NC SBE Ignores Voters, Approves Touchscreens: 'BradCast' 8/23/19
Ransomware Attacks in 22 TX Cities Before 2020: 'BradCast' 8/22/19
GOP 'Political Malware' as NC Elections Begin: 'BradCast' 8/21/19
Domestic Shootings by White Men Prevented: 'BradCast' 8/20/19
Petition to Recall AK's GOP Guv Catches Fire: 'BradCast' 8/19/19
Election Software Obsolete, Servers Found Online: 'BradCast' 8/16/19
JUDGE BANS GA'S OLD TOUCHSCREEN SYSTEMS: 'BradCast' 8/15/19
Brad's Upcoming Appearances
(All times listed as PACIFIC TIME unless noted)
'Special Coverage' Archives
GOP Voter Registration Fraud Scandal 2012...
VA GOP VOTER REG FRAUDSTER OFF HOOK
Felony charges dropped against VA Republican caught trashing voter registrations before last year's election. Did GOP AG, Prosecutor conflicts of interest play role?...
Criminal GOP Voter Registration Fraud Probe Expanding in VA
State investigators widening criminal probe of man arrested destroying registration forms, said now looking at violations of law by Nathan Sproul's RNC-hired firm...
DOJ PROBE SOUGHT AFTER VA ARREST
Arrest of RNC/Sproul man caught destroying registration forms brings official calls for wider criminal probe from compromised VA AG Cuccinelli and U.S. AG Holder...
Arrest in VA: GOP Voter Reg Scandal Widens
'RNC official' charged on 13 counts, for allegely trashing voter registration forms in a dumpster, worked for Romney consultant, 'fired' GOP operative Nathan Sproul...
ALL TOGETHER: ROVE, SPROUL, KOCHS, RNC
His Super-PAC, his voter registration (fraud) firm & their 'Americans for Prosperity' are all based out of same top RNC legal office in Virginia...
LATimes: RNC's 'Fired' Sproul Working for Repubs in 'as Many as 30 States'
So much for the RNC's 'zero tolerance' policy, as discredited Republican registration fraud operative still hiring for dozens of GOP 'Get Out The Vote' campaigns...
'Fired' Sproul Group 'Cloned', Still Working for Republicans in At Least 10 States
The other companies of Romney's GOP operative Nathan Sproul, at center of Voter Registration Fraud Scandal, still at it; Congressional Dems seek answers...
FINALLY: FOX ON GOP REG FRAUD SCANDAL
The belated and begrudging coverage by Fox' Eric Shawn includes two different video reports featuring an interview with The BRAD BLOG's Brad Friedman...
COLORADO FOLLOWS FLORIDA WITH GOP CRIMINAL INVESTIGATION
Repub Sec. of State Gessler ignores expanding GOP Voter Registration Fraud Scandal, rants about evidence-free 'Dem Voter Fraud' at Tea Party event...
CRIMINAL PROBE LAUNCHED INTO GOP VOTER REGISTRATION FRAUD SCANDAL IN FL
FL Dept. of Law Enforcement confirms 'enough evidence to warrant full-blown investigation'; Election officials told fraudulent forms 'may become evidence in court'...
Brad Breaks PA Photo ID & GOP Registration Fraud Scandal News on Hartmann TV
Another visit on Thom Hartmann's Big Picture with new news on several developing Election Integrity stories...
CAUGHT ON TAPE: COORDINATED NATIONWIDE GOP VOTER REG SCAM
The GOP Voter Registration Fraud Scandal reveals insidious nationwide registration scheme to keep Obama supporters from even registering to vote...
CRIMINAL ELECTION FRAUD COMPLAINT FILED AGAINST GOP 'FRAUD' FIRM
Scandal spreads to 11 FL counties, other states; RNC, Romney try to contain damage, split from GOP operative...
RICK SCOTT GETS ROLLED IN GOP REGISTRATION FRAUD SCANDAL
Rep. Ted Deutch (D-FL) sends blistering letter to Gov. Rick Scott (R) demanding bi-partisan reg fraud probe in FL; Slams 'shocking and hypocritical' silence, lack of action...
VIDEO: Brad Breaks GOP Reg Fraud Scandal on Hartmann TV
Breaking coverage as the RNC fires their Romney-tied voter registration firm, Strategic Allied Consulting...
RNC FIRES NATIONAL VOTER REGISTRATION FIRM FOR FRAUD
After FL & NC GOP fire Romney-tied group, RNC does same; Dead people found reg'd as new voters; RNC paid firm over $3m over 2 months in 5 battleground states...
EXCLUSIVE: Intvw w/ FL Official Who First Discovered GOP Reg Fraud
After fraudulent registration forms from Romney-tied GOP firm found in Palm Beach, Election Supe says state's 'fraud'-obsessed top election official failed to return call...
GOP REGISTRATION FRAUD FOUND IN FL
State GOP fires Romney-tied registration firm after fraudulent forms found in Palm Beach; Firm hired 'at request of RNC' in FL, NC, VA, NV & CO...
The Secret Koch Brothers Tapes...
MORE BRAD BLOG 'SPECIAL COVERAGE' PAGES...
Latest incident in long, growing list of e-vote hack events...
[UPDATED: Hacker fesses up, took total control of system]
By Brad Friedman
on 10/4/2010, 12:27pm PT
Last week we told you about D.C.'s intention of running an insane live experiment on live voters in a live election with an untested, wholly unverifiable, easily-manipulated Internet Voting scheme this November, and about just some of the computer security and election experts who have been desperately trying to warn them against it.
And now we find out that the very short planned pre-election test phase, in which hackers were invited to try to manipulate the system, has been abruptly aborted in the wake of a, um, disturbing (if not wholly unpredictable) development.
The failed system in D.C. was developed with the Open Source Digital Voting Foundation, an outfit that is working with election officials around the country to push Internet Voting everywhere, along with other computerized voting schemes. Simply because a system is "open source" does not mean it's secure, particularly when it relies on concealed vote counting, as all of their e-vote schemes do.
Below, along with our quick list of other recent known e-voting hack events, computer scientist Jeremy Epstein in "The Risks Digest," which describes itself as a "Forum on Risks to the Public in Computers and Related Systems," offers the quick timeline of recent developments in the District of Columbia's plan "against advice from many computer scientists, pursuing a trial of a prototype system for the November election."
The result, as seen below, in this latest assault on citizen-overseeable democracy is, of course, a stunning surprise to absolutely nobody other than perhaps the D.C. election officials interested in this horrific scheme and the profiteers who must have tricked them into believing that it was a secure and/or good idea [emphasis added]...
While we don't have the time today to detail all of the hacks of electronic voting systems used across the country today --- which are already easily manipulated even without relying on the Internet to make matters worse --- here are a few of note from recent years, including one as recently as this past August when "white hat" hackers were able to hack Pac-Man onto a touch-screen voting system without disturbing its supposedly "tamper-evident" seals. (For the record, one of scientists involved with the Pac-Man hack, and a number of others listed below, is J. Alex Halderman, who is now an assistant professor of electric engineering and computer science at Michigan University. Just saying. [Insert fight song here]. )
- Sequoia AVC Edge DRE, 2010, Pac-Man hacked onto machine by scientists from University of Michigan and Princeton University without breaking "tamper-evident" seals.
- Sequoia AVC Advantage DRE, 2009, hacked by computer scientists at UC San Diego, University of Michigan, and Princeton University by swapping out its chips in a matter of minutes, with no access to source code or other "closely guarded technical information."
- Sequoia Edge DRE, 2007, hacked by computer scientists at U.C. Santa Barbara (video release in 2008)
- Diebold, ES&S, Sequoia, and Hart Intercivic systems, 2006 & 2007, Independent tests commissioned by the states of CA, OH, and CO all found they were able to hack every system tested. In seconds.
- Diebold Touch-Screen, Op-Scan Systems, 2007, Physical key to all Diebold voting systems (same one is used for every machine) confirmed by Princeton computer scientists as accurately copied from photo of key posted by Diebold in its own online store.
- Diebold touch-screen system, 2006, hacked by computer scientists at Princeton
- Sequoia tabulator, 2006 accidentally hacked by Michael Shamos in PA (while trying to demonstrate that the system was not hackable)
- Diebold touch-screen system, 2006, hacked by Harri Hursti in Emery County, UT
- Diebold optical-scan system, 2005, hacked by Harri Hursti in Leon County, FL (video)
[Hat-tip to Joyce McCloy's indispensable Voting News!]
* * *
UPDATE, 2:24pm PT: Washington Post's Mike DeBonis reports on the hack, says D.C. officials will nix their ill-considered plan for allowing votes to be cast on the Internet --- for now --- and quotes computer scientist Jeremy Epstein (whose coverage we noted above) stating what should be the obvious in regard to the hackers exploiting a security hole in the Internet voting scheme to play the Michigan fight song: "In order to do that, they had to be able to change anything they wanted on the Web site."
Anything. They. Want.
Other than that, let's keep working towards Internet Voting! It's a great idea! Local e-voting has worked out so great, what could possibly go wrong by extending it onto the Internet?!
CORRECTION: As Epstein notes in his comment below, he is not of "The Risks Digest," as we originally described him, but rather, it is "a public forum for computer scientists and others to share risks for over 25 years." Our apologies for the imprecise accreditation there. We've changed "of" to "at" in the story above to correct the record.
* * *
UPDATE 10/5/10: As we posited above, University of MI's J. Alex Halderman was, indeed, behind the attack. He fesses up, saying: "Within 36 hours of the system going live, our team had found and exploited a vulnerability that gave us almost total control of the server software, including the ability to change votes and reveal voters’ secret ballots." Full details now here...
* * *Please support The BRAD BLOG's fiercely independent, award-winning coverage of your electoral system, as available from no other media outlet in the nation, with a donation to help us keep going (Snail mail, more options here). If you like, we'll send you some great, award-winning election integrity documentary films in return! Details right here...
Reader comments follow below ad...
READER COMMENTS ON
"Hackers Inject Univ. of Michigan 'Fight Song' Onto System During D.C. Internet Voting Scheme Tests"
(19 Responses so far...)
COMMENT #1 [Permalink]
Jon in Iowa
said on 10/4/2010 @ 2:14 pm PT...
Brace yourself for the Ohio State backlash.
COMMENT #2 [Permalink]
said on 10/4/2010 @ 4:37 pm PT...
woah! Brad, let me make sure that I read this correctly... You mean to tell me that in the face of incontrovertable facts, bone stupid common sense and (perhaps!) an acknowledgement of the minimum procedures necessary to run a democratic election, election officials in DC actually DID THE RIGHT THING (at least for now) and stopped an attempt to undermine our democracy with technology? My mind is blown! This goes against everything that I thought this country stood for since Shrub! I need to sit down and think about this for awhile!
COMMENT #3 [Permalink]
said on 10/4/2010 @ 6:19 pm PT...
Brad, good coverage. But you should know I'm not "of the RISKS Digest" - the RISKS digest has been a public forum for computer scientists and others to share risks for over 25 years.
COMMENT #4 [Permalink]
said on 10/4/2010 @ 8:53 pm PT...
Thanks, Jeremy. Will correct that right away. And thanks for ur good work on this beat! Have a feeling this latest (Internet Voting) nightmare is just beginning...
COMMENT #5 [Permalink]
said on 10/4/2010 @ 9:47 pm PT...
On the banks of the Red Cedar
There's a school that's known to all
Its specialty is winning
And those Spartans play good ball
Fie on Wolverines, I say, fie!
COMMENT #6 [Permalink]
said on 10/5/2010 @ 12:52 am PT...
Brad, your links used to post to Facebook with titles, graphics, and description, e.g., on June 22 at http://www.facebook.com/SaveOurVote. Now all we get is the reproduced link. We add the titles but it still lacks the picture. Anything you can do on your end?
COMMENT #7 [Permalink]
Max - The IT Pro
said on 10/5/2010 @ 6:52 am PT...
Why did these peeps not use OpenBSD as the server operating system for this e-voting application??? It's the most SECURED O/S on the planet and free to download & use. It's based on Berkely Unix which was developed at the University of California (Berkeley) back in the 70s.
Not even the CIA can hack into a BSD system.
Visit the OpenBSD project in Western Canada at http://OpenBSD.org and be amazed.
COMMENT #8 [Permalink]
said on 10/5/2010 @ 8:34 am PT...
Paper ballots are remarkably resilient from remote manipulation. Just sayin'.
COMMENT #9 [Permalink]
said on 10/5/2010 @ 9:36 am PT...
Barbara Glassman - Thanks for pointing that out. Haven't made any changes on this end, so let me look into that!
COMMENT #10 [Permalink]
said on 10/5/2010 @ 12:35 pm PT...
Thanks, Barbara! I was wondering the same thing.
COMMENT #11 [Permalink]
said on 10/5/2010 @ 1:18 pm PT...
I just want vote by mail. Easy for me and the post office needs the business.
COMMENT #12 [Permalink]
said on 10/5/2010 @ 2:44 pm PT...
@Max, you said "Why did these peeps not use OpenBSD" - I'm not sure whether or not they did (according to the DC diagram at http://www.dcboee.us/DVM/Visio-BOEE.pdf, they're using VMWare ESX, but it doesn't say what they're running on top). But the vulnerabilities were application vulnerabilities, not OS problems. So they would exist regardless of the underlying platform. That's the problem with application-level vulns - hardening the OS generally doesn't help.
COMMENT #13 [Permalink]
said on 10/5/2010 @ 3:45 pm PT...
Why don't they just use a paper ballot system? Even the most SECURED system would still leave us wondering if somebody on the inside could mess with the votes. Go back to the future - paper ballots, hand marked, stuffed in a clear plexiglass locked box, then dumped out on a table and counted before anybody that wants to watch. How hard is that?
COMMENT #14 [Permalink]
Gregory A. Miller
said on 10/5/2010 @ 8:35 pm PT...
A couple of points:
1. Your assertion that the Foundation is advocating Internet voting is patently wrong, and void of intellectual honesty. Anyone who reads the trustthevote.org blog will be properly informed on just where we stand regarding "Internet voting." the record is clear, we do NOT support widespread use of it. Which leads me to point #2:
2. Our role in the D.C. project was to deploy our ballot generator, and we also assisted them with developing a "worked example" of returning ballots by some means other than their current process of eMail or Fax (!) We fully intended this public evaluation to uncover any problems that might prevent its safe use (i.e., the PDF uploader vulnerability that is the center of attention here). They (U. Michigan) DID, and the BoEE thanked them and did the RIGHT THING: took the site down and canceled its use this November. (we applaud them too) However, without this worked example to illustrate what could go wrong, everything was academic jousting. To that extent, we believe this entire exercise has been a complete success (particularly since the D.C. BoEE did the right thing and took the site down.
But please refrain from falsely accusing us of something we're NOT doing: advocating the use of Internet voting systems. We're busy working on voting system source code that can be adopted adapted and deployed to bring about accuracy, transparency, trust and security in any voting system that uses a computer for counting and in some cases preparing or casting a ballot. NONE of our system architecture is intended for any public packet switched network; NONE of it. Your charge just killed your credibility in my mind because perusing our blog posts would set that record straight. I have been a big supporter of you and your cause, but this just baffles me why you would make such a baseless charge.
COMMENT #15 [Permalink]
said on 10/5/2010 @ 10:14 pm PT...
Jonathan Simon has written an excellent piece on the recent special election in Massachusetts and its anomalies.
Hope that link works. If not, go to the Election Defense Alliance and read his article-- Believe It Or Not.
COMMENT #16 [Permalink]
said on 10/6/2010 @ 6:32 am PT...
To those who say "why don't you use paper", the DC system (and similar systems) are intended for UOCAVA voters - military and overseas voters who may be a thousand miles from the nearest ballot box and with irregular mail delivery. The goal is to allow them to cast their vote - many overseas voters who request absentee ballots never receive them, and some number that get sent back get lost in the mails.
(As an example, my sister, who has lived in the same small town overseas for 40 years, sometimes gets her blank ballot and sometimes doesn't. And it's a whole lot harder for military people who are moving from location to location, so between when they request their ballot and when it arrives they may have moved several times.)
I don't say this to endorse Internet voting, but rather to suggest that it's not as simple as "drop your marked ballot in the clear ballot box".
Of course we could do like some countries and do away with absentee voting, but methinks that would be a political non-starter!
COMMENT #17 [Permalink]
said on 10/6/2010 @ 11:19 am PT...
Gregory Miller @ 14:
Happy to correct and/or amend the article above to point folks towards your comment and/or objection to my coverage.
But before I do, quick question to help me under stand OSDV's position: While you say that OSDV is not "advocating Internet voting" and that you "do NOT support widespread use of it", do you support it's use under federal grants available for pilot programs for Internet Voting use by overseas and military voters? (as occurred in this D.C. sitch?)
Also, did you warn D.C. against their Internet Voting scheme before you participated in the program, or anytime during its implementation? If so, do you have any documentation of that? If not, why didn't you? And why would you participate in a program that you believed to patently unsafe and unsecured for voters? Wouldn't a principled stand require you to not participate at all in such a scheme?
Look forward to your thoughts.
COMMENT #18 [Permalink]
Gregory A. Miller
said on 10/12/2010 @ 10:42 am PT...
To your questions:
1. For those jurisdictions with military and other qualified overseas voters who have no other reasonable means to return their ballots in time, we support the DoD/FVAP program to explore the LIMITED use of online services. The risk of doing so is clear and present, but we believe it is up to the Elections Officials to make that risk assessment. So for this limited use of overseas UOCAVA voters, the alternative is eMail or Fax return, which we believe is even worse. So call it a choice of evils, and in that regard, we support the FVAP effort, so long as it is limited to qualified UOCAVA voters. By qualified I mean that they can demonstrate that relying on alternative means like those provided by the Overseas Vote Foundation (for instance) is not reasonable to ensure timely return and avoid disenfranchisement.
2. Yes, we have discussed the dangers of using the public packet switched network with several officials in D.C. We've presented slides from Dr. Appel and felt we informed them. NO, unfortunately, I do not have documentation of that, but there are officials in D.C. who would verify my assertion here. And to provide some protection, we strongly pursued the concept of a public test of the demonstration system BEFORE any public deployment and that if any vulnerabilities were uncovered that could not be timely resolved (and re-tested) before going live, then it had to be pulled. That happened. No live data was ever used; no real ballots, and no access to any voter information was ever involved.
3. We participated in the program on the basis that we would have an opportunity to put some of our open source components (the ballot generator for instance) into a production setting, and this production setting involved a very restricted use of a digital means of ballot transfer for qualified overseas "UOCAVA" voters ONLY. We continue to believe the Internet is unsafe for transacting ballots. We believed the method the District wanted to use was better than eMail or Fax, and if one looks at their architecture rationale document (43 page technical white paper available on their site) the approach appeared to offer a means worth examining and piloting for this very restricted audience, whose alternative return methods are guaranteed less private or secure.
In retrospect, had we known that putting this system into a public review cycle, with fully transparent code would result in such a backlash if a vulnerability in deployment was uncovered, we never would've participated.
To be sure, the greatest enemy to all sides was a mismanagement of time. The cycle time for evaluation was greatly compressed. The rush to deploy components resulted in basic block-and-tackle errors (from what we can tell; we have NO role in the data center, access to it, or even visibility on what exactly happened on their back-end.) But for sure, the mismanagement of time and process is the real teachable element here. I say that, because in a more reasonable time frame, the configuration screw-ups that occurred would've been trapped and corrected before the public review. But the theory was to put it out there and let people have at it BEFORE any decision to turn it live was made.
I also point out, that one of our agenda items was to push this along so the elections verification community could, in fact, have a venue, forum, and real worked example on which to make their case. And they have it and are doing so. I still think that there is a success in what happened.
One final point, the CTO's office in D.C. is conducting their own internal investigation into the U. Michigan's findings. I understand there will be more to come out, that may clarify the Haldermann team's findings. We'll see, it is entirely out of our hands.
COMMENT #19 [Permalink]
said on 10/13/2010 @ 5:06 pm PT...
Call me suspicious, but the actual name of the Michigan Fight song is "The Victors". Perhaps someone leapt to conclusions re; the meaning of the message? Also, a really clever hack might have used the Iowa Fight Song. Go Hawks!
Support The BRAD BLOG
Please visit our advertisers
Support The BRAD BLOG
Please visit our advertisers
All Content & Design Copyright © Brad Friedman
unless otherwise specified. All rights reserved.
logo courtesy of Rock Island Media
Web Hosting, Email Hosting, & Spam Filtering for The BRAD BLOG courtesy of Junk Email Filter