Voting machines pose a greater threat to our elections than foreign agents

Have you heard about the STAR-Vote system? What do you think about it: https://www.youtube.com/watch?v=Cl8q_356zZs https://en.wikipedia.org/wiki/End-to-end_auditable_voting_sy...

And its an age old problem. We have expressions for it, ballot stuffing, and quips about it, vote early and often. We even had a partisan judiciary decide an election since the machines failed to fully punch cards.

Why can't both be a factor?

Cool, though hacking Xbox is probably less valuable to would-be attackers than hacking US elections.

Not even oppose really, the mere act of questioning how secure they are given their track record of being prohibited in Germany, Holland, and India would attract not opposing arguments but name-calling. We are supposed to just trust that everything is well and good.

I'm confused. They're actively fighting secure elections?

Well, just to be fair, paper and pencil are not good enough any election.

I mean, what about elections that you want to steal?

It's a whole lot harder to steal an election without an electronic voting scheme in place.

/sarcasm

It's not a good thing when the state has ineffective processes that rely on the vendor's assurances if it has any standards at all. If the feds were imposing a preemptive monoculture that'd be bad. But that's not at issue.

In fact they all use voting machines from the same few vendors and mostly running Windows, so there are plenty of common vulnerabilities.

Also, in the US, hacking a single large state can swing a federal election.

That would only makes sense to me if rigging only one state was near useless. It's very much not. If you rig say, Florida, there's a fairly high chance of deciding the election.

You don’t need to corrupt all of the voting processes though, you only need to do it in a few key states. Funnily enough, the states you’d need to do it in would be the poorer ones who’d have no ability to discern a good voting solution from a bad one.

The real solution is to use paper. There’s no way to fuck with a paper ballot system other than to go to every polling station and fuck with their counts - an expensive and highly visible attack.

That's almost like saying that if there isn't a company-wide security policy, every department will implement security whatever way they want, making company-wide data breach impossible.

Perhaps votefrauding swing states would be an easier target, much easier than targeting all states..

This gets repeated a lot, but it directly contradicts another bit of common wisdom: security by obscurity isn't.

Not only are we vulnerable to a few key districts tipping elections, nation state actors should find it absolutely trivial to build a comprehensive program targeting the full spectrum of voting machines used in practice.

Or you can design a system that’s the same for everyone because it actually works.

Like, you know, observable paper ballots.

The federated security you describe holds as long as the Electoral College holds. If elections are decided by popular vote, just one or two hacked/corrupt county-administrated systems could decide national elections.

To some extent, yes. But you can still have centrally-imposed rules that improve security for specific voting methods.

The US Election Assistance Commission develops testing and certification standards for voting equipment. They also certify 3rd party laboratories that certify equipment. States are not required to use the recommendations but some states have passed laws that only certified equipment be used.

https://www.eac.gov/voting-equipment/system-certification-pr...

How do you make sure that the firmware image deployed on those machines wasn't compromised from the beginning?

What happens when a bug occured and machines need to be updated? Do you bring all machines in for maintenance or does a local IT shop do it? Maybe the manufacturer send a person but can the person be trusted to update multiple machines all over the country?

If we just disconnect from the internet, then the local politicians will still be able to fix the elections. Unscrupulous local politicians are a bigger problem than foreign interference.

I don't think you're correct to assume that the biggest problem is connectivity for reporting results.

How does the voter verify that their vote was counted correctly?

All electronic voting machines should output a paper human readable 'scantron' type ballot that is safely stored for verifying the internal digital tally.

About a decade ago, a researcher demonstrated a worm that could be implanted in one machine, that over the course of months would spread to a large number of machines as election workers did routine maintenance. Since physical protection of the machines was typically weak, the initial compromise wouldn't have been that difficult for anyone able to pick a lock.

> If we're really concerned about this - get rid of the network connectivity.

Iranian centrifuges had no network connectivity: https://en.wikipedia.org/wiki/Stuxnet

> just make it more environmentally friendly so however millions of people times the size of the paper ballot isn't wasted needlessly.

this is one of the biggest straw men i've ever seen on this site.

you realize that building computers out of various plastic and rare earth materials sourced from all over the world isn't free, correct?

> I think the key issue is that these machines are internet or network connected. If we're really concerned about this - get rid of the network connectivity.

They (generally) aren't.

(Almost) every demo of voting machine hacking involves physical access to the machine, tools, and keys/lockpicks.

What a nice and opaque technology. Bribe (or blackmail if you are from NSA) a developer or sysadmin and ask them to make so that every second vote for candidate A goes to candidate B and candidate B wins. It doesn't matter how people will vote, it only matters whom sysadmin chooses.

> I think the key issue is that these machines are internet or network connected.

This is a very important issue, certainly. There is no excuse for voting machines not to be air-gapped. But that's not the only very important issue with voting machines.

That will let you verify that your vote is counted, but is there any way to verify that additional votes are not manufactured?

It's an interesting idea, but I am skeptical of any system that requires voters to do the verification themselves after the election is complete. I suspect that there wouldn't be enough people to actually do that to make any sort of difference.

Because if you can check how your vote was counted, you may be coerced to check it with, say, your boss standing behind your back - so, your vote is no longer secret.

But, of course, voting by mail is even worse, and most of the US seems to not care about it a slightest bit.

Maybe the old saying "Absence of evidence is not evidence of absence" applies.

North Carolina, Congressional District 9 - https://www.theatlantic.com/ideas/archive/2019/09/north-caro...

It sounds like there was a more-or-less professional election rigger involved:

"According to prosecutors, McCrae Dowless, a contractor for the Harris campaign, oversaw extensive election fraud in Bladen County, in the district’s rural east, affecting potentially hundreds of votes."

Details about McCrae Dowless: https://www.charlotteobserver.com/news/politics-government/a...

He sounds extra sketchy.

When people talk about voter suppression, we don't always talk about these highly effective methods such as: - requiring a specific ID that is difficult for certain segments of the population to get. Either by requiring non-existent documentation, or making the in-person process onerous. - closing polling stations, or understaffing in certain areas. - adding regulations that are prima facie neutral, but in reality disadvantage some population segments more. (eg: unstable home addresses, no PO boxes accepted, not allowing college addresses) - not making good faith effort to ensuring everyone has maximum access and accommodation at polls, eg: signage, language translation, advertising campaigns, technical use challenges.

A lot of these rules and restrictions are constructed in such a way that the dominant language/culture/homeowners don't have any problems meeting them, thus offering an easily defensible reasoning behind them. It seems totally reasonable to assume everyone has ID - but if you don't drive, and are well established in a community you probably won't need ID to conduct life.

The reality with the importance of the chief federal executive office and how the election swings on such narrow margins in certain states, this is a problem that constitutional we just aren't able to easily solve - deliberately so, that is the constitutional order constructed on purpose.

OK, so if that's an unpopular opinion, then lets at least make voting a national holiday, move it to a weekend day, or make it last more than one day?

A single Tuesday in November seems like an awfully thin window to measure the sentiments of a nation of ~350MM, no?

Why are we married to such an archaic idea of what is a reasonable time to cast a vote?

I think this is a hopeless goal, sort of related to Reflections on Trusting Trust.

Even the most basic version of this, a ballot-marking system, is pretty much infeasible unless you have formally verified hardware as well, which is not even possible even for commercial vendors. At least for them, selling sealed units that are somewhat resistant to physical modification is possible, but even there physical compromises have been demonstrated.

Ballot scanning machines (for hand-marked ballots) are a pretty good balance of time/accuracy/simplicity, with the auditability being a big bonus for both random checks and for disputed elections.

To take New York state as an example, it has manually marked ballots now with ballot scanners for tabulation, and I'm reasonably comfortable with the tabulation and placement aspects; where NY fails is largely in usability -- ballot design is worse than terrible, and borders on misleading. That plus the inscrutibility of NY's ballot initiative system (trying to find the actual text of the ballot measures is nearly impossible) makes the whole system a little shakey. And part of that as well is the scope of elected positions for minor things (what the hell is a Comptroller and why are we voting for one); they basically are a power transfer from the executives to the party machine to allow them to essentially give positions to people favored by the (unelected) party apparatus, which give toeholds to higher positions.

How do we verify that our hypothetical perfect software is what's running on the voting machine?

We have this. It's called a paper ballot.

> we could develop an unhackable

"Unhackable" is an unachievable goal.

How do you do "bipartisan counting" and validation in an all digital voting system? Reading the same digital information twice, doesn't verify it.

If you have paper ballots, sure, but the US does not have paper ballots in some states and won't by the next national election. And even if they did (as many do), few states have a uniform system of random vote audits.

So I'm not sure what you're referring to with this:

> There are enough checks in the system (bipartisan counting and validation committees) that a pure digital compromise of an election that would not be flagged and detected is very small.

I literally read the Diebold Voting machine source code (and tabulator) that was leaked (twice). There's nothing remotely like that in there. There's no facility to do that. And while most of those are now retired, there's similar machines that work exactly the same way still in usage.

I would agree. If the worst we have to worry about from outside influences is that they're sharing posts on FB, I really think their power is over stated.

> a lack of identification requirements for elections that make certain classes of fraud difficult to detect.

Go on, because let me tell you what this looks like in practice here in NC. Here, you currently have to register and then provide your name to a poll worker, then sign that you voted. The only plausible fraud I can imagine if I wanted to vote more than once is to give the name of someone else and hope they don't show up to vote. There's no way I can imagine to do this at a significant scale without it going undetected. (You'd have to somehow get a bunch of fake names registered or figure out names of people who aren't likely to vote, then find people who are willing to commit fraud to vote under those names and get them to do so during early voting I guess.)

Beginning next year, we need to present ID to vote, but the acceptable IDs are fairly restrictive[1,2]. In particular, my college aged daughter who will be voting for the first time next year is not able to use her state college issued ID[3]. Nor can she use her expired DMV learner's permit. Now fortunately, she has a passport and she'll use that. But otherwise, she'd have to get some form of acceptable ID.

This is not well-publicized, and I guarantee there will be first time student voters next year who will be surprised to learn they can't vote with their college ID, and must instead to submit a provisional ballot.

I am certain this will suppress many many more votes than fraudulent votes, if fraudulent votes even exist.

1. https://www.ncsbe.gov/Voter-Id

2. "Of the approximately 850 universities, colleges, state and local employers, including charter schools, and tribal entities that were eligible to have their identification cards approved, 81 institutions submitted requests to the State Board of Elections. We do not in all cases know why the majority of institutions chose not to request approval, but in some cases institutions raised concerns that they believed they could not meet the current statutory requirements."

https://s3.amazonaws.com/dl.ncsbe.gov/Voter%20ID/Corresponde...

3. https://s3.amazonaws.com/dl.ncsbe.gov/Voter%20ID/Student%2C%...