Luther Weeks | CTVotersCount.org

What we don’t understand seems all but impossible and fictional

Like you I don’t know a lot about brain surgery, flying a jet, or hacking a cell-phone. Off-hand I often think of all of those somewhere on a spectrum from taking years to learn, to almost impossible, fictional or magical. Yet the evidence is different. People learn brain surgery, perform it regularly and well. Just this week we saw a mechanic take-off and fly a jumbo jet, apparently with only some video game experience. Which brings me to my newest proverb:

What we don’t understand seems all but impossible and fictional.

But that is not true. Case in point, DEFCON.

What we don’t understand seems all but impossible and fictional.

But that is not true. Perhaps I know that because I was once an expert in one software product. In the 1970’s I was an expert in a product by IBM called IMS. It was relatively new and it had occasional problem. IBM gave customers access to its source code. I could occasionally diagnose and cure problems by studying the symptoms and speculating on the possible errors in the code that would cause them, suggesting fixes to IBM often fixing them myself when IBM refused to address them. Few, if any, know how I did it. I knew, it was years of education, interest, access to that code, combined with a job that offered me an opportunity to do good things for my employer. Others, not everyone, could have done the same thing with enough motivation and interest. Even when I don’t know how to do something, I can understand how others could. How many of you know how to build apps for an iPhone? Well thousands have learned how to do that. And those apps often steal our data and can do many things with our iPhone. Do you trust those apps? Do you trust your iPhone? I rely on mine, yet I know danger always lurks.

A could of weeks ago I spent some time with an election official. He was obviously smart and accomplished, with a wide-ranging prospective. Yet, near the end of our time together, another computer scientist and I were unable to convince him that voting scanners were in any danger because his elections office did pre-election testing, had election definition files encrypted from a vendor, had no scanner internet connectivity, and kept the devices secured. Those all are good practices, yet even altogether they are insufficient with proven vulnerabilities. When we ended that discussion, I could tell he thought I must be crazy as we agreed to disagree.

Anyone who knows computers and software understands the risks. Any who has read in detail about STUXNET understands such threats are real. Few really understand how much more real and easy are threats from insiders. Every one of those security measures can by broken by outsiders, yet are much more easily broken by a myriad of insiders.

Case in point DEFCON, last week where some threats from outsiders are close to “Child’s Play”, many take just a bit more maturity, experience, and knowledge: US voting systems: Full of holes, loaded with pop music, and ‘hacked’ by an 11-year-old <read>

The first day saw 39 kids, ranging in age from six to 17, try to crack into facsimiles of government election results websites, developed by former White House technology advisor Brian Markus. The sites had deliberate security holes for the youngsters to exploit – SQL injection flaws, and similar classic coding cockups.

All but four of the children managed to leverage the planted vulnerabilities within the allotted three-hour contest. Thus, it really is child’s play to commandeer a website that doesn’t follow basic secure programming practices nor keep up to date with patches – something that ought to focus the minds of people maintaining election information websites…

On the adult side, Premier/Diebold’s* TSX voting machines were found to be using SSL certificates that were five years old, and one person managed to, with physical access, upload a Linux operating system to the device and use it to play music, although that hack took a little more time than you’d get while voting.

Diebold’s Express Poll 5000 machines were even easier to crack, thanks to having an easily accessible memory card, which you could swap out while voting, containing supervisor passwords in plain text. An attacker could physically access and tamper with these cards, which also hold the unencoded personal records for all voters including the last four digits of their social security numbers, addresses, and driver’s license numbers.

Hackers thus found that by inserting specially programmed memory cards when no election official is looking, they could change voting tallies and voter registration information. And take a guess what the root password was? Yes, “Password” – again stored in plain text.

Three days at the Fairfax Risk Limiting Audit Prototype

Last Wednesday through Friday I attended and observed the City of Fairfax, VA Risk Limiting Audit Prototype. I was most impressed by the level of participation and cooperation of the State, County, and Local Officials. Was it partially because they are all appointed? I can’t be sure.

Here is a news story that explains it at a very high level. No doubt other reports and the official City of Fairfax report will go into more depth: First new Va. election results audit held in Fairfax city <read>

Any doubt I was there? Check out the photo of the group watching a presentation. I am last row, last on the right.

Georgia: New information enhance title as a Most Vulnerable State

article from McClatchy: Georgia election officials knew system had ‘critical vulnerabilities’ before 2016 vote

Georgia election officials got a friendly warning in August 2016 that their electronic voting system could be easily breached.

But less than a month before the November election, a state cybersecurity official fretted that “critical vulnerabilities” persisted, internal emails show.

The emails, obtained through a voting security group’s open records request, offer a glimpse into a Georgia election security team that appeared to be outmatched even as evidence grew that Russian operatives were seeking to penetrate state and county election systems across the country…

The disclosures add to alarms about the security of Georgia’s elections — not only in 2016, but also heading into this fall’s midterm elections.

Another article from McClatchy: Georgia election officials knew system had ‘critical vulnerabilities’ before 2016 vote <read>

Georgia election officials got a friendly warning in August 2016 that their electronic voting system could be easily breached.

But less than a month before the November election, a state cybersecurity official fretted that “critical vulnerabilities” persisted, internal emails show.

The emails, obtained through a voting security group’s open records request, offer a glimpse into a Georgia election security team that appeared to be outmatched even as evidence grew that Russian operatives were seeking to penetrate state and county election systems across the country…

The disclosures add to alarms about the security of Georgia’s elections — not only in 2016, but also heading into this fall’s midterm elections.

“I think these emails reveal that they recognized this system was catastrophically insecure,” said Robert McGuire, a Seattle lawyer representing citizen activists in a lawsuit that seeks to force Georgia to scrap its paperless electronic voting machines this fall and shift to paper ballots.

Secretary of State Brian Kemp, whose office oversees the state’s elections, says he was unaware of the system vulnerabilities at the time. Kemp, the Republican nominee for governor in this fall’s election, still maintains Georgia’s system is secure…

As a result, experts say, the system may be an inviting target for operatives from Russia and elsewhere to install software that manipulates votes without detection.

Georgia: Are you sure you want this man to be your Governor. Are you sure you actually can participate in that choice?

The most vulnerable state: Georgia

Electronic election suspicions in Georgia have been there since the dawn of century. Now with Secretary of State Brian Kemp running for Governor, a New Yorker article reviews the recent history of ongoing vulnerability, lack of investigation by the state, and cover-up.

Our Editorial

Has our democracy been stolen in Georgia? Will it continue to be stolen? This is not just a problem for Georgia voters. The Senators and Representatives from each state change the balance in Washington, the Electoral College votes from Georgia count toward who is our President, especially in close elections like 2000, 2004 and 2016. The fully justified suspicion alone undermines confidence in Democracy.

Instead of papering over suspicions, Georgia should be moving to paper ballots and sufficient post-election audits.

Electronic election suspicions in Georgia have been there since the dawn of century. Deserving of chapters in Bev Harris’ book Black Box voting <read> which included the suspicious loss of Senator Max Cleland and the election of Governor Sonny Perdue.

Now with Secretary of State Brian Kemp running for Governor, a New Yorker article reviews the recent history of ongoing vulnerability, lack of investigation by the state, and cover-up: Trump, Election Hacking, and the Georgia Governor’s Race <read>

The indictment also revealed—for the first time—that the Russians had targeted county Web sites in Georgia, looking for election-related vulnerabilities. (The indictment said that the hackers also looked at county Web sites in Iowa and Florida.) In one sense, this was an unremarkable fact: the top cybersecurity official in the Department of Homeland Security, Jeanette Manfra, told Congress in April that Russians hackers had likely targeted every state’s systems in 2016. But, for the past two years, Kemp has been contemptuous of efforts by the D.H.S. to shore up election systems nationally. And, though not going so far as to say that Russian interference is “all a big hoax,” as Trump has, [Secretary of the State and Candidate for Governor Brian] Kemp has been an outspoken advocate of not taking the whole thing so seriously…

Labelling elections as critical infrastructure, Kemp declared, opened the door for the federal government to “subvert the Constitution to achieve the goal of federalizing elections under the guise of security.” Georgia is one of only five states that uses voting machines that create no paper record, and thus cannot be audited, and the Center for American Progress has given it a D grade for election security. But, when D.H.S. offered cybersecurity assistance, Kemp refused it…

The suit was filed on July 3rd. Four days later, the servers at the Center for Election Systems were wiped clean. On August 9th, less than twenty-four hours after the case was moved to the U.S. District Court for the Northern District of Georgia, all the data on the Center’s backup servers were destroyed as well. As the Coalition said in a brief, “The State of Georgia and its officials have the legal, moral, and ethical obligation to secure the State’s electoral system. Sadly—and inexplicably—they appear to lack the will to do so.”

Our Editorial

Instead of papering over suspicions, Georgia should be moving to paper ballots and sufficient post-election audits.

Top voting vendor, ES&S, admits lying to public and election officials for years

Article from Mother Board by Kim Zetter: Top Voting Machine Vendor Admits It Installed Remote-Access Software on Systems Sold to States <read>

Wyden told Motherboard that installing remote-access software and modems on election equipment “is the worst decision for security short of leaving ballot boxes on a Moscow street corner.”

I would add that lying about ballot boxes being left on a Moscow street corner is equivalent to flat out lying about the software installed on your products. We should expect more from companies whose hands and integrity upon which our elections depend.

Article from Mother Board by Kim Zetter: Top Voting Machine Vendor Admits It Installed Remote-Access Software on Systems Sold to States <read>

Remote access software can be used to take over a computer from a distant computer for maintenance and trouble-shooting, unfortunately also from fraud.

From the article:

The nation’s top voting machine maker has admitted in a letter to a federal lawmaker that the company installed remote-access software on election-management systems it sold over a period of six years, raising questions about the security of those systems and the integrity of elections that were conducted with them.

In a letter sent to Sen. Ron Wyden (D-OR) in April and obtained recently by Motherboard, Election Systems and Software acknowledged that it had “provided pcAnywhere remote connection software … to a small number of customers between 2000 and 2006,” which was installed on the election-management system ES&S sold them.

The statement contradicts what the company told me and fact checkers for a story I wrote for the New York Times in February. At that time, a spokesperson said ES&S had never installed pcAnywhere on any election system it sold. “None of the employees, … including long-tenured employees, has any knowledge that our voting systems have ever been sold with remote-access software,” the spokesperson said.

ES&S did not respond on Monday to questions from Motherboard, and it’s not clear why the company changed its response between February and April. Lawmakers, however, have subpoena powers that can compel a company to hand over documents or provide sworn testimony on a matter lawmakers are investigating, and a statement made to lawmakers that is later proven false can have greater consequence for a company than one made to reporters.

Election-management systems are not the voting terminals that voters use to cast their ballots, but are just as critical: they sit in county election offices and contain software that in some counties is used to program all the voting machines used in the county; the systems also tabulate final results aggregated from voting machines.

We point out that because those machines can be used to “used to program all the voting machines”, they can be used to change the software used on those machines and essentially are just as risky to those machines as would be if pcAnywhere were installed on those machines as well.

Wyden told Motherboard that installing remote-access software and modems on election equipment “is the worst decision for security short of leaving ballot boxes on a Moscow street corner.”

I would add that lying about ballot boxes being left on a Moscow street corner is equivalent to flat 0ut lying about the software installed on your products. We should expect more from companies whose hands and integrity upon which our elections depend.

VoteAllegheny Analysis of Election Risks in One County

VoteAllegheny presents a report by Carnegie-Mellon researchers on the vulnerabilities in a single county in a swing state. The biggest takeaway for us is understanding that a top-down analysis of vulnerabilities can yield the most cost-effective areas to focus on preventing election fraud. Where we spend our resources can make a difference in the results!

As Connecticut spends $5million+ in Federal election security dollars, perhaps an independent study like this one for Connecticut would be the most effective use of the 1st $1.00, pointing to the most cost-effective use of the rest of the $5million+.

Suggestions for reading and viewing on the 4th of July

Once again, we have a suggestions for the 4th of July. A Centennial address from 1876.

Once again, we have a suggestion for the 4th of July. This time from a Republican who viewed life and our country more like a mid-20th-century Democrat. But for a strong sense of public integrity he might likely have run and become President in the late 1800’s.

Also a recent book on our heritage: Kurt Andersen’s <Fantasyland> How America Went Haywire: A 500 Year History

Robert G. Ingersoll was likely the most widely known orator of the late 1800’s, following Emerson, and preceding Mark Twain. In 1876 he gave this oration on “The Meaning of the Declaration of Independence” <read>

all things considered, it was the bravest political document ever signed by man. And if it was physically brave, the moral courage of the document is almost infinitely beyond the physical. They had the courage not only, but they had the almost infinite wisdom to declare that all men are created equal. Such things had occasionally been said by some political enthusiasts in the olden time, but for the first time in the history of the world, the representatives of a nation, the representatives of a real living, breathing, hoping people, declared that all men are created equal. With one blow, with one stroke of the pen, they struck down all the cruel, heartless barriers that aristocracy, that priestcraft, that kingcraft had raised between man and man. They struck down with one immortal blow, that infamous spirit of caste that makes a god almost a beast, and a beast almost a god. With one word, with one blow, they wiped away and utterly destroyed all that had been done by centuries of war—centuries of hypocrisy—centuries of injustice….

“What more did they do? They then declared that each man has a right to live. And what does that mean? It means that he has the right to make his living. It means that he has the right to breathe the air, to work the land, that he stands the equal of every other human being beneath the shining stars; entitled to the product of his labor—the labor of his hand and of his brain.

What more? That every man has the right; to pursue his own happiness in his own way. Grander words than these have never been spoken by man.

Book Review: Reporter: A Memoir by Seymour Hersch

If you think it’s unfair to Hersh to reveal all his secrets in a review, don’t worry — this is not even 1/100 of what his book contains…

“Reporter” provides detailed explications of how Hersh has used these lessons [about investigated journalism], making it one of the most compelling and significant books ever written about American journalism. Almost every page will tell you something you’ve never heard before about life on earth. Sometimes it’s Hersh elaborating on what he’s already published; sometimes it’s new stories he felt he couldn’t write about when he first learned of them; and sometimes it’s the world’s most intriguing, peculiar gossip.

There is an excellent interview with Sy Hersh just released as an Intercepted podcast

Starting at about 10min in to the interview, Sy provides his take on the evidence that Russians accessed the DNC emails in the run-up to the Nov 2016 election…

I could write my own book review of Seymour Hersh’s memoir Reporter: A Memoir but Jon Schwarz has done a much better job at the Intercept that I every could Seymour Hersh’s New Memoir Is a Fascinating, Flabbergasting Masterpiece <read>. After reading that I immediately bought the book. Schwarz covers several of Hersh’s revelations. The book is full of revelations about political actors, inside jobs, and Hersh himself. Here is are two paragraphs that accurately summarize what awaits readers:

If you think it’s unfair to Hersh to reveal all his secrets in a review, don’t worry — this is not even 1/100 of what his book contains…

“Reporter” provides detailed explications of how Hersh has used these lessons [about investigated journalism], making it one of the most compelling and significant books ever written about American journalism. Almost every page will tell you something you’ve never heard before about life on earth. Sometimes it’s Hersh elaborating on what he’s already published; sometimes it’s new stories he felt he couldn’t write about when he first learned of them; and sometimes it’s the world’s most intriguing, peculiar gossip.

I was especially fascinated by Hersh’s discussions of what is required of and investigative journalist, his candor, his constant battles/debates with editors about what to publish, and how much he chose not to publish. Although I am not a reporter, let alone an investigative reporter, I take some solace in the incidents and issues with election integrity that for one reason or another I do not pursue or cover in CTVotersCount.org.

Speaking of elections. There is an excellent interview with Sy Hersh just released as an Intercepted podcast: Intercepted Live From Brooklyn With Sy Hersh, Mariame Kaba, Lee Gelernt, and Narcy <listen>

Starting at about 10min in to the interview, Sy provides his take on the evidence that Russians accessed the DNC emails in the run-up to the Nov 2016 election – He says that there is yet no evidence available implicating Russians.

The “Real” Lawyers Only Need Apply Rule

As this CTNewsJunkie post implies, it will always be called The Bysiewicz Test <read>

Ambiguously defined in law and only slightly less ambiguously by the Connecticut Supreme Court. All we know for sure is that you have to be a lawyer in CT for at least ten years and have different experience than Susan Bysiewicz had in 2010. As I commented in on the article:

I always find it interesting that the AG and Judge of Probate are the only offices that have qualifications, as far as I know. They are both related to law. I wonder if the composition of the General Assembly makes the legislature realize how important qualifications are, in just these cases?

There remains no necessary training whatsoever to be Secretary of the State, while some of her employees, but not all, need to be lawyers to give advice to the public, would be candidates, and election officials. That could be going better, but of course, certification by itself does not preclude errors and incompetence, or as Jon Lender puts it Bungling

As this CTNewsJunkie post implies, it will always be called The Bysiewicz Test <read>

I always find it interesting that the AG and Judge of Probate are the only offices that have qualifications, as far as I know. They are both related to law. I wonder if the composition of the General Assembly makes the legislature realize how important qualifications are, in just these cases?

Why is there no requirement that the Comptroller be a CPA with 10 years in practice? How about the Treasurer being an MBA with 10 years managing significant funds? Or that the Secretary of the State has been a Registrar, Municipal Clerk, and served in election administration or as a pollworker for at least 10 elections?

There is no such requirement for Justice of the U.S. Supreme Court.

Or perhaps there should be no qualifications for any office?

The General Assembly and Denise Merrill, agree that to be a pollworker you must be trained before every election and primary; to lead a polling place or the counting of absentee ballots you must be a Certified Moderator; there are no qualifications to be a Registrar of Voters, yet you must become a Certified Registrar to remain a Registrar and be subject to some refresher training each year.

There remains no necessary training whatsoever to be Secretary of the State, while some of her employees, but not all need to be lawyers, to give advice to the public, would be candidates, and election officials. That could be going better, but of course, certification by itself does not preclude errors and incompetence, or as Jon Lender puts it Bungling: Candidate’s Lawsuit Says Bungling By Merrill’s Office Ruined Her Chance At Primary <read>

Ex-State Rep. Vickie Orsini Nardello, D-Prospect, claims in a lawsuit that bungling by Democratic Secretary of the State Denise Merrill’s office has deprived her of running in a 16th State Senate District primary that she qualified for at a convention in May.

Nardello says two Merrill subordinates told her two different things early this month: one, that a technical problem with her primary eligibility form (she’d failed to write “16” in the “Senatorial District” space) had been “resolved” and she was “all set”; and the other that “we are unable to accept your certificate of eligibility” and it’s too late to submit one that’s filled in correctly.

One blow behind closed doors, two blows to open government

Statement from the Connecticut Freedom of Information Council: Restore public access to public hearings

To the surprise of many, the vast majority of transcripts from public hearings held during the recently adjourned 2018 legislative session are not available. Officials from the Office of Legislative Management and the House and Senate say that transcription services have fallen victim to budget cuts, with the elimination of the service expected to save about $100,000 annually. The decision apparently was made without public input and has been condemned by open-government advocates.

This directly effects me, CT Voters Count, and the Citizen Audit. It effects anyone involved in the legislative process or litigation related to Connecticut law. This effects you indirectly, and significantly.

Statement from the Connecticut Freedom of Information Council: Restore public access to public hearings <read>

To the surprise of many, the vast majority of transcripts from public hearings held during the recently adjourned 2018 legislative session are not available. Officials from the Office of Legislative Management and the House and Senate say that transcription services have fallen victim to budget cuts, with the elimination of the service expected to save about $100,000 annually. The decision apparently was made without public input and has been condemned by open-government advocates.

This is a double whammy to open government:

It was a decision made months ago behind closed doors with no notice to those effected.
It curtails public access to information and provides no public record of critical information.

Can there be any wonder why this was done in secret – It would not have survived scrutiny:

Murphy was a member of a task force that met in 2010 and was charged with making recommendations regarding the conversion of legislative records from paper to electronic form. According to the group’s final report, “the task force was presented with an overwhelming amount of testimony opposing elimination of public hearing transcriptions.”

Among those testifying were members of the legislative, judicial and executive branches, including the offices of the attorney general, chief court administrator, chief public defender and the Division of Criminal Justice. Others included the Connecticut Bar Association and the Southern New England Law Librarians Association. Ultimately, the vote to oppose elimination of the transcripts was unanimous.

Opposition has not abated and many open-government advocates view the decision by legislative leaders as yet another step in limiting accountability and curtailing transparency.

For example:

Twice this year I heard testimony which I wanted to view the transcript when it became available. Once to preserve and retain a statement of a state official in their testimony. Another time to lookup a critical reference from expert testimony for use in future years.
I have been working toward passing a civil rights bill for a couple of years. It would extend a bill passed in 2002. The first thing legislators ask for is the legislative history of the bill in 2002. Fortunately, that testimony transcribed prior to online access, is preserved and available at the State Library.
Similarly the record of another bill passed several years ago provides evidence that the Legislative intent is not being followed, resulting in the disenfranchisement of voters.

This follows the assaults on CT-N and the past refusal to provide public access to the accounting records of the UConn Foundation. Connecticut once had a Freedom of Information law that was the envy of the world. This is also consistent with unrelenting attacks chipping away at Elections Enforcement and the Citizen Election Program.