Slashdot Mirror

And they have the nerve to brag about how they help 'protect' the Bill of Rights.

Doesn't it seem strange that Diebold would have these problems, resulting in an election going to a republican when the CEO is a Bush supporter? A google search quickly found evidence of a link between Diebold and the Republicans. Sure some of the link were not real friendly towards Bush and might be easily discounted. But then I found news release! Clearly this needs investigation.

Diebold is not a tiny outfit of a handful of techies. They have 13,000 employees in at least 600 locations.

Straight from their web site

SAIC's independent review states, "While many of the statements made by Mr. Rubin were technically correct, it is clear that Mr. Rubin did not have a complete understanding of the State of Maryland's implementation of the AccuVote-TS voting system...The State of Maryland's procedural controls and general voting environment reduce or eliminate many of the vulnerabilities identified in the Rubin report."

SAIC's report continues, "Rubin states repeatedly that he does not know how the [Diebold] system operates in an election and he further identifies the assumptions that he used to reach his conclusions. In those cases where these assumptions concerning operational or management controls were incorrect, the resultant conclusions were, unsurprisingly, also incorrect."

And Diebold bought it. Diebold is going Windows.

This is scary. It's going to be so tempting to hang the ATMs on the bank's internal Internet and save money. And you know Microsoft will screw up and leave a port open, or leave something in the OS that calls home. The DES protection may protect the ATM transaction messages, but what about Windows Update. And yes, Microsoft does suggest installing remote "upgrades" and "hotfixes".

This page on Diebold's website mentions that "Election results are securely stored utilizing world-class encryption techniques." As far as I can see, that's all they tell you about their encryption. Does that mean it has the same 128-bit encryption as, say, Mozilla? (Which, I suppose, is still pretty darn secure, but probably not "world class.") Is the "world class" bit is just marketing hype? Diebold doesn't say anything, which makes me a little nervous.

And what about their wireless security? You can store votes in a steel box protected by voracious bears, but if they (the votes, not the bears) aren't protected on the way to wherever it is that they count them up, it doesn't make much of a difference. (I'm assuming here that that is what the wireless networking is used for). Is Diebold using WEP, which can be broken in a couple of hours? Unless Diebold has adopted WPA early (which, given their track record on security, I kinda doubt), some schmuck could sit in his car outside the polling place and run a wireless packet sniffer on whatever traffic is being sent.

The way that Diebold seems to be hiding information on its machines' security is disturbing - you'd think that if they had solid software they'd talk a little about it to impress potential customers, rather than just making vague blanket statements. Given everything that's happened, though, that's apparently is not the case.

This is the machine I've seen in the SLO polling places. Note the features section. Specifically, "Teleresults for timely modem transmission of precinct results". :(

It doesn't mean the machines talked to each other. It means they talked to the server running GEMS (Global Election Management System).

The study the article references (by Johns Hopkins ) can hardly be considered a valid study. For an institution as highly regarded as Johns Hopkins, you'd think they'd have a substantive case before publishing such a study. The thing was replete with guesses and "what-ifs." They set up the software on a Windows PC, which is not the way the software is used in the real world. In fact, it's not even the same OS they use in the real world. Diebold, the company who makes the software, has (predictably) published 2 responses to the study. Both of them are .pdf.

Follow up statement
and

Technical Response

Of course, you'd expect them to refute the study, but their claims are valid ones. You can't fairly critique a system unless you can duplicate the process as closely as possible from start to finish. JH didn't do that.

However, all that said, I still agree with their initial assertion that all election software should be open sourced. Even though, as one poster said, the code would be incredibly, mind-numbingly boring to read, it would still be worth it to be able to have the code reviewed.

The study the article references (by Johns Hopkins ) can hardly be considered a valid study. For an institution as highly regarded as Johns Hopkins, you'd think they'd have a substantive case before publishing such a study. The thing was replete with guesses and "what-ifs." They set up the software on a Windows PC, which is not the way the software is used in the real world. In fact, it's not even the same OS they use in the real world. Diebold, the company who makes the software, has (predictably) published 2 responses to the study. Both of them are .pdf.

Follow up statement
and

Technical Response

Of course, you'd expect them to refute the study, but their claims are valid ones. You can't fairly critique a system unless you can duplicate the process as closely as possible from start to finish. JH didn't do that.

However, all that said, I still agree with their initial assertion that all election software should be open sourced. Even though, as one poster said, the code would be incredibly, mind-numbingly boring to read, it would still be worth it to be able to have the code reviewed.

Yeah, that would be really weird.

Yeah, that would be really weird.

Yeah, that would be really weird.

http://www.tse.gov.br/eleicoes/eleicoes2002/

The results were known within hours. The code is digitally signed, and the parties were allowed to check the source code. There is no wires, the device generates a diskette that is encrypted and signed before being sent to TSE. Some cities was experimenting a printer attached to extra security.

Diebold voting terminals

Brazil's vote - fast but fiddly

From the Diebold Election Systems website:

http://www.diebold.com/whatsnews/images/touchscree n_vote.jpg

It didn't fail. IBM still sells OS/2 for the princely sum of $284.00 USD.
Nobody buys it you say?
Then how do Diebold use it on their old, and new ATM's? Because they buy copies of it. From IBM. (although they do get a discount of some sort, my guess is) They make a lot of ATM's, worldwide.
GPL something that still makes them money? What a good idea..