- cypherpunks-legacy - lists.cpunks.org

Re: The cages on the Hudson, AKA Little Guantanamo (fwd)
by Sunder 01 Sep '04

01 Sep '04

Wheee! NYC==Police State for the last week for those of you living under rocks... ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"Our enemies are innovative and resourceful, and so are we. /|\ \|/ :They never stop thinking about new ways to harm our country /\|/\ <--*-->:and our people, and neither do we." -G. W. Bush, 2004.08.05 \/|\/ /|\ : \|/ + v + : War is Peace, freedom is slavery, Bush is President. ------------------------------------------------------------------------- ---------- Forwarded message ---------- Date: Wed, 1 Sep 2004 15:26:13 -0400 From: Edward Potter To: grimmwerks Cc: wwwac <wwwac(a)lists.wwwac.org> Subject: Re: [wwwac] Yes, it's relevent! The cages on the Hudson, AKA Little Guantanamo He's out. You can't get near the place today. I tell people what happened and they can't believe it. I would not have believed it either, except I was there for 11 hours. Then another 15 hours downtown. Excellent first hand account here: http://nyc.indymedia.org/newswire/display/107675/index.php If I had not been arrested, I would not have known anything like this was going on. 1000- 2000 people, in barb-wire cages, at this very moment on the Hudson River. No joke. Totally surrounded by police. ACLU lawyers, Reporters, everyone being denied access. Just starting to hit the media. -ed On Sep 1, 2004, at 2:57 PM, grimmwerks wrote: > I read the same thing - and the guy with the bike is STILL there? And > held > on what grounds? Has any pics surfaced yet? > > > On 9/1/04 2:51 PM, "Edward Potter" <ejp(a)well.com> wrote: > >> I cross posted this to the Politics list, just getting so little media >> coverage, and yes, I met a few Java Programmers there, plus the guy >> that has the bike that writes messages by WifI got nailed by the >> police >> too (writing "America Home of the Free") ... so I guess hopefully the >> word gets out. >> --------------- >> >> Does anyone on this list know there are now up to 2000 people >> imprisoned in barb-wire cages on the Hudson River that don't know what >> their charges are, have not had any rights read to them and are being >> denied any access to any legal representation? >> >> I was there, it was real. It would blow your mind. YOU HAVE NEVER SEEN >> ANYTHING LIKE IT IN AMERICA BEFORE. >> >> Or as the police call it: Little Guantanamo >> >> Keep up with the news here: >> http://nyc.indymedia.org > > > ## The World Wide Web Artists' Consortium - http://www.wwwac.org/ ## ## To Unsubscribe, send email to: wwwac-unsubscribe(a)lists.wwwac.org ##

1 0

Re: Remailers an unsolveable paradox?
by Major Variola (ret) 01 Sep '04

01 Sep '04

At 01:30 PM 9/1/04 +0200, Nomen Nescio wrote: > Yet we need >to make sure we're not abused too much since sooner or later laws >will catch up with the remailers should abuse sky-rocket. You need a Bill of Rights that specifies freedom of expression, and judges that understand it. Since you appear to be European, where eg singers can be busted for singing political songs, these ideas may be foreign to you. > Using techniques like Hashcash should be >more or less mandatory even today to make it harder to mailbomb or >send large amounts spam? Why is it not? Because when someone tells us that something is *mandatory*, we tell them to fuck off, and we put them on our watch list. OTOH nothing prevents you from 1. implementing a hashcash-based node 2. automatically filtering what you receive. > Regardless of what any hardcore cypherpunk or old-timers in the >remailer community may think about any ideas imposing restrains on >the useability of remailers something just have to be made about the >abuse of the system. Will no one think of the chiiildren? > Making sure we have robust remailing services in one shape or >another and at the same time have some kind of at least indirect >acceptance from legislators and also a low degree of spam flowing >through are essential goals. Any legislator seeking to control how people use a communications medium needs killing. > The average naive and ignorant redneck will never ever understand >the principal arguments for free speech that makes remailers useful. That's why mob rule^H^H^H^H democracy loses to the constitution. If you don't have the latter, you suffer the former. >The average american do not think and analyze what is told to him. Well duh. > Since providing a true non-censoring remailing service and at the >same time safeguard against spam and abuse are therotically >incompatible I guess remailers are indeed a paradox waiting to be >shut down sooner or later by politicians if we're not open to at >least discuss some aspects of how these services are operated. Why not use one of those "are you human" visually-distorted checks that various websites use? That is robust to automated spam. Adding *voluntary* hashcash to remailer injection nodes is another layer of defense in depth against spammers. BTW, while spam is abuse, is a threatening message really abuse, or just uncomfortable feedback?

1 0

Re: Remailers an unsolveable paradox?
by hal＠finney.org 01 Sep '04

01 Sep '04

Spam is the least of the problems for remailers when it comes to abuse. You should be more concerned about possible liability for illegal messages. In a way, spam has actually made the remailer operator's life easier as people today are used to receiving annoying and obscene email. Ten years ago, when I ran a remailer, people were genuinely shocked to receive unsolicited pornography. Yes, it's hard to believe today, but in those quaint times, when the Internet was in black and white, most users got only a few email messages a day and they were all from their friends, family and co-workers. As far as spam, next-generation remailers should incorporate hashcash, www.hashcash.org, to make sending an anonymous message relatively costly. Let it take a minute or more to generate the "stamp" necessary for a message to enter the remailer system and spam will not be a problem, while legitimate users will have no barrier. Hal

1 0

making your own stamps
by Major Variola (ret) 01 Sep '04

01 Sep '04

http://www.thesmokinggun.com/archive/0831041_photostamps_1.html?link=eaf

1 0

RE: Remailers an unsolveable paradox?
by Tyler Durden 01 Sep '04

01 Sep '04

Some good points, Johnny. I'm not convinced Spam and the remailers are inherently incompatible. Or at least, I'm thinking there's a sort of uncertainty principle that should work between legit remailable messages and spam. it may be a tricky business, but I suspect that the need of spammers to send out huge numbers of messages may be exploitable. Hell...they may in some ways be an asset if handled correctly: Much easier to hide remailed messages in larger torrents than in sparsely trafficked remailer networks. And of course, it may be that the need to sell goods (ie, from a specific URL) means that anonymity is not so useful, particularly if there are time+bandwidth constraints on portions of the network (eg a remailer has a max bandwidth that gets throttled back if there's a large woosh of traffic in a certain period of time). So I don't think the problem is unsolvable, but I agree with your essential point that it needs looking into. -TD >From: Nomen Nescio <nobody(a)dizum.com> >To: cypherpunks(a)al-qaeda.net >Subject: Remailers an unsolveable paradox? >Date: Wed, 1 Sep 2004 13:30:01 +0200 (CEST) > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >Are remailers an unsolveable paradox? > > We want to be able to provide the means for whistleblowers and >others to communicate in a secure and anonymous fashion. Yet we need >to make sure we're not abused too much since sooner or later laws >will catch up with the remailers should abuse sky-rocket. > > Once upon a time all email servers were open relays. This was a >friendly time and spam wasn't invented. As time changed the focus >turned on securing the relaying procedures and has continued until >this day. Yet as we know the flow of spam (most of it coming directly >or indirectly from US) continued to increase, despite even existing >legislation today. > > What are the possible solutions for the remailers? Make all >remailers middleman only and adding the ability to opt-in for >delivery outside the network? Having a network of middleman remailers >and some nymservers that only delivers to other nymserver or opted-in >servers will at least provide some means for people to communicate >between themselves. It would in practise destroy the ability to >contact anyone outside the network though, making the network an >isolated place for a few. Using techniques like Hashcash should be >more or less mandatory even today to make it harder to mailbomb or >send large amounts spam? Why is it not? > > Regardless of what any hardcore cypherpunk or old-timers in the >remailer community may think about any ideas imposing restrains on >the useability of remailers something just have to be made about the >abuse of the system. I also predict that the abuse will increase so >time is ticking in a sense. > > Making sure we have robust remailing services in one shape or >another and at the same time have some kind of at least indirect >acceptance from legislators and also a low degree of spam flowing >through are essential goals. > > The average naive and ignorant redneck will never ever understand >the principal arguments for free speech that makes remailers useful. >The average american do not think and analyze what is told to him. >You will probably today find millions of americans who believe that >Saddam and Al-Qaeda did business just because Bush and the >administration lied about that initially, even though it's more or >less confirmed today that those links were not there. > > The rednecks also vote however (to some extent) and that's why it >will be a piece of cake to strike against the remailers if the >politicians would like to. And they will, if and when serious abuse >were to happen more often utilizing remailers. What would happen if >it was found (or simply suspected or claimed) that some terror deed >was planned using remailers? How long time would it take for us to >see new laws being proposed? Not long. And don't forget that anyone >(like Tom Ridge himself) could send bogues messages through the >system trying to > > Since providing a true non-censoring remailing service and at the >same time safeguard against spam and abuse are therotically >incompatible I guess remailers are indeed a paradox waiting to be >shut down sooner or later by politicians if we're not open to at >least discuss some aspects of how these services are operated. > > >Johnny Doelittle > > >-----BEGIN PGP SIGNATURE----- >Version: Tom Ridge Special v1.01 > >iQA/AwUBQTWdszVaKWz2Ji/mEQJlUwCfT/jWnw/p2ydTJTKMYKA5/hs+Dm8AoNoE >r9bl2EtJ3CQpZPgfkSPfGBWB >=B8dt >-----END PGP SIGNATURE----- > > > > > > Effective today, Lemuria will be going middlemen. > > > > Sometime around the middle of the month, Lemuria will go away. > > > > This is final. > > > > > > The main reasons are that I've lost my faith in the usefulness of > > the remailer network. I have indications that the remailer network > > is > > being massively abused, on the scale where the legitimate mails are > > a tiny fraction that would be better served using other means. > > > > There are two main reasons for my thoughts. One is I have looked at > > the bounces I receive, and compared their numbers to my statistics. > > According to that data, without having run a statistically > > significant analysis, the major traffic coming through Lemuria is > > Spam, with > > threats and harrassment a second. I realize that in the no-bounces, > > the fraction of legitimate mails will be higher, but even assuming > > a factor of 10, it is still a negligable part. > > > > Second, I've the mail attached below yesterday. In case you can't > > read german, it is essentially spam advertising the mixmaster > > software and some book and/or software I haven't tested, might be a > > mixmaster > > client, might be a trojan. This is a sign for me that the anonymous > > remailer network is being used systematically for abuse, on a large > > scale. I don't want to be a part of that. > > > > As mixmaster has no features whatsoever to prevent this crap, and > > the "encrypted only" switch doesn't do what it should do, and > > legitimate traffic is close to zero anyways, I'll be taking Lemuria > > down and > > leaving the remailer community. > > > > It was an interesting time, and between frog, the SciTol fanatics > > (from both sides) and a couple really cool people, I've learned a > > lot about society that I'm not sure I really needed to know. :) _________________________________________________________________ On the road to retirement? Check out MSN Life Events for advice on how to get there! http://lifeevents.msn.com/category.aspx?cid=Retirement

1 0

Re: Another John Young Sighting
by Tyler Durden 31 Aug '04

31 Aug '04

> > You may laugh but 74% (or whatever is the % who believes Saddam >personally > > piloted all 9/11 planes) of americans will believe it. > > > > So Mr. Young is anarchist for all practical purposes and consequences. > > And you are all his associates. Well, they did have the little info-stripe under John Young's face that said "Anarchist", so that proves it. Too bad they didn't use the shakey-letter scary font. -TD "Listen to the music...he's evil!" (Homer Simpson) _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

Backdoor found in Diebold Voting Tabulators
by Sunder 31 Aug '04

31 Aug '04

Oops! Is that a cat exiting the bag? http://www.blackboxvoting.org/?q=node/view/78 Issue: Manipulation technique found in the Diebold central tabulator -- 1,000 of these systems are in place, and they count up to two million votes at a time. By entering a 2-digit code in a hidden location, a second set of votes is created. This set of votes can be changed, so that it no longer matches the correct votes. The voting system will then read the totals from the bogus vote set. It takes only seconds to change the votes, and to date not a single location in the U.S. has implemented security measures to fully mitigate the risks. <SNIP> ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"Our enemies are innovative and resourceful, and so are we. /|\ \|/ :They never stop thinking about new ways to harm our country /\|/\ <--*-->:and our people, and neither do we." -G. W. Bush, 2004.08.05 \/|\/ /|\ : \|/ + v + : War is Peace, freedom is slavery, Bush is President. -------------------------------------------------------------------------

4 4

Re: Backdoor found in Diebold Voting Tabulators
by Major Variola (ret) 31 Aug '04

31 Aug '04

http://www.blackboxvoting.org/?q=node/view/77 is up Seems its due to an intentional, insider job, and not just as an "engineering backdoor" (c) Cisco Consumer Report: Part 2 - Problems with GEMS Central Tabulator Submitted by Bev Harris on Thu, 08/26/2004 - 11:38. Investigations This problem appears to demonstrate intent to manipulate elections, and was installed in the program under the watch of a programmer who is a convicted embezzler. According to election industry officials, the central tabulator is secure, because it is protected by passwords and audit logs. But it turns out that the GEMS passwords can easily be bypassed, and the audit logs can be altered and erased. Worse, the votes can be changed without anyone knowing, including the officials who run the election. Multiple sets of books (Click "read more" for the rest of this section) The GEMS program runs on a Microsoft Access database. It typically recieves incoming votes by modem, though some counties follow better security by disconnecting modems and bringing votes in physically. GEMS stores the votes in a vote ledger, built in Microsoft Access. Any properly designed accounting program will allow only one set of books. You can't enter your expense report in three different places. All data must be drawn from the same place, and multiple versions are never acceptable. But in the files we examined, we found that the GEMS system contained three sets of "books." The elections official never sees the different sets of books. All she sees is the reports she can run: Election summary (totals, county wide) or a "Statement of Votes Cast" (totals for each precinct). She has no way of knowing that her GEMS system uses a different set of data for the detail report (used to spot check) than it does for the election totals. The Access database, which contains the hidden set of votes, can't be seen unless you know how to get in the back door -- which takes only seconds. Ask an accountant: It is never appropriate to have two sets of books inside accounting software. It is possible to do computer programming to create two sets of books, but dual sets of books are prohibited in accounting, for this simple reason: Two sets of books can easily allow fraud to go undetected. Especially if the two sets are hidden from the user. A hidden trigger The data tables in accounting software automatically link up to each other to prevent illicit back door entries. In GEMS, however, by typing a two-digit code into a hidden location, you can decouple the books, so that the voting system will draw information from a combination of the real votes and a set of fake votes, which you can alter any way you see fit. That's right, GEMS comes with a secret digital "on-off" switch to link and unlink its multiple vote tables. Someone who tests GEMS, not knowing this, will not see the mismatched sets of books. When you put a two-digit code into a secret location can you disengage the vote tables, so that tampered totals table don't have to match precinct by precinct results. This way, it will pass a spot check -- even with paper ballots -- but can still be rigged. How and when did the double set of books get into GEMS? Black Box Voting has traced the implementation of the double set of books to Oct. 13, 2000, shortly after embezzler Jeffrey Dean became the senior programmer. Dean was hired as Vice President of Research and Development in September 2000, and his access to the programs is well documented through internal memos from Diebold. The double set of books appeared in GEMS version 1.17.7. Almost immediately, according to the Diebold memos, another Diebold programmer, Dmitry Papushin, flagged a problem with bogus votes appearing in the vote tables. The double set of books remained, though, going through several tweaks and refinements. From the time Jeffrey Dean was hired in September, until shortly before the Nov. 2000 election, GEMS went through over a dozen changes, all retaining the new hidden vote tables. For four years, anyone who has known how to trigger the double set of books has been able to use, or sell, the information to anyone they want. Black Box Voting Associate Director Andy Stephenson has obtained the court and police records of Jeffrey Dean. It is clear that he was under severe financial stress, because the King County prosecutor was chasing him for over $500,000 in restitution. During this time, while Jeffrey Dean was telling the prosecutor (who operated from the ninth floor of the King County Courthouse) that he was unemployed, he was in fact employed, with 24-hour access to the King County GEMS central tabulator -- and he was working on GEMS on the fifth floor of the King County Courthouse. (Dean may now be spending his nights on the tenth floor of the same building; after our investigations appeared in Vanity Fair and the Seattle Times, Dean was remanded to a work release program, and may be staying in the lockup on in the courthouse now.) Jeffrey Dean, according to his own admissions, is subject to blackmail as well as financial pressure over his restitution obligation. Police records from his embezzlement arrest, which involved "sophisticated" manipulation of computer accounting records, report that Dean claimed he was embezzling in order to pay blackmail over a fight he was involved in, in which a person died. So now we have someone who's admitted that he's been blackmailed over killing someone, who pleaded guilty to 23 counts of embezzlement, who is given the position of senior programmer over the GEMS central tabulator system that counts approximately 50 percent of the votes in the election, in 30 states, both paper ballot and touch screen. And just after he is hired, multiple sets of books appear in GEMS, which can be decoupled, so that they don't need to match, by typing in a secret 2-digit code in a specific location. Dr. David Jefferson, technical advisor for California voting systems, told Black Box Voting that he could see no legitimate reason to have the double set of books in a voting program. He surmised that it might be incredible stupidity. Dr. Jefferson should speak to Jeffrey Dean's partners and those who worked with him. "Stupid" is not how he is described. The descriptions we get, from Dean's former business partner, and from others who worked with him, are "sophisticated," "cunning," "very bright," "highly skilled," and "a con man." This is the man who supervised the programming for GEMS when the multiple set of books was installed. Diebold, however, is the company that did nothing about it. Internal memos show that Dean was sent the passwords to the GEMS 1.18.x files months after Diebold took over the elections company. Diebold clearly did not examine the GEMS program before selling it, or, if it did, chose not to correct the flaws. And after exposing this problem in 2003, Diebold still failed to correct it. Elections were run on this tamper-inviting system for more than three years, and anyone who knew could sell the vote-tampering secrets to anyone they wanted to, at any time. It has been a year since this report was first printed, and Diebold has never explained any legitimate reason for this design, which is rather elegant and certainly is not accidental. Consumer Report: Part 3 - More GEMS problems, and why current solutions / explanations won't work Submitted by Bev Harris on Thu, 08/26/2004 - 11:33. Investigations But do new security measures solve the problem? The MS Access database is not passworded and can be accessed illicitly through the back door simply by double-clicking the vote file. After we published this report, we observed unpassworded access on the very latest, GEMS 1.18.19 system in a county elections office. Some locations removed the Microsoft Access software from their GEMS computer, leaving the back door intact but, essentially, removing the ability to easily view and edit the file. However, you can easily edit the election, with or without Microsoft Access installed on the GEMS computer. As computer security expert Hugh Thompson demonstrated at the Aug. 18 California Secretary of State meeting, you simply open any text editor, like "Notepad," and type a six-line Visual Basic Script, and you own the election. Some election officials claim that their GEMS central tabulator is not vulnerable to this back door, because they limit access to the GEMS tabulator room and they require a password to turn on the GEMS computer. However... (Click "read more" for the rest of this section) Any county that uses modems to transfer votes may inadvertently be giving control of the entire central tabulator to anyone who gets at the computer through the modem phone lines (even if it is NOT attached to the Internet). This allows Diebold, or any individual, to manipulate votes at their leisure, from any personal computer anywhere in the world. Let's talk about getting at the central tabulator through telephone lines: Mohave County, Arizona, for example, has six modems attached to its GEMS computer on election night. King County, Washington has had up to four dozen modems attached at once. You will hear that the GEMS machine is stand alone, and is never connected to the Internet. It does have an Internet component, called "jresults," but nowadays most counties say that they do not hook GEMS up to the Internet. They say that they remove the disk from the GEMS computer and physically take it to another computer, from whence the Internet feed comes. Very nice -- BUT: You can access a computer through phone lines as well as through the Internet. In fact, famous hacker Kevin Mitnick liked to hack through telephone lines, not the Internet. If you have the dial-in numbers, it is possible to get at the GEMS computer from anywhere, using RAS. The dial-in protocols are given to poll workers, many people in Diebold have them, lots of temps have them, and the configurations have been sitting on the Internet for several years. What if your county doesn't use any modems at all? That's excellent, but here's what we found: Harris & Stephenson visited county elections officials to ask for lists of names. We asked who was allowed to access the central tabulator, after it was already turned on, and who is given a password and permission to sit at the terminal? Several officials told us they don't keep a list. Those who did, gave us the names of too many people -- County employees (sometimes limited to one or two). Diebold employees. Techs who work for the county, like county database technicians, also get access to GEMS. Printshops who do the ballots have some access also. Diebold "contractors," who are temporary workers hired by subcontractors to Diebold were also reported to have gained access to the GEMS tabulator. (Diebold accounts payable reports obtained by Black Box Voting indicate that Diebold advertises for temps on Monster.com, hotjobs.com, and uses several temporary employment firms, including Coast to Coast Temporary, Ran Temps Inc, and also works with many subcontractors, like Wright Technologies, Total Technical Services, and PDS Technical Services.) What if there is a password even to get onto the GEMS computer itself? There usually is. The problem is this: Once that computer is open and running GEMS (on election night, for example), that password doesn't much matter. Votes are pouring in pell-mell, and they aren't about to shut that computer down until hours later, sometimes days later. Also, Black Box Voting found another problem with the design of GEMS: Check out the Audit Log, which is supposed to record everything that happens. In every database, you find everyone logging is as the same person, "admin." There is a reason for this. We did not find a way in GEMS to log in as a new user unless you close GEMS and reopen the file. Now who, on election night, with votes pouring in, is going to close and reopen the file? They don't. Instead, everyone calls themselves the same name, "admin," thereby ruining the audit log (which can be easily erased and changed anyway.) What about counties that limit access to just one person, the county elections supervisor? We've found nowhere that actually does this. The reason: Elections officials are dependent on the vendor, Diebold, during the election. Suppose we have a computer whiz county official who is the ONLY person who can access GEMS? Unlikely, but if you do: "Trust, but verify." We should never have to trust the sanctity of a million votes to just one person. The following things can be done when you go in the back door in GEMS using Microsoft Access: 1) You can change vote totals. 2) You can change flags, which act as digital "on-off" switches, to cause the program to function differently. According to internal Diebold memos, there are 32 combinations of on-off flags. Even the programmers have trouble keeping track of all the changes these flags can produce. 3) You can alter the audit log. 4) You can change passwords, access privileges, and add new users. Let's talk about passwords How many people can have passwords to GEMS? A sociable GEMS user can give all his friends access to the vote database. We added 50 people, and gave them all the same password, which was "password" -- so far, we haven't found a limit to how many people can be granted access to the election database. Election meltdown: We found that you can melt down an election in six seconds, simply by using the menu items in GEMS. You can destroy all data with two mouse clicks, and with four mouse clicks, you can destroy the configuration of the election making it very difficult to reload the original data. Does GEMS even work as advertised? According to testimony given before the Cuyahoga Elections Board, the Microsoft Access database design used by Diebold's GEMS program apparently becomes unstable with high volume input. This problem, according to Diebold, resulted in thousands of votes being allocated to the wrong candidate in San Diego County in March 2004. The Audit Log Britain J. Williams, Ph.D., is the official voting machine certifier for the state of Georgia, and he sits on the committee that decides how voting machines will be tested and evaluated. Here's what he had to say about the security of Diebold voting machines, in a letter dated April 23, 2003: "Computer System Security Features: The computer portion of the election system contains features that facilitate overall security of the election system. Primary among these features is a comprehensive set of audit data. For transactions that occur on the system, a record is made of the nature of the transaction, the time of the transaction, and the person that initiated the transaction. This record is written to the audit log. If an incident occurs on the system, this audit log allows an investigator to reconstruct the sequence of events that occurred surrounding the incident. Since Dr. Williams listed the audit data as the primary security feature, we decided to find out how hard it is to alter the audit log. We went in the front door in GEMS and added a user named "Evildoer." We had Evildoer perform various functions, including running reports to check his vote-rigging work, but only some of his activities showed up on the audit log. When we had Evildoer melt down the election, by hitting "reset election" and declining to back up the files, he showed up in the audit log. No matter. It was a simple matter to eliminate Evildoer. We went in through the back door and simply deleted all the references to Evildoer. Microsoft Access encourages those who create audit logs to use auto-numbering, so that every logged entry has an uneditable log number. Then, if one deletes audit entries, a gap in the numbering sequence will appear. However, we found that this feature was disabled, allowing us to write in our own log numbers. We were able to add and delete from the audit without leaving a trace. Could the double set of books be legitimate? From a programming standpoint, there might be reasons to have a special vote ledger that disengages from the real one. For example, election officials might say they need to be able to alter the votes to add provisional ballots or absentee ballots. If so, this calls into question the training of these officials. If election officials are taught to deal with changes by overwriting votes, regardless of whether they do this in vote ledger 1 or vote ledger 2, this is improper. Also, if it was legitimate, it would be a menu item in the GEMS program, not executed in a hidden location triggered by a secret 2-digit code. Nothing in the GEMS documentation describes the use of any feature like this whatsoever. Here's why we need to involve CPAs in vote tabulation regulations, procedures, and design: If changing election data is required, the corrective entry must be made not by overwriting vote totals, but by making a corrective entry. It is never acceptable to make changes by overwriting. Data corrections should not be prohibited, but must always be done by indicating changes through a clearly marked line item that preserves each transaction. However, according to elections officials we interviewed, GEMS is improperly designed, and cannot perform an adjustment, and you can't journal changes that occur for weird reasons that really happen. (For example, a poll worker might accidentally run ballots through twice. You need to be able to correct this and still show your work.) Instead of doing an adjustment and showing the explanation, retaining a permanent record of everything that happened, a common procedure is to wipe out the mistake, and simply overwrite it with new data. This is completely improper, from an auditing standpoint. It is certainly improper to have the summary reports come from the second ledger, while pulling the spot check reports from the first ledger, with a provision in the back door to allow these two ledgers to be mismatched. But there is more evidence that these extra sets of books are illicit: If the extra set of books is legitimate, the county officials, whose jurisdiction paid for and own the voting system, should be informed of such functions. Yet Diebold has not explained to county officials why it is there at all, and in most cases, never even told them these functions exist. As a member of slashdot.org commented when we originally published this information: "This is not a bug, it's a feature."

1 0

Tilting at the Ballot Box
by R. A. Hettinga 31 Aug '04

31 Aug '04

<http://www.business2.com/b2/web/articles/print/0,17925,683182,00.html> Business 2.0 - Magazine Article - Printable Version - Tilting at the Ballot Box Entrepreneur David Chaum's e-money venture flopped. Now he wants to fix electronic voting. For once, is the brilliant inventor right on time? By John Heilemann, September 2004 Issue The legendary cryptographer David Chaum has just invented something amazing, and his timing is nearly perfect. At a moment when electronic voting has been turned -- by a confluence of clueless election officials, slipshod technologies, dodgy vendors, and ever vigilant geeks -- from a great leap forward into an abject fiasco, Chaum has unveiled an e-voting system that's everything the current gizmos aren't. It's incredibly secure. It guarantees anonymity. Its results are verifiable. It is, Chaum claims, "the first electronic mechanism that ensures both integrity and privacy." Indeed, as far as I can see, Chaum's invention has only one conceivable drawback: It won't be on the market in time to save us on Nov. 2. As veterans of the digital revolution will recall, solving apparently insoluble problems has always been Chaum's forte. Most famously, back in 1990, he founded the company DigiCash to commercialize his pioneering work on electronic money. Even by the standards of that heady time, Chaum's ambitions were lofty: propelling the international currency system into the digital age. But while everyone agreed that the technologies he invented were elegant and brilliant, the world, it turned out, wasn't nearly ready for the incursion of e-money. At the end of 1998, DigiCash bit the dust. Technology writer Steven Levy once described Chaum as "Don Quixote in Birkenstocks." Today the Birkenstocks are gone, but the beard, ponytail, and quixotic temperament all remain in place. Once again, the windmill he's tilting at is an entrenched and archaic system. And once again he's starting a new company to profit from his ingenuity. If there were any justice or logic in this world, his success would be guaranteed. But since the world we're talking about is national politics, I fear he faces an uphill fight. No one has thought longer or harder about e-voting than Chaum. As a graduate student at the University of California at Berkeley in the late 1970s, he wrote the first papers on the topic -- then moved on to other things. But after the Floridian fiasco of 2000, in which hanging chads and butterfly ballots vividly demonstrated how dangerously outmoded our electoral technology was, Chaum's interest was rekindled. At the time, election officials in scores of states were racing to embrace touchscreen voting terminals from suppliers such as Diebold and Sequoia. So Chaum considered the idea he was hatching "a totally academic exercise." Then, out of nowhere, all hell broke loose. Computer scientists and security experts declared the current generation of machines easily hackable and prone to tampering. In particular, the critics complained that because the machines leave no paper trail, their results are impossible to audit. (Any recount would rely on the same software that might have mangled or manipulated the votes to begin with.) Voting activists dug up a pile of evidence of past e-voting irregularities. A populist campaign, "The Computer Ate My Vote," erupted on the Internet. Meanwhile, Diebold's CEO, Walden O'Dell, unwittingly fed a thousand conspiracy theories by hosting a Bush fund-raiser -- and writing to the invited guests, "I am committed to helping Ohio deliver its electoral votes to the president next year." In the face of all this, states are scrambling to figure out what to do -- both in November and further in the future. The solution that's gained the most momentum is known as "verified voting." Here a printer attached to the touchscreen terminal spits out a hard copy of the voter's choices and displays it under a transparent barrier. Once the voter approves the receipt, it's put in a sealed ballot box, from which it can be retrieved and tallied in the case of a recount. The problem, however, as Chaum points out, is that the receipts are as vulnerable to fraud as ordinary paper ballots. "They can, for example, be tampered with between the vote and the recount," he says."In a sense, ballot-under-glass is no more secure than old-fashioned punch-card systems." Chaum's system, Votegrity, produces a paper trail too -- except Chaum throws cryptography into the mix, and that changes the equation. With Votegrity, the printer attached to the terminal generates two strips of paper, each of which holds your vote in encrypted form. Overlaid on top of one another and seen through a custom viewfinder, the strips, through some cryptographic voodoo, reveal your choices in plain English. Once you've verified your vote, the strips are separated, you pick one to take home as a receipt, and the bar-code-like image on that strip is stored digitally. When the time comes to tally the votes, the images are decrypted (using a complicated Chaumian mathematical process that's all but tamperproof). Meanwhile, the encoded images are posted on the Web, so that you can go online afterward and confirm that your vote was counted by using a serial number on your strip. There's no denying that Votegrity teeters on the brink of genius. By letting voters take receipts, Chaum's system would erect formidable hurdles to election fraud -- while simultaneously, through encryption, preserving the sacrosanct anonymity of the ballot box. That said, I can think of at least three glaring reasons to be skeptical of Votegrity's prospects. First, the system isn't exactly a paragon of simplicity; it took nearly four hours of explication by Chaum for me to get my head fully around it. Second, election officials are by inclination a deeply conservative lot, especially around new technology. A system combining cryptography and the Web isn't likely to set their pulses racing -- or cause their checkbooks to spring open. Third, there's verified voting. Whatever the imperfections of ballot-under-glass, I suspect that many people who distrust e-voting will consider it a good-enough safeguard. And as the history of technology makes abundantly clear, in a contest between perfect and good enough, the latter wins every time. Naturally, Chaum disagrees. Given the intensity of the uproar over the current touchscreen terminals, he believes that states will have no choice but to adopt a more sophisticated system. "The more people swear that the machines should be trusted, the less trust there is," he says. "Forget whether they're really secure or reliable. What matters is that major chunks of the public don't believe they are. We've got a crisis of voter confidence on our hands -- and it's not going to go away." As for verified voting, Chaum simply says, "I don't think a system that's equivalent to punch cards is going to cut it at this point." Depending on what happens in November, Chaum could be proven right. With the election only two months off, the backlash against e-voting has produced a situation bordering on chaos. At the start of the year, it appeared that some 50 million voters-roughly 30 percent of the total -- would be casting their ballots digitally. Now, who knows? In California, the secretary of state has banned the Diebold machines from use and decertified all the rest. In other states, there are movements afoot to require verified voting. In still others, officials are pressing ahead with the machines despite the hue and cry. All of which suggests one thing: If the election turns out to be as close as most polls suggest, we may be headed for a multistate postelection conflagration, complete with protests and litigation, that will make the contretemps over Florida in 2000 look like a schoolyard spat. For Chaum, who's in the process of rounding up investors and hiring executives for the firm he's starting around Votegrity, such a conflagration would be, perversely, the best news imaginable. Not that he's the kind of guy who'd root for such an outcome. A bone-deep do-gooder, a privacy crusader, he's an unabashed idealist whose desire to make the world better is so earnest it's slightly painful. When I asked him why he was still tilting at windmills even after the anguish of DigiCash, he smiled, shrugged, and softly replied, "This is really important stuff -- someone's got to do it." On that point he'll get no argument from me. No matter what transpires on Election Day and in its aftermath, Chaum and his allies have already rendered an invaluable service: not only exposing the flaws of e-voting today, but pointing toward something better for tomorrow. Coming up with that something -- a digital system that's secure, private, and verifiable -- will plainly be no mean feat. As more and more geeks take up the challenge, the odds will inevitably decline that Chaum's will be the system that triumphs. But I can't help hoping that, for once in his life, he kicks the windmill's ass.? John Heilemann wrote "Pride Before the Fall." His next book is "The Valley." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

3 9

Pigradio survey of anonymizing systems
by Major Variola (ret) 30 Aug '04

30 Aug '04

The pigs want to be able to send anonymous messages over IP or POTS using their emergency 700 Mhz comm system: http://www.ncs.gov/informationportal/Web_Proxy_Report.doc

1 0