Hacker News Reader

Comment by adolph | Hacker News Reader

From the interview a story about paper ballot tabulation problems:

With fill-in-the-bubble ballots, a typical error would be printing the ballot with the candidates in one order but programming the scanner with the candidates in a different order. There was a famous incident of this happening [in] Pottawattamie County, [Iowa], in 2006 in its June primary. The net result was that the numbers that came up were pretty nonsensical and bore no relationship with anyone’s expectation of the outcome of the race. The election officials noticed. They did a hand count, and that completely resolved the problem. And they could because they had paper ballots.

I think like most things there are tradeoffs and the qualities most needed in the system run counter to one another--speed can cause errors to be missed, security reduces access, etc.

View on HN

Many jurisdictions do, and all jurisdictions should, test every machine with a reference set of ballots and verify the correct output as part of commissioning. This is intended to detect errors of this type.

Right but it seems some machines are connected to the internet (seriously).

And it's probably easy in the firmware to check if you're being tested (ask Volkswagen). And even if it's not, you could write a firmware you could trigger with a specific ballot.

The bottom line is firmware for these things should and must be open so they can be audited by experts. And hackers must be given access to them so they can try to do their worst.

As long as you treat it as a black box, I'm afraid to say you aren't trusting the device, you are just having faith in it.

While they do exist, internet-connected machines are relatively rare. Unfortunately guidance has been inconsistent. Some states have qualification standards that prohibit network connections on tabulators, some states have standards that allow it, and some states don't have standards at all. In non-binding recommendations, the NIST is against network connectivity but the FEC takes a softer line on the topic. This is a great area to lobby state governments, all state standards should prohibit internet connectivity.

Generally, from a network security perspective, electronic pollbook systems are a much greater concern as they are connected over the internet as a matter of standard practice, and it's difficult to avoid this while preserving functionality. There are also more, smaller vendors for EPBs and they receive significantly less scrutiny or security review than tabulators.

Reply on news.ycombinator.com