Schneier on Security

"It seems that we have a new problem to worry about: the Secretary of State has no clue how to get a decent security review done."

I think you are crediting him with incompetence when it was actually done with malice; he doesnt want a thorough review because he doesnt want to have to spend the money to fix the problems.

Facing schedule and profitability pressures, it is fairly common today to cobble together existing code from various sources into a delivery, thereby incorporating a variety of previously unrelated bugs and vulnerabilities, and, worse, having no security integrity, so that bug fixes may be undone by unrelated code, creating emergent vulnerabilities.

It would be interesting to trace the parentage of the Sequoia code to see if any parts were lifted from elsewhere.

Just how difficult is it to build a box that can count?

http://www.theinquirer.net/?article=41449

We would be better off putting pebbles in jars than trust any of these hairbrained schemes.

The paper based human counting system has many faults, but it's good enough. It has the huge advantage of being cheap and the requirement that people have to actually turn up to vote makes systematic and automated fraud difficult (though not impossible.)

Very often, good enough, is sufficient. That last 10% is always going to be expensive to cover and you never get value for money.

The secretary of state, Debra Bowen, ran on a platform of electoral security, and has the support of a number of security experts.

The schedule emerged because the legislature moved up the California primary to February, and the law requires a six month warning if the secretary wants to raise security issues with the county elections officials, or decertify any systems.

http://sfgate.com/cgi-bin/article.cgi?f=/c/a/2007/07/28/VOTING.TMP&tsp=1

> law requires a six month warning

???? So if they find a massive vulnerability, or an actual breach, the week before an election they just what, cover it up? Throw up their hands and use the machines anyway?

"the law requires a six month warning if the secretary wants to ... decertify any systems."

That six month deadline is today - I take that to mean that if the machines aren't decertified in the next couple of hours, then they'll be in use on 5 Feb.

So, any would-be election tamperers will have half a year to study the reports, reproduce the results, and get their election-fixing software firmly entrenched. Hurrah! The long-held dream of a Zoroastrian theocracy in America may finally come true!

- Throw up their hands and use the machines anyway?

Apparently, that is the case. I think the secretary can challenge results, but local officials have the choice of the system to use.

The big scandal is the local officials: they are screaming that the systems are not the problem, and that the tests were not fair. They claim their procedures would prevent the machines from being hacked.

Which we know is a joke.

Basically, the county guys made bad purchase decisions because the previous secretary of state said the machines were OK. He was appointed by Arnold.

"Deep rooted weakness" .. wow .. you can make this same statement about any sizable project. I am sure if there was a "real" problem these guys will be jumping all over tv and internet .. instead they come up with this lame dame story.

What's the story here .. that a secretary of state doesn't know how to schedule a software review ?

I wonder what's becoming of this site, it's become a fixture for conspiracy seekers and anti-establishment fear mongers and BS keeps serving them coolaid.

@sooth_sayer:

So, let's try a thought experiment. Suppose that instead of significant, deeply-rooted security weaknesses, these researchers had found real problems. In such a case, how should they have phrased their conclusions so as to convince you that the problems they had found were indeed real?

The NSA should be given the task of developing secure voting machine standards, just as they have standards for other aspects of computer security.

@ Bruce

I'm not a lawyer and I don't play one on TV.

> Secretary of State has no clue how to get a decent security review done.

My cursory reading of the CA voting code agrees with what Bill said:

> The schedule emerged because the legislature moved up the
> California primary to February, and the law requires a six month
> warning if the secretary wants to raise security issues with the county
> elections officials, or decertify any systems.

@ shoobie01

> Throw up their hands and use the machines anyway?

Yeah, what Bill said again. They use the machines.

The CA voting code is here:

http://www.leginfo.ca.gov/cgi-bin/calawquery?codesection=elec&codebody=&hits=20

The SoS's job is to count the votes, and organize contested elections:

http://www.leginfo.ca.gov/cgi-bin/displaycode?section=elec&group=15001-16000&file=15500-15505
http://www.leginfo.ca.gov/cgi-bin/displaycode?section=elec&group=16001-17000&file=16100-16101

Really, the only recourse available to the SoS is to instigate civil proceedings:

http://www.leginfo.ca.gov/cgi-bin/displaycode?section=elec&group=18001-19000&file=18560-18578

So, Debra can only say, "These suck, you ought not to use them," the local officials get to decide whether or not to use them. And if they do use them anyway, her choices are, (a) do nothing, or (b) instigate a civil action, or I guess (c) refuse to certify the results.

But (c) is (so far, anyway) not well defined.

Clarification:

I haven't read enough of the CA code to know what the implications of the SoS refusing to certify an election are.

Yes, I verified that Bill is correct:

http://www.leginfo.ca.gov/cgi-bin/displaycode?section=elec&group=19001-20000&file=19200-19216

quote:

> 19201. (a) No voting system, in whole or in part, shall be used
> unless it has received the approval of the Secretary of State prior
> to any election at which it is to be first used.
> (b) No jurisdiction may purchase or contract for a voting system,
> in whole or in part, unless it has received the approval of the
> Secretary of State.

In other words, now that the machines have been used, the SoS can't say, "You can't use these any more" - it's up to the local officials.

> 19208. If the report states that the voting system can be used, it
> shall be deemed approved by the Secretary of State and machines or
> devices of its kind may be adopted for use at elections.

There is NO ability to revoke approval, as near as I can tell (again, disclaimer: not a lawyer).

Yes, this is a major problem. But it looks like, if the SoS declares the machines unfit, she can't do much to enforce it.

Ah, wait, I/Bill was wrong:

19222. The Secretary of State shall review voting systems
periodically to determine if they are defective, obsolete, or
otherwise unacceptable. The Secretary of State has the right to
withdraw his or her approval previously granted under this chapter of
any voting system or part of a voting system should it be defective
or prove unacceptable after such review. Six months' notice shall be
given before withdrawing approval unless the Secretary of State for
good cause shown makes a determination that a shorter notice period
is necessary. Any withdrawal by the Secretary of State of his or
her previous approval of a voting system or part of a voting system
shall not be effective as to any election conducted within six months
of that withdrawal.

So, yes, she can decertify the machines, which means that they couldn't be used.

@Richard Braakman

Real problems will be listed as :
1. This thing fails in the following scenarious .....
2. This thing can be compromised this way ....

This thing about "deep rooted" .. is in the same category as "international experts" and "really sound" and "totally useless"

Other than making nasty comments on everyone else's integrity and capability, these reports don't tell anything useful.

Thought experiments are with thoughts .. there is nothing here ..

@sooth_sayer:

Did you actually read the reports or blog posts you''re talking about?

The reports consist of several hundred pages of the form "this thing fails in the following scenarios" and "this thing can be compromised this way...". That seems to add up to "deeply rooted" by any definition.

Also, where do they make any nasty comments on anyone's integrity? I've not finished reading them, but I haven't gotten to that part yet.

I assume you're just trolling, but there are so many crazies willing to apologize for these supremely awful voting machines, I may be wrong.

IANL...but the way I would interpret 19222 above:

1) The CA SoS can simply declare the machine unacceptable / obsolete / etc and give the Counties 6 months to replace them.

If the primary is less then 6 months away, the Counties could still use the machines.

2) "Good Cause" is for emergency situations -- such as when 2 days before the election they find out there's been a systemic hack actually taken place on the machines, and she orders the Counties to use paper ballots.

==============================

> The paper based human counting
>system has many faults, but it's good
>enough. It has the huge advantage of
>being cheap

Counting ballots by hand is *not* cheap, and moreover requires having the available, trustworthy labor to do it.

The larger the ballot, the longer it takes. A simple budget referendum that's "yes / no" would be hard pressed to count more then 1,200 or so ballots / hour, and that requires at least 5 people -- a person who reads the ballot, a person who confirms the person reading, a person who tallies, a person who confirms the tally is accurately recorded, and a supervisor/judge (although he could have multiple groups he's counting).

Now I figured it was 1,200 ballots/hour for a single question yes/no referendum.

Now let's take a more typical election with a dozen positons being voted on, most of which have 2 and some of which may have 4, 5, or 6 candidates on the ballot.

You're probably talking more like 180 ballots/hour for a full count (don't forget, most "recounts" are only conducted for a single position, they're not counting by hand every position).

Your labor costs, direct and indirect, are at least $50/hour for that 5 person crew -- so you're talking $3.60/ballot to count them.

Mechanical voting machine elections run about $3,000. I don't think you'd see much of a drop in that cost with other automated systems, like optical scanned paper ballots.

With 2,500 votes cast in my town the November, 2006 elections. That's under $1 per vote.

Move to a hand counted system, you're talking adding around $9,000 to the cost of the election, or over $4/ballot cast.

Perhaps more importantly, it saves something like 70 man hours of time to count them. Either you need to double up on the number of poll workers to record them "live time" or you're looking at a day or two later before you have a final count.

My town, like most, has difficulty recruiting poll workers. Now you're asking to recruit twice as many, or have them work for 2 or 3 days instead.

It makes it a perfect place to apply technology to save time and money.

You just need the technology to be reliable and verifiable -- like optical scanner systems.

So what most of the people here who support these machines are saying is that the machines might be expensive, and let people steal the election, then use the power they get to cover it up and ensure that next time it is done the same flawed way, but that paying a bunch of people to sit and count the votes correctly takes too long, and costs money.

Sorry, but governments spend billions of dollars on whims and fancies and nice dinners, whilst voting themselves pay rises. Spending a few million on a custom built and well working voting machine, *for which they only have to promise to buy the winner of the contest* really isn't hard. The military and others have been doing it for a hundred or more years. It's called a tender.

A number of states have election security issues arising from electronic voting. Having ready online access to a state's legal code is helpful for assessing the current state of affairs, so I'm glad that Californians have that access. Some states, Georgia among them, direct official state web site visitors, when the option for the state code is selected, to a gateway controlled by LexisNexis. The gateway has no information as to how a visitor without a business or academic registration might register and get a password.

"You just need the technology to be reliable and verifiable -- like optical scanner systems."

@Matt from CT

As the recent, Florida-sponsored, July 27, 2007 SAIT "Software Review and Security Analysis of the Diebold Voting Machine Software" noted on p.3, opscan systems are not without flaws:

"As an example of the issues that remain, flaws in Optical Scan software enable a type of vote manipulation if an adversary can introduce an unofficial memory card into an active terminal before the voting (or early voting) period (e.g., during 'sleepover'). Such a card can be preprogrammed to alter the correspondance between physical bubbles on the scanned paper ballots and the candidates with which they are associated. Specifically, it can be used to essentially swap the electronically tabulated votes for two candidates, reroute all of a candidate's to a different candidate, or tabulate votes for several candidates of choice toward another chosen candidate. We implememented this attack in the laboratory. The attack succeeds despite new protection mechanisms apparently designed to protect against similarly-documented attacks in previous studies."

http://election.dos.state.fl.us/pdf/SAITreport.pdf

Deploying a system with a capability for an independently auditable ballot is just an initial requirement.

The results from theoretically software-independent (SI) election system must actually be independently tallied--or at least independently audited--before the system should actually be considered SI.

In the past, I've proposed fully-redundant counting subsystems. Others pointed out unresolved problems with that particular proposal in assuring receipt-free properties. But, on the whole, fully-redundant counting subsystems seem affordable.

At the very, absolute least, actually auditing the results from the vote tally is essential: An opscan system by itself is not sufficient.

"[California Secretary of State Debra Bowen] wants to do the right thing, but has no idea how to conduct a security review."

Bruce,

Fwiw, on March 22, 2007 the California Secretary of State's office made its "Draft Criteria for Top-to-Bottom Voting Machine Review" available for public comments.

Press Release:
http://www.sos.ca.gov/executive/press_releases/2007/DB07_008.pdf

Draft Criteria:
http://www.sos.ca.gov/elections/voting_systems/draft_top_to_bottom_review.pdf

The deadline for public comments was Mar 30, 2007. Obviously, that deadline has long since passed. But what were your comments on the draft criteria?

In your opinion, how should this review have been conducted?

@nedu
The draft was published March 22, 2007 and the deadline on March 30, 2007, that are only six workdays. Was the fact of the publication made widely public, was it in at least some news or was the link at the website the only way to know it?
A press release ist worth nothing if noone publishes it except yourself on your website.

> In your opinion, how should this review have been conducted?

Not how but when: before any line of code had been written and before any screw had been turned. Then regularily while the work is in progress and when it is finished and when it is used.
The design must be done formaly and be able to be proved mathematically (I would propose a formal language for that purpose. The logic is not very complicated and straightforward, even something simple like ISO-Z would be sufficient). At least where possible because it's in most cases very difficult to find a provable correct compiler/interpreter for your programming language of choice. COTS hardware is also difficult to dissect and building hardware yourself is expensive.

CZ

I find it very irritating that people here are actually discussing the security of voting machines, though the whole idea should be critized.

The point about democratic elections is that they should work without trust as a prerequisite. It should be possible that, although two parties cheat on each other whenever possible, the overall result can still be trusted, as manipulation can only effect small fractions of the result (the system fails sensibly). Think about glass containers for the votes, that everybody can observe (using his/her own understanding of the laws of physics) that no manipulation is taking place!

Only the full confidence that the result can be trusted established the necessary legitimation for the politian voted into office.

The need to "ceritify voting machines" by "independent experts" already shows that there is some perlimary trust needed. Such a system is wrong.

I find it very interesting that we are telling other nations how they should run elections, and actually go there to observe honest elections, yet we seem unable to do the same in our own country. Perhaps we also need independent international observers?

Been there already ...

http://www.cnn.com/2004/ALLPOLITICS/08/08/international.observers/index.html

http://www.osce.org/documents/odihr/2004/11/3779_en.pdf

I just wanted to thank Pat Cahalan for taking the extra minutes to review the actual articles on the topic and commenting, instead of adding more knee-jerk opinions. The vitriol should be aimed at the state workers and companies that insist nothing is wrong, these machines are fine. Bowen should be praised and supported here for such an aggressive stance towards getting the problem addressed; if we had put people like her in office at the beginning when these things were first showing up, we might actually have seen real security reviews from the very start, and not emergency reviews and hot-patches.

@bill, @shoobe0:
"- Throw up their hands and use the machines anyway?

Apparently, that is the case. I think the secretary can challenge results, but local officials have the choice of the system to use."

Challenging the results is useless, see the history from FL, 2000 Presidential election.

Selective malfunctions were used to skew results by invalidating ballots from demographically biased precincts. (Here's how: hanging chad result from failure to properly clean and maintain machines, if you make sure that happens where demographics indicate you want an undervote but not where demographics favor your candidate, you skew the results.) Challenges went all the way to the Supreme Court and the modified results were upheld.

Local officials in those same precincts now defend their present electronic voting systems. Wonder why?

@RC: "The NSA should be given the task of developing secure voting machine standards, just as they have standards for other aspects of computer security."

Fast forward a few decades.... "Gee, isn't it funny how only the Presidential candidates who promise increased funding for the NSA manage to get elected."

I don't think anyone posted...per an NPR news clip I heard over the weekend, the California Secretary of State has decertified the machines and they WILL NOT be used for the Primary.

@Nebu:
>At the very, absolute least, actually
>auditing the results from the vote tally
>is essential: An opscan system by itself
>is not sufficient.

Absolutely. An audit only requires a small fraction of the counting a manual count requires, and it can take several forms.

@Bernd:
>I find it very irritating that people here
>are actually discussing the security of
>voting machines, though the whole
>idea should be critized.

You could drop the whole security word.

In the end, we're talking about Accuracy. In most elections, it doesn't matter since the margin of victory is greater then the margin of error.

My state has long had procedures in place when elections are so close to require an automatic recount, and when there is a wider margin of victory but still close enough the losing candidate has the right to demand a recount.

Mechanical machines can be shown to be accurate by a mechanic. He can show all the sprockets and levers.

Media that is marked primary by the voter (like optical scan ballots or punch cards) can be trusted to accurately reflect their intent.

The problem with voting machines which the primary means is electronic to mark the ballot is verifying the accuracy -- you must expect knowing our society most voters will not take the time to verify the paper "receipt." Once an audit discrepancy is detected, which do you trust to be accurate? The machine that recorded the vote directly, or the same machine that produced the receipt that doesn't match the vote?

@Anonymous
>Selective malfunctions were used to
>skew results by invalidating ballots from
>demographically biased precincts

Most of these allegations of poor procedures are strongly associated with areas of a heritage of corrupt Democratic machine politics. In an area controlled, traditionally, by Democrats it really didn't affect the outcome of Citywide / Statewide / National power. What it did affect was internal Party politics of one Democrat against another.

These local pockets of corrupt political culture has become more obvious due to recent closeness of major races, and that the corruption has spread to Republicans -- specifically, Republicans in areas that formerly had Democratic machines designed to suppress the black vote. The corruption spread when the white fled the Democratic party in the south.

It's nothing new -- just remember the famous slogan of Democratic Chicago Mayor Richard Daley -- "Vote Early and Vote Often!" and such practices of the dead voting and people voting in multiple precints were endemic in certain Democrat machine controlled urban cities through out the nation and rural areas of the South for all of the 20th century.

Bruce: to be fair, the schedule wasn't entirely the Secretary of State's discretion. In order to decertify machines for the February primary, the Secretary of State had to announce her decision no later than yesterday; in order to give her time to respond to the review, the review had to be finished no later than a week ago.

Yeah, it could have been started earlier; but she was sworn in in January and started the process in March --- I'm not sure how much faster it's reasonable to have expected her to get things done.

Bob: I think you are accusing someone of malice without knowing anything about them. California's Secretary of State is a *she*, and she specifically campaigned for the office on this issue.

Bill: the local officials are generally speaking computer illiterate, and are not to be trusted with this decision. (I'm a poll worker, and a software engineer; the poll worker training I received claimed, among other things, that the Hart machines weren't computers).

Christoph: arguably you are correct that this should have been done before any code was written. But given that a previous SecState had approved the machines, that was no longer an option.

Aphrael is right; Bowen only won election in November '06.

As a member of the legislature she led a well-regarded review of e-voting systems problems last summer...

I'm going to have to agree with abacus on this one; I don't think the investigation was rushed because Bowen doesn't know how to run an audit, I think it was rushed because it had to be finished in the allotted time to have any effect on the '08 election.

@Matt
> You could drop the whole security word.
>In the end, we're talking about Accuracy. In most
>elections, it doesn't matter since the margin of
>victory is greater then the margin of error.

I disagree. The point is indeed security. We consider the leverage of a villain. If we have manual voting, then the leverage is much smaller when compared to a villain who manages to manipulate a voting machine.

Also, even if "we engineers" are able to build a really safe voting system: The problem that the average John Doe cannot verify the voting procedure opens up a whole new world for conspiracy theories and erodes the legitimation of the politicians. This is poison for democracies, where the minority has to accept that they are governed by the party that got the majority.

http://www.engadget.com/2007/08/05/california-official-gives-ok-to-voting-systems-that-failed-secur/

"California Secretary of State Debra Bowen up and decided Friday that those severely vulnerable Diebold, Hart, and Sequoia voting terminals would still be cleared for takeoff, provided the companies in question supply their machines with updated firmware, disabled access to unused ports, kill the wireless connections, and so on."

OQ: that's inaccurate. The full text of her decision is available on her website, but what it boils down to is this --- HAVA requires that blind and disabled voters be allowed to vote unaided. A *single* machine is allowed in each polling place to accomodate these voters.

She's between a rock and a hard place on that; if she doesn't allow these machines to be used for disabled access, then California is in violation of federal law, and the Justice Dept can step in.

---

People interested in this topic should check out today's forum (a local npr call in show), which featured her and various county elections officials discussing the decision. An mp3 will eventually be available here.

@Matt from CT, "@Anonymous
>Selective malfunctions were used to
>skew results by invalidating ballots from
>demographically biased precincts

Most of these allegations of poor procedures are strongly associated with areas of a heritage of corrupt Democratic machine politics. In an area controlled, traditionally, by Democrats it really didn't affect the outcome of Citywide / Statewide / National power. What it did affect was internal Party politics of one Democrat against another."

Um, Matt, hanging chad gave W the white house win in 2000. That's certainly affecting national power, and something no side on any internal Democratic party politics would want to see.

So I think you're blowing smoke. W's brother, the governor of Florida, and his cronies stole that election, no two ways about it.