top | item 17750664

US elections remain 'dangerously vulnerable' to cyber-attacks

190 points| pmoriarty | 7 years ago |theguardian.com | reply

127 comments

order
[+] umanwizard|7 years ago|reply
Friendly reminder: electronic voting is totally unnecessary. Many highly developed democracies (e.g. France) have totally paper voting where the ballots never leave the public eye.

If the past is any indication, there will almost certainly be a lot of comments on this article proposing complicated schemes for making electronic voting secure and verifiable. Consider when evaluating these schemes whether there is any benefit or upside at all over good old fashioned unhackable paper.

[+] liberte82|7 years ago|reply
The best benefit I've heard about paper voting is the mechanism by which trust in the count is ensured.

With paper voting, all votes are counted by several people, with oversight and random recounts. It is _possible_ to cheat, but it would require a local conspiracy for a limited number of votes.

With electronic voting, the counting is done by machines and the mechanism is obfuscated and unverifiable. If it's working correctly, it should be perfect; but if the machines were hacked, it could be done through a network and the impacts could be massive. It would require a large conspiracy to pull off, but the number of votes that could be affected could change an election.

So in summary: paper voting = higher chance of small irregularities, with limited impact; electronic voting = lower chance of massive irregularities with election changing consequences. In paper voting, the trust is distributed, while in electronic voting, it is centralized.

[+] 8ytecoder|7 years ago|reply
What is HN's view on the Indian Electronic Voting Machines? These machines are not connected to any network. They reduced invalid votes by a huge margin, increased trust in the system by making it almost impossible to stuff ballots, reduced the time to get the results by a very significant margin - even a full recount can be done in just a few hours. There are risks. IMHO, those risks existed with paper ballots as well. Also to note that this works well in India (so far no major complaints) primarily because it's accompanied by an independent Election Commission i.e., national/state/local sitting officials don't oversee elections.

https://en.wikipedia.org/wiki/Electronic_voting_in_India

[+] doombolt|7 years ago|reply
Paper voting means that you can hold very few elections and the like. This means choosing between representatives who nobody likes, and only discussing major questions. With electronic voting (not the black box kind of course) there's hope that democracy becomes more direct.
[+] PurpleBoxDragon|7 years ago|reply
>Consider when evaluating these schemes whether there is any benefit or upside at all over good old fashioned unhackable paper.

Just because there is no immediate benefit doesn't mean there won't one day be benefit. Initial versions of many forms of technology were near useless and only became better after refinement. Just look at how useless the original electric cars were. But electronic voting, if someone could make it safe and secure, could have benefits we can't recognize.

The risk is implementing an incomplete system and the very likely possibility that any government attempt will be very lacking (and often filled with the standard amount of corrupt in similar large IT projects). I would not support removing the paper process currently, but I would support development going into electronic voting so that one day the technology will be mature enough for us to see benefits that current paper voting can't provide.

A few examples of what may one day be possible is massively lowering the cost to vote (for many poor people getting a few hours off of work to go vote ends up costing them far more than they value their vote being worth), making it possible to do voting a more regular event which would allow more direct democratic versions of government, the ability to have something we can trust more than slips of paper that have to be hand tallied (current systems are far less trustable, but future systems may be able to become more trustable than paper).

[+] umvi|7 years ago|reply
> at all over good old fashioned unhackable paper.

I think regardless of if paper or digital is used, we need an anonymous verification method. i.e. I can confirm that my vote was cast and tallied for X candidate. And if you got your whole community together, you could prove there are no injected or altered votes.

The receipt of a vote could be a UUID that you can then use later to verify your vote, for instance.

[+] paulddraper|7 years ago|reply
> good old fashioned unhackable paper

I agree with you, but let's not kid ourselves.

"Vote early, vote often" did not originate with electronic voting. Paper systems are hackable as well.

[+] davidw|7 years ago|reply
Worth repeating: Senator Ron Wyden has a bill that would require paper ballots. Worth calling your lawmakers to support.

Edit: press release with link to the full text of the bill - https://www.wyden.senate.gov/news/press-releases/wyden-gilli...

[+] meritt|7 years ago|reply
We vote entirely by paper ballots and additionally by mail in Oregon (Senator Wyden is OR). You have 2-3 weeks to read through the issues, candidates, and then make hopefully responsible and educated choices. And if you don't want to pay for a stamp, there's numerous dropboxes around town where you can deposit your ballot at your convenience.

There's no rush to the polls, nobody has to skip voting because they couldn't get to the polls, and for the outliers who aren't able to receive/send mail, they can pickup their ballots at the local county elections office.

Oregon was also the first state that instituted automatic voter registration.

[+] beat|7 years ago|reply
I would love to see Democrats pick up a blanket ban on paperless electronic voting as an issue. The GOP won't, for, um, reasons. This is a marvelous partisan opportunity, if the Democrats are wise enough to pick it up.
[+] MichaelApproved|7 years ago|reply
It's insane that we have systems using 100% electric vote counting.

Any system, even 100% paper ballots, are hackable. They key is making the hack difficult to scale.

Computer systems are easy to hack from a distance and in large numbers. Theoretically, one person could hack many devices from another country.

Paper ballots require someone to change/stuff in person. One person can do limited damage and would have to be in the country. You'd need to recruit large numbers for an effective operation.

Electric assistance is fine but ultimately you need a paper result that a human can read.

A computer can help you make selections and fill out the ballot but the voter must be able to read the printed result and confirm their vote was properly printed.

I'd be against any computer counting for the initial count. Manual is slower and expensive but it's worth the added cost to have a more secure voting system.

[+] antris|7 years ago|reply
> A computer can help you make selections and fill out the ballot but the voter must be able to read the printed result and confirm their vote was properly printed.

And that would essentially make the voting machine a very expensive pen.

[+] ciconia|7 years ago|reply
I think there's a good chance the 2016 US elections were in fact manipulated, and the upcoming mid-terms are not gonna be any different.

"[The hackers] wouldn’t need too heavy a hand... just a couple of tweaks here and there." [1]

Sadly, it's in the interest of the ruling party to look the other way.

[1] https://fivethirtyeight.com/features/how-russia-could-steal-...

[+] InternetPerson|7 years ago|reply
A hostile nation targeted our elections in 2016. We know that much.

In February, the NY Times writes, "The Justice Department charged 13 Russians and three companies on Friday in a sprawling indictment that unveiled a sophisticated network designed to subvert the 2016 election" [1]

OK, so Russia had this expensive, sophisticated operation to influence the election. It wasn't a half-assed effort.

So why wouldn't this operation include attacking voting machines? Especially if the machines are vulnerable and virtually unprotected?

[1] https://www.nytimes.com/2018/02/16/us/politics/russians-indi...

[+] empath75|7 years ago|reply
I think we’re going to find out that election machines have been regularly hacked since they were first released and that they were in fact designed to be insecure. It’s been well known that they were broken and unauditable going back to the Black Box Voting days of 2004 when everyone thought Bev Harris was some kind of paranoid nut job.
[+] liberte82|7 years ago|reply
Former CEO of Diebold, in 2003 when the first electronic voting machines were used (back when it was controversial, and people hadn't given in to this idea that it is inevitable and inherently "better" than paper voting):

"I am committed to helping Ohio deliver its electoral votes to the president."

[+] gonmf|7 years ago|reply
Just to add my 2 cents. I participated in elections before, both as a candidate and as member of the voting table (at instances at the same time as well). If there is some complicit agreement you can see certain leaning votes being discarded as not being clear enough, mostly because they are too left for the table or the inverse. This is widespread and a mostly unknown phenomena, since no one is going to recount a table for a small percentage of discrepancy.

I don't know anything about electronic voting but if it can guarantee there is no personal opinion in the middle, good.

[+] maxxxxx|7 years ago|reply
Considering how militant US politics is I wouldn't be too surprised if the people in power are actually OK with cyber-attacks as long as they go their way.

Coming from Germany I don't even comprehend how the US is not able to run elections in a way that can be trusted. The 2000 Supreme Court decision should have been a big warning. I really believe there are a lot of people who don't want to fix the system because it would take away the opportunity to create more theater and conspiracy theories along party lines

[+] elif|7 years ago|reply
After the 2000 (record speed) SC ruling, many people were vocal and protesting.

Then that died out around September...

[+] marviel|7 years ago|reply
Can anyone on HN provide me a good article or explanation as to why digital voting machines could be considered better for democracy?

My intuitive reckoning is that making the "verifiability check" for a given vote something that non-technical people could carry out would increase the number of eyes on both sides which could point out inconsistencies.

EDIT: added/removed words for clarity

[+] giarc|7 years ago|reply
I don't have any articles, but I think I could come up with one reason why electronic voting may be preferred.

The last time I voted was a municipal election in my city. I was given 3 separate ballots (mayor, my city councillor and my school board trustee). My understanding is that many elections in the states also have multiple propositions and other things the citizens are asked to vote on. So the paper system could become cumbersome and confusing with many issues on the ballot. Therefore, an electronic system where you are presented a single item at a time could be easier.

I'd still argue that paper ballots are better for security issues, but the above could be one argument against paper ballots.

[+] Mbioguy|7 years ago|reply
Doesn't going paper-only make it difficult to switch to alternative voting systems like RCV (as Maine is) or multiple-member districting at anything beyond a local level? FPTP is fairly simple to count by hand and other methods can be more labor-intensive as the total number of votes increases.

I am all for having a paper trail, mandatory audits, and secure infrastructure. I agree with those who thing the current private sector systems for voting have huge issues. What I don't understand is what I see as media pushing a false choice between paper or digital.

Estonia has been using e-voting alongside paper ballots for years without serious issues. (Of course, they have national ID and have digitized a lot of their gov't functions, so maybe this is a special case.)

https://www.newyorker.com/magazine/2017/12/18/estonia-the-di...

There are a lot of ways to improve our elections, from social engineering (France's media blackout a few days before elections, moving voting day to the weekend, making it multiple days, or just using the mail system) to improved systems like Scantegrity or increased use of optical scanning.

https://en.wikipedia.org/wiki/Scantegrity

The cynic in me fears this is a push designed to make it harder for us to use things like RCV and entrench FPTP.

[+] beat|7 years ago|reply
Minneapolis has done instant runoff voting for a couple of elections now, on paper ballots, with no problems. I don't think it's making as much of a difference as proponents hoped, but at least we know it's not hard.
[+] ghostly_s|7 years ago|reply
How are paper ballots at all an obstacle here? RCV is just a different format for the ballot. You can still input the votes and calculate the runoffs digitally to save time, you just have the benefit of verifiable paper records for the raw data.
[+] dragonwriter|7 years ago|reply
> Doesn't going paper-only make it difficult to switch to alternative voting systems like RCV

It makes IRV (“RCV” is an annoying name designed specifically to obscure other ranked-choice methods) impractical, particularly for large electorates, if you want to avoid machine tallying, but that's a reason not to use IRV, not a reason to avoid paper ballots and manual tabulation.

A simply tallyable ranked choice method like Bucklin is amenable to manual tabulation. (And, compared to IRV, getting rid of loser elimination reduces the degree to which IRV produces undesirable results and makes the system easier to understand.)

[+] ska|7 years ago|reply
I don't see why paper makes different systems more difficult. Paper is more about how votes are registered and counted, voting systems are more about how they are aggregated and decided.

Re: your comment on social engineering, etc. There has been a ton of effort in arenas in the US electoral system(s), but the goals have not been security or access - sometimes quite the opposite.

[+] beat|7 years ago|reply
Electronic voting without paper trail should be illegal. Flat out.

But it won't ever be so, which is curious.

[+] 40acres|7 years ago|reply
Congress recently failed to pass a bill which would add election security funding, so we know where they stand.
[+] olivermarks|7 years ago|reply
"It's not the people who vote that count, it's the people who count the votes."
[+] kryogen1c|7 years ago|reply
>Donald Trump publicly invited Russia to hack Hillary Clinton’s email server

I find statements like this to be immediately discrediting of journalistic integrity. The intent was not to enter into an illicit agreement with a third party. Reacting in this ridiculous fashion only aids in his popularity. I think Democrat (obviously false) hyperbole is in danger of giving us a second term

[+] pjc50|7 years ago|reply
>"“I will tell you this: Russia, if you’re listening, I hope you’re able to find the 30,000 emails that are missing,” he said. “I think you will probably be rewarded mightily by our press.”

The president was encouraging a foreign adversary to illegally hack into messages by a former secretary of state that might contain sensitive information, then release them publicly."

https://www.theatlantic.com/politics/archive/2018/07/russia-...

Did he or did he not say that?

[+] factshurtfeels|7 years ago|reply
Ad hom nonsense. What's discrediting to journalistic integrity about stating the fact that he stated this? His "intent" doesn't matter, that is precisely what he said, verbatim and clear as day on national television: https://youtu.be/3kxG8uJUsWU?t=39s
[+] liberte82|7 years ago|reply
We all heard him say it, and it was controversial at the time and has remained so, especially given everything that has happened since. What are you "concerned" with, exactly? If you're a supporter, you should be happy that things are playing out in a way that helps him, if you believe what you're saying.
[+] root_axis|7 years ago|reply
Just curious, what do you think a fair articulation of the facts would sound like?
[+] swarnie_|7 years ago|reply
Its The Guardian, they are about as far removed from Trump and his base as its possible to be. Not that i approve of what their doing here, just explaining the motivation.