Was Halifax’s e-vote hacked?

[InfoSec News <alerts () infosecnews org>]

http://www.thecoast.ca/RealityBites/archives/2013/06/27/was-halifaxs-e-vote-hacked

By Rob Wipond
The Coast
June 27, 2013

It's been several weeks since I revealed evidence that the online voting 
in last fall's municipal elections in Halifax was not secure. Now I'm 
starting to wonder, does anyone care? How many people care about defending 
our most basic pillar of democracy---our elections?

I obtained the damning documents through an Access to Information request 
to the Canadian Cyber Incident Response Centre (CCIRC) of Public Safety 
Canada—the federal government agency charged with helping ensure internet 
safety. Although the documents were heavily censored, they made clear that 
right up until the day before online voting began on October 6, 2012, an 
outside security researcher, the CCIRC, the election software vendor 
(Scytl) and the Halifax Regional Municipality Elections Office were 
grappling with a myriad of security vulnerabilities.

The documents also made clear that, at the time online voting began, only 
“some” of those security holes had been in part “mitigated.” Some of the 
problems, evidently, were never addressed.

HRM didn’t inform the public about any of this. I asked the CCIRC, Scytl 
and the city to provide evidence that the security problems were solved 
and the online votes were securely, correctly recorded. The CCIRC and 
Scytl declined to answer questions, and the city merely provided a report 
by Ernst & Young.

Unfortunately, from a technical standpoint, that Ernst & Young report was 
not a security audit, it was a user test. Basically, the city had asked 
Ernst & Young to confirm that the election software was functioning, but 
not to investigate how easily the system could be hacked or circumvented. 
It was like testing to make sure your computer could surf the internet, 
but not to see if your computer was protected against hackers or viruses. 
So, any reassurances derived from that report are deeply misplaced.

[...]

--
Visit the new and improved InfoSec News website
http://www.infosecnews.org/