Category: Electronic Vulnerability

An Alternet interview of Jonathan Simon: Something Stinks When Exit Polls and Official Counts Don’t Match – A discussion with an exit poll expert reveals an electoral house of cards.  <read>

When their were claims that exit polls did not match in the Democratic Primary, I said that neither side made the case  saying, “I stand with Carl Sagan who said, “Extraordinary claims require extraordinary evidence.”

Now a very thoughtful interview with Jonathan Simon who outlines the case that we should be concerned about the exit polls and concerned just as much that we cannot verify our elections:

We try as carefully as we can. I’ve been doing this pretty steadily now for the last 15 years along with some of my colleagues, and I would be the first to acknowledge that there is a lot of smoke there and there’s a lot of probative value to this work, but that bringing it forth as ironclad proof is very problematic. So we’re stuck at a place where I pivoted to is looking at the risk involved in having a computerized, privatized, unobservable vote counting system and just taking on faith that that system is not being manipulated when there is such a obvious vulnerability (on which the experts strongly agree) of the system to malfeasance and manipulation. That is where I’ve tended to go, is to look at that risk rather than screaming fraud from the rooftops and claiming proof…

Simon goes on to refute many of the reasons raised to be skeptical of exit poll data, yet also acknowledging that without evidence, the polls could be consistently wrong. Yet, errors strongly trend in the same direction.

In this past Tuesday, again we saw a very consistent pattern of exit polls that were more in favor of Hillary Clinton, more in favor of Democratic senatorial candidates and then vote counts were shifted from the exit polls to the right towards Donald Trump, towards the Republican senate candidates. Those are the figures that I pulled down and did a very basic analysis of. You have a column of numbers of state by state showing the degree of that shift and we’ll eventually do that for the national vote for the House of Representatives as well…

What it means to me is that neither system is self validating. Neither system can be trusted. If you look at accounting, you do double entry accounting. I’m not an accountant so my terminology may be off, but you basically audit by checking one column of numbers against another column of numbers. If they disagree, you know something is wrong somewhere. There is some arithmetical mistake, some failure of entry, possibly fraud … you don’t know. You just know that if two things that are pretty much supposed to agree had disagreed, there’s a problem somewhere. I can rule out mathematically and scientifically, by this time, errors due to random chance. Errors due to random chance, sampling errors, what we call margin of error issues, would not be expressing themselves so consistently in one direction. They’d be going in both directions and they’d be much smaller…

If you want to sleep well at night, which I also prefer to denial, and you want to say to yourself, Yeah, it must have been people just lying to the exit pollsters and I’m not going to worry about it, that’s fine. What you’re missing at that point is the fact that if you challenge me to say, How do you know these exit polls are valid? I would turn right around and challenge you and say, How do you know the vote counts are valid?

The fact is, and this is cold hard fact, neither of us can prove our case. That is the problem. We have an unobservable system that cannot answer the challenge that it might be subject to manipulation. It can’t demonstrate that it is not rigged. Exit polls are just a tool that we use to look at it and say, Well folks, there might be something to dig deeper into here. The problem is virtually never is anyone allowed to dig deeper. We have optical scanner equipment all over this country right now that have the voter marked ballots that drop through the optical-scan reader device and sit in their cabinet below. Those voter marked ballots need to be saved 22 months in theory, although they’ve been destroyed early, in fact, in many cases, especially if when there was an investigation going on in Ohio…They are corporate property. They are off limits to public inspection. It might as well, in the 99.9% of cases, be a paperless touchscreen that has no record whatsoever.

The bottom line is that Democracy requires citizen engagement and action:

[Around election time concern] passes briefly in front of the public eye. There’s a lot of stirring about it and then it dies out and it’s basically left to us hardcore election integrity advocates. This is catastrophic. This is tragic. What we’re left with is a system that was accepted more or less without real proof.

If that’s what democracy is worth to us, then we deserve what we get. Democracy requires support. It requires citizen support. It requires an investment of care and an investment of vigilance and an investment of participation more than deciding, Yeah, I’m going to vote or I’m not going to vote. It requires the fulfillment of a duty to be part of the public that counts and observe the counting of the votes so we don’t have the ludicrous situation where we hand our ballots to a magician who takes them behind a curtain, you hear them shred the ballots, comes out and tells you so-and-so won. This is what we’ve got now and it’s what we’ve accepted. We spend more money in two weeks in Iraq then would cost us for 30 years to hand-count our elections. This is surrealistic, this is absurd, but it’s the very strong inertial reality. Getting the energy up to change that reality, especially when that reality has worked well by definition for everybody who is sitting in office. They’re the people with the least incentive to look under the hood and say, Hey, we need to change this. It’s what put them in office.

It is an outstanding interview.  I highly recommend reading in its entirety.

USAToday article: Could the U.S. election be hacked?  <read>

We add some annotations:  [Bottom-line there is a conspiracy in plan view.  A thinly disguised attempt to assure us that elections are not vulnerable and that any attempt to say otherwise is an attack on every pollworker.]

Fact-checking the presidential debate: Fibs and fiction [Actually the have left that to us.]

Factcheck.org’s Lori Robertson takes a look at the claims made during the second presidential debate between Hillary Clinton and Donald Trump. Find out where fact-checkers found that candidates stretched the truth.

SAN FRANCISCO — The impact of Russian hacking on the upcoming presidential election was a topic in Sunday night’s debate, raising the question: Is the U.S. election hackable? Experts say at the national level, no. But there could be individual incidents that undermine faith in the system. [We disagree.  Election systems are very vulnerable based on the California Top To Bottom Review and the Ohio EVEREST report. Nobody should be considered an expert who ignores those reports. Actually so called “experts” denying the risks are thinly disguised attempts to create blind faith in the system.]

There’s almost no danger the U.S. presidential election could be affected by hackers. It’s simply too decentralized and for the most part too offline to be threatened, according to the head of the FBI and several security experts. [Decentralization means it would indeed be a challenge to hack every polling place and central count location in the country, yet that is a strawman argument, it is not necessary.  Only hacking a few jurisdictions in a small number of swing states is all it would take. See Ohio 2004 and Florida 2000. Offline is a good practice, yet that is insufficient for two reasons:  First, insiders can do all manner of hacks with our without connectivity. Motivated governments can and do find ways to hack systems without connectivity, see STUXNET.]

“National elections are conducted at the local level by local officials on equipment that they obtained locally,” so there’s no single point of vulnerability to tampering here, said Pamela Smith, president of Verified Voting, a non-partisan, non-profit organization that advocates for elections accuracy. [Most voting equipment is obtained from two our three vendors nationwide. Most officials have blind trust in their entire staffs, that is a formula allowing one or several individuals to hack a jurisdiction. Security of election equipment and voted ballots varies.  In many jurisdictions and whole states, such as Connecticut and New Jersey, machine and ballot security is very weak.]

In testimony before the House Judiciary Committee last month, FBI Director James Comey said that while concern has been rightly focused on the integrity of state voter registration systems, the actual voting process remains “very, very hard to hack into because it is so clunky and dispersed.’’ [We should be concerned with voter registration systems.  We should equally be concerned with voting systems and the systems which are used to total results for polling places, central count, jurisdiction accounting, and statewide accounting.]

“It is Mary and Fred putting a machine under the basketball hoop at the gym,’’ Comey said. “These things are not connected to the Internet.’’ [This is an attempt to say we are challenging the integrity of each  of the Mary and Fred’s who work in elections.  [Actually it is quite a leap to believe that each every pollworker and elected official is of high integrity.  Some have gone to jail for their activities. As a class we see no reason to agree that election officials that legislators, mayors, governors, and other public officials.  In Connecticut we have seen many punished for violating the public trust.]

Nevertheless, Comey said federal authorities have been counseling state officials to secure their systems, especially voter registration databases, as hackers have continued to “scan’’ the systems for vulnerabilities.

High stakes rhetoric

In Sunday’s debate, Democratic presidential candidate Hillary Clinton noted U.S. intelligence officials have blamed Russia for hacking Democratic officials accounts.

“We have never in the history of our country been in a situation where an adversary, a foreign power, is working so hard to influence the outcome of the election,” she said, and alluded to her Republican opponent Donald Trump’s praise of Russian president Vladimir Putin. [Many claim that the U.S. hacked a recent Ukraine and several over the years in South America.  Russia has been charged with hacking an election in Georgia. Some of these claims have stronger verification than U.S. claims without transparent evidence that any of these hacks were acts of the Russian Government. Not so long ago the U.S. was blaming hacks on China.  It seems we have a new enemy of choice.  Brought out also to charge that Trump, Clinton, Stein, and Sanders are somehow linked to Russia and Communism.] 

Trump replied that he knew “nothing about the inner workings of Russia,” and didn’t address electoral issues.

However on the campaign trail he has said multiple times that he fears the election will be stolen. In August in Columbus, Ohio he said “I’m afraid the election’s going to be rigged. I have to be honest.”

His website features a page where supporters can sign up to be election observers, to “Help Me Stop Crooked Hillary From Rigging This Election!”

Hacking dangers [We are not the only ones concerned:]

Experts say some local systems may be vulnerable to hacking. In some jurisdictions, local rules allow the transfer of election results using WiFi rather than putting the information on a thumb drive that’s physically taken to the central tally site. Others simply use outdated machines, said Kim Alexander of the California Voter Foundation, a non-profit, non-partisan organization that promotes the responsible use of technology in elections.

“They’re in a position where they need to buy something new, but governments don’t want to spend the money on it,” she said.

Depending on the voting machine, all it might take would be one disgruntled election official plugging in a thumb drive containing malware to falsify vote tallies, said Mike Baker, founder of Mosaic451, a computer security company that focuses on infrastructure protection, including for some state and federal election networks.

So far, 33 states and 11 county or local election agencies have approached the Department of Homeland Security for cybersecurity risk and vulnerability assessments, Secretary Jeh Johnson said in a statement Monday.

But time is a factor and he encouraged election agencies to ask for help now.

“There are only 29 days until election day, and it can take up to two weeks from the time we receive authorization to run the scans and identify vulnerabilities. It can then take at least an additional week for state and local election officials to mitigate any vulnerabilities on systems that we may find,” he said.

DHS may increase protections for voting systems to thwart hackers

The good news is that in the upcoming election, close to 80% of voters nationwide are in areas that will either use either paper ballots or voting machines with paper backups, both of which are considered much more secure than online only systems, said Smith.

Y2K or Pearl Harbor

The biggest question in the mind of voting security expert Joseph Kiniry is whether the 2016 election will be Y2K or Pearl Harbor.

The Y2K or millennium bug arose because programs represented the four-digit year with only the final two digits, which made 2000 indistinguishable from 1900. There were predictions of widespread computer failures and possibly catastrophic meltdowns of the world’s digital infrastructure.

Hundreds of millions of dollars and thousands of hours of work dealt with the problem and on January 1, 2000 the world woke to nothing more than a hangover, to the relief of many.

“I hope this is Y2K all over again,” said Kiniry, chief scientist at Free & Fair, a public-benefit corporation that works on creating technologies to keep elections free and fair.

But he and others worry that there’s a chance, though a small one, that it could be Pearl Harbor instead.

[Unlike Y2K, we are being warned, yet there is little action to significantly improve voting equipment, procedures, and security.  Maybe Y2K was a one-off where a very technical problem was described to the public, government, and business and after fifteen or so years of warnings, finally there was action in time to largely avoid the actual risks. As a Y2K programmer, I still hear complaints that we all ripped-off the system because nothing significant happened on Jan 1, 2000.  Many took the wrong lesson from that successful project/challenge.]

“Imagine lines wrapping around the block at every polling place in American on election day because the databases were compromised. Or results far different from previous elections and then two weeks after everyone thinks they know the outcome of the election, we find evidence of hacking in the machines,” he said.

66.5 million people watched Sunday’s Trump-Clinton debate
Voter confidence key

While election officials worry about such possibilities, they’re loath to discuss them publicly. If voters lose confidence in the system and don’t turn out to vote in the first place, it would be a greater threat to the integrity of the election system than hackers, they believe. [Don’t let the voters know what the risks really are, but privately worry, ignore, and cover-up.]

“It’s a tough position for us to be in. We don’t want to scare voters away,” said Alexander.

The fear is that proof of even one example of vote manipulation could be amplified through social media to threaten the electorate’s trust in the entire system.

That trust is a bedrock of American democracy and if it’s lost, “that puts us in a whole different category of countries that don’t have free and fair elections,” said Melinda Jackson, chair of the political science department at San Jose State University. [I would love to see a survey of what percentage of voters and non-votes have that blind trust given the thinly disguised attempt to deny risks.]

It might not even take that, she said.

“Already we see candidates sowing the seeds of distrust by saying the election might be rigged,” she said, citing Trump’s multiple statements to that effect.

In an absolute worst case scenario, were either Trump or some other group to question the legitimacy of the elections “we might see violence, we might see protests, we might see rioting, things that we see in other countries but not here,” said Jackson. [We have plenty of protests here. Just not so much over elections and no so much covered by the media.  See Standing Rock Dakota Pipeline and see where the violence comes from.]

While that’s an unlikely Doomsday scenario, she said, “it’s not impossible.”

Contributing: Kevin Johnson in Washington D.C.

Elizabeth Weise covers technology and cybersecurity for USA TODAY. Follow her at @eweise.