HACKER Q&A
📣 thrownawayer009

Security researchers, Am I dumb?


First, I assign no party to have done the following, but I am genuinely curious:

Why do I feel like it is so easy to do the following:

1) Secure Equifax data for SSN, Names, Addresses

2) Ensure person is valid registered voter in SOS website

3) Identify which are least likely to vote

4) Request a ballot on behalf of valid registered voter

5) Spread requests across leases and owned properties or PO Boxes

6) Collect, fill in, and send ballots

People have done crazier things for lottos when the odds get right. The only hitch here is matching a signature to the voter registration, which if I were an enterprising lad, might be easy, no?


  👤 smt88 Accepted Answer ✓
> Secure Equifax data for SSN, Names, Addresses

What does this mean?

> The only hitch here is matching a signature to the voter registration, which if I were an enterprising lad, might be easy, no?

No. Even if signature-matching were a legitimate process, it's still not easy to see someone's signature.

The real hitch here is that this doesn't scale. Even if you pull it off perfectly, it's:

- expensive

- difficult

- easily discovered by the voter

- possibly fruitless if the voter was on your side already

And even if you could make it scale, you'd have to have massive scale to actually sway an important election. You don't know ahead of time which counties (or even states!) will be crucial to the election. You can guess, but you can't narrow it down to one.

So if I were trying to sway the current presidential election, I would have had to alter 10,000+ votes in multiple states. If my success rate (meaning I'm not discovered) is 50%, suddenly I had to alter 20,000 votes.

Once you get to election fraud of that size, you become pretty easy to find, and someone is likely to notice and find you.

> Identify which are least likely to vote

This part is also impossible. If it were possible, polls would be a lot more accurate.


👤 neckardt
A few problems with this.

1) You need to get access to this data first, which is hard. But certainly possible for a nation state to do. Not easy for random individuals.

3) You can't guarantee whether or not someone will vote. Voting twice is a federal crime, and we routinely arrest people for this. If this were done on a wide scale we would see a large spike in these types of arrests as plenty of people who were identified as unlikely to vote would still vote, triggering the FBI to make an arrest. Of course those arrested would then claim they didn't vote twice, and you would be arresting the people who's identity was stolen rather than the perpetrator.

I think those two reasons both rule out the case of individuals doing this, and a large organization doing this systematically. Maybe there are still some loopholes I missed though.


👤 chaganated
people systems are never easy