Site Sponsor:

mcafee_logo.gif
line

Now Available:

Featured Resource:

line

Newsletter

Email Address:


line

Ask the Expert

Have a question for our resident expert? Email your questions to Dan or post a comment to the blog.

« Intelligence Agency Handheld Device Stolen | Main | Just Checking, But Can Machines Think? »

Report on e-Voting Security Not Made Public

It's one thing to keep quite about a vulnerability which, if made public, could harm those running systems with the vulnerability. That reasoning doesn't fly with e-voting machines.

Techdirt has been following the story of possible problems with e-voting machines in New Jersey. The state hired security experts to conduct a study, that study is not going to be released, per order of a judge. The report should have been released by now according to Andrew Appel, one of the expert witnesses in the case. He posted on his blog:


A judge of the New Jersey Superior Court has prohibited the scheduled release of a report on the security and accuracy of the Sequoia AVC Advantage voting machine. Last June, Judge Linda Feinberg ordered Sequoia Voting Systems to turn over its source code to me (serving as an expert witness, assisted by a team of computer scientists) for a thorough examination. At that time she also ordered that we could publish our report 30 days after delivering it to the Court--which should have been today [October 2, 2008].

It's not clear what harm would come from releasing this information, in fact one would think the election officials would want details in case they need to deploy alternate voting mechanisms.

Secrecy is necessary for to protect against some vulnerabilities (like the DNS cache poisoning vulnerability found earlier this year) but this sure doesn't look like one of those cases.

TrackBack

TrackBack URL for this entry:
http://www.realtime-websecurity.com/type/mt-tb.cgi/875

Post a comment

(All comments are approved by site leader before appearing here. Thanks for commenting!)

line

Dan Sullivan's Bio:

Dan Sullivan is a systems architect with 20 years of IT experience that includes engagements in enterprise security, application design, and systems architecture. His experience includes a broad range of industries, including financial services, manufacturing, government, retail, gas and oil production, power generation, and education. Dan’s security-related project work has ranged from requirements analysis for enterprise information security to designing and implementing security for database applications and enterprise portals. Dan has written about information security and other enterprise information management topics for Business Security Advisor, DM Review, Intelligent Enterprise, and E-Business Advisor. You can contact Dan at: dan_sullivan@realtimepublishers.net