Electronic Voting Machine Insecurity Michael Plasmeier theplaz.com
A Hack
Harri Hursti
Video of hack animation
Question“Yes”“No”Total Votes Memory Card Set 5-50 “Zero Tape”000 Actual Ballots268 Machine Total718
Question“Yes”“No”Total Votes Memory Card Set 5-50 “Zero Tape”000 Actual Ballots268 Machine Total718
Question“Yes”“No”Total Votes Memory Card Set 5-50 “Zero Tape”000 Actual Ballots268 Machine Total718
Ballot scanning
Question“Yes”“No”Total Votes Memory Card Set 5-50 “Zero Tape”000 Actual Ballots268 Machine Total718 8
Scientists at Berkeley University confirmed the Hursti Hack and found 16 more security flaws
Diebold’s Response “a very foolish and irresponsible act” “leaving a car’s keys in the ignition and the windows down”
Why does the memory card support negative counts? Why then, did the machine print an incorrect “zero tape”????
Ion Sancho, Leon County trouble buying new machines got court order to allow still uses not many people actually use takes extra precautions no overnight
How this Came to Be
Florida
Help Americans Vote Act 2002 $3.9 billion $$$
Business and $$ Before no $$ in voting machines Old lever machines used for 40 years Counties did not buy them Not as much attention on them
Diebold’s Business Diebold was $3 billion ATM maker Bought a smaller company Which got the touch screen technology from a company making machines for the mall No emphasis on security
First get into a business you don't understand, selling to customers who barely understand it either. Then roll out your product without adequate testing. Don't hire enough skilled people. When people notice problems, deny, obfuscate and ignore. Finally, blame your critics when it all blows up in your face
The Real Problem
Secrecy Code is secret No design documents public Reviews/Audits secret Independent investigations discouraged
Secrecy One NJ county wanted to loan Princeton researchers some Sequoia machines to test Sequoia threaten to sue Violate the license agreement
Secrecy Claimed machines tested by Independent Testing Agencies (ITA) “shocking history of sloppy, incomplete and non-existent testing“ EAC on CIBER 2006
Mitigating Factors
VVPAT
Mitigating Factors Open Source Less vendor control Firefox is percepted to be very secure SSL is used by millions of people to conduct business online
Why?
Essential to Democracy Transparency Can’t secure from admin Must maintain vigilance