certification in election matters is only part of that. Additional skills, education, and experience also play a part. We are skeptical that without increased compensation that many highly skilled, organized, and experienced individuals will be attracted to the jobs in small towns. We wonder how much certification would have prevented the problems seen in recent years in Hartford, West Hartford, and Bridgeport. We support professionalization through regionialization. That might be the result of another bill passed by the committee, S.B. 1083.

There are other risky, insufficiently defined provisions in the bill associated with closing of the polls and reporting results:

One requires quicker reporting of partial results “Once completed, the vote totals produced by the tabulator shall be prepared for transmission to the Secretary of the State”.
This is ambiguous. Yet, according to the Secretary’s testimony on the bill, it seems that the intention is to transmit the results from optical scanners to the central GEMs system for automated calculation of results.
To connect our optical scanners to the GEMS requires reversing longstanding security policy implemented by the Bysiewicz administration to keep the scanners sealed from communication that risks infecting the scanners with fraudulent code.
We add that the GEMS system is no gem. It figured prominently in the reporting errors discovered in the Humboldt Project. We also recall Bev Harris demonstrating to Howard Dean how easy it would be for him to change election results on the GEMS, undetected.
Maybe it will turn out OK. Once again, we are left to hope that in the end, this Secretary and all future secretaries work to maintain security of the scanners, memory cards, and their programming.

Further, the bill gives officials 48 hours after the election to report the rest of the results: hand counted ballots, write-in ballots, and for checkers to sign the pollbooks.

We are all for giving officials time to get thing right. Especially in situations like Bridgeport in 2010 where there are huge numbers of unexpected ballots to count by hand. We wish the media could hold off the pressure for “results, any results”.
Yet, these changes seem to lack any security and transparency requirements. If counting is stopped to continue later, we need convincing, sufficient, enforceable, and enforced security for ballots and checkin lists. We need formal requirements for notification of the public of when counting will resume.
When it comes to checkin lists, we see no point in not having checkers total and sign the lists at the polling place on election night — except it they are using electronic pollbooks and the lists are not printed until later by someone else — then we see nt good reason to have them sign printed paper lists that they have not created, from a system they do not understand, and have not held in custody. Perhaps they or the polling place moderator should have a form to record the number of voters the machine reports as having checked in – signed and submitted on election night.

Finally, we come to electronic auditing. The bill has this provision near the end:

Notwithstanding any provision of title 9 of the general statutes, the Secretary of the State, in consultation and coordination with The University of Connecticut, may authorize the use of electronic equipment for the purpose of conducting any audit required pursuant to section-320f of the general statutes, as amended by this act, for any primary or general election held on or after January 1, 2016, provided (1) the Secretary of the State prescribes specifications for (A) the testing, set-up and operation of such equipment, and (B) the training of election officials in the use of such equipment; and (2) the Secretary of the State and The University of Connecticut agree that such equipment is sufficient in quantity to accommodate the total number of audits to be conducted. Nothing in this section shall preclude any candidate or elector from seeking additional remedies pursuant to chapter 149 of the general statutes as a result of any information revealed by such process.

As readers of CTVotersCount know, we have long been supporters of machine assisted auditing. We are here left to hope that the Secretary and UConn do the right thing i.e. support a method of auditing that is transparent and meets the requirements of evidence based elections, such that the public can verify the results of the audit without depending on officials. How is that possible? It has been outlined by three leading experts in the field of election auditing and prototyped in CA and CO.

In fact, we provided a bill which included a provision for safe machine assisted auditing this year, S.B. 1041. Even though that bill received wide support and no opposition in testimony, it did not move forward.

If S.B. 1051 moves forward in its current form we are left to hope that the Secretary and UConn will use its provisions to provide safe verifiable auditing. Yet, left with the concern that they might not, and that some future Secretary and some future UConn scientist or UConn leader collude to disregard science to provide some all but useless, untrustworty version of electronic “black-box” auditing.

New South Wales wails: Researchers find flaws in Internet voting system

New South Wales, Australia is holding an election with a significant number of online votes. Researchers point out several concerns…

New South Wales, Australia is holding an election with a significant number of online votes. Researchers point out several concerns:

Votes could have been easily changed with nobody the wiser
The touted user verification has its own flaws.
The system was taken down to fix (correct) the ballot.
The source code is not disclosed, so there is no means to assess its vulnerabilities

Read the summary report and the researchers response to the response/criticisms from New South Wales officials <read>

As the summary concludes, this is not the first time flaws and risks have been exposed in Internet voting schemes:

The vulnerability to the FREAK attack [name for the particular attack mechanism demonstrated] illustrates once again why Internet Voting is hard to do securely. The system has been in development for years, but FREAK was announced only a couple of weeks before the election. Perhaps there wasn’t time to thoroughly retest the iVote system for exposure. We can bet that there are one or more major HTTPS vulnerabilities waiting to be discovered (and perhaps already known to sophisticated attackers). Verification is a vital safeguard against such unknown problems, but at best it detects problems rather than preventing them.

To election security researchers, these problems aren’t surprising. We’ve already seen dire security problems with Internet voting in Estonia and Washington, D.C. Securing Internet voting requires solving some of the hardest problems in computer security, and even the smallest mistakes can undermine the integrity of the election result. That’s why most experts agree that Internet voting cannot be adequately secured with current technology.

So you want to connect voting machines to the Internet?

60 Minutes Shows Threats to Autos and Voting Machines are Real

Among the other reform calls in Connecticut are those to “do anything to get results faster on election night – any results”. One proposal is to connect our voting machines directly to the Internet to collect results. There is a reason our voting machines are not connected to the Internet. UConn and other researchers have long pointed out the risks <October 2007 article>

60 Minutes Shows Threats to Autos and Voting Machines are Real

We need a system that does not rely on trusting the Government or the abilities of officials and pollworkers. Sometimes the risks sound crazy and too theoretical and unlikely. For several years it has been known that many vehicles can be taken over via the Internet – but not really understood at a gut level. Last week 60 Minutes demonstrated the risks to Lesley Stahl so she will never forget, and perhaps by watching her we will also understand: DARPA: Nobody’s safe on the Internet <video at 6:45 > Or watch the entire video to understand that the Defense Department is regularly attacked and how they can attack the appliances in and around your house.

If the Defense Department can’t protect itself, if auto companies can’t protect us, why would we think the State of Connecticut could protect us? Or local registrars of voters in our 169 towns?

In fact, Arthur House, Chair of our utility control agency is concerned that utilities and the State together cannot protect our power infrastructure. <here>

Yet its even worse. Not only can’t the Defense Department protect itself, the Federal Government actually makes it harder for private enterprise to protect us – in the name of “national security” they make us more vulnerable, while they also make “security theater” claims of increasing security, NYTimes: Obama Heads to Security Talks Amid Tensions <read>

President Obama will meet here on Friday with the nation’s top technologists on a host of cybersecurity issues and the threats posed by increasingly sophisticated hackers. But nowhere on the agenda is the real issue for the chief executives and tech company officials who will gather on the Stanford campus: the deepening estrangement between Silicon Valley and the government…

Now, the Obama administration’s efforts to prevent companies from greatly strengthening encryption in commercial products like Apple’s iPhone and Google’s Android phones has set off a new battle, as the companies resist government efforts to make sure police and intelligence agencies can crack the systems…

“What has struck me is the enormous degree of hostility between Silicon Valley and the government,” said Herb Lin, who spent 20 years working on cyberissues at the National
Academy of Sciences before moving to Stanford several months ago. “The relationship has been poisoned, and it’s not going to recover anytime soon.”…

The F.B.I., the intelligence agencies and David Cameron, the British prime minister, have all tried to stop Google, Apple and other companies from using encryption technology that the firms themselves cannot break into – meaning they cannot turn over emails or pictures, even if served with a court order. The firms have vociferously opposed government requests for such information as an intrusion on the privacy of their customers and a risk to their businesses.

Meanwhile in the wake of the theft of health records from Anthem, Connecticut legislators are demanding encryption for health insurers <read> We wonder if they will ask the U.S. Government to stop compromising encryption. Others are asking who is benefiting from the Anthem attack? <read>

Ambitious agenda should be reasoned and well-planned

In today’s print edition of the Courant, one in a series of editorials setting an agenda for the State, Agenda 2015: Ambitious Goals For The State, one portion focuses on elections,

We diverge from the Courant in our opinion. We continue to point out that the most comprehensive system of election administration reform would be to regionalize elections, obtaining some of the same benefits obtained by regionalizing probate.

Also, Professionalization does not include ignoring science. There is a reason we do not connect our scanners to the internet to report results.

In today’s print edition of the Hartford Courant, one in a series of editorials setting an agenda for the State, Agenda 2015: Ambitious Goals For The State, one portion focuses on elections:

Elections

Isn’t it time Connecticut’s registrars came into the 21st century? Hartford was so unprepared for Election Day that President Obama had to beg voters who had given up waiting to vote to try again.

State law should be changed to let towns and cities appoint a single trained nonpartisan registrar. The current system under which two registrars (or more) are elected for each town is expensive, wasteful, inefficient. Connecticut needs to professionalize these offices or have municipal clerks take over the job. U.S. Sen. Chris Murphy is right to call for reforming the state’s entire election system in 2015.

The state must professionalize voting too. Machines here could transmit results electronically, as in Massachusetts, but they aren’t allowed to. Instead, pages of results are hand-transcribed and faxed to the state the next day. What is this, 1992?

And can the legislature silence those irritating, intrusive political robocalls that invade households at election time? Though most unsolicited pitches are against the law, political robocalls are legal. Some states ban or restrict them. So should Connecticut.

We really have two basic problems with election administration. One predominantly in small towns and another in large towns. In smaller towns there is often a lack of sufficient funds and time for very part time registrars to keep up with the laws, requirements, and technology, and to have staff members to gain such experience to be possible replacements. In large towns there are sufficient funds and staff, yet in some there is a a lack of professional actions – apparently replaced by some incompetence and excuse making. Patronage and selecting candidates by party loyalty often contributes to the problem. Some of these same problems exist in mid-sized towns as well. It would be unfair and highly inaccurate to paint all registrars with this same brush. Most are of individuals of integrity, some in large towns are very competent or employ competent staff, many in small towns expend the efforts necessary despite low pay.

No system is perfect. There are states with effective county administrators, elected or appointed. Yet there are areas with incompetent and obviously unfairly partisan officials appointed, and elected.

Its hard to believe that registrars appointed by the Hartford or Bridgeport Council’s (or any towns) would reduce partisan action/pressure. It might work sometimes, and not work other times. That is no improvement. Registrars make important decisions effecting who is on the ballot, who runs polling places, and when to recanvass a suspicious result. In 2010 the Secretary of the State’s Office reached an agreement with the registrars in Bridgeport to audit every district after the election day debacle – the agreement was nixed by the Mayor and city attorneys. As for saving money, its the council’s that set the salaries for registrars and deputies today.

Moving elections to the clerks would be close to moving deck chairs on the Titanic. It would not solve the time and money problems for small towns. For large towns it would not change the risks of political pressure or in itself save money.

We do need more professionalism in election administration. Less partisan, more professional administration. That requires some form of education and certification, plus a career path so individuals can learn the job and make elections a career. That is why we recommend rationalization with appointed officials.

Also, Professionalization does not include ignoring science. There is a reason we do not connect our scanners to the internet to report results. The Professionals at Uconn agree with other computer scientists and security experts that connecting voting machines to the Internet or phone systems is unsafe. That is why we do not to it. In fact, Connecticut is much earlier than many other states in reporting election results. Where we need professionalism is in taking a bit more time to report more accurate, more complete results.

Connecticut not alone in election adminstration challenges

Since the election on November 4th we have had all sorts of complaints about Connecticut election administration. Claims that we are the slowest, with the most clueless election officials. And all sorts of cures proposed including more mail-in votes, electronic calculation of results, and reorganization of election administration.

We agree with that their are many problems. We agree with the general outlines of some of the cures. Yet, we caution against knee-jerk reaction, and change without planning and analysis.

We suggest looking at the best practices from other states. Yet, we can also learn from the mistakes and foibles of other states. Often those employing some of those very cures proposed for Connecticut.

We agree with that their are many problems. We agree with the general outlines of some of the cures. Yet, we caution against knee-jerk reaction, and change without planning and analysis.

Lets look at the recent news:

11/17 NJ not so quick in reporting results Using equipment from the same vendor as Connecticut, NJ has problems, delays, and investigations of slow accumulation/reporting of results electronically. Then again, some other states below reported fast, with much less accuracy than Connecticut or New Jersey.

1/25 Mail voting: Not so fast, not so easy, not so simple Take Oregon and their all-mail voting, please. A highly charged ballot question is yet to be decided. In fact they have just counted enough votes to realize they need a recount. Here is the issue, some 13,000 votes were not counted because of possible signature mismatches. So advocates contacted voters after the election to see if they actually voted and requested they come in and sign their ballot or show their signature changed.. We have some of our own issues with all this:

Just how good is their signature matching? Has anyone evaluated their methods. What are the odds they missed more questionable signatures? How many of those 13,000 should not have been questioned?
Does the result depend on which side got more voters to come in and sign (demographics can indicate how a voter might have tended to vote)
And we complain that some results in Connecticut were not available until Nov 5th?
PS: This problem will never happen in Connecticut as we never match signatures. (See no evil…)

11/25 MN lowest turn out since 1986 Many claim, anecdotally and incorrectly, that no-excuse absentee voting is a panacea for increasing turnout. Apparently, anecdotally, it has not helped Minnesota all that much.

11/25 The Maine question: Will 21 mystery ballots change looser into winner? Connecticut has problems with ballot counts not matching check-in list counts, and a greater problem with some officials not checking that those numbers match. At least in Maine there is a recognition that this might be a problem, especially if extra ballots are found after the initial count.

1/26 Electronic result totals not alwasy even close to accurate Here we go again with that electronic tallying of votes. They only missed about one-third of the votes. Fortunately, a news outlet found the error. They say the problem has been fixed, yet sounds more like the error has been corrected in the results of this one election. They are not counting accurately in Kansas any more.

How can we vote on Internet that is unsafe for banks, Canada, and alarms the President?

Recent articles highlight the folly and blind faith in technology leading many to trust voting on the Internet.

As Roosevelt said “The only thing we have to fear is fear itself.” seems to apply here.

There are real cyber risks, we need to protect or digital assets. Yet it does not help to jump to the conclusion that every breech is the work of our biggest enemy of the moment.

Like building new civic centers, baseball stadiums, and bankrolling fishing and hunting retailers there is plenty of real world evidence that Internet voting does not work well, yet we persist despite the evidence. Apparently the technology that actually works to protect Democracy, a technology actually under assault in Connecticut, is Freedom of Information.

Recent articles highlight the folly and blind faith in technology leading many to trust voting on the Internet

From the NYTimes: Obama Had Security Fears on JPMorgan Data Breach <read>

President Obama and his top national security advisers began receiving periodic briefings on the huge cyberattack at JPMorgan Chase and other financial institutions this summer, part of a new effort to keep security officials as up dated on major cyberattacks as they are on Russian incursions into Ukraine or attacks by the Islamic State.

But in the JPMorgan case, according to administration officials familiar with the briefings, who would not speak on the record about intelligence matters, no one could tell the president what he most wanted to know: What was the motive of the attack? “The question kept coming back, ‘Is this plain old theft, or is Putin retaliating?’ ” one senior official said, referring to the American led sanctions on Russia. “And the answer was: ‘We don’t know for sure.’ ”

More than three months after the first attacks were discovered, the source is still unclear and
there is no evidence any money was taken from any institution.

As Roosevelt said “The only thing we have to fear is fear itself.” seems to apply here. There are real cyber risks, we need to protect or digital assets. Yet it does not help to jump to the conclusion that every breech is the work of our biggest enemy of the moment (e.g. China last year, Putin here, and ISIS last week) when we apparently don’t have a clue.

Just as irrational is the fear in then Connecticut Legislature, (and perhaps in the statehouse) where many voted for Internet voting under the threat of being deemed “unpatriotic”.

Of course, Internet voting is not banking. Internet voting is more vulnerable, and more critical to our Democracy. As highlighted by this recent report:

From GMA News: Online voting not ready for worldwide roll-out, study concludes <read>

The research, produced by the Atlantic Council think tank and the online protection firm McAfee, concluded that “security will need to be vastly improved” before it becomes feasible to adopt Internet voting on a large scale.

According to the study, online voting faces more complex obstacles than electronic commerce, where a customer can be reimbursed in the case of fraud or theft.

“Online voting poses a much tougher problem” than e-commerce, the report said.

“Lost votes are unacceptable… and unlike paper ballots, electronic votes cannot be ‘rolled back’ or easily recounted.”

The report said hackers could paralyze an online voting system or, even worse, change the results without being detected.

A major problem of online voting is that any system must verify the identity of the voter, and at the same time guarantee anonymity in the process.

Some experts believe it could be decades before online voting becomes mainstream.
Joseph Hall of the Center for Democracy and Technology said that many security experts believe “the timeline will be 30 to 40 years” before the technological hurdles to online voting are overcome.

One of the problems is the “uncontrolled platform,” in which voting software or computers can be infected, Hall said at a discussion hosted by the Atlantic Council.

Jordi Puiggali of the online voting technology firm Scytl said that while Internet balloting has not been perfect, “we have to consider the risks of voting channels that already exist,” citing practices such as stuffed ballot boxes.

The researchers cited a study released earlier this year by University of Michigan scientists on online voting in Estonia, the first country to hold national elections on the Internet.

That study, which is to be published in a scientific journal next month, revealed vulnerabilities in Estonia’s online voting system.

“Attackers could target the election servers or voters’ clients to alter election results or undermine the legitimacy of the system,” the study said.

Estonian officials have maintained that the system is secure.

Wednesday’s report said that online voting has enormous potential if security can be improved.

“For the digital generation, unsupervised polling via mobile devices may be the ‘killer app’ of e-voting,” the report said, adding that biometric and other security features may need to be perfected.

“Broad adoption of most new technologies generally takes longer than technology optimists hope, but it will happen,” the report added.

“Online voting’s potential benefits in terms of reach, access and participation have the potential to revolutionize the democratic process around the world.”

Count us among the skeptics that Internet voting will be safe in 30-40 years. We say it is a good bet that 20 years from now it it will still be 30-40 years off, and maybe that will be the last we will hear of it. On the other hand it might be possible with a radical redesign of the underlying Internet. (Geeks like myself will remember IP 6, which we were all supposed to be using by about 10 years ago. Great news its up to 4% now.)

From Aljazera: Latest Internet voting reports show failures across the board <read>

Internet voting, a technology often cited as a solution to the United States’ problematic voting machines, received failing security and accessibility grades in the latest in-depth audit conducted by the City of Toronto. Two of the three vendors audited by the city currently have contracts with over a dozen U.S. jurisdictions for similar technologies.

The accessibility report, prepared by researchers at the Inclusive Design Research Centre at OCAD University, and the security report, prepared by researchers at Concordia and Western universities, were obtained by Al Jazeera America through a Freedom of Information Act

request.

Proponents of Internet voting, largely disabilities groups and advocates for military voters overseas, point to the apparent ease-of-use of other Internet-based activities, such as banking, and claim the technology would lead to higher turnout rates.

The reports highlight the difficulty in creating a voting system that isn’t more susceptible to corruption than existing voting technology and that is easy enough to use for voters with a variety of personal computer setups, including those with disabilities who often use alternatives to traditional mice, keyboards and screens.

Got that? Susceptible to corruption. And does not provide expected benefits. Sounds a lot like those civic center, sports stadium, and fishy retail projects! Meanwhile the U.S. Government continues to stonewall:

A nonprofit watchdog group, the Electronic Privacy Information Center, sued FVAP last month to force them to disclose their own audits of Internet voting conducted three years ago. In 2012 the program told Congress it would release the records to the public by the middle of 2013.