Incident: Hacking Attack and Computer Malfunction Delay Poland's Vote Count.

Published Date: 2014-11-20

Postmortem Analysis
Timeline 1. The software failure incident, involving a computer malfunction delaying the vote count for recent local elections in Poland, happened around November 2014. [31974]
System 1. State Electoral Commission's website 2. Voting system (not confirmed to be breached) 3. Computer glitch causing hand count of votes 4. National Electoral Office system (Kazimierz Czaplicki resigned over the vote count delays) [31974]
Responsible Organization 1. Hackers: The software failure incident was caused by a hacking attack on the website of the State Electoral Commission, as reported in Article 31974. [31974]
Impacted Organization 1. State Electoral Commission's website [31974] 2. National Electoral Office [31974]
Software Causes 1. A computer malfunction that delayed the vote count from the recent local elections [31974]. 2. Hackers entered the State Electoral Commission's website, although they did not breach the voting system itself [31974]. 3. A separate computer glitch forced a hand count of votes in some places, further delaying the full returns [31974].
Non-software Causes 1. Protesters storming Poland's main voting commission and occupying the building due to anger over the delay in the vote count for recent local elections [31974]. 2. Allegations of irregularities and hacking attacks on the website of the commission [31974]. 3. The need for a hand count of votes in some places due to a separate computer glitch [31974]. 4. Resignation of Kazimierz Czaplicki, the head of the National Electoral Office, over the vote count delays [31974].
Impacts 1. The software failure incident, including a computer malfunction and a separate glitch, led to delays in the vote count for recent local elections in Poland, causing frustration among the protesters who stormed the main voting commission [31974].
Preventions 1. Implementing robust cybersecurity measures to prevent hacking attacks on the website of the commission [31974]. 2. Conducting thorough testing and quality assurance of the voting system software to identify and address any potential glitches or faults before the election day [31974]. 3. Ensuring regular maintenance and updates of the voting system software to prevent unexpected computer malfunctions that could delay the vote count [31974].
Fixes 1. Implementing stronger cybersecurity measures to prevent hacking attacks on the voting commission's website [31974]. 2. Conducting a thorough investigation and fixing the computer glitch that forced a hand count of votes in some places [31974]. 3. Ensuring proper maintenance and testing of the voting system software to prevent future incidents of delays in the vote count [31974].
References 1. Warsaw prosecutors' spokesman, Przemyslaw Nowak [31974] 2. Head of the National Electoral Office, Kazimierz Czaplicki [31974]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown (a) The software failure incident related to the delay in the vote count for recent local elections in Poland was not explicitly mentioned to have happened again within the same organization or with its products and services in the provided article [31974]. (b) The article [31974] does not provide information about a similar incident happening again at other organizations or with their products and services.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident from the article. The delay in the vote count for recent local elections in Poland was attributed to a computer malfunction that occurred due to a system development issue. Protesters stormed Poland’s main voting commission, demanding the resignation of commission members over the computer malfunction that was causing delays in the vote count [31974]. (b) The software failure incident related to the operation phase is also highlighted in the article. A separate computer glitch forced a hand count of votes in some places, leading to delays in the full returns of the election results. This glitch was a result of operational issues or misuse of the system, which required manual intervention to count the votes [31974].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident mentioned in the article is related to a computer malfunction that is delaying the vote count for recent local elections in Poland. The article states that a separate computer glitch has forced a hand count of votes in some places, contributing to the delay in the full returns [31974]. These issues are internal to the system responsible for the vote count process. (b) outside_system: The article also mentions that prosecutors are investigating a hacking attack on the website of the commission. However, it is specified that the initial evidence suggests the hackers entered the State Electoral Commission’s website but not the voting system itself [31974]. This indicates that the hacking attack originated from outside the system, affecting the website rather than the core voting system.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case appears to be a combination of non-human_actions and human_actions. 1. Non-human_actions: The article mentions a computer malfunction that is delaying the vote count from Sunday's nationwide vote. Additionally, there was a separate computer glitch that forced a hand count of votes in some places, further delaying the full returns [31974]. 2. Human_actions: The article also highlights that prosecutors are investigating a hacking attack on the website of the commission. It is mentioned that initial evidence suggests hackers entered the State Electoral Commission's website, although not the voting system itself [31974]. Additionally, a top official, Kazimierz Czaplicki, resigned over the vote count delays, indicating human involvement in the incident [31974].
Dimension (Hardware/Software) hardware (a) The software failure incident in the article is related to hardware as there was a computer malfunction that delayed the vote count for the recent local elections. Additionally, there was a separate computer glitch that forced a hand count of votes in some places, further contributing to the delay in the full returns [31974].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The software failure incident mentioned in the article is related to a hacking attack on the website of Poland's main voting commission. The protesters stormed the commission and demanded the resignation of its members over a computer malfunction that was delaying the vote count for recent local elections. Prosecutors were investigating the hacking attack on the commission's website, indicating a malicious intent to disrupt the voting process [31974]. (b) Additionally, a separate computer glitch was mentioned in the article, which forced a hand count of votes in some places, further delaying the full returns. This glitch was not attributed to malicious intent but rather described as a technical issue causing delays in the vote count process [31974].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident mentioned in the articles seems to be related to poor decisions. The delay in the vote count for the recent local elections in Poland was attributed to a computer malfunction and irregularities that led to the need for a hand count of votes in some places. Additionally, the head of the National Electoral Office resigned over the vote count delays, indicating accountability for the issues faced [31974].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident in this case seems to be more related to development incompetence rather than accidental factors. The protesters stormed Poland's main voting commission and demanded the resignation of commission members over a computer malfunction that was delaying the vote count for recent local elections. Additionally, a top official resigned over irregularities that were causing delays in the vote count process. The incident involved a hacking attack on the commission's website and a separate computer glitch that forced a hand count of votes in some places, further delaying the full returns. These issues point towards failures or shortcomings in the development and maintenance of the voting system rather than accidental factors [31974].
Duration temporary (a) The software failure incident described in the articles seems to be temporary rather than permanent. The delay in the vote count for the recent local elections in Poland was attributed to a computer malfunction and a separate computer glitch that forced a hand count of votes in some places. Prosecutors were investigating a hacking attack on the website of the commission, but it was mentioned that the hackers entered the State Electoral Commission’s website and not the voting system itself. Additionally, a top official resigned over irregularities causing delays in the vote count, indicating that the issue was not a permanent failure but rather a temporary one that affected the timely processing of election results [31974].
Behaviour timing, other (a) crash: The software failure incident mentioned in the articles is not specifically described as a crash where the system loses state and does not perform any of its intended functions. (b) omission: The software failure incident is not directly linked to the system omitting to perform its intended functions at an instance(s). (c) timing: The software failure incident is related to timing issues as there was a delay in the vote count for recent local elections due to a computer malfunction and a separate computer glitch that forced a hand count of votes in some places, causing delays in the full returns [31974]. (d) value: The software failure incident is not explicitly attributed to the system performing its intended functions incorrectly. (e) byzantine: The software failure incident does not involve the system behaving erroneously with inconsistent responses and interactions. (f) other: The behavior of the software failure incident in this case is primarily related to delays in the vote count process due to computer malfunctions and glitches, leading to protests and calls for resignations [31974].

IoT System Layer

Layer Option Rationale
Perception sensor, processing_unit, network_communication (a) sensor: The article mentions a computer malfunction that is delaying the vote count, which could be related to sensor errors if the sensors collecting the voting data are not functioning correctly [31974]. (b) actuator: The article does not specifically mention any issues related to actuators in the context of the software failure incident. (c) processing_unit: The article mentions a separate computer glitch that has forced a hand count of votes in some places, indicating a potential issue with the processing unit [31974]. (d) network_communication: The article mentions that prosecutors are investigating a hacking attack on the website of the commission, which could be related to network communication errors [31974]. (e) embedded_software: The article does not provide direct information about embedded software errors in the context of the software failure incident.
Communication unknown The software failure incident mentioned in the article does not provide specific details indicating whether the failure was related to the communication layer of the cyber physical system that failed. The incident mentions a computer malfunction delaying the vote count, a hacking attack on the website of the commission, and a separate computer glitch that forced a hand count of votes in some places. However, it does not explicitly specify whether these issues were at the link_level (wired or wireless physical layer) or connectivity_level (network or transport layer) of the cyber physical system. Therefore, it is unknown whether the failure was specifically related to the communication layer based on the information provided in the article.
Application FALSE The software failure incident mentioned in Article 31974 was not related to the application layer of the cyber physical system. The failure was attributed to a hacking attack on the website of the State Electoral Commission and a separate computer glitch that forced a hand count of votes, leading to delays in the vote count process. Therefore, the failure was not due to bugs, operating system errors, unhandled exceptions, or incorrect usage at the application layer [31974].

Other Details

Category Option Rationale
Consequence delay (a) death: People lost their lives due to the software failure (b) harm: People were physically harmed due to the software failure (c) basic: People's access to food or shelter was impacted because of the software failure (d) property: People's material goods, money, or data was impacted due to the software failure (e) delay: People had to postpone an activity due to the software failure (f) non-human: Non-human entities were impacted due to the software failure (g) no_consequence: There were no real observed consequences of the software failure (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? The articles do not mention any consequences related to death, harm, basic needs, property loss, or impact on non-human entities due to the software failure incident. The consequences discussed include delays in the vote count for local elections, protesters storming the voting commission, hacking attacks on the commission's website, irregularities causing delays in the vote count, and the resignation of a top official over the delays. These consequences fall under the category of delays [(31974)].
Domain information, finance, government (a) The failed system was intended to support the information industry as it was related to the State Electoral Commission's website and the vote count for recent local elections [31974]. (h) Additionally, the software failure incident was linked to the finance industry indirectly as it involved the manipulation and movement of money for profit in the context of the election process and potential impacts on political outcomes [31974].

Sources

Back to List