Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Bugtraq
[Top] [All Lists]

Re: Diebold Global Election Management System (GEMS) Backdoor Account Al

Subject: Re: Diebold Global Election Management System (GEMS) Backdoor Account Allows Authenticated Users to Modify Votes
Date: Wed, 29 Sep 2004 09:59:17 +0200
How do you know that the software generating the audit trail is playing 
fair if it's closed source?

Sometimes, IMHO, there's just no alternative to pen and paper.  Surely 
the manual method of ticking a box and having multiple human vote 
counters checking ballots is the best option going, even if it is more 
expensive.  (I confess I've no idea what costs are involved either way.)

i don't think that you can save a lot of money, if you implement the
same 'security' and 'auditability'. i've monitored two elections in an
east european country this year. people's confidence into democracy
isn't very strong in this country and there might have been some
incidences that you wouldn't expect within long established democracies
but in general the premisses are the same.

from my point of view you cannot guarantee any human auditability
without a paper trail, in the form that the voting machine prints a
ballot that will be put into a ballot box within public sight, meaning
that independent monitors can see that everybody throws exactly one
ballot into that box. thus you will need some kind of election comitee
in every polling station that takes care of those ballot boxes (seals
them after the vote and securely transports them to the next authority).
like this you will maybe save on the counting, but with voting districts
not bigger than 2000 people human counting took no longer than 3 hours
and you will not save on bureaucratic processes that account the proper
procedures with sealing and handing over the ballot boxes.

from my expirience with voting in not so established democracies it
becomes clear that the whole voting process has to be understandable by
everybody not only some tech geeks and crypto specialists. because if
some provincial politicians are not able to verify the fairness of the
vote they will call for a recount. OOS even with Open Source Hardware
(yes who tells me that Party A's votes don't get counted by a chip that
calculates 1+1=3) with Public Records cannot be sufficient for that.
Because if Joe and Jane Average don't understand the process the same
way Bruce Schneier does they have the right for a manual recount and
than we haven't saved any money. That's democracy.

Not everything that can be done by machines is automatically better, as
if we would do it by hand.

float 
-- 
-----------------------------------------------------------------------
                       _        |    .''`.Florian Klinglmueller   
ASCII ribbon campaign ( )       |   : :'  :debian-ppc user        
 - against HTML email  X        |   `. `'`                      
             & vCards / \       |     `- float@jabber.org          
------------------------------------------------------------------------

<Prev in Thread] Current Thread [Next in Thread>