Ask HN: Security researchers, Am I dumb? | Hacker News Reader

Ask HN: Security researchers, Am I dumb?

1 pointthrownawayer0095 comments

First, I assign no party to have done the following, but I am genuinely curious:

Why do I feel like it is so easy to do the following:

1) Secure Equifax data for SSN, Names, Addresses

2) Ensure person is valid registered voter in SOS website

3) Identify which are least likely to vote

4) Request a ballot on behalf of valid registered voter

5) Spread requests across leases and owned properties or PO Boxes

6) Collect, fill in, and send ballots

People have done crazier things for lottos when the odds get right. The only hitch here is matching a signature to the voter registration, which if I were an enterprising lad, might be easy, no?

View on HN

> Secure Equifax data for SSN, Names, Addresses

What does this mean?

> The only hitch here is matching a signature to the voter registration, which if I were an enterprising lad, might be easy, no?

No. Even if signature-matching were a legitimate process, it's still not easy to see someone's signature.

The real hitch here is that this doesn't scale. Even if you pull it off perfectly, it's:

- expensive

- difficult

- easily discovered by the voter

- possibly fruitless if the voter was on your side already

And even if you could make it scale, you'd have to have massive scale to actually sway an important election. You don't know ahead of time which counties (or even states!) will be crucial to the election. You can guess, but you can't narrow it down to one.

So if I were trying to sway the current presidential election, I would have had to alter 10,000+ votes in multiple states. If my success rate (meaning I'm not discovered) is 50%, suddenly I had to alter 20,000 votes.

Once you get to election fraud of that size, you become pretty easy to find, and someone is likely to notice and find you.

> Identify which are least likely to vote

This part is also impossible. If it were possible, polls would be a lot more accurate.

> Secure Equifax data for SSN, Names, Addresses

> What does this mean?

I have to imagine it means that since Equifax was hacked and the personal information has been copied in other locations to verify if individuals have been pwned - that it makes it on the easier scale for a powerful organization to acquire.

> Expensive

I don't think a dollar amount can be put on the economical impact of 'influencing' some high profile elections.

> Difficult

See above.

> Easily discovered by the voter

This point will address the 'impossibility' of identifying likely voters - this information is actually what ground campaigns rely on and update on a daily basis in local elections. There are companies that offer this information by analyzing voter rolls based on campaign themes and much more - the data is there, the usual 'game theory' is you only focus on turning out your base and doing what you can for undecideds.

> So if I were trying to sway the current presidential election, I would have had to alter 10,000+ votes in multiple states. If my success rate (meaning I'm not discovered) is 50%, suddenly I had to alter 20,000 votes.

OP must mean 'easy' for a large organization, or coordinated effort, not a one off individual.

Finally, I agree on the idea that 'there should be smoke' - we would be seeing many people show up to the polls only to discover they have 'already voted' or 'received a ballot by mail' - and those people would be making a fuss.

The question is how credible the unlikely voter information in the current polling and political strategy services.

> I don't think a dollar amount can be put on the economical impact of 'influencing' some high profile elections.

Sure it can.

Let's say the cost of a TV ad campaign is $100M, and you expect to get an extra 1,000 votes out of it.

Now let's say the cost of elections fraud, an extremely serious offense, is $100k + 75% chance of going to prison. That $100M suddenly sounds a lot better to most people.

We can't know whether it's 1% or 75%, but unless you're very smart and conspire with a very small group of people, it wouldn't be hard to catch you. At the very least, you'd be on camera visiting your post office boxes (which you can't use to register to vote in some places anyway).

> This point will address the 'impossibility' of identifying likely voters

I didn't say it's impossible to guess likely voters. It's impossible to guess highly unlikely voters.

Likely voters follow a pattern: they voted before. Once someone votes, they're likely to vote again.

Unlikely voters could just start voting in any election (as they did in this year's) without any warning. There's no psychographic or demographic information that's widely available to hackers to help them decide which unlikely voters will continue to be non-voters.

A few problems with this.

1) You need to get access to this data first, which is hard. But certainly possible for a nation state to do. Not easy for random individuals.

3) You can't guarantee whether or not someone will vote. Voting twice is a federal crime, and we routinely arrest people for this. If this were done on a wide scale we would see a large spike in these types of arrests as plenty of people who were identified as unlikely to vote would still vote, triggering the FBI to make an arrest. Of course those arrested would then claim they didn't vote twice, and you would be arresting the people who's identity was stolen rather than the perpetrator.

I think those two reasons both rule out the case of individuals doing this, and a large organization doing this systematically. Maybe there are still some loopholes I missed though.

people systems are never easy

Reply on news.ycombinator.com