Message-ID: <4158A9AD.2050609@immunix.com>
Date: Mon, 27 Sep 2004 17:00:45 -0700
From: Crispin Cowan <crispin@...unix.com>
To: Paul Wouters <paul@...net.nl>
Cc: Jeremy Epstein <jeremy.epstein@...methods.com>,
	bugtraq@...urityfocus.com
Subject: Re: Diebold Global Election Management System (GEMS) Backdoor


If a vendor did a proper job of constructing a machine that conformed to 
the VVAT spec, then open source would not be required *at all*. The 
voter gets to verify the paper ballot before it is deposted in the 
ballot box, and external oververs can physically inspect the ballot box 
and the discard box to ensure that the right number of ballots are 
deposited into each box.

OTOH, if the machine does *not* conform to the VVAT spec, then open 
source is no where near sufficient to assure fair balloting, because the 
vendor could supply source code all over the place, and then just 
install trojan code at the last moment.

And that is the fundamental problem with all-electronic (no paper trail) 
voting: a human observer on the outside cannot tell what is going on in 
the chips and disks. You can get all the tripwire/opensource/checksum 
report crap you want, but if a bad guy got access to the machine and 
installed a trojan, then your reports are all a pack of lies, and no 
amout of election observing by anyone will help.

That is why the VVAT isn the one and only answer to fair digital voting. 
Open source is a distraction.

Crispin

Paul Wouters wrote:

> Free enterprise is not the issue here. Audit trails are. If it means that
> somewhere someone cannot make a profit, then so be it. Unless you declare
> democracy dead, and instate the Corporate Republic. The 'free market'
> should not be a main consideration in voting security. If you cannot 
> relay
> that message to your government, then either you or your government is 
> not
> the right one for its task.
>
>> the VVPAT groups with the open source community.  So rather than putting
>> your energy into trying to get Diebold et al to move to open source, it
>
>
> Diebold has proven to not earn the trust of the public. It deserves to 
> lose
> money, or even go bankrupt. That's capitalism. You screw up and your 
> product
> no longer sells and you go do something else. Perhaps Diebold can go into
> the playing cards business.
>
>> (3) WRT requiring that the technology protect itself in case the users
>> don't, that's simply unrealistic.  In *any* real computer system, 
>> there are
>> expectations about the environment (e.g., the administrators aren't 
>> hostile
>> to the functioning of the system).  It's important to state what those
>> expectations are, but there will ALWAYS be some that rely on 
>> non-technical
>> means.  The important part about election systems is that they be 
>> explicitly
>> stated, and they be enforceable using non-technical means (e.g., by 
>> having
>> locks on doors).  The problem today is that some of the assumptions 
>> (e.g.,
>> the vendor provided software doesn't have any bugs) are clearly 
>> unrealistic.
>
>
> We are talking about voting machines here, not general purpose 
> operating systems! They should be able to restrict and properly (and 
> provably!) secure a reasonably simple dedicated single purpose voting 
> computer.
>
>> (4) WRT getting one set of software approved, and then installing 
>> another...
>> that's an old problem in any environment.  The way it's supposed to 
>> work in
>> election systems is that a particular version is approved, and it's 
>> illegal
>> for the vendor to install something different.  If there are teeth in 
>> the
>> law, and the vendor can be fined for installing illegal software, 
>> then it's
>
>
> A fine? No. They just be blacklisted from ever supplying voting 
> machines to
> the government again. Screwing up elections is not like hitting a red 
> light
> when there is nobody around.
>
>> Bottom line, election systems are no different than any other systems in
>> that the security of the whole system is based on risk management.
>
>
> But I guess no one trusts the US government itself anymore if even Europe
> is sending officials to watch over the elections:
>
> http://news.bbc.co.uk/2/hi/americas/3666898.stm
>
> And to counter your arguments, the Netherlands has open sourced its 
> voting
> system. You can download and verify it at http://www.ososs.nl/
>
> Paul


-- 
Crispin Cowan, Ph.D.  http://immunix.com/~crispin/
CTO, Immunix          http://immunix.com

Powered by blists - more mailing lists