The 'Mysterious' Fourth Page of the Affidavit...
I've been trying to prepare a FAQ on some of the most frequently asked questions I've been getting about the Clint Curtis story. It's taking longer than I had hoped because so much else is currently going on.
But since I get so many questions about that fourth page of the Affidavit, and why it looks different than the first three, let me post here at least an answer to that question right now! PLEASE feel free to point folks to this link or this information when you see them asking that particular question!
And keep being skeptical, which is good! (Though not cynical, which is not particularly helpful at all!)
Q. What's up with the fourth page of Curtis' affidavit [PDF]? The fonts and colors and pixellation were totally different than the first three pages! It must be a fake!
A. The original document was black and white except for the purple ink in the signature on the final page. The person who scanned it had the scanner set on an "Automatic" setting and the scanning program apparently kicked into Color mode only when it got to the purle signature on the last page.
I was concerned that folks would get distracted by that, as silly as it is, when the scan was first sent to me, so I asked to have it rescanned and resent. They did so, and it came back the same way again. The person doing the scanning couldn't figure out how to change it, and then had to get to a meeting. So that's the version I had to go with as I had to get the story out (for reasons explained in our original story itself.)
Please note, these aren't 40 year old documents! This is not the Dan Rather story where shadowy, anonymous figures had presented documents claiming they came from unnamed sources. This affidavit was signed, notarized, scanned and sent to me on Monday of this week! And the guy who created them -- Clint Curtis -- has gone very public in saying so! He was on the radio yesterday morning continuing to do just that!
As well, the copies of the affidavit that have been received by congressional people looking into this, and the folks at CREW who are looking into Curtis' claim are copied from the original. Not from the scan that I released with the story on Monday.
In truth, I don't really even understand the charge of "the affidavit is fake!" in the first place. If it was a fake, I'd think the person whose name is on them as swearing it to be truthful under penalty of perjury would likely have come forward and told the world that the affidavit was a fake!
To that end, while the skepticism is healthy and I share Curtis' point (quoted here yesterday) encouraging folks to research his claims and attempt to prove them false, it would be more useful perhaps if folks investigated the substance of the charges contained in the documents signed by the guy who admits he signed them! Debunking the substance of Curtis' story is more useful to everyone than getting stuck on some archane technical concerns make no sense anyway if one bothers to ponder it.
But since I get so many questions about that fourth page of the Affidavit, and why it looks different than the first three, let me post here at least an answer to that question right now! PLEASE feel free to point folks to this link or this information when you see them asking that particular question!
And keep being skeptical, which is good! (Though not cynical, which is not particularly helpful at all!)
Q. What's up with the fourth page of Curtis' affidavit [PDF]? The fonts and colors and pixellation were totally different than the first three pages! It must be a fake!
A. The original document was black and white except for the purple ink in the signature on the final page. The person who scanned it had the scanner set on an "Automatic" setting and the scanning program apparently kicked into Color mode only when it got to the purle signature on the last page.
I was concerned that folks would get distracted by that, as silly as it is, when the scan was first sent to me, so I asked to have it rescanned and resent. They did so, and it came back the same way again. The person doing the scanning couldn't figure out how to change it, and then had to get to a meeting. So that's the version I had to go with as I had to get the story out (for reasons explained in our original story itself.)
Please note, these aren't 40 year old documents! This is not the Dan Rather story where shadowy, anonymous figures had presented documents claiming they came from unnamed sources. This affidavit was signed, notarized, scanned and sent to me on Monday of this week! And the guy who created them -- Clint Curtis -- has gone very public in saying so! He was on the radio yesterday morning continuing to do just that!
As well, the copies of the affidavit that have been received by congressional people looking into this, and the folks at CREW who are looking into Curtis' claim are copied from the original. Not from the scan that I released with the story on Monday.
In truth, I don't really even understand the charge of "the affidavit is fake!" in the first place. If it was a fake, I'd think the person whose name is on them as swearing it to be truthful under penalty of perjury would likely have come forward and told the world that the affidavit was a fake!
To that end, while the skepticism is healthy and I share Curtis' point (quoted here yesterday) encouraging folks to research his claims and attempt to prove them false, it would be more useful perhaps if folks investigated the substance of the charges contained in the documents signed by the guy who admits he signed them! Debunking the substance of Curtis' story is more useful to everyone than getting stuck on some archane technical concerns make no sense anyway if one bothers to ponder it.
5 Comments:
Look, the biggest hole I see in all this is Curtis's claim that if you don't have the source code, you can't detect the hack. This is untrue because if you have a voting machine, you can get the object code and while it's true not as many people speak object code as once did, with some sweat you can figure out what's happening.
However, depending on how the code was stored in the voting machine, you could obscure the hack and/or erase it. Particularly if you collect up all the voting machines or tie into them remotely.
If the code is in ROM, it stays there until you take it out (but watch for patches!). If there's a hard disk in the voting machine, then the code can be written to it and it can also be written over, etc. The best way to do this is by remotely logging in and overwriting the code with something else. However, unless (and even if you're the NSA), the disk is "sand blasted" (repeatedly overwritten with the hexadecimal value FF), it is still possible to find some or all of the overwritten code - but not easy and maybe not at all.
But if you have remote access, just load the hack into memory. Then when the machine is turned off, it goes away. I suppose if you want the kind of proof conspiracy theorists like, this would be "proven" by the fact that the Diebold machines are supposedly accessible remotely with no security protection.
"Just 'cause you're paranoid doesn't mean they're not all out to get you."
Conversely, having a chunk of source code doesn't prove anything unless you can prove that's what's loaded on the machine - and you don't load source code, you load compiled (object) code onto la machine. So again, Curtis's assertion that if you have the source code, the hack can be detected is at least not precise.
"Look, the biggest hole I see in all this is Curtis's claim that if you don't have the source code, you can't detect the hack."
I wouldn't consider that a "hole" in his claim. I'd consider that a difference of opinion that you may have him.
Since extraordinary measures (decompiling, etc.) would need to be taken only *after* a suspect vote occurred (for example Election 2004) in order to determine only *then* if the code had trouble, the point I understood Curtis to make is a valid one.
If you can't hide the "rigging code" (as Curtis claims Feeney requested) in the source code itself, it's certainly harder to notice! That is, unless the source code is proprietary and nobody is allowed to review it before it's used in the voting or tabulating machines.
"Curtis's assertion that if you have the source code, the hack can be detected is at least not precise. "
I don't believe that was his assertion. I believe it was that if you review the source code *before* it's compiled, it's very difficult (if not impossible) to hide such malevolent code.
And again, that's all that he claims he was asked to do and had said it was "virtually impossible", according to the affidavit.
If you feel he was wrong in the technical assessments he gave to Feeney and Yang, you are certainly entitled to the opinion. However, that certainly neither debunks his claim or demonstrates a "hole" in it from what I can tell.
Well look, I hate to pick nits but you've got it backwards. What he says in the affidavit is:
"I told him [Feeney] that it would be virtually impossible to hide such code written to change the voting results if anyone were able to review the uncompiled source code. However, if the code were compiled before anyone was able to review it then any vote fraud would remain invisible to detection."
In otherwords, he's asserting that you wouldn't be able to find it once it was compiled. This is not "a difference of opinon", he's just wrong if the only difference is whether it was compiled or not. And conversely, what he said was "vitually impossible" was hiding it if they had the source code.
Now look, this is not to say he's lying nor am I saying this would be easy to do. But just because it was compiled does not mean it would "remain invisible to detection". And yes, you have to look for it. Does this mean that Diebold was wrong in keeping the code secret? Yes. Does it mean that the process of developing the software had security holes you could drive a truck through? Yes.
But we've known for some time that you could hack the election - that's why so many computer people were up in arms about the Diebold machines, suits were filed, etc. And Curtis is the first person to say "I was told to hack the election." Naming specific names, times, etc. All of which is "good" in the sense of uncovering the hack. But saying it's "impossible to detect" is not true. You asked people to poke holes, I'm poking.
Regardless of whether you're acting on source code or object code, a simple md5( file ) will produce a hash differing from other machines with unmodified code. ( md5 is a function that makes a 32(?) character hash of some source file that is extremely hard to duplicate once changing the file.)
However, I still don't see this as a "hole" in Curtis' story. In his affidavit, he was more saying that is what he told Feeney... not what he himself knows. In other words, he may have been simplifying it for a layman.
OK, OK, I retract the hole. What bothered me is that it indicated a lack of sophistication in his knowledge of software. Which, having seen his code, I understand. His competence and knowledge of software will be attacked if it hasn't been already.
In re hash/diff algorithms, this will indeed find if code has been changed providing you have a "before and after" snapshots. And what needs to be done is to think through finding such hacks for validation. To do this we need to a. get hold of a voting machine asap, particularly one that hasn't been plugged into a modem, b. get either the source code they have refused to release through legal recourse) or better, a machine that produced suspect results, c. compare the diff's, d. if they don't match, get to analyzing why - what changed.
These are the broad steps anyway.
Post a Comment
<< Home