# Do we have time to get paper trails on electronic voting machines before November? **URL:** \ **Category:** Great Debates\ **Created:** [July 31, 2004, 2:20am UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689 "2004-07-31T02:20:00Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![BrainGlutton](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@BrainGlutton](https://boards.straightdope.com/u/BrainGlutton)\ **Post date:** [July 31, 2004, 2:20am UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/1 "2004-07-31T02:20:00Z")
We’ve had several threads on this topic, but here’s an update. “How They Could Steal the Election This Time,” by Ronnie Dugger, in _The Nation_, August 16, 2004 ([http://www.thenation.com/doc.mhtml?i=20040816&s=dugger](http://www.thenation.com/doc.mhtml?i=20040816&s=dugger), printer-friendly version at [http://www.thenation.com/docprint.mhtml?i=20040816&s=dugger](http://www.thenation.com/docprint.mhtml?i=20040816&s=dugger)): > [@](#): > > On November 2 millions of Americans will cast their votes for President in computerized voting systems that can be rigged by corporate or local-election insiders. Some 98 million citizens, five out of every six of the roughly 115 million who will go to the polls, will consign their votes into computers that unidentified computer programmers, working in the main for four private corporations and the officials of 10,500 election jurisdictions, could program to invisibly falsify the outcomes. > > \ > > The potential for fraud and error is daunting. About 61 million of the votes in November, more than half the total, will be counted in the computers of one company, the privately held Election Systems and Software (ES&S) of Omaha, Nebraska. Altogether, nearly 100 million votes will be counted in computers provided and programmed by ES&S and three other private corporations: British-owned Sequoia Voting Systems of Oakland, California, whose touch-screen voting equipment was rejected as insecure against fraud by New York City in the 1990s; the Republican-identified company Diebold Election Systems of McKinney, Texas, whose machines malfunctioned this year in a California election; and Hart InterCivic of Austin, one of whose principal investors is Tom Hicks, who helped make George W. Bush a millionaire. > > About a third of the votes, 36 million, will be tabulated completely inside the new paperless, direct-recording-electronic (DRE) voting systems, on which you vote directly on a touch-screen. Unlike receipted transactions at the neighborhood ATM, however, you get no paper record of your vote. **Since, as a government expert says, “the ballot is embedded in the voting equipment,” there is no voter-marked paper ballot to be counted or recounted. Voting on the DRE, you never know, despite what the touch-screen says, whether the computer is counting your vote as you think you are casting it or, either by error or fraud, it is giving it to another candidate.** No one can tell what a computer does inside itself by looking at it; an election official “can’t watch the bits inside,” says Dr. Peter Neumann, the principal scientist at the Computer Science Laboratory of SRI International and a world authority on computer-based risks. > > \ > > The integrity of the vote-counting inside DREs depends on audit logs and reports they print out, but as Neumann says, these are “not real audit trails” because they are themselves riggable. The DREs randomly store three to seven complete sets of alleged duplicates of each voter’s ballot, and sets of these images can be printed out after the election and manually counted. The companies claim that satisfies the requirement in the 2002 Help America Vote Act (HAVA) that “a manual audit capacity” must be available. But as informed computer scientists unanimously agree, if the first set of ballot images is corrupted, they all are. I asked Robert Boram, the chief engineer who invented a DRE sold by the RF Shoup voting-systems company, if he could rig his DRE’s three sets of ballot images. “Give me a month,” he replied. > > **The United States therefore faces the likelihood that about three out of ten of the votes in the national election this November will be unverifiable, unauditable and unrecountable.** The private election companies and local and state election officials, when required to carry out recounts of elections conducted inside the DREs, will order the computers to spit out second printouts of the vote totals and the computers’ wholly electronic, fakable “audit trail.” The companies and most of the election officials will then tell the voters that the second printouts are “recounts” that prove the vote-counting was “100 percent accurate,” even though a second printout is not a recount. > > HAVA was supposed to solve election problems revealed in 2000; instead, it has made the situation worse. Under the act the Election Assistance Commission (EAC), appointed by President Bush, is supposed to set standards for the vote-counting process, but four months before the election the new agency had only seven full-time staff members. On June 17 the EAC sent $861 million to twenty-five states, mainly to buy computerized machines for which no new technical standards have been set. Its just-appointed fifteen-member technical standards committee does not include more than one leading critic of computerized vote-counting. > > \ > > In the US Senate seven Democrats and the one Independent are co-sponsoring a bill by Senators Bob Graham and Hillary Clinton to require paper trails on DREs by November, with a loophole for jurisdictions whose officials deem it to be technologically impossible. . . . > > New Jersey Democrat Rush Holt introduced a House bill more than a year ago requiring a paper trail on DREs. It has 149 co-sponsors, including a few prominent Republicans. Holt says, “The verification has to be something that the voter herself or himself has to do”; without that, “we will never have a truly secure election.” Holt’s bill has opened up a partisan divide in the House. The chairman of the committee to which his bill is assigned, Ohio Republican Bob Ney, informed Holt that he is against the bill and would not allow a hearing on it. A few days later Graham and Holt wrote their fellow members of Congress that “without an independent, voter-verified paper trail, we will be able only to guess whether votes are accurately counted.” Last month Ney relented and scheduled two hearings. Holt plans to offer his bill as an amendment to the Treasury appropriation after Congress returns from its August recess. Graham is still mulling his strategy. > > \ > > In 2000 five out of six Georgians cast a paper ballot that could be recounted on ES&S systems. In January 2001, in a speech to the Democratic-controlled legislature, Georgia Secretary of State Cathy Cox, a Democrat who is expected to run for governor in 2006, declared that considering all the recent problems down in Florida, Georgia should adopt one “uniform electronic voting system by November 2004.” Upon Cox’s fervent recommendation of the just-born Diebold Election Systems, in May 2002 Georgia agreed to pay Diebold $54 million for 19,000 DRE voting systems. The counties and cities of Georgia had chosen their own voting machines for the last time, and, less obviously, Georgians had lost their ability to recount their votes in contested elections. > > At once Diebold set to manufacturing 282 of its AccuVote TS voting systems a day. Some of the earliest ones arriving in Georgia, sent out for use in the training of election workers, were left in a hotel conference room overnight, stolen and never recovered. Late that June the secret vote-counting codes inside nine to fourteen more of the Diebold machines were stolen. Diebold made an uncounted number of apparently illegal changes in the election-conducting code between June and November. The memory cards on which the votes on each of the computers were recorded on election day all over Georgia had no encryption. According to Rob Behler, who served as Diebold’s production deployment manager in Georgia during the first half of that summer, those cards could be used to change the results manually, precinct by precinct. > > **Incumbent US Senator Max Cleland and incumbent Governor Roy Barnes, both Democrats, were odds-on favorites to win re-election. A week before the voting an Atlanta Journal-Constitution poll showed Cleland ahead by five points, 49-44, but on election day he lost to his Republican opponent, Saxby Chambliss, by seven points, 53-46, a twelve-point swing. The loss of Governor Barnes to Sonny Perdue was even more remarkable: a one-week switch of fourteen percentage points. These were suspicious anomalies, and subsequently in a Peach State Poll one in eight Georgia voters were “not very confident” or “not at all confident” that the DREs had produced accurate results; another 32 percent were only "somewhat confident."** > > In his front parlor at home in Georgia, Rob Behler told me that just before or just as he took over the Atlanta warehouse for Diebold, some of the voting machines had been sent out to “do demos,” and in one southern county “somebody broke in and stole…[nine or] fourteen of the machines and, I think, one of the servers.” He says the vote-counting programs in the stolen computers could have been completely reconstructed by reverse engineering and employed to jimmy the election. > > \ > > Citizens can stay current on election developments via several websites: [electionline.org](http://electionline.org), a reliable and up-to-date source; [VerifiedVoting.org](http://VerifiedVoting.org), Dill’s group; [notablesoftware.com](http://notablesoftware.com), Mercuri’s site; [blackboxvoting.org](http://blackboxvoting.org), Bev Harris’s site; [countthevote.org](http://countthevote.org), the site of the Georgia group led by Jekot; and these will key into many others. For a steady flow of news stories on this subject (and a few others) from around the country, get on the e-mail list of [resist@best.com](mailto:resist@best.com). Official information concerning each state is available online at each state’s website for its secretary of state. So, I propose two issues for debate (which have not, as yet, been debated in exactly these terms): 1. How serious is the threat that these electronic voting machines will not count or report our votes honestly? 2. If that threat is serious, can we do anything about it between now and November? Is there enough time? ---
**Author:** ![laigle](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@laigle](https://boards.straightdope.com/u/laigle)\ **Post date:** [July 31, 2004, 2:42am UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/2 "2004-07-31T02:42:37Z")
The threat is very serious. Even if you ignore the… curious results and practices we’ve seen with e-voting so far, the big target for hackers, tamperers, and other assorted low lifes comes this fall. And simply knowing the election was rigged might not be enough. What do you do when every Diebold machine registers a million votes for Kevin Smith? Throw out the election? Every district with electronic voting machines will have paper ballots as well for absentee votes and power failure issues. We can ditch the machines and use those for now. Maybe by next election cycle the electronic units will be ready, but I doubt it. ---
**Author:** ![BrainGlutton](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@BrainGlutton](https://boards.straightdope.com/u/BrainGlutton)\ **Post date:** [July 31, 2004, 4:07am UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/3 "2004-07-31T04:07:58Z")
I flubbed a couple of links in that last paragraph. Let me try again: > [@](#): > > Citizens can stay current on election developments via several websites: [electionline.org](http://electionline.org), a reliable and up-to-date source; [VerifiedVoting.org](http://VerifiedVoting.org), Dill’s group; [notablesoftware.com](http://notablesoftware.com), Mercuri’s site; [blackboxvoting.org](http://blackboxvoting.org), Bev Harris’s site; [countthevote.org](http://countthevote.org), the site of the Georgia group led by Jekot; and these will key into many others. For a steady flow of news stories on this subject (and a few others) from around the country, get on the e-mail list of [resist@best.com](mailto:resist@best.com). Official information concerning each state is available online at each state’s website for its secretary of state. ---
**Author:** ![Early\_Out](https://avatars.discourse-cdn.com/v4/letter/e/6f9a4e/32.png) [@Early\_Out](https://boards.straightdope.com/u/Early_Out)\ **Post date:** [July 31, 2004, 4:22am UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/4 "2004-07-31T04:22:06Z")
While the problems associated with electronic voting machines do raise some new challenges, the lack of a paper trail isn’t one of them. For most of my adult life, I’ve voted in places that had the metal monsters, the machines with the little levers next to each candidate’s name. You’d pull down the levers for the candidates of your choice, and when you used the big handle to open the curtain, the votes were tabulated by the mechanical device. Or were they? I’m quite sure I remember instances of machines malfunctioning, and failing properly to register all of the votes cast. There were certainly no paper ballots to be recounted. A “recount” consisted of double-checking the counter wheels inside the back of the machine, and adding up the results from all of the machines again. In fact, I’ve _never_ cast a paper ballot in any election. The lack of a paper trail is hardly a new issue. ---
**Author:** ![BrainGlutton](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@BrainGlutton](https://boards.straightdope.com/u/BrainGlutton)\ **Post date:** [July 31, 2004, 5:04am UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/5 "2004-07-31T05:04:00Z")
> [@Early Out](#): > > There were certainly no paper ballots to be recounted. A “recount” consisted of double-checking the counter wheels inside the back of the machine, and adding up the results from all of the machines again. But at least that was a **trail.** Something verifiable, something in a clunky mechanical machine where any tampering would be fairly obvious. Spotting tampering in these new electronic voter machines would be much harder, maybe even impossible. From that same article in _The Nation:_: > [@](#): > > Alfred Gonzales, Durazo’s Filipino outreach specialist for voters who speak Tagalog, demonstrated the AVC, a sign on the top of which said Try It Out Today. No More Punchcards! I voted on it and asked Gonzales how I knew for sure that my vote would be counted. “Because it will be registered in the machine, saved in the hard drive, and put on a cartridge,” he said. “At the end of the day it will be in the printout of the total.” How did he know the machine would do that? “Because it has been federally certified!” he said. “There is fool-proof security.” Well, one more thing, I asked. There’s no ballot–what if you need a recount? “It’s really a matter of trusting the machine,” Gonzales said. Patting the AVC gently, he intoned with pride, “It’s really a matter of trust.” > > “These companies are basically saying ‘trust us,’” Rebecca Mercuri told the New York Times. “Why should anybody trust them? That’s not the way democracy is supposed to work.” Douglas Kellner, a leader on the New York City Board of Elections, exclaimed at a meeting of computer specialists in Berkeley this past spring, “I think the word ‘trust’ ought to be banned from election administration!” Dr. Avi Rubin, computer science professor and technical director of the Information Security Institute at Johns Hopkins University, recently testified before the federal Election Assistance Commission, “The vendors, and many election officials, such as those in Maryland and Georgia, continue to insist that the machines are perfectly secure. I cannot fathom the basis for their claims. I do not know of a single computer security expert who would testify that these machines are secure.” > > Mercuri wrote in her dissertation on vote-counting in 2001 that “security flaws (such as Trojan horse attacks)…are possible in all of the computer-based voting systems” and that providing thorough examinations of source code and other circuits for DREs that vary from municipality to municipality “is a Herculean task–one that is likely not to be affordable, even if it were accomplishable.” > > \ > > Some kids who are “really interested in computers” were playing around last year, spidering through the links on various websites, when they discovered that Diebold had an unsecured FTP site (the same one Behler had used). One of the boys noted the fact on his website. Some other material on that site–not the stuff about Diebold–attracted a lot of hits, and that automatically led Google, the cyberspace search engine, to position it among the early-listed sites for many searches. One day Bev Harris, a literary publicist in Washington who was doing research for a book on vote-counting in computers, fed Google the right search words and the FTP site itself popped up. Knowing little about computers, she turned to David Allen, who was publishing her book, and he recognized the openly posted source codes and much other data concerning Diebold voting machines. > > A small group of activists in Georgia worked with Harris. One of them, Roxanne Jekot, who runs a software consulting firm, analyzed “almost every line” of the Diebold source code and found many ways to change vote totals there and also in the Microsoft operating code. “The software is totally junk,” she says. “They sold vaporware.” Determined to get peer review of what she was finding, Jekot approached David Dill, the Stanford computer science professor. > > “Both Roxanne and Bev were very courageous and determined to lift the veil of secrecy on the code,” Dill says. “I think most academics would be much more cautious, especially about publishing the fact that they looked at the code. I certainly was, and I wasn’t about to get other people in trouble by asking them to help me. A number of us would be inclined to talk to lawyers before doing anything too bold. So it made a huge difference that Bev posted the code in New Zealand for everyone to download. That reduced but didn’t eliminate the legal risks of the Johns Hopkins/Rice University people looking at the code. If Bev and whoever else was involved in releasing this code had not been so brave, people [with strong professional reputations] might not have been able to speak out so freely.” > > After some agreements on a division of roles, Avi Rubin of Johns Hopkins and three other scientists produced a devastating twenty-three-page exposure of the Diebold software. That was followed by two more damaging technical studies in Ohio. Then a “Red Team” exercise to break the Diebold code was staged at RABA Technologies’ headquarters in Maryland. Four of the eight computer scientists on the team had worked at the National Security Agency, and the team director had been the senior technical director for the NSA. The team concluded, “A voter can be deceived into thinking he is voting for one candidate when, in fact, the software is recording the vote for another candidate.” A security vulnerability “allows a remote attacker to get complete control of the machine.” And one can “automatically upload malicious software” that will “modify or delete elections.” Some kids sniffing around in cyberspace had led, step by step, to the dawning national realization that computerized vote-counting puts democracy in grave danger. ---
**Author:** ![Oy](https://avatars.discourse-cdn.com/v4/letter/o/bc8723/32.png) [@Oy](https://boards.straightdope.com/u/Oy)\ **Post date:** [July 31, 2004, 1:44pm UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/6 "2004-07-31T13:44:24Z")
As a computer programmer, I can think of half a dozen easy ways to set it up so that one candidate would be much more likely to win (and subtly - how about one vote in 20 going to the candidate of choice? In this close election, that would be enough, and pretty closely within the margin of error in the polls.) It would be easy to include a ‘recoding’ of the machine in the shutdown sequence or when it turned midnight or at some other cue, so that the guilty software would never be detected - it would be gone. This is not a conspiracy that would take large numbers of people - the primary argument against most conspiracy theories. Two correctly placed people could do it - one programmer, one person who allows that programmer to put his/her version of the code in at the right time. And this is just at the manufacturing point - lord knows what a hacker could do! ---
**Author:** ![Revtim](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/revtim/32/1042_2.png) [@Revtim](https://boards.straightdope.com/u/Revtim)\ **Post date:** [July 31, 2004, 1:56pm UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/7 "2004-07-31T13:56:46Z")
It seems pretty simple to add a printer to what is basically a computer, and write code to send each vote to the printer. Not exactly cutting-edge technology, and it sounds like it could be implemented extremely quickly (if the system already has general printer functions). But, then all the hacker/rogue programmer would have to do is make sure his cheating code executes _before_ the code that prints the record. Then the paper trail and any recount will fail to catch it. ---
**Author:** ![BrainGlutton](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@BrainGlutton](https://boards.straightdope.com/u/BrainGlutton)\ **Post date:** [July 31, 2004, 3:13pm UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/8 "2004-07-31T15:13:15Z")
> [@Revtim](#): > > But, then all the hacker/rogue programmer would have to do is make sure his cheating code executes _before_ the code that prints the record. Then the paper trail and any recount will fail to catch it. The idea is to have the machine print a paper ballot right after the voter makes his/her final entry – so the voter can **see** that the paper ballot accurately reflects his/her votes. From the same _Nation_ article: > [@](#): > > Though no broad citizens’ movement has formed against computerized vote-counting, a nationwide backlash against unverifiable paperless voting has. The paper ballots used in the op-scan and punch-card systems already provide a voter-verified paper audit trail (VVPAT). The principal proposed security safeguard for the DRE system was invented, but not patented, ten years ago by computer scientist Rebecca Mercuri, now a research fellow at Harvard. In her solution, after voters record their choices on the touch-screen, they confirm them on a paper ballot that appears under glass and then push a button to cast the vote, causing the machine to deposit the paper ballot in a box that will hold it for recounting if that is ordered. The printer for the paper ballots for each voting machine should cost about $50; the total add-on could be $300-$600. Many jurisdictions also have the alternative of expanding or acquiring the relatively inexpensive optical-scan systems or other systems already in place that create paper trails. ---
**Author:** ![Spoke](https://avatars.discourse-cdn.com/v4/letter/s/a88e57/32.png) [@Spoke](https://boards.straightdope.com/u/Spoke)\ **Post date:** [July 31, 2004, 5:25pm UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/9 "2004-07-31T17:25:29Z")
> [@laigle](#): > > What do you do when every Diebold machine registers a million votes for Kevin Smith? It occurs to me that some patriotic hacker ought to pull just such a stunt: register a million votes for Kevin Smith, just to expose the flaws in the system. Or maybe rig it so that Ralph Nader wins, say, Georgia outright. **IF** the system can be hacked (and I am not smart enough to know whether this is so), then it seems to me the most patriotic think a concerned and computer-savvy person could do would be to commit such a blatant hack. ---
**Author:** ![BrainGlutton](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@BrainGlutton](https://boards.straightdope.com/u/BrainGlutton)\ **Post date:** [July 31, 2004, 5:43pm UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/10 "2004-07-31T17:43:03Z")
> [@spoke-](#): > > It occurs to me that some patriotic hacker ought to pull just such a stunt: register a million votes for Kevin Smith, just to expose the flaws in the system. > > Or maybe rig it so that Ralph Nader wins, say, Georgia outright. > > **IF** the system can be hacked (and I am not smart enough to know whether this is so), then it seems to me the most patriotic think a concerned and computer-savvy person could do would be to commit such a blatant hack. The danger is not that some outsider will hack the system but that the machines (which are stand-alone units, I believe, not directly connected to the Internet) will arrive at the precincts prehacked – rigged by their manufacturers, or by some groups who have an inside track with the manufacturers. In other words, rigged by Republican sympathizers to yield Republican victories. Nobody appears to be afraid of such machines being rigged to favor Democrats or Greens or Libertarians, because none of them are positioned to do the rigging. The Repubicans are. Diebold is a major GOP contributor. In fact, all the voting-machine companies appear to have a Republican bias. ---
**Author:** ![BrainGlutton](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@BrainGlutton](https://boards.straightdope.com/u/BrainGlutton)\ **Post date:** [July 31, 2004, 5:45pm UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/11 "2004-07-31T17:45:17Z")
On that note – see the bolded paragraph in the excerpt from Dugger’s article in the OP. That might be what actually happened in Georgia in 2000: Cleland was expected to win re-election to the Senate, and Barnes as governor, by comfortable margins; and it is possible they would have done so, had not somebody stolen some of the machines and reverse-engineered them and gotten into a position to rig the vote totals. ---
**Author:** ![BrainGlutton](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@BrainGlutton](https://boards.straightdope.com/u/BrainGlutton)\ **Post date:** [July 31, 2004, 5:46pm UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/12 "2004-07-31T17:46:41Z")
Sorry, Georgia in 2002, not 2000. ---
**Author:** ![Zagadka](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zagadka/32/7272_2.png) [@Zagadka](https://boards.straightdope.com/u/Zagadka)\ **Post date:** [August 1, 2004, 12:16am UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/13 "2004-08-01T00:16:22Z")
This is a rather timely issue for me. I’m sitting here in Vegas at Defcon 12, sitting by the poolside with hundreds of geeks who are proud to be hackers and general computer security experts. From some of the stuff I’ve seen here this weekend, there is no way I would trust an electronic voting system. In fact, they don’t trust anything electric even here - you have to register in cash, and none of the vendors accept credit cards. Someone hacked the air conditioning system before. Anyway, the seminars I’ve been to so far have been very interesting, but mostly they reminded me about exactly how unsecure systems are - from both ends (outside users getting in, and inside administrators managing data). No way in hell I would trust that system when even a paper system leaves so many questions. As a side note, I’ve been hearing a lot on various “civil disobediance” plots for the Republican Convention. I’m somewhat curious now to see it all happen, and how much of a reaction it will get. I don’t see how any system can be 100% secure, and it would have to be, because even a tiny hole would be total disaster. There would be two types of hacks: 1. A serious effort that would be similar to the plot of Office Space; a tiny change in the system to make a small change over a large amount of time. This would not be detected until it was possibly irreversable. This is the most dangerous. 2. A grandstanding attention whore stunt, as the aforementioned votes for Kevin Smith. This would be immediately detected, and the main result would be a smaller disaster that I hope someone has a contingency plan for. O\_o ---
**Author:** ![XT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xt/32/456_2.png) [@XT](https://boards.straightdope.com/u/XT)\ **Post date:** [August 1, 2004, 4:02am UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/14 "2004-08-01T04:02:48Z")
People will cheat if they can. The voting machine type doesn’t matter. For most of the history of US elections, fraud has gone on in one form or another…by all the major political parties. We’ve always managed to muddle through. People have stuffed ballot boxes, used dead people to cast votes, etc etc. Electronic voting machines are no different. Sure, there is potential for abuse. But there is no more potential for abuse than any other system. The ‘scary’ thing for people is they dont understand how the machines work…seems like magic. No paper trail…oh my, how will we recount?!? The reality is the systems use secure and encrypted databases. Could they be ‘hacked’? Sure they could, though its my understanding that the voting machines aren’t connected directly to the internet, but supposedly through secure point to point connections to a central repository. The physical machines though, they surely could be hacked. Guess what? So could those old clunky voting machines. ‘Hacking’ just means bypassing normal operations, and I guarentee you that you can bypass the normal operation of an analogue machine if you really wanted too. > [@AvhHines](#): > > As a computer programmer, I can think of half a dozen easy ways to set it up so that one candidate would be much more likely to win (and subtly - how about one vote in 20 going to the candidate of choice? In this close election, that would be enough, and pretty closely within the margin of error in the polls.) It would be easy to include a ‘recoding’ of the machine in the shutdown sequence or when it turned midnight or at some other cue, so that the guilty software would never be detected - it would be gone. Ok, so you add in a few lines of code that adds an extra vote for every 20 to a certain candidate…and you are a god programmer and able to do this without a trace (it IS possible). What voter registration numbers are you using for those field in your data base recording of the vote, AvhHines?? Random? Or do you have a list of ‘valid’ voter registration numbers you can use, perhaps those of dead people? How is this different than the ‘regular’ voter fraud that political party machines have used in the past?? Actually, you’d be somewhat MORE vulnerable than they are, because if you tried to insert those numbers for your 1 in 20 it would be trace-able by looking at the code. Again, sure you COULD do it, but then you can cheat with nearly anything. > [@Zagadka](#): > > From some of the stuff I’ve seen here this weekend, there is no way I would trust an electronic voting system. In fact, they don’t trust anything electric even here - you have to register in cash, and none of the vendors accept credit cards. Someone hacked the air conditioning system before. They are blowing sunshine up your skirt. If it were that easy, it wouldn’t be the election to worry about…money would be the prime goal. I’m in IT and security, have been for 15 years and even own my own IT company…I know what can and can’t be done. If these guru’s could hack and get away with credit card info or other financial data that easily, they’d all be millionares…hell billionares. They aren’t. The fact that the hotel is stupid enough to play up to them and make all transactions cash…well, there are a lot of gullable people out there. Most people and places that get their credit card info ‘hacked’ do so because they were careless…and a lot of times its a PHYSICAL security breach, not some fancy hacking routine. Again, this isn’t to say that its impossible to ‘hack’ the election, though I’d need to see exactly how the machines were configured as far as their infrastructure goes. At a guess and from what I remember from talking to a friend, the machines aren’t directly connected to anything that can be directly accessed from the outside (i.e. they don’t have an internet connection). Now, the central repositorys perhaps could be hacked (i.e. where the various districts voting records are tabulated electronically from the machines) but guess what? So could the central repositories for the old fashioned records (remember, ‘hacking’ doesn’t have to mean fancy electronic wizardry…it just means circumventing normal operations). There are certainly issues with electronic voting we need to look into. There needs to be a ‘neutral’ organization with access to the code for the voting machines as well as the tabulation machines and the data bases from the machines. There should be a way to do a check sum on the data, in case the physical machine itself was hacked (the most likely scenerio IMO). The links should be secure, encrypted point to point PRIVATE connections…no connections at all to the internet or any other pubic connection. I have no idea how many of these things HAVE been implemented (most would be my guess), but those and a few more SHOULD be implemented. There doesn’t need to be a paper trail if these things are done…it would be redundant and unnecessary. -XT ---
**Author:** ![Zagadka](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zagadka/32/7272_2.png) [@Zagadka](https://boards.straightdope.com/u/Zagadka)\ **Post date:** [August 1, 2004, 4:12am UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/15 "2004-08-01T04:12:30Z")
> [@xtisme](#): > > They are blowing sunshine up your skirt. If it were that easy, it wouldn’t be the election to worry about…money would be the prime goal. I’m in IT and security, have been for 15 years and even own my own IT company…I know what can and can’t be done. If these guru’s could hack and get away with credit card info or other financial data that easily, they’d all be millionares…hell billionares. They aren’t. The real challenge isn’t doing the crime - it is not getting caught. It is a simple matter to get the credit info and account access. The TRICKY part is doing something with it without leaving a nice trail right to yourself. Similarly, it would be rather simple to commit fraud. Anyone can do that. The hard part is to get away with it, and that is why it isn’t practiced almost constantly. However, the national presidential election is worth much more than stealing a few thousand dollars on pilfered credit cards. ---
**Author:** ![Oy](https://avatars.discourse-cdn.com/v4/letter/o/bc8723/32.png) [@Oy](https://boards.straightdope.com/u/Oy)\ **Post date:** [August 1, 2004, 12:56pm UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/16 "2004-08-01T12:56:01Z")
> [@xtisme](#): > > Ok, so you add in a few lines of code that adds an extra vote for every 20 to a certain candidate…and you are a god programmer and able to do this without a trace (it IS possible). What voter registration numbers are you using for those field in your data base recording of the vote, AvhHines?? Random? Or do you have a list of ‘valid’ voter registration numbers you can use, perhaps those of dead people? How is this different than the ‘regular’ voter fraud that political party machines have used in the past?? Actually, you’d be somewhat MORE vulnerable than they are, because if you tried to insert those numbers for your 1 in 20 it would be trace-able by looking at the code. Again, sure you COULD do it, but then you can cheat with nearly anything.-XT The difference should be obvious, **xtisme**. Stuffing ballot boxes, in order to make a big enough difference to win a national election, has to be done on a large scale. Can you have one or two people fly to every precinct in the country (or even every counting location) and somehow invisibly slip in enough false ballots to win without being noticed? Sounds like Santa Claus delivering presents to every child in the world on Xmas Eve - it can’t be done. Therefore it must be done by lots of people, and the possibility of detection is very high. There are, by definition, physical traces, and opportunities to be detected. And, in case you’re not aware, _many_ safeguards have been put into place to prevent the kinds of voter fraud that used to take place - people can vote only in a single location, and are basically signed in and checked off as they do so. I’m not saying cheating _can’t_ take place in a paper ballot system, but I _am_ saying it would have to be on a large scale to make a national difference, and that it would have to involve a _lot_ of people in on the conspiracy. Electronic voting machine fraud, as I mentioned, could be done by two people, for _every location in the nation in which those machines were used_. Three, if you want to have someone looking up the voter registration numbers of the recently (within the past four years) deceased. I don’t know if any kind of id of that nature, that connects an invidual with their vote, is stored within the systems. Which do you think is more likely to succeed - a conspiracy with lots of physical evidence, that takes hundreds if not thousands of people to implement, or a conspiracry with no physical evidence that takes three? And yes, I am a _god_ programmer. Bow down before me, mortal 😃 ---
**Author:** ![Mops](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mops/32/16494_2.png) [@Mops](https://boards.straightdope.com/u/Mops)\ **Post date:** [August 1, 2004, 2:31pm UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/17 "2004-08-01T14:31:14Z")
> [@xtisme](#): > > … The reality is the systems use secure and encrypted databases. … Sorry to disappoint, but from the reports i’ve read (e.g. in RISKS) a lot of them use _Microsoft Access_. ---
**Author:** ![XT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xt/32/456_2.png) [@XT](https://boards.straightdope.com/u/XT)\ **Post date:** [August 1, 2004, 2:31pm UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/18 "2004-08-01T14:31:18Z")
> [@AvhHines](#): > > Electronic voting machine fraud, as I mentioned, could be done by two people, for every location in the nation in which those machines were used. Three, if you want to have someone looking up the voter registration numbers of the recently (within the past four years) deceased. I don’t know if any kind of id of that nature, that connects an invidual with their vote, is stored within the systems. Are the machines connected to a public network? If so, then the people doing this are making a mistake, even if they are using multilayered firewalls. It would allow a hole in their security with no real benifite. If not, I’d like to know how you would circumvent this, unless you were in on it and on the inside. You simply can’t hack a secure private point to point encrypted link from the outside, unless you are part of the telco providing the service…and even then you’d need some pretty high powered equipment to break the encryption if the people setting it up had half a clue. And if you were on the inside, there would be easier ways to hack the system. However, same goes for analogue machines…if you have people on the inside it becomes easy to hack a lot of machines…no need for ‘Santa Clause’. 🙂 As to whether or not a voter ID is one of the fields in the vote data base, I assume its in there somewhere. I seriously doubt that the data base record consists of a single vote field containing the candidate voted for. Somewhere there is a record of WHO voted, even if its not key linked to the actual vote…and that means that if you are going to monkey with the code to allow for a vote in 20 for your candidate you are going to need to also put in a voter ID code. Again, this is an assumption, though I have a friend that worked on an electronic voter systems a few years ago, and at least her code worked that way. > [@AvhHines](#): > > And yes, I am a god programmer. Bow down before me, mortal And I’m a god like IT engineer. Everyone I’ve ever met in IT was an arrogant son of a bitch…and with good cause. Millions, even billions of dollars rest on our decisions, and we are all so young (well, I was when I first started anyway). 😃 -XT ---
**Author:** ![Oy](https://avatars.discourse-cdn.com/v4/letter/o/bc8723/32.png) [@Oy](https://boards.straightdope.com/u/Oy)\ **Post date:** [August 1, 2004, 2:47pm UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/19 "2004-08-01T14:47:00Z")
I’m thinking in terms of being on the inside, rather than hacking. Electronic voting machines are not performing a very sophisticated function, and it would be easy enough to have the “right” programmer in the right place at the right time. ---
**Author:** ![BrainGlutton](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@BrainGlutton](https://boards.straightdope.com/u/BrainGlutton)\ **Post date:** [August 1, 2004, 3:17pm UTC](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689/20 "2004-08-01T15:17:56Z")
> [@xtisme](#): > > Ok, so you add in a few lines of code that adds an extra vote for every 20 to a certain candidate…and you are a god programmer and able to do this without a trace (it IS possible). What voter registration numbers are you using for those field in your data base recording of the vote, AvhHines?? Random? Or do you have a list of ‘valid’ voter registration numbers you can use, perhaps those of dead people? How is this different than the ‘regular’ voter fraud that political party machines have used in the past?? Actually, you’d be somewhat MORE vulnerable than they are, because if you tried to insert those numbers for your 1 in 20 it would be trace-able by looking at the code. Again, sure you COULD do it, but then you can cheat with nearly anything. No, **x,** they wouldn’t do it by **adding** votes but by **altering** them. Every 20th vote for Kerry is recorded as a vote for Bush. Much easier to get away with. Might already have been done (Georgia in 2002). > [@xtisme](#): > > There needs to be a ‘neutral’ organization with access to the code for the voting machines as well as the tabulation machines and the data bases from the machines. Check out this thread: [http://boards.straightdope.com/sdmb/showthread.php?t=264462](http://boards.straightdope.com/sdmb/showthread.php?t=264462) [Next page](https://boards.straightdope.com/t/do-we-have-time-to-get-paper-trails-on-electronic-voting-machines-before-november/257689.md?page=2)