News for hackers. Stuff that matters.
Re:DHS plans urgently needed to address identified challenge... by maximente on Thursday February 06, 2020 @04:00PM (#22260232)
when viewed from a sludge-money lens (a la the F35) electronic voting and election security seem largely working as intended:

- we know paper works (Canada/UK) so there must be an ulterior motive for pushing on tech solution so hard

- money gets sent to various entities under the guise of tech, security, freedom, etc. (contracts for voting machines, contracts for software, etc.). this basically gives some limited air cover for transfer of funds to entities

- it nicely feeds into itself: defensive work always needs to keep up with (real or imagined) offensive threats so basically unlimited amounts can be spent without too much eye rolling

- it is basically a get out of jail free card for both political parties in the future: "elections were hacked" is bipartisan and can be a useful tool to defeat/deny access to popular party outsiders on both parties, as opposed to a genuine candidate blowing up the system (Sanders?)

- any foreign entity can be conveniently used if e.g. need to get a quick war going to distract the plebs from, say, medical parasitism or offshoring jobs

Re:DHS plans urgently needed to address identified challenge... by jcrawfordor on Thursday February 06, 2020 @06:55PM (#22261755)
Introduction of electronic voting in the US was primarily motivated by the Help America Vote Act of 2002 which required that election authorities more effectively accommodate the needs of voters with sensory and mobility needs. Previously used election methods were generally inoperable by individuals with such disabilities unless they had a second person enter their votes for them, which is considered a compromise of the right to a secret ballot. Electronic voting systems offer extensive accessibility modes designed for voters who are vision impaired and/or have limited mobility, such as reading the ballot aloud and supporting a sip/puff or two-paddle input device. As I discuss in more length in another comment it is quite possible to meet these needs using a paper ballot system (by use of a ballot marking machine or BMM which may be integrated into the tabulator), but direct recording electronic (DRE) systems are less expensive to operate and in some cases purchase. So, unfortunately, many election authorities, forced by HAVA to replace their equipment on an extremely limited budget, opted for the cheapest option. These election authorities now cannot afford a complete replacement of their voting systems and so may be "locked in" to a DRE system by their vendor.

To improve US elections administration, it is imperative to address the severe funding limitations faced by most election authorities that may leave them little or no choice over the methods they use.

Re:DHS plans urgently needed to address identified challenge... by guidance on Sunday February 09, 2020 @10:41PM (#22286263)
Ha. Yeah, they always come up with some Real Plausible Explanation for the things that they do, and the naive types always buy it.

Here's the reality: the electronic voting systems are being put in place because they are so easily hackable.

Re:DHS plans urgently needed to address identified challenge... by colejohnson66 on Thursday February 06, 2020 @04:45PM (#22260708)
> ...so there must be an ulterior motive for pushing on tech solution so hard

I know someone in the industry who thinks software voting will solve the issues. It’s not ulterior motives; People actually believe it will help.

Re:DHS plans urgently needed to address identified challenge... by morio on Thursday February 06, 2020 @05:52PM (#22261325)
Agreed, I see a lot of "if Estonia can do online voting, why can't we?" When I talk to some of these people, who work in the SV as software engineers, I realize not everyone has a wide ranging context on security and privacy. Not everyone religiously attends or watches DEFCON presentations...

There is also a continuous push to make results available faster, basically instantly. The media is as guilty as everyone else here. Like we can't wait for a few days for results.

Lastly reducing the amount of total paid workers and volunteers in the field to reduce costs likely looks like a shiny object in many managers eyes.

Re:DHS plans urgently needed to address identified challenge... by deepspace on Thursday February 06, 2020 @06:51PM (#22261727)
> not everyone has a wide ranging context on security and privacy

Hey, it sounds like you just came up with an excellent screening question for interviewing potential software developers for any project with security and/or privacy requirements.

"Do you think electronic voting is a good idea?" A "yes" answer would suggest strongly that the candidate does not have a deep understanding of software security and privacy issues.

Re:DHS plans urgently needed to address identified challenge... by CalRobert on Thursday February 06, 2020 @06:08PM (#22261427)
If they went to a single DEF CON talk on voting they'd strongly favour paper.
Re:DHS plans urgently needed to address identified challenge... by ngold on Thursday February 06, 2020 @05:50PM (#22261310)
Nothing beats the relaxation of voting by mail. Secure? Better then most.
Re:DHS plans urgently needed to address identified challenge... by jcrawfordor on Thursday February 06, 2020 @07:00PM (#22261789)
Keep in mind that mail-in ballots are counted by centralized OMR which generally provide the voter less assurance that their vote was successfully tabulated than a precinct tabulation system. For example, a mail-in ballot that is erroneously marked or overvoted (too many choices in a race) may need to be simply discarded for that question, while a precinct tabulator will reject such a ballot and return it to the voter for correction or to be spoiled (replaced). Mail-in voting systems also generally use a permit system to allow voters to check online that their ballot was received, but the need to maintain a secret ballot means that permits (actually the outer envelope usually) and ballots are separated at tabulation and so mail-in voters have less assurance that their ballot actually made it to the tabulator than voters in precinct tabulation jurisdictions where they insert it themselves.

All of this said, the convenience and accessibility of mail-in voting is extremely beneficial and so an ideal solution may be a hybrid arrangement in which voters have the option of mailing in their ballots or submitting them for immediate tabulation at a precinct or early polling location. This system actually exists in several states although the "mail-in option" tends to actually be an extension of absentee voting (basically, you are allowed to vote absentee by mail even if you just want your ballot sent to your own house inside of the jurisdiction), but awareness of the mail-in voting option could be significantly improved.

Re:DHS plans urgently needed to address identified challenge... by pjc50 on Thursday February 06, 2020 @06:05PM (#22261407)
The additional problem with election security is distinguishing between the parts of the corruption that are local, protected and untouchable; the parts done by foreign actors at the behest of the local untouchables; and the parts done by foreign actors on their own initiative against the local elites.

There's no need to hack the votes themselves if you can just get a list of opposition voters and just cancel their registrations, for example: https://www.theguardian.com/us-news/2019/dec/28/georgia-voti...

Re:DHS plans urgently needed to address identified challenge... by mzs on Thursday February 06, 2020 @05:54PM (#22261336)
UK and Canada are parliamentary systems so most ballots are one page. Most of those are just a single question with one selection permitted.

In the US the ballot I get in my polling place depends on where I live and sometimes what party I am registered with. My ballot will likely be different than the next person in line. That ballot is many pages with numerous questions per page. And for about half of the questions I am permitted more than one selection.

Machines are a good aid here for this system. Verifiable paper tallies are good for election security though.

Re:DHS plans urgently needed to address identified challenge... by roganartu on Thursday February 06, 2020 @06:37PM (#22261644)
What you describe is not that different from Australia's preferential system afaict, aside from people at one district potentially having different ballots.

Australian ballots are not always simple, and you vote for your local representative so each district has a different one. Often you will have multiple ballots to complete, and some have the choice between above or below the line voting (where above you select some preferences and below you select all preferences, where all may be over 100 boxes).

Parties often hand out small leaflets outside the voting locations with instructions for above the line voting, which is typically a list of around 6 preferences in order.

Despite this, voting in Australia is done with paper, and we have live coverage with real-time counts on election night. Paper works quite well, computers really aren't necessary.

Re:DHS plans urgently needed to address identified challenge... by mzs on Thursday February 06, 2020 @07:01PM (#22261791)
Australia is always a curveball! I've wondered how a precinct counts those ballots, especially if some people vote below the line. I hope someone with experience comments here.
Re:DHS plans urgently needed to address identified challenge... by roganartu on Thursday February 06, 2020 @09:11PM (#22262617)
You don't have to wonder, the counting process is well documented! :)

https://www.aec.gov.au/voting/counting/

Re:DHS plans urgently needed to address identified challenge... by mzs on Friday February 07, 2020 @12:10PM (#22268161)
Thanks, I'm still confused but it seems in essence before counting they make an educated guess of the two likely winners and first count with that in mind and only do a more complicated tally if it ends-up mathematically possible for one of the others to still come-out on top.
Re:DHS plans urgently needed to address identified challenge... by pjc50 on Thursday February 06, 2020 @06:39PM (#22261660)
> sometimes what party I am registered with

This is one of the very weird things about the US system, that somewhere in reconstruction the parties were effectively nationalised and allowed to use state-run election infrastructure.

The concept of "registered for party X" doesn't exist in European systems. The state has no business running internal party affairs, they can select their own candidates.

Re:DHS plans urgently needed to address identified challenge... by jcrawfordor on Thursday February 06, 2020 @07:05PM (#22261825)
This situation can be remarkably complex. In my county of around half a million people there can be over five hundred distinct ballot types in some elections. The underlying reason for this is election consolidation, in which elections held by different authorities using different voting districts are all combined into one ballot for the voter's convenience.

For example, in many areas the school district legally conducts separate elections based on separate precincts. But, no one is excited to take a separate trip to the polling place just for the school district election, which results in very low turnout. To improve turnout and save money, the school district questions are combined onto the same ballot as the municipal election - but two voters in the same municipal election precinct may be in different school district precincts. Imagine how this challenge multiplies as you add soil and water conservation districts, judicial districts, economic development areas, county issues, etc.

Re:DHS plans urgently needed to address identified challenge... by munk-a on Thursday February 06, 2020 @07:13PM (#22261882)
In Canada voters at the same polling place get the same ballot only because there are enough polling places that local district seats will always be larger than polling catchment areas.

Last election I walked into my polling place six minutes before my bus was supposed to arrive right out front and caught my bus.

Skimping on costs when it comes to elections is pretty silly - it makes sense to make sure there isn't rampant corruption but people have enough reasons not to vote that adding inconvenience to the list can be quite discouraging.

Re:DHS plans urgently needed to address identified challenge... by jcrawfordor on Thursday February 06, 2020 @10:09PM (#22262903)
In the US voting occurs during a workday and so there is a significant push towards 'voting convenience' or 'non-precinct voting' where a voter may appear at any polling place instead of only at their designated precinct. This is a huge advantage for voters but requires that ballots be either selected from a large supply or printed on-site for each voter. This effectively requires the use of a computerized pollbook.
Re:DHS plans urgently needed to address identified challenge... by ctoth on Thursday February 06, 2020 @04:04PM (#22260271)
Posiwid thinking. The purpose of a system is what it does.
Re:DHS plans urgently needed to address identified challenge... by claudeganon on Thursday February 06, 2020 @04:14PM (#22260389)
Judging from Iowa, I imagine that some primary Sanders wins will claim to have been hacked by Russians. Democratic Party operatives were already doing false flag “Kremlin” stuff during the Doug Jones race in Alabama:

https://thegrayzone.com/2019/01/23/how-new-york-times-scott-...

Re:DHS plans urgently needed to address identified challenge... by syshum on Thursday February 06, 2020 @04:31PM (#22260557)
>>- we know paper works (Canada/UK) so there must be an ulterior motive for pushing on tech solution so hard

Works sure, efficient no, and largely one of the reason for low participation rates (though far from the only)

That said none of the "tech" solutions that simply replace paper ballots at a polling place with a Touch Screen at a polling place would be what I desire from a "tech" solution to voting

The rest of your points are largely true, though on the money never discount the power of incompetence when it comes to government, they way government contracts are "awarded" attracts the most incompetent people in any industry for if they were competent they would not need government contracts

as the old saying goes...

If you can... do

If you cant.. Teach

If you cant teach... Work for the government

Re:DHS plans urgently needed to address identified challenge... by munk-a on Thursday February 06, 2020 @04:45PM (#22260711)
There are some pretty hard, potentially unsolvable, problems around electronic voting around guaranteeing the ability to vote and guaranteeing the accurate record of voting - these problems aren't unique to electronics but paper & person systems have pretty good ways to protecting against system abuse by being incredibly inconveniently distributed, having known actors that can face legal pressure, relying on our existing social systems to increase the difficulty in compromising the system and, lastly, having thinking components that can act in isolation to solve problems independently including those we can't anticipate.

"Tech" exacerbates those issues while not offering a lot in exchange, the big two I can think of is accessibility (which, honestly, look at Washington state's system for a counterpoint there - though it is limited in how many states are that good) and quick vote tallying.

I just don't see the point - have automatic counting machines, allow tech to help inform voters (provide a blurb on the candidates or dedicate a gov't organization to providing some structured data around political stances), allow easy confirmation of registration and auto-enroll eligible voters... just... keep the ballots dead simple.

Re:DHS plans urgently needed to address identified challenge... by vkou on Thursday February 06, 2020 @04:37PM (#22260624)
> efficient no,

How is it not efficient? Elections Canada figures out how to count ballots in a few hours. 95% of the work of putting on an election is setting up, and running the polling stations. Using an electronic system is not going to make that 95% any easier.

The only thing that would make it easier, is purely mail-in ballots, like in Washington State.

> and largely one of the reason for low participation rates (though far from the only)

Canada has a 5-15% higher voter turnout rate.

Re:DHS plans urgently needed to address identified challenge... by syshum on Thursday February 06, 2020 @04:44PM (#22260700)
>>How is it not efficient?

It is not efficient for the people voting. More than 1 election I simply skipped because I did not want to find my polling place, stand in line, and then vote

I want a Polling Place free Voting system

Re:DHS plans urgently needed to address identified challenge... by munk-a on Thursday February 06, 2020 @04:48PM (#22260729)
Take this up with your government - electronic voting systems isn't the solution for this... making a huge deal over states when they cut the number of polling places is. It is super depressing that AZ[1] wasn't rung through the wringer by public outrage over their polling place shenanigans in the last election - both winners and losers should care about the accessibility of voting.

Also it's about time for election day to become a national holiday - as a former Vermonter I always enjoyed participating in Town Meeting Day, giving people a day off to participate in government is a strictly good thing.

1. https://www.azcentral.com/story/news/politics/elections/2016...

Re:DHS plans urgently needed to address identified challenge... by Swenrekcah on Thursday February 06, 2020 @05:10PM (#22260960)
There are really easy solutions to this that other countries use, while keeping the safe and simple paper ballots.

They have many polling places, enough that queues aren’t more than a few minutes at the most.

They don’t make the polling places deliberately hard to get to.

They hold elections on a weekend or a public holiday so the flow evens out over the course of the whole day.

Re:DHS plans urgently needed to address identified challenge... by jcrawfordor on Thursday February 06, 2020 @09:59PM (#22262865)
It is important to keep in mind that using what is often called a "voting convenience center" model where a voter can appear at any precinct instead of only their own precinct essentially requires the use of a computerized pollbook, since the pollbook needs to be kept in sync across all locations to prevent double-voting at two locations. This isn't much of a difference since computer pollbooks are already nearly universal, but the computer pollbook is a risk surface for election interference that's largely overlooked by the public discussion - I think it's a major mistake that the public discussion focuses essentially only on the voting tabulation itself when often the supporting systems (pollbook, election management system, communications) are far more poorly secured. Defects in them tend to be easier to detect since there is less of an element of secrecy, but consider the chaos that could be caused by a malicious actor simply taking the pollbook offline, or the subtle manipulation that might go unnoticed if a malicious actor gained access to the pollbook and invalidated the voter registrations of people in an area and demographic making them likely to vote for a particular party... if the right number of people were chosen, you might be able to influence the outcome of the election without invalidating so many people's registrations that the election administrator can't wave it off as people who thought they were registered and weren't. This could be especially effective if you targeted an economically disadvantaged group which tend to have a harder time with their voter registrations anyway due to frequent address changes.
Re:DHS plans urgently needed to address identified challenge... by empath75 on Thursday February 06, 2020 @06:13PM (#22261471)
Move to Washington and mail it in. But to be honest, you have an obligation as a citizen to do whatever you have to do to vote and I’m not too sympathetic to people without a disability saying it’s too hard to get out of the house when I see other people standing outside in the cold and rain for hours to do it.

Take some responsibility for your country.

Re:DHS plans urgently needed to address identified challenge... by munk-a on Thursday February 06, 2020 @07:00PM (#22261782)
I don't think that's helpful, especially when your country goes out of its way to make the process difficult and discourage participation, which the US has certainly been guilty of in the past.
Re:DHS plans urgently needed to address identified challenge... by syshum on Thursday February 06, 2020 @07:15PM (#22261894)
>>>>you have an obligation as a citizen to do whatever you have to do to vote

1000000000000% disagree, I have zero obligations to society, if I did I would not be a free person, I would be a servant