Voting Machine Vendors, Election Officials Continue To Look Ridiculous, As Kids Hack Voting Machines In Minutes

from the voting-village-strikes-again dept

Last year at Defcon, the Voting Machine Hacking Village showed just how bad the security was on electronic voting machines. This is not a surprise, of course. It's a topic we've covered on Techdirt going back almost 20 years. But what's still most incredible is how much the voting machine manufacturers and election officials continue to resist the efforts of security experts to explain all of this. Even earlier this year, there were reports about the insane lengths that voting machine vendors were going to to try to stop Defcon from obtaining their machines:

Village co-organizer Harri Hursti told attendees at the Shmoocon hacking conference this month they were having a hard time preparing for this year's show, in part because voting machine manufacturers sent threatening letters to eBay resellers. The intimidating missives told auctioneers that selling the machines is illegal -- which is false.

Meanwhile, election officials have been whining about the whole thing, and telling people not to pay any attention to all of this:

Election officials from the National Association of Secretaries of State (NASS) bristled at the demonstrations, saying they didn't reflect what could actually happen on Election Day. So did voting machine vendors, which argued it would be difficult for adversaries to gain the level of access necessary to tamper with equipment.

Leading voting machine Vendor, ES&S put out a completely bullshit letter to its customers basically saying "don't pay any attention to Defcon." That letter was expertly debunked and mocked by reporter Kim Zetter:

Also, memo to ES&S: when hackers are trying to help you improve the security of your shitty machines, whining that they're "breaking licensing agreements" is not a good look. But, it's the hill ES&S has ridiculously decided to die on:

In the letter, ES&S also warned election officials ahead of the conference that unauthorized use of its software violated the company’s licensing agreements, according to a copy of the letter viewed by The Wall Street Journal.

And, of course, all this hand-waving failed to stop the inevitable. The news is full of stories, often revolving around the hook that an 11-year-old hacked into and changed votes on a replica Florida state website:

The boy, who was identified by DEFCON officials as Emmett Brewer, accessed a replica of the Florida secretary of state’s website. He was one of about 50 children between the ages of 8 and 16 who were taking part in the so-called “DEFCON Voting Machine Hacking Village,” a portion of which allowed kids the chance to manipulate party names, candidate names and vote count totals.

Lots of other hackers were successful as well:

After a few hours on Friday, one hacker was essentially able to turn a voting machine into a jukebox, making it play music and display animations.

And while the Secretaries of State continue to insist that this is not a real world replica, Defcon folks disagree:

Nico Sell, the co-founder of the the non-profit r00tz Asylum, which teaches children how to become hackers and helped organize the event, said an 11-year-old girl also managed to make changes to the same Florida replica website in about 15 minutes, tripling the number of votes found there.

Sell said more than 30 children hacked a variety of other similar state replica websites in under a half hour.

“These are very accurate replicas of all of the sites,” Sell told the PBS NewsHour on Sunday. “These things should not be easy enough for an 8-year-old kid to hack within 30 minutes, it’s negligent for us as a society.”

The really incredible part of this, of course, is that election officials and voting machine vendors don't embrace Defcon's vote hacking village. That would open up important lines of communication, rather than all this sniping. Indeed, Defcon folks made the effort only to be mostly ignored:

“The Voting Village conducted an outreach effort that was more extensive than any other organization. The Village mailed invitations to almost 7,000 election officials, made over 3,500 live calls, and sent two emails to nearly every single election official in the country, inviting them to participate at DEFCON and the Voting Village.”

While it appears that a few election officials came (including some from Illinois, Colorado and Ohio), many others did not, preferring to just complain about the demonstration. The end result, of course, is that they look silly and petty -- and unconcerned with the terrible security associated with their machines.

Filed Under: defcon, e-voting, hacking, voting, voting integrity
Companies: es&s

Biggest Voting Machine Maker Admits -- Ooops -- That It Installed Remote Access Software After First Denying It

from the you-guys-are-soooooooo-bad-at-this dept

We've been covering the mess that is electronic voting machines for nearly two decades on Techdirt, and the one thing that still flummoxes me is how are they so bad at this after all these years? And I don't mean "bad at security" -- though, that's part of it -- but I really mean "bad at understanding how insecure their machines really are." For a while everyone focused on Diebold, but Election Systems and Software (ES&S) has long been a bigger player in the space, and had just as many issues. It just got less attention. There was even a brief period of time where ES&S bought what remained of Diebold's flailing e-voting business before having to sell off the assets to deal with an antitrust lawsuit by the DOJ.

What's incredible, though, is that every credible computer security person has said that it is literally impossible to build a secure fully electronic voting system -- and if you must have one at all, it must have a printed paper audit trail and not be accessible from the internet. Now, as Kim Zetter at Motherboard has reported, ES&S -- under questioning from Senator Ron Wyden -- has now admitted that it installed remote access software on its voting machines, something the company had vehemently denied to the same reporter just a few months ago. That was then:

In a statement, ES&S said, ‘‘None of the employees who reviewed this response, including long-tenured employees, has any knowledge that our voting systems have ever been sold with remote-access software.’’

This is now:

In a letter sent to Sen. Ron Wyden in April and obtained recently by Motherboard, Election Systems and Software acknowledged that it had "provided pcAnywhere remote connection software … to a small number of customers between 2000 and 2006," which was installed on the election-management system ES&S sold them.

This should be a massive scandal considering the potential impact on our democracy, but considering all the other scandals going on right now with the potential to impact our democracy, expect this one to not get nearly enough attention. Wyden's own comment on this is noteworthy:

Wyden told Motherboard that installing remote-access software and modems on election equipment “is the worst decision for security short of leaving ballot boxes on a Moscow street corner.”

As for the pcAnywhere software ES&S had installed on those voting machines, well...

In 2006, the same period when ES&S says it was still installing pcAnywhere on election systems, hackers stole the source code for the pcAnyhere software, though the public didn’t learn of this until years later in 2012 when a hacker posted some of the source code online, forcing Symantec, the distributor of pcAnywhere, to admit that it had been stolen years earlier. Source code is invaluable to hackers because it allows them to examine the code to find security flaws they can exploit. When Symantec admitted to the theft in 2012, it took the unprecedented step of warning users to disable or uninstall the software until it could make sure that any security flaws in the software had been patched.

Around this same time, security researchers discovered a critical vulnerability in pcAnywhere that would allow an attacker to seize control of a system that had the software installed on it, without needing to authenticate themselves to the system with a password.

So... that's disturbing.

Anyway, elections are a very tricky problem to do securely. It is a nearly impossible task. But there are lots of things that you clearly should not do, and for some reason, the e-voting manufacturers seem to want to do all of them, and don't seem particularly apologetic about any of it. And, while in the past the idea of hacking an election may have seemed far fetched and conspiracy-minded, these days... not so much. This is a key issue concerning our democracy, and the most incredible thing is how flippant many people are about all of this. Computer security professor Matt Blaze, who knows more about any of this than anyone reading this points out that "in the more than quarter century I've been doing computer security, I've never encountered a problem space nearly as difficult or complex as civil elections."

And yet, we're letting people who don't understand even the slightest bit of the problems and challenges run the show. What a mess.

Filed Under: e-voting, electronic voting, pcanywhere, remote access, remote access software, ron wyden, security, voting
Companies: diebold, es&s

Cause For Concern: 'Experimental' Patches Applied To Ohio Voting Machines Without Certification

from the seriously? dept

Update: Just as this post went out, the ruling was released—the judge has rejected the claims.

While we've covered e-voting issues for years, it really did seem like the issues with e-voting machines were less this year than in the past. Except... maybe not. ES&S, the largest vendor of e-voting machines, who has a long and scary history of problems with their machines, is embroiled in yet another controversy, in which Ohio's Secretary of State, Jon Husted, had the company install "experimental" software patches on ES&S vote counting machines (not the voting machines themselves, but the tabulators). The software is uncertified and likely violates the law.

Husted's office has not inspired confidence with its responses to these charges:

The Secretary of State’s office has been evasive and contradictory in response to questions about the minor seeming change that involved converting results from xml to csv format. Apparently, by calling the software “experimental,” Husted was attempting to avoid any approval, review or testing of the new software. But as the federal Elections Assistance Commission titled a memo back in February , “Software and Firmware modifications are not de minimis changes.”

In the meantime, a court is set to rule on the challenge to the software any time now, and a ruling against the software patches could make counting the votes tonight a more complicated process -- but considering the concerns, a reasonable solution. Today, the judge rejected the challenge to the software.

Oh, and while this story is making the rounds, we have no idea what to make of the video of an e-voting machine that votes for Romney if you click on Romney or Obama. There have been some questions as to whether the video was real, but reporters have confirmed that the machine (in Pennsylvania) has been "taken off line." The writeup on that one suggests it's not just a touch screen calibration issue, because the guy who filmed it said that if you touch other candidates, the same offset doesn't happen.

Filed Under: e-voting, ohio
Companies: es&s

Why Isn't There A Central Database Of E-Voting Problems?

from the seems-like-a-no-brainer dept

For many years, we've been reporting on stories of e-voting malfunctions, mainly from Diebold/Premier, ES&S and Sequoia. For a sampling of such stories click on any of the following links: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25. And that's just the first 25 I found (there are lots more), and only cover stories that I actually covered. I'm sure plenty more glitch-infused elections have happened. Given all these glitches and errors, and a seeming lack of followthrough to make sure they don't happen again, a group is asking Congress to authorize a public national database of e-voting election problems.

The really scary part is that the researchers who wrote the report note that many of the problems are repeats -- a problem happens in one location, but another voting district uses the same machines configured in the same problematic way in another election, totally unaware of the problems it will cause. It's still amazing that after nearly a decade of examples of problems with e-voting, just how little has been done to fix these machines.

Filed Under: database, e-voting, problems
Companies: diebold, es&s, premier, sequoia

Did South Carolina Use Second-Hand E-Voting Machines That Louisiana Decertified?

from the conspiracy-theories dept

The election situation in South Carolina keeps getting stranger. Last week, we noted how the controversial election of Alvin Greene, a broke, out of work guy currently facing felony obscenity charges, who did no campaigning and no advertising of his campaign, had people looking at the e-voting machines in the election as one possible culprit. The ES&S iVotronic machines used in the election have no paper or audit trail, so there's really no way to go back and check, but the differences in voting patterns between the e-votes and absentee ballots certainly raised some eyebrows, as did a test of randomness in voting results using Benford's law (a useful tool for suggesting data was faked).

Now, reader Pickle Monger alerts us to the news that the previously expected winner of the campaign, Vic Rawls, is claiming that the ES&S e-voting machines used in the campaign were bought secondhand from Louisiana after Louisiana outlawed their usage:

Third is the well-documented unreliability and unverifiability of the voting machines used in South Carolina. It is worth noting that these machines were purchased surplus from Louisiana after that state outlawed them.

In response, the state is insisting there is no truth to this claim at all:

South Carolina's election commission begs to differ about the provenance of the voting machines. Spokesman Chris Whitmire says the state's 12,000 iVotronic voting machines were bought brand-spanking-new from Election Systems and Software, an Omaha-based behemoth that boasts of operations in 39 states.

Rawls' campaigns' response is hardly reassuring:

"That was what the word around the state was -- heard it from several people."

In other words, total hearsay. I'm all for pointing out the problems of e-voting systems, and ES&S certainly does have an exceptionally long history of having problematic machines that have been decertified in certain states, but claiming that such machines were used in South Carolina without any evidence other than "heard it from several people," seems pretty silly.

Of course, South Carolina's election commission has its own credibility problems. Apparently, its been telling local news media that the iVotronic systems do have an auditable paper trail. They don't. They have a paper tally, but that's not the same thing.

Either way, if you've been following the whole e-voting mess for many years, this sort of situation was bound to happen. Even if it turns out that e-voting machines were not the problem, the very lack of a voter verifiable paper trail, combined with massive security problems and ridiculous levels of secrecy from the e-voting companies has created a world in which no one actually trusts those machines. Even if the results were accurate, the voting machine companies' own actions have created so much doubt in people's minds, that they don't trust the results at all.

Filed Under: alvin greene, e-voting, south carolina
Companies: es&s

Justice Department Decides To Break Up E-Voting Company

from the how-about-just-opening-the-source-code? dept

As was rumored at the end of last year, the US Justice Department has decided to break up Election Systems & Software (ES&S), the dominant e-voting provider in the country. You may recall that just a few months earlier, ES&S (who has a long and troubled history of inaccurate, buggy and insecure e-voting machines) had purchased the remains of Diebold's e-voting business for just $5 million. Of course, Diebold also had a long and troubled history of inaccurate, buggy and insecure e-voting machines, so the two made a perfect match. In both cases, the companies relied on security by stonewalling -- insisting that nothing was wrong, despite lots of proof to the contrary, and refusing to let third party security experts ever look at their machines. Rather than breaking up the companies, why don't the feds just require that any e-voting machine use open source software that can be tested by anyone?

Filed Under: antitrust, e-voting, justice department
Companies: diebold, es&s, premier

Justice Department May Unwind Diebold E-voting Sale To ES&S

from the but-why? dept

After getting hammered publicly for having e-voting machines that didn't work well and had serious security problems, Diebold tried sell off its e-voting division for years with no luck. It then tried to change its name to Premier, hoping people wouldn't realize it was Diebold. In the end, Diebold finally found a buyer in ES&S, the other large player in the market. Between them they own 70% of the US market, apparently. And that's leading to some concern. The Justice Department is apparently looking into the deal to see if it should be unwound, out of fear that ES&S will jack up prices.

Honestly, I don't see what the value is in unwinding the deal. Then you'll have two awful e-voting companies with terrible track records with security and accuracy, rather than one. Instead, why aren't we focusing on requiring truly open solutions so that we actually verify that an e-voting system is both secure and accurate?

Filed Under: anti-trust, e-voting
Companies: diebold, es&s, premier

ES&S Sues Former Workers Over Taking Buggy, Vulnerability-Filled Code

from the why-would-they-bother? dept

Michael Scott alerts us to the news that e-voting firm ES&S has sued two former employees, claiming copyright infringement over code they took with them from ES&S, along with additional trade secrets. I have no idea whether or not this is true, but all I can ask is "why?" As has been documented time and time again, ES&S's e-voting code has a ton of problems. Remember, these are the machines that have been found to have serious security vulnerabilities, with some serious bugs, such as adding votes to the wrong election, calibration problems that lead to people voting for the wrong candidate, and bugs that resulted in phantom votes. And ES&S is the company that knew about some of these bugs, and let them be used in elections anyway. So if you were going to go off and start your own e-voting company (and it's not clear these individuals did that), wouldn't you be better off starting from scratch?

Filed Under: copyright, e-voting, software, trade secrets
Companies: es&s

Diebold Finally Dumps E-Voting Division... But Sells It To Equally Problematic ES&S

from the that-makes-it-better? dept

Ah, Diebold. One of the "big three" e-voting providers out there, its name was the first one that got associated with the problems of e-voting machines, despite problems being found across the board in players in that space. I could never understand why the company continued to fight and deny problems with its machines after so much evidence was presented against them. The smart move would have been to admit that the machines had problems, work with security experts to solve them, and come out with better, safer machines. But that's not what happened. Instead, it stonewalled, denied problems, mocked those who exposed security flaws and kept pushing out questionable machines. Eventually, the stories got so bad, that Diebold realized it was having a seriously negative impact on its other lines of business (including ATMs), so it renamed the e-voting division "Premier Election Solutions" (as if people would forget) and went about trying to sell the thing off -- though, for years it couldn't find any takers.

It took a while, but Diebold has finally found a buyer. ES&S has purchased Diebold's e-voting business for a mere $5 million plus some outstanding revenue. In classic Diebold fashion, the company has announced that it "would not be answering questions about the sale" -- because that's how you go about rebuilding trust.

Meanwhile, it's not like ES&S is any better. It, too, has had massive problems with its e-voting machines, while the company has a history of stonewalling attempts by gov't officials to review their code. Oh, and there's this: company memos showed that the company knew about some of the problems with its voting machines that were used in elections. And the most fun of all? When we questioned why e-voting companies didn't allow independent security researchers to examine machines, an ES&S employee showed up in our comments to call us all idiots.

Now, with the combined ES&S/Diebold/Premier, a ridiculous large percentage of the country's e-voting machines now belong to one company, with an amazingly long family tree of faulty machines and a history of attacking anyone who points out those flaws.

Filed Under: e-voting, merger
Companies: diebold, es&s, premier

Yet Another E-Voting Glitch; This One Adds 5,000 Phantom Votes

from the oops dept

Another election using e-voting machines... and another set of stories concerning massive problems. Slashdot points us to the news that a local election in Rapid City, South Dakota, was about to go to a runoff after no one hit the 50% mark, when someone finally noticed that the 10,488 vote total seemed a bit high. So, they went back and recounted the actual ballots, and discovered only 5,613 people voted, but the software added up the votes incorrectly. Once again, we're left wondering why it's so difficult to do simple arithmetic -- and why e-voting companies like ES&S are so against allowing experts to look at their source code and maybe help catch some of these bugs before they totally screw up an election.

ES&S, of course, has been especially bad when it comes to transparency, despite numerous stories of glitches. It's also the company that had an employee stop by here on Techdirt, call us all "idiots" while insisting that the machines were perfectly fine and that the machines are "extremely scrutinized and very reliable" and anyone questioning their reliability was simply relying on "conspiracy blogs." Of course, his focus was on the idea that the machines were "hacked" -- a charge we never made. Our concern -- and the concern of many others -- are that the machines are unreliable, prone to errors and have serious security and process flaws. Considering how many stories we've seen of problems with those machines in real elections, that seems to be proven fact -- not "conspiracy."

And yet, ES&S has always resisted any real scrutiny. When California looked to investigate e-voting machines more fully, ES&S was the one vendor who held out for months beyond the deadline, before finally submitting its source code along with a threatening letter about how it would personally sue the Secretary of State if any of its trade secrets got out. Of course, soon after this, we found out that even its certified code didn't much matter, since it had given California machines with uncertified code for an election. In the end, not surprisingly, ES&S machines were found to have significant problems, and were decertified in California. Perhaps South Dakota should have taken note.

Filed Under: e-voting, extra votes, south dakota, transparency
Companies: es&s