ADVERTISEMENT

Why can't we get a handle on voting equipment

Marvin the Martian

Hall of Famer
Gold Member
Sep 4, 2001
37,268
23,800
113
Last year, ESS admitted to putting remote access capabilities into their voting systems. Now it turns out that VR Systems opened up remote access to their systems as well. Further, as Politico reports, it appears the Russians infiltrated VR Systems itself.

Now before things digress, this is the disclaimer that I am not suggesting anything untoward happened in 2016.

But the argument we often here is the system cannot be hacked. Well it turns out our vendors are installing remote access and not telling anyone. I do somewhat get the reasoning, how can someone like VR Systems have enough people trained and staged in every county that buys their system to troubleshoot election day problems. It isn't going to happen.

But that is a secondary concern, paper ballots can replace machines that have to be brought down. But IF someone hacks the system there is no good recovery mechanism. Anything on the internet can be hacked. Frankly, probably has been hacked to some extent if contains interesting information to foreign powers or the NSA.

I get that many of us hate the idea of a top down system. But what we have isn't working. To major suppliers have now admitted to doing exactly what they said they would not do. This has invalidated the entire claim that "the system is safe because it is not reachable" invalid. We need to get these systems under control before there is a hacking. Let me ask this. Let's suppose in 2020 a candidate wins and then it is discovered massive hacking occurred. Look at the constitution and tell me what remedies are listed?
 
Should be optical scan machines/paper ballots nationwide with $$$ for that and mandatory audits. It's the best system. Everything that's done needs to be like in Indiana where a rep of the Pubs & Dems have to sign off on things.

Feds should put money into securing all the systems and have NSA, etc. make sure they're secure.
 
Well it turns out our vendors are installing remote access and not telling anyone.
[...]
Two major suppliers have now admitted to doing exactly what they said they would not do. This has invalidated the entire claim that "the system is safe because it is not reachable" invalid.
These suppliers should be tarred and feathered.

You would be far more knowledgeable than me, but I would think a local network at each polling place air-gapped from the Internet and with hardware redundancy/mirroring would be easily configured. Have the polling places transmit their totals to the central tabulation point via hard copy or flash drive or freaking fax.
 
  • Like
Reactions: MrBing
These suppliers should be tarred and feathered.

You would be far more knowledgeable than me, but I would think a local network at each polling place air-gapped from the Internet and with hardware redundancy/mirroring would be easily configured. Have the polling places transmit their totals to the central tabulation point via hard copy or flash drive or freaking fax.

Voting machines and vote tabulating machines are air gapped. The security for the equipment and results is more elaborate than anyone assumes. A breach can only occur through in-house corruption which is a real problem in some places.
 
Voting machines and vote tabulating machines are air gapped. The security for the equipment and results is more elaborate than anyone assumes. A breach can only occur through in-house corruption which is a real problem in some places.

How can they be air gapped if the vendor has installed back doors in so they can access them in real time? That is what two companies are now admitting they have done.
 
  • Like
Reactions: iuwclurker
You would be far more knowledgeable than me, but I would think a local network at each polling place air-gapped from the Internet and with hardware redundancy/mirroring would be easily configured.
Hard to air-gap a machine with cellular capability, short of voting in a Faraday cage. And the voting machines become vulnerable, regardless, when needed updates are applied, or are simply programmed for the next election. I attended a talk on voting security by J Alex Halderman of UM last year. The problem is mind boggling and complex, but the list of simple things that we could and should be doing but aren't, is stunning.
 
  • Like
Reactions: Bill4411
Last year, ESS admitted to putting remote access capabilities into their voting systems. Now it turns out that VR Systems opened up remote access to their systems as well. Further, as Politico reports, it appears the Russians infiltrated VR Systems itself.

Now before things digress, this is the disclaimer that I am not suggesting anything untoward happened in 2016.

But the argument we often here is the system cannot be hacked. Well it turns out our vendors are installing remote access and not telling anyone. I do somewhat get the reasoning, how can someone like VR Systems have enough people trained and staged in every county that buys their system to troubleshoot election day problems. It isn't going to happen.

But that is a secondary concern, paper ballots can replace machines that have to be brought down. But IF someone hacks the system there is no good recovery mechanism. Anything on the internet can be hacked. Frankly, probably has been hacked to some extent if contains interesting information to foreign powers or the NSA.

I get that many of us hate the idea of a top down system. But what we have isn't working. To major suppliers have now admitted to doing exactly what they said they would not do. This has invalidated the entire claim that "the system is safe because it is not reachable" invalid. We need to get these systems under control before there is a hacking. Let me ask this. Let's suppose in 2020 a candidate wins and then it is discovered massive hacking occurred. Look at the constitution and tell me what remedies are listed?
Those machines aren't going to be replaced quickly so before they are replaced I wonder if they can just unplug them from the internet and only plug them in if they stop working right and techs need to trouble shoot them.
 
  • Like
Reactions: stollcpa
How can they be air gapped if the vendor has installed back doors in so they can access them in real time? That is what two companies are now admitting they have done.

The article is wrong in some respects and where it isn’t wrong it doesn’t say what you think it says. Voter data has been online in most jurisdictions for years. That can be tampered with but there is no way that leads to vote tabulation tampering. Such tampering can lead to voter problems, that is why provisional ballots are the law. Early voting which is now universal also mitigates this issue. The vote reporting equipment is online, once again, that is not the same as vote counting and tabulation. In the jurisdiction I am familiar with, the vote tabulating equipment is very secure during election night, kinda like Fort Knox.
 
Hard to air-gap a machine with cellular capability, short of voting in a Faraday cage.
Why in the fvck would a voting machine be set up with cellular capability???
The problem is mind boggling and complex, but the list of simple things that we could and should be doing but aren't, is stunning.
That doesn't surprise me. In the past I made good money on the side doing desktop computer cleanups for individuals and a handful of small offices. I saw one of two things -- either there was little or no security in place (no updated AV, everything defaulting to auto-anything, outdated web-facing programs, idiotic user behavior, etc.) or well meaning but incompetent people running multiple AVs and redundant anti-whatevers, usually from dodgy sources, which opened up more vulnerabilities than they closed. I worked myself out of a job by covering just the basics: putting into place a handful of security programs and prophylactic configurations and setting web-facing programs to update by default. The point being that the simplest measures will alleviate damn near everything there is to be concerned about. If that isn't even being done, then you're wasting time discussing the exotic "possibilities".
 
Why in the fvck would a voting machine be set up with cellular capability???
I'm guessing because it universally works. I'm also guessing that you've tried to walk a non-technical person through a network setup over the phone ...
 
Nope. Smarter than that. I always made them pay me to come out and do it for them.
That's funny. I know you're kidding, but on a more serious note, it does illustrate the potential cost of maintaining the systems. Would you feel better about a Windows XP system with no networking but with a Zip drive? And how do we vet all of these service people? Maybe we could hire the kids from DEFCON (a very short but fun/frightening read).
 
The article is wrong in some respects and where it isn’t wrong it doesn’t say what you think it says. Voter data has been online in most jurisdictions for years. That can be tampered with but there is no way that leads to vote tabulation tampering. Such tampering can lead to voter problems, that is why provisional ballots are the law. Early voting which is now universal also mitigates this issue. The vote reporting equipment is online, once again, that is not the same as vote counting and tabulation. In the jurisdiction I am familiar with, the vote tabulating equipment is very secure during election night, kinda like Fort Knox.

But the machines are vulnerable, see this story. Find me a computer security expert who says they CANNOT be hacked via the internet.
 
That's funny. I know you're kidding, but on a more serious note, it does illustrate the potential cost of maintaining the systems. Would you feel better about a Windows XP system with no networking but with a Zip drive? And how do we vet all of these service people? Maybe we could hire the kids from DEFCON (a very short but fun/frightening read).
Look, I'm just a techie wannabe, but I still think one could set this up easily enough.

In Monroe County, you vote on a paper ballot (blacken in the circles) which is then scanned into a reader box of some sort. In my polling place (which is actually pretty busy most of the time) there are at most a couple dozen little "booths" for you to fill in your ballot, then you walk it to and insert it in the scanner on your way out. There's only one of those. So at least in that case, you're only talking about needing to support one box. If that box becomes problematic, you either have another one sitting there as backup or you bring in another one and re-scan the ballots. All under the supervision of the poll officers, of course. The paper ballots are your final backup.

The tallies could be transmitted to the central tabulator in as secure/primitive fashion as you want -- phone in the numbers, print out and sneakernet them, burn to disk or flash drive and sneakernet, print out and fax, fer cryin' out loud. Regardless, the Internet shouldn't ever be involved.

The central tabulator could/should be similarly isolated. Results might not be instantaneous, but there's no reason they couldn't be made available in a timely fashion.

(I'd also suggest they use a bare bones Linux based OS with only the modules absolutely required to do the job, so no networking capability.)
 
But the machines are vulnerable, see this story. Find me a computer security expert who says they CANNOT be hacked via the internet.

A lot of this sounds like "consultant-speak" with the consultants looking for lucrative consulting gigs.

Much of what is written there is inconsistent with the Colorado system about which I have pretty good personal knowledge. The Colorado system is unique with its mail-security measures, but the inperson voting is fairly typical of many states. I don't have the time or the interest to pick apart the article.
 
Look, I'm just a techie wannabe, but I still think one could set this up easily enough.

In Monroe County, you vote on a paper ballot (blacken in the circles) which is then scanned into a reader box of some sort. In my polling place (which is actually pretty busy most of the time) there are at most a couple dozen little "booths" for you to fill in your ballot, then you walk it to and insert it in the scanner on your way out. There's only one of those. So at least in that case, you're only talking about needing to support one box. If that box becomes problematic, you either have another one sitting there as backup or you bring in another one and re-scan the ballots. All under the supervision of the poll officers, of course. The paper ballots are your final backup.

The tallies could be transmitted to the central tabulator in as secure/primitive fashion as you want -- phone in the numbers, print out and sneakernet them, burn to disk or flash drive and sneakernet, print out and fax, fer cryin' out loud. Regardless, the Internet shouldn't ever be involved.

The central tabulator could/should be similarly isolated. Results might not be instantaneous, but there's no reason they couldn't be made available in a timely fashion.

(I'd also suggest they use a bare bones Linux based OS with only the modules absolutely required to do the job, so no networking capability.)
That's pretty much how we do it in my state/county. And it's basically the type of process that Halderman advocates for. You have a paper backup, and no voter is alone in a booth with a machine that is involved in the voting. Throw in some statistical sampling of the ballots, and get people re-conditioned to not having instantaneous results. Unfortunately, as Bing points out, that isn't going to happen overnight. And it's not going to happen unless the money is set aside and certain security requirements are legislated. I'm shaking my head at whoever thought touch screen voting was a good idea.
 
That's pretty much how we do it in my state/county. And it's basically the type of process that Halderman advocates for. You have a paper backup, and no voter is alone in a booth with a machine that is involved in the voting. Throw in some statistical sampling of the ballots, and get people re-conditioned to not having instantaneous results. Unfortunately, as Bing points out, that isn't going to happen overnight. And it's not going to happen unless the money is set aside and certain security requirements are legislated. I'm shaking my head at whoever thought touch screen voting was a good idea.

Touch screens, and other accommodations, are necessary to comply with federal disabled voting requirements. Touch screens need not be universally used, just available.
 
Touch screens, and other accommodations, are necessary to comply with federal disabled voting requirements. Touch screens need not be universally used, just available.
Then use them to print out a paper ballot as I described and carry on from there.
 
Touch screens, and other accommodations, are necessary to comply with federal disabled voting requirements. Touch screens need not be universally used, just available.
That's not the point, plus you're conflating how a vote is recorded with how the user inputs the vote. Touch screens could be used to produce paper ballots.
 
Unfortunately, as Bing points out, that isn't going to happen overnight. And it's not going to happen unless the money is set aside and certain security requirements are legislated. I'm shaking my head at whoever thought touch screen voting was a good idea.
Someone else will have to weigh in, but I'll bet dollars to donuts all the systems available from the various vendors are Windows based. That's where the problem starts. With a Windows based setup, you're starting with a loaded gun and need to remove as many bullets as you can find. If some vendor misses one, or if the safety mechanism can be defeated, then you're toast. With a Unix-like system (Linux or BSD among others), you can build up from the kernel and the attack surface can be minimized to the point where these machines are essentially nothing more than glorified adding machines. Which is all they need to be.
 
A lot of this sounds like "consultant-speak" with the consultants looking for lucrative consulting gigs.

Much of what is written there is inconsistent with the Colorado system about which I have pretty good personal knowledge. The Colorado system is unique with its mail-security measures, but the inperson voting is fairly typical of many states. I don't have the time or the interest to pick apart the article.

We know that a computer NOT connected to the internet and in another room has been hacked, so I don't know why you are so convinced we have nothing at all to worry about. Sure, the method used in this attack isn't easy to carry out in a voting booth scenario. But it is just an example of how many attack vectors exist.

Many systems used today create NO paper trail. That's stupid. I would imagine you would have to agree on that.
 
The article is wrong in some respects and where it isn’t wrong it doesn’t say what you think it says. Voter data has been online in most jurisdictions for years. That can be tampered with but there is no way that leads to vote tabulation tampering. Such tampering can lead to voter problems, that is why provisional ballots are the law. Early voting which is now universal also mitigates this issue. The vote reporting equipment is online, once again, that is not the same as vote counting and tabulation. In the jurisdiction I am familiar with, the vote tabulating equipment is very secure during election night, kinda like Fort Knox.
Everything you wrote above is pure nonsense, a non-sequitur to the original question. Maybe you should sit this one out. This is obviously outside your competence zone.
 
  • Like
Reactions: dahldc
How is this a political issue? We should prioritize fair an accurate voting and vote tabulation. We know that machines were hacked by Russians in Florida. This is not some existential threat. How does the GOP get away with ignoring this?
 
Last edited:
  • Like
Reactions: Bill4411
Everything you wrote above is pure nonsense, a non-sequitur to the original question. Maybe you should sit this one out. This is obviously outside your competence zone.

He mentioned provisional ballots. As I understand it, they can be handed out if the person's eligibility is in question. A couple things about that. One, it does discourage voters from voting anyway. I haven't worked in 16 or 18, but I did before that. Some people would just "nevermind" it. Secondly, if the person is who they say they are (sometimes lack of ID is the problem), how does a provisional ballot solve the problem. If John Smith has been removed from the roles by a hack, it is a lot of work to go back and prove he was registered to vote 1 year ago. In mass hacking, will that all be sorted before an election is certified? And 3rd, if it happened a whole lot it would slow down the precinct tremendously. Let's recall in some minority areas people are already waiting 3 hours to vote. It would be worse if 10% of the people needed provisional ballots.
 
We know that machines were hacked by Russians in Florida.

Wut? Do you have a link? IIRC, hacks were attempted of voter data, I don't remember if those hacks were succussful. This has nothing to do with votes cast or tabulation.
 
Wut? Do you have a link? IIRC, hacks were attempted of voter data, I don't remember if those hacks were succussful. This has nothing to do with votes cast or tabulation.

You are correct. According the link below, the tabulation was done by a separate system. However, the Russians did hack into voter information and I don’t think it’s a stretch to think they have tried and will continue trying to hack other voting information and systems.

https://www.politico.com/states/flo...nd-desantis-refuse-to-release-details-1015772
 
Someone else will have to weigh in, but I'll bet dollars to donuts all the systems available from the various vendors are Windows based. That's where the problem starts. With a Windows based setup, you're starting with a loaded gun and need to remove as many bullets as you can find. If some vendor misses one, or if the safety mechanism can be defeated, then you're toast. With a Unix-like system (Linux or BSD among others), you can build up from the kernel and the attack surface can be minimized to the point where these machines are essentially nothing more than glorified adding machines. Which is all they need to be.
I'll again reference the DEFCON link. Most appear to be Windows (including XP), but one was a QNX system. Of course, if you run in single user mode and have no password, that's a problem. One of the kids installed Linux on the system, overwriting the system already there. I agree with your comment about Windows cruft, but hardware with ports and/or other I/O devices is a real problem. Sure, those kids had physical access to the machines, but it didn't take much time. Another problem is that it's my understanding that voting machine vendors aren't very eager to let others poke around in their software. It's basically a black box.
 
I agree with your comment about Windows cruft, but hardware with ports and/or other I/O devices is a real problem. Sure, those kids had physical access to the machines, but it didn't take much time. Another problem is that it's my understanding that voting machine vendors aren't very eager to let others poke around in their software. It's basically a black box.
Ports can be physically blocked or disabled at the BIOS level. Discussions about hacks done with physical access might make for good copy, but that's not the real issue. The concern is about nefarious actors doing large scale damage; not necessarily in one place, but small "adjustments" across a large number of machines could add up, make a difference, and go undetected. As far as access to the code is concerned, if the vendor won't allow for an audit by some regulatory/governing body, then they shouldn't be given the contract.
 
  • Like
Reactions: Cream&Crimson
As usual, the answer is because Republicans:

A raft of legislation intended to better secure United States election systems after what the special counsel, Robert S. Mueller III, called a “sweeping and systematic” Russian attack in 2016 is running into a one-man roadblock in the form of the Senate majority leader, Mitch McConnell of Kentucky.

. . . Mr. McConnell has long been an implacable foe of legislation that mandates disclosure or limits on political donors. Critics charge that he may have another reason to stay on the sidelines: not wanting to enrage President Trump, who views almost any talk of Russia’s success as questioning the legitimacy of his 2016 victory.
The report describes the numerous legislative efforts that are going nowhere, because of Republicans' ideological opposition to a federalized response and because Republicans fear enraging our toddler President, who can't abide reminders that Putin helped him win. Thus we're leaving ourselves largely defenseless against another foreign attack on our elections. Because Republicans prefer it that way.

In a time of Trump, decent people shouldn't vote Republican.
 
  • Like
Reactions: Cortez88
As usual, the answer is because Republicans:

A raft of legislation intended to better secure United States election systems after what the special counsel, Robert S. Mueller III, called a “sweeping and systematic” Russian attack in 2016 is running into a one-man roadblock in the form of the Senate majority leader, Mitch McConnell of Kentucky.

. . . Mr. McConnell has long been an implacable foe of legislation that mandates disclosure or limits on political donors. Critics charge that he may have another reason to stay on the sidelines: not wanting to enrage President Trump, who views almost any talk of Russia’s success as questioning the legitimacy of his 2016 victory.
The report describes the numerous legislative efforts that are going nowhere, because of Republicans' ideological opposition to a federalized response and because Republicans fear enraging our toddler President, who can't abide reminders that Putin helped him win. Thus we're leaving ourselves largely defenseless against another foreign attack on our elections. Because Republicans prefer it that way.

In a time of Trump, decent people shouldn't vote Republican.
Naw, the real reason the Republicans don't want to do anything about securing the voting is because they see Russia as their friend and may win them some more elections but I have news for them-- wait until the Chinese decide they want to get rid of Trump and manipulate the vote in favor of the Democrats- now that will get a big harumph out of Mitch and then they will want reform.
 
Last edited:
As usual, the answer is because Republicans:

A raft of legislation intended to better secure United States election systems after what the special counsel, Robert S. Mueller III, called a “sweeping and systematic” Russian attack in 2016 is running into a one-man roadblock in the form of the Senate majority leader, Mitch McConnell of Kentucky.

. . . Mr. McConnell has long been an implacable foe of legislation that mandates disclosure or limits on political donors. Critics charge that he may have another reason to stay on the sidelines: not wanting to enrage President Trump, who views almost any talk of Russia’s success as questioning the legitimacy of his 2016 victory.
The report describes the numerous legislative efforts that are going nowhere, because of Republicans' ideological opposition to a federalized response and because Republicans fear enraging our toddler President, who can't abide reminders that Putin helped him win. Thus we're leaving ourselves largely defenseless against another foreign attack on our elections. Because Republicans prefer it that way.

In a time of Trump, decent people shouldn't vote Republican.

Didn't Dan Coats say the red lights were blinking on future interference.

The thing about computer security is one does not know there is a problem until after the break-in.

But we have to ignore possible threats because any expert sounding an alarm bell must be angling for a government contract.
 
  • Like
Reactions: Rockfish1
Didn't Dan Coats say the red lights were blinking on future interference.

The thing about computer security is one does not know there is a problem until after the break-in.

But we have to ignore possible threats because any expert sounding an alarm bell must be angling for a government contract.

Naw, the real reason the Republicans don't want to do anything about securing the voting is because they see Russia as their friend and may win them some more elections but I have news for them-- wait until the Chinese decide they want to get rid of Trump and manipulate the vote in favor of the Democrats- now that will get a big harumph out of Mitch and then they will want reform.

Who in the hell ignores threats? And do you really think congress can pass a law to stop hacking? I think both of you are politicizing technology cuz TRUMP!

All public governmental computers, including voter data, are under CONSTANT ATTACK from probably thousands of hackers. There is nothing unique with Mueller's admonition about Russian attacks. The Russian attacks he mentioned were unsuccessful. We error on the side of caution, the false positive attacks outnumber the real ones by a wide margin. Many data breaches that we hear about are often the result of human error (but not always) which leave open a back door.

Marv, I know you have made the attempt; but once again how can air locked computer systems be hacked absent inside corruption?
 
Who in the hell ignores threats? And do you really think congress can pass a law to stop hacking? I think both of you are politicizing technology cuz TRUMP!

All public governmental computers, including voter data, are under CONSTANT ATTACK from probably thousands of hackers. There is nothing unique with Mueller's admonition about Russian attacks. The Russian attacks he mentioned were unsuccessful. We error on the side of caution, the false positive attacks outnumber the real ones by a wide margin. Many data breaches that we hear about are often the result of human error (but not always) which leave open a back door.

Marv, I know you have made the attempt; but once again how can air locked computer systems be hacked absent inside corruption?

Voting machine companies add things like USB ports that can be easily accessed. Think of Florida, 10 people in 10 of the heaviest D precincts in South Florida inserting code to change one in 10 D votes to R would make a big difference.

Source of USB.

I have posted about this long before we were crazy enough to elect Trump.

Edit to add link.
 
Voting machine companies add things like USB ports that can be easily accessed. Think of Florida, 10 people in 10 of the heaviest D precincts in South Florida inserting code to change one in 10 D votes to R would make a big difference.

Source of USB.

I have posted about this long before we were crazy enough to elect Trump.

Edit to add link.

If the USB ports aren't connected to anything, the machines are air locked. I acknowledge, and have said, that a corrupt insider can corrupt the machines and rig an election. Isn't that what you are talking about?

HAVA regulations have pretty detailed requirements about the storage and handling of the actual voting equipment. Security cameras and secure warehouses are among those requirements. No longer can the machines be stored in the courthouse basement with open access. I think your concern is overstated, but i agree where there is a will there is a way if election rigging is the intent.
 
The concern is about nefarious actors doing large scale damage; not necessarily in one place, but small "adjustments" across a large number of machines could add up, make a difference, and go undetected.
I think your concern is overstated, but i agree where there is a will there is a way if election rigging is the intent.
If there is something that we should have learned from Russia's interference in the 2016 election, it's that sowing chaos, distrust and divisiveness was an objective. An adversary need not affect the outcome of an election to achieve those goals. Arguably, the real threat isn't of an election being thrown, but that voters lose confidence in the integrity of our election process. Consider a scenario where Trump loses -- a guy who claimed election fraud by 3 million people in a election that he won -- and just a dozen or so strategically located voting machines have been visibly and demonstrably tampered with. To put it mildly, Trump is not an institutionalist.
 
  • Like
Reactions: Bill4411
ADVERTISEMENT

Latest posts

ADVERTISEMENT