Safe as an ostrich, from cyber attack.

Imagine no Internet for a few weeks. Imagine if that is because there is no power grid. CNN.Money: Cyber-Safe: How Corporate America keeps huge hacks secret

The backbone of America — banks, oil and gas suppliers, the energy grid — is under constant attack by hackers.

But the biggest cyberattacks, the ones that can blow up chemical tanks and burst dams, are kept secret by a law that shields U.S. corporations. They’re kept in the dark forever.

Imagine no Internet for a few weeks.  Imagine if that is because there is no power grid. CNN.Money:  Cyber-Safe: How Corporate America keeps huge hacks secret
<read>

The backbone of America — banks, oil and gas suppliers, the energy grid — is under constant attack by hackers.

But the biggest cyberattacks, the ones that can blow up chemical tanks and burst dams, are kept secret by a law that shields U.S. corporations. They’re kept in the dark forever.

You could live near — or work at — a major facility that has been hacked repeatedly and investigated by the federal government. But you’d never know.

What’s more, that secrecy could hurt efforts to defend against future attacks.

The murky information that is publicly available confirms that there is plenty to worry about.

Unnamed energy utilities and suppliers often make simple mistakes — easily exposing the power grid to terrorist hackers and foreign spies. A CNNMoney investigation has reviewed public documents issued by regulators that reveal widespread flaws.

Reminds us of the “little” error by a DNC vendor a few weeks ago.  Except that a successful attack on the power grid vulnerability could be much more devastating.

Robert M. Lee spent time in the U.S. Air Force, where he identified critical infrastructure attacks as a “cyber warfare officer.” Now he travels the world for the SANS Institute, teaching the actual government investigators and power plant computer teams who face these types of dangerous attacks.

Except he doesn’t have any class material. He can’t find it. It’s all secret.

“My class is the only hands-on training for industrial control systems, but my students’ number one complaint is that there aren’t case studies or enough data out there about the real threat we’re facing,” he said. “There’s no lessons learned. It is extremely destructive to the overall national security status of critical infrastructure.”

Book Review: Ballot Battles by Edward B. Foley

I have long been a fan of the  papers and other writings of Edward B. Foley of the Moritz College of Law.  He writes extensively on the issues associated with close elections, how they have been decided since the founding of the United States, and how the process might be improved. Last month his book on the subject, Ballot Battles:The History of Disputed Elections in the United States was released.

To me, it was a highly fascinating read that kept my interest through every page. It should be required reading for anyone interested in Election Integrity

I have long been a fan of the  papers and other writings of Edward B. Foley of the Moritz College of Law.  He writes extensively on the issues associated with close elections, how they have been decided since the founding of the United States, and how the process might be improved. Last month his book on the subject, Ballot Battles:The History of Disputed Elections in the United States was released.

To me, it was a highly fascinating read that kept my interest through every page. It should be required reading for anyone interested in Election Integrity

As I would define it, Ballot Battles is focused on one component of election integrity, i.e. How close elections have been decided in the U.S., rather than if the vote counting itself was accurate. Foley’s work is an important component of election integrity. Further along that vein we could say that Fair Elections go beyond Election Integrity to include fair voter eligibility, access to the polls, candidate access to the ballot, access to the press, and campaign financing etc.

Ballot Battles follows close elections and the process for deciding the declared winner from 1781 through 2008.  While Presidential races from 1800, 1876, and 2000 are important, many other races for the U.S. Senate, U.S. House, and Governors are just as important to history and the challenges remaining today. Reforms have been attempted after major controversies, yet as Foley shows they have been insufficient, including those after 2000.  We remain vulnerable.  As summarized at one point in Ballot Battles:

“the 1960 presidential election must be viewed as a failure of American government to operate as a well-functioning democracy.  That failure puts 1960 along-side 1876 — and, as we shall later consider, 2000 — in a disturbing series of instances in which the nation has lacked the institutional capacity to identify accurately the winner of the presidency.”

There is no easy solution. It would likely require a Constitutional Amendment.  Ultimately, as Foley recommends, following successful models of instances of bodies of equal numbers of partisans, with a single respected non-partisan member.  That is unlikely to always work, yet that has worked better than the system we are left with for adjudicating close Federal Elections.

Ballot Battles thoroughly covers the adjudication process and the risks to which we are exposed.  Those seeking information on fraud and error in elections will not find the details here.  Likewise, those seeking agreement that the Supreme Court erred or acted responsibly in 2000 will find little agreement here, yet much to ponder, much to learn about the law, and the precedents applied to resolve election challenges.

Will encryption save us? No, “It’s Saturday Night!”

Last Saturday, some may have been channel surfing and mistakenly thought they were watching Saturday Night Live.  As one the 2% of voters spending last Saturday night intentionally watching the debate between the Democratic candidates and two ABC hosts, I was not the only one that noticed the flaws in one candidate’s claims for encryption that went unchallenged.

Fortunately, Jenna McLaughlin of The Intercept articulates the issues and the faulty assumptions of candidates and pundits: Democratic Debate Spawns Fantasy Talk on Encryption <read>

During Saturday’s debate, Democratic presidential frontrunner Hillary Clinton said the U.S. should commission a “Manhattan-like project,” a reference to the secret World War II-era atomic bomb endeavor, to address the alleged threat encryption poses to law enforcement. She also admitted she doesn’t actually understand the technology.

Last Saturday, some may have been channel surfing and mistakenly thought they were watching Saturday Night Live.  As one the 2% of voters(*) spending last Saturday night intentionally watching the debate between the Democratic candidates and two ABC hosts, I was not the only one that  noticed the flaws in one candidate’s claims for encryption that went unchallenged.

Fortunately, Jenna McLaughlin of The Intercept articulates the issues and the faulty assumptions of candidates and pundits: Democratic Debate Spawns Fantasy Talk on Encryption <read>

During Saturday’s debate, Democratic presidential frontrunner Hillary Clinton said the U.S. should commission a “Manhattan-like project,” a reference to the secret World War II-era atomic bomb endeavor, to address the alleged threat encryption poses to law enforcement. She also admitted she doesn’t actually understand the technology.

Clinton was largely parroting a popular FBI talking point that’s been highly publicized following the terrorist attacks in Paris and San Bernardino — that encryption is law enforcement’s Achilles heel in preventing crime — though there’s no evidence encryption enabled the plots to go undetected…

..law enforcement argues, the government needs some sort of a way in — a “backdoor,” “front door,” or “golden key” — to stop the bad guys in their tracks. For months, FBI Director James Comey has been proclaiming his wish for some sort of magical solution to allow law enforcement access to encrypted communications. Comey has repeatedly insisted that smart people working on technology simply need to try harder, or be incentivized properly.

But technologists and cryptographers have been saying for years that it’s impossible — without severely handicapping the protection encryption affords its users…

Yet the government has never presented a clear case where encryption has crippled a critical terrorism investigation, and law enforcement has other investigative tools in its arsenal — like traditional informants and tips, for example. Even when encryption is present, there is evidence that the FBI and other government agencies can hack into suspects’ computers and phones — bypassing encryption entirely.

And as Ed Snowden reminds us, be careful in setting precedents:

No matter how good the reason, if the U.S. sets the precedent that Apple has to compromise the security of a customer in response to a piece of government paper, what can they do when the government is China and the customer is the Dalai Lama?” he wrote to The Intercept in July.

Perhaps it is too much to ask in the limitations of the debate format, no candidate challenged these remarks and assumptions. Yet it is not just candidates and government officials that need to be fact checked. Increasingly it is correspondents and debate moderators:

Raddatz, ABC News’ chief global affairs correspondent, framed her questions in the debate as being about encryption as a “new terrorist tool used in Paris.” But criminals and terrorists have been using encryption for years, and encryption is also used legitimately by people around the world to protect sensitive information.

Read the full article for more of the arguments against and references to other pertinent articles.

* You might rate us “Mostly True” here as we rely on media reports that just under 8 million tuned in to the debates, assuming they reflected the U.S. population and most were eligible to vote, although considerably fewer do so.

Does All Mail Voting Increase Turnout?

In the long run, apparently Not or Not Much.

Article from the Washington Post, from researcher Elizabeth Bergman: Voting only by mail can decrease turnout. Or increase it. Wait, what?

My research found that when you can only vote by mail, voter turnout actually drops by about 13 percent. I examined what happens to turnout if voting by mail is compulsory. I studied more than 90,000 voters who could vote only by mail across four elections from 2006 through 2008 in five of the most populous urban counties in California. (In that state, if a precinct has fewer than 250 voters, elections officials are allowed to forego a polling place and accept ballots only by mail.)

That decline may seem counterintuitive. Presumably voting by mail is easier and more convenient than going to the polls. So why doesn’t turnout go up?

In the long run, apparently Not or Not Much.

Article from the Washington Post, from researcher Elizabeth Bergman: Voting only by mail can decrease turnout. Or increase it. Wait, what? <read>

Note that we here are talking about all mail elections, not no-excuse absentee voting, which tends also to decrease turnout.

Supporters hope that voting by mail means more citizens will vote. Is it so?

Generally, the answer is both “no” and “yes,” but with important qualifications…

Some early research in Oregon claimed that voting by mail increased turnout by 10 percentage points. However, since then, scholars have been unable to reproduce those results. Apparently that boost to Oregon’s turnout grew from a “novelty effect” and recurred only in special elections.

In Washington, researchers found that switching to all-mail elections increased overall participation by about three percentage points in presidential and midterm elections. In the California pilot, after the Nov. 3 elections, the San Mateo County elections office received 105,325 ballots out of the approximately 353,000 that were mailed. That’s 29.5 percent voter turnout, or 4.1 percent more than a similar off-year polling place election in 2013, when 25.4 percent of registered voters cast their ballots…

The media was quick to attribute the “eye-popping” increase in voter turnout to simply switching to vote-by-mail. But it’s not that simple.

Mail-only balloting actually decreases voting

My research found that when you can only vote by mail, voter turnout actually drops by about 13 percent. I examined what happens to turnout if voting by mail is compulsory. I studied more than 90,000 voters who could vote only by mail across four elections from 2006 through 2008 in five of the most populous urban counties in California. (In that state, if a precinct has fewer than 250 voters, elections officials are allowed to forego a polling place and accept ballots only by mail.)

That decline may seem counterintuitive. Presumably voting by mail is easier and more convenient than going to the polls. So why doesn’t turnout go up?

According to a 50-state study that examined elections over a 30-year period, voter turnout is less about convenience than academics once thought. Most voting reforms, like all-mail balloting, do not attract new voters.

What’s more, alternative voting methods are most likely to be launched in states that already have high voter turnout.

Why does voting by mail decrease turnout? Because mail voters have a longer voting “window,” they receive less stimulus to vote. Scholars have found that reductions in stimulation to vote are greater than the modest positive benefits of additional convenience from mail voting…

But reminders make a difference

Reminders are critical. My research found that when the elections office communicates more often with voters, more of them vote. In particular, four official communications can wipe out the 13 percent decrease in turnout that I found. ‘‘Official communications’’ include such documents as a Sample Ballot, a Voter Guide, letters on county letterhead and postcards from the Registrar of Voters. Each additional communication improved the odds of voting by 4 percent. And a voter who received five communications was 4 percent more likely to vote than a voter who received no mailings.

That leaves us with another question.  What effect would those same reminders have on election day voting?  Could we wipe out the 13% deficit by avoiding all mail voting, and add those same five reminders to increase turnout altogether, say by 10% or so?

What if we used computers for voting, not just driving?

From OpEd News, Interview with Barbara Simons: What the Heck Does the Recent Volkswagen Scandal Have to Do with Our Elections? <read full interview>

Since the Volkswagen hacking was disclosed we have been using that to highlight the potential of rigged elections as we have for earlier, more dramatic, vehicle hacking demonstrations.

Any large software program contains undetected bugs. That’s why software vendors such as Microsoft and Apple send out frequent software updates, many of them to fix security holes. Likewise, it also can be very difficult to detect cleverly hidden malware.Computers can greatly facilitate both car performance and ballot tabulation. But just as laboratory tests are not adequate for testing pollution controls in the presence of malware, so too we cannot depend solely on voting system “certification” to verify that our voting systems are accurate and secure

From OpEd News, Interview with Barbara Simons: What the Heck Does the Recent Volkswagen Scandal Have to Do with Our Elections? <read full interview>

Since the Volkswagen hacking was disclosed we have been using that to highlight the potential of rigged elections as we have for earlier, more dramatic, vehicle hacking demonstrations.

Both modern cars and voting systems are significantly computerized. VW was playing a very high stakes financial game that led someone to installed cheating software (malware).

The stakes are also very high in modern elections. I continue to be amazed that some losing candidates either are pressured not to rock the boat – sometimes by their own party (I know of candidates to whom this was done) – or actually accept negative results without questioning the computerized voting machines that “declare” those results.

Any large software program contains undetected bugs. That’s why software vendors such as Microsoft and Apple send out frequent software updates, many of them to fix security holes. Likewise, it also can be very difficult to detect cleverly hidden malware.

Computers can greatly facilitate both car performance and ballot tabulation. But just as laboratory tests are not adequate for testing pollution controls in the presence of malware, so too we cannot depend solely on voting system “certification” to verify that our voting systems are accurate and secure

Read the full interview <read>

 

Iowa Caucus: Democrats to vote by “Magic Pony” Express

Des Moines Register: Democrats abroad can phone-in caucus votes <read>
No matter how much we warn about Internet voting, it seems nobody learns. In this case it is telephone voting, just as insecure. These days the phone goes over the same paths as the Internet:

Des Moines Register: Democrats abroad can phone-in caucus votes <read>
No matter how much we warn about Internet voting, it seems nobody learns.  In this case it is telephone voting, just as insecure.  These days the phone goes over the same paths as the Internet:

The Iowa Democratic Party on Tuesday announced the first ever Tele-Caucus initiative. It will allow deployed service members and other Iowans living abroad to participate in the first-in-the-nation event.

The effort piggybacks on a satellite caucus initiative the party announced this fall. Both programs aim to expand participation in the Feb. 1 Iowa caucus to those who are normally unable to attend.

“This is to try and be more inclusive as a party,” Iowa Democratic Party Chair Andy McGuire said. “We want as many people as possible to participate in this caucus.”

We would add, perhaps there will be people participating they would rather not have, such as hackers.

The Tele-Caucus will be facilitated through a telephone consulting firm, Stones’ Phones.

?Founder of the company, Marty Stone, said participants will essentially phone-in their caucus vote by selecting a candidate with the push of a number on the dial pad. It’s compatible with any landline, cellphone, Skype or other program used for calling abroad.

Anyone planning to participate in the inaugural Tele-Caucus must register online, at iowademocrats.org/telecaucus, by Jan. 6. Those eligible should be registered to vote as a Democrat in Iowa and qualify for the Uniformed and Overseas Citizens Absentee Voting Act.

As with other such schemes, saying it is secure is not the same as it being secure.  No word of actual testing and certification by third parties.

Just this week, we learned a new technical term, Magic Pony, in this article from the Intercept:   Comey Calls on Tech Companies Offering End-to-End Encryption to Reconsider “Their Business Model” <read>

It is an educational read about the fallacies of the “Security” of placing back doors “only for the government” into encryption software.  One of those things likely only to be used by the public.  Anyone aiming at skulduggery would use encryption without backdoors, or avoid the Internet altogether.

Comey had previously argued that tech companies could somehow come up with a “solution” that allowed for government access but didn’t weaken security. Tech experts called this a “magic pony” and mocked him for his naivete.

Now, Comey said at a Senate Judiciary Committee hearing Wednesday morning, extensive conversations with tech companies have persuaded him that “it’s not a technical issue.”

“It is a business model question,” he said. “The question we have to ask is: Should they change their business model?”

Voter or Voting Fraud? via AB, immune to Voter Id

Many believe that stronger Voter Id would prevent voter fraud. Actually who would risk going to the polls with the risk of strong penalties if they are caught when there is an easier alternative, absentee voting?  This case from Wisconsin shows how easy can be, yet also that sometimes you can get caught. In this case only because there were two votes from one person.

A Shorewood man has been charged with more than a dozen counts of illegal voting, accused of casting multiple ballots in four elections in 2011 and 2012, including five in the 2012 gubernatorial recall.

Many believe that stronger Voter Id would prevent voter fraud. Actually who would risk going to the polls with the risk of strong penalties if they are caught when there is an easier alternative, absentee voting?  This case from Wisconsin shows how easy can be, yet also that sometimes you can get caught. In this case only because there were two votes from one person: Shorewood man charged with 13 counts of voter fraud <read>

A Shorewood man has been charged with more than a dozen counts of illegal voting, accused of casting multiple ballots in four elections in 2011 and 2012, including five in the 2012 gubernatorial recall.

Robert D. Monroe, 50, used addresses in Shorewood, Milwaukee and Indiana, according to the complaint, and cast some votes in the names of his son and his girlfriend’s son.

According to the complaint:

Monroe cast two ballots in the April 2011 Supreme Court election, two in the August 2011 Alberta Darling recall election, five in the Scott Walker-Tom Barrett recall, one illegal ballot in an August 2012 primary, and two ballots in the November 2012 presidential election.

In the presidential election, Monroe cast an in-person absentee ballot in Shorewood on Nov. 1 and drove a rental car to Lebanon, Ind., where he showed his Indiana driver’s license to vote in person on election day, Nov. 6, the complaint charges. Monroe owns a house there, according to the complaint…

The complaint indicates the investigation started in Waukesha County as an inquiry into possible double voting by Monroe’s son, who lives in Waukesha. But the son denied any knowledge of requesting an absentee ballot from his father’s Shorewood address, and the investigation shifted back to Milwaukee County…

The complaint refers to Monroe as an executive within the health care industry who earned a master’s degree in business administration at the University of Wisconsin-Milwaukee in 2013.

“He has expressed an interest in attending law school,” the complaint reads.

Monroe faces various counts of election fraud, including registering in more than one place, providing false information to an election official, voting more than once and voting as a disqualified person, for a total 13 felony charges. Each charge carries a maximum penalty of up to 18 months in prison, two years of extended supervision and a $10,000 fine.

 

Time to Hold ’em – Connecticut’s voting machines

San Francisco provides another reason for Connecticut to wait before considering new voting machines: San Francisco Examiner: San Francisco sets sights on open source voting by November 2019 <read>

“San Francisco could help write some U.S. democracy history with its leadership role,” said a Nov. 18 letter to the Elections Commission from Gregory Miller, co-founder of the Open Source Election Technology (OSET) Foundation, a collection of executives from top technology companies like Apple and Facebook. “And the total estimated cost to do so [$8 million] is a fraction of status-quo alternatives.”

San Francisco provides another reason for Connecticut to wait before considering new voting machines: San Francisco Examiner: San Francisco sets sights on open source voting by November 2019 <read>

San Francisco could have an open-source voting system in place by the November 2019 election, under a plan approved earlier this month by the Elections Commission.

The timeline could result in the emergence of San Francisco as the leader of the open-source voting movement in the United States.

For supporters of open-source voting, the importance of that point can’t be underscored enough.

“San Francisco could help write some U.S. democracy history with its leadership role,” said a Nov. 18 letter to the Elections Commission from Gregory Miller, co-founder of the Open Source Election Technology (OSET) Foundation, a collection of executives from top technology companies like Apple and Facebook. “And the total estimated cost to do so [$8 million] is a fraction of status-quo alternatives.”

Open-source voting systems bring a greater level of transparency and accountability by allowing the public to have access to the source codes of the system, which is used to tabulate the votes. A system owned by The City could also save taxpayers money…

We have said it before, No Crisis in CT unless we make one, there are few voting system options available today, expensive and,  at best, incrementally better than the AccuVoteOS scanners we use in Connecticut.  It is time to wait and see the results of efforts underway in Los Angeles County, CA, Travis County, TX, and now San Francisco.  There will be dramatically better and more economical systems available in the next five to ten years for Connecticut to benefit from these pioneering efforts.

Essex students assist Secretary in random drawing


Yesterday we observed the random drawing of 68 districts and alternate districts for the post-election audit. Just as last time, it was an effective and educational event for all those present and participating. After each district was drawn they were marked on an map of the State. See the <press release> for more details and a list of the districts chosen.


Yesterday we observed the random drawing of 68 districts and alternate districts for the post-election audit. Just as last time, it was an effective and educational event for all those present and participating. After each district was drawn they were marked on an map of the State.  See the <press release> for more details and a list of the districts chosen.

CT Lottery Hacked. Claimed to be easy “unsophisticated” hack

Once again, we wonder which is safer Gambling or Voting?

Courant story:  Suspended Lottery Game Had Too Many Winners <read>

Just how some lottery agents were able to manipulate their machines is not clear, but
investigators believe there was a vulnerability between the time a ticket was ordered at a terminal when it was printed…

[Consumer Protection Commissioner Jonathan] Harris said he does not think those who manipulated the system were sophisticated hackers, but rather people who were able to figure out how the lottery terminals work.

We are not reassured.

Once again, we wonder which is safer Gambling or Voting?

Courant story:  Suspended Lottery Game Had Too Many Winners <read>

The Connecticut Lottery and state Department of Consumer Protection shut down the 5 Card Cash game after noticing there were more winners than the game’s parameters should have allowed, and determining that some lottery agents were manipulating machines to print more winning tickets and fewer losers…

Just how some lottery agents were able to manipulate their machines is not clear, but
investigators believe there was a vulnerability between the time a ticket was ordered at a terminal when it was printed…

[Consumer Protection Commissioner Jonathan] Harris said he does not think those who manipulated the system were sophisticated hackers, but rather people who were able to figure out how the lottery terminals work.

As for how many agents and terminals were involved, “That’s the part we still don’t know,”  Harris said. It’s also not clear how much money was lost, Harris said...

Lora Rae Anderson, a spokeswoman for the Department of Consumer Protection, said the fact  there were more winners than there should have been raised a flag…

The Connecticut Lottery and the state Department of Consumer Protection were alerted to the  possibility of problems involving 5 Card Cash a year ago. A lottery retailer in Weston was accused of holding back winning tickets and selling losing tickets to unsuspecting customers. State authorities were alerted and suspended the retailer’s license to sell lottery tickets.

We are not reassured.

  • Is it really an unsophisticated hack?  If that is true we are concerned because,
    • The vulnerability was not corrected in a year
    • They have no idea who did it, how often it was done, how exactly it is accomplished, and how much was stolen
    • Apparently ignored red flags that too much money was being awarded
  • Yet, it could be sophisticated, which would be even more concerning, since they apparently have gotten away with the money

We ask:

  • Why do they assume it was unsophisticated hackers?
  • Was it really a hack? Or the did the system simply pay out too much?
  • What kind of security expertise does the vendor have, if a system could be broken by unsophisticated hackers?
  • What kind of security review and testing does the Lottery employ, if any?
  • Is anyone sure the random algorithms that choose winners are operating correctly?
  • Are they sure it is not an inside job?
  • Is there an audit trail of tickets cancelled?  Can’t they tell which terminals cancelled numbers of losing tickets?

We also wonder if the Lottery is up to the standards of Los Vegas gambling machines or closer to the weaker standards of voting machines <compare>