Russia’s cyberattack on the U.S. electoral system before Donald Trump’s election was far more widespread than has been publicly revealed, including incursions into voter databases and software systems in almost twice as many states as previously reported. In Illinois, investigators found evidence that cyber intruders tried to delete or alter voter data. The hackers accessed software designed to be used by poll workers on Election Day, and in at least one state accessed a campaign finance database….the Russian hackers hit systems in a total of 39 states
In Decoding Liberation: The Promise of Free and Open Source Software, Scott Dexter and I wrote:
Oversight of elections, considered by many to be the cornerstone of modern representational democracies, is a governmental function; election commissions are responsible for generating ballots; designing, implementing, and maintaining the voting infrastructure; coordinating the voting process; and generally insuring the integrity and transparency of the election. But modern voting technology, specifically that of the computerized electronic voting machine that utilizes closed software, is not inherently in accord with these norms. In elections supported by these machines, a great mystery takes place. A citizen walks into the booth and “casts a vote.” Later, the machine announces the results. The magical transformation from a sequence of votes to an electoral decision is a process obscure to all but the manufacturers of the software. The technical efficiency of the electronic voting process becomes part of a package that includes opacity and the partial relinquishing of citizens’ autonomy.
This “opacity” has always meant that the software used to, quite literally, keep our democracy running has its quality and operational reliability vetted, not by the people, or their chosen representatives, but only by the vendor selling the code to the government. There is no possibility of say, a fleet of ‘white-hat’ hackers–concerned citizens–putting the voting software through its paces, checking for security vulnerabilities and points of failure. The kinds that hostile ‘black-hat’ hackers, working for a foreign entity like, say, Russia, could exploit. These concerns are not new.
Dexter and I continue:
The plethora of problems attributed to the closed nature of electronic voting machines in the 2004 U.S. presidential election illustrates the ramifications of tolerating such an opaque process. For example, 30 percent of the total votes were cast on machines that lacked ballot-based audit trails, making accurate recounts impossible….these machines are vulnerable to security hacks, as they rely in part on obscurity….Analyses of code very similar to that found in these machines reported that the voting system should not be used in elections as it failed to meet even the most minimal of security standards.
There is a fundamental political problem here:
The opaqueness of these machines’ design is a secret compact between governments and manufacturers of electronic voting machines, who alone are privy to the details of the voting process.
The solution, unsurprisingly, is one that calls for greater transparency; the use of free and open source software–which can be copied, modified, shared, distributed by anyone–emerges as an essential requirement for electronic voting machines.
The voting process and its infrastructure should be a public enterprise, run by a non-partisan Electoral Commission with its operational procedures and functioning transparent to the citizenry. Citizens’ forums demand open code in electoral technology…that vendors “provide election officials with access to their source code.” Access to this source code provides the polity an explanation of how voting results are reached, just as publicly available transcripts of congressional sessions illustrate governmental decision-making. The use of FOSS would ensure that, at minimum, technology is held to the same standards of openness.
So long as our voting machines run secret, proprietary software, our electoral process remains hackable–not just by Russian hackers but also by anyone that wishes to subvert the process to help realize their own political ends.
6 thoughts on “Proprietary Software And Our Hackable Elections”
Pencil and paper is still the hardest system to hack, if I’m not mistaken.
In fear of possible election meddling by any foreign or non-foreign entity, the Netherlands reverted to the classic ‘red pencil’ after just one election cycle using voting machines.
The Dutch system allows any party to run as many candidates as they want, so with a record number of parties running, the ballot was enormous on the 15th of March. Not surprisingly and rightfully so, environmental organizations complained about the waste of paper. Of course, this would not be a problem in the case of the U.S. or French presidential elections with only a small number of candidates on the ballot, however, a simple solution exists. Instead of machines or red pencils, we could have voting machines that print a simple, small receipt with the candidate of choice, you then check whether it’s correct after which you put the receipt in the ballot box. Easy, no meddling, no waste of paper, no waste of pencils.
Just an idea.
All it takes is that the source code be readable (and inspected by public authorities). The software does not need to be FOSS. Furtheremore, FOSS software is easier to break than proprietary.
Some support for that claim would be useful. For the contrary claim, please see chapter 3 of my book, Decoding Liberation.
The «transformation from a sequence of votes to an electoral decision» could be made fully transparent by documenting the software (for clarity) and allowing access to the source code (for verification). Hence, the requirement for the software to be FOSS is too restrictive. It would be fine with me; but it is a tougher restriction than what would be strictly necessary, as FOSS means more than just source code availability. Best regards.