Schneier on Security

Jonas Ö • October 15, 2010 6:40 AM

I worked as an election official (a the lowest level) in the 1998 election in Sweden (I'm a Swedish citizen) and I've stood for election at the municipal level in all elections since then. All votes in Swedish elections are made by putting a piece of paper, roughly 4x6 inches in size, into a sealed envelope; these envelopes are then opened and counted by hand at each voting location.
Sometimes counting machines (standardized bill counters) are used to verify the manual count.

Most votes are pre-printed with a party name and a number of candidates. These votes are sorted and placed into different stacks according to party name.
Votes that do not have a pre-printed party name on them are inspected by at least two different election officials; if the hand-written party name on the vote is identical to or sufficiently close to the name of a registered party, the vote is transferred to the stack with the corresponding pre-printed votes. Otherwise these "odd" votes are recorded, manually, onto a special piece of paper.

The resulting vote totals are recorded on paper; the count is then signed and counter-signed by election officials on-site. This official count and all votes are then transported to central counting stations for a second round of counts.

This initial round of counting is usually completed some 6-8 hours after closure of the voting station. (In 2010, there were 5668 voting stations; some 6 028 000 votes were recorded in the national level).

In the second round of counting OCR scanners are used, but only for the pre-printed votes - they are used to capture votes for individuals within the registered parties. To my knowledge, hand-written votes are always dealt with manually, and usually they go through several stages of manual interpretation and recording (both pen-and-paper and keyboard-and-screen recording) before they are committed to a database. So an SQL injection attack using this signalling path is a looong shot.

So I strongly doubt that the hand-written party name
pwn DROP TABLE VALJ
(VALJ means "elect" in Swedish) was meant as a serious attempt at disrupting the Swedish elections.
Despite the fact that The Economist reported it as "an attempt to sabotage the Swedish election" or some such nonsense.

The list of all hand-written votes is at
http://www.val.se/val/val2010/handskrivna/...