Replies

Whoever dreamed up the idea of using USB sticks/cards is in on the voter fraud scheme. These things can be stolen, hacked, and duplicated.

There is nothing inherently wrong with using USB sticks/cards. There are any number of ways to make sure that the cards themselves are not altered in transit. Here's a quick example that I came up with right off the top of my head.

Let's say the card ends up with a file on it that contains all the vote data. There is a cryptographic tool that you can use to generate a 'hash' of that file. The 'hash' is a humnan-readable string of hexidecimal digits. This can be saved separately, and possibly printed on the envelope that will contain the card. This has can also be transmitted separately, or given to multiple individuals, and can be used to validate the accuracy of the data on the card. If the has on the card is not the same as the hash on the envelope, the card is segregated.

Here's a quick example of using a hash to see if a file has been altered...

## The following is the original file. It is the Project Gutenberg version of 
## the King James version of the bible.
$ ls -l
total 4844
-rw-r--r-- 1 amp amp 4959549 Nov 28 20:30 The_Bible-KJV.txt

## This is the hash generated via the 'sha256' program.
$ sha256sum The_Bible-KJV.txt 
6d1c5625cad6b6f619bd8b5cb5e77ea20dcf052082743f27bc8c8be2fb7e8a55  The_Bible-KJV.txt

## Now I make a copy of that file.
$ cp The_Bible-KJV.txt The_Bible-KJVa.txt

## I check the hash of both files, and they show as being identical
$ sha256sum The_Bible-KJV.txt The_Bible-KJVa.txt
6d1c5625cad6b6f619bd8b5cb5e77ea20dcf052082743f27bc8c8be2fb7e8a55  The_Bible-KJV.txt
6d1c5625cad6b6f619bd8b5cb5e77ea20dcf052082743f27bc8c8be2fb7e8a55  The_Bible-KJVa.txt

## I edit the copy...
$ vi The_Bible-KJVa.txt

## The following is a listing of the first 3 lines of each file. 
## Note only difference is the first line starts with "T" in the first
## and "t" in the second.
$ head -3 The_Bible-KJV.txt
*This King James' Bible is the SECOND Project Gutenberg Version*
This 10th edition should be labeled biblea10.txt or biblea10.zip
****This edition is being officially released on Easter 1992****

$ head -3 The_Bible-KJVa.txt
*this King James' Bible is the SECOND Project Gutenberg Version*
This 10th edition should be labeled biblea10.txt or biblea10.zip
****This edition is being officially released on Easter 1992****

## Now, lets check the hash again...
$ sha256sum The_Bible-KJV.txt The_Bible-KJVa.txt
6d1c5625cad6b6f619bd8b5cb5e77ea20dcf052082743f27bc8c8be2fb7e8a55  The_Bible-KJV.txt
2cedfa1ddd401af877a03c9f9e84f675c89f86a3474372b2e45b0e777dd88c21  The_Bible-KJVa.txt

## Note that even the tiniest of changes to the file generates a completely different hash.
## You'll also note below that the two files are still exactly the same size, yet
## produce much different output because if that difference of a single character.
$ ls -l 
-rw-r--r-- 1 amp amp 4959545 Nov 28 20:44 The_Bible-KJVa.txt
-rw-r--r-- 1 amp amp 4959545 Nov 28 20:42 The_Bible-KJV.txt

None of the above is rocket science to anyone who knows anything about security. Not only can you generate a hash for each individual file on the card, but after doing so and saving the resulting list of hashes, you can hash that resulting file as well, so that if any individual file is changed that overall has will fail as well. You can print, save, email and otherwise disseminate these hashes so everyone involved will have confidence in the data.

None of the above is hard to do, and quite frankly I would be hard pressed to answer why someone wouldn't take such elementary precautions, unless they wanted to perpetuate fraud.

If I were involved in setting something like this up, not only would you have strong cryptographic hashes of all data, but the files on the computer as well, such that any change made would be readily apparent. I'd also implement digital signatures using strong cryptographic functions like those available with the PGP or GPG encryption programs, but that is a much longer discussion for another day.