Subject: Re: internet voting -- ICANN, SmartInitiatives, etc.

From: "Steven M. Bellovin" <[email-masked]>
Date: Sun, 14 Jan 2001 12:11:37 -0500

In message <[email-masked]>, Jon Crowcroft writes:
>
>the bggest problems with security ssytems are generally 90% to do with
>design errors at level 10 (human, not policitcal, economic,
>application, transport etc)
>

Mostly right, though one shouldn't rule out the possibility of layer 
10-inspired insider tampering with the software.  Nor should one ignore 
the possiblity of simple bugs -- the electronic equivalent of hanging 
chad.  See http://www.notablesoftware.com/evote.html for more details.

But the hard parts of the electronic voting problem have nothing to do 
with crypto, firewalls, protocols, DDoS attacks and the like -- and I 
say that as an expert in those fields.

		--Steve Bellovin, http:/www.research.att.com/~smb

---

From: Ed Gerck <[email-masked]>
Date: Sun, 14 Jan 2001 10:35:37 -0800

"Steven M. Bellovin" wrote:

> chad.

Mostly right also, but it is a bug to say that bugs are somehow equivalent
to hanging chads. Dimples, pregnant chags and hanging chads are
digitization errors, bound to happen in any process that goes from analog
to digital (because a digital process has steps and an anlog process is
stepless).  So, chad problems are inevitable in any system that uses
punch cards to record votes (btw, a technology that was first used in
1890 in the US Census).  Chad problems can never be entirely fixed
or avoided as long as you have that punch card.

Bugs, however, can be either fixed or avoided.

So, even though many people like to talk in terms of dumbed down
soundbytes, one cannot derive any logical conclusion from such
soundbytes.

Cheers,

Ed Gerck