In Florida wurde letztes Jahr eine unabhängige Experten-Kommission einberufen, die sich die Scytl-Wahlsoftware (Pnyx.core ODBP 1.0) näher anschauen sollte. Der Abschlussbericht dazu liegt vor. Er umfasst 100 Seiten, der einerseits die Auswertung und Ergebnisse der Experten, andererseits sich auf die Ergebnisse beziehende Anmerkungen und Kommentare von Scytl selber beinhaltet

Im abschließenden Punkt Conclusion werden die Ergebnisse der Analyse zusammengefasst:

One strength of the Pnyx.core ODBP 1.0 software is that it appears to provide a reasonable degree of protection against many kinds of outsider attacks, including Internet-based attacks […] One weakness of the Pnyx.core ODBP 1.0 software is that the software mechanisms appear to provide little protection against insider malfeasance or actions by malicious insiders who exceed their authority
[…]
We were unable to provide definitive, final answers to many of the important and central questions posed to us by the State of Florida. This was not due to a lack of effort; rather, it reflects limits on current human ability to engineer computing systems so that they will behave in predictable ways. It is currently very difficult and costly to achieve a reasonable level of confidence that complex software is free of bugs, defects, flaws, or vulnerabilities that could affect its ability to perform as expected. The Pnyx.core ODBP 1.0 voting system contains hundreds of thousands of lines of source code, making it complex and beyond our ability to scrutinize every line of code carefully. Yet a single flaw in any one line of code could potentially have severe consequences. It is vanishingly unlikely that any system of this size is completely free from bugs, implementation defects, and design flaws—indeed, we found a number of such shortcomings

Zusammengefasst lässt sich also sagen, dass sich bei solch komplexer Software, das Vorhandensein von Fehlern nicht komplett ausschließen lässt. Selbst kleinste Fehler, die anscheinend auch gefunden wurden, können große Auswirkungen haben.

Zum Abschlussbericht: „Software Review and Security Analysis of Scytl Remote Voting Software“ (.pdf)

[via doncaramello]