CTVotersCount.org

“Who Could Have Imagined” System rigged to make tests look good.

Over the years, we an others have pointed out that voting systems cannot be tested to assure performance before an election. Not the system itself before it is setup/programmed for a particular election. Not a setup and programmed system either. Not even if a system is completely secured and is somehow proven to run approved/certified software.

Here is some proof, not from a voting system – from a crime by an automaker. In this case it only puts the environment and lives in danger, rather than Democracy.

Here is some proof, not from a voting system – from a crime by an automaker. In this case it only puts the environment and lives in danger, rather than Democracy. Jeremy Epstein explains the analogy at Freedom To Tinker: <read>

In particular, computer scientists have noted that clever (that is, malicious) software in a voting machine could behave “correctly” when it detects that L&A testing is occurring, and revert to its improper behavior when L&A testing is complete. Such software could be introduced anywhere along the supply chain – by the vendor of the voting system, by someone in an elections office, or by an intruder who installs malware in voting systems without the knowledge of the vendor or elections office. It really doesn’t matter who installs it – just that the capability is possible.

It’s not all that hard to write software that detects whether a given use is for L&A or a real election. L&A testing frequently follows patterns, such as its use on dates other than the first Tuesday in November, or by patterns such as three Democratic votes, followed by two Republican votes, followed by one write-in vote, followed by closing the election. And the malicious software doesn’t need to decide a priori if a given series of votes is L&A or a real election – it can make the decision when the election is closed down, and erase any evidence of the real votes.

Such concerns have generally been dismissed in the debate about voting system security.

Read the entire post for more of the convincing details.

Of course voting machines are not autos. Unfortunately, voting machines are more vulnerable; Voting machines are not subject independent testing by trained professionals; Voting machines are not under lock and key by those who are hurt in general by pollution. Voting machines are not under lock and key by those likely to be impacted by declining value in their now illegal or poor performing vehicles. Voting machines are certified by those in the employ of the vendors, tested before election days by amateurs, responsible for their safekeeping. Some of those amateurs may actually have the motive and opportunity to fix results and cover up errors.

The solution when it comes to elections is voter verified paper ballots, sufficient ballot security, sufficient independent audits, and recounts (aka Evidence Based Elections).

TSA provides “Security Theater” , not “Peace of Mind”

The Intercept covers the lack of security and abundance of BS from the TSA: TSA Doesn’t Care That Its Luggage Locks Have Been Hacked

In a spectacular failure of a “back door” designed to give law enforcement exclusive access to private places, hackers have made the “master keys” for Transportation Security Administration-recognized luggage locks available to anyone with a 3D printer…

Now that they’ve been hacked, however, TSA says it doesn’t really care one way or another.

What reminders and lessons can we learn from this?

The Intercept covers the lack of security and abundance of BS from the TSA: TSA Doesn’t Care That Its Luggage Locks Have Been Hacked <read>

In a spectacular failure of a “back door” designed to give law enforcement exclusive access to private places, hackers have made the “master keys” for Transportation Security Administration-recognized luggage locks available to anyone with a 3D printer…

When the locks were first introduced in 2003, TSA official Ken Lauterstein described them as part of the agency’s efforts to develop “practical solutions that contribute toward our goal of providing world-class security and world-class customer service.”

Now that they’ve been hacked, however, TSA says it doesn’t really care one way or another.

“The reported ability to create keys for TSA-approved suitcase locks from a digital image does not create a threat to aviation security,” wrote TSA spokesperson Mike England in an email to The Intercept.

“These consumer products are ‘peace of mind’ devices, not part of TSA’s aviation security regime,” England wrote.

What reminders and lessons can we learn from this?

Government lies and covers up.
“Backdoors” to security defeat security, such as backdoors to encryption. If there were no master keys then this particular hack would not have happened.
Like the Snowden revelations, publishing this information informs and protects the public. Not publishing it only serves the criminals and protects the government.
This is similar to the hack of Diebold/ES&S/Dominion AccuVote-OS optical scanners used in Connecticut – the keys were hacked by using a photo in the Diebold online catalog for extra keys. Like the TSA keys, every AccuVote-OS uses the exact same key, in the possession of thousands of election officials in every election and between elections, easily duplicated.
Except for the master keys the TSA locks would be a bit safer than the seals used to “secure” Connecticut’s scanner and ballot cases – primarily because TSA keys are used by consumers to protect their valuables from others – ballot and scanner seals are used to protect against the very same people who apply and open the seals.

For more on the vulnerability of seals see our past coverage <here> <and here>

Sierra Club pitches nonscience nonsense for obscure company

It seems that for the Sierra Club, reason and science end at the edge of the environment. They are now touting a product for Internet voting from a company that simultaneously claims that they have a product that is “a revolutionary mobile voting platform designed to securely cast votes in elections across the globe.” while running a Contest awarding $230,000 to actually accomplish that “In this Challenge, we are asking Solvers for help in overcoming the significant obstacles that stand in the way of bringing safe, secure, and easy voting to people worldwide.”

The article link from the Sierra Club goes to Huffington Post: Why You Might Vote For the Next President From Your Couch [Update: Link has been removed from Huffington Post and updated at the Sierra Club] <read> Read what you can about the company, Votem here: <read>

For many years my career in Computer Science involved evaluating software from large and small companies for use in a large company. Later for close to a decade I worked for a couple of small startups, building and marketing data communications software. One of those was successful, started by an engineer with a working product in demand before the doors opened. The other, was started by a serial entrepreneur, who I later learned was also a serial failure. He was good at getting venture capitol and publicity for attractive concepts, lacking feasibility.

My BS detectors go up when I see a company web site touting their revolutionary product, completely missing information on the company structure, missing information on principles, with no customer success stories, and touting their expertise at getting media placement! I am disappointed that the Sierra Club is sucked in.

Electronic voting is far from ready for prime time. I see that the Challenge and award is just for paper designs to solve some of the many challenges of electronic voting. Here is what top security scientists, computer scientists, and voting experts report after an exhaustive study: https://www.usvotefoundation.org/news/E2E-VIV-press

I wonder who Votem will have evaluate the submissions? If their system is already secure as their web site claims, why do they need this help?

My BS detector is confirmed by their blog trashing science and scientists?
http://votem.com/blog/

I see the first entry cites errors by Einstein and others, and claiming therefor that those skeptical about Internet voting are wrong:
http://votem.com/internet-mobile-voting-is-unachievable/

The world is full of experts. Very intelligent and well-meaning people make predictions about our world every day. And because we are all human, many experts get it wrong; and some in a very big way.

Just the same we can point to industry “experts” who have made many “errors” which coincidentally helped their products. We recall the doctors claiming the safety of tobacco, the claims that our nuclear waste problems would be solved years ago, that fracking is safe, that we would all be driving in flying cars by now, and now that some computer systems are unhackable. There are a lot more startups on the scrap heap along with failed corporate and government projects, that Einstein predictions.

The second blog post is entitled “Beware of The Experts”. The third claims support of Republican presidential candidates.

It is as if Sierra wrote positively about a Challenge by a startup energy services company to award prizes for white papers describing how to do safe fracking or building safe oil pipelines, touting they were just around the corner, leaving the impression that we might as well not bother with green technology investment and conservation.

Cyber risks of Internet voting and electronic voting

Two articles this week on cyber risks, one refuting Colorado’s Secretary of State on online voting. Another articulating the risks of hacking electronic voting in general.

Stay tuned and stay involved!

Two articles this week on cyber risks, one refuting Colorado’s Secretary of State on online voting. Another articulating the risks of hacking electronic voting in general.

From the Colorado Statesman: Colorado Secretary of State Wayne Williams obscured key facts in online-voting commentary <read>

Last week’s guest commentary by Secretary of State Wayne Williams in The Colorado Statesman obscured some important facts. He was responding to criticism of his new rule establishing criteria for the casting of election ballots by email.

In it, Secretary Williams implies that the federal government expanded voting by email. He writes, “The federal government, along with the Colorado General Assembly, expanded the electronic ballot transmission for military and overseas voters.” In fact the federal government has neither endorsed nor expanded the return of marked ballots over email…

Secretary Williams claims that of the nearly 3,400 ballots sent back electronically in 2014 there was not a single report of tampering. This raises two issues: First, “no report” is meaningless when tampering of online ballots can be done undetectably. Experienced hackers can penetrate a system for a very long time without detection, as seen in recently publicized successful attacks on the FBI and Pentagon. A Colorado voter whose email ballot has been altered would never know; the elections office also will never know…Second, for years there has been no state rule to guide these vulnerable voters through this security minefield, nor to spell out the very narrow parameters required by law, needlessly putting many more than even those 3,400 votes at risk…

Given our shared concern is for ensuring the safe return of military and overseas voters’ ballots, the record of other states can be instructive. Minnesota and Wisconsin consistently lead the nation in the rate of military and overseas ballots returned, and neither permits online ballot return

Read the article for more.

From WhoWhatWhy: Foreigners Could Hack U.S. Elections, Experts Say <read>

What if a foreign head of state had the power to handpick our next President? It sounds like the plot of a movie, but it actually might be in the realm of possibility.

Most people take our elections for granted. The few who don’t often suspect that one party might be trying to steal votes from the other. But they don’t envision that the theft could be coming from outside US borders.

What experts are telling us, though, is that our voting machines are so insecure that all elections, whether at the national, state, or local level, are vulnerable to being attacked by hackers in other countries.

We’ll add that maybe foreigners might scare some of the complacent, yet all these attacks could be done by Americans bent by many similar motives and more.

We also add a specific added threat on our shores of insider attack – those with access the the system who can, desire, or are intimidated into changing the results.

For example, Russia may want to prevent a hawk like John McCain, who wants weapons in the Ukraine and faces a tough battle for his job next fall, from getting reelected.

Israel’s leaders believe that the Iran nuclear deal would doom their country, so if they thought they could get away with it, would they try to put in office US representatives who share that view?…

This begs the question: Given that the security at some of our most protected institutions can be breached, and given that US elections pose an enticing target for our adversaries, what would prevent a foreign agent from hacking our ballot boxes?

The answer: Not much.

Experts indicate that the election systems in place today do not provide the adequate protection that would be able to stop a foreign hacker — a hacker anywhere, in fact — from rigging our races. Even worse, these attacks could go undetected…

Since such attacks can easily go unnoticed, evidence of remote hacks is scarce. But it’s likely they’re happening more than we know, considering that unencrypted connections over the open internet aren’t too hard for a knowledgeable college student to breach…

One report [on Internet voting], produced by computer scientists at the request of the Pentagon, examined a pilot iVoting project and concluded that an internet- and PC-based voting system presented “fundamental security problems” that couldn’t be fixed without a “radical breakthrough.”

Cyber attacks, the report concluded, “could occur on a large scale, and could be launched by anyone from a disaffected lone individual to a well-financed enemy agency outside the reach of U.S. law.”…

Despite its seemingly safe appearance, there are subtle ways the eVoting [polling place and central count voting] process could be susceptible to attack. For, in many cases, these systems actually do connect online.

John Sebes, CTO of the Open Source Elections Technology Foundation (OSET), told WhoWhatWhy that the most significant logistical issue for local officials is something called the election management system, or EMS.

As a component of the overall apparatus, the EMS is used for election data management and data entry — most likely on a PC in an elections office. Sebes said that, in theory, EMSs are never supposed to be online, but sometimes they get connected anyway. Not only do hackers then have the potential to breach election data on the PC, but malware could affect the removable media when it is taken out of the PC and inserted into the voting machines.

For now Connecticut is relatively safe from outsider attacks domestic and foreign.

While the Legislature voted for Internet voting, Secretary of the State Denise Merill maintained her staunch opposition, pointing out that Internet voting would violate our state constitutional requirement for a secret ballot. Fortunately, a constitutional amendment to change that died between committee and the floor, in 2014. It should stay that way.
Right now we do not connect our optical scanners to external equipment. In fact, their external ports are sealed. Memory cards are never in a device connected to the outside world. We do all our election results summary by addition and transcription from the printed scanner tapes. However, the Secretary of the State’s Office has plans for acquiring GEMs systems for municipalities to speed the electronic calculations of results. If, and its a big “if” right now, the GEMs systems are pristine, never were or never will be connected to the Internet, we would remain relatively safe from outsider attack. Stay tuned and involved!

Remember that we are still at risk of insider attacks, where our only protection would be adequate ballot security, audits, and recounts.

Larry Wilkerson on Computerized Elections

Are Larry Wilkerson’s concerns justified? Without sufficient audits and recounts, we can never be certain. As he tells us, history tends toward cheating whenever it is possible.

Our position is that paper ballots and optical scanning followed by sufficient security, audits, and recounts is the optimum system available. Yet, in Connecticut we need stronger security, audits, and recounts to achieve justified integrity and confidence in our elections.

Are Larry Wilkerson’s concerns justified? Without sufficient audits and recounts, we can never be certain. As he tells us, history tends toward cheating whenever it is possible.

The Selfie Threat To Democracy

What could be more patriotic in our narcissistic social-media age than posting a picture of yourself on Facebook with your marked ballot for president? Show off your support for former Secretary of State Hillary Clinton, Donald Trump, Senator Bernie Sanders (D-Vt.) or former Florida Governor Jeb Bush. Last week, a federal court in New Hampshire struck down that state’s ban on ballot selfies as a violation of the First Amendment right of free-speech expression.

That might seem like a victory for the American Way. But the judge made a huge mistake because without the ballot-selfie ban, we could see the reemergence of the buying and selling of votes — and even potential coercion from employers, union bosses and others…

From Reuters, by Richard L. Hansen Why the selfie is a threat to democracy <read>

What could be more patriotic in our narcissistic social-media age than posting a picture of yourself on Facebook with your marked ballot for president? Show off your support for former Secretary of State Hillary Clinton, Donald Trump, Senator Bernie Sanders (D-Vt.) or former Florida Governor Jeb Bush. Last week, a federal court in New Hampshire struck down that state’s ban on ballot selfies as a violation of the First Amendment right of free-speech expression.

That might seem like a victory for the American Way. But the judge made a huge mistake because without the ballot-selfie ban, we could see the reemergence of the buying and selling of votes — and even potential coercion from employers, union bosses and others…

In his 42-page opinion, Federal District Court Judge Paul Barbadoro offered an erudite and thoughtful discussion of the history of vote buying in the United States. You would think his analysis would have led him to uphold the ban. But it didn’t. Instead, his analysis fell apart in its legal reasoning…

Barbadoro also said the law was not narrowly tailored, given that nothing would stop someone from posting on Facebook, or elsewhere, information about how he or she voted. What this analysis misses is that a picture of a valid voted ballot, unlike a simple expression of how someone voted, is unique in being able to prove how someone voted…

The social-media age gives people plenty of tools for political self-expression. New Hampshire’s law is a modest way to make sure that this patriotic expression does not give anyone the tools to corrupt the voting process.

We agree 1000%. See our earlier post: Common Sense: The good, bad, and ugly secret ballot

***** Update 8/25/2015
More from the New York Times <read>

NonScience Nonsense, another claim of electronic voting security

In late June a respected source published a non-peer-reviewed article: The case for election technology Which despite its title is actually a marketing piece disguised as science, not for election technology but for electronic voting, including Internet voting. The case actually made is for skepticism and peer-review.

That skepticism is well addressed in posts by Jeremy Epstein and E. John Sebes: How not to measure security and A Hacked Case For Election Technology

In late June a respected source published a non-peer-reviewed article: The case for election technology <read>. Which despite its title is actually a marketing piece disguised as science, not for election technology but for electronic voting, including Internet voting. The case actually made is for skepticism and peer-review.

That skepticism is well addressed in posts by Jeremy Epstein and E. John Sebes: How not to measure security <read> and A Hacked Case For Election Technology <read>

From Epstein:

But the most outrageous statement in the article is this:

The important thing is that, when all of these methods [for providing voting system security] are combined, it becomes possible to calculate with mathematical precision the probability of the system being hacked in the available time, because an election usually happens in a few hours or at the most over a few days. (For example, for one of our average customers, the probability was 1×10-19. That is a point followed by 19 [sic] zeros and then 1). The probability is lower than that of a meteor hitting the earth and wiping us all out in the next few years—approximately 1×10-7 (Chemical Industry Education Centre, Risk-Ed n.d.)—hence it seems reasonable to use the term ‘unhackable’, to the chagrin of the purists and to my pleasure.

As noted previously, we don’t know how to measure much of anything in security, and we’re even less capable of measuring the results of combining technologies together (which sometimes makes things more secure, and other times less secure). The claim that putting multiple security measures together gives risk probabilities with “mathematical precision” is ludicrous. And calling any system “unhackable” is just ridiculous, as Oracle discovered some years ago when the marketing department claimed their products were “unhackable”. (For the record, my colleagues in engineering at Oracle said they were aghast at the slogan.)

As Ron Rivest said at a CITP symposium, if voting vendors have “solved the Internet security and cybersecurity problem, what are they doing implementing voting systems? They should be working with the Department of Defense or financial industry. These are not solved problems there.” If Smartmatic has a method for obtaining and measuring security with “mathematical precision” at the level of 1019, they should be selling trillions of dollars in technology or expertise to every company on the planet, and putting everyone else out of business.

We would add that just because an election happens over a short period is not a reason to claim any increased level of security or reduced vulnerability:

Programming election systems occurs months and weeks ahead of the election. Systems are vulnerable for their whole life up to and including each election. Its like saying air traffic control systems are not vulnerable to errors because directing each airplane occurs over a very short period of time in each control center. Of course that never happens.
And the rush to provide results quickly, all including the work of tired, lightly trained, technically challenged, and often partisan officials increases the vulnerability.
And the very suggestion of less vulnerability actually can have the effect of reducing vigilance, and increasing risk.

From Sebes:

I also disagree with most of Mugica’s comparisons between eVoting and paper voting because from a U.S. perspective (and I admit this review is all from a U.S.-centric viewpoint) it’s comparing the wrong two things: paperless eVoting verses hand-marked hand-counted paper ballots. It ignores the actual systems that are the most widely used for election integrity in the U.S.

Now, perhaps Mugica’s argument is for eVoting more broadly, without insisting on the paperless part. But in that case, most of America already has some form of eVoting, using voting machines and paper ballots or records, coupled with some form of paper ballot audit to detect malfunctioning machines. In that case, you don’t need to claim mythical security properties along with implied mythical perfect performance. If some equipment doesn’t work right – whether from hacks or good old fashioned software bugs – the audit can detect and correct the results.

1. The Article Misses the Point

This paper completely misses the point that it is not paper-voting vs. electronic-voting, but rather that each is insufficient. In reality, transparent (in technology and process), accurate, secure, and verifiable elections require a combination of people + paper + process + computers, each cross-checking the other. The majority of U.S. election officials now commonly understand this as the norm. Either that, or the author assumes that eVoting includes support for ballot audit (more below), and is arguing against paper-only hand-count elections—a practice that is no longer relevant in the U.S.

2. The Article Ignores Common U.S. Election Practices

“The security of a paper-based, manual vote with a manual count is extremely low. Single copies of each vote make them easy to tamper with or destroy.”

True, but only for the most procedurally simple methods of conducting hand counts or hand audits. Just last week, the state of Wisconsin conducted a public manual ballot audit that was a model of transparency and integrity.

Security is not the main issue for either hand count or machine count. Accuracy is.

We have long held that optical scan, including strong ballot security, sufficient audits and recounts is the best available system today.

Online Voter Registration: Vulnerable too!

An independent report by the state auditor general found Florida’s voter registration database flawed.

Susanna Randolph, one of the candidates running for Alan Grayson’s 9th district congressional seat, sent a letter today asking Attorney General Loretta Lynch to launch a Department of Justice probe into the state’s voter system.

Report from Florida station, WMFE: Randolph Calls on DOJ Probe into Florida’s Voter Registration System <read>

An independent report by the state auditor general found Florida’s voter registration database flawed.

Susanna Randolph, one of the candidates running for Alan Grayson’s 9th district congressional seat, sent a letter today asking Attorney General Loretta Lynch to launch a Department of Justice probe into the state’s voter system. The request comes less than one month after an independent report by the state auditor general found flaws with the nine-year-old registration database.

The audit found the system at risk of a security breach, citing unauthorized access to voter data by Department of State employees. It also labeled the system overdue for upgrades and a disaster recovery plan evaluation.

Department of State officials said they have changed the system’s software and plan to train staff before voters prepare to cast their ballots in the 2016 elections.

This is one of several ways of hacking a voting system. Records could be altered, deleted, the system taken down, or simply fail. As we said, last month:

Just this week we understand that the Connecticut voter registration system was down for a day – a day when registrars were attempting to print party voter lists on the last legal day for party caucuses. This year the Legislature said that same system could be used for voters to register during Election Day Registration (EDR) – if we got used to relying on that system and it failed on its own or with a little help from hackers – in a large turnout election, it could result in long lines and turned away/turned off voters!

Unfortunately, we took a shot that was pretty close last month!

Last month, after a report of drone hacking, I speculated wildly, according to some:

My concern is that if cars can be hacked, why not police vehicles, especially, those armored military vehicles now in the hands of our local police?

“>Its even worse than we thought. A couple demonstrate graphically the hacking and controlling of a sniper rifle.

Last month, after a report of drone hacking, I speculated wildly, according to some:

My concern is that if cars can be hacked, why not police vehicles, especially, those armored military vehicles now in the hands of our local police?

“>Its even worse than we thought. A couple demonstrate graphically the hacking and controlling of a sniper rifle.

Top Six Ways Hackers Could (have) Disrupt(ed) an Election

The election system is particularly vulnerable because it involves a combination of state, local, and federal government agencies with their own systems, software, hardware, and security protocols. Often, government departments are running old “legacy” computer systems that are extremely vulnerable to malware and hacking; and even if they have new systems, these are often put into place without a comprehensive security audit and performance review.

Who exactly is in charge of securing these overlapping networks isn’t always clear in government either.

From the Huffington Post: Top Six Ways Hackers Could Disrupt an Election <read>

Our own headline emphasizes that we have no reason to believe that these risks only apply to future elections. There is no reason to believe that some or all have not been used in past elections. From the article:

Hacking just a few electoral districts could allow an attacker to swing an election in a close race. The U.S. has had close elections multiple times in the past. In 1960, John F. Kennedy squeaked out a victory over Richard Nixon by just 0.1%. In the 2000 presidential election, the decision came down to just a few votes in Florida. In the end, the Supreme Court had to determine the winner.

The election system is particularly vulnerable because it involves a combination of state, local, and federal government agencies with their own systems, software, hardware, and security protocols. Often, government departments are running old “legacy” computer systems that are extremely vulnerable to malware and hacking; and even if they have new systems, these are often put into place without a comprehensive security audit and performance review.

Who exactly is in charge of securing these overlapping networks isn’t always clear in government either…

According to Verizon’s 2015 Data Breach Investigations report, the public sector has the highest rate of “crimeware” infections of any industry sector…

If foreign governments can hack into U.S. government and defense systems, why would anyone think that foreign interests couldn’t also hack into U.S. elections? It’s important that we start talking about these risks because a “hack attack” could happen sooner than we think. Fixing this won’t be easy which is why we need to start preparing/safeguarding now!

The author lists his top six risks:

Hack a voting machine
Shut down the voting system or election agencies
Delete or change election records
Hijack a candidate’s website
Doxing a candidate
Target campaign donors

Just this week we understand that the Connecticut voter registration system was down for a day – a day when registrars were attempting to print party voter lists on the last legal day for party caucuses. This year the Legislature said that same system could be used for voters to register during Election Day Registration (EDR) – if we got used to relying on that system and it failed on its own or with a little help from hackers – in a large turnout election, it could result in long lines and turned away/turned off voters! In fact, that system is used today by officials on election day for EDR and for checking voter registrations when issues arise with the lists in pollbooks.

Another potential hack not mentioned would be attacking a local elections website. A hacker could change polling place locations, switch polling places and streets between polling places. Or simply knock out the web, preventing voters from obtaining polling place information on election day.

Of course, all these risks also apply, even more strongly to Internet voting where there are no paper backups to survive system failures, for audits, and for recounts.