![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
from news:comp.risks
Date: Fri, 21 Jul 2006 22:20:30 +0200
From: Erling Kristiansen <erling.kristiansen@xs4all.nl>
Subject: Voting machines in Ireland and The Netherlands
According to EDRIGRAM, the on-line newsletter of "European Digital Rights",
number 4.14:
On 4 July 2006, the Irish Commission on Electronic Voting released its
second report on the secrecy and accuracy of the e-voting system purchased
by the Irish Government.
The summary remarks at the beginning of the 200 page report say: "The
Commission concludes that it can recommend the voting and counting equipment
of the chosen system for use at elections in Ireland, subject to further
work it has also recommended, but that it is unable to recommend the
election management software for such use."
The "further work" includes, among others:
1) add a voter verified audit trail;
2) replace the election management software (which prepares election
data, reads votes from "ballot modules", and calculates results) with a
version that is developed to mission critical standards;
3) modify the embedded software within the voting machines to bring it
up to mission critical standard;
4) make certain modifications to the machines themselves;
5) test all components to mission critical standard;
6) modify the specification for the PC that is to be used for vote management;
7) test the system as a whole (including end-to-end testing) to mission
critical standard;
8) rectify the security vulnerabilities identified in the way data is
transferred within the system.
This is quite a mouthful. In particular, the "mission critical standards"
may be quite difficult to achieve as a retrofit. The article speculates
that the responsible minister, who declares his intention to continue the
project, "may not realize the extent of the changes required". [Or is it a
polite way of saying "No thank you"? -EK]
Full article at http://www.edri.org/edrigram/number4.14/evotingireland
The article includes several links, including a link to the full report.
As far as I can make out from various sources, the voting machines in
question are essentially the same as the Nedap machines used in The
Netherlands for years. Little public criticism of these machines appears in
the general press.
But they do, indeed, have problems: According to the "Bits of Freedom"
newsletter:
In a local election, one candidate got 1, 3, 7, and 181 votes, respectively,
in the 4 polling stations where he was a candidate. The candidate not only
was en election official in the high-vote station, he operated the machine!
Peter Knoppers, according to the article an expert on voting machines, is
quoted saying that manipulation of the machine by a voting official is "a
piece of cake". For example, if a key is turned at the exact moment of the
vote being acknowledged by the voter, the vote will not be counted. The
missed votes can then be added manually at a later time, for any candidate
of your choice.
Full story (in Dutch) at
http://www.bof.nl/nieuwsbrief/nieuwsbrief_2006_14.html
This article also has several links, all in Dutch.
Date: Fri, 21 Jul 2006 22:20:30 +0200
From: Erling Kristiansen <erling.kristiansen@xs4all.nl>
Subject: Voting machines in Ireland and The Netherlands
According to EDRIGRAM, the on-line newsletter of "European Digital Rights",
number 4.14:
On 4 July 2006, the Irish Commission on Electronic Voting released its
second report on the secrecy and accuracy of the e-voting system purchased
by the Irish Government.
The summary remarks at the beginning of the 200 page report say: "The
Commission concludes that it can recommend the voting and counting equipment
of the chosen system for use at elections in Ireland, subject to further
work it has also recommended, but that it is unable to recommend the
election management software for such use."
The "further work" includes, among others:
1) add a voter verified audit trail;
2) replace the election management software (which prepares election
data, reads votes from "ballot modules", and calculates results) with a
version that is developed to mission critical standards;
3) modify the embedded software within the voting machines to bring it
up to mission critical standard;
4) make certain modifications to the machines themselves;
5) test all components to mission critical standard;
6) modify the specification for the PC that is to be used for vote management;
7) test the system as a whole (including end-to-end testing) to mission
critical standard;
8) rectify the security vulnerabilities identified in the way data is
transferred within the system.
This is quite a mouthful. In particular, the "mission critical standards"
may be quite difficult to achieve as a retrofit. The article speculates
that the responsible minister, who declares his intention to continue the
project, "may not realize the extent of the changes required". [Or is it a
polite way of saying "No thank you"? -EK]
Full article at http://www.edri.org/edrigram/number4.14/evotingireland
The article includes several links, including a link to the full report.
As far as I can make out from various sources, the voting machines in
question are essentially the same as the Nedap machines used in The
Netherlands for years. Little public criticism of these machines appears in
the general press.
But they do, indeed, have problems: According to the "Bits of Freedom"
newsletter:
In a local election, one candidate got 1, 3, 7, and 181 votes, respectively,
in the 4 polling stations where he was a candidate. The candidate not only
was en election official in the high-vote station, he operated the machine!
Peter Knoppers, according to the article an expert on voting machines, is
quoted saying that manipulation of the machine by a voting official is "a
piece of cake". For example, if a key is turned at the exact moment of the
vote being acknowledged by the voter, the vote will not be counted. The
missed votes can then be added manually at a later time, for any candidate
of your choice.
Full story (in Dutch) at
http://www.bof.nl/nieuwsbrief/nieuwsbrief_2006_14.html
This article also has several links, all in Dutch.