Paper Ballots. The Best Answer For Secure Voting Systems.

First, these hilarious news about hacking voting machines:

This weekend saw the 26th annual DEFCON gathering. It was the second time the convention had featured a Voting Village, where organizers set up decommissioned election equipment and watch hackers find creative and alarming ways to break in.  

...

In a room set aside for kid hackers, an 11-year-old girl hacked a replica of the Florida secretary of state’s website within 10 minutes — and changed the results.

You'd think that the integrity of the voting system is the absolute foundation of democracy, wouldn't you?  And just as a bookkeeping system which cannot be audited is nothing but an invitation for fraudsters, a voting system which cannot be properly audited is one, too.

Yet any US debates about this make me feel as if I've suddenly moved to an alternative reality, one where nobody worries about rigged votes by those who count the votes, say, or about someone (say, the Russians) hacking into the voting machines or the programs which tally the votes.

We are expected to simply assume that the voting systems are secure, what with their decentralized and patchwork nature* and so on, and any attempt to question that security is seen as an attack from the tinfoil brigade**.

Yet the votes are the basic ways in which a democracy works.  Given that, shouldn't we be absolutely certain that the voting systems in current use are secure from illegal influence?

Georgia's voting system cannot be properly audited at all, and appears to have been completely open to outside influence:

...a young security researcher in Georgia named Logan Lamb began poking around the Web site of Kennesaw State University’s Center for Election Systems, looking for vulnerabilities. The Center was under contract with the Georgia secretary of state’s office—Kemp’s office—to program and test all the voting machines in the state, train state election workers, and distribute the state’s electronic voter-registration database to the counties. With the entire state election system housed in one place, the Center was a high-value, potentially vulnerable target. Lamb, who worked for an Internet-security company called Bastille, wanted to find out how vulnerable.

On the Center’s Web site, Lamb quickly discovered a trove of unsecured files—fifteen gigabytes’ worth. Among the files were lists of passwords that would allow election workers to sign into a central server on Election Day, and the systems that prepared ballots and tabulated votes. He also found software for the state’s “poll books,” electronic databases that are often used to verify people’s eligibility to vote, as well as a security hole through which he could download the entire database of the state’s 6.7 million registered voters. The files had been publicly exposed for so long that they were cached on Google. He also saw that the Center had failed to fix a well-known glitch in its content-management system through which hackers could take control of the site. A patch for this issue had been publicly available for two years.

If you'd like a truly hair-raising experience, read the rest of the linked article about a court case, beginning last summer, which argued that Georgia had failed to guarantee the fairness of its election system:

A few weeks after the special election, a group called the Coalition for Good Governance sued Kemp and other state officials for failing to insure a fair election, free from interference. They asked, among other things, that the court invalidate the special election. (Handel took her seat in Congress the week after the election.)

The suit was filed on July 3rd. Four days later, the servers at the Center for Election Systems were wiped clean. On August 9th, less than twenty-four hours after the case was moved to the U.S. District Court for the Northern District of Georgia, all the data on the Center’s backup servers were destroyed as well.

More recently Senator Bill Nelson (D-Fl) has argued that 

Voting machines in at least one U.S. state already may have been compromised by Russian operatives ahead of the midterm elections, a Florida Democratic senator warned.

According to a report in the Tampa Bay Times, Sen. Bill Nelson claims the Russians “have already penetrated certain counties in the state and they now have free rein to move about.”

And voting machines, in general,  are not difficult to hack.  Even adults can do it:

After nearly an hour and a half, Carsten Schürmann, an associate professor with IT-University of Copenhagen, successfully cracked into a voting machine at Las Vegas' Defcon convention on Friday night CNET reports. Schürmann penetrated Advanced Voting Solutions' 2000 WinVote machine through its Wi-Fi system. Using a Windows XP exploit from 2003, he was able to remotely access the machine, CNET reports.

Given the importance of fair voting for democracy, it would seem obvious that fixing the flaws and holes in the US election systems should be of utmost priority. A good first step in that is to return to paper ballots.

But just giving the voters paper ballots or receipts to take home doesn't allow for a proper audit.  That requires each paper ballot to leave a paper copy, in a secured place, and it is those copies that should be counted when total tallies are audited.




---------
* Though decentralization makes hacking more difficult (or requires more hackers), it does not guarantee no hacking or unaffected results.

Sometimes all that is needed is to change, say,  a total of 80,000 votes in three states, in order for the outcome of the election to be changed.  If those crucial areas are known beforehand, well, the hacking job should be fairly easy. (This is a purely theoretical example, my friends.)

**  It's common for these debates to end by someone asking strong proof that the vote was illegally altered somewhere.  But if I ask for strong proof that the vote cannot be illegally altered  anywhere in the US, I tend to hear only crickets.

The trust of citizens in a democracy depends on the latter guarantees.