<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class="Apple-interchange-newline">On Nov 10, 2016, at 6:00 PM, Bill Frantz <<a href="mailto:frantz@pwpconsult.com" class="">frantz@pwpconsult.com</a>> wrote:<br class=""><br class=""></blockquote><div class=""><div><blockquote type="cite" class="">On 11/10/16 at 6:59 AM, <a href="mailto:agr@me.com" class="">agr@me.com</a> (Arnold Reinhold) wrote:<br class=""><br class=""><blockquote type="cite" class=""><br class="">As for voting systems, where I live we have paper ballots that are optically scanned. Results are available immediately after the election but the paper ballots can be manually counted as a check. A hack attack that targeted only a few machines would be noticeable statistically if it was large enough to matter. An attack that made small increments in many voting machines could be caught be hand counting a few precincts. Best of all, a paper system is understandable by the retirees hired to staff the voting places. What is the point of going to an all electronic system that only a few specialists can audit?<br class=""></blockquote><br class="">We use a similar system to the one Arnold uses here in Santa Clara County, California. Assuming a small percentage of the precincts are randomly selected for audit after the votes have been counted, it should be quite secure.<br class=""><br class="">There is an organization working to make sure our voting systems can be audited, <<a href="https://www.verifiedvoting.org/" class="">https://www.verifiedvoting.org/</a>>. People interested in this area should know about them.<br class=""><br class="">I don't think we can get to 100% certainty in voting system, or any other systems for that matter. Attackers are just too resourceful. I remember as a child hearing of a voting attack using only paper ballots. The attacker was one of the vote counters. He had a pencil lead glued under a fingernail. When he counted a ballot for the "wrong" candidate, he used the pencil to mark the ballot so the vote for that race would be invalid (spoiled). I don't remember how the technique was discovered, but apparently it was quite effective.<br class=""><br class=""></blockquote><br class=""></div></div><div>Optical scanners for paper ballots can detect over-votes at the time of submission and return the paper ballot to the voter so they can get it voided and try again. ( See <a href="http://vote.nyc.ny.us/html/newway_en/faq.shtml" class="">http://vote.nyc.ny.us/html/newway_en/faq.shtml</a> Faq #10) So any over-voted ballot detected during later hand counting should arouse suspicion, more than one alarm. I assume that when you were a child there were no scanners. But this rather clever scheme was non the less detected. The skills needed to figure out mischief with paper ballots are widely held, the skills needed to discover problems in electronic systems are far more scarce. </div><div><br class=""></div><div>On Fri, 11 Nov 2016 00:49 John Denker wrote:</div><div><br class=""></div><div><blockquote type="cite" class="">The part of this that is particularly relevant in this forum<br class="">concerns the machines that scan the ballots after the bubbles<br class="">have been filled in. This requires a platform that is resistant<br class="">to "tailoring" (in the NSA TAO sense of the word). Everything<br class="">needs to be secured, including the BIOS, N stages of boot loader,<br class="">OS, applications, and peripherals.<br class=""><br class="">This is a really hard problem. It is an "advanced persistent<br class="">threat" situation. One thing we learned from Snowden is that<br class="">the "tailors" are very advanced and very persistent. Also<br class="">there are plain old bugs. Open source is nicer than closed,<br class="">but it does /not/ automagically make all bugs shallow.<br class=""><br class="">I reckon there is a role for cut-and-choose at some point:<br class="">pick some subset of the machines and tear them down to bare<br class="">metal and bare silicon.</blockquote><br class=""></div><div>Is that even possible today? We’ve had discussions on this list of subverting processors by changing the dopant level at certain transistors. Isn’t hand counting ballots from a sample of scanners, as you suggest below, just as effective, cheaper, and doable by people without (very) advanced training in computer security?</div><div><br class=""></div><div><blockquote type="cite" class="">I reckon there is also a role for good old-fashioned redundancy.<br class="">Count the ballots twice, with two dissimilar systems in tandem.<br class="">Arizona already does a bit of this, insofar as they routinely<br class="">hand-count 2 percent of the precincts. I would prefer to see<br class="">two redundant machine-counts of everything, followed by a hand-<br class="">count of a smallish sample.<br class=""><br class="">The power of this approach was well demonstrated in Humboldt<br class="">County in 2008. Famous story:<br class=""> <a href="https://www.wired.com/2008/12/unique-election/" class="">https://www.wired.com/2008/12/unique-election/</a><br class=""></blockquote><br class=""></div><div>Great link, thanks. I wasn’t all that disturbed by the bug that caused one batch (their term “deck” warms my heart) of ballots to be occasionally deleted. Vastly more serious was the fact that the audit log produced by their software failed to record all such deletions, even permitted ones. Was that ever fixed? That the later problem was apparently not recognized as a show-stopper is a strong indicator that all-electronic voting systems can never be trusted, because the builders and maintainers of such systems will never take security seriously enough long term.</div><div><br class=""></div><div>Arnold</div></body></html>