Month: October 2006

The “We do not trust voting computers” foundation in The Netherlands have performed a quite superb security analysis of the Nedap voting machines used there.

They lucked into getting their hands on first one then two more voting machines, a major breakthrough of their own. Starting work on August 23rd, 2006 they managed to find and publish numberous flaws by October 6th, 2006. Incredible work but also testament to how poor these systems are.

In a lovely tale of international unintended consequences, the findings of the Irish Independent Commission on Electronic Voting provided a head-start for the researchers as Ireland also has Nedap machines.

A quick summary of the flaws found:

• Physical locks on the machines use the same key for all 8,000 machines in The Netherlands. The key for the locks is readily available for purchase at one Euro each, there is only one key made to fit this model lock.

• A supposedly restricted maintenance mode has its password hard-coded as the Dutch word for 'secret'.

• To demonstrate that the machines are just computers built from standardised components and that they had fully understood the workings, they reprogrammed a machine to play chess.

• A program “Nedap PowerFraud” was developed to electronically stuff the ballot memory of a Nedap machine, but only in real elections and not test situations.

• TEMPEST or Van Eck phreaking, that is eavesdropping radio signals from the Nedap machines presents convincing opportunities for knowing how users have voted.

It's very interesting that despite all these attacks and a few others mentioned in the report, the Nedap machines actually meet all Dutch regulatory requirements. Of course there is nothing stopping the supplier exceeding those requirements (not likely, I know) but in many senses this report is a devastating critique not of the technology but of the specifications and regulations provided by the Dutch authorities.

You can watch an Irish news report about all this here [Real]

• Full security analysis report [PDF]
• Detailed pictures of the machines used
• Links to oodles of technical data
• English language press coverage of these findings
• Blog entry with some background on the chess!
• Blog entry with more details on the rubbish lock/key used
• YouTube videos of some of the attacks (in Dutch)

Many thanks to Anne-Marie Oostveen for letting me know about this early, but being snowed under this hasn't emerged on here until after it go Slashdotted!

A quick round-up of coverage on the 2007 e-voting pilots announcement.

• The Register with a short but sweet jab at the muddled logic of the announcement.
• Silicon.com report it pretty straight.
• A linux sysadmin, tory blogs his criticisms
• Somebody a Warwick university doubts councils are the right people to be running these pilots

In other news, I'm afraid it looks like Ireland are going try to use their e-voting machines again:

• Ahern makes case for e-voting
• E-voting machines to be used in 2009 despite warnings

The Times reports today that the UK will be investigated by the Council of Europe for electoral fraud and alleged breaches of human rights. The announcement currently relates specifically to postal vote related fraud particularly the aftermath of the infamous Birmingham postal vote fraud case which caused Labour serious embarrassment and lead to outspoken comments from presiding Judge Richard Mawrey:

“Anybody who has sat through the case I have just tried and listened to evidence of electoral fraud that would disgrace a banana republic would find [government assurances about postal voting] surprising” (Source: BBC)

Postal voting is extremely problematic, particularly when an election is all-postal. However electronic voting creates the opportunities for fraud on a much wider scale whilst being considerably harder to detect. Additionally remote electronic voting continues to breach human rights treaties demanding a secret ballot. So, given yesterday's announcement of pilots in 2007, I hope this investigation is widened to include electronic voting.

(Thanks to Ian Brown for the tip-off)

Sorrow of sorrows but in spite of all the evidence showing that e-voting is A Bad Idea, today the Department for Constitutional Affairs has announced plans for electronic voting pilots to be held in May 2007 and are inviting proposals.

The prospectus states:

Research for the Electoral Commission released in 2003 shows there is significant
demand for electronic voting and that it may help stem the declining turnout at elections.

Yet the Electoral Commission’s own figures for the 2003 pilots showed that e-voting had no significant impact on turnout (more info)

It would seem that a year makes all the difference as in September 2005 Harriet Harman MP, a minister responsible said to Radio 4 that:

“We just think that the time is not right for it (e-voting) at the moment. We talked to a lot of people, we listened to a lot of views including from the Conservative Party. The general consensus seemed to be that the time is not right for it at the moment. So we are not going ahead with the pilots that we were planning to run otherwise in the May 2006 council elections.” (Source: The Independent)

What has changed since Ms Harman said those words, I do not know. Since 2003 The Electoral Commission have been repeatedly calling for a clear framework or road-map to be set out by government but nothing has emerged. Still they seem to be happily going along with these pilots. Why?

Some good news is that SMS, digital TV and all-postal voting have all been ruled out for 2007. Sense prevailed there thank goodness!

Despite repeated criticism from The Electoral Commission, suppliers, councils and qualified observers such as myself, the timetable is again tight. Applications close 17th November leaving the usual scant time for supplier selection, contractual agreements and technical work to be completed. Indeed the prospectus timetable leaves only February and March for development and testing – madness!. This process should, at the latest, have been begun in the summer. Also with the central electronic voter register project stalled, I wonder if now is a good time to be piloting anything?

Immediate Action

Please write to your local councillors asking them to ensure that your local council does not waste tax payer money and risk the integrity of elections by applying to run a pilot.

Use WriteToThem for quick access to your local councillors.

Learn more:

• The uncertain nature of elections to come [PDF] – detailed report on the serious failings in the planning, management and implementation of the 2003 pilots

• Electronic Voting Doesn’t work – written for Electoral Reform Society

• LEARN: I want to understand the issues – learn about the pros and cons of voting methods