Senators ask why vendors sell voting machines with ‘known’ vulnerabilities’

Senators ask why vendors sell voting machines with ‘known’ vulnerabilities’(techcrunch.com)

111 points by Ours90 7 years ago | 70 comments

bshipp 7 years ago |

Criticisms of the underlying hardware/software aside, my intuitive answer to the headline question is "because governments are buying them."

Perhaps the esteemed Senators should undertake a short naval-gazing exercise and ask "how could there only be three major players in such a lucrative segment, each selling ancient hardware and crappy software products?"

I'm going to go out on a limb and guess at the answer to that question, and it likely shows those three companies as being the only ones with the patience and tenacity to get those models approved.

So Mr./Ms. Senator(s), I suggest you rephrase your question as follows: "how can we simplify the procurement process to make sure we, the government, are receiving the greatest value for our expenditures?"

Bluestrike2 7 years ago | |

They don't actually have any influence in the purchase decisions, as it's a state matter. Machines are bought by local governments, with varying state regulations on what can be purchased depending on the state in question. Most machines were paid for by local jurisdictions with a mix of federal funding (HAVA), and in some cases, state funds for part of the cost. Some states have uniform systems; others do not.[0] On election day, there isn't just "one" election but thousands taking place.

There's no single procedure for procuring voting machines, well, anywhere.

To make matters worse, each jurisdiction and the states are fiercely protective of their power in this matter. A federally uniform system, or even just something beyond the very basic requirements set by the Help America Vote Act in 2002, is right now very unlikely and would be a massive political and legal mess. Or, more accurately, a series of messes.

0. http://www.ncsl.org/research/elections-and-campaigns/the-can...

ams6110 7 years ago | | |

> There's no single procedure for procuring voting machines, well, anywhere.

And that's probably a good thing. Heterogeneity in this sort of thing is desirable, as it makes large-scale fraud harder to pull off.

amanaplanacanal 7 years ago | | |

And nobody apparently wants to spend any more money on elections, even though it's actually going to take money to fix the problems.

specialist 7 years ago | | |

In addition, there's no uniform certification process. EAC.gov made things a wee bit better, but it's an advisory role.

maxxxxx 7 years ago | |

"because governments are buying them."

The main problem in american politics is that a lot of decisions are made either to damage the "other" party or to accommodate some donor. When you look at Congress they barely think about doing something right.

tru3_power 7 years ago | | |

Off topic question- but this is always something that interested me: do you have any blatant examples of a high level politician solely choosing a product to accommodate a donor?

munificent 7 years ago | |

> "how could there only be three major players in such a lucrative segment, each selling ancient hardware and crappy software products?"

Because all markets tend towards cartels and consolidation unless vigilant, enforced regulation prevents it?

Why do Coca-Cola and Pepsico have >60% of the soft drink market? Why do the largest two or three meat processing companies have the majority market share in almost every category? Why does Nestle have more annual revenue than the GDP of Sri Lanka?

linuxftw 7 years ago | | |

> Why do Coca-Cola and Pepsico have >60% of the soft drink market?

Well, this one is probably simple: government. I'm unsure whether it would be copyright, or trademark infringement, but if you release a product that tastes exactly like coke or pepsi, you'll probably find yourself in expensive litigation.

justin66 7 years ago | |

> So Mr./Ms. Senator(s), I suggest you rephrase your question as follows: "how can we simplify the procurement process to make sure we, the government, are receiving the greatest value for our expenditures?"

Hey guys, let's drop this important task we are working on and go look for the holy grail!

save_ferris 7 years ago |

Regardless of one's political leanings, it's frightening that only one of the two major American political parties is even feigning interest at fixing what is clearly a vulnerable system.

This shouldn't be a partisan issue, but it somehow continues to be.

ddingus 7 years ago |

They ALL have a known vulnerability. Works like this:

Pretend the machine is a person in a secure room only they are in, and only they know the contents of.

You approach a window, tell them your vote. They say it back and optionally hand you a piece of paper.

Then, in that room, they do whatever they want, and the final tally, winner of the election is determined by whatever they did in the room.

Voters have no chain of trust between their expression of intent, and the record used for the final tally. When voters make physical expressions, and those expressions are counted, voters know the election, on a basic level, can be trusted to reflect the collective intent of the people.

When they use electronics, they have no idea. They push a button, or mash a screen, and the display will tell them something and that something could be anything. They cannot know.

None of us can without forensic level examination of the machine. Even then, we can only verify function and infer a voter intent was correctly recorded and or used for the tally.

Secondly, should there be error, or controversy, the enduring record of voter intent both walked out of the building and or is a collection of grease smears on input devices.

Useless in a court of law.

The only way around this is to make vote records personally identifiable and basically use the systems for banking. (Who gets around this problem with multiple, redundant records created at the time of transaction)

gumby 7 years ago |

I think it's pretty straightforward to understand: the buyer likely has little to no expertise in the important issues. This is not in any way a slur on election officials, simply the recognition of the (statistically) likely experience of someone who is a local election official.

In addition the way the question is structured by the senators isn't really fair either: if you have n bugs to fix before the ship date, you'll prioritize them and then ship (presumably) the best product you can by the immovable target date. That is also reality.

Though voting is a local matter the Federal Government has a constitutional interest (Article 1, Sections 4 and 5) in the elections to Congress and can mandate minimal standards for voting just as the DoT mandates minimum standards for automobiles. So they could require that whatever machines used are verifiable and non-repudiatable. They could also mandate procedures although those are harder to enforce. If States need to buy equipment suitable for congressional elections they'll presumably use the same equipment for all other elections too.

specialist 7 years ago | |

In my experience, the buyers (election administrators) at the state and local levels know exactly what's going on. Like every where else, there's a revolving door between govt election administrators and the private vendors & consultants.

gumby 7 years ago | | |

Hmm, perhaps I was thinking too fine-grained.

Macross8299 7 years ago |

I suppose it's more politically expedient to blame the companies trying to rationally minimize cost rather than risk reprimanding and alienating state and local officials who sign contracts for voting machines without any sort of serious security, auditing or compliance provisions.

This sure does seem like grandstanding from these senators. Probably not unrelated to fallout from the Mueller report.

munificent 7 years ago | |

> reprimanding and alienating state and local officials who sign contracts for voting machines without any sort of serious security, auditing or compliance provisions.

What other options do these officials have?

The companies have the choice to improve their security of their hardware at the possible expense of lowering their profit margins.

Whenever you're deciding who to point the finger at, one simple rule is "Can this person actually effect change?" If the answer is "no", then blaming them isn't helpful.

Macross8299 7 years ago | | |

>What other options do these officials have?

Paper voting, for one. If no system is offered that is secure enough, then the default should be no electronic voting system at all and just paper voting. It's scaled fine for hundreds of years and has clear processes in place for custody of ballots.

>The companies have the choice to improve their security of their hardware at the possible expense of lowering their profit margins.

You can't expect companies to just "make a choice" to lower profit margins without some sort of (dis)incentive or external pressure like regulation. It's unrealistic. Companies exist to make their principals money. It's the government's job to check that and make sure that the companies are acting in public interest while they pursue profit.

Local and state officials definitely can effect change on this level since they are often the ones in charge of the procurement process.

gafferongames 7 years ago |

The better question is, why do they keep buying them?

BenMorganIO 7 years ago |

Note: this article is of the United States.