Slashdot Log In
Diebold Disks May Have Been For Testers
Posted by
Zonk
on Sun Oct 22, 2006 09:28 PM
from the concientious-tester dept.
from the concientious-tester dept.
opencity writes "The Washington Post reports on the two Diebold source disks that were anonymously sent to a Maryland election official this past week. Further investigation has lead individuals involved to believe the disks came from a security check demanded by the Maryland legislature sometime in 2003." From the article: "Critics of electronic voting said the most recent incident in Maryland casts doubt on Lamone's claim that Maryland has the nation's most secure voting system. "There now may be numerous copies of the Diebold software floating around in unauthorized hands," said Linda Schade, co-founder of TrueVoteMD, which has pressed for a system that provides a verifiable paper record of each vote."
Related Stories
[+]
IT: Opening Diebold Source, the Hard Way 299 comments
Doc Ruby writes to tell us about an article in the Baltimore (MD) Sun, reporting that someone sent a package to a former legislator containing what appears to be Diebold source code. From the article:
"Diebold Election Systems Inc. expressed alarm and state election officials contacted the FBI yesterday after a former legislator received an anonymous package containing what appears to be the computer code that ran Maryland's polls in 2004... The availability of the code — the written instructions that tell the machines what to do — is important because some computer scientists worry that the machines are vulnerable to malicious and virtually undetectable vote-switching software. An examination of the instructions would enable technology experts to identify flaws, but Diebold says the code is proprietary and does not allow public scrutiny of it." Read on for more of Doc Ruby's comments and questions.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
New tag (Score:3, Funny)
Re:New tag (Score:5, Funny)
Parent
Re:New tag (Score:4, Informative)
Parent
Re:New tag (Score:5, Insightful)
Parent
Re: (Score:3, Informative)
I agree - I don't have tons of time to surf anymore and I steal a glance at the tags before considering whether to actually RFTA or not. I can't imagine myself using the search function for anything in particular, as fish, relatives and
Yes, tags are the greasy new flavor feature, but if it's strictly for indexing, searching, whatever, why bother showing them on the front page? We as the users will abuse anything given a chance...e
Re:New tag (Score:5, Interesting)
Instead, the editors who post the story should be tagging it appropriately. As well as that, there should be a common set of tags that can be voted on for each story ( dupe, inaccurate, comfirmed, ect.. ), with the voting be weighed by user.
And even that is subject to errors, but it'd be more accurate.
Parent
Re:New tag (Score:5, Insightful)
Oh, and I wasted my mod points so I could tell you how people with senses of humour work.
Parent
Re: (Score:3, Informative)
What's the point again?
Proper tags (Score:5, Funny)
Proper tags for this article may include "Diebold" "voting machines" "Maryland"
Surely you can think of some more useful tags like "electoral fraud", "corruption," "cronyism" ...
Parent
Previous story tags: (Score:4, Funny)
fud, no, yes, rms, notfud
scam, slownewsday
yay, spam, spamhaus, haha
wikipedia, copyright
fud, notfud, monopoly
'glad to see the system is working well.
Parent
Can't do much with these disks (Score:5, Funny)
Re:Can't do much with these disks (Score:5, Funny)
It's still great fun over the LAN!!
Getting a bunch of friends together to suborn the vote is always a good time
Parent
Re:Can't do much with these disks (Score:5, Insightful)
And, frankly, the AI is horribly unrealistic. All the little guys that you tell to cast votes... Most of them just ignore you. It's like they don't even notice you, or anything going on. And, the guys being voted for are like crazy over the top cartoon villains. Whoever made this game is obviously a moron, and has no understanding of a decent plot.
Actually, on a more serious note... I haven't been able to find a torrent. This shit is pretty fucking fundamental to our democracy, and when it finally gets 'leaked,' it manages to stay buttoned up? Seriously, do we know anything about the source? Does anybody have a torrent, or at least asn assessment from somebody qualified to be frightened by looking at it? As far as I'm concerned, every citizen of the US not only should have the right to see the mechanics of demacracy, but an obligation to do so. Anybody who doesn't try to get ahold of the source code running their local voting machines should be considered grossly negligent.
Parent
Re:Can't do much with these disks (Score:5, Insightful)
Kagan did the right thing, which was to contact the state elections officials, who in turn contacted the FBI, who went and talked to Kagan.
She was part of the Government and respects it enough to try and work within the system.Good luck explaining that to a judge. The penalties for messing with anything relating to an election are no joke. Why do you think those discs were delivered anonymously?
Parent
Re:Can't do much with these disks (Score:5, Interesting)
I've heard the likes of your attitude before. It can pretty much be summed up as "Don't ask why, that's just how it is." Imagine if you told your kids that.
Try appending that statement to the end of different statements:
-"We can't cure cancer. Don't ask why, that's just how it is." And so nobody bothers researching a cure.
-"Your computer's Windows installation is broken. Don't ask why, that's just how it is." And so you needlessly spend $$$ on a new computer when all you needed was a fresh installation and anti-vir."
-"2 + 2 = 5. Don't ask why, that's just how it is." And so the plane crashes.
-"You're wrong. Don't ask why, that's just how it is."
I hope you get the point.
Parent
Re:Can't do much with these disks (Score:5, Funny)
You've obviously never been a parent or a teacher.
-Grey [wellingtongrey.net]
Parent
Slight correction (Score:4, Informative)
The Baltimore sun says that "Kagan called the attorney general's office, and word of the disks began to spread. Learning of the development, Linda H. Lamone, the state's elections chief, reported Kagan's possession of the code to the FBI yesterday [Oct 19]."
Which only reinforces my point, since
Attorney General > State Election Chief
Parent
Re:Can't do much with these disks (Score:4, Insightful)
Let's just suppose, hypothetically like, that I...um....have a friend who has access to the current source stream for all Diebold software, and has no problems with peeking at (or more), and is extremely well qualified to understand it (let's just say, again, hypothetically like, that he was the key architect for the system, and wrote most of the code himself), and is much more interested in seeing his own vote counted correctly than in seeing Diebold or any politically motivated individual rig the election. Let's also assume, hypothetically like, that while completely reliable, he's one of the tin-foil hat crew who is already convinced that someone is trying to rig the election through rigging voting machine software. More to the point, let's assume that preusing Diebold source code is this dude's full-time job, and if he wants to stay late reviewing code, his employer pays him time and a half.
How would you suggest my friend go about making sure that the software running on the box he uses to cast his vote is the same one he just finished building at Diebold? Let's assume he knows what version is current, what patches are appropriate, and what every last function in the source does, and he's verified it's all clean. He knows an unrigged machine will display buildID 8675309, but he also knows how easy it would be to make a rigged machine display that as well.
If you were "my friend", how would you?
If the software running on the box were "open source" by law, it might solve the problem of clueless coders, and it might allow us to catch the unscrupulous ones, but it wouldn't allow us to address the fundamental problem of having to trust the machine count.
In this application, having the source code buys you nothing, whether you're allowed to have it or not.
Parent
If the attackers can use the source to attack it (Score:5, Insightful)
Having numerous copies floating around is a good thing if disclosure of security holes is encouraged, and the fact that Diabold are implying that the security of their systems rely on people not having access to the source code is a very bad thing.
Lets look at things logically. The only people who would rig the election using those machines would have to have physical access to the machines, and if they did they wouldn't need the source code to highlight security holes. If the source code was released then the people who would be advantaged would be the people who would responsibly disclose security holes.
Re:If the attackers can use the source to attack i (Score:5, Interesting)
The real lesson here is the lengths some politicians will go to so that they appear "right".
(OK, and Diebold also has security issues - but that is a side issue, everyone has security issues. These are the guys making ATMs, for goodness sake. A voting machine that is as secure as an ATM is probably good enough. You can't stop human fraud via a machine - humans win every time.)
Parent
Re:If the attackers can use the source to attack i (Score:5, Insightful)
Wasn't it just a few weeks ago people were finding the passwords for ATMs 'hidden' right there on the net with instructions on how to reprogram them from the front pannel so that it thought the 20s slot was actually dispensing $5s???
If this is the security we can expect...well, I just hope my side finds the password list before the other side. Those bastards are slimy cut and run warmongers who want to stay the course of flipflopping.
Parent
Re:If the attackers can use the source to attack i (Score:5, Insightful)
If the system were as secure as an ATM network I would have to agree. An ATM gives you a bit of paper to prove the transaction took place and are fully auditable by the bank, the voting machines in question do not give a receipt and do not leave an audit trail. The fact that diebold also makes ATM's indicates nothing less than malice in the design of such a piss poor security scheme for their voting machines.
Parent
Voting and ATM machines unrelated. (Score:5, Interesting)
Diebold BOUGHT the voting machine deisgn (by buying the company that made it). It is unrelated to their ATM designs.
Parent
Re:If the attackers can use the source to attack i (Score:4, Insightful)
The ATM analogy is a bad one since banks must connect an individual to a transaction. Voting machines must not connect an individual to a transaction while still ensuring one vote per person. It's not particularly hard to do, the issues have been well understood for at least a couple of centuries.
Having said that, diebold have shown they understand security and auditing issues by producing reliable ATM's, they have not done the same for voting machines. Given diebold's experience with ATM security issues it is hard to see how incompetence has played a part in this particular cock-up.
Parent
Re:If the attackers can use the source to attack i (Score:5, Insightful)
Parent
Re:If the attackers can use the source to attack i (Score:5, Insightful)
That's not what we're getting, as the research and disclosures have made painfully clear.
In any case, Diebold has had some trouble with ATMs, including the ATM reprogrammed as a jukebox [thetartan.org] and the ATMs infected by a virus [windowsfordevices.com].
Voting machines are a harder and more safety-critical application than ATMs. Voting machines have to preseve anonymity. Imagine how that would complicate banking. Then, the worst case failure of an ATM is that some money changes hands inappropriately and laywers earn lots of money sorting it out. The worst case failure of a voting system is an election lost to fraud, meaning the victors are the crooks. The damage is potentially incalculable: think of the nations ruined by having the wrong leaders.
Parent
Re: (Score:3, Insightful)
There's even more money and power in cracking elections then there is in cracking ATMs, so no it's not good enough.
Re:If the attackers can use the source to attack i (Score:4, Insightful)
I'll let you in on a dirty little secret. When it comes to security, "good enough" is good enough.
In the case of ATMs, banks make a huge amount of money (or at least avoid losign a huge amount of business) by having them. But they don't have to be particularly secure -- just secure enough that the marginal cost of adding a bit of security is greater than the marginal increment of savings. In other words in business you don't "spend a buck to save a buck".
"Good enough" security systems abound; for example credit cards and checks. The security of these systems are extremely lax, and consequently there is a _ton_ of fraud commited with them. But the cost of paying for fraud (to the banks) is less than trying to get an increment of security. Businesses do not subscribe to the "millions for defense, not one dollar for tribute" theory of security.
It seems like a manufacturer of ATMs would be the perfect manufacturer of voting machines, until you take into account the difference between "good enough" for an ATM and "good enough" for a voting machine. Money is fungible -- a bit of fraud here and there is amply made up by profits elsewhere. Votes are not like that. Having a fair election in 95% of the districts doesn't make up for having a fraudulent election in 5%, especially when those districts can be strategically chosen.
It would be better to pick somebody with experience in systems where system failures have horrible, unthinkable results rather than a vendor where failures are just an incovenience. Somebody who makes avionics, or medical instrumenation, or defense command and control systems.
Parent
Diebold machines aren't designed to be secure (Score:4, Informative)
Parent
Re:If the attackers can use the source to attack i (Score:4, Interesting)
I'll address the second and third paragraphs first of all since it's more on topic before refuting the first paragraph.
I never said that a closed source software has to be inherently less secure than open source software. Whether the source is open or not doesn't have any direct implications on the security of the software. I said or implied that closed alrogithms are inherently less trustworthy than closed algorithms. Peer revue is an old and very well tested notion that lays the foundation for modern cryptography, and it is more than "look at the source and find flaws". I'll quickly outline the reasons for it here.
On Corey Doctorow's excellent speech on DRM [boingboing.net] he slyly called this Schneider's Law: "any person can invent a security system so clever that she or he can't think of how to break it". In other words if you thought of it then you probably only see its benifits without seeing its flaws. For someone to see the flaws they have to be able to think differently; not necessarily be smarter than you, just be able to think differently from you. The chances of getting someone to be able to do this in a small organisation is slim. Even sending it out to technical officers only increases the chances of it being found slightly.
The next reason more specific to this situation comes when you look at the likely attackers of the system. When looking at the voting machine you tend to think of politicians to be the most likely to compromise security. You might also have major corporations with a political adgenda, foreign governments, even private citizens. In other words, everyone. Not many people actually realise that this includes the programmers themselves!
Do you trust every person in Diabold? I don't even know them - who the fuck are they to have control over my vote? (Luckily I'm not American so they don't have control over my vote) If the code is secret then they not only have the means but they also have the ability to do it without getting caught! If you personally don't have access to the code you are simply giving your vote to the programmers and trusting them to do the right thing. I'm not saying that they're necessarily bad people, but there's a lot of money in the US elections, and everyone has a price.
I haven't really gone through that thoroughly and I think I've missed more than a few things but I don't really have that much time free. I'll get onto the first paragraph now. Firstly, gathering an algorithm without source from a binary is pretty trivial and as I said before the people most likely to attack these machines will have access to the machines themselves and thus have access to the binaries. Even without this, perhaps not knowing the algorithm is a disadvantage to a cryptoanalysist but even then many algorithms have identifiers in their output giving clues as to which algorithm it is. It's definitely not infinitely more useful to know the algorithm when determining what the message says. Even so if you're relying on an algorithm's secrecy to ensure security in your communications then as soon as the algorithm is released (and it most often is in more serious situations) then your communications are compromised. Yes you said all things being equal but the thing is the algorithm isn't supposed to be the secret, the key is.
Now that was a long rant.
Parent
Stupid (Score:5, Insightful)
Instead, I bet it's a pile of shit. Recycled code, buffer vulnerabilities, piles of ad hoc crap, with poor documentation.
I hope someone does find a way to exploit the code. People need to wake the hell up.
Just joking. (Score:4, Insightful)
Although, if they did vote by email, imagine the junkmail vote....
You gotta wonder about any politician that wants no paper trail of his own votes. Why is he not interested in having hardcopy proof that he really did win this or that election? (or she, or she, I hope to the gods that Americans aren't backward enough to have only male options in parliament).
Can we borrow yours? (Score:4, Funny)
Actually, our options for Parliament are even more limited than that...
Parent
Re:Just joking. (Score:4, Funny)
Cheap C!@lis for President!
No money down m o r g a g e holds Senate majority!
And plenty of HOT! NUDE! GIRLS! in Congress!
Parent
What's the problem again? (Score:5, Insightful)
If I didn't misunderstand, someone in D.C. should give this lady a call and explain to her the pitfalls of "security through obscurity" and why openness is a Good Thing.
Conspiracy theory (Score:5, Funny)
Parent
Re:Conspiracy theory (Score:4, Funny)
Too bad the stupid spell checker changed 'Sgt. Bosco "B.A." Baracus' to "Bush" and we're stuck with this guy now.
Sorry dudes, my B.
-slug
Parent
Re:What's the problem again? (Score:5, Insightful)
In other words: If diebold can't manage to secure their source code from theft then how the fuck can they be trusted to secure your vote from theft.
Parent
Re:What's the problem again? (Score:4, Interesting)
Also, it is possible that those disks were copied before they were discovered. These copies could potentially get into the hands of someone who wanted to abuse the election. Security through obscurity is no longer a good defense when your enemy has the source code. The only thing they're succeeding at is hiding flaws from the people who wish to fix them.
Remind me again why people use Diebold products?
Parent
I find it very interesting... (Score:4, Insightful)
Copyright vs. election security (Score:5, Insightful)
This is assuming, of course, that there's any overall benefit to digital voting in the first place, which there really isn't. Digital elections are a terrible idea -- stick with paper. Oh no! We'll have to wait a few more hours to have complete results! Big fucking deal.
These are the disks we returned to the state (Score:5, Informative)
Security doesn't matter if the machines are rigged (Score:5, Insightful)
Who gives a fuck if J0e Hax0r can compromise a voting machine when secret code can be installed on thousands, if not all, of the voting machines at the last minute with absolutely no oversight and nobody knowing about it? Voting, to borrow from one of the current "President's" minions, is a "quaint" and outdated practice.
So why did we move to electronic voting again? (Score:4, Insightful)
Re:So why did we move to electronic voting again? (Score:5, Insightful)
and the voter gets a carbon copy of the paper
You had me up until that part. The voter should be able to SEE the paper copy and verify it is accurate without being able to touch it. It is then whisked away, dropped down, or whatever onto a roll, stack or whatever so poll workers have a way to verify the machine counts with paper counts. If they are given receipts, this would provide proof they voted a certain way. Voters should not be given a copy since this opens the door to people being paid or intimidated to vote a certain way. Other than that point, I agree with your post.
Parent
Re:So why did we move to electronic voting again? (Score:5, Insightful)
Later:
"I lost the receipt."
"Our company no longer requires your services, we, uh, have decided to consolidate our action points to improve the synergy blah blah blah."
Parent
be cautious of a Diebold paper trail - not right! (Score:5, Insightful)
I early voted on a Diebold voter verified machine - and it's NOT good enough. I even had a nice conversation with the technical election judge, and since it did print a verified trail I did have to go home and think about this before I realized how it sucked.
They totally and complete circumvented the idea of a voter verified paper trail.
The way this machine works is you vote, it prints, you can see-but-not-touch the printout. You can vote AGAIN (up to 3 times) and it voids the previous printouts. Again, without you touching them. Which means the process expects that some percentage of its paper trail will be voided. The printouts get sent into some magic compartment.
So 1) there's no way except by noise for the election monitors to know if it printed a variety of extra votes. And they were pretty quiet.
2) There's absolutely zero way to know if it went back and voided your vote, because there's plenty of precedent for voiding votes.
3) It can absolutely tell via paper alone who voted in which order; it's on a spool. Which could be easily tracked by anyone who watched what order people voted at that machine. Your votes are even less anonymous.
*sigh*
(Ok, so I posted this on the previous Diebold story - sue me. It's important, so I reposted it, Karma be damned.)
Not 1337 h4x0rs! (Score:5, Insightful)
abc news poll (Score:3, Funny)
"Are you confident that your vote is safe and will be counted in the election?"
Oddly, this poll seems to be suffering some voting irregularities itself. Repeatedly refreshing the results yields this strange sequence:
approx 12:30am, 10-23-06
no: 738 yes: 101 ns: 86 tot: 925
12:53am
no: 743 yes: 101 ns: 87 tot: 931
12:54am
no: 737 yes: 101 ns: 86 tot: 924
12:55am
no: 746 yes: 101 ns: 88 tot: 935
12:56am
no: 670 yes: 84 ns: 80 tot: 834
12:57am
no: 721 yes: 99 ns: 85 tot: 905
12:58am
no: 734 yes: 101 ns: 86 tot: 921
meanwhile... (Score:3, Interesting)