Georgia’s Voter Registration Cancellation Site Briefly Exposes Data, With Predictable Results

(Mis)Uses of Technology

from the do-better-or-prepare-for-the-worst dept

Election security is still an issue that demands close attention. Unfortunately, the political rhetoric in this country has been controlled by Republicans who continue to insist the last election was “stolen,” despite a complete lack of evidence. This isn’t helping anything. And raiding the Capitol to overturn election results accomplished little else than allowing people to proclaim themselves “patriots” when not being actively prosecuted for federal law violations.

Georgia has been a political hot spot and an area of some concern in terms of election security. This dates back prior to Trump’s false “stolen election” claims, but not before Trump started converting Republican politicians into toadies willing to echo whatever dumb bullshit came out of his mouth.

So, on one hand, we have Governor Brian Kemp’s BS claim that Democrats were “hacking the voter registration system” — something he first declared in 2018 following Trump’s election two years earlier. On the other hand, we have Trump remora/former NYC mayor Rudy Giuliani doing whatever he can to prevent his money from ending up in the pockets of the Georgia election workers he spent several months defaming during TV appearances on FOX News and other far-right news outlets.

While it might seem more diplomatic to say the truth lies between these two extremes, the fact is the truth lies much closer to the actual truth than the conspiracy theories pushed by people like Georgia governor Brian Kemp, disgraced former mayor Rudy Giuliani, and the odds-on favorite for Grover Cleveland-ing the nation, Donald Trump.

What’s happening now isn’t helping anything. Georgia’s voter registration system has some problems, like many others across the nation. But Georgia is making headlines because it left some key voter registration data briefly exposed, which has now led to people who think they’re more subversive than they actually are to start cancelling registrations of people they don’t like. Here’s Doug Clark with more details for ProPublica:

On Friday, four days after Georgia Democrats began warning that bad actors could abuse the state’s new online portal for canceling voter registrations, the Secretary of State’s Office acknowledged to ProPublica that it had identified multiple such attempts — including unsuccessful efforts to cancel the registrations of two prominent Republicans, Rep. Marjorie Taylor Greene and Georgia Secretary of State Brad Raffensperger.

[…]

Mike Hassinger, a spokesperson for Georgia’s Secretary of State’s Office, said the state had been monitoring cancellation requests for abuse and that’s how it spotted the ones targeting Greene’s and Raffensperger’s registrations.

The Democrats issued the first warning. At first glance, it might appear Democrats were the first to exploit this exposed data. I’m not an idiot so I’m not going to claim this is a false flag operation meant to portray Democrats as cheaters willing to steal the vote. But there’s an equally likely chance this has nothing to with the Democrat party and everything to do with The Internet. It could have been a staffer at a Democratic rep’s office. Or it could have been someone who frequents 8chan. While this is obviously a bad thing, there’s no reason to believe this is the result of a coordinated effort by Democrat party operatives.

Rest assured, it will be portrayed as a conspiracy as soon as it’s politically expedient to do so. And that moment might come sooner than later, what with Trump spending part of his campaign visit to Atlanta, Georgia bad-mouthing the extremely popular (and extremely Republican) governor of the state.

“He’s a bad guy, he’s a disloyal guy and he’s a very average governor,” Trump told supporters, eliciting boos toward Kemp from the crowd.

These comments — along with the state’s failure to protect information that would allow people to cancel other people’s voter registrations — are sure to resurface if Trump loses the 2024 election. It will be served up as evidence the election was rigged against him.

And that’s the biggest problem here. This was careless and stupid. But it wasn’t a deliberate attempt to undermine the integrity of the upcoming election. But because it introduces doubt — no matter how thin and easily rebuttable — it just adds fuel to the fire that has been carefully tended since the failed insurrection attempt that greeted the results of the last presidential election. Mistakes will be made because that’s an inescapable fact of life. But these errors matter more now because there’s a considerable percentage of people willing to believe any mistake is a conspiracy and are willing to commit violence to prove their point.

Filed Under: e-voting, elections, georgia, vulnerabilties

Delaware Court Says Dominion Voting Systems Can Continue Suing Fox News For $1.6 Billion In Defamation

Defamation

from the hope-the-charade-was-worth-it,-Fox dept

Another one of Dominion Voting Systems’ many, many lawsuits against Trump loyalists will be allowed to continue. (For a pretty comprehensive rundown of Dominion’s election-related defamation lawsuits, check out these comments by BestNetTech reader RP.)

This particular lawsuit was filed in Delaware state court against Fox News Corporation, alleging that many of its hosts and commentators lied about Dominion’s voting machines and its owners during coverage following Donald Trump’s election loss. These false claims continued to be made by Fox News personalities like Lou Dobbs and Maria Bartiromo and amplified by guest commentators (who are also being sued by Dominion elsewhere) like former Trump lawyers Sidney Powell and Rudy Giuliani.

Fox moved to dismiss the lawsuit, claiming there was no defamation here, just a lot of protected speech. Fox’s defense is that repeated lies by hosts and guests were heated hyperbole and statements of opinion rather than defamation. Also, Fox contends it can’t be held responsible for statements made by its employees. From the decision [PDF]:

Fox argues that multiple constitutional doctrines protect Fox’s alleged defamatory speech. First, Fox contends that truthfully reporting newsworthy allegations made by a sitting president and his legal team on matters of public concern is not actionable. Second, Fox claims that the media is completely protected when reporting and commenting about allegations made in government proceedings. Third, Fox asserts that opinion and hyperbolic rhetoric about newsworthy allegations are constitutionally protected. Finally, Fox claims that none of the challenged individual statements identifies actionable defamation against Fox.

But, as the Delaware Superior Court points out in its refusal to toss the case, Fox News and its hosts were provided facts that contradicted on-air statements. And yet these statements continued unaltered, with Fox News playing up the “stolen election” angle to drive viewers to its broadcasts.

It’s that refusal to correct on-air statements that may end up costing Fox News a whole lot of money. Dominion is seeking $1.6 billion, citing the amount of money it has spent fighting months of false claims about its software and hardware, as well as contracts dropped by state officials who bought into the “stolen election” narrative.

The judge says repeating false claims when you have facts in hand can be defamatory. That’s called “actual malice” and it’s definitely actionable. And the reporting on the election and Dominion Voting Systems was far from neutral, undermining Fox’s “neutral reportage” defense.

The Court, reviewing the Complaint’s allegations, notes that it is reasonably conceivable that Fox’s reporting was inaccurate. As alleged, Dominion attempted to factually address Fox’s election fraud allegations. After Fox began connecting Dominion to election fraud claims, Dominion sent Fox executives and television anchors its “SETTING THE RECORD STRAIGHT” emails. Dominion’s emails, which contained analysis from election and related experts, tended to disprove the election fraud claims. Nevertheless, Fox and its news personnel continued to report Dominion purported connection to the election fraud claims without also reporting on Dominion’s emails. When Fox guests spread or reiterated disinformation about Dominion, Fox did not use the information Dominion provided to correct its guests or to reorient its viewers. Instead, Fox and its personnel pressed their view that considerable evidence connected Dominion to an illegal election fraud conspiracy.

In addition, the Court notes that it is reasonably conceivable that Fox was not dispassionate. Given that Fox apparently refused to report contrary evidence, including evidence from the Department of Justice, the Complaint’s allegations support the reasonable inference that Fox intended to keep Dominion’s side of the story out of the narrative. Moreover, the Complaint alleges numerous instances in which Fox personnel did not merely ask questions and parrot responses but, rather, endorsed or suggested answers. Fox therefore may have failed to report the issue truthfully or dispassionately by skewing questioning and approving responses in a way that fit or promoted a narrative in which Dominion committed election fraud.

This doesn’t necessarily mean the neutral reportage defense is completely undercut. But at this point — with Fox having yet to actually respond to the allegations in Dominion’s complaint — Fox can’t make this lawsuit disappear.

First, Fox argues it was not required to “defend” Dominion from Fox’s guest by reporting Dominion’s refutations. Still, Fox’s possession of evidence demonstrating the election fraud claims were untrue supports the reasonable inference that Fox made or published statements knowing they were false or with a reckless disregard for the truth. Fox may not ordinarily have a duty to defend the targets of allegations on which it is reporting; however, Fox must report on those allegations accurately and dispassionately under the neutral reportage defense. Second, Fox argues there are instances in which Fox was critical of the allegations against Dominion and in which Fox reported Dominion’s refutations. Fox may end up being right. This is the pleadings stage though and, at this stage, this argument raises factual issues the Court must resolve in Dominion’s favor. Fox will have the ability to develop this argument during discovery as the case proceeds.

The “fair reporting” privilege also does not apply. This covers “substantially true” coverage of court proceedings. Hardly anything asserted by Dominion to be defamatory fits this description.

The Court recognizes that most of the alleged statements were made before a lawsuit had been filed (e.g., the Powell allegations). As a result, most of the alleged statements, even if true, were not “of” a judicial proceeding. That alone is enough to preclude the fair report privilege. Fox counters with decisions that, according to Fox, hold the fair report privilege applies to “anticipated” or “forthcoming” lawsuits as well as pending proceedings. To the extent Fox argues its personnel were referring to pending election fraud cases filed throughout the nation, and investigations initiated by the federal government, the Complaint alleges facts that Fox’s personnel did not tailor their comments to the allegations in those proceedings. By consequence, the Court finds there is ambiguity, from the viewer’s perspective, as to whether Fox was reporting on those proceedings.

Hyperbole and opinion? Maybe that defense will work for Fox News once discovery is underway and all the facts can be closely examined. But for now, the court finds too many of the statements made by Fox News hosts possibly actionable to toss out the entire suit.

[T]he Court finds it is reasonably conceivable that Fox and its personnel broadcasted mixed opinions that were based on either false or incomplete facts unknown to the reasonable viewer. Many of Fox’s reporters made broad election fraud statements that did not disclose their sources clearly, or clearly connect their statements to the election fraud litigations. Although Fox classifies its reporters’ remarks as “commentary” that used “loose and hyperbolic rhetoric” for entertainment value, even loose and hyperbolic language can be actionable if it rests on false statements of fact undisclosed to viewers. Accordingly, the Complaint supports the reasonable inference that Fox made unprotected statements of fact that defamed Dominion.

It’s those “false statements of facts” that bring in the “actual malice” component of defamation law. The court says Dominion has alleged enough to move forward. Fox’s defense that some of its commentators and hosts contradicted claims of election fraud — perhaps assuming this would mean Fox News as a whole can’t be sued — works against it.

In addition, the Complaint alleges that several of Fox’s personnel openly disclaimed the fraud claims as false. Yet, certain Fox personnel (e.g., Mr. Dobbs) continued to push the fraud claims. The nearby presence of dissenting colleagues thus further suggests Fox, through personnel like Mr. Dobbs, was knowing or reckless in reporting the claims.

That’s not to say this won’t ultimately result in Fox News escaping this lawsuit. But from what the judge has seen so far, Fox definitely has an uphill battle. Fox execs should have known they were playing with litigation fire by allowing their hosts to traffic in false claims about Dominion voting machines — especially after the network was given evidence that directly contradicted these claims. But the network apparently felt the “stolen election” angle was for more profitable and more likely to retain viewers unwilling to believe their president was no longer their president.

As multiple lawsuits continue to work their way through the court system, high-profile Trump acolytes are going to discover that their election conspiracy theories are going to cost them far more than their reputations.

Filed Under: actual malice, defamation, e-voting, election, fair reporting, fox news, substantial truth
Companies: dominion voting, fox

E-Voting App Maker Voatz Asks The Supreme Court To Let It Punish Security Researchers For Exposing Its Flaws

(Mis)Uses of Technology

from the be-the-injustice-you-want-to-see-in-the-world dept

Voatz has decided to weigh in on a Supreme Court case that could turn a lot of normal internet activity into a federal crime. At the center of this CFAA case is a cop who abused his access privileges to run unauthorized searches of law enforcement databases. The end result — after a visit to the Eleventh Circuit Court of Appeals — was a CFAA conviction for violating the system’s terms of use.

That’s why this case is important. If the CFAA is interpreted this broadly, plenty of people become criminals. And it won’t just be security researchers risking criminal charges simply by performing security research. It will also be everyone who lies to social media services about their personal info. Lawprof Orin Kerr’s brief to the Supreme Court points out what a flat “no unauthorized use” reading would do to him.

Like the majority of American adults, I have a Facebook account. Facebook’s terms of service require its users to “[p]rovide accurate information about” themselves. See Facebook Terms of Service, https://www.facebook.com/legal/terms/plain_text_ terms (last visited July 1, 2020). I recently violated that term by listing my home city as Sealand. Sealand is an offshore platform in the North Sea near England built during World War II to host anti-aircraft guns. It’s not actually my home city. I list it only to make a point about the CFAA. But under the government’s position, my joke is no laughing matter. It is a federal crime.

No one should want the law to be read this way. Not even sites that would greatly prefer users to respect the terms of service. The collateral damage of a broad reading would make it far easier to prosecute people who use sites in ways owners don’t expect or engage in research efforts that require ignoring the rules. And it would give abusive site owners plenty of ways to harass users and visitors they don’t like.

But one developer wants this to happen. And it’s a developer of notoriously flawed e-voting systems. Voatz has made plenty of headlines lately. None of them have been flattering. MIT researchers discovered a bunch of flaws in Voatz software. Voatz tried to combat this negative press by hiring outside researchers to perform an independent audit of its systems. This went no better than the MIT study. Voatz is full of holes, which made its accusations that the MIT researchers were only in it for the clicks look even stupider.

Voatz thinks the court should read the CFAA as broadly as possible, which will make it easier for it to punish security researchers for finding flaws in its software. It’s literally the only thing it’s arguing. Its 16-page brief [PDF] makes this ridiculous claim:

A BROAD READING OF “EXCEEDS AUTHORIZED ACCESS” IN THE CFAA WILL NOT HAVE A DELETERIOUS EFFECT ON COMPUTER SECURITY

That’s it. That’s the argument. That is all Voatz wants to say.

The brief says researchers won’t be harmed because bug bounty programs and controlled access for authorized penetration testing, etc. operate using completely different terms of service. Under these guidelines, researchers are “free” to conduct their research without worrying about CFAA charges.

But that’s a very limited view of security research. Lots of security research is ongoing and not limited to hunting bugs for bounties or at the behest of sites and services. That’s what would be affected by a broad reading and Voatz’s interest in securing a broad reading can be traced back to the MIT research it still claims is incorrect. It’s also still very defensive people have accused Voatz of sending the FBI after some freelance researchers. For no apparent reason, it recounts this incident in its brief, submitting as evidence of… something.

The Computer Researchers also cite a news account claiming that Voatz reported two college students to the Federal Bureau of Investigations. (Computer Researchers’ amicus brief, p. 24). That account is at least partially inaccurate, in that Voatz made no report to the FBI or any other federal authority. Rather, Voatz reported the students’ unauthorized attempts to access its systems to its customer, the State of West Virginia, because the students’ ill-advised activity was indistinguishable from a hostile attack and the students did not seek any prior authorization privately or through Voatz’s public bug bounty program. It is a standard practice for technology companies to report attack attempts to their clients and Voatz is contractually required to report such potential attacks during live elections – the same way an electric company would be required to report an attack on an electric grid to state and federal authorities, or a dam operator would be required to report an attack on software that monitors and operates dams to authorities such as the Army Corps of Engineers. Officials in West Virginia, in their discretion and independent of Voatz, then chose to refer the matter to the FBI. To Voatz’s knowledge, no one was prosecuted.

Following Voatz’s argument to its logical conclusion, a broad reading would result in more prosecutions because there’s very little security research that doesn’t involve violating terms of service agreements. It would allow everything to hinge on “discretion.” This might mean something if entities caught with their security pants down were more reasonable in their responses. Unfortunately, shooting the messenger is still the most popular response.

And the less said about the supposed “discretion” of prosecutors the better. Prosecutors pursue convictions, not justice. And the DOJ has not shied away from pursuing very questionable CFAA prosecutions in the past.

Voatz wants messengers shot. It’s that simple.

While the Computer Researchers portray themselves as under threat of being victimized for inadvertently tripping over a restriction, the reality is different: they wish to be free to deliberately infiltrate a live system in violation of readily accessible terms, openly publish any results obtained, and be immune from being intercepted or reported for doing so.

Voatz thinks the law should aid and abet its antagonism towards researchers who’ve uncovered flaws in systems it hopes to sell to government agencies. If the Supreme Court decides to side with Voatz, it will be open season on researchers. This is what Voatz wants. And there are others like Voatz out there that would welcome the chance to punish people for exposing problems they’re not interested in fixing. But only Voatz has put it in writing.

Filed Under: cfaa, e-voting, security research, supreme court
Companies: voatz

Just As The Postal Service Is Being Dismantled To Prevent The Handling Of Mail In Ballots, It Tries To Patent Blockchain Voting By Mail

(Mis)Uses of Technology

from the i...-uh...-what? dept

We are living in truly dystopian times. As you may have heard, this week there have been a bunch of stories regarding the somewhat systematic dismantling of US Postal Service operations in what appears to be a coordinated effort by this administration to foil the process of sending and collecting mail-in ballots. But, apparently, rather than ensuring its own ability to handle mail-in ballots for this election, the US Postal service is trying to… patent blockchain-based voting?

As you almost certainly know, President Trump has been — without any factual basis at all — decrying mail-in ballots, despite the fact that they have been proven safe and effective. As we’re in the middle of a pandemic — made significantly worse by this administration’s own incompetence — whose main mode of transmission is gathering indoors, the need for more mail-in ballots is obvious to anyone who cares about a functioning democracy. Instead, the President has apparently focused on making it impossible. While that seemed like a conspiracy theory to many, he admitted he was holding up funding for exactly that reason:

“They want three and a half billion dollars for something that’ll turn out to be fraudulent, that’s election money basically. They want three and a half billion dollars for the mail-in votes. Universal mail-in ballots. They want $25 billion, billion, for the Post Office. Now they need that money in order to make the Post Office work so it can take all of these millions and millions of ballots,” Trump said, repeating his false claims that mail-in voting would be “fraudulent.”

“But if they don’t get those two items that means you can’t have universal mail-in voting because you they’re not equipped to have it,” Trump added.

Except, again, there is no evidence to support the claims of mail-in ballot fraud. Indeed, Trump and the first lady themselves have requested mail-in ballots in Florida (where he does not reside) and when questioned as to why it was okay for their to be mail-in ballots there, has said it works in Florida because there’s a Republican governor.

So Florida has got a great Republican governor, and it had a great Republican governor. Ron DeSantis, Rick Scott, two great governors. And over a long period of time, they?ve been able to get the absentee ballots done extremely professionally. Florida is different from other states.

He’s also supported mail-in ballots among his supporters in North Carolina. Of course, it’s notable that North Carolina is basically the one place where there was some evidence of mail-ballot fraud… conducted by Republican operatives.

At the same time, however, beyond just blocking funding for the USPS, other efforts have been made to harm the ability to handle mail-in ballots. The Postmaster General, Louis DeJoy, who was only just appointed in May, fired a bunch of top USPS execs in a “Friday Night Massacre” a week ago. And this week, it seems like there’s been a new story every hour or so. All over the country, the USPS started removing and dismantling expensive postal sorting machines for now clear reason.

There have also been reports in places like Montana and Oregon that the familiar blue postal boxes were being removed for unclear reasons.

To drive all of this home, the USPS has directly warned 46 states (and Washington DC) that it may have delays in handling mail-in ballots.

But have no fear (or, really, have lots and lots of fear), because in the midst of all of this, a USPS patent application for blockchain-based mail-in ballots has been released. Applied for back in February, but just now revealed, the patent application first noticed by Jamie Love is for:

A voting system that can use the security of blockchain and the mail to provide a reliable voting system. A registered voter receives a computer readable code in the mail and confirms identity and confirms correct ballot information in an election. The system separates voter identification and votes to ensure vote anonymity, and stores votes on a distributed ledger in a blockchain.

Of course, as we’ve highlighted in the past, while some people keep pushing for blockchain-based voting it solves none of the problems of actual online voting, and leverages none of the benefits of the blockchain. Indeed, basically every blockchain-based voting system to date has been a dumpster fire of security concerns and, given everything else discussed above, you can bet the same would be true for any USPS-based blockchain voting system.

Even so, the timing of this release of this patent, in the midst of everything else going on with the USPS and efforts to suppress mail-in ballots (well, at least from those who don’t support the President) is the kind of coincidental timing that even the worst Hollywood writers would reject as just too on the nose. Alas…

Filed Under: blockchain, democracy, donald trump, e-voting, elections, louis dejoy, mail in ballots, patents, usps, voting

Investigation Shows Governor's Claims That Democrats Tried To Hack The Georgia Election Were Bullshit

(Mis)Uses of Technology

from the another-unforced-error-by-Brian-Kemp dept

Georgia Governor Brian Kemp is very involved with the electorate. Well, perhaps not that involved with the residents of the state, but he does seem to keep a very close — and very partisan — eye on election security. Election security is important, especially as more states move to electronic ballots, but Kemp has spent most of the last four years using election security as a political football to score points with.

When President Obama was still leading the nation, Kemp (while still Georgia’s Secretary of State) claimed the DHS had breached his office’s firewall during its security testing — something he had directly asked it not to do. Kemp claimed his state had already implemented the DHS’s recommendations and had asked to be left out of this nationwide testing. The DHS apparently ignored that, resulting in Kemp making lots of noise about an overreaching federal agency.

Kemp’s tune changed once Trump was elected. While running for the job of governor against Democrat Stacey Abrams, Kemp — a Republican — generated a lot of bad press for himself by allegedly engaging in voter suppression efforts. He capped this off with a bad judgment two-fer.

First, he insisted the Democratic Party was trying to hack the voter registration system. The only evidence Kemp had for this is that a hacking attempt had been made. He responded to this by opening an investigation into the Democratic Party based on apparently nothing more than his animosity towards it. This was capped off a few days later when Kemp released a ton of absentee voting info, including names, addresses, and the reason they voted absentee.

Two years later, ProPublica — using documents obtained from the Georgia Bureau of Investigation (GBI) — has published the investigation’s findings. No surprise, GBI’s conclusions don’t agree with Kemp’s baseless and partisan assertions.

“The investigation by the GBI revealed no evidence of damage to (the secretary of state’s office’s) network or computers, and no evidence of theft, damage, or loss of data,” according to a March 2 memo from a senior assistant attorney general recommending that the case be closed.

Unlike Kemp’s 2016 assertion about DHS meddling (which was later shown to be routine checks of the state’s firearm database by law enforcement) where it wasn’t asked to, the alleged “failed hacking attempt” seen by Brian Kemp’s office was actually the DHS doing something the state had asked it to do.

The internet activity that Kemp’s staff described as hacking attempts was actually scans by the U.S. Department of Homeland Security that the secretary of state’s office had agreed to, according to the GBI. Kemp’s chief information officer signed off on the DHS scans three months beforehand.

Kemp continues to be wrong about election security — something that only seems to concern him when it can be leveraged to (incorrectly in every case) target political opponents. The state’s election system still has security issues. The article points out the site where voters can check their information still contains a “significant vulnerability” that Kemp has been notified of, but refused to acknowledge.

All the bluster worked, though. Kemp was elected governor in 2018 and now has an even bigger platform to be wrong about election security issues. And he — and his former office — were completely wrong about this one. The other alleged hacking his office thought it was witnessing — other than the DHS’s pentest traffic — was nothing more than someone doing what anyone could do: altering site URLs to view other voters’ data.

That’s not hacking. That’s what anyone who knows how websites work can do at any time with zero skill or additional tools. And from that, an entire conspiracy theory was erected by Kemp’s office, resulting in thousands of tax dollars being wasted to pursue Kemp’s politically motivated accusations. There’s some hackery going on here, but it’s only of the partisan variety.

Filed Under: brian kemp, dhs, e-voting, georgia, hacking, politics, voting machines, voting security

Study Shows Major E-Voting System Open To Numerous Hacking Attacks

(Mis)Uses of Technology

from the e-voting-can't-be-secured.-Full-Stop. dept

Another day, another electronic voting system that’s simply not up to the task.

Over the weekend, researchers at MIT and the University of Michigan released a paper (pdf) showcasing how OmniBallot, an electronic voting system made by Seattle-based Democracy Live, is vulnerable to hack attacks and vote manipulation. OmniBallot is currently being used used in Colorado, Delaware, Florida, Ohio, Oregon, Washington, and West Virginia. Courtesy of the pandemic, these and several additional states are considering their expanded use of the platform. But the study makes it abundantly clear that may not be a particularly good idea:

“We find that OmniBallot uses a simplistic approach to Internet voting that is vulnerable to vote manipulation by malware on the voter?s device and by insiders or other attackers who can compromise Democracy Live, Amazon, Google, or Cloudflare. In addition, Democracy Live, which appears to have no privacy policy, receives sensitive personally identifiable information?including the voter?s identity, ballot selections, and browser fingerprint? that could be used to target political ads or disinformation campaigns.”

Great.

BestNetTech has, of course, been highlighting the problems with electronic voting since the site began. It’s a sector dominated by companies that simply don’t seem to care if their platforms can be secured, that often refuse to adhere to basic security standards, that don’t allow third-party researchers to fact check their claims, and then simply utter “trust us” every time concerns are raised.

The Omniballot system lets states deliver ballots electronically to voters as a pdf, letting users vote via email, fax or mail. But it’s also being used as a pure internet voting system in states like Delaware, which used it as the backbone of its primary voting just last week. Security researchers have been pointing out for decades that there are simply too many attack vectors between your PC/phone and the target destination to adequately secure the data in transit. In this case, researchers found the system was open to both vote and ballot manipulation:

“Specter and Halderman found that with regard to the blank ballots delivered to voters over the internet, an attacker could alter those ballots to change or remove races or candidate names. They could also misdirect completed ballots returned through the internet so they?re sent to the wrong destination. The greatest risk, though, is manipulation of votes. Attackers could use malware on the voter?s computer or injected into the OmniBallot web app so that the ballot could appear correct to the voter reviewing it on their computer while the ballot that?s submitted has different selections.”

Researchers found the system transmits all manner of sensitive voter data over the internet that simply doesn’t need to be transmitted. The system also uses a wide number of intermediaries, including Amazon, Google, and Cloudflare, all of which researchers say create additional opportunities for manipulation:

“The biggest security problem with internet voting is the insecurity of all the millions of voters? computers and phones. That doesn?t change, depending on who is hosting the server,? Appel said. ?But it?s still an important point to realize that [in this case] it?s not just one server that would need to be secure in addition to the millions of voters? computers; it?s a whole ecosystem of connected companies.”

Again, internet voting cannot be adequately secured. It simply can’t at this moment in the technology’s development history. There’s a long list of companies and government leaders that have fooled themselves to the contrary because it’s profitable, but it’s hard to find any reputable security researcher that genuinely thinks electronic voting is anywhere near prime time, and this is just one of countless studies making that very clear.

But because our broken Congress has refused to secure proper funding to do mail voting with a proper paper trail correctly, and is insistent on turning secure remote voting into an idiotic partisan issue, this isn’t a problem that’s going away anytime soon.

Filed Under: e-voting, electronic voting, omniballot, security risks
Companies: democracy live

Surprise! MIT Study Claims Voatz E-Voting Technology Is A Security Dumpster Fire

(Mis)Uses of Technology

from the we've-kinda-been-over-this dept

You’d be pretty hard pressed to find a single respected cybersecurity expert that thinks voting via smartphone is a good idea. There’s just too many potential attack vectors as your voting data floats from your personal device, across the internet, and into the final tally repository. Despite this there’s an endless chorus of political leaders, cities, and states who continue to insist they know better. From West Virginia to Washington State, the quest for great inclusivity in voting access often results in people ignoring these warnings in the belief that they’re helping.

The West Virginia effort has been handed over to internet voting vendor Voatz, whose smartphone voting system had already been criticized for being risky and insecure. Last November, Senator Ron Wyden wrote to the Pentagon to raise concerns about Voatz?s security and to ask for a full audit of the app.

Criticism of the company grew much louder this week after MIT researchers released a paper (pdf) showing how Voatz’s technology has some fairly basic problems that would let an attacker intercept votes as they?re transmitted from mobile phones to the voting company?s server — without anybody being the wiser:

“We find that Voatz has vulnerabilities that allow different kinds of adversaries to alter, stop, or expose a user?s vote, including a sidechannel attack in which a completely passive network adversary can potentially recover a user?s secret ballot. We additionally find that Voatz has a number of privacy issues stemming from their use of third party services for crucial app functionality. Our findings serve as a concrete illustration of the common wisdom against Internet voting, and of the importance of transparency to the legitimacy of elections.”

While Voatz has repeatedly complained that its blockchain technology should have protected this from happening, the researchers found said implementation wasn’t actually implemented in the way the company claimed, providing no additional security protection to the vote transmissions. On top of those issues, computer science professor Alex Halderman found other issues with the certificate pinning and servers Voatz implemented:

The New York Times, which first reported the research, notes that a copy of the findings had already been submitted to the Department of Homeland Security and the various election officials who’ve signed off on the platform. Like many e-voting companies, Voatz claims transparency isn’t really necessary because it utilizes an array of anonymous experts to audit the company’s systems. But the findings of those audits have yet to be made public, even to the officials using the systems. See the problem yet?

For its part, Voatz’s response has been to double down on its previous positions while insulting the researchers that disclosed the problem, insisting that server-side protections would thwart the theoretical attack (cybersecurity experts were quick to disagree). The company issued a blog post in which it accused the researchers (MIT’s Michael Specter, James Koppel and Daniel Weitzner) of being publicity hounds and attempting to “deliberately disrupt the election process”:

“It is clear that from the theoretical nature of the researchers? approach, the lack of practical evidence backing their claims, their deliberate attempt to remain anonymous prior to publication, and their priority being to find media attention, that the researchers? true aim is to deliberately disrupt the election process, to sow doubt in the security of our election infrastructure, and to spread fear and confusion.”

When every single respected infosec researcher and journalist is telling you e-voting can’t be adequately secured and your solution to that problem is flawed and will only make that problem worse, insulting and ignoring researchers isn’t a great look. Compounded by the GOP’s refusal to pass any election security bills of note, and you can start to see how we’re just begging for problems on what could potentially someday be a catastrophic scale.

Filed Under: blockchain, e-voting, mobile voting, research, security
Companies: voatz

John Oliver Takes On Fucked Up Voting Machines In The Way Only He Can

(Mis)Uses of Technology

from the nicely-done dept

At BestNetTech, we’ve been writing about the problems of electronic voting for just about our entire existence. I believe the first time we wrote about the problematic nature of electronic voting was in June of the year 2000, a few months before the controversy over “hanging chads” in the 2000 election in Florida. Over the years, we’ve continued to write about electronic voting and its myriad problems dozens upon dozens of times — and to this day I remain amazed at how little companies and election officials have taken this space seriously. Part of the issue is that there is no easy solution. There isn’t a “good” solution, there are only options that are “less bad” than others. The problem is that many places use solutions that are obviously bad when there are at least better options on the table.

So it’s great to see John Oliver step in and explain the problems with voting machines in a way that only he can:

If you’ve followed this space for some time (as, apparently, we have), you won’t find much that’s surprising in the piece, but it does such a good job of highlighting just how ridiculous the discussion currently is around voting machines, and how little politicians and voting machine companies seem inclined to do anything about it all.

Filed Under: e-voting, electronic voting, john oliver, voting machines, voting security

Revolving Doors And Regulatory Capture Are Ensuring E-Voting Remains An Insecure Mess

(Mis)Uses of Technology

from the we're-from-the-government-and-we're-here-to-secure-corporate-boardroom-p dept

Despite the long list of bad news generated by electronic voting machines, their market share only continues to grow. Rather than consider them the attack vectors they are, state and county legislators have decided to toss caution and paper ballots to the wind. The future is now. And it’s riddled with vulnerabilities.

Maybe there shouldn’t be a rush to digitize the democratic process, at least not while manufacturers are still shipping machines pre-loaded with security flaws and inadequate software. The push for e-voting machine deployment isn’t organic, of course. It’s an organized push that starts with the machines’ manufacturers and ends in regulatory capture.

Sue Halpern has exposed the paper trail connect voting machine manufacturers to ill-advised rollouts in her article for the New Yorker. The heaviest pushes target legislatures that make purchasing calls for the entire state. Most states allow the decision to be made at the county level, which decreases the chance the entire state will be affected by voting machine hacking or malfunctions. But in states like Georgia and Delaware, a successful pitch to the state legislature can mean hundreds of millions of dollars in sales.

The pay-for-play begins in the usual way: paid junkets that take state advisory boards to major cities for the usual wine/dine/schmooze-fests with all expenses paid. An investigation by McClatchy showed the Governor Brian Kemp’s chief of staff, David Dove, attended an event held by voting machine manufacturer ES&S (Election Systems & Software) — timed impeccably to capture the state’s $100 million voting machine market. To the surprise of no one, the state’s election commission decided to award ES&S this contract. But it had to do so over the voices of non-purchased stakeholders who saw nothing good in replacing one faulty e-voting machine with a similarly faulty product.

In doing so, the panel rejected the advice of computer scientists and election-integrity advocates, who consider hand-marked ballots to be the “most reliable record of voter intent,” and also the National Academies of Sciences, Engineering, and Medicine, which recommended that all states adopt paper ballots and conduct post-election audits.

This continued the proud Georgia tradition of voting machine vendor cross-pollination in the state legislature, which kicked off almost a two decades ago. In 2002, Diebold secured a $54 million contract to provide the state with voting machines. Diebold’s lobbyist was a former Georgia state official. When problems developed, ES&S stepped in, killing off legislation addressing election integrity issues and capturing a very key demographic.

In 2006, a bill requiring a verifiable paper record of each ballot, introduced in the Georgia legislature at the urging of election-integrity advocates, failed after the state’s elections director, Kathy Rogers, opposed it. Rogers, of course, later went to work for E.S. & S.

Another legislator took an extended trip through the lawmaker/lobbyist revolving door. Charles Harper went from sod farmer to state rep to lobbyist for ES&S before ending up as the deputy chief of staff in Governor Brian Kemp’s office. Brian Kemp, of course, spent the last election hastily patching voting machine vulnerabilities following the exposure of flaws, blaming the Democratic Party for the alleged hack, doxxing absentee voters, and, finally, overseeing voting integrity operations of an election he participated in.

Congress has tried to fix this problem… multiple times. It opened this year’s session with a 571-page bill full of reforms and paper ballot mandates. The problem is previous attempts to install these reforms have failed after receiving pushback from state officials. Voting machine vendors are focusing on states and counties, where the decisions (and purchases) are made. And it’s working.

Last year, the Democratic congressman Bennie Thompson, of Mississippi, proposed the Election Security Act; a year before, the Republican Mark Meadows, the chair of the right-wing House Freedom Caucus, introduced the Paper Act, which was endorsed by the former Department of Homeland Security Secretary Michael Chertoff and by Grover Norquist, the president of the conservative organization Americans for Tax Reform. The Senate’s attempt to reform election practices, last year’s Secure Elections Act, had bipartisan support, too, but was killed by the White House before it got out of committee.

You can’t remove money from politics and you can’t banish lobbyists from petitioning on the behalf of the causes and corporations they represent. But you can oust politicians who prefer corporations to constituents. Changes can be made and it all starts with those who serve their own interests rather than the public’s. Shining a light on regulatory capture is the first step.

Filed Under: brian kemp, e-voting, georgia, lobbying, regulatory capture

Texas E-Voting Machines Switching Votes For Non-Nefarious But Still Stupid Reasons

(Mis)Uses of Technology

from the almost-competent-handling-of-the-democratic-process dept

For all the talk about election interference from nation-states, there’s been not nearly as much concern about devices themselves threatening the integrity of the voting system. E-voting machines have long been an insecure mess. On top of that, they’re prone to introducing errors — either through flaws in the devices themselves or by users who aren’t familiar with how they work.

The latter seems to be the issue in Texas, where voters have been complaining about their votes being switched. What sounds like just another crazy conspiracy theory may be nothing more than software not behaving the way people think it should behave.

Some Texas voters are complaining that machines flipped their straight-ticket selections to the other party in key races during early voting, especially the much-watched Senate battle between Republican Ted Cruz and Democrat Beto O’Rourke.

[…]

“The Hart eSlate machines are not malfunctioning, the problems being reported are a result of user error — usually voters hitting a button or using the selection wheel before the screen is finished rendering,” said Sam Taylor, spokesman for the office of Secretary of State Rolando Pablos, who was appointed by Republican Gov. Greg Abbott.

This appears to be happening only to voters voting straight-ticket. (Gross. — Ed.) The software apparently populates tickets slower than voters are expecting. Hitting “submit” before it’s ready to move forward causes problems with candidate selection. The Texas Republican Party is warning voters to be patient and double-check that all candidates have been selected before moving on. The same thing is happening to Democratic straight-ticket voters, causing them to “vote” for Ted Cruz if they aren’t careful.

This would be somewhat comical if there was any way for voters or election officials to track which votes may have been flipped. But there isn’t. The move to paperless voting has eliminated the backup system everyone looks to when things go wrong: the paper trail. The Hart eSlate machines produce no receipts, leaving it up to voters to catch errors before submitting their votes.

The Democratic Party is blaming the government for not doing more, which is a very Democratic Party thing to do. In this case, the Republicans are in control of the state and the Democratic Party has chosen to claim the Republicans don’t care enough about the problem. The state’s government has pointed out e-voting machines only need to comply with state laws, not actually be accurate and/or idiot-proof. It points to the voting machines’ certification — which last happened nearly a decade ago — as evidence that the bare minimum requirements have been met.

It’s a mess and it’s probably not going to be fixed anytime soon. The state says it’s up to the counties to replace voting machines they don’t like. Counties likely don’t have the funding to do so immediately and there’s no way any county is going to hotswap e-voting machines with an election already in progress. The problems of the 2018 election will be kicked down the road to 2020 where it’s likely the same fears of voting interference will be stoked while the faulty machines causing the problems remain in place.

Filed Under: e-voting, switching votes, texas, ui, user interface