E-Voting Ballots May Not Be So Secret; Paper Trail Takes Away Anonymity
from the line-'em-up,-match-'em-up dept
Another day, another security problem with e-voting machines. Obviously, one of the biggest requests from people who were nervous about the security of e-voting machines was that all e-voting machines have a verifiable paper trail. Then, at least, there’s a way to recount the votes if there are any questions. Unfortunately, even when the e-voting companies finally do add a paper trail, it seems that they muck up the process. As was noted in the recent security analysis of these machines, many of the problems are because they weren’t designed from the ground up with security in mind, but rather have security procedures slapped on as extras.
In this case, some Ohio activists discovered that the paper trail coming from e-voting firm Election Systems and Software (ES&S) happen to have time and date stamps on them. Those ballots are available for anyone to look at, based on election law in Ohio. Also available for anyone to peruse are the voter sign-in logs. With both of those in hand, it’s not hard to put together a pretty decent list of who voted for what. You just match up the names in the order they signed in with the timestamp on the ballots.
Of course, rather than responding to this as they should, by admitting it was a bad idea, ES&S sends out their PR people to say it’s no big deal. While ES&S is right that it might not always be possible to do an exact match person to person, you can come pretty close — and that should be seen as a huge concern. Furthermore, as Ed Felten points out, the other e-voting firms aren’t much better, and Diebold (or Premiere, or whatever its new name is) appears to be outright
lying skirting the truth when it claims that its paper trail doesn’t include timestamps (update:: Ed Felten points out that the Diebold ballots don’t have a time stamp, but the electronic records do). It’s not hard to see how this happened, but the continued denial and stonewalling from the e-voting companies, rather than admitting a mistake was made and explaining how they’re going to fix things, really is troubling.