RE: Diebold Global Election Management System (GEMS) Backdoor

From: Paul Wouters (paul_at_xtdnet.nl)
Date: 09/27/04

  • Next message: Seth Breidbart: "Re: Diebold Global Election Management System (GEMS) Backdoor Account Allows Authenticated Users to Modify Votes" 
    Date: Mon, 27 Sep 2004 13:25:33 +0200 (MET DST)
To: Jeremy Epstein <jeremy.epstein@webmethods.com>

    On Thu, 23 Sep 2004, Jeremy Epstein wrote:

    > (1) I agree that source code should be inspected by someone truly
    > independent and competent, and that the standards for approving voting
    > machines should be stronger. However, that's NOT the same as open source.
    > And I'd strongly discourage folks from calling for open source, as it plays
    > directly into the hands of folks like Diebold, who claim that the people
    > (like me) who want Voter Verified Paper Audit Trails (VVPATs) are really
    > trying to kill free enterprise.

    Free enterprise is not the issue here. Audit trails are. If it means that
    somewhere someone cannot make a profit, then so be it. Unless you declare
    democracy dead, and instate the Corporate Republic. The 'free market'
    should not be a main consideration in voting security. If you cannot relay
    that message to your government, then either you or your government is not
    the right one for its task.

    > the VVPAT groups with the open source community. So rather than putting
    > your energy into trying to get Diebold et al to move to open source, it

    Diebold has proven to not earn the trust of the public. It deserves to lose
    money, or even go bankrupt. That's capitalism. You screw up and your product
    no longer sells and you go do something else. Perhaps Diebold can go into
    the playing cards business.

    > (3) WRT requiring that the technology protect itself in case the users
    > don't, that's simply unrealistic. In *any* real computer system, there are
    > expectations about the environment (e.g., the administrators aren't hostile
    > to the functioning of the system). It's important to state what those
    > expectations are, but there will ALWAYS be some that rely on non-technical
    > means. The important part about election systems is that they be explicitly
    > stated, and they be enforceable using non-technical means (e.g., by having
    > locks on doors). The problem today is that some of the assumptions (e.g.,
    > the vendor provided software doesn't have any bugs) are clearly unrealistic.

    We are talking about voting machines here, not general purpose operating
    systems! They should be able to restrict and properly (and provably!) secure
    a reasonably simple dedicated single purpose voting computer.

    > (4) WRT getting one set of software approved, and then installing another...
    > that's an old problem in any environment. The way it's supposed to work in
    > election systems is that a particular version is approved, and it's illegal
    > for the vendor to install something different. If there are teeth in the
    > law, and the vendor can be fined for installing illegal software, then it's

    A fine? No. They just be blacklisted from ever supplying voting machines to
    the government again. Screwing up elections is not like hitting a red light
    when there is nobody around.

    > Bottom line, election systems are no different than any other systems in
    > that the security of the whole system is based on risk management.

    But I guess no one trusts the US government itself anymore if even Europe
    is sending officials to watch over the elections:

    http://news.bbc.co.uk/2/hi/americas/3666898.stm

    And to counter your arguments, the Netherlands has open sourced its voting
    system. You can download and verify it at http://www.ososs.nl/

    Paul 

    -- 
 	"Non cogitamus, ergo nihil sumus"
  • Next message: Seth Breidbart: "Re: Diebold Global Election Management System (GEMS) Backdoor Account Allows Authenticated Users to Modify Votes"

    Relevant Pages

    • Why doesnt the GOP want Ohios voting machines tested?
      ... Ohio Republicans have blocked a proposal to test electronic voting ... machines prior to the 2008 presidential primary. ...
      (misc.news.internet.discuss)
    • Re: Question about President Bush
      ... >>>Oh you mean the voting machines encrypted ballots or system audit logs, ... >>>of operatives with the power to tap into the networked machines and thus ... >>>You mean that in the last election access to the voting network was not ... America's right to vote, and to have those votes counted in this ...
      (alt.gathering.rainbow)
    • Re: Fiasco all over again.
      ... Programming errors and inexperience dealing with electronic voting machines frustrated poll workers in hundreds of precincts Tuesday, delaying voters in several states and leaving some with little choice but to use paper ballots instead. ... voters rolled their eyes as election workers fumbled with new touchscreen machines that they couldn't get to start properly until about 10 minutes after polls opened. ...
      (alt.politics)
    • Re: Fiasco all over again.
      ... voters rolled their eyes as election workers fumbled with ... new touchscreen machines that they couldn't get to start properly until ... Election officials in Delaware County, Ind., extended voting hours because ...
      (alt.politics)
    • Re: Rummy is going
      ... there weren't ANY problems with electronic voting? ... I would be ecstatic if we held voting machines to the ... Properly designed paper ballots are many many times better ... The idea here is that a cut tie or torn tape will ...
      (rec.bicycles.tech)