Life in Central America

FBI raids evoting activist

From the slashdot site

Doc Ruby writes "Investigating a crack of eVoting company VoteHere, the FBI is said to be issuing a subpoena for the traffic logs of journalist Beverly Harris' BlackBoxVoting website. The FBI is pursuing Harris on the theory that her site is the connection between incriminating memos leaked from (VoteHere competitor) Diebold and the intrusion into VoteHere's servers.

However, as one commenter said:
------
A website exposing the republicans' (the guys who are in power right now) connections to fixing voting machines all of a sudden gets raided by the FBI because the FBI thought they might have logs pertaining to the theft of logs at Diebold, a corporation republicans have a lot of dealings with.

Of course, it won't be spun that way in the mainstream media. No mention will be made to the connection between Diebold and republicans, and Diebold will be spun as a nice corporation that had some critical documents stolen by nefarious kniving hackers. Not to mention the humiliating defeat in california the company had.
------
Are you on Bev Harris's mailing list, by any chance?

Digital democracy?

I have written about this, and I have lectured about it, and it hasn't made a darn bit of difference.

I said 'This is a bad, bad, bad idea.' People remembered this particular quote (my sound bite), but not much else.

Meanwhile, this bad, bad, bad idea keeps rolling along. It even dropped of the Internet radar screen for a while, so I was glad to see this article on Mother Jones.
-------
The most startling find was that it's possible for someone to silently enter the system and edit votes without leaving a trace. This could be done, for example, using the GEMS vote-counting computer located in each e-voting county.

Activist Bev Harris described how anyone within reach of that terminal, "whether that's the election supervisor, their assistants, the IT people, the janitor," has election results at their fingertips:

You don't even need to break in. It will open right up and in you go. You can change the votes and you can overwrite the audit trail. It doesn't keep any record of anything in the audit trail when you're in this back door.

The other situation would be supposing someone gets in by either hacking the telephone system or by going backwards in through the Internet, because the Internet does connect to these GEMS computers, even though they deny it. A lot of the press watches election results come in on the Web and what they're watching is actually being uploaded directly off the GEMS computer.

We must have control over our voting software

The trend towards voting computers is irresistible, but dangerous. Voting computers are like a Trojan horses, they look attractive, but we don’t know what is inside them.

Or, to use another analogy, from the Wizard of Oz, they are run by the men behind the curtain. We cannot allow these shadow persons to control our voting. We must control it ourselves.

In practical terms, this means the source code for our voting computers must be openly available, not proprietary secrets of the voting machine companies. This has already been done in Australia, and we could follow their example.

Our voting software should be developed by public entitles and exposed to intense public scrutiny. And only that software should be used on our voting computers. This is similar to the situation in most personal computers, where the computer manufacturers use outside software (Microsoft Windows), instead of developing their own. But our voting software must be more secure than Windows, we don’t need viruses in our voting software.

Perhaps some will object that we don’t have time for that now. We should go ahead and use the new voting machines that are available, with some minor improvements, such a printed backup ballots - because our present voting technologies, are defective. We disagree. Most of our present technologies, such as punch cards, can be easily and inexpensively recalibrated. We should continue to use our present technologies, with improved certification procedures. We need to improve our peopleware (our voting process) before we tackle the intricacies of software.

We need not rush into the future, without knowing where we are going.

Diebold PR department files early entry in 2004 "Black is White" contest

From SiliconValley.com

"Maryland Security Study Validates Diebold Election Systems Equipment for March Primary." That was the title of the self-congratulatory press release issued by Diebold in the wake of a report that found its voting machines to be horribly insecure. According to scientists at Raba Technologies, the consulting firm hired to hack into Diebold electronic voting system, it was an "easy matter" to use the system to steal an election.

"We could have done anything we wanted to," William Arbaugh, a University of Maryland assistant professor of computer science who participated in the study told Wired News. "We could change the ballots (before the election) or change the votes during the election." Odd then that Diebold would claim that the report confirmed "the accuracy and security of Maryland's voting procedures and our voting systems as they exist today." But it did.

"They took a study that was highly critical of them and claimed victory," said Avi Rubin, director of the Information Security Institute at Johns Hopkins University and author of an earlier report critical of the Diebold system. "I don't understand the continuous need to insist that things are OK." Said consultant Michael A. Wertheimer, a former National Security Agency analyst,

"You are more secure buying a book from Amazon than you are uploading your results to a Diebold server," recommending several changes to increase security.

Voting reform unfinished

United Press International; 10/21/2002

Election 2002: Voting reform unfinished (Part of UPI's Special Report on Election 2002)

WASHINGTON , Oct 21, 2002 (United Press International via COMTEX) -- Only a few states have taken dramatic steps to fix an election system that many say is broken, leaving some voters in the Nov. 5 election still at risk of having their vote diluted.

After the fiasco in Florida following the 2000 federal elections, election reformists and civil rights groups called for widespread and immediate changes to the way elections are run with regards to voting machines, poll workers and registration procedures. However, tight state budgets, brought on by a slumping economy, have prevented many states, if not most, from making substantial changes.

"Little has changed ... despite an apparent groundswell following November 2000," said a 2001 report from the Virginia-based Election Reform Information Project, supported by Pew Charitable Trusts.

"There could be more 'Floridas' than less this year, because there has not been enough significant change," said Maine's Secretary of State Dan Gwadosky. "It's a funding issue."

That funding was promised by Congress earlier this month --- $3.86 billion over the next three years. If President George W. Bush signs off on it, some of the cash could begin flowing to the states almost immediately. But it won't be soon enough to have any effects for this election.

Thus far, only a handful of states, including Georgia, Maryland and Pennsylvania, have instituted major changes in the nation's locally administered elections system, according to Gwadosky.

Optical scanners are the second most popular upgrade for states making changes, after the more popular new computerized touch screen voting machine, according to Election Data Services.

Problems with voting machines, ballots or ballot counting methods are not the only causes of election chaos. The poll workers and the voters themselves are in need of additional education and training, according to elections administrators.

"We've experienced problems with the 'people' part of the process," said Linda Lamone, administrator for the Maryland State Board of Elections. "Poll workers are not paid a lot, they are asked to work 18-hour days. ... They are the weakest link in the system. We are relying on these people to work out of the goodness of their hearts to do this."

This is why diverse election reform groups, such as the NAACP, The League of Women Voters, Georgetown University scholars and Rock the Vote recommend more pay and education for poll workers and more education for voters.

"The answer to all the problems is not just new equipment. We need better training for poll workers, more poll workers, and better education for voters," said Ricci.

States are also increasingly adopting central computerized voter registration databases. According to NCFER, almost 40 percent of voters live in a state with a statewide voter registration database. A central voter database helps prevent voter fraud caused by ballot box stuffing, "ghost voting" under a deceased person's name or "repeater" voters, that group said.

Thirteen states -- Arizona, Idaho, Indiana, Maine, Mississippi, Nevada, New Hampshire, New York, North Dakota, Oregon, Pennsylvania, Vermont and Wisconsin --do not have central voter registration databases, according to a July 2002 report by the Constitution Project.

Activists are also calling for streamlined procedures for military and overseas voters, who have to register and request a ballot weeks in advance. Some activists say every state should have one designated official for absentee and military voters.

"This is a bedrock issue --- one of the very tenets of democracy," said Maine's Gwadosky. "It's not as exciting as other issues but it's a long-lasting issue. The credibility of the government rests on the integrity of the election process."

Badmouthing punch cards

From the Center for Voting and Democracy
------
Much existing equipment, such as punch card systems, in addition to being unreliable, is not compatible with ranking candidates or "clumping" votes as in cumulative voting.
------
NOT TRUE!

You can do very sophisticated processing with punch cards, it's all done mechanically, but you can see exactly what is going on. This business about their being unreliable is just not true.

This whole computer voting thing is just a distraction, a red herring. Before we know it we will end up with a system which looks flashy, but is easily corrupted. We need to keep things out in the open, instead of hiding them inside computers.

But I’m beginning to realize I have a hopeless task. Americans are so enamored of computers, they won’t listen to common sense. They think punch cards are an “obsolete technology”, the worst thing imaginable. To which I reply “Is the wheel obsolete?”

Badmouthing computers is like madmouthing someone else's wife. The husband can do it, but other people have to be careful.

Election reform

The Democrats Abroad of Costa Rica has been concerned about the voting crisis in America. We agree with the Election Assistance Commission, which was established by the Help America Vote Act (HAVA), that the present crisis in voting is primarily caused by the shortage of poll workers. There used to be an ample supply of unemployed housewives who were happy to get up a 4 AM to make sure the voting procedures were followed. These are now in short supply, and no one has taken their place.

We are sure there are many citizens who would be glad to perform this task, if they could just get off from work. We are also sure many of America's companies would be willing to allow their workers to do this, if they were asked to. The Federal Government needs to make this effort. Perhaps high school students could be used, and this would help them understand the voting process. There are many possibilities, and these need to be explored and acted on - soon.

Computer Voting

We are also been concerned about the possibilities of voter fraud due to voting by computers. There is ample evidence that the voting computers now being purchased with HAVA funds are defective, and should not be used. And it is our belief that computers should not be used to voting at all, at least until the technology is greatly improved. There is an existing technology, punch cards, which is safer and more reliable.

The debacle in Florida has been blamed on punch cards, but this not the case. Properly aligned punch card stations are one of the most secure devices known to science, and it is easy to test them for proper alignment. This is not the case with computers. It is very difficult, and in some cases, nearly impossible to tell what is going on in a computer.

Rush Holt's Help Bring Back Integrity to the Voting Process in the USA act requires voting computers to also provide paper ballots, which then can be used to provide a recount, if necessary. But how do we know when computer voting has failed? Why use a computer to print a paper ballot when a punch card station provides a ballot that is machine-readable (very quickly) and also human-readable?

Punch cards are an appropriate voting technology, and computers are not. Besides, they are much more expensive.

Other voting reforms

Our voting process has been developed over time and served us well, but this process varies from country to country, and from state to state, and uses a variety of technologies. There should be one voting process that is developed and administered at the Federal level, with certification of every polling station. This standardization is similar to many commercial endeavors, where different companies agree on how they are going to do things. ISO certification is a good example.

---- add other reforms here.

New technology is dangerous

This is true on many levels, but especially true for security issues. Let me give you the perfect example. Just before WWII, the Germans developed a new encryption device, and they called it the Enigma Machine. This was a devilishly clever device, and they had complete confidence in it. They did a mathematical analysis that proved that the Enigma code could not be broken. This was just pure arrogance, there is not such thing as unbreakable encryption, and Enigma was no exception.

The British got their best brains to crack the code. Some of these guys were downright weird, but they were bright, no doubt about it. And they cracked the code. The Germans were a big help. In messages to their submarines, for example, they always had a standard header: From Subcommandpak, and so on. This was blatantly bad encryption practice. And they only made minor variations in their coding, and kept using the same machine. And what’s more, they sold the machine to the Japanese, and the Japanese were just as arrogant (and ignorant ) as the Germans. The Americans improved on the British work, and even designed machines to help break the Japanese code. This was a big help in winning WWII.

Nowadays, the biggest new technologies are personal computers and the Internet. These were not designed with security issues in mind (or a lot of other issues), and they will probably be replaced completely some time in the future. Meanwhile, we have to recognize their limitations, and not use them where high-security is required – electronic voting, for example. We have to remember the Enigma Machine.

Our right to vote is under attack

My talk this morning is supposed to be about electronic voting, but first let me talk about some bigger issues. I am worried about the political situation in the States – and I am not just worried, I am paranoid.

The CEO of Sun Microsystems wrote a book Only the Paranoid Survive, and one of our early patriots said: The Price of Freedom is Eternal Vigilance. I believe our freedoms are under attack on a broad spectrum, but today I want to concentrate on one of those freedoms: the Right to Vote.

Most of you saw the video last month about the voting scandal in Florida during the last election. These disturbing events were used to discredit the use of punch cards for voting, and the substitution of voting computers. This is a big mistake. Punch cards are an appropriate technology for voting, and the computer voting machines now on the market are not. A punch card voting station that is properly designed, with sharp-eyed observers, is about as fraud-proof as any human system can be. And they are inexpensive.

Computer voting could be just as good, if careful attention was paid to their design. And if their programming was open to public scrutiny and they were carefully tested. But computer voting does not give us any capability we do not have already. And they are much more expensive and much harder to control.

My main function today is to educate you about computers. Probably some of you already know about computers, and you can support me in what I say. Here is my outline:

Computers only do what they are told to do
Bad programming is easy
Good programming is hard, expensive, and rare
Computer fraud happens, and it can be a bitch

Let me finish with some remarks about online voting. This is obviously the wave of the future, but that future is not anywhere near. Computers have their problems, but a network of computers have really big problems. Personal computers linked on the Internet are just barely adequate for commerce, but totally inadequate for applications like voting, where the whole country depends on the outcome.

I know this is frustrating, because I would like to be able to vote online from Costa Rica myself. Unfortunately, the technical explanations behind this are more than I can cover today. Online security is a big subject, I have worked at understanding it, but I still feel ignorant. But I know enough to back up the security experts hired to evaluate SERVE (Secure Electronic Registration and Voting Experiment), an online voting system being developed by the Pentagon. Let me quote from their report.

It is impossible to estimate the probability of a successful cyber-attack (or multiple successful attacks) on any one election. But we show that the attacks we are most concerned about are quite easy to perpetrate. In some cases, there are kits readily available on the Internet that could be modified or used directly for attacking an election. And we must consider the obvious fact the a US general election offers one of the most tempting targets for cyber-attack in the history of the Internet, whether the attacker’s motive is overtly political or simply self-aggrandizement.

But there is some good news. Just two days ago I got this off the Net.

They're recommending a system that would let pre-registered voters log onto dedicated terminals at military bases or consulates for ballots from home counties. Trained elections officials would maintain software and machines. Only voters with approved military IDs or SERVE-authorized IDs could log in.

Never connected to the Internet, kiosks would receive software and voter databases on disks delivered by certified mail. Voters would print and sign ballots and mail them back their registrar.

This sounds more like it, but the Pentagon is still determined to go ahead with SERVE, anyway.

Despite Challenges, New Federal Voting Commission Is Eager to Get Started

From electionline.org

This backs up what I said in my posting The American voting system doesn’t work

A federally-mandated agency envisioned to help states navigate the Help America Vote Act (HAVA) was plagued with delays since the law passed in 2002. Now, as the Election Assistance Commission (EAC) begins operations in Washington, D.C., a new set of challenges lie ahead.

On January 2, their first official day of work, the commissioners were struggling to get going without an administrative staff, a budget or an office.
---------
While news story after news story has focused on voting machine technology and security, it appears to Soaries that states will face an even bigger challenge the next time voters head to the polls.

“You could have flawless technology at every voting precinct in America, but if you don’t have people willing to get up at 4 A.M. to assist people at the polls... that’s the big challenge, national recruiting, training and deployment of poll workers,” he said. “In my mind that’s the most compelling issue we face as a country.”

There has been a cultural shift, Soaries points out from the post-World War II housewives who dutifully filled poll worker positions to a generation that is “unavailable.”

If the country can’t turn out enough poll workers, “some of the more sexy volatile issues that we like to debate will be moot,” said Soaries.

“We have a real national challenge in this regard and to downplay that aspect of the challenge is to miss the potential threat to our goal,” he said. “I know [poll worker recruitment]’s not as interesting a subject as technical sabotage, but at the end of the day that’s the most common challenge nationally.”