Hacker News Reader

Comment by viraptor | Hacker News Reader

I'm having a hard time understanding the way voting machines are created these days. Why are they complete operating systems? Why do they have ports? Why do they look like they're overengineered in so many ways?

What's stopping the companies from producing a closed box with SoC+board connected to: N buttons, display, card reader/scanner, printer, wifi/ethernet. All you need is to take cards, register the result, add it to some continuously hashing database, print vote proofs, periodically upload data (again, public-key encrypted). If they need to be updated, allow only signed code. (ARM SoCs have secure-boot-like capabilities)

Am I missing something? Why do we get multiple iterations of machines with exposed ports, running XP, having hardcoded passwords, allowing admin access, having physical locks which can be opened without a key, etc. How can these things be created without at least one person saying "this shit is unacceptable"?

View on HN

Electronic voting machines used in Indian elections are custom built for the purpose, and cost about $100.

https://en.wikipedia.org/wiki/Indian_voting_machines

All it has is N buttons, accumulators to store presses of each button in non-volatile memory, and a seven-segment LED display to indicate status (ready-to-vote, vote cast, etc.). Vote counting is done offline by connecting to a controller. No wifi or any other remote-access capability.

All that really needs to be done to create a paper trail is to add a printer.

Not implying that they're completely secure, but any breach at least needs physical access to the box. And physical security of the machines is on the same level as those provided for traditional ballot boxes.

Edit 1: The balloting unit does not even have a 7-segment display - just individual LEDs next to their buttons to provide feedback that the button has been pressed.

Edit 2: More details on the internals of the EVM: https://jhalderm.com/pub/papers/evm-ccs10.pdf

Indian EVMs are not as secure as ballot boxes. It is dead simple to "inspect" a ballot box once received for any backdoor that might be there, but not the same for Indian EVMs, in fact there is an attack where the attacker can change a single IC, and make the machine remotely editable, or "distribute" votes, and that can be turned on and off. https://www.youtube.com/watch?v=apkSkb6Ak3I

How would you "inspect" a ballot box from which real votes have been discarded and which has been stuffed with fake votes? Once you have sufficient access to open a voting machine (electronic or otherwise) and change components, all bets are off.

I was talking about inspection once it reaches the election agency. After that, till counting both are same, however the fact that they can be tampered with during manufacturing is what bothers me. Essentially the ballot boxes only require one trustable entity the election agency, the EVM requires two trustable entities the EVM manufacturer and the election agency.

The next generation of EVMs apparently come with an additional printer unit (VVPAT) that doubles up as a ballot box. The voter can verify that what got printed was the vote he/she cast, and the papers collected in the printer unit's "ballot box" can be manually counted and used to cross-verify an EVM's result.

Digital signatures and tamper-resistant ICs?

If malicious actor swaps the IC, new one won't have the secret material that original had contained (and which IC will only disclosed upon receiving court-signed audit order, permanently burning a fuse at the same time). And if they try to tamper with the IC, they'll need to spend significant amount of time with it.

This isn't even remotely perfect, but can be used as one of the measures. Throw in some more redundant systems with different approaches, ensure their integrity at the end and you'll have some proof that the results are authentic enough to a certain extent (measured in amount of efforts needed to perform a successful attack).

That's security through obscurity. You want any citizen to be able to audit the security of the device, if you have to trust the government or some institution then what's the point?

There are better ways to make sure your vote got registered properly, for instance http://www.nytimes.com/2004/03/02/science/did-your-vote-coun...

After voting, each voter would receive a receipt -- a record of his choices that would be encrypted, or put into code, and could be deciphered only by a collaboration of all the election trustees. After polls closed, all receipts would be posted on the Internet. Each voter could use his serial number to find the image of his receipt, and make sure it matched the one he carried.

Not foolproof but still better than what we have now.

What you are missing is that the technical part is not the hard part. The hard part is all the rest of it.

For example, here [0] is a link to the 200-page "volume 1" of the federal standards, merely one of a complex web of certifications that these things go through.

One random paragraph is illustrative:

Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand, without disruption of normal operation or loss of data, electrical fast transients of: a. +2 kV and −2 kV on External Power lines (both AC and DC) b. +1 kV and −1 kV on Input/Output lines(signal, data, and control lines) longer than 3 meters c. Repetition Rate for all transient pulses will be 100 kHz

Now I am a software engineer, and quite frankly I have no idea whether these are large tolerances which would require specialized equipment to withstand or whether e.g. my laptop would sail through this kind of event. Nor do I have any idea how I would demonstrate compliance with these requirements to the satisfaction of a federal examiner.

And that is what voting machines are. They are checkboxes on a specification. That means that you can buy them with confidence that somebody else's ass will be on the line when they turn out to be awful. The fact that they actually record votes is ancillary at best, the primary feature and the reason for buying them is that they tick the checkboxes.

As to why they seem overpriced, the reason is that it costs a lot of money to have an engineer hook the thing up to his fancy oscillator and write you a report that yes, this machine complies with requirement 4.1.2.6.c, over and over again.

[0] http://www.eac.gov/assets/1/Documents/VVSG.1.1.VOL.1.FINAL.p...

That kind of testing is par for the course for electronics manufacturing at scale, though it does seem these requirements are quite stringent. The 100kHz repetition rate sounds odd though, and some of the other specs aren't completely clear. But regulatory testing of electronics is, in general, a solved problem, as are the mitigations for voltage surges.

Not to mention how hard it is to sell to the government. It can take months to get into the system then you need to wait for the RFP process to have a request that matches your capabilities. Then procurement. It's a huge barrier to entry for startups.

Actually, those requirements are par of the course when designing mains-powered devices . You'd be surprised the kind of transient voltage spikes AC motors generate when starting, and I'd assume all devices sold in the US satisfy the same or similar standards.

Having engineers design and test electronics with such kind of safety standards is good practice. You don't want a failed USB power supply to fail in a way that sends mains voltage to the USB for example.

I used to consult for a company that made WiMax base station equipment in India. Typically, the way government would work, is that they'd send out request for information to multiple vendors. Then, they'd take the list of parameters that they got from each vendor, create a master list of parameters, and pick the "best" under each parameter as a requirement. Then, they'd send out a request for quotes to all vendors with a list of requirements that would be impossible to meet simultaneously.

What happens then ? How did they pick up the most appropriate ? Or maybe they wait for one the vendors (the fastest) to produce a product up to the specs ?

I really don't know. I wasn't there long enough and didn't have full insight into the workings. But my guess is that they eventually settled on a solution that met most of the specs at a reasonable cost.

However, what that opens up, is a way for corrupt officials to favor a vendor and use the others-did-not-meet-this-particular-spec as a justification.

Just my 2c. I really have no idea if it actually was ever used in this way.

> Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand, without disruption of normal operation or loss of data, electrical fast transients of: a. +2 kV and −2 kV on External Power lines (both AC and DC) b. +1 kV and −1 kV on Input/Output lines(signal, data, and control lines) longer than 3 meters c. Repetition Rate for all transient pulses will be 100 kHz

The real question seems to be, they apparently have all these stringent electrical engineering requirements set up in the standards, ones that seem to be made with detailed input from a professional electrical engineer, ones that can only be properly understood and tested by someone with electrical engineering knowledge.

So why did all these requirements on electrical engineering get into the standards, but requirements on software security did not?

For most of the technology governments use, they are reliant on off-the-shelf hardware and software. Only the military has the budget to design solutions from scratch. Police equipment has traditionally been either ancient, or repurposed military hardware, only recently have budget blown up to where it's profitable for companies to design products specifically for police departments.

The private sector literally doesn't have any use, at all, for voting machines. The problem they solve never arises in modern life. So there's no commercial solution available to repurpose. Add that to the fact that election boards are always hideously underfunded and understaffed, there's no one out there to hold the contractors' feet to the fire.

Really, state and local election boards need to just go back to the older systems, but there's nobody making them do it, and you will sound like a Negative Nancy trying to take away all their fancy new kit.

What really needs to happen is for POTUS to make it an issue. With one swipe of his pen he could issue an executive order to throw federal money at a new department whose job is to maintain a body of standards for electronic voting machines and mandate that all new machines have to adopt on a certain time table. They probably won't be secure, but it'll be the department's job to respond to reported vulnerabilities and ensure that they get fixed.

How much would it cost to produce a decent secure voting machine design? No more than a few tens of millions, right?

Maybe a few of the tech billionaires that read HN could pass around a hat and get this done?

"Saved American democracy" would be a good legacy for anyone!

Congratulations you've rediscovered taxes and their purpose.

What has paid for the devices under consideration in TFA? Why have those taxes not resulted in the usable machine described by GP?

Same reason a few billionaires passing around a hat wouldn't result in a secure device. Those billionaires are either already running the government or lobbying the poop out of it. Our system is kinda messed up right now.

Since the outcome of the process facilitated by these machines determines the authority to levy and spend taxes, doesn't it make sense - for this one particular expenditure - to have a wall of independence, both political and financial?

A single million would get you a good solution. You'd need to set aside the remaining tens for lobbying to get it adopted.

Governments didn't make this device. They hired a contractor and/or purchased from a vendor (which likely specifically set up its business to profit from government contracts for voting machines). The vendor is almost exclusively interested in getting paid money from the contract, not with actually delivering a highly secure device that a democracy can depend on.

Commercial viability of a solution is a non-issue. A device is either highly secure or it isn't.

Absolutely this.

Federal and State governments should stop using contractors all together for software projects. Instead, hire a very large shared bank of highly-qualified engineers and pay competitive salaries. Even if those engineers sit around doing nothing most of the time (unlikely), they would still be extraordinarily cost-effective compared to pissing away hundreds of millions on projects that should only cost a few million.

IMO it's impossible to take deficit hawks seriously if they don't back a blanket policy of starving out leeching contractors.

There is a strong current of blind faith right now that private services/products are automatically the most efficient choice. Really there's a lot of market conditions that need to be in place before that's likely for a specific product or service, but careful consideration gets overrun in the bigger meme of gov't bad/companies good.

> Only the military has the budget to design solutions from scratch.

Define from scratch. It's perfectly reasonable and economically feasible to develop a SoM or SoC based hardware platform.

Because the important thing is getting it through the procurement process, which is largely a political wining-and-dining process. The procuring governments have no way of assessing their requirements or whether they're getting a good product.

The solution you describe is the cryptographer's one, the result of taking security seriously. The contract goes to those who take the politics of procurement seriously (and, frankly, pushing unsuitable and unnecessary solutions to non-problems). It's still questionable whether electronic voting is necessary at all.

A lot of the early bad ones were from Diebold, who make ATMs. The ATMs also run WinXP, but are much more physically protected.

>Am I missing something?

Probably - corruption involving the contracts, outsourced or incompetent engineers (chances are, the best and the brightest are working on things that actually turn a profit), and neither party really having a strong interest in a system they couldn't subvert if they wanted to.

Hurray Capitalism?

I sort of chalk it up to the sort of stuff you get with hucksters that sell stuff to municipalities.

The business is a little different than when some random person buys a phone, because while they are technically inept, there is a layer of brokers/buyers between the manufacturers and the stores. Those guys are smart and know their markets well. If you ever sold something into that market you need to produce a few thousand units, for those guys to beat on. And they have to be perfect, or they won't place orders.

This doesn't exist for something like a voting machine.

So think 'stuff thrown together as quickly and cheaply as possible' in order to land the contract. Quality will vary a lot.

Why put in all that cost/effort when you can sell laptops with MS Access voting apps for the same price?

Can you? When we're talking about N machines per each voting point, even volume pricing of MS Access may be larger than a dedicated box. Of course the price of designing a dedicated box is non-zero. But if you can reduce the dedicated box spec to <=$100 and reduce the scope of any review (you're not reviewing the whole OS anymore), I'm not sure laptops would be cheaper.

For small productions runs - and it's hard to sell more than a couple hundred voting machines locally - developing the product (NRE) typically dominates costs.

Imagine that you have one developer who can do enough hardware, software, and documentation in a single man-year, and whose fully-loaded cost is $100 000 per year. Then just paying that developer will cost $1000 per box on a 100-box production run; paying a team of three such developers for two years would still cost nearly $700 per box on a 1000-box production run.

(And those would need to be very productive developers; I'd expect a team of 10-20 people if you want to do the above in a year, once you include sales, staff, and specialists doing projects/consulting work for your company.)

But that's general cost, not cost compared to current solutions. Hardware, software, documentation also had to be produced for any solution using XP embedded. (Probably shouldn't have continued using "laptops" idea from the parent post, since that's not really what's happening.)

Kinda ancillary to your point, but if you think the developers who write stuff like this make $100k/year, you've lived in Silicon Valley or NYC for too long. These kinds of projects are typically done by someone making half that somewhere in middle America.

Kinda ancillary to your point, but if you don't know what "fully loaded cost" is, it might behoove you to look it up before assuming it means "salary".

I've never hired a $50k/a engineer, so I don't know what the multiplier is, but I've heard people throw around "2x" as a rough estimate. So you and JoachimSchipper are assuming the same salary, more or less.

As someone who's done consulting electronics product development, I agree with your numbers.

Fully-loaded employee cost of 100k is probably 60k in salary. maybe 70, tops. But point taken.

> Then just paying that developer will cost $1000 per box on a 100-box production run; paying a team of three such developers for two years would still cost nearly $700 per box on a 1000-box production run.

That's not correct. Development is a fixed cost -- you don't rewrite all the software and re-design the hardware every time you run a new production run.

Furthermore, this isn't even necessary for hardware stuff where production run size actually does affect cost. If the machines are developed in house and you know you'll be using them for the next 15 years across the whole US, you can do a few medium-sized production runs.

Which is exactly why federal and state governments should have a permanent bank of software engineers and EEs for routine software projects like this. Then they can do what makes sense for the taxpayers, instead of having to play fiddle to the profit motives of an incompetent money grubbing contracting firm.

which is secure?

What I don't get is why using access. If it's just to keep count of the number of button pressed, even a text file is good enough.

A simple but elegant product is unlikely to wow the politician making the purchasing decision.

If it's complicated and over engineered, it'll probably be expensive too. Both factors in favour for a politician, as if it's expensive it's a safe bet.

If it's a boring little eight-segment display and a pair of buttons, the voters will go "we spent $10m on this cheap looking crap?!".

So you go for the one with the shiny gui, the crazy price tag, and you've chosen sensibly - or as sensibly as one can in our batshit insane system of the world.

Because those things are decided on basis of what's cheapest, not what's the best. I'm 100% certain that designing your own box with custom buttons is more expensive than buying cheap laptops with XP already pre-installed.

"How can these things be created without at least one person saying "this shit is unacceptable"?"

Because the people who decide what the money is getting spent on have absolutely no idea what is acceptable and what isn't.

I think the main party to blame here is Microsoft. They're pushing this "one-size fits all" solution into everything - from embedded systems to super-computers. To them it doesn't matter if Windows is "over-engineered" for a voting machine - it's just another license sold.

If it were up to me no embedded system would ever use the same operating system that's on a billion PCs. That's just asking for trouble.

Define "embedded system" here: a ban on kiosk PCs? Could you apply the same logic to Linux, which is on hundreds of millions of PCs and also embedded routers? Is the problem just proprietary software?

Linux is not an OS, it's a kernel. There are hundreds of different distros (the actual operating systems) with various degrees of security from being worse than Windows to having ultra-hardened kernels and user-spaces.

So from this point of view, I think it's okay for "Linux" to be in multiple things at once, because it's really pretty far from a "single thing". The embedded versions of Windows seem to be more like 90% of the desktop version of Windows, and with the "unification" strategy of Windows 10 that's probably more true than ever.

It's debatable whether a kiosk PC that handles purchases should run Windows or not. What's the worst that can happen there? The owner loses his records and possibly all of his money. It only affects him so he can choose whatever he likes. If he wants a less secure OS and he's fine with the risk, that's okay.

A voting machine (which is duplicated across a city or state or country) that's not secure affects millions of people. Seems to me that it shouldn't be using "mainstream" solutions that are the target of thousands of hackers.

I've said it before many times, but the government's operating procedures are (accidentally (sort of)) tailored to explicitly filter out all the things that make for good hackers/programmers. This is an old essay I wrote on this subject that I usually post in repsonse to comments like this: http://wademeredith.com/2011/05/why-the-dmv-website-sucks/

Most of your questions can be answered "Because it is cheaper" and "Because certifying boards are useless"

Grandfathered in lucrative government contracts.

Reply on news.ycombinator.com