Wednesday, May 10, 2006

New security glitch found in Diebold system

It can get boring standing at a touchscreen voting system trying to decide between the least palitable candidate. Bring a thumbdrive with "PacMan" on it. There is nothing like eating pills to make you feel better about selecting people to run your government.

source http://www.insidebayarea.com/ci_3805089?source=rss
New security glitch found in Diebold system
Officials say machines have 'dangerous' holes
By Ian Hoffman, STAFF WRITER

Elections officials in several states are scrambling to understand and limit the risk from a "dangerous" security hole found in Diebold Election Systems Inc.'s ATM-like touch-screen voting machines.

The hole is considered more worrisome than most security problems discovered on modern voting machines, such as weak encryption, easily pickable locks and use of the same, weak password nationwide.

Armed with a little basic knowledge of Diebold voting systems and a standard component available at any computer store, someone with a minute or two of access to a Diebold touch screen could load virtually any software into the machine and disable it, redistribute votes or alter its performance in myriad ways.

"This one is worse than any of the others I've seen. It's more fundamental," said Douglas Jones, a University of Iowa computer scientist and veteran voting-system examiner for the state of Iowa.

"In the other ones, we've been arguing about the security of the locks on the front door," Jones said. "Now we find that there's no back door. This is the kind of thing where if the states don't get out in front of the hackers, there's a real threat."

This newspaper is withholding some details of the vulnerability at the request of several elections officials and scientists, partly because exploiting it is so simple and the tools for doing so are widely available.

A Finnish computer expert working with Black Box Voting, a nonprofit organization critical of electronic voting, found the security hole in March after Emery County, Utah, was forced by state officials to accept Diebold touch screens, and a local elections official let the expert examine the machines.

Black Box Voting was to issue two reports today on the security hole, one of limited distribution that explains the vulnerability fully and one for public release that withholds key technical details.

The computer expert, Harri Hursti, quietly sent word of the vulnerability in March to several computer scientists who advise various states on voting systems. At least two of those scientists verified some or all of Hursti's findings. Several notified their states and requested meetings with Diebold to understand the problem.

The National Association of State Elections Directors, the nongovernmental group that issues national-level approvals for voting systems, learned of the vulnerability Tuesday and was weighing its response. States are scheduled to hold primaries in May, June and July.

"Our voting systems board is looking at this issue," said NASED Chairman Kevin Kennedy, a Wisconsin elections official.

Advertisement

"The states are talking among themselves and looking at plans to mitigate this."

California, Pennsylvania and Iowa are issuing emergency notices to local elections officials, generally telling them to "sequester" their Diebold touch screens and reprogram them with "trusted" software issued by the state capital. Then elections officials are to keep the machines sealed with tamper-resistant tape until Election Day.

In California, three counties — San Joaquin, Butte and Kern — plan to rely exclusively on Diebold touch screens in their polling places for the June primary.

Nine other counties, including Alameda, Los Angeles and San Diego, will use Diebold touch screens for early voting or for limited, handicapped-accessible voting in their polling places.

California elections officials told those counties Friday that the risk from the vulnerability was "low" and that any vote tampering would be revealed to voters on the paper read-out that prints when they cast their ballots, as well as to elections officials when they recount those printouts for 1 percent of their precincts after the election.

"I think the likelihood of this happening is low," said assistant Secretary of State for elections Susan Lapsley. "It assumes access and control for a lengthy period of time."

But scientists say that is not necessarily true.

Preparations could be made days or weeks beforehand, and the loading of the software could take only a minute or so once the machines are delivered to the polling places. In some cases, machines are delivered several days before an election to schools, churches, homes and other common polling places.

Scientists said Diebold appeared to have opened the hole by making it as easy as possible to upgrade the software inside its machines. The result, said Iowa's Jones, is a violation of federal voting system rules.

"All of us who have heard the technical details of this are really shocked. It defies reason that anyone who works with security would tolerate this design," he said.

Contact Ian Hoffman at ihoffman@angnewspapers.com.

Monday, May 01, 2006

Electronic voting switch threatens mass confusion

Those great examples of captalism, voting machine vendors such as Diebold and ES&S continue to wow everyone with their technical prowess, and integrity. Remember, it's not about doing a good job, its about winning the lucrative state contract.

And we aren't even talking about how easy the systems are to hack or execute voter fraud. This is just how poor they are at execution.

I have a better idea. Why don't we just offshore our election counting systems to China or India? It will save a alot of money and if we are going to have our heads in the sand about handing over our elections to a private enterprise, why not go all the way and give it to a private enterprise in a different country? How about Russia? I here they have very equatable elections. Only Putin is allowed to win.

Electronic voting switch threatens mass confusion
Published: May 1 2006 23:22 | Last updated: May 1 2006 23:22

source: http://news.ft.com/cms/s/a1b985a4-d960-11da-8b06-0000779e2340.html

The last three election cycles in the US have been marked by controversy not only about candidates, but also about the fairness and accuracy of the voting process. And as voters head to the polls today for primaries in some jurisdictions, the coming cycle promises more of the same.

With about 8,000 separate election authorities managing approximately 175,000 polling places and perhaps as many as 150,000 different ballot forms that include choices for everyone from senator to dogcatcher, American elections are complex even when all goes well. But this cycle sees many states and smaller jurisdictions making last-minute efforts to switch to electronic voting, and early signs of trouble are appearing.

In California, the League of Women Voters has protested against a new, computerised statewide election registry that the group says is improperly rejecting registered voters, while county clerks in several Indiana jurisdictions complained that the electronic ballots programmed by the vendors of their electronic voting machines had been delivered late, were incorrect and poorly proofread.

The clerk for Marion County – the state’s most populous – said that, so far, nine rounds of “fixes” had been required; she was unsure whether the primary vote today could be held without problems, according to The Indianapolis Star.

The scramble to convert to electronic voting has spurred disputes with vendors of the new machines. Last month, Oregon filed a breach of contract lawsuit against Election Systems & Software, alleging that the company reneged on a commitment to supply the state with electronic voting machines suitable for handicapped people for its May 16 primary.

In Florida, ground zero for election disasters in 2000, the election supervisor for Leon County allowed anti-electronic voting activists to try breaching security in the county’s optical scan voting system, prompting the big three electronic voting systems companies – Diebold, Election Systems & Services, and Sequoia – to refuse to sell the county new machines. The Florida secretary of state has since opened an anti-trust investigation.

After the 2000 presidential election made “hanging chad” a sure laugh line for television comics, Congress passed the “Help America Vote Act”, or Hava.

The law promised states funding to replace old voting technology with computerised systems.

The new systems fall into two categories – optical scan systems, in which voters mark paper ballots that are read by computer scanners, and direct recording electronic (DRE) systems in which voters touch computer screens or push buttons to mark their ballots.

But delays in setting standards, insufficient funding for Hava, and lack of technical expertise among the nation’s election administrators have election experts predicting the 2006 election will not run smoothly.

Last September, the US Government Accountability Office issued a report with a litany of potential flaws in the reliability and sec-urity of electronic voting and warned that steps needed to ensure voter confidence in the integrity of the vote were unlikely to be in place in time for the 2006 election.

A principal author of the report, analyst David Powner, said in an interview that since last autumn, nothing had happened to change the report’s conclusions.

One problem is that many of the new voting machines that will be deployed are arriving from offshore manufacturing sites – mainly China – and are being rushed into service without adequate quality controls, says Kimball Brace, president of Election Data Services, a voting consultancy firm.

In some cases, election officials are “getting equipment three weeks before the election”.

“We’re all behind the eight ball,” says Mr Brace.

“There are going to be enough problem areas that the issue of voting will be front and centre on everybody’s plate.”

Texans who want to vote early in elections set for May 12 may be voting on paper ballots because Election Systems & Software, one of the big e-voting machine vendors, is late in providing computer coding and electronic ballots for some of the 140 counties that use the company’s machines. The company’s president went to the state last week to mollify irritated election officials.