D.C. election issues and hacking of potential web voting are now national issues, and causing mounting concerns.
Brad Blog has been following the hacking issue closely here:
D.C. Internet Vote Scheme Hacker: 'Within 36 Hours We Had Total Control of Server, Ability to Change Votes, Reveal Secret Ballots'
As we posited in our coverage yesterday of D.C.'s Internet Voting scheme which was hacked with the University of Michigan fight song just days after experts had warned against the entire scheme, J. Alex Halderman, asst. professor of electronic engineering and computer science at the university, was, indeed, at the heart of the hack.
He details tonight that he and a small team of students were happy to participate in the test that D.C. election officials had announced, with just three days notice, inviting hackers to try and penetrate the system they planned to use this November, as developed with the Open Source Digital Voting Foundation.
Halderman writes in his explanation of how they did it:
Within 36 hours of the system going live, our team had found and exploited a vulnerability that gave us almost total control of the server software, including the ability to change votes and reveal voters’ secret ballots.
And if you think that's chilling, Halderman goes on to note that all cast ballots on the system were modified and overwritten with write-in votes, all passwords taken --- including the encryption key, which e-voting supporters constantly suggest will keep such systems safe --- before they went on to install a back door to let them view any votes cast later, after their attack, along with the names of voters and whom they voted for...
My friend Keith Ivey writes:
I listened to a lot of Cheh's elections hearing today,
with a break for listening to the Kojo Show. I'm not going to write up
a report, but here are my tweets:
Dorothy Brizill: Sep 14 primary "by far the worst election I have ever
witnessed, in the
District of Columbia or any other city." #dccouncil
Brizill says BOEE employees forced to work 16-18hr days for weeks w/no
overtime pay under threat of losing jobs. #dccouncil
Tom Smith of Ward 3 Dems concerned about "potential for fraud &
mischief", wants
early voting in each ward, opposes same-day registration.
Tom Smith complaining that AU students are registering to vote in ANC
election, doesn't mention he's the one they're targeting. #dccouncil
Tom Smith: A bank statement alone should not be sufficient to register
in DC. #dccouncil
Moten complaining about Ward 8
straw poll excluding unregistered voters.
W8 D's can make own rules. What does this have to do w/ #dccouncil?
Moten complains about Brizill (at table w/him) reporting that young
people were paid to vote in straw poll. #dccouncil
Moten still harping on his ridiculous gift card "sting" video. #dccouncil
Brizill going through detailed explanation of (mis)handling of data
cartridges from precincts. She was denied access for 2.5hr. #dccouncil
Brizill says seals were broken at loading dock, w/o observers, "chain of
custody broken". "Someone made a decision to change the process."
Brizill: "There was no transparency" in counting process. #dccouncil
Brizill knows what Rokey Suleman will say, since he had "his dog & pony
show" before #dccouncil yesterday, but she knows the truth.
Tom Smith: "If there is not an
early voting center in each ward, then
there should be no early voting centers anywhere." #dccouncil
Tom Smith: Campaigns that don't have resources of major
mayoral
candidates are at disadvantage in early voting. #dccouncil
Tom Smith: Spreading out voting over 2 weeks stretches resources and
"damages checks and balances". #dccouncil
Tom Smith says training of poll workers and
precinct captains was
seriously inadequate. #dccouncil
Tom Smith: "Most folks wanted to vote on electronic machines [why?], but
no precinct had more than one." #dccouncil
Brizill: Alysoun McLaughlin was in charge of poll worker training but
has no background in it. #dccouncil
Tom Smith: Campaigns were forced to bring attorneys in to ensure that
people were able to challenge in
polling place. #dccouncil
Moten says he had people counting voters at Ballou polling place & there
were more votes cast there than people who went in. #dccouncil
Moten still whining about gift cards, somehow distinguishing between
giving them to voters & giving concert tickets, which is OK. #dccouncil
Susannah Goodman of
Common Cause testifying on DC test of online voting
for overseas voters, introducing Alex Halderman of UMich. #dccouncil
Halderman: This sort of test cannot show that system is secure, though
it can uncover problems, as in this case. #dccouncil
Halderman: Within 36hr of system going live, team had found "shell
injection vulnerability" that gained full control of server. #dccouncil
Halderman: "A real attack might be completely invisible & might have
gone on much, much longer" without being noticed. #dccouncil
Halderman: Security cameras in data center were publicly accessible, so
could watch BOEE staff as they configured system. #dccouncil
Halderman: While observing system, saw & blocked other attacks coming
from Iran & China (probably not specifically targeted). #dccouncil
Halderman: "An attacker who compromises a digital voting system could
disenfranchise all of the voters in one fell swoop." #dccouncil
Halderman: It will be "decades, if ever" before voting can be done
safely over the Internet. #dccouncil
Halderman: System accidentally kept copy of uploaded files around
unencrypted. #dccouncil
Halderman: One file apparently left over from testing seemed to be list
of all online voters & PINs to allow voting. #dccouncil
Halderman: That file should never have been on system at all, indicates
BOEE does not take security seriously. #dccouncil
Halderman: Sending blank ballots to voters over Internet & having them
email or fax back would be less risky. #dccouncil
Another witness points out that digital return of ballots does not meet
legislative requirement for voter-verifiable hard copy. #dccouncil
Goodman: MD &
VA, even w/large military population, do not allow online
voting. #dccouncil
Witnesses talking about online voting in Estonia, in which ballot is not
secret. #dccouncil
@FKlopott Have you asked Hlinko what % of
Facebook group live in DC? He
should have that from group demographics FB provides.
Cheh: Should #dccouncil by legislation shut down this online voting?
Panel: Yes, yes, yes.
Goodman: Thanks to #dccouncil for requiring voter-verified paper ballot.
Internet voting can't have that.
Witness says online (& mail) voting increase risk of coercion & vote
buying, prefers social voting at polls. #dccouncil
Is today's @kojoshow going to be devoted to
Marion Barry scolding Kojo?
Marion Barry: "I'm less popular in the white community, but that's not
*my* fault." @kojoshow
Tom Sherwood to Barry: "What do you know about Vince Gray that those
nervous white voters should hear?" @kojoshow
Barry: Washington Post has perpetuated myth that Vince Gray is monster
like Marion Barry. No reason to be fearful. @kojoshow
Barry: "Problem with
Adrian Fenty is that he never stopped running for
office." ??? Doesn't fit w/usual criticism. @kojoshow
Barry: "Tell Kojo to stop perpetuating these myths that I was an awful
mayor." Sherwood jumps in to point out Barry's failings. @kojoshow
@anc7c04 Let's hope it's pre-retirement tour & not prelude to running in
next year's special election.
Kojo: "The perception of Marion Barry is that he stokes racial fires."
Barry: "You ought to stop that, 'cause I don't." @kojoshow
Caller asks Barry to apologize for being a racist & using power to
accumulate personal wealth. @kojoshow
Sherwood: "If Marion Barry has personal wealth, neither I nor the IRS
has been able to find it." @kojoshow
DC Democratic State Committee has openings for 12 ex officio members to
be chosen Nov 4.
http://bit.ly/aB0GSw (PDF)
Barry: We fought for freedom of press, but press must be responsible,
shouldn't perpetuate myths. @kojoshow
Kojo to Barry: "Your apology will come privately.... I don't think I did
anything for which I need to apologize."
RT @dc4d: DC for Democracy member Malcolm Kenton reports on Vince Gray's
#ward5 town hall for @ggwash:
http://bit.ly/ciUxzl@tweetelissa I've noted before both have supporters who just become more
supportive when scandals arise. Media criticism strengthens them.
@AlanSuderman Yes, they pulled Moten into 1st panel when others hadn't
shown up.
David Meadows of @DCDemocrats testifying about lack of voter education
about referendum on elected AG on Nov ballot. #dccouncil
Cheh: Impetus for elected AG charter amdt was feeling that AG Nickles
(though not mentioning name) was responsive to mayor more than public.
@anc7c04 Sounded like he thinks @DCBOEE should, except they don't have
funding. There's nothing on BOEE site even mentioning it yet.
Lawrence Guyot calling for #dccouncil to pass resolution supporting DOJ
against ridiculous Black Panthers case.
Guyot says council has captured mayoralty, and it frightens him.
Guyot: "I have not seen personification of hatred of a candidate since I
left
Mississippi." New verb: to fenty.
Guyot very grateful the election didn't result in violence, now bringing
up Fenty write-in campaign.
Guyot wants to "stop foolishness of trying to bring city together" by
having black meetings & white meetings separately. ???
Cheh tells Guyot he's way out of time and way off message.
Now @DCBOEE panel is testifying, including @alysoun. #dccouncil
RT @VerifiedVoting: Video of Alex Halderman's DC Council Testimony
http://is.gd/fRDed@anc7c04 Agreed, but @DCBOEE site should have text of charter amdt &
ballot language. @DCDemocrats
Rokey Suleman: I don't know how media could've done better job covering
issue that voters couldn't switch to D on election day. #dccouncil
BOEE head Suleman uses Emily Litella comparison in discussing those
claiming non-D's were allowed to vote in D primary. #dccouncil
Suleman says some non-D's were allowed to submit special ballots because
of dispute, but the ballots were excluded during count. #dccouncil
Suleman: "Rambunctious" poll observers from campaigns were disruptive &
didn't understand rules. #dccouncil
Suleman: Had to chase ghosts. Rumor principal was preventing
polling
place at Cesar Chavez School from opening completely false. #dccouncil
Suleman: "If I were to part the Red Sea, they'd be complaining about
dead fish." Cheh: "I'll have to think that one through." #dccouncil
@IMGoph @dcist_martin Would there really have been less confusion with a
middle initial? Who knew MA Brown's initial?
Suleman: Confusion in handling of memory cards. Not handled according to
procol. Some left locked in
polling places overnight. #dccouncil
@DCDemocrats Do you have the ballot language for it?
Suleman: Early voting is great. Current format & timing is perfect. 2
weeks is adequate. #dccouncil
Cheh asking Suleman about possibility & cost of having an
early voting
center in each ward. He doesn't have figures. #dccouncil
Suleman says budget is lacking, esp w/HAVA funds going away. #dccouncil
Suleman: Eastern Market would've been great place for early voting, but
they wanted $4000/day. #dccouncil
Suleman: Public facilities charging BOEE for cleaning & maintenance of
sites used for voting is govt charging itself. #dccouncil
Suleman suggests eliminating precinct-level voting on election day;
instead just have same centers used for early voting. #dccouncil
Suleman: 57.5% of same-day reg forms were accepted as valid. 1 woman
who'd become citizen that day was able to register & vote. #dccouncil
Suleman: Looking at some people who might have voted in MD/VA as well as
DC: "low single digits". #dccouncil
Cheh suggesting that #dccouncil should not continue to spend $ on
Internet voting. Suleman agrees digital return needs to be shut down.
Suleman says we need to do pilot projects to progress toward Internet
voting. Cheh says maybe WE don't need to do them. #dccouncil
Cheh says we could use $ on other BOEE needs, not further Internet
voting work. Suleman disagrees. #dccouncil
Suleman, speaking as individual, says BOEE has no responsibility to deal
w/public confusing candidate w/anyone not on ballot. #dccouncil
Suleman: "Putting pictures on the ballot is not a realistic idea." "We
could put photos in the voter guide." #dccouncil
Suleman: On referendum, BOEE is notifying voters about it in voter
guide. BOEE has to be careful not to take position. #dccouncil
Suleman: Usually those who get issue on ballot are responsible for
publicizing. In this case, no one cares enough. #dccouncil
Suleman: Primary should be held no later than 1st week in Jun [much
longer lame duck], though could be possible 1st week in Aug. #dccouncil
Suleman: We were focused on so many things, but neglected how to upload
results to website. (How could that happen?) #dccouncil
Suleman says next year's special election has no federal office on
ballot, so federal law against vote buying won't apply. #dccouncil
BOEE counsel: Unclear who would be responsible for investigating
vote-buying allegations. #dccouncil
Suleman: For petitions, wants BOEE to verify sigs rather than leave it
up to citizen challenge; also set maximum # of sigs. #dccouncil
BOEE counsel agrees w/Cheh that expanding board would require amending
DC charter. #dccouncil
Chairman Togo West listing benefits & disadvantages of expanding BOEE
from 3 to 5 members. #dccouncil
Alysoun McLaughlin says Brizill made her testimony "a little bit
personal, as is her wont". #dccouncil
McLaughlin: Special ballot clerks &
precinct captains received
insufficient training, but that's being corrected for next time. #dccouncil
Suleman: Poll workers are unhappy that tokens of appreciation for them
were cut out of budget. #dccouncil
"More Perfect Union" guy is rambling about song he has to promote
voting, & wants compensation for lost CD of song? #dccouncil
Yeah, that's what we need: trucks w/bullhorns playing his song to
encourage voting. #dccouncil
@amorrissey The stuff about the lost CD was just bizarre. He wants
compensation, & accuses them of "corruption" for losing it?
Guy says he's being denied access to the American Dream because they're
not using his song. #dccouncil
How can @DaveforWard3 suggest that @marycheh is disagreeable when she
shows inhuman patience w/this guy w/the song?
Seconded. RT @amorrissey: Mary Cheh seriously deserves a beer after this
hearing, yo. #dccouncil
@dcist_martin How do they manage to always put the loons on last?
@FKlopott Thanks. Not sure what possessed me to listen to the whole
thing (except for a Kojo break).