Thermal Pope said:
Maricopa was live tweeting during the press conference.
When the so-called auditors talked about the computer security, I think that they may have had a minor point or two. However, it is hard to say for sure without more detail.
Specifically, they gave some examples of computers connecting to the Internet, but they didn't spell out precisely what those computers were used for in the election process. Sure, a server used to provide election information would have to be on the Internet. Hopefully that server did receive its OS updates and virus definitions.
(Note that in the case of the election web server, they were able to determine that it had been connected to the Internet from the logs without needing the router information to determine that.)
While it would be nice for the election machines themselves to have the security updates and virus definitions applied and up to date, that would pretty much require them being connected to the Internet. If they cannot be connected to the Internet, then they would have to have those through a thumb drive or something. Does Microsoft distribute updates on a thumb drive? Does any antivirus company distribute their virus definitions on a thumb drive? Even if they could download the security updates and virus definitions to a thumb drive, applying the definitions increases the risk since the thumb drive itself could have been compromised. I can certainly understand why the computers were unpatched and the virus definitions had not been updated. Them not being patched on a computer that is only used on a stand alone network, if any network at all, is not that much of a cause for concern.
The part about the logs being rolled over does need more explanation. That there were additional log entries is not, in and of itself, indicative of any wrongdoing.
They brought out an issue regarding username and password information. For a purpose such as this, it seems reasonable on the surface that each person logging into the machines have his own username and password, but that is not necessarily an issue for reasons of practicality. We should keep in mind that what is best practice for a situation in a corporate or university environment in which many different people may connect to servers on an as needed basis for a number of different purpose is not necessarily the same for a set of occasionally used single purpose machines not on a general network with limited access to them.
(I may have something more to say about this issue, but unless I can find a transcript, I'll have to go back and try to find where they talked about a certain point in the presentation.)
This part of the presentation bothered me more when watching the presentation than it does now after having a day to think about it. Suppose that you have 1,000 voting machines sitting in storage between elections and you hire a new employee who might need to logon to the machines at some point. Do you take each machine out of storage, one at a time, and start them up so that you can add a username and password for that employee? Of course not. That would be a nightmare. Also, when an employee leaves or is moved to another department, then would you have to take them out of storage, one at a time, and start them up to remove his access.
It's not like it would be reasonable to suspect that the election machines are all sitting in a big room, plugged in and running, and ready for someone to walk up and start logging into them.
Looking at it this way, it seems that it might be better to keep a log of who has access to the machine at what time and their purpose for needing the access. They said in the presentation that there is a video of an employee on the machine. so that would certainly help.
Also, there are certainly situations in which people do legitimately share usernames and logins for other purposes. For example, on our external router provided by AT&T, there is one login for AT&T to use with their own password and one login for me to use with my password. I have downloaded the configuration of that router and have seen the login entry (the password itself is encrypted). It would be silly to expect everyone at AT&T who might need to access the router to have their own username and password on the router.
Historically, on UNIX machines it has been normal to have one shared username at the most privileged level -- root. If you needed to grant someone access to the machine for things like configuration, adding and removing users, ..., then you gave them the root password and they logged on as root.
The sudo package can kind of get around this depending on the settings. You identify which users need access to root in a configuration file (if I remember correctly, /etc/sudoers) and the type of access. One option is to require them to enter the root password for every command they enter. Another option is to require no password. You can also limit particular users to certain commands.
So, on the surface, it seems like this might be a problem, but I'm not sure that it is when you think about it more carefully.
What does strike me as a possible problem is that it sounded like they were using the same passwords set by Dominion. Here, the issue is with who determined the passwords. Unless the password used are determined by the proper people at the election board, they should probably change the passwords when they receive the equipment in case Dominion uses the same passwords for multiple customers. I doubt that they do this, though.
This part of the presentation bothered me a lot more watching that portion of the presentation than it does after thinking about it overnight. When watching a presentation, there is no time to think about the issue in more detail. You are going at the presenter's speed, not your own speed. Your options are to either accept what is said or reject it outright, especially when unable to ask questions. This is precisely why I don't like to gather information on weighty matters by video and strongly prefer to read it where I can read at my own pace and take time to gather additional information from other sources or to think about it in more detail.
