This is more of an editorial-type story than most of the breaking news stuff we normally report in the handler's diary, but I've been thinking about it for a while and wanted to see what our readers think. My thanks to Pedro, for allowing me to post this on his day has handler on duty.
One week ago today was an off-year election here in the US. It was the first time that my precinct (and county) used the new electronic touch screen voting machines. In previous years, we used the infamous punched cards that garnered so much attention (and introduced most of us to the concept of hanging chads) in Florida in 2000. I have to admit that as a security professional it was somewhat disconcerting to be using a Windows-based machine to cast my vote on Black Tuesday (the second Tuesday of the month when Microsoft normally releases their patches and security vulnerabilities). The machines that were used in my precinct were Diebold AccuVote-TSX. This appears to be the latest incarnation of the system that Avi Rubin, et al, reviewed in their scathing report from July 2003 (also presented at the IEEE Symposium on Security and Privacy 2004). As a 'consumer', I have no way of telling whether many of the concerns raised in that report have been addressed because it doesn't appear that Diebold has been very forthcoming, but there appear to still be some serious problems with them which led to California banning the use of the Diebold machines this fall (see story here). I suspect that the problems with forged smartcards probably still exist, too, for example. I was very happy to see that at least one of the conclusions of the report was taken seriously. The machines in my precinct did produce a paper ballot that I was asked to verify before my ballot was counted (or, at least, before the software claimed that ballot had been recorded). I assume that those paper ballots would be used in the event a recount was called for, but as the California test demonstrated, if the printers jam or the machine freezes, the paper doesn't really help. I also note that the Government Accounting Office (GAO) released another very critical report on the state of electronic voting just 2 weeks before the election. So, what does all of this mean? I'm not sure. I believe that electronic voting in some form is the future, but as a security professional, I am keenly aware that there are many obstacles still to overcome.
A few useful links on electronic voting:
http://lorrie.cranor.org/voting/hotlist.html (unfortunately, not updated recently)
Jim Clausing, jclausing /at/ isc.sans.org
I will be teaching next: Reverse-Engineering Malware: Malware Analysis Tools and Techniques - SANS Baltimore Fall 2020
Nov 15th 2005
Nov 15th 2005
1 decade ago