10. Communications Capability
Voting systems shall not use wireless, power-line, or concealed communications (except for infrared technology if certified with the voting system) but all other kinds of communications capability can be used.[39]
Wrong!
At the least, the exemption for infrared needs to be reworded to exempt only infrared, and not exempt a system with infrared from the prohibition against all other wireless, powerline, or concealed communications.
At best, infrared should not be an exception, since its use is not required for any election-related function and its use is an arbitrary choice of a vendor to load ballot definition files via infrared despite the availability of other simple methods for loading such files.
The entire prohibition is weak, because all forms of communications are easy entry-points for tampering. The focus on specific types of communications (wireless, power-line, and concealed) betrays an unhistorical and superficial understanding of computers, which were subject to break-ins via the older telephone line/modem technology long before wireless and power-line came into use. The listing of specific types of communications will make this section obsolete soon. Nevertheless, if a list is used it should include "dial-up modem networking" or "telecommun-ications" or "connections to the public switched telecommunications network", as well as ultra- or sub-sonic audio transmission.
Solution
The law should ban all communications devices and technologies, known or to be developed, in all voting and vote-tabulating equipment.
11. Internet Connections
Voting machines shall not be connected to the internet, but Election Management Systems and vote tabulating equipment may be connected to the internet.[40,41]
Wrong!
There is no reason whatsoever to allow internet connections to any Election Management System (EMS) or vote tabulating equipment. This paragraph allows EMS, which are used to program ballot definitions, and tabulators to be internet-connected, thus facilitating tampering and denial-of-service attacks.
For example: many jurisdictions do not require poll workers to print and post tally reports PRIOR TO connecting their DREs or optical scanners via telephone line or other technologies to their central tabulator (or EMS system if it functions as the central tabulator) to send in the day's tallies. This paragraph allows tamperers to connect to the central tabulator and put in malicious code so that when individual DREs or optical scanners connect to the tabulator to transmit their tallies, the central tabulator ALTERS their tallies first, then lets them send in the altered tallies. Then the poll workers print the tally reports in the poll site-but the tallies have already been falsified.
This may have been what Clint Curtis was talking about when he testified before a Congressional panel and was asked, if tallies in the central tabulator are altered, won't people notice that the tallies in the poll sites are different? He replied, "Not if I did it!"
Solution
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22
