Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security Government United States Politics

Punchscan Wins Open Source Voting Competition 98

Posted by kdawson from the at-least-they're-foss-hanging-chads dept.
An anonymous reader writes "Punchscan emerged victorious at the open source university voting systems competition, VoComp. For their efforts, they will receive the US$10,000 prize provided by ES&S (which has recently been named in a scandal in Florida). The second-place team put up a good fight: 'Per Ron Rivest, one of the contest's judges, the runner-up team, the Pret-a-Voter team from the University of Surrey in the UK, gave Punchscan a tough run for the first-place money until the Punchscan team dug through Pret-a-Voter's source code and found a significant security flaw in their random number generation. Oops.' It will be interesting to see if these systems ever make it into the mainstream. Kudos to ES&S for showing their forward thinking in this area, as the other voting machine vendors, such as Diebold, did not support the competition."
This discussion has been archived. No new comments can be posted.

Punchscan Wins Open Source Voting Competition More

Punchscan Wins Open Source Voting Competition

Comments Filter:

  • So (Score:2, Funny)

    by Anonymous Coward
    A system with a significant flaw in security comes second?

    • Re:So (Score:5, Insightful)

      by inaequitas ( 885724 ) on Tuesday July 24, 2007 @03:47PM (#19974285) Homepage
      What do you expect, when one with an undocumented number of security flaws is marked for real-life use?

      But an interesting competition. Puts responsibility back in the way people write their code, not license it and hide behind the legalese.
    • Well, this flaw found in the second place team's code is the perfect example of why e-voting software should be open source. If it was hidden, odds are that flaw would never be discovered; and might not require a deliberate attack to cause problems in the future.

      There is a strong correspondence between e-voting and encryption technology. The assumption for all encryption technology is that evesdroppers will always know your method (i.e., the source code), so instead you make that knowledge useless by using

  • Why do they use a random number generator? (Score:4, Funny)

    by Intron ( 870560 ) on Tuesday July 24, 2007 @03:50PM (#19974333)
    Does this explain the last two presidential elections?

    • Re: (Score:3, Insightful)

      by raddan ( 519638 )
      Without knowing the specifics of the system, I'd guess it's probably used as some part of an authentication token. You want to make sure that you can verify that the printed paper receipts correspond to a vote, but you don't want to give away the voter's identity, right? Random numbers are frequently used where you need a shared secret or seed for an encryption algorithm to work on, and encrypted secrets or seeds are often a part of an authentication system. Numbers that are "random enough" are difficult
    • No, if the president was truly selected randomly [stochasticracy.net], then a second-party candidate might have won.

  • How can reciepts ever work? (Score:1, Interesting)

    by Anonymous Coward
    Take home receipts are vulnerable to exploits that make them seem useless. Any random voter could go home and make a fake receipt to claim the results were tampered with. Sure, you could combat that by keeping record of which ballots, with their identifying numbers, were passed out, but if you're going to tamper with the election results, you could delete the vote from the count and the list, then when the voter complains their vote wasn't counted you could claim they faked their ballot...

    • Re:How can reciepts ever work? (Score:5, Informative)

      by InvisblePinkUnicorn ( 1126837 ) on Tuesday July 24, 2007 @04:01PM (#19974503)
      "Any random voter could go home and make a fake receipt to claim the results were tampered with."

      TFA explains how that would be pointless, since the pairing of letters with names is different on each form. The receipt doesn't tell you anything about who you voted for, only what letters you chose. And if their point was to try to change an election, they would need a large group of people to be in on it to guarantee their desired outcome, and the larger the group, the more likely their fraud would be to be exposed.
      • Well since they used a random number generator, I assume that there is a cryptographic reason that they can't forge the receipt as well ...

      • Re: (Score:3, Insightful)

        by Not_Wiggins ( 686627 )
        And if their point was to try to change an election, they would need a large group of people to be in on it to guarantee their desired outcome, and the larger the group, the more likely their fraud would be to be exposed.

        More to your point, if you could organize that many people to swing the vote a certain way, couldn't you have just gotten those same people to vote your way at the start without any fraud?

    • Re: (Score:2)

      by Aerion ( 705544 )
      Sure, you could combat that by keeping record of which ballots, with their identifying numbers, were passed out, but if you're going to tamper with the election results, you could delete the vote from the count and the list, then when the voter complains their vote wasn't counted you could claim they faked their ballot...

      You can make a copy of each receipt at the polling place and give it to one or more trusted third parties (e.g. the League of Women Voters, or the ACLU (supposing for the moment that none o

  • The only problem I see with this (Score:5, Funny)

    by InvisblePinkUnicorn ( 1126837 ) on Tuesday July 24, 2007 @03:55PM (#19974419)
    The only problem I see with this system, as it was with the hanging chads, is that people with poor vision or low brain power will be easily confused by the way the choices are out-of-order. Maybe they could use colored letters to make it easier to match them up, or even use pictures, e.g. a dog for Clinton, a snake for Giuliani.

    • Re: (Score:3, Interesting)

      by techno-vampire ( 666512 )
      They were already using that in Shakespeare's time: "The Cat, the Rat and Lovel the Dog, rule all England under the Hog."

    • ... Maybe they could use colored letters to make it easier to match them up, or even use pictures, e.g. a dog for Clinton, a snake for Giuliani.
      So, you're saying just use the pictures of the candidates themselves?

  • Irrelevant (Score:2, Insightful)

    by Gothmolly ( 148874 )
    To quote a now dead, but once very powerful man: "He who votes decides nothing. He who COUNTS the votes decides everything."
    It's charming to see people coming up with Open Source voting and other governmental tools, but extremely naive to think that they'll ever be implemented. Even if they make their way into governmental dialog, they'll be co-opted by Diebold, et.al. in the 11th hour before any policy is changed.
    • Even more disturbing...how will we know if they're implementing an open source system? If a voting machine is a black box, it wouldn't exactly be easy to determine whether or not the source code originates from an open source system.

    • Re: (Score:1)

      by AP2k ( 991160 )
      Another, once very powerful man, said the Jews were the root of all problems. Yet another said to take everything with a grain of salt.

      • Re: (Score:2)

        by shrubya ( 570356 )
        Yeah yeah, and we may as well throw in "A witty saying proves nothing" from Voltaire.

        In this case, however, the words were backed by real action. Comrade Joe was indeed the one counting the votes, and he did in fact end up deciding everything in his nation.
      • It was a pharoh who said to take everything with a grain of salt?

    • It's charming to see people coming up with Open Source voting and other governmental tools, but extremely naive to think that they'll ever be implemented.

      Well, if users could verify that their vote was accurately counted, doesn't that kind of undermine the purpose of staging an election?

    • To quote a now dead, but once very powerful man: "He who votes decides nothing. He who COUNTS the votes decides everything."

      Quite true. At least we can get a fair count with this system, or a verifiable count. I expect an OSS system would be first used by small towns in low tax areas. Chaum's desire for licensing revenue could scuttle the whole ship, though. Can somebody please give him a grant to keep him happy? He's done good work, but a patent on this kind of think can do bad things for democracy.

      Spe

  • More publicity for OSS voting machines, please. (Score:5, Insightful)

    by TheDarkener ( 198348 ) on Tuesday July 24, 2007 @03:59PM (#19974477) Homepage
    We need more than preaching to the choir - everyone should link to this from their blogs, post it as a bulletin to their friends on Myspace, etc. etc. etc.... the more people hear about these things, the more likely it will be that we actually start using OSS-based voting machines on a large scale.

    3 2 1, GO!
    • Hearing is not caring.
    • I love OSS as much as the next Slashdotter, but I'm not sure it's a panacea here.

      As long as the system relies on software, rather than something that can be physically verified, to actually tally votes, then you are at the mercy of the software. And that is a problem. Even if the code is available, you still have a long way to go. You have to ensure that the code that's running on every one of the voting machines is actually the source code that's available. And you have to have a completely clean, verified
      • Did you RTFA? You can verify your votes at a later time online with your vote tally. This is a major element in verifying election integrity. Sure, it isn't perfect - but what truly is? We're always chasing after a better solution, and this is definitely a better solution than what we have right now.

        How about redundancy...I think we can all agree that the more independent, distributed systems that are in place to verify voting integrity, the better. It's hard to hack 10 separate systems to change voting res

      • Re: (Score:2)

        by rtb61 ( 674572 )
        Actually you do not really need to even pay people to do the work, just shift the elections to a Saturday and hold the booths open for 12 hours, so that the majority of people can more readily participate.

        Elections and democracy are about people, I absolutely can not understand why some governments are so desperate to get people out of the system, it should be driven as an inclusionary process, is it fundamentally the most important part, the ultimate defining act of any democracy.

        Sure you might have el

    • Re: (Score:2)

      by Yvanhoe ( 564877 )
      OSS based machine doesn't solve anything. How can you be sure that the published source is the one being used by the machine ? I am sorry, I see no way of doing this with an electronically programmable machine.
  • I think it was a comment here that once suggested a voting system where users could ensure that their vote counted.
    Every registered voter has a public / private key.
    Votes are digitally signed by the voters.
    Then after the election (or during), the signed messages are posted online.
    Voters would be able to see that their vote counted in the right direction, and unless someone else knows your private key, nobody would be able to tell who you voted for.

    The non-digital analog to this went something like this. Th

    • Re: (Score:1, Insightful)

      by Anonymous Coward
      And then after the election, cousin vinnie comes along and says "ok, now you prove that you voted for uncle enzo, or I break your kneecaps". Since you do have a method of proving who your vote was for, you're kinda stuck...

      The solution to high-tech fraud is not "make low tech fraud easy". We've seen this sort of low tech fraud in the past; while scale problems make it hard to pull off for president, it's common in smaller-scale elections.

      Moreover, a fraudster now just has to be careful to not change votes

      • Re: (Score:2)

        by Aerion ( 705544 )

        And then after the election, cousin vinnie comes along and says "ok, now you prove that you voted for uncle enzo, or I break your kneecaps". Since you do have a method of proving who your vote was for, you're kinda stuck...

        This is exactly right. I can force you to surrender your private key. What if you refuse? My, eh, associates will break your legs.

        How can I verify that the private key you provide is actually yours? Your odds of randomly guessing a valid private key are terrible, but it's trivial to verify that a private key is valid for some ballot. I can brute-force check every signed ballot against your private key.

        If one of them does match, and the matching ballot shows that you didn't vote for my guy, my associates wi

      • Re: (Score:1)

        by ydra2 ( 821713 )
        No public key is needed. You just make up something that you can remember, such as "The quick brown fox" or a single letter or anything you can remember. If it's already been used, you have to change it, by making it all caps, or maybe every second letter capital, or adding something to it, ot whatever to make it unique. When you search online the search will simplly return the ten (or whoever many you chose), closest matches to whatever you enter. Then you find one that voted for uncle enzo and you say "Th

    • Re:public key techonology (Score:4, Insightful)

      by bobdehnhardt ( 18286 ) on Tuesday July 24, 2007 @05:01PM (#19975381)

      Voters would be able to see that their vote counted in the right direction, and unless someone else knows your private key, nobody would be able to tell who you voted for.


      That "unless" part is the biggest problem with this approach. Digitally signing the ballot eliminates the anonymity of it. On measures that are controversial or highly contentious (stem cell research, gay marriage, abortion, legalization of drugs, to name a few), people need to be able to cast their votes without fear of reprisal or being ostracized be their community. If I'm digitally signing my ballot, that creates a solid link between me and my votes, which may make me reluctant to vote in ways that don't conform with the views of my neighbors.

      Of course, the Government has a solid reputation of keeping secrets, so there's no chance that the ballot data could be stolen [newsnet5.com], hacked [virginia.edu] or otherwise compromised [stltoday.com], or have their contents improperly made available to the general public [pcworld.com]. And encryption never [slashdot.org], ever [slashdot.org] gets cracked. And the public would never fall for any tricks to get them to divulge their passphrase or surrender their key (for example, a phishing site claiming to be a Voter Verification Portal). Nope, the security here is 100%, nothing to worry about, just go about your business....
      • Digitally signing the ballot eliminates the anonymity of it

        Not so, fortunately. Think about it. You can verify a signed object against a public key without knowing who owns the corresponding private key. There is nothing in the key pair itself which carries identity.

        And if you make use of a certificate infrastructure, you can verify that the public half of the key pair was signed by an authority whose identity you do know.

        Certificates can be used to carry many sorts of identity, including anonymize

        • Not so, fortunately. Think about it. You can verify a signed object against a public key without knowing who owns the corresponding private key. There is nothing in the key pair itself which carries identity.

          Of course, someone know who owns the corresponding private key, unless identity is not provided in order to have the key issued, or the key and the provided identity are never connected in the process.

          Even the threat that they might be connected covertly by government could have a distorting effect on

          • unless identity is not provided in order to have the key issued, or the key and the provided identity are never connected in the process

            Exactly, like a double blind.

      • The if the fear of the unlikely chance of voter key compromise is reason enough to put you off on voting freely we've already lost.

    • Every registered voter has a public / private key.
      Votes are digitally signed by the voters.
      Then after the election (or during), the signed messages are posted online.
      Voters would be able to see that their vote counted in the right direction, and unless someone else knows your private key, nobody would be able to tell who you voted for

      Someone issued your public/private key combo, and probably required your identity when they provided it to you. That someone knows your private key.

      • Someone issued your public/private key combo, and probably required your identity when they provided it to you. That someone knows your private key.
        Not necessarily. The voting machine can generate the key pair, and sign it with its own certificate. Then it gives you the private key in a printout. The machine doesn't need to know who's voting at it, just that it is some voter.

        • Re: (Score:1)

          by ragefan ( 267937 )

          Someone issued your public/private key combo, and probably required your identity when they provided it to you. That someone knows your private key.

          Not necessarily. The voting machine can generate the key pair, and sign it with its own certificate. Then it gives you the private key in a printout. The machine doesn't need to know who's voting at it, just that it is some voter.

          As it has been mentioned before in many threads, anytime the ability is given to verify your vote at a later time opens the ability for fraud as well. Examples include a candidate (or supporter) offers cash for every verifiable vote, or an employer requiring proof to keep ones job.

          I think the best solution I've heard is that the voting machine does nothing more than prompt for votes and then print the ballot in clear text with the selections marked showing the votes placed that the voter can verify visual

          • As it has been mentioned before in many threads, anytime the ability is given to verify your vote at a later time opens the ability for fraud as well.

            This is true in many cases, but its quite possible to have a system where the voter has the information to verify their vote, but no one else can with any certainty verify the voters vote, even with the voters receipt. Of course, such a system necessarily cannot be used to by the voter to challenge the results if their is fraud, it can only provide personal

    • IIRC, one of the challenges Chaum set himself is to avoid reliance on cryptography, because it would be too hard for users to understand.

      Having said that, I'm not sure if his system doesn't suffer from the same problem.

      On the other hand, the system you proposed can fail in ways that Chaum's can't. For example, your private key could be obtained by a malicious party, or they could coerce you into proving whom you voted for.

  • Was it a fair competition? (Score:5, Funny)

    by 91degrees ( 207121 ) on Tuesday July 24, 2007 @04:18PM (#19974753) Journal
    After seeing the machines, the 6 judges cast their votes electronically. The votes were 2 for Pret-a-voter, 3 for Punchscan and 107,345 for Diebold.
    • When Louisiana upgraded our voting machines, we sold our old voting machines to Mexico. Let me tell you, the Mexicans were really pissed when Edwin Edwards [wikipedia.org] won the election for President of Mexico!

      Don't believe all the bad things you have read about Lousiana politics. In all reality, it is much much worse!

  • Just wanted to mention that one of the graduate students behind Punchscan, Richard Carback, was/is a grad student in Computer Science at the University of Maryland, Baltimore County. Way to get UMBC mentioned on Slashdot, Rick!
    • This is why you're supposed to think before you post... But anyway, to add to his praise (and my previous comment), apparently Rick was the one who spotted the security hole in the other group's system. The judges were reported to have been very impressed. =)

  • But... (Score:3, Funny)

    by AntsInMyPants ( 819105 ) on Tuesday July 24, 2007 @04:56PM (#19975325)
    How did they count the votes to determine who won?
  • I would like to have had the chance to put my mailclad.com idea into the running on that one.

    Anyhow I need to actually get my code up on sourceforge first I guess.

    Anyone want to help get this thing off the ground.

    John

  • In the North Carolina case, ES&S attributed the problem to a software glitch that caused the machines to falsely sense that their memories were full. Although the machines allowed voters to continue to cast ballots, the votes were not recorded.

    I guess they figured that, for PR reasons, it was better to silently throw out votes than inform the voter that the ballot box was stuffed^w full.

  • For something that is literally the heart of democracy, i.e., voting, proprietary systems are anathema. May Diebold act in accordance with its name, dying a bold and noble death, in searing flames....

  • Diebold Afraid to Compete vs Superior Products (Score:3)

    by CodeBuster ( 516420 ) on Tuesday July 24, 2007 @05:26PM (#19975687)
    as the other voting machine vendors, such as Diebold, did not support the competition.

    Of course they didn't support it. The first or second place projects in the competition are both better than the crappy voting system marketed by Diebold and they are *free*. If your competition is free and it is better then you are in a world of hurt. Diebold is the classic example of a company which didn't make a very good transition of expertise in physical real world security products to software products.
    • Seems to me that this raises two clear points in favour of these systems being open to inspection... 1) Univ. of Surrey's entry was presumably strong except for the random number generator, now that's been highlighted it should be easily fixed. So in a roundabout way, Surrey should be grateful that the problem was found, and we should all be grateful that there are two strong contenders for an OSS voting system. 2) It looks like the most direct way to find these issues is to look at the source, If Diebold
  • While the Punchscan system appears to resolve the problems of auditability and vote tampering quite well, the issuance of a ballot receipt - no matter how indirect - allows verifiable vote buying.

    The system also does not resolve one of the key points of HAVA - which, while deeply flawed, addresses some very deeply held concerns of disabled voters. That problem is one of ballot access - Punchscan is not disabled-friendly.

    • Re: (Score:1, Informative)

      by Anonymous Coward
      Actually, if you had read about punchscan at all you would know that it specifically does not allow vote verification. The voter takes a receipt home with them yes, but when they go to verify that their vote has been counted they see the scanned image of the receipt they hold in their hands. These two identitical halves cannot be used to show how one voted, only that their vote was received as expected.
      • If the punchscan system doesn't allow me show other people who I voted for, then how does it allow me to show myself who I voted for? Sure their scanned in copy looks the same as mine. Now, prove to me that showing me a scanned document proves that it was actually tallied correct (ie. the computer read the ballot as I would have), and that the same information was sent to the database.
    • Thank you for posting one of the more coherent comments in this thread.

      Even more unimpressive is the dramatic lack of understanding of the complexity of various state's laws with regard to voting (for example, many states require specific and repeatable candidate ordering), and the lack of understanding of how easily the average voter is overwhelmed by the least complexity (many voters are barely able to follow the simplest instructions such as "Vote for One," and "Mark only in the oval").

      A system that resu

    • Re: (Score:2)

      by Aerion ( 705544 )

      The system also does not resolve one of the key points of HAVA - which, while deeply flawed, addresses some very deeply held concerns of disabled voters. That problem is one of ballot access - Punchscan is not disabled-friendly.
      It's no less unfriendly than current pen-and-paper systems, and is almost as easily adapted. Nothing prevents Punchscan from using Braille or some other method for assisting the visually-impaired.
      • Actually Punchscan is very disabled friendly. For example, if you are unable to physically mark a ballot and need an aide, that aide would typically see how you vote. With Punchscan, you can show one ballot half to the voter and the give the other half to the aide. The voter can tell the aide to mark "a" or "b" or whatever, and the aide will have no idea who the vote is being counted for. With the visually impaired, you can use braille or you can use audio ballots. Check out the Punchscan page for more:
      • A bit late on the response, but I thought I should get back to you...

        Punchscan does not address physical handicaps; people with CP, MD and other severely disabling diseases cannot use paper systems - they have to have computer-assisted voting if they want to vote on their own without assistance.

        Braille doesn't assist with ballot verification. How do you know your ballot was just marked? Ballot receipts are not a secure answer, and they only work if you check up after the election is over.
  • ... my first thought was, "So what kind of voting machine did they use to count the votes for best voting machine? Was is the Punchscan machine?"
    • good post you really added something to the world with that groundbreaking comment

      • good post you really added something to the world with that groundbreaking comment
        Ouch! I've had my point of view criticized plenty of times here, but I was unprepared for angry replies to a silly comment. For future reference, what's this about? Did I break some /. rule, or was it just not funny enough?
    • My, that's such a thought! What would the code auditors say if they would have thought of this possi- oh wait, your comment is useless.
  • ...if your vote didn't matter, the weasels wouldn't try so hard to mess with the count. Votes matter--never doubt it.
  • So, the free and open source solution has won a competition. Is the point now to somehow compel Diebold to seriously consider actually using this open source solution?

    • Re: (Score:2)

      by Aerion ( 705544 )

      So, the free and open source solution has won a competition.

      Well, the competition was only open to free and open source solutions. So that's not the important part.

      Is the point now to somehow compel Diebold to seriously consider actually using this open source solution?

      Presumably, the point is that the publicity will let everybody know that a free, open source solution actually exists. It doesn't matter if Diebold adopts it, or somebody else, so long as somebody does.

    • I think that one of the points was to go beyond whining about how much existing voting machines suck, by actually providing a better alternative.
    • The whole point of OSS alternative is to prevent a shady corp to introduce untrustworthy elements into the final product, so an OSS based Dielbolt voting machine would still be as suspect as their current closed source ones.
  • ``a significant security flaw in their random number generation''

    Inquiring minds want to know: what was the flaw?

Slashdot Top Deals

"What man has done, man can aspire to do." -- Jerry Pournelle, about space flight

Close