Schneier on Security

Nick Levinson • July 1, 2022 11:48 PM

Multiple observations:

The Swiss voter authentication paper voting key may be technically good as keys go (someone else can question it) but is bad except for the relatively-well-educated and better-educated voters. Others will misspell. The system could tolerate that; but by how much? The higher the tolerance, the longer the code must be, the greater the misspelling risk, the greater the tolerance needed. And very long codes discourage voting (I presume voting in Switzerland is not mandatory, as it is in Australia, where the problem might not be discouragement of voting, depending on the penalty, but sharing of the key with someone who’s helpful, which is risky).

The Australian NSW discussion points to failure to take Internet security seriously. It doesn’t say why the failure, but I’ll guess that those in charge of deciding not to take Internet security seriously don’t use the Internet much. This can lead to one of two conditions: considering a 4-digit PIN to be security a-plenty since people can keep a million dollars behind a PIN and not knowing about the irrelevance of that; or being so unsure of security no computer system is deployed, like when Russia/Soviet Union refused (once) to install a computer to launch ICBMs after all of their top leadership is dead (the top leadership is almost always older and probably less comfortable with computers and would rather use their voices and fingers and have lower-level people do likewise). In this case, refusal may not have been an option for the decision-makers, so they may have relied on the PIN irrelevance.

For some U.S. jurisdictions that create a paper receipt for a voter where the receipt shows which candidates were voted for, I assume those can be sold by voters to whomever likes certain candidates. I heard of one poll site in a mainly-one-party city where someone from that party listened to votes being cast on an old mechanical lever machine; party loyalists should vote with dull thuds all the way down the party column, so if a sharp click could be heard the listener wanted his $5 back. So, if someone solved that problem and still has a good verification system, that’s good.

The NSW threatening jail time for sharing the source code reminds me of a couple of closed-source high-end math programs: only the vendor can check the complex math. All the user knows is they put in 2 plus 2 and got back 4; they don’t know how (high-end math programs generally don’t use computer hardware like registers for calculations, using software and RAM instead). The pro-closed-source argument is that sales revenues motivate keeping the program accurate; the open-source model may not attract enough volunteer programmers and regressions may be a more common problem.

I read all 5 parts, at least the last of which is dated as of yesterday.

Nick Levinson • July 2, 2022 10:46 AM

@Denton Scratch & @SpaceLifeForm:

“[C]ontrol of the postal service would be equally effective; just don’t send out the sheets of paper with the voting codes.” (From Denton Scratch.)

That’s an issue. In the U.S., I was in two campaigns wherein I heard two rumors to like effect, although not about official documents. In one, it was alleged by an insider that 40,000 pieces of campaign literature for 3 Zip codes were not delivered, or not until election day was past. In the other, the candidate alleged that a letter carrier (a postal employee) had told her not to mail her campaign lit because it wouldn’t get delivered but to give it to him instead and he’d deliver it for free; and, according to the candidate, he did. Although the Postal Service is a national agency, almost all workers and managers live locally to where they work and thus are likely to share local political interests, and apparently do. Back then, campaign mailings went third class, without delivery date commitments but cheaper for postage (today the terminology and terms may be different), and it apparently wasn’t hard for a local manager to have the sacks of someone’s mail pieces put to one side until after election day (excuse me, until the workload can be evened out to a normal average when many campaigns are mailing at the same time). A related news story was that in one jurisdiction absentee ballots mailed from homes were mailed using official return envelopes on which return postage was preprinted using official indicia. The voters were instructed that these return envelopes had to be postmarked on time to be countable. The board of elections checked their procedure with the Postal Service but didn’t check well enough. Since the envelopes had postage indicia, the Postal Service did not postmark most of them and wasn’t supposed to for any of them, and most of the voters wouldn’t have known that. To get a postmark, they would have had to pay their own postage on a free mailing, and almost none would have thought of that.

Nick Levinson • July 4, 2022 7:54 PM

@Kent Brockman:

While the press interviews undecideds, the committed are the loudest and most noticed. Meanwhile, most voters have the right to write in a candidate of their choice or to vote for a minor-party candidate, but few do and still they vote for the office and so they vote for one of only the leading two, and many have not yet decided which one. In a presidential general election, that’s a lot of voters. “Lesser evil” is not how most of those voters think of either one; if they did, we wouldn’t have the 100-day honeymoon for the winner to get an agenda started, during which even voters on the other side mute their reactions, being hopeful. Voters whose minds were made up months ahead of time are not enough on which someone can win, Trump included. Campaigners can try to switch committed voters’ votes but it’s easier to persuade undecideds and weak supporters and, for presidential general elections, there are many. An incumbent finds that many last-minute undecideds vote for the challenger, but surveys show most of them as still undecided just a week before. Election-season debates matter and leading candidates participate, even for the vice-presidency; if almost all minds were already made up by a debate date, candidates would send surrogates instead and hosts would let them or cancel the debates. Two candidates physically exhaust themselves in the couple of months before election day because that’s what it takes for one of them to win. The day after one election, a White House phone operator told a foreign leader who had asked for the two candidates’ phone numbers (I think for Obama and McCain), presumably to congratulate or condole, that either one might be asleep at any time, i.e., forget about their sleeping on schedule for that day.

In my unsystematic observation, no foreign nation of any political persuasion has a better record at predicting the outcome of a U.S. presidential general election than domestic pollsters do. If you could just count up the committeds a month ahead of time and have the answer, we’d be relying on that. We don’t.