bugtraq - RE: Diebold Global Election Management System (GEMS) Backdoor Acc ount Allows Authenticated Users to Modify Votes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 27 Sep 2004 10:01:14 -0400
From: David Brodbeck <DavidB@...l.interclean.com>
To: 'Claudius Li' <aprentic@...tae.net>, bugtraq@...urityfocus.com
Subject: RE: Diebold Global Election Management System (GEMS) Backdoor Acc
	ount    Allows Authenticated Users to Modify Votes


> -----Original Message-----
> From: Claudius Li [mailto:aprentic@...tae.net]

> So my question is, given that this seems to be a solved 
> problem why is there so much debate on finding the solution? 
> Surely I am missing something obvious.

You're missing the social dynamics around it.  There are several parties
involved:

- State officials who actually pick the voting equipment.  They generally
are politicians, with a background in law or business.  They don't
understand the complicated technical issues behind electronic voting.

- Companies who build the voting equipment.  Their motive is profit.  They
want to get a marketable product out quickly and cheaply.  They perceive
(correctly) that the audience they're selling to does not understand or care
about complicated security issues, and can be easily impressed by trivial
but sophisticated-looking features.

- The public.  They don't understand these issues either, and they have a
short attention span.

- The news media.  They don't push security issues because they lack good
visuals and don't fit into a 15-second news spot.  Anything longer and
they'll lose their audience (see above.)

- Computer scientists and voting activists.  They *do* understand the
issues, but are unable to explain them in a way the news media, the public,
and state officials find compelling and understandable.  The companies who
build the equipment can easily label them as alarmists or conspiracy
theorists.