Software Bug Adds 5K Votes To Election

eldavojohn writes "You may be able to argue that a five-thousand-vote error is a small price to pay for a national election, but these errors are certainly inadmissible on a much smaller scale. According to the Rapid City Journal, a software glitch added 4,875 phantom ballots in a South Dakota election for a seat on the city council. It's not a hardware security problem this time; it's a software glitch. Although not unheard of in electronic voting, this bug was about to cause a runoff vote since the incumbent did not hold a high enough percentage of the vote. That is no longer the case after the numbers were corrected. Wired notes it's probably a complex bug as it is not just multiplying the vote count by two. Here's to hoping that AutoMark follows suit and releases the source code for others to scrutinize."

Re:How hard is it for a computer to do addition?

[stickrnan]

i++; is essentially the same as the statement i=i+1;. If you have multiple threads running at the same time you can potentially lose data should more than one thread try to assign i the value of i+1 at the same time.

Pseudocode

[Jamamala]

I posted a question yesterday about what was wrong with a simple program. No-one seemed to know so here's my attempt at writing that simple program. Feel free to tear my ideas to pieces. Hint: I am not a programmer.

MAIN:
print("Please enter your Voter ID")
scan, store as voterID
if (voterID == any value in array of legal voters)
then run the vote program
else {
print("Error")
go back to main }

VOTE:
print("Enter your choice of candidate")
scan, store as candidate
if (candidate == A) {
then record vote for candidate A
remove voterID from array of legal voters
exit }

elif (candidate == B) {
then record vote for candidate B++
remove voterID from array of legal voters
exit }

else {
print("Error")
go back to vote }

ballot browser

[mtrachtenberg]

There is a very simple, comparatively low-tech fix for broken elections that involve paper ballots.

As we do in Humboldt County, CA, run all ballots through an off-the-shelf scanner and run an independent count with independent, open source software. Ballot Browser (open source, Python, GPL from me) is available for tweaking and the basics are explained in April's Python Magazine. Or, it's really not that difficult to write your own bubble-reading software.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:How hard is it for a computer to do addition?

[The Moof]

That was the whole point of the code. He was answering the GP's question "How can a computer 'add phantom ballots'?"

Or at least I hope that was his intention.

Re:How hard is it for a computer to do addition?

[Enigma0498]

How do you know this system is fraud free? Reading your comment doesn't convince me one bit. I voted too, in the Netherlands, and for the first time in years I had to use a pencil again. No guarantee that there are no counting errors, but they won't be systematic on a large scale.

The Belgian government publishes the source code of the voting software the moment the bureaus close. The software of yesterday's election can be found here: http://www.ibz.rrn.fgov.be/index.php?id=1152&L=1 [rrn.fgov.be]

Re:How hard is it for a computer to do addition?

[buchner.johannes]

I'm not a programmer but why would totalVotes[candidate]++; not work?

Is it a race condition, it pulls the number adds one and puts it back, and if the system is run parallel it will drop vote added at the same time?

Because totalVotes[candidate]++ really is
totalVotes[candidate] = totalVotes[candidate] + 1
which is
temp = totalVotes[candidate];
totalVotes[candidate] = temp + 1
and with 2 threads this might look like this:

Thread1: tempA = totalVotes[candidate];
Thread1: totalVotes[candidate] = tempA + 1
Thread2: tempB = totalVotes[candidate];
Thread2: totalVotes[candidate] = tempB + 1

Or like this:

Thread1: tempA = totalVotes[candidate];
Thread2: tempB = totalVotes[candidate];
Thread1: totalVotes[candidate] = tempA + 1
Thread2: totalVotes[candidate] = tempB + 1

The issue is that the ++ command (increment) is not necessarily atomic. Either you make it atomic (operating system or hardware), or you need some read-write concurrency strategy (a synchronisation strategy like locks).

Also see Readers-writers_problem [wikipedia.org]

Verified Voting

[Presto Vivace]

Verified Voting [verifiedvoting.org] also does great work.

Hacking Democracy anyone?

[gubers33]

The documentary "Hacking Democracy" talks about bugs like this one as well as poorly written and easily exploited code used in these systems. It why one such system was banned from use in California. It is amazing how many government tools use extremely poor code not just voting machines, but breathalyzers and other vital hardware.