,
7 tweets,
2 min read
Read on Twitter
ICYMI, yesterday we released details of a trapdoor in code that was released as part of Switzerland's #evoting testing. It has since come out that this code & trapdoor also exists in a voting system used in Australia, and that system will be patched during an election period.
Relevant links in this thread:
Regardless of what you think about the Swiss situation, the fact that this issue (which skipped through multiple audits, and that was apparently found 2 years ago but not fixed) has now triggered a patch in a live system raises yet more questions about audit procedures.
Or to put it more brutally: Because vendor who originally implemented the broken election system failed to fix the broken election system when they were told it was broken, they are now in charge of fixing the broken election system during an election period.
But don't worry, because to exploit the issue we found you need to have access that very few people have, like the ability to change the code that runs on parts of the system during an election.
If the previous tweets come across as unnecessarily sardonic...you try summarizing this situation without the sardonicism.
Also, let us not forget what the vendor said about my previous concern about their voting system - before we announced our findings.
If anything, I am being way too nice.
If anything, I am being way too nice.
