ES&S Sues Former Workers Over Taking Buggy, Vulnerability-Filled Code

from the why-would-they-bother? dept

Michael Scott alerts us to the news that e-voting firm ES&S has sued two former employees, claiming copyright infringement over code they took with them from ES&S, along with additional trade secrets. I have no idea whether or not this is true, but all I can ask is "why?" As has been documented time and time again, ES&S's e-voting code has a ton of problems. Remember, these are the machines that have been found to have serious security vulnerabilities, with some serious bugs, such as adding votes to the wrong election, calibration problems that lead to people voting for the wrong candidate, and bugs that resulted in phantom votes. And ES&S is the company that knew about some of these bugs, and let them be used in elections anyway. So if you were going to go off and start your own e-voting company (and it's not clear these individuals did that), wouldn't you be better off starting from scratch?

Filed Under: copyright, e-voting, software, trade secrets
Companies: es&s

Diebold Finally Dumps E-Voting Division... But Sells It To Equally Problematic ES&S

from the that-makes-it-better? dept

Ah, Diebold. One of the "big three" e-voting providers out there, its name was the first one that got associated with the problems of e-voting machines, despite problems being found across the board in players in that space. I could never understand why the company continued to fight and deny problems with its machines after so much evidence was presented against them. The smart move would have been to admit that the machines had problems, work with security experts to solve them, and come out with better, safer machines. But that's not what happened. Instead, it stonewalled, denied problems, mocked those who exposed security flaws and kept pushing out questionable machines. Eventually, the stories got so bad, that Diebold realized it was having a seriously negative impact on its other lines of business (including ATMs), so it renamed the e-voting division "Premier Election Solutions" (as if people would forget) and went about trying to sell the thing off -- though, for years it couldn't find any takers.

It took a while, but Diebold has finally found a buyer. ES&S has purchased Diebold's e-voting business for a mere $5 million plus some outstanding revenue. In classic Diebold fashion, the company has announced that it "would not be answering questions about the sale" -- because that's how you go about rebuilding trust.

Meanwhile, it's not like ES&S is any better. It, too, has had massive problems with its e-voting machines, while the company has a history of stonewalling attempts by gov't officials to review their code. Oh, and there's this: company memos showed that the company knew about some of the problems with its voting machines that were used in elections. And the most fun of all? When we questioned why e-voting companies didn't allow independent security researchers to examine machines, an ES&S employee showed up in our comments to call us all idiots.

Now, with the combined ES&S/Diebold/Premier, a ridiculous large percentage of the country's e-voting machines now belong to one company, with an amazingly long family tree of faulty machines and a history of attacking anyone who points out those flaws.

Filed Under: e-voting, merger
Companies: diebold, es&s, premier

Yet Another E-Voting Glitch; This One Adds 5,000 Phantom Votes

from the oops dept

Another election using e-voting machines... and another set of stories concerning massive problems. Slashdot points us to the news that a local election in Rapid City, South Dakota, was about to go to a runoff after no one hit the 50% mark, when someone finally noticed that the 10,488 vote total seemed a bit high. So, they went back and recounted the actual ballots, and discovered only 5,613 people voted, but the software added up the votes incorrectly. Once again, we're left wondering why it's so difficult to do simple arithmetic -- and why e-voting companies like ES&S are so against allowing experts to look at their source code and maybe help catch some of these bugs before they totally screw up an election.

ES&S, of course, has been especially bad when it comes to transparency, despite numerous stories of glitches. It's also the company that had an employee stop by here on Techdirt, call us all "idiots" while insisting that the machines were perfectly fine and that the machines are "extremely scrutinized and very reliable" and anyone questioning their reliability was simply relying on "conspiracy blogs." Of course, his focus was on the idea that the machines were "hacked" -- a charge we never made. Our concern -- and the concern of many others -- are that the machines are unreliable, prone to errors and have serious security and process flaws. Considering how many stories we've seen of problems with those machines in real elections, that seems to be proven fact -- not "conspiracy."

And yet, ES&S has always resisted any real scrutiny. When California looked to investigate e-voting machines more fully, ES&S was the one vendor who held out for months beyond the deadline, before finally submitting its source code along with a threatening letter about how it would personally sue the Secretary of State if any of its trade secrets got out. Of course, soon after this, we found out that even its certified code didn't much matter, since it had given California machines with uncertified code for an election. In the end, not surprisingly, ES&S machines were found to have significant problems, and were decertified in California. Perhaps South Dakota should have taken note.

Filed Under: e-voting, extra votes, south dakota, transparency
Companies: es&s

Ireland Latest To Scrap E-Voting Machines

from the good-for-them dept

Reader oxymoron alerts us to the news that Ireland has dumped e-voting machines, concerned both about the costs and the reliability and accuracy of the machines. It still amazes me that anyone is using these machines anywhere given the massive reliability and accuracy problems they've seen throughout the world. So it's great to see countries finally realizing that perhaps democracy is aided by actually having voting systems that people can trust, rather black boxes that make it that much easier for people to distrust.

Filed Under: e-voting, ireland

E-Voting Firms Recognize That Open Source Software Exists... But Seem Confused About What It Means

from the not-too-surprising dept

We've never quite understood why e-voting software shouldn't be required to be public information. For the sake of actually allowing an open and transparent voting system, it's hard to understand how any governing body would allow proprietary software to be used. There's simply no way you can prove that the system is fair and transparent if the counting mechanism is totally hidden away. For years, the big e-voting firms have simply shrugged this off, but it looks like they're at least open to discussing it. A trade group representing the big e-voting firms has put out a whitepaper discussing open source voting systems, where all they really do is show that they don't actually understand much about open source technologies.

First, they claim that, even though they understand that "security through obscurity" isn't effective, "there remains some underlying truths to the idea that software does maintain a level of security through the lack of available public knowledge of the inner workings of a software program." Computer Science professor Dan Wallach does a nice job responding to that claim:

Really? No. Disclosing the source code only results in a complete forfeiture of the software's security if there was never any security there in the first place. If the product is well-engineered, then disclosing the software will cause no additional security problems. If the product is poorly-engineered, then the lack of disclosure only serves the purpose of delaying the inevitable.

What we learned from the California Top-to-Bottom Review and the Ohio EVEREST study was that, indeed, these systems are unquestionably and unconscionably insecure. The authors of those reports (including yours truly) read the source code, which certainly made it easier to identify just how bad these systems were, but it's fallacious to assume that a prospective attacker, lacking the source code and even lacking our reports, is somehow any less able to identify and exploit the flaws. The wide diversity of security flaws exploited on a regular basis in Microsoft Windows completely undercuts the ETC paper's argument. The bad guys who build these attacks have no access to Windows's source code, but they don't need it. With common debugging tools (as well as customized attacking tools), they can tease apart the operation of the compiled, executable binary applications and engineer all sorts of malware.

Voting systems, in this regard, are just like Microsoft Windows. We have to assume, since voting machines are widely dispersed around the country, that attackers will have the opportunity to tear them apart and extract the machine code. Therefore, it's fair to argue that source disclosure, or the lack thereof, has no meaningful impact on the operational security of our electronic voting machines. They're broken. They need to be repaired.

The next oddity, is the claim that if a problem is found in open source software, then it won't get fixed as quickly, because you have to wait for "the community" to fix it. That completely mistakes how open source software works. Again, Wallach points out how silly that is, noting that plenty of commercially-focused companies run open source projects, including maintaining and contributing code to the project. If these companies were to open source their code, there's nothing stopping them from continuing to improve the security of the code. There's no need to wait around... The paper has other problems as well, which Wallach discusses at the link above. To be honest, though, it's quite telling that these firms don't even seem to understand some of the basics of how open source software works.

Filed Under: e-voting, open source

On Second Thought, Finnish Gov't Rejects Defective E-Voting Results

from the some-good-news dept

Back in February, we found it disturbing that Finland was allowing the results of an election to stand, despite the fact that at least 2% of the votes had gone missing due to e-voting glitches. However, it looks like some sense of sanity has been restored as a higher court has now rejected the election results and ordered a new election. One hopes that the new election won't involve similarly screwed up e-voting machines. Speaking of which... in a separate article, we find yet another story of e-voting machines that were "mis-calibrated" in such a way that made it difficult to impossible for people to vote for candidates of their choice. At some point, given all of these problems with e-voting machines, you have to ask why elections officials still rely on them.

Filed Under: e-voting, finland

Kentucky Election Officials Arrested For Changing Votes On E-Voting Machines

from the security... dept

While there have been plenty of conspiracy theories over the years concerning e-voting machines, none have been particularly compelling. The evidence looked like plenty of incompetence, with buggy machines that had huge security flaws that could be exploited -- but we hadn't heard of any cases of anyone actually being caught tampering with or trying to tamper with votes. That isn't to say it didn't happen. It's possible that it happened and the perpetrators weren't caught -- but it's a big leap from it "could" happen, to it "did" happen. So, most of our coverage here has been very much on the bugs and the flaws, rather than any of the conspiracy theories that floated around.

However, it appears that a group of Kentucky election officials, the circuit court judge and the county clerk, were arrested for changing votes in various elections between 2002 and 2006 on e-voting machines. The details suggest that there were two parts to the vote changing. First, there was traditional vote buying -- where they paid people to vote in a certain way. However, the second involved actually changing voters' votes on ES&S e-voting machines.

It didn't involve any hacking or direct security flaws -- but the elections officials made use of the confusing user interface and process of the e-voting machines to trick voters into leaving before their votes had been cast. That's because there's a "vote" button, that some people (silly them!) assumed meant they actually voted. Nope. It turns out that just gets you to a page to review your vote and then confirm it. However, these elections officials told people that once they hit vote they had voted -- and were then able to go in and change the actual votes.

Filed Under: arrest, changing votes, corruption, e-voting, kentucky, vote buying, voting

German Court Says E-Voting Was Unconstitutional

from the well-how-about-that dept

It still stuns us that, despite so many problems found with e-voting technologies, that elections officials in the US seem to have no problem continuing to roll them out every election time, it looks like Germany is taking a slightly different perspective. A number of readers have sent in the news that Germany's highest court hasn't just rejected Germany's use of e-voting technologies, but declared their usage in a 2005 election as unconstitutional, due to the unreliable nature of the machines and (more importantly) the fact that the black box nature of the machines made the elections not as transparent as required. That said... it also allowed the results from the election to stand, saying there was no actual evidence of mistakes. Still, perhaps other courts will start to recognize this as well: when you make the details of the election and how the results are counted totally secret, you cannot have a citizenry that believes that the election results were fair or accurate.

Filed Under: e-voting, germany

No Surprise Here: Lost Votes In Last Election Due To Faulty Diebold Equipment

from the anyone-surprised? dept

Back in December, we pointed to yet another (in a long line) of stories about lost votes on an e-voting machine in an election in California. The machines in question were from Premier Election Solutions, the shiny coat of paint put on the e-voting unit of Diebold, whose name had been tarnished for a long history of defective, highly vulnerable e-voting machines (along with a long history of denying any problems whatsoever with those machines). You would think after all these years of criticism, and a shiny new name, the company would be a bit more careful to make sure its machines weren't actually defective. No such luck.

As Slashdot points out, the Secretary of State's report on the matter clearly places the blame on Diebold's faulty equipment (warning: pdf file). Still, the scariest part is what we noted in the original story about the problems: despite all of the claims to the contrary, the 200 or so lost votes wouldn't have been noticed at all under Diebold/Premier's normal auditing process. It was only because of an experimental "transparency" project set up by local officials that the mistake was noted. Thus, Diebold machines in other regions may have lost votes, and no one will know about it. So can anyone explain why anyone still uses e-voting machines from this company? For years they've lied, stonewalled, denied problems, attacked critics... and produced faulty equipment over and over again. And it's still being used.

Filed Under: california, e-voting
Companies: diebold, premier voting

Finland Certifies Election, Despite 2% Of Votes Lost Due To Computer Issues

from the what's-1%-here-or-there? dept

In the latest sad saga concerning e-voting mishaps, it appears that Finland's courts have agreed to certify a recent election, despite approximately 2% of the votes not being counted (found via Slashdot). Also, there were additional problems as it's been discovered that despite the requirement for an "anonymous election" the voting software stored identifying information, along with how each voter voted. Oops. Once again, we're left wondering why various governments keep trusting such questionable equipment?

Filed Under: e-voting, elections, finland