Schneier on Security

Clive Robinson • April 9, 2015 1:35 PM

I feel sorry for the researchers who’s reputations have been unfairly tarnished by self interested election officials.

Perhaps people should look carefully at where these election officials get various things… and ask when does the required impartiality of such a position become degraded to self interest or worse?

History shows that computerized electronic voting is very vulnerable especially to “insider attacks” and if people want to look back far enough on this blog they will see I thought up a way to turn an external attack into an insider attack, that could cross air gaps and get around “locked storage room” security.

I did this some time prior to the apperance of what we call Stuxnet, which used almost exactly the same infection route I had identified.

Thus it is very safe to assume that there are those in the non-elected side of US and Israeli Governments that know how to “fix” the election to get the elected officials and administration if they so wished. Whilst they might not wish to use it at home, it’s more than clear that both the US and Israeli Foreign Policy objectives is to control who runs other countries. So I would expect such activities to become the norm if not presently but in the future.

And compared to the normal election campaign costs that in the US now run into several billion dollars a few million puting the fix in on the electronic voting equipment and it’s related standards is dirt cheap in comparison.

Oh and as has been noted before, take a long carefull look at the political alliance of those who own or back financialy the voting machine companies, it tells a tale in it’s own right.

As a number of people have said in the past there realy needs to be full open design not just of the equipment but all parts around them, including the vulnerable Internet Standards etc.

Voting is primarily about the open process that is easily verified by interested lay people, but with one exception the privacy of the individuals cast vote. This apparent conflict has been conflated with all sorts of other things often quite deliberatly when it comes to anything other than the simple paper ballot system. Many assume incorrectly it is a “cost” issue, after a few moments thought on the matter most with a security background will realise that the simplicity and transparency of the paper ballot system is going to be considerably less expensive than the cost of the required security measures for any electronic system.

We also need to realise as voters that no system is perfect, votes can always be rigged one way or another. Thus any system we use should be focused on easy oversight by lay people from start to finish. There should not be any “secrets” in the system be they company or otherwise if people are to trust such systems. We do not need “secrets” being used to hide what is primarily shoddy workmanship that contains faults by accident or design that others can exploit very very cheaply, for immense gain.

Thus along with transparancy the systems must be such that rigging an election must be not only easy to spot but importantly expensive to do and thus leave paper trails etc. The way to do this is to make individual votes expensive but the system cheap, which is what paper ballots err towards. Electronic systems however make the individual votes effectivly free, but the system expensive, thus strongly favouring fraud.