One of my readers (yes I actually have at least one that’s not related or an outside friend) pointed out an article that he was working that has been picked up by the media.
The issue it seems is in the method that Ohio ballots are marked and recorded. While I will provide you with the links to the technical side of this type of attack, the results are tragic in the face of democracy.
Our system of government relies on a secret ballot. Some people have no problem sharing who and what they are voting for. Others however feel undo pressure from peers if someone else knows how they may vote on unpopular issues. For example, that property tax hike that you campaigned against for months and invested time and money in fighting, well you could go down and see all the people that voted for it after it past. Some less scrupulous people could use this information to harass the voters that passed it. After this harassment has taken place there will be more outside forces that can cause that voter not to vote their conscience the next time.
Since this is one of those rare opportunities where you can ask the person that discovered this bug (he e-mailed me first) I sent this back to him
“.….I’m just curious what your thoughts are on how to fix this hole?
Do you wish them not record time stamps or not have a paper trail? Electronic voting machines have several known vulnerabilities that can lead them to manipulation? I can see that you would rather have a ballot form of paper trail since these could theoretically be mixed up so you can’t them orderly, but at the same time the anonymity is only going to be aggregate to the amount of data you collect. In other words in small elections turn outs it will be easier to decipher who voted which way then a large voter turn out.
An easy immediate step to help insure security of these records without the additional cost of voting machines would be have the pollsters record the voting numbers randomly instead of orderly without time stamps since we only really need to verify they are eligible and do not need to record which order they came in to vote accurately.……”
A few hours later (we all have day jobs) he sent me this response:
“…I still see electronic voting as superior to hand-counted ballots. My opinion on the details changes ;-) but currently I would like to see implemented
- separation of ‘vote’ and ‘event’ logs (similar to ES&S’s Unity database)
- sorting of ‘vote’ logs by content, rather than a deceptively insecure [pseudo]random sequence.…”
I have some personal issues of course with electronic voting machines and while I’m not going to put in the complete exchange we discussed here is the relevant part of my reply.
“.…..I’ll agree that electronic voting machine are superior, especially in the amount of time to tally the votes and accuracy. The things I would like to see implemented is an open source approach to the code (I’m not a linux zealot as most my computer are windows) as this can have a verified security through the process of code review. The main coders would just have to publish the code but maintain all changes by the in house programmers after suggestions of a code review — since it would not be advisable to take custom code in from normal coders — the maintainers would still be accountable for accuracy and reliability.
The next thing would be a split printer paper trail where it could maintain one copy for archival purposes and possible manual tallying to verify votes were counted accurately by the computer and a mirrored copy that would be printed out for the voter to verify the accuracy of their vote. While there would need to be a mechanism for the archival copy to be destroyed if the voter decided to change their vote or found an inaccuracy in their printed ballot — this for the most part would be a trivial proposition of an enhanced paper tray.
But all in all I agree with you — of course for Ohio vulnerabilities the intern that took the back up home on a flash drive full of public records as the states way of maintaining off site records is a far worse exposure that I hope can be corrected along with the voting issue.…..”
Now this is something that really needs to be addressed quickly. It does not effect all Ohio counties but please pressure your officials to make sure that you are not using the type of equipment that can cause this exposure to your private data. In the end your privacy is all you have that will truly always be yours.
Recent Comments