Minnesota's system for entering election data! (Unbelievable.)

[Carolab]

http://soshelpdesk.sos.state.mn.us/SVRSProfile/SVRS/ENR_File-Upload.pdf

Is it just me or does this seem eminently unsecured--like the data could just be so easily manipulated it isn't even funny.

P.S. When you get to page 10, it won't advance so you have to go to the last page and then go back to 12.

Put out by a company called "Arran Technologies Incorporated"

Publishing date of 8/04

[UL_Approved]

1. This is a joke.

They have the election results in the documents folder for a given user. I'll bet the results are just plain-text. And to add to the items, manual editing and submission can be done online.

As a general rule, computers can be very safe for data storage and distribution. THE HUMAN END OF THE PROCESS IS WHERE THINGS BREAK DOWN. Anybody who could get the password, or find a backdoor, could change results. After looking at the display, I wonder if one person logged in could alter other election returns from their account. It looked like that may be possible, but I just skimmed the article. Anybody else?

[Carolab]

2. Yes the files are just plain .txt format

It is a total joke. So incredibly easy to mess up and so easy to change. Just as Bev has demonstrated. Mind you, these are results from optically scanned ballots and also from hand-counted paper ballots. In Minnesota only one precinct used the touch screens.

By the way, I found something on the net that links Arran with CyberNet and Chicago Public Schools. I wonder if it means anything.

They are on a procurement list for 2004. There are contact names.
http://www.csc.cps.k12.il.us/purchasing/bid_history/2546.html

[UL_Approved]

6. Get this to TruthIsAll

This DUer has been putting together many items on election fraud. This is another piece of the puzzle. Great Find!

[geo]

11. Yes. Great find!!

Hi all,

This might help explain the 6 point red shift between exit polls and declared results. Wonder if Kathy Dopp has gotten her team together yet to analyze which precincts might be the most problematic....

Warmly,

George

[w13rd0]

3. OMG

That is AWFUL! It's a fricken web backend text parser. I...I can't even compute. Text files?!? Oh, but it's just a system to upload the election result data. Accessed from a publicly available website. You'd still need a username and password, and gosh golly, no one would be able to crack that. Does the web page also check the client computer to ensure there are no memory resident keyloggers?

[badc0der]

4. they could be using client certs

but not likely since none of the election people (including manufacturers) seem to have a clue about crypto/pki/etc

[noamnety]

5. Everyone in the county shares one ID and password

What could be more secure than that?

[Carolab]

7. Does it actually say that?

I missed that part--there is a shared ID and password throughout each county?

[Sade]

8. Unfreaking believable but here it is on pg 5

"Only one User ID and Password is necessary per county. As many users as necessary may use the same login at the same time. If you have misplaced or would like to change your password, contact the OSS Helpdesk at: 651-297-4848"

[Oreo]

9. Just wrote to KARE 11

I gave them the link and the link to this page so if they do happen to drop by, let's spell out exactly what is wrong with this.

I just found this pdf file that shows how to logon and tally the votes for the election. I am an IT professional and there are so many things wrong about this. Shared passwords that are intentionally given to a large group of people gives you no way to trace anything that may have been done wrong. The votes are uploaded as simple txt files. My 2 year old could open one of those and change numbers.

While the media may be taking a pass on the fraud that happened in this election, don't you think it's important to make sure future elections aren't stolen?

Here is the pdf file which you can openly download from the MN SOS website. That in itself is frightening.

http://soshelpdesk.sos.state.mn.us/SVRSProfile/SVRS/ENR_File-Upload.pdf

For more info... read here:
http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=203x62773

[shraby]

10. Kick this thread

:kick: :kick: :kick: :kick:

[shraby]

12. Not only that, they give a number to call

for the password.

[shakerbaker]

13. has KSTP covered this

or any of the vote fraud? They did have the video of the weapons in Iraq.

[Roger_Otip]

14. site map

more info at this page - http://soshelpdesk.sos.state.mn.us/sitemap.htm - including links to login pages. i'm not a hacker, but this looks like it would be really easy to break into, upload a text file with your own set of votes... and you've changed an election!

[floridadem30]

15. kick

[Roger_Otip]

16. how to apply election law when using election software

Questions regarding election law and administration or how to apply election law when using election software should be directed to the Election Division.
Phone: [phone]
Email: [e-mail] 

http://soshelpdesk.sos.state.mn.us/SVRSProfile/SVRS/electechinfo.htm

[grasswire]

17. send to olbermann

He oughta get a kick out of this.

[Carolab]

18. Arran Technologies is in Roseville, MN--someone should contact them

Here is the contact person for Arran Technologies right here:

Laura Tyson
2740 Patton Road, Roseville, MN 55113
651-468-0002 x160
651-468-0005

I wonder if KSTP would like to question her about this amazing elections software they provided the Secretary of State?

[crispini]

19. this is so incredibly stupid.

Having this pdf publicly available on a website is like having a big sign that says 'HACK ME.' Making phone numbers and this level of detailed information publicly available means they are incredibly vulnerable to a social engineering hack. This is where the hacker takes advantage of inside information to pose as a knowledgeable user, calls the password reset line, and persuades some poor schulb to reset their password unwittingly. VERY, very easy to do.

"Only one User ID and Password is necessary per county. As many users as necessary may use the same login at the same time." Worst. Idea. Ever. If hacked, how could you tell who hacked it? How can you control who's got the password? All it would take is one bad seed in one office and away you'd go!

[Straight Shooter]

20. This document is dated September 3, 2002. Has it been updated?

Maybe someone needs to talk to them on Monday, eh? That number would be 651-284-0244.

edit to clarify: maybe their procedure has been updated and no one bothered to change the web site document.

[Carolab]

21. Check the date on the front page: August 2004

Got to be an updated version. Why post old material under a link that explains procedures for the 2004 election?

[Oreo]

22. Nothing to see here.... move along

On the MN board a DU member is saying this is a non-issue. She is an election judge in MN and feels that since there is a paper trail, this isn't an issue

http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=160x4749

I appreciate the info and it may be the case now but come on... this is absolutely ridiculous. According to her... we're all being chicken little. So as I said... move along... nothing to see here :wtf:

[jean]

26. Thanks for notifying KARE! I think what some people don't 'get' (and have

mocked or harassed those who do 'get it') is this:

MN opti-scan machines results are tallied by the machine. There are a small percentage of mandatory random audits automatically done on these machines (and apparently state officials will move to increase that percentage).

But the machine is subject to being tampered with - and the central tabulating done at the SoS level could also be tampered with.

I know some people think it's impossible for this to happen in MN since we're not using touchscreen machines. But fiddling with the vote via opti-scans is possible and we need to investigate.

For those who say people are crying wolf or are chicken littles:

We really shouldn't sit around with our fingers in our ears going, "La, la, la" and pretend everything is hunky dorey!

[Carolab]

31. EXACTLY! JUST READ THIS!!!

http://www.chuckherrin.com/HackthevoteFAQ.htm

[Oreo]

23. kick

[Zan_of_Texas]

24. Hey, can you tell me where you got the Arran part of the story?

How is Arran connected to MN elections? I don't see it on the document.

Great find, by the way.

[Oreo]

27. Look on the front page

of the pdf file at the bottom it has Arran's logo

Ewww... check this:

http://soshelpdesk.sos.state.mn.us/SVRSProfile/SVRS/vemstechinfo.htm
They're not giving us the domain name also? Look at the Change Password link in the above.

More here:
http://soshelpdesk.sos.state.mn.us/SVRSProfile/SVRS/ersenr.htm

[jean]

28. Arran's logo is on the bottom left corner of the title page

from Carolab's link:
http://soshelpdesk.sos.state.mn.us/SVRSProfile/SVRS/ENR_File-Upload.pdf


You can see their logo here, also - on page 7:

http://www.telluriderealtors.net/Downloadable_files/IDX_faq_packet.pdf


The company site is: www.arran.com


edit: added link

[Zan_of_Texas]

30. odd - maybe I don't have the right graphics program to see it --

it's not there on my screen.

This comes up blank for me

http://www.telluriderealtors.net/Downloadable_files/IDX_faq_packet.pdf

[jean]

32. you need Adobe - but if you're seeing the text of the file I don't know

why the image doesn't show for you. Could you see the big MN SoS emblem at the center of the title page? If not, I don't know what you should do.

Anyway, their logo was on that front page - you can see a rendition of it in the header at their site.

[Zan_of_Texas]

33. Yes, I could see text, and screen shots, and the big MN emblem.

Just not that company logo. Weird. Maybe it was disappearing ink?

[Cronus Protagonist]

25. Holy Smoke Batman! This is not even insecure, it's an INVITATION

Damn. Is this stuff current? Unbelievable!


http://brainbuttons.com/home.asp?stashid=13
Buttons for brainy people - educate your local freepers today!

[Oreo]

29. From Arran's Website

So the system is probably based at Arran meaning any number of their employees more than likely have full access to the system.

Minnesota Secretary of State
Objective
The Office of the Secretary of State had purchased a statewide business filing and workflow solution, but needed assistance in implementing the application and customizing new features and enhancements. To date, four other vendors had already failed in this capacity, but Arran Technologies was ready to take on the challenge.
Solution
Arran Technologies brought in a team of developers, business analysts and database experts to assess the current status of the application development project and to begin the stabilization process. A new development methodology and a formal software release process was implemented while a new project plan was being developed.
Outcome
Arran Technologies successfully implemented seven feature rich monthly releases of the application. The total number of enhancements and issues resolved was in excess of two hundred. Arran Technologies also assisted in transferring the technical and application knowledge to the existing technical staff, which will allow them to be self sufficient in supporting and enhancing the application in the future.


More info on Arran;
Arran Technologies, formerly the Kaufman Group, Inc. was founded in 1983 primarily to address the specific needs of customers who had enterprise wide applications written in a legacy software product known as MAPPER (Unisys Proprietary)