Argentina Rewards Programmer Who Exposed E-Voting Vulnerabilities With A Complimentary Home Police Raid

from the shoot-all-the-messengers dept

Tue, Jul 7th 2015 10:35am — Karl Bode

An Argentinian programmer who was trying to do a good thing in exposing severe vulnerabilities in the country's e-voting system was rewarded for his actions -- with a police raid on his home. According to Argentinian news outlet La Nación, Joaquín Sorianello informed MSA, the company than makes the Vot.ar e-voting system, that the SSL certificates used by the system to encrypt transmissions between the voting stations and the central election office could be easily downloaded, allowing for potential voting fraud (or just a good old-fashioned DDOS attack).

Sorianello, who says he never received a phone call from MSA after reaching out to the company to report the flaw, suddenly found his home being raided by Argentinian police, who seized computers, Kindles, and numerous storage devices (from a Google translation of the source):

"The truth is amazing, you notify the company that they have a failure in their voting system and the next thing they do is (raid my home) instead of looking for the real culprits..."I'm just a programmer, I'm not a hacker." Sorianello told La Nacion that he contacted the police station in Caballito to corroborate the raid: "They said yes, but they could not tell me why or how it was going to take." He also said he did not receive any call from the company (after having told them about the flaw a week) ago."

Sorianello has pointed out to numerous news outlets that he's a programmer -- not a hacker, and if he had wanted to hack into the systems to cause damage, he certainly wouldn't have informed the company of the flaw first. He's also repeatedly pointed out that it was the protected @FraudeVotar Twitter account that published the core details of the e-voting internals, not him. That apparently didn't matter to the Argentinian legal system.

This isn't the first problem facing MSA and its e-voting technology, which is being used in Buenos Aires elections for the first time. Two weeks ago, the source code for the company's Vot.ar technology was leaked to Git.hub. A number of researchers also discovered that a smartphone with NFC capabilities (pretty common at this point) could be used to create a specialized e-ballot, capable of tricking the system into counting a single vote numerous times. And this is all before you realize that in many instances, the technology Argentina is using just doesn't appear to work very well:

"Earlier today, the Argentinian site La Política Online reported that 532 polling stations were unable to transmit their results electronically to the central electoral office, and had to be transported there physically for the 184,000 votes involved to be included in the final result. As the article points out, although this failure won't change the outcome of the election for the head of local government in Buenos Aires, it will make a difference to the allocation of seats in the legislature and community boards."

So not only is MSA's e-voting system completely open to several vectors of fraud and attack, it works so damn well you need to physically move the machines back to the central office to count the tallied votes. Meanwhile, Argentinian locals are claiming that the same Judge that thought it was a good idea to authorize the police raid on Sorianello's home, has also ordered Argentinian ISPs to block many of the websites where details on the e-voting flaws and source code can be found (like justpaste.it). Surely if you stop people from discussing the obvious flaws, the problem magically goes away, right?

As we've seen with countless other e-voting scandals of this type, you can't operate a secure, successful e-voting system without trust. And you certainly don't gain the public's trust by shooting as many messengers as possible and playing a futile game of Whac-a-mole censorship with those who point out your system is utterly and painfully flawed. What you do successfully accomplish is make it perfectly clear that you appear to like the fact your electoral process can now be rigged.

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: argentina, arrest, blame the messenger, e-voting, joaquin sorianello, security, vot.ar, vulnerabilities
Companies: msa

22 Comments

If you liked this post, you may also be interested in...

Reader Comments

Subscribe: RSS

View by: Time | Thread

Baron von Robber, 7 Jul 2015 @ 10:42am

As usual, moral of the story is, when come upon an exploit, it's better to sell it in secret to make money than to let the company know they have holes in their system.

Amirite?
[ link to this | view in thread ]
Anonymous Coward, 7 Jul 2015 @ 11:08am

It's not clear from the article if he has been charged with any crime.
[ link to this | view in thread ]
Anonymous Coward, 7 Jul 2015 @ 11:13am

Re:
In this case, it would have been better for him to use his knowledge to get someone voted in and then get that person to pardon him.
[ link to this | view in thread ]
Anonymous Coward, 7 Jul 2015 @ 11:18am

Re:
They do not have to charge one with a crime, they are allowed to break and enter private property, trash the place for no reason and they face absolutely no repercussions for their transgressions. American exceptionalism on display every day.
[ link to this | view in thread ]
Anonymous Coward, 7 Jul 2015 @ 11:20am

Re: Re:
... and I guess they are stealing that exceptionalism from the American GOP
[ link to this | view in thread ]
The voice of reason, 7 Jul 2015 @ 11:24am

serves him right.
You don't upset the status quo. Those in power don't like it when you upset the status quo.

Now we can't rig the election like we were planning.
[ link to this | view in thread ]
Anonymous Coward, 7 Jul 2015 @ 11:29am

obviously borrowed the USA police script then!
[ link to this | view in thread ]
Personanongrata, 7 Jul 2015 @ 11:40am

Argentina The US What Is The Difference? A Statist Thug Is A Statist Thug
It is nice to see the authority abusing statist thugs in Argentina are on par with the authority abusing statist thugs found in the US.
[ link to this | view in thread ]
JustShutUpAndObey, 7 Jul 2015 @ 12:28pm

We just pretend our systems are secure.
Despite all the documentation to the contrary, in the USA, we just ignore the fact that our voting systems are trivially vulnerable and have already been tampered with.

No need to swat somebody if we can pretend the systems are secure.
[ link to this | view in thread ]
Anonymous Coward, 7 Jul 2015 @ 12:46pm

Re: Re: Re:
You are stupid if you think this is a GOP ONLY issue.

Both of the very corrupt parties rise to power creating laws that service the political elite.

No matter how much you see or hear Hillary/Bill, Bush, Boehnor/Mitch or Obama talk trash about each other they all have a dark agreement between each other that they will enjoy the power that each party brings into power as the retarded voters like yourself just keep voting.

If they really hated each side all that much a bit more repeals would happen but they don't. At most repeal is only talked about to stoke their bases while in the end nothing actually ever happens except more expansion of the law.

Blacks are still getting gunned down all the same whether a Black man is in charge or not, whether that DemocRat or RePuke is in power or not.
[ link to this | view in thread ]
Anonymous Coward, 7 Jul 2015 @ 1:17pm

Re: Re:
In this case, it would have been better for him to use his knowledge to get someone voted in and then get that person to hire him.

FTFY
[ link to this | view in thread ]
Anonymous Coward, 7 Jul 2015 @ 1:18pm

Priorities
"Meanwhile, Argentinian locals are claiming that the same Judge that thought it was a good idea to authorize the police raid on Sorianello's home, has also ordered Argentinian ISPs to block many of the websites where details on the e-voting flaws and source code can be found..."

What do you want to bet that one thing the judge hasn't done is to order the flaws fixed.
[ link to this | view in thread ]
Anonymous Coward, 7 Jul 2015 @ 1:26pm

Re: Re: Re: Re:
Not really sure what your race references is all about.

Are you talking about black on black, white on black, black on white, black police on black, or white police on black killing?

At any rate, I fail to see how a black president would change anything about murder rates or why anyone would have an expectation that it would.
[ link to this | view in thread ]
Anonymous Coward, 7 Jul 2015 @ 1:30pm

Re: serves him right.
Those with the gold make the rules.

I think his failure was not having enough gold.
[ link to this | view in thread ]
Anonymous Coward, 7 Jul 2015 @ 1:36pm

Re: Re: Re: Re:
Who more often claims America is exceptional?
Who raises their voices more often demanding minimum sentencing? Who initiated the war on drugs?

Yup, everyone but those with whom you agree are morons and should not be allowed to vote - American Exceptionalism right there.

Tell me again how both parties are the same. It must be true because cops are still gunning down minorities even though the president is part minority.
[ link to this | view in thread ]
MikeC (profile), 7 Jul 2015 @ 1:44pm

Let's see - ban it and no will use it to break a law
Or to paraphrase - "when exposing flaws is outlawed only outlaws will have access to the flaws" ...

Because we all know that if it's illegal then no one will be able to do it right? Sounds like anti-gun, anti-drug,anti-bullying, etc.. arguments to me - make the "insert bad item of your choice" illegal/hidden and no one will be able to do bad things with it. IE: Don't let anyone expose the flaws in the system, then no one will be able to exploit them for bad things.
[ link to this | view in thread ]
Anonymous Coward, 7 Jul 2015 @ 3:23pm

Wow, its almost if they intentionally want them to be faulty... Why would a profit-oriented notoriously corrupt company do something like this?
Seems like the grabblers are at it again.
[ link to this | view in thread ]
doodaa, 7 Jul 2015 @ 9:38pm

Re: Argentina The US What Is The Difference? A Statist Thug Is A Statist Thug
Could not have said it better, myself.
[ link to this | view in thread ]
wut, 7 Jul 2015 @ 11:27pm

Hey, a local's insight.

We live amid systemic corruption, and sort of as a whole manage to thrive in it. This means that in order to get a govt contract you need to make powerful friends, and those powerful friends can make you virtually invulnerable to the hurdles the system would otherwise present to john and jane doe with their small business.

MSA is in this regard not even specially evil; they as a company happen to be very good friends with all the right people, and thus can pull shit like this while some shmoe's corruption scandal or someone else's domestic abuse situation or whatever can spend months unattended.

For us, progress happens when excellently connected people happen to have needs that accidentally map with random people's needs. It might be a common thing everywhere, but for some reason or another it just feels much more explicit here than in other places, hence the need to come here and comment.
[ link to this | view in thread ]
Anonymous Coward, 8 Jul 2015 @ 1:09am

They are just testing the e-voting farce in Argentina,
but this will be implemented in your country pretty soon.
[ link to this | view in thread ]
Anonymous Coward, 8 Jul 2015 @ 4:53am

Re:
It seemingly already has
[ link to this | view in thread ]
Bergman (profile), 8 Jul 2015 @ 2:47pm

Re: serves him right.
That's exactly what I was thinking as I read the article.

If it was the government rigging the election, it would certainly explain the wild overreaction to him pointing out that the election security was compromised.
[ link to this | view in thread ]