Ron Rivest, of RSA fame, has published a paper (PDF) describing a new voting system:

Not only can each voter verify that her vote is recorded as she intended, but she
gets a “receipt� that she can take home that can be used later to verify that her vote is actually included in the final tally. Her receipt, however, does not allow her to prove to anyone else how she voted.

In brief, the system allows the voter to create three ballots and then take a copy of one of them as a receipt. Attackers would not know which ballot was the real one, thus creating privacy, while the voter would have a copy of the original, thus creating verifiability. I haven’t finished reading it yet, but the first question that jumps to mind is what happens if the voter forges or alters their receipt to dispute the recorded votes?

I can not resist commenting on this story. It does not surprise me that a three-year old child was able to use a computer to purchase a real automobile on an auction site. In fact I can just imagine a high-tech company executive telling his/her staff “I want this system to be simple enough for a baby to use!”

Sometimes companies can go overboard thinking that the obstacle to the flow of money is a little bit of authentication, or a simple authorization check. But there needs to be a balance. Making things too easy leads to a higher rate of fraud and frustration among those trying to undo unauthorized or unathenticated purchases. And so what actually surprised me was the mother’s reaction:

Mrs Neal, of Sleaford, Lincolnshire, said she had left her eBay password in her computer and her son had used the “buy it now” button.

She said: “Jack’s a whizz on the PC and just pressed all the right buttons.

“I was just horrified.

“We now have the parental locks on – and we make sure we sign out of eBay!”

Note that she said rather specifically that she does not sign out of anything else, just eBay. Is that the right lesson? Baby buys car on eBay, mother signs out of eBay. Baby buys new computer on Amazon…

Sad story about the psychological effects of managing a system that can not be trusted.

Two miners whose jobs included watching for safety hazards inside the Sago Mine before the deadly explosion last January committed suicide in the past month.

Neither man had been blamed for the disaster that killed 12 of their comrades, and neither one’s family has definitively linked the suicides to the accident. But those who knew the men say there is little doubt the tragedy haunted them.

Tragedy beset by more tragedy. This part of the report was also disturbing:

Boni, who was certified as a fireboss and occasionally conducted pre-shift inspections to ensure the safety of incoming crews, told investigators he had detected low levels of methane in that area five days earlier and reported his findings to a supervisor, who was not alarmed.

As for Chisholm, he told investigators that a carbon monoxide alarm had sounded about 20 minutes before the explosion. Following ICG procedure, he alerted a crew inside the mine and asked it to verify the alarm because the system that had a history of malfunctions.

At a hearing in May, ICG executive Sam Kitts said miners are not required to evacuate when there is an alarm; they verify it, then decide how to proceed.

“The dispatcher did what he was supposed to do. He notified a maintenance person who was then able to go up and check the sensor before they would have again advanced onto the section,” Kitts testified.

The men may have blamed themselves, struggled with investigators’ visits, or buckled from public scrutiny, or all three. And yet we see that they were forced to make calls based on a system with “a history of malfunctions”. Does the system manufacturer carry liability as much as the operations management, or even the operators themselves? What was the accepted standard for a functioning mine alarm system? Was it accurate 50 or 90% of the time? I know that an intrusion detection system that gives anything more than 40 or 50% false positives, especially in high traffic areas, is a problem. That number might seem low, but the cost/benefit analysis of getting an intrusion detection system above 90% often reveals better investments in security. Perhaps miners would be better served by new breathing apparatus rather than slightly better alarms.

I also wonder how the cost of a false positive weighed upon the alarm operators (e.g. what was the tone of the workers and managers when a mine was stopped and the workers evacuated — annoying and unnecessary interuptions, lost revenue, better safe than sorry, etc.)?