Schneier on Security

hmm • December 6, 2017 9:50 AM

@Supper

Voting machines are not home appliances. The comparison is flawed.

Given a choice between 25 maybe-sorta secure voting machines and 1 thoroughly vetted one?

You would choose the crapware? Really?

hmm • December 6, 2017 5:07 PM

With as many different models as they have, none of them really get the full attention. There’s no static compliance targets. Everything is a 1-off, every vendor and then every sub-model is an individual ecosystem of vulns. Managing that model is impossible for any organization. See Android clusterf#.

I understand having a diverse ecosystem compartmentalizes the vulns, yes that can help prevent a 1-worm pandemic – but so can good design. Vulns can be nixed ‘fleetwide’ instead of haphazardly per-state laissez-patched if that state/locality has the money/time/interest to do so, as it is now.

Why did we decide that they had to be self-contained ‘machines’ made as cheaply as possible in the first place? Why not have one or two moderate-cost reliable systems per polling place and have banks of cheap idiot-proof terminals? I mean there are ways to make this a lot more secure and efficient all around, it’s worth spending a bit to get right rather than just shrugging and accepting hacked elections as an inevitability.

Put out bounties and really get it whittled down to robust code without much surface area to attack, build HW security features that complement the SW, have multiple layers of complementary blockchains on the backend, keep in reserve a completely-different-but-also-fully-vetted alternate front-end system ready to go, maybe 2 or 3. But not 50-500.

All of this is fully doable. What’s standing in the way besides states’ rights and short-sighted local misers?

hmm • December 7, 2017 7:49 PM

For the purposes of secure voting you’re not really going for the cheapest mass-produced option.
Having a wide rainbow of cheap under-designed machines is the problem we have NOW.

“Free enterprise” doesn’t exactly keep the best secrets or offer the most secure systems historically.

We don’t NEED several dozens of styles of a simple thing like a voting machine, nobody does really. Voting is the same simple task everywhere. We don’t need a ton of options or locality specific firmwares. We don’t need wifi or even USB. The less to it the better. You know, an actual security paradigm.

We need one style, and we need it to work so idiot-proof reliably and provably that the public takes it for granted that it’s a secure and trustworthy bastion of our form of governance.
Anything less than achieving that result and the whole idea is pointless nomatter the cost.

How we engineer and manufacture and verify that, sure the devil is in the details – but starting from simple secure best practices and limiting the unnecessary feature creep and proprietary blob weirdness from the very beginning is a crucial concern. Designing this to be a for-profit item is missing the application.

If our baseline is set at accepting the CRAP that Diebold has or other absolutely worthless machine fleets, because “they work on some level and aren’t expensive and we have them now” – or “because it’s West Virginia and these are made in West Virgina”, then representative government as we know it is done for.

hmm • December 8, 2017 1:09 PM

” voting machines are needed, then logically somebody has to make them and they will require payment for materials, labour, etc, etc. ”

Sure there’s a practical necessity there, of course.

We know all about the “big check” procurement problem of government vs. private industry, where you end up with the $6000 toilet seats on submarines, etc. Valid issue.

All the big companies that provide infrastructure that makes the internet possible, all of them have special deals with the .gov. AT&T wouldn’t exist, IBM wouldn’t exist as we know it without those special collaborative projects that we’ve depended on. I’m less concerned about those companies making “too much” on those contracts as I am holding them to the 6th significant figure of compliance when it comes to the finished product.

Especially so with e-voting. It should be a protected, subsidized and partnered project like pipelines or anything else we do that’s important and critical to do right.

The net profit for the project itself isn’t so much the incentive, more just being “that major company” that the government depends on as their trusted contractor for this. It’s a cachet that leads to further contracts and longevity. If this collaboration yields the fruit sought, in this case provably secure and stable election performance, YOU CAN’T PAY ENOUGH.

It’s invaluable and necessary to our system. NOT having this, we’re basically waiting for some effort that succeeds in hacking our system at scale. The cost of that, if our elections were completely disrupted and people didn’t trust it, would be INCALCULABLE. So at some point we have to decide that funding out fundamental infrastructure to DO THE JOB that we need done outweighs whatever free-market dogmatic economic theory we’d like to pretend we follow, (but don’t really, if you look closely at our macroeconomy..)

Of course, done wrong? It’s a major boondoggle and fodder for those who would repeat the common mantra that “gubmint can’t do anything right” – and they would have a point, but this is a very difficult problem to solve and KEEP solved. Still we have to make a proactive effort on it NOW, before it becomes the crisis it very well might. A fully hacked election is orders of magnitude worse than any bloated contract or appearance of picking winners and losers in the economic framework.

So I’m less concerned about the ‘faux market’ – frankly the entire “voting machine” industry shouldn’t exist. Voting is not and should not be an for-profit endeavor, and to the extent that it is corrupted in that direction it will be gamed. You’re right.

“One way is to supply unreliable goods that have a continuous need to be repaired and upgraded, others are potentially criminal to the point of treason (ie sell elections is criminal and to foreign powers would be treason, but oh so profitable if you could get away with it).”

-Yeah that’s a valid concern also. Oversight in the contract needs to be airtight. This is essentially a matter of national security, like missile interceptor projects or something on that level. Leaving it to unregulated industry in the name of protecting the market niche competivity would be to miss the point of the endeavor wholly. This isn’t something companies need to make money on. This is a pillar of representative government. If we don’t get it right, government waste will be the least of our concerns.