Hacking the Nedap – the aftermath

It’s been all over the net: we hacked our voting machine. The precise machine that 90% of The Netherlands votes on has been hacked. If you read our report and documentation, you’ll see we didn’t just scratch the surface, but we dug in deep and we feel we proved beyond any doubt that this machine is not fit to be used in any election that deserves to be called democratic. The Nedap ES3B system is a DRE-style electronic voting systems. DREs are the ones that don’t leave any tangible trace of a vote and whose software just needs to be blindly trusted. Usually, such as is the case here in The Netherlands, a voting population has to provide this trust without being granted any information about how they work.

On October 4th, we’ve been on a national news documentary program that brought the first results, showing how easy it is to rig a vote once you have access to the machines. This was brought together with a news report detailing how easy it was to get surreptitious access to 400 of these machines, the ones that serve the entire city of Rotterdam. Then the next morning we hosted a press conference at which the entire national and international press-corps sat open-mouthed as we told the story of the deficiencies at various levels of the election process here in the Netherlands.

The aftermath is truly strange. On the good side there’s the reaction in Ireland, where large-scale media-coverage of our findings seems to have killed any last remaining hope for a slightly modified version of this silly machine to ever be used in any Irish elections. And in Germany people seem to be using our research productively to make sure Nedap and others do not expeand their black-box voting business over there. Over here in The Netherlands however, politicians and journalists seem to be ignoring any of the real scandals, focussing instead on the terrible fact that hackers were able to get such easy access to a voting machine.
Someting of this nature was to be expected with the elections this close. When we started this campaign, everybody expected elections to happen in March 2006 (provincial parliament) and May 2007 (national parliament). Then our government fell, and now national parliamentary elections happen on the 22nd of November 2006. Given such time pressure, it is simply much more comfortable for all involved to continue believing that the e-Voting emperor is wonderfully dressed. The simple and provable fact that our electronic voting procedures and technology are both deeply and irrepairably flawed is just a little too painful. Even – or make that especially – political parties whose voters would care about these issues have to walk a thin line to make sure they do not disenfranchise the very voters they depend on this November.
Nedap and the Dutch interior ministry have essentially reacted to the Nedap ES3B machine being proven ridiculously insecure by saying they are happy we care so much about the election process (which we suspect is a lie), by claiming that the machines we used are not the current ones (which we know is a lie) and by making unspecified promises of placing seals on them and guarding them a little better (which we can prove is insufficient and doesn’t address any of the real problems). Issues of placing our democracy in the hands of a few companies that do not want to tell us what they are doing remain unaddressed. If we leave it up to the people we elected to safeguard our democracy, these issues will be silently buried over the course of the coming week.

This is not something we plan to let happen though: we’re not done yet. We’re fully prepared to take the Dutch state to court and we will campaign to bring many people to vote in the last villages where this November’s elections are done on good old paper. It will be a bit of a hassle to get the paperwork needed to vote outside of our own municipalities. But hey, throughout history people have made much larger sacrifices to be able to vote in an honest election.

If you want to stay up-to-date on our voting stuff, check out the english pages of our campaign, which include a box to fill out your e-mail address to be added to our (low-traffic) announcement list.

One thought on “Hacking the Nedap – the aftermath”

Comments are closed.