[ISN] Gambling on Voting

From: InfoSec News (isn@private)
Date: Mon Jun 14 2004 - 22:53:41 PDT

  • Next message: InfoSec News: "[ISN] ITL Bulletin for June 2004"

    June 13, 2004
    If election officials want to convince voters that electronic voting 
    can be trusted, they should be willing to make it at least as secure 
    as slot machines. To appreciate how poor the oversight on voting 
    systems is, it's useful to look at the way Nevada systematically 
    ensures that electronic gambling machines in Las Vegas operate 
    honestly and accurately. Electronic voting, by comparison, is rife 
    with lax procedures, security risks and conflicts of interest.
    On a trip last week to the Nevada Gaming Control Board laboratory, in 
    a state office building off the Las Vegas Strip, we found testing and 
    enforcement mechanisms that go far beyond what is required for 
    electronic voting. Among the ways gamblers are more protected than 
    1. The state has access to all gambling software. The Gaming Control 
    Board has copies on file of every piece of gambling device software 
    currently being used, and an archive going back years. It is illegal 
    for casinos to use software not on file. Electronic voting machine 
    makers, by contrast, say their software is a trade secret, and have 
    resisted sharing it with the states that buy their machines.
    2. The software on gambling machines is constantly being spot-checked. 
    Board inspectors show up unannounced at casinos with devices that let 
    them compare the computer chip in a slot machine to the one on file. 
    If there is a discrepancy, the machine is shut down, and investigated. 
    This sort of spot-checking is not required for electronic voting. A 
    surreptitious software change on a voting machine would be far less 
    likely to be detected.
    3. There are meticulous, constantly updated standards for gambling 
    machines. When we arrived at the Gaming Control Board lab, a man was 
    firing a stun gun at a slot machine. The machine must work when 
    subjected to a 20,000-volt shock, one of an array of rules intended to 
    cover anything that can possibly go wrong. Nevada adopted new 
    standards in May 2003, but to keep pace with fast-changing technology, 
    it is adding new ones this month.
    Voting machine standards are out of date and inadequate. Machines are 
    still tested with standards from 2002 that have gaping security holes. 
    Nevertheless, election officials have rushed to spend hundreds of 
    millions of dollars to buy them.
    4. Manufacturers are intensively scrutinized before they are licensed 
    to sell gambling software or hardware. A company that wants to make 
    slot machines must submit to a background check of six months or more, 
    similar to the kind done on casino operators. It must register its 
    employees with the Gaming Control Board, which investigates their 
    backgrounds and criminal records.
    When it comes to voting machine manufacturers, all a company needs to 
    do to enter the field is persuade an election official to buy its 
    equipment. There is no way for voters to know that the software on 
    their machines was not written by programmers with fraud convictions, 
    or close ties to political parties or candidates.
    5. The lab that certifies gambling equipment has an arms-length 
    relationship with the manufac- 
    turers it polices, and is open to inquiries from the public. The 
    Nevada Gaming Control Board lab is a state agency, whose employees are 
    paid by the taxpayers. The fees the lab takes in go to the state's 
    general fund. It invites members of the public who have questions 
    about its work to call or e-mail. 
    The federal labs that certify voting equipment are profit-making 
    companies. They are chosen and paid by voting machine companies, a 
    glaring conflict of interest. The voters and their elected 
    representatives have no way of knowing how the testing is done, or 
    that the manufacturers are not applying undue pressure to have flawed 
    equipment approved. Wyle Laboratories, one of the largest testers of 
    voting machines, does not answer questions about its voting machine 
    6. When there is a dispute about a machine, a gambler has a right to 
    an immediate investigation. When a gambler believes a slot machine has 
    cheated him, the casino is required to contact the Gaming Control 
    Board, which has investigators on call around the clock. Investigators 
    can open up machines to inspect their internal workings, and their 
    records of recent gambling outcomes. If voters believe a voting 
    machine has manipulated their votes, in most cases their only recourse 
    is to call a board of elections number, which may well be busy, to 
    lodge a complaint that may or may not be investigated.
    Election officials say their electronic voting systems are the very 
    best. But the truth is, gamblers are getting the best technology, and 
    voters are being given systems that are cheap and untrustworthy by 
    comparison. There are many questions yet to be resolved about 
    electronic voting, but one thing is clear: a vote for president should 
    be at least as secure as a 25-cent bet in Las Vegas. 
    ISN mailing list
    Sponsored by: OSVDB.org - For 15 cents a day, you could help feed an InfoSec junkie!
    (Broke? Spend 15 minutes a day on the project!)

    This archive was generated by hypermail 2b30 : Tue Jun 15 2004 - 02:21:54 PDT