Hacker News new | past | comments | ask | show | jobs | submit login
Senators ask why vendors sell voting machines with ‘known’ vulnerabilities’ (techcrunch.com)
111 points by Ours90 on March 27, 2019 | hide | past | favorite | 70 comments



Criticisms of the underlying hardware/software aside, my intuitive answer to the headline question is "because governments are buying them."

Perhaps the esteemed Senators should undertake a short naval-gazing exercise and ask "how could there only be three major players in such a lucrative segment, each selling ancient hardware and crappy software products?"

I'm going to go out on a limb and guess at the answer to that question, and it likely shows those three companies as being the only ones with the patience and tenacity to get those models approved.

So Mr./Ms. Senator(s), I suggest you rephrase your question as follows: "how can we simplify the procurement process to make sure we, the government, are receiving the greatest value for our expenditures?"


They don't actually have any influence in the purchase decisions, as it's a state matter. Machines are bought by local governments, with varying state regulations on what can be purchased depending on the state in question. Most machines were paid for by local jurisdictions with a mix of federal funding (HAVA), and in some cases, state funds for part of the cost. Some states have uniform systems; others do not.[0] On election day, there isn't just "one" election but thousands taking place.

There's no single procedure for procuring voting machines, well, anywhere.

To make matters worse, each jurisdiction and the states are fiercely protective of their power in this matter. A federally uniform system, or even just something beyond the very basic requirements set by the Help America Vote Act in 2002, is right now very unlikely and would be a massive political and legal mess. Or, more accurately, a series of messes.

0. http://www.ncsl.org/research/elections-and-campaigns/the-can...


> There's no single procedure for procuring voting machines, well, anywhere.

And that's probably a good thing. Heterogeneity in this sort of thing is desirable, as it makes large-scale fraud harder to pull off.


Not if all these heterogenous procurement processes end up buying from the same 3 vendors.


Scott Adams (Dilbert) coined a term that applies to the voting machine vendor certification procurement racket: confusopoly.


And nobody apparently wants to spend any more money on elections, even though it's actually going to take money to fix the problems.


In addition, there's no uniform certification process. EAC.gov made things a wee bit better, but it's an advisory role.


"because governments are buying them."

The main problem in american politics is that a lot of decisions are made either to damage the "other" party or to accommodate some donor. When you look at Congress they barely think about doing something right.


Off topic question- but this is always something that interested me: do you have any blatant examples of a high level politician solely choosing a product to accommodate a donor?


Maybe one example: NASA is developing the SLS mainly to keep jobs in some districts. so billions are spent on something that's really not the right thing from a technical point of view.

Same for voting machines: They are often either bought to keep jobs somewhere or because there is some connection between the vendor and decisions maker.


Another example is the Space Shuttle's solid rocket boosters - the reason they're there, essentially, is to keep Thiokol happy.


From my perspective, it usually derives from some kind of 'think of the jobs' mentality.

https://pilotonline.com/opinion/editorial/article_947f55ff-3...


https://en.m.wikipedia.org/wiki/Glomar_Explorer has often been considered one of those items, given that there was seemingly very little to gain by bringing up a ship twenty years after it sank.

But there are also some conspiracies about why the sub had fifteen extra people onboard and that Kissinger was looking for more information on that.


There is a lot of more or less blatant bribery going on in state and local governments. My girlfriend does investigations in that area and she has a ton of examples (which I can't publish). As far as I know pretty much every state and country manages their own election system so they are very vulnerable to local politicians who often don't even understand what they are dealing with.


There's a term for that: "Pork barrel spending".

> Pork barrel is a metaphor for the appropriation of government spending for localized projects secured solely or primarily to bring money to a representative's district.

It's isn't hard to imagine who benefits from that.


> "how could there only be three major players in such a lucrative segment, each selling ancient hardware and crappy software products?"

Because all markets tend towards cartels and consolidation unless vigilant, enforced regulation prevents it?

Why do Coca-Cola and Pepsico have >60% of the soft drink market? Why do the largest two or three meat processing companies have the majority market share in almost every category? Why does Nestle have more annual revenue than the GDP of Sri Lanka?


> Why do Coca-Cola and Pepsico have >60% of the soft drink market?

Well, this one is probably simple: government. I'm unsure whether it would be copyright, or trademark infringement, but if you release a product that tastes exactly like coke or pepsi, you'll probably find yourself in expensive litigation.


Why does it have to taste exactly like the other?

The two biggies just overpower the others:

http://mentalfloss.com/article/76881/tragic-history-rc-cola


The formula for Coke is supposedly a trade-secret, for which there are no protections other than keeping it secret, and I guess maybe not acquiring it illegally.

So, on what basis would Coca-Cola or PepsiCo have for a suit?


I'm pretty sure flavours and even recipes can't be copyrighted. Perhaps patented, but as others said that makes them public and protected for only a relatively limited time. Hence why formulations like KFC and Coca Cola are kept as a trade secret instead.

Branding and awareness is their real power, and a small time competitor has no real leverage there. And perception plays a huge role in flavour, so even if your product tastes the same, it won't.


There are no legal protections for recipes.


> So Mr./Ms. Senator(s), I suggest you rephrase your question as follows: "how can we simplify the procurement process to make sure we, the government, are receiving the greatest value for our expenditures?"

Hey guys, let's drop this important task we are working on and go look for the holy grail!


Regardless of one's political leanings, it's frightening that only one of the two major American political parties is even feigning interest at fixing what is clearly a vulnerable system.

This shouldn't be a partisan issue, but it somehow continues to be.


In the US voting machine decisions are also a very local decision. So even if it was a party decision... it really would have to be very local party decisions.

Often times national party decisions in the US do not translate into local action even by folks in the same part as obviously things change on the ground.


The federal government could set certain minimum standards for voting machines used in federal elections. That would effectively set the standard for all elections since I can't imagine any local governments could justify a set of machines for federal elections and a different set for local.


Better yet, why doesn't DARPA design them and then the federal gov't outlaw any other voting machine, for any election.


They recently started a contest to design an election machine.


I wouldn't mind that.


This isn't true.

The Secure Elections Act was introduced by a Republican: https://www.congress.gov/bill/115th-congress/senate-bill/226....


It also went nowhere, stalled in a republican controlled senate by a republican controlled committee.


This is absolutely true.

As someone else pointed out, it didn't even make it out of the committee controlled by the ruling party, and certainly wouldn't have made it out of the Republican-controlled Senate.

This legislation would pass in a Democratic Congress and White House, but absolutely will not in a GOP-led government. Full stop.


Its not true that "that only one of the two major American political parties is even feigning interest at fixing what is clearly a vulnerable system".

Apparently some Republicans support this bill. I bet there are some Democrats that don't support the bill.

Partisan reductionism presents an overly simplistic view of a complex phenomena.

And bills don't represent ideology anyway. They often have unintended consequences. Politicians might be interested in fixing a "vulnerable system" while rejecting a particular bill for some other reason. For example: Voter ID.


It's not that complicated: one party is committed to fixing this problem and has influential leaders backing such an initiative. Another party isn't even seriously trying. One GOP senator is interested in solving this problem? Good for that guy, but shame on the other 52 GOP senators that aren't.

> And bills don't represent ideology anyway.

Yes they do, that's why we vote for one party or another. Think taxes are too high? Want to expand social programs? Legislation is how all of that is executed. Bills absolutely represent party ideology. Take the green new deal, for example. How was that bill not an example of party ideology?

> Politicians might be interested in fixing a "vulnerable system" while rejecting a particular bill for some other reason. For example: Voter ID.

Voter ID laws were designed explicitly to suppress minority votes and have been struck down time and again by the courts. They were not designed to solve a legitimate issue, because there is no evidence that rampant voter fraud exists in the US[0].

What does exist, however, are coordinated ballot-harvesting efforts designed to unduly influence the outcome of elections, as was witnessed in NC-9 in this past election. But again, the GOP doesn't seem to be very concerned about this specific issue.

[0]: https://www.brennancenter.org/analysis/debunking-voter-fraud...


> Voter ID laws were designed explicitly to suppress minority votes and have been struck down time and again by the courts. They were not designed to solve a legitimate issue, because there is no evidence that rampant voter fraud exists in the US[0].

That is not what motivates many people who care deeply about this issue. Its partisan spin used to malign a contrary view. Believe it or not many Republicans are not racists hell-bent on denying minorities the right to vote. I know it seems impossible, but some Republicans even are minorities.

> What does exist, however, are coordinated ballot-harvesting efforts designed to unduly influence the outcome of elections, as was witnessed in NC-9 in this past election. But again, the GOP doesn't seem to be very concerned about this specific issue.

A lot of Republicans in California complained about ballot harvesting.

FWIW I agree that voter fraud not a major problem. And neither is vote hacking.

Both sides play footsie with these issues and its dangerous as it undermines the credibility of the system as a whole. If you believe elections are stolen or democracy is dead, then the American government is illegitimate. How long till we're advocating ignoring its laws, or overthrowing the regime.

Another civil war is the last thing we need in this country.

A slightly corrupt system that we collectively pretend is pristine is far better than the alternative.


It takes a lot of mental gymnastics to see republicans as interested in fixing election problems after everything they have and haven't done since 2016.

They would have done that long ago if they wanted to, but instead they made themselves the primary beneficiaries of a broken election system, rampant gerrymandering, voter suppression and election fraud.

It doesn't matter which individual R's turn it is to temporarily go against the grain for some publicity, the republican committee and caucus will always vote with their party if they have majority to pass what the party wants. Partisan reductionism is the only proper attitude to this party.


As a counterpoint: the FEC over the past decade.

The Republican voting bloc has stymied enforcement actions for much of that time.


If the ability to alter an election in your favor can be done invisibly, and you value being reelected over transparency, then buying these products make perfect sense. It's not an American thing, rigging elections is probably as old as having them.


That's because one of the two political parties has only minority support and thus depends on a long list of dirty tricks to remain in power.


That's a gross misunderstanding of the electorate. The Republicans didn't have the national majority vote this presidential election, but in Congress that's irrelevant. Have you been to Utah, or any of the other heartland states? They have overwhelming majority support.

One of the worst problems in the country right now is that things have become so geographically polarized. Many people live so deep in their (red|blue) bubble that they don't even know anyone who votes for the other side.


> Have you been to Utah, or any of the other heartland states?

Yes. I grew up in Kentucky and Tennessee, and went to college in Virginia. The first time I moved to a town of more than 30,000 (Los Angeles) I was 24. So I am very familiar with the culture of "middle America".

Yes, Republicans have overwhelming majority support in many districts, but they would not hold a majority in the House without gerrymandering [1] and they would not hold a majority in the Senate without the inherent bias towards small states built into the two-senators-per-state system. (I guess it's not fair to call that a "dirty trick", but I do think it's fair to apply that label to a lot of the things that Mitch McConnell has done as Senate majority leader.) Also, without that bias, no Republican would have been elected president such George H.W. Bush.

[1] https://www.washingtonpost.com/outlook/2018/11/08/how-gerrym...


Yes and no. I live next door to a couple (who have become our friends) that are ideologically opposed to us. Despite our houses being physically next to each other, we might as well inhabit a different world when it comes to politics. It would not be accurate to say they disagree with us on the issues, because to get to disagreement we would at least need to agree on the underlying facts. Without that structure, any discussion stalls immediately. It's like living in a different country.


Show them lots of love. :)


The apparent increased partisanship is the result of FPTP & gerrymandering coupled with engagement driven corporate media.

I've served as the captain in the largest precinct in the most "liberal" legislative district (LD) in one of the most "liberal" states. I've been doorbelling my precinct for 10 years. My LD's GOTV efforts is specifically credited for winning multiple statewide offices and initiatives.

The people (voters) aren't any where nearly as partisan as the election results. But if you went by media accounts, we're all treehugging socialists. The truth on the ground is there's a HUGE variety of opinions, positions.


I think it'd be disingenuous to call either party's support a "minority" when they collectively represent 55% of voters as of 2014. https://www.people-press.org/interactives/party-id-trend/


One of the many dirty tricks that the Republicans use to remain in power is to pass laws that selectively disenfranchise minorities and other likely Democratic voters. So I don't think this is disingenuous at all. The fact that fewer people vote is in no small measure because of Republican dirty tricks [1].

[1] https://www.nytimes.com/2018/11/03/us/politics/voting-suppre...


Ah, my mistake: I interpreted your comment as referring to a statistical minority, rather than a racial/ethnic one.


I deliberately chose that phraseology to be ambiguous. But what is not ambiguous is that the Republicans engage in dirty tricks (gerrymandering [1], stripping the governor of powers after an election where a Democrat is elected [2], passing laws to disenfranchise demographic minorities [3], running candidates with blatant conflicts of interest [4], and just flat-out breaking the law [5]) far more often than Democrats do.

[1] https://www.washingtonpost.com/opinions/the-power-that-gerry...

[2] https://www.politico.com/story/2018/12/14/scott-walker-lame-...

[3] https://www.npr.org/2018/10/23/659784277/republican-voter-su...

[4] https://www.cnn.com/2018/10/16/opinions/brian-kemp-georgia-v...

[5] http://time.com/5535292/north-carolina-election-fraud/


I think it is a valid observation that statistically, the Republican Party represents fewer citizens per politician than the Democratic Party. This is partly due to geography and the deliberate choices of Senate representation, and partly due to the skillful manipulation of state politics by the Republican Party. The Democrats collectively forgot for a while that politics starts at the local level, unsexy as it seems compared to, say, POTUS, and the Republicans cleaned their clock.

Of course, currently the Democratic Party relies heavily on actual racial/gender minorities, but if they are smart they understand how fleeting that association can be, there is no guarantee it will remain durable over time. Especially as the number of older white male voters dwindles through natural attrition, it is pretty likely that the demographics of the parties are going to evolve.


Eventually white people are going to figure out they want healthcare and black people are going to figure out they want guns and all hell will break loose.


There are currently four groups of voters: left, right, won't, and can't.


They ALL have a known vulnerability. Works like this:

Pretend the machine is a person in a secure room only they are in, and only they know the contents of.

You approach a window, tell them your vote. They say it back and optionally hand you a piece of paper.

Then, in that room, they do whatever they want, and the final tally, winner of the election is determined by whatever they did in the room.

Voters have no chain of trust between their expression of intent, and the record used for the final tally. When voters make physical expressions, and those expressions are counted, voters know the election, on a basic level, can be trusted to reflect the collective intent of the people.

When they use electronics, they have no idea. They push a button, or mash a screen, and the display will tell them something and that something could be anything. They cannot know.

None of us can without forensic level examination of the machine. Even then, we can only verify function and infer a voter intent was correctly recorded and or used for the tally.

Secondly, should there be error, or controversy, the enduring record of voter intent both walked out of the building and or is a collection of grease smears on input devices.

Useless in a court of law.

The only way around this is to make vote records personally identifiable and basically use the systems for banking. (Who gets around this problem with multiple, redundant records created at the time of transaction)


Why not have paper ballots that can be read by a machine? It doesn't get around the issue entirely, but you can always look at the physical ballots for a recount. It's a lot harder to tamper with an election at scale when you need to handle physical ballots.

Or just abandon electronic voting entirely. Ireland tried electronic voting, but scrapped it for just these reasons. You could even keep the ballots in a machine-readable format for sanity checks if necessary.


In New York State, we have exactly this: optical-scan ballots. We fill in the bubbles of the candidates and issues we support with a black marker, then personally feed them into a voting machine that both securely stores and automatically tabulates them. If they needed to be hand-recounted, that could easily be done.

The one significant improvement I would prefer in this process is verifying on the optical-scan machine's screen which options you have voted for, with the option to retrieve your ballot and fix it if anything shows up wrong.


My precinct in Sunnyvale has been doing this for decades. Paper ballot, marked with ink (no “hanging chad”). Ballot is machine readable, and cheap. And easy to process. And has no reliance on high tech on voting day — you could vote by candle light if the power goes out.


This!

I don't have any real concerns about machine counting given a physical record, basic statistical means can tell us all we need to know.


The problem with public vote records is that people may be incentivized financially or coerced via threat to vote a certain way. The bad actor in this situation can verify with public record if the victim followed through.

Somehow I think this is less of a threat than our "black box" vote tallies, but it is valid.


Precisely! I think electronic voting records are wrong. We should use paper ballots, and Counting them electronically with something simple and robust like Optical scan works really well. Let the statisticians run some Audits and we can be really confident. My state does that. Oregon.


Yes, also in Oregon. Our elections are also by mail, so you don't have to stand in line at your local voting station.


Which, when you think about it, kinda presents a similar problem to public vote records. (People can be incentivized financially or coerced via threat to vote a certain way.)


So far, that has not been the experience in Oregon. First, doing that is a Felony with teeth.

Second, the system has a way for the voter to get around coersion. They can submit their vote, and fail to do a valid signature, or even just do it correctly.

Once they have voted, they can contact elections, have that vote invalidated, and or request another ballot to vote correctly. If they want to, they can do that in person, at the elections office, and or tell their story.

It's hard to coerce tons of people, which is needed to impact an election. And those who take part are all at real risk for hard time.

The actual is much different. People will gather to vote together. Our family does this, and will often have open door times. Young people have come to do it and learn about stuff. People tend to take it seriously. The votes differ, and that's OK. Democracy. (and the ones in the minority can totally gloat, should it turn out they made the right call. All good.)

So, we get the voter guides out, make sure people understand, and they, themselves cast their votes, whatever those votes are, we seal them all up and either mail, or take them to the drop box, or elections office.

Most people I know take a while to vote. They have the ballot, and work through it as they have time.

That is what I do personally.


I think it's pretty straightforward to understand: the buyer likely has little to no expertise in the important issues. This is not in any way a slur on election officials, simply the recognition of the (statistically) likely experience of someone who is a local election official.

In addition the way the question is structured by the senators isn't really fair either: if you have n bugs to fix before the ship date, you'll prioritize them and then ship (presumably) the best product you can by the immovable target date. That is also reality.

Though voting is a local matter the Federal Government has a constitutional interest (Article 1, Sections 4 and 5) in the elections to Congress and can mandate minimal standards for voting just as the DoT mandates minimum standards for automobiles. So they could require that whatever machines used are verifiable and non-repudiatable. They could also mandate procedures although those are harder to enforce. If States need to buy equipment suitable for congressional elections they'll presumably use the same equipment for all other elections too.


In my experience, the buyers (election administrators) at the state and local levels know exactly what's going on. Like every where else, there's a revolving door between govt election administrators and the private vendors & consultants.


Hmm, perhaps I was thinking too fine-grained.


Feel compelled to add: I think we want the same thing, eg informed legislators. But from what I've seen, administrators run circles around legislators and their staff. Which is why I flipped on term limits (now oppose) and think legislators need a lot more staff.


I suppose it's more politically expedient to blame the companies trying to rationally minimize cost rather than risk reprimanding and alienating state and local officials who sign contracts for voting machines without any sort of serious security, auditing or compliance provisions.

This sure does seem like grandstanding from these senators. Probably not unrelated to fallout from the Mueller report.


> reprimanding and alienating state and local officials who sign contracts for voting machines without any sort of serious security, auditing or compliance provisions.

What other options do these officials have?

The companies have the choice to improve their security of their hardware at the possible expense of lowering their profit margins.

Whenever you're deciding who to point the finger at, one simple rule is "Can this person actually effect change?" If the answer is "no", then blaming them isn't helpful.


>What other options do these officials have?

Paper voting, for one. If no system is offered that is secure enough, then the default should be no electronic voting system at all and just paper voting. It's scaled fine for hundreds of years and has clear processes in place for custody of ballots.

>The companies have the choice to improve their security of their hardware at the possible expense of lowering their profit margins.

You can't expect companies to just "make a choice" to lower profit margins without some sort of (dis)incentive or external pressure like regulation. It's unrealistic. Companies exist to make their principals money. It's the government's job to check that and make sure that the companies are acting in public interest while they pursue profit.

Local and state officials definitely can effect change on this level since they are often the ones in charge of the procurement process.


> Paper voting, for one.

The election official's budget may simply not be able to afford that.


The better question is, why do they keep buying them?


Note: this article is of the United States.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: