Common Sense: Limits on Testing From Turing to Self Driving Cars

At first this may not seem like Common Sense. We have the famous Turing Halting Problem which has some very important consequences for voting which may not, at first, make common sense:

Note: This is then thirteenth post in an occasional series on Common Sense Election Integrity, summarizing, updating, and expanding on many previous posts covering election integrity, focused on Connecticut. <previous>

At first this may not seem like Common Sense. We have the famous Turing Halting Problem which has some very important consequences for voting which may not, at first, make common sense:

  • We cannot use testing to be sure that the software in a voting machine will provide accurate election results.
  • And any hardware circuits are also part of the machine and come under the limits of the halting problem

It is worse, beyond the halting problem:

  • We really have no way of knowing if the software that actually ran on a machine when the results were created and printed was actually the approved, tested software.
  • We really have no way of determining if the results were somehow changed by some some means external to the software.
  • We have no way of really determining that the components of the hardware were what were tested were actually those running the machine.
  • There could also be permanent or intermittent hardware errors.
  • The hardware errors could include logic circuits, wires, or sensors.

At this point you may be complaining that this is crazy or at least not common sense.

Consider the idea of self-driving cars.  How comfortable are you with them today?  Do you think testing is sufficient?  Maybe. Yet, they could be subject to intermittent errors and hacking – similar to today’s vehicles that rely almost entirely on software to translate the driver’s commands into action. See:  <60 Minutes Shows Threats to Autos and Voting Machines are Real>

The NEW Rob Georgia

While attention was appropriately aimed at FL and OH respectively in 2000 and 2004, Georgia perhaps remains as the most questionable state for voting integrity in the nation.  Many overlooked the questionable elections there highlighted by Bev Harris in Chapter 11 of Black Box Voting: Rob Georgia, Noun or Verb? <read>

Now we have the story on the vulnerabilities in Georgia in 2017 by Kim Zetter.  Here is her 20 minute interview on yesterday’s Fresh Air: <listen>

And her earlier extensive article at Politico:  Will the Georgia Special Election Be Hacked? <read>

“I was like whoa, whoa. … I did not mean to do that. … I was absolutely stunned, just the sheer quantity of files I had acquired,” he tells Politico Magazine in his first interview since discovering the massive security breach.

As Georgia prepares for a special runoff election this month in one of the country’s most closely watched congressional races, and as new reports emerge about Russian attempts to breach American election systems, serious questions are being raised about the state’s ability to safeguard the vote…

Be careful what you ask for. Georgia has gone from risky to even more questionable as the Secretary of State’s office is taking over the programming of the voting systems from Kennesaw State U. as the Secretary is running for Governor.

While attention was appropriately aimed at FL and OH respectively in 2000 and 2004, Georgia perhaps remains as the most questionable state for voting integrity in the nation.  Many overlooked the questionable elections there highlighted by Bev Harris in Chapter 11 of Black Box Voting: Rob Georgia, Noun or Verb? <read>

Now we have the story on the vulnerabilities in Georgia in 2017 by Kim Zetter.  Here is her 20 minute interview on yesterday’s Fresh Air: <listen>

And her earlier extensive article at Politico:  Will the Georgia Special Election Be Hacked? <read>

“I was like whoa, whoa. … I did not mean to do that. … I was absolutely stunned, just the sheer quantity of files I had acquired,” he tells Politico Magazine in his first interview since discovering the massive security breach.

As Georgia prepares for a special runoff election this month in one of the country’s most closely watched congressional races, and as new reports emerge about Russian attempts to breach American election systems, serious questions are being raised about the state’s ability to safeguard the vote…

Be careful what you ask for. Georgia has gone from risky to even more questionable as the Secretary of State’s office is taking over the programming of the voting systems from Kennesaw State U. as the Secretary is running for Governor.

Here is more on calls before the Special Election for Georgia to use a paper ballot  <read>

Do Not Hide Voter Information

Voting as we know it, depends on two important keys that are often difficult for the public, media, and sometimes even experts to understand.

Voting rolls and check-in lists need to be available to every citizen, young and old, so that the public can be assured that only registered voters voted, that they voted in the correct primary, that the number of ballots match the number of voters checked in, and that those checked in actually did vote. Otherwise there is no basis for trust in democracy.

Public voting rolls provide the only means for individuals and news organizations to independently investigate voting fraud; they provide officials with the credible proof that fraud is limited; and they help the public to trust in decisions by the State Elections Enforcement Commission.

 

Voting as we know it, depends on two important keys that are often difficult for the public, media, and sometimes even experts to understand.  One is the need for anonymous voting, aka the “secret ballot”.   The other is the need for voting rolls and the record of who voted to be public.  We addressed that second one in a letter published in the Hartford Courant today:

Do Not Hide Voter Information

I was surprised to learn that Dan Barrett, Connecticut ACLU legal director, was against “any old person on the street [being] able to access [voter rolls].”

Voting rolls and check-in lists need to be available to every citizen, young and old, so that the public can be assured that only registered voters voted, that they voted in the correct primary, that the number of ballots match the number of voters checked in, and that those checked in actually did vote. Otherwise there is no basis for trust in democracy.

Public voting rolls provide the only means for individuals and news organizations to independently investigate voting fraud; they provide officials with the credible proof that fraud is limited; and they help the public to trust in decisions by the State Elections Enforcement Commission.

Not so long ago, UConn students used that data to expose the extent to which the rolls included deceased voters. That same data was used by officials to demonstrate, in a way that could be verified, that very few of those entries were associated with actual fraud. More recently, those public rolls were used to uncover and confirm that a state representative had voted for several years and had been elected based on an illegal residence. Currently, there is a criminal investigation underway in Stamford based on absentee voters checked off who did not actually vote.

What prompted this letter was an article with the quote along with quotes from several officials proposing to restrict access to voter rolls Lawmakers Seek More Voter Privacy <read>

 

Join us in the Battle for the Internet

Its actually a battle for the information necessary for citizens to maintain democracy:

Battle fro the Internet: Write the FCC and contact Congress: <Battle For the Net>

Its actually a battle for the information necessary for citizens to maintain democracy:

Battle fro the Internet:  Write the FCC and contact Congress:  <Battle For the Net>

Response to ill-advised Presidential Commission risks democracy

There is much to criticize in the Trump Commission.  Yet there is no excuse for officials to unilaterally disobey the law.  There are reasons for voting lists and voting history to be public documents.  Perhaps we can providing a teaching moment.

Editor’s Note: We sent the following letter to the Hartford Courant in response to their recent editorial. They along with apparently the rest of the media opposed the Trump Commission, in our opinion, for the wrong reasons.  There is much to criticize in the Trump Commission.  Yet there is no excuse for officials to unilaterally disobey the law.  There are reasons for voting lists and voting history to be public documents.  Perhaps we can providing a teaching moment.

To the Editor,

I share the concerns for the ill-conceived Presidential Advisory Commission on Elections shared by Secretary of the State Denise Merrill, officials nationwide, and your editorial on 7/6/2017. Yet in a rush to respond to a clumsy request, the rule of law and the importance of transparent voter rolls is overlooked, at our peril.

Connecticut’s Freedom of Information law is constantly under official attack. We should never condone a unilateral act to disobey the law based on an official’s view of the requester or how they might use the data.  This is no different than the county clerk who refused to follow the law and issue marriage licenses to those she did not approve.

Voter rolls are constantly made available to both political parties. Recently a contractor for the Republican Party exposed all that data and more.  Last year data, likely including voter rolls and more, was insufficiently secured by the Democratic Party.

There is a reason government data, including voter rolls are required to be public.  Not so long ago, UConn students used that data to expose the extent to which the rolls included deceased voters. That same data was used by officials to demonstrate in a way we could verify that hardly any were associated with actual fraud. More recently those pubic rolls were used to uncover and confirm that a state representative had voted for several years and been elected based on an illegal residence.

Public voting rolls provide the only means for individuals and news organizations to independently investigate voting fraud; they provide officials with the only means to provide credible proof that fraud is limited; and for the public to trust in the related decisions by the State Elections Enforcement Commission.

 

4th of July Suggestion

As we often do, a suggested reading for the 4th of July weekend.  It has been a while since we have read the Declaration.  As we said six years ago:

This weekend is a great time to [re-]read the Declaration of Independence. We find it very inspiring to read it sometime around the 4th of July each year.  As we have discussed before, some believe that the right to vote is more fundamental than the Constitution. Here is a link to a copy for your reading <Declaration of Independence>

The Declaration of Independence asserts our rights to determine and change our form of government – without voting integrity we lose that most fundamental of rights.

“The right to vote… is the primary right by which other rights are protected” – Thomas Paine

As we often do, a suggested reading for the 4th of July weekend.  It has been a while since we have read the Declaration.  As we said six years ago:

This weekend is a great time to [re-]read the Declaration of Independence. We find it very inspiring to read it sometime around the 4th of July each year.  As we have discussed before, some believe that the right to vote is more fundamental than the Constitution. Here is a link to a copy for your reading <Declaration of Independence>

The Declaration of Independence asserts our rights to determine and change our form of government – without voting integrity we lose that most fundamental of rights.

“The right to vote… is the primary right by which other rights are protected” – Thomas Paine

Russians not the only threat to our elections

Many articles on the Congressional hearings on the “Russian” hacking or not hacking of our elections.  Brad Friedman and Mark Karlin come closet to my opinions:

Recent article by Mark Karlin referencing Brad Friedman:  Beyond the Russians, Electronic Voting Machines Are Vulnerable to Any Hackers  

Journalists and activists have been sounding the alarm about electronic voting machines and their proprietary software for years. The vulnerability of these machines to hacking has not been front and center for some time — primarily due to the failure of the corporate media and legislative bodies to take it seriously. That changed, to some extent, with the charges about Russian hacking from US intelligence agencies. However, the current emphasis is on the Russians allegedly attempting to influence the 2016 election, not on the flawed electronic voting machines that make hacking possible…

Meanwhile, our Secretary of the State continues to spread myths about the safety of voting systems not connected to the internet and “tamper-proof” seals that are at best “tamper-evident”. 

We add that paper ballots are insufficient.  They need protection from tampering.  We need sufficient audits and recounts.  Audits and recounts that are comprehensive and convincing.  Audits and recounts that are transparent and publicly verifiable.f

Many articles on the Congressional hearings on the “Russian” hacking or not hacking of our elections.  Brad Friedman and Mark Karlin come closet to my opinions:

Recent article by Mark Karlin referencing Brad Friedman:  Beyond the Russians, Electronic Voting Machines Are Vulnerable to Any Hackers   <read>

Journalists and activists have been sounding the alarm about electronic voting machines and their proprietary software for years. The vulnerability of these machines to hacking has not been front and center for some time — primarily due to the failure of the corporate media and legislative bodies to take it seriously. That changed, to some extent, with the charges about Russian hacking from US intelligence agencies. However, the current emphasis is on the Russians allegedly attempting to influence the 2016 election, not on the flawed electronic voting machines that make hacking possible…

Ironically enough today, in the U.S. Senate Intelligence Committee, top intelligence officials from the FBI and DHS testified in regard to concerns about alleged Russian manipulation of the 2016 election. Neither they, nor the elections officials who also testified today, seemed to know much of anything about the actual vulnerability of U.S. voting systems. Or, if they did, they certainly offered a whole lot of demonstrably inaccurate information about whether voting systems are connected to the Internet (they are), whether our decentralized voting and tabulation systems make it impossible to hack a  Presidential election (it doesn’t), and whether actual voting results were manipulated in the 2016 President race (they claimed that they weren’t, even while the DHS finally admitted they never actually checked a single machine or counted a single ballot to find out!)

On the other hand, one computer scientist and voting machine expert, Dr. Alex Halderman of the University of Michigan, also testified today and he actually knows what he’s talking about, because he’s personally hacked just about every voting system in use in the U.S. today, including 10 years ago when he first hacked the exact same 100% unverifiable touch-screen voting machines used in the state of Georgia during Tuesday’s Special Election for U.S. House, the most expensive such election in U.S. History. As he explained in his prepared remarks [PDF] today, 10 years ago, he “was part of the first academic team to conduct a comprehensive security analysis of a DRE [touch-screen] voting machine.” It was a Diebold touch-screen machine, the exact same type used in GA yesterday, as obtained from a source of mine and given to his crew at Princeton University at the time…

The Russian hacking makes for a profitable corporate media narrative — particularly with tweeter Trump tossing gas on the fire. However, if we are looking to secure our voting system from foul play, shouldn’t we also start paying major legislative attention to the electronic voting machines themselves?

I could hardly say it better.

Meanwhile, our Secretary of the State continues to spread myths about the safety of voting systems not connected to the internet and “tamper-proof” seals that are at best “tamper-evident”.

We add that paper ballots are insufficient.  They need protection from tampering.  We need sufficient audits and recounts.  Audits and recounts that are comprehensive and convincing.  Audits and recounts that are transparent and publicly verifiable.

Hacking voting systems is/was easy

Article in the Atlantic summarizes some of the bad news from the last couple of weeks:  There’s No Way to Know How Compromised U.S. Elections Are <read>

So let us not be complacent. Just because you do not understand something, does not mean that hundreds and thousands of others can’t easily hack it.

Article in the Atlantic summarizes some of the bad news from the last couple of weeks:  There’s No Way to Know How Compromised U.S. Elections Are <read>

While the NSA concluded the attack was carried out by the most sophisticated of hackers—the Russian military—their entry methods were relatively vanilla. They gained access to the credentials and documents of a voting system vendor via a spear-phishing attack, and then used those credentials and documents to launch a second spear-phishing attack on local elections officials, which if successful could have compromised election officials’ systems and whatever voter data they possessed.

While the NSA concluded the attack was carried out by the most sophisticated of hackers—the Russian military—their entry methods were relatively vanilla. They gained access to the credentials and documents of a voting system vendor via a spear-phishing attack, and then used those credentials and documents to launch a second spear-phishing attack on local elections officials, which if successful could have compromised election officials’ systems and whatever voter data they possessed…

The splintered digital infrastructure across and within states; the use of multiple vendors; the overlapping interfaces between municipalities, counties, and states; and the reliance on of volunteers for data entry and verification in both registration and voting mean that there are literally thousands of entry points to compromise elections in each state.

Another case study is the state of Georgia, where organizations have filed lawsuits against the state over the security of its elections in advance of the special election in the 6th Congressional District. A June 14 Politico investigation revealed just how insecure the entire system is, and how much more insecure it was in the past. Last August, cybersecurity researcher Logan Lamb probed the Kennesaw State University’s Center for Election Systems—which programs voting machines for the entire state—and found a structure that basically begged to be hacked.

It had no password protection, and was available on a public site without encryption and lacking even basic security updates. Lamb found millions of registration records, credentials for the central elections server, files for the electronic ballot equipment, and database information for the Global Election Management Systems (GEMS) used by many states for preparing ballots and counting votes. In other words, with rather basic tools that fall well outside the realm of sophisticated “hacking,” as it is known, Lamb would have had a wide-open entry point to disrupting Georgia elections last fall, had he been a malicious actor.

So let us not be complacent. Just because you do not understand something, does not mean that hundreds and thousands of others can’t easily hack it.

If [Connecticut] Voting Machines Were Hacked, Would Anyone Know?

NPR story by Pam Fessler:  If Voting Machines Were Hacked, Would Anyone Know?   Fessler quotes several experts and election officials including Connecticut Assistant Secretary of the State Peggy Reeves:

Still, Connecticut Election Director Peggy Reeves told a National Academies of Sciences, Engineering, and Medicine panel on Monday that many local election officials are ill-equipped to handle cybersecurity threats.

“Many of our towns actually have no local IT support,” she said. “Seriously, they don’t have an IT director in their town. They might have a consultant that they call on if they have an issue. So they look to us, but we’re a pretty small division.”

Reeves said the best protection against hackers is probably the fact that the nation’s voting system isso decentralized, with different processes and equipment used in thousands of different locations.

We certainly agree with that and the cybersecurity experts quoted.

NPR story by Pam Fessler:  If Voting Machines Were Hacked, Would Anyone Know? <read>  Fessler quotes several experts and election officials including Connecticut Assistant Secretary of the State Peggy Reeves:

Still, Connecticut Election Director Peggy Reeves told a National Academies of Sciences, Engineering, and Medicine panel on Monday that many local election officials are ill-equipped to handle cybersecurity threats.

“Many of our towns actually have no local IT support,” she said. “Seriously, they don’t have an IT director in their town. They might have a consultant that they call on if they have an issue. So they look to us, but we’re a pretty small division.”

Reeves said the best protection against hackers is probably the fact that the nation’s voting system isso decentralized, with different processes and equipment used in thousands of different locations.

We certainly agree with that and the cybersecurity experts quoted.

 

A cut below the rest: National beacon or bad example?

Every year Connecticut’s Citizen Election Program is under assault.  This year is no different.

Here is the bottom line:  The Citizen’s Election Program is a drop in the bucket.  A small percentage of what we pay for the General Assembly and its staff;  A smaller percentage of the state budget; $10 million a year compared to billions in the budget.  Just one bad decision against the people can cost us several times that $10 million.

Read more from the In These Times article: Ten Years Ago, Connecticut Got Big Money Out of Its Elections. Now Democrats Are Gutting the Program

Every year Connecticut’s Citizen Election Program is under assault.  This year is no different.

Here is the bottom line:  The Citizen’s Election Program is a drop in the bucket.  A small percentage of what we pay for the General Assembly and its staff;  A smaller percentage of the state budget; $10 million a year compared to billions in the budget.  Just one bad decision against the people can cost us several times that $10 million.

Read more from the In These Times article: Ten Years Ago, Connecticut Got Big Money Out of Its Elections. Now Democrats Are Gutting the Program  <read>

Connecticut’s introduction of the Citizens’ Election Program (CEP) in 2005, seriously curbed the influence of corporations and the rich on state elections. Yet, this beacon of democracy could soon dim, as the state legislature is on the verge of gutting the law that gave the state its democratic promise.