A few weeks ago we were asked to see how long it would take us to swap the ROM’s in a Nedap voting computer. The exact time would be needed in a German report from the Chaos Computer Club. They did research on voting computers and their vulnerabilities and came out with their analysis today.
In order for them to calculate how long an outsider would need to hack the elections they needed an estimate on how long it would take to swap the two ROM chips on a Nedap voting computer. The complete voting computer software is loaded from these two ROMs, and the person/entity installing the ROMs on these black box voting computers has complete power over the elections. There is no safeguard as there is no ‘paper trail’ and a recount is not possible.
If you want to know more details: recently a subtitled version of a Dutch TV item became available online for those interested in the situation in the Netherlands and our atempts to hack the Nedap’s. I think it gives a nice overview.
For us doing the ‘ROM swap job’ was a fun assignment. We stopped when setting the ‘record’ to one minute. One minute per machine is a nice statement and we decided not to push the limits any further.
And of course we backed up our 60 second claim with a video clip that will only take one minute of your valuable time (in Windows Media or on YouTube).
* Update June 10: The CCC report is getting extremely good press. Read the article from the prestigious ‘Der Spiegel’ magazine.
Barry’s too modest: he did the camerawork and directed the piece… 🙂
Nice!
What I’m missing is a count-down timer. But then you might also slip into adding a theme song and using latex gloves 😉
DWizzy: it was way too much trouble editing that in. And besides, in the little bar below the clip at youtube you can see a counter? According to YouTube the clips takes only 59 seconds and you can see what second of the clip is playing.
It was fun directing this little event and editing the video 😉
WEll, I am still quite pleased, that in Denmark we still use the old pen and paper method of voting. But the whole voting computer , gives me the creeps, because of when I read about electronic voting fraud. It was here on this site, and later I saw the documentary named Hacking Democracy . So paper and pen voting is perhaps the best system of voting in our parts of the “democratic” world.
Please forgive me for ranting but:
Electronic voting machines as a rule seems to be as far as security is concerned, built around the entire premise of building an example of everything NOT to do.
It is totally amazing that people can manage this level of incompetence. If you put skilled sabateurs to work on the task, they would be hard pressed to do as well as the actual makers do without assistance.
The only way these machines could get much worse is if they broadcast the voter’s choices to the tabulator paired with identity information: unencrypted, with a non-directional antenna, via morse code, on commerical radio FM frequencies. Then again, all they would have to do is sweep the area for transmitters or recievers to stop fraud there.
I guess they could just have voters show up to specified locations based on vote, send the tally via a carrier pigeon per person, and hand out shotguns with birdshot across the street.
Atleast the hackers would be easier to catch in the act. Just follow the gunshots.
See what I mean? Hard pressed to do worse.
Wait! I’ve got it! Give each voter a piece of chalk before going in to the booths, and have them tally off directly on a chalkboard as the tabulation! We’ll just go on the honor system!
Elections will be decided by who is more brazen about rigging the elections!
As opposed to now…
[/rant]
I’m not trying to downplay your accomplishment, but it should have atleast taken half of an unreasonable-amount-of-time-to-loiter-in-a-booth to even be defensible by the manufacturer regardless of the skill of the hacker.
Maybe the manufacturer’s in your country are a bit more receptive to criticism than Diebold… It’s not nearly so disgraceful when they aknowledge the problems and work to fix them.