Argentinean programmer's house raided after he found a security breach | Hacker News Reader

Argentinean programmer's house raided after he found a security breach

twitter.com

Some context: He found a security breach in the public voting system of Buenos Aires city, Argentina (elections are tomorrow). He brought it to awareness yesterday: http://www.lanacion.com.ar/1807352-denuncian-un-agujero-de-s...

The tweet reads:

After finding a vulnerability in the voting system they're raiding my house, people from computer forensics.

Broad summary of what's been going on the last few days in Buenos Aires, Argentina (by /u/sebadoom):

https://gist.githubusercontent.com/sebadoom/f0eedcba2f39e3e0...

There are several bugs in the system reported by local engineers, like being able to add multiple votes to a sigle voter's RFID chip.

This is a scandal and a complete failure at several levels, not only for the local city goverment but for respected institutions like the University of Buenos Aires which got paid to audit the system.

And this is all happening in the same day as the America Cup (Copa America) Final between Chile and Argentina, so people are numb to most of this news.

He is accused of leaking the private information of 2000 people involved in the electoral operation.

That's why he was raided. Not because of the alleged vulneravilities he found.

That would sound more reasonable, do you have a source for that or is that just heresay?

It was that and the WMDs in his cellar.

https://twitter.com/fraudevotar

http://justpaste.it/votarleaks6

You don't raid someone for doing that, you raid someone to silence them, then use that as a justification.

Some people will totally accept that explanation. And some people will pretend to accept it, even though they know it is a sham.

What kind of people orders such a raid? What's the mindset behind that decision? Their own team wasn't good enough to catch the breach (hell, the whole thing sounds like a train wreck) and now they try to silence people who reveal their incompetence?

The same administration that just assassinated a prosecutor that had written out an arrest warrant against her.

Wrong.

The federal goverment is from a different political party, they are NOT the same people that are running the local city goverment. The police that raided this guy's house was the metropolitan police (BA city police), not the federal police.

Important correction: the "metropolitan police" is not the city police. Legally speaking, it's more of a private army that only answer to the executive branch of the city's government. Yes, it's incredibly amazing that such a thing exists.

"Police" it just a word in the name of the institution.

I, and many others have proven in public/open court, that the police/military are completely compromised around the world, and that they are not allowed to act-as or call themselves the police or military anymore.

It was scrubbed... Again, and again, and again...

:-(

Thanks for the correction, I didn't knew.

Just to add, an arrest warrant against her for aiding Iran terrorists that attacked Argentina.

If embik thinks he does not know what those people think, I guess he should turn that into a certainty from now on.

There are a lot of examples in the US of the government harrasing citizens who report vulnerabilities. The DMCA is typically used to justify this behavior.

I'm not sure what the appropriate conclusion is here.

If we're that charitable towards their motivations, I'd generally expect the sort of people who end up in large city administrations to do that more than not.

Another possibility is that they had arranged a good setup for vote manipulation, and someone exposed it.

You must not know much about history.

In Argentina specifically, there was Juan Peron. The broadway play and movie "Evita" is about his wife. I once read her biography.

Some astronomers I once met were at cerro tololo inter-american observatory in chile when some heavily armed men turned up to look after the nearby radio towers.

Conspiracy theories abound with respect to JFK's assassination.

No one really believes that communists torched the Reichstag.

On December 8, 1941, the pearl harbor base commander found a letter from the US state department in his mailbox, to let him know that the japanese might give him trouble sometime soon.

"Gentlemen do not read each others' mail.". That was the stated reason that the US stopped its codebreaking work. I dont believe it really did. The best way to read a gentleman's mail is if he doesnt think he needs to encrypt it.

Josef Stalin once knocked over a bank, then gave all the loot to Lenin.

With all due respect... What the hell are you talking about?

One of my great fears is that posts like the one you responded to turn out, years later, to be 100% legitimate, despite how weird they sound now.

Every starving writer just loves to hear about it when a fan appreciates his work.

I think his ultimate point was that embik is being naive. That it is just a simple coverup with a thin, obviously untrue excuse.

Have a read of the parent post that mine is a reply to.

Why wouldn't you order a raid ? A security vulnerability in a voting system has been exposed.

Yes this guy may have done nothing with it but I would damn want to make 100% sure that was the case. And I would definitely want to make sure that the vulnerability wasn't recklessly revealed. This isn't like finding a browser bug we are talking about, you can radically alter the course of a nation.

He posted the same on the python argentina mailing list last night. Unbelievable; he merely published security holes on publicly available code.

Nothing wrong (nor legally, nor morally) there. It's not the first hole to get published recently either.

It IS legally and morally wrong to reveal security holes before there has been an opportunity for it to be fixed though. Security researchers almost always do the "right thing" before potentially unleashing mayhem.

Not saying he didn't do this just that it isn't a black/white issue.

No, it is neither illegal nor immoral.

If it's less than 24 hours before the election, it's absolutely right to go public.

Or are you in favour of electoral fraud? Republican, perchance? Work for diebold?

He should have disclosed it to the regulators before going public.

The debate between 'responsible disclosure' and public or 'full disclosure' has been argued ad nauseum elsewhere. but it really comes down to trust.

If you don't trust the people you are responsibly disclosing to, to actually fix the problem, or worse to not sue you or attempt to get you charged as a criminal (the CFAA is particularly abusable), then full, public disclosure may be your only option to force the vendor to fix their product or service.

Remember, it's already broken, and you may not be the first person to have noticed.

Reply on news.ycombinator.com