Diebold Audit Released, BlackBoxVoting.Org Shut Down

Chris Soghoian writes "The State of Maryland requested an audit of the Diebold electronic voting system by SAIC, after a report released by Johns Hopkins University and Rice Researchers (disclaimer: I'm one of Dr Rubin's students) noted several security issues. A condensed, from 200 to 40 pages, and censored version of the report has been released online (PDF link). The report notes that 'SAIC has identified several high-risk vulnerabilities that, if exploited, could have significant impact upon the AccuVote-TS voting system operation.'" However, Diebold says Maryland are moving forward with installation with "new security features" included, and elsewhere, Badgerman points out "Diebold has shut down blackboxvoting.org, apparently with copyright claims made to their ISP. But you can still go to the blackboxvoting.com site."

Comments

Diebold is winning

[corebreech]

Pending: your vote is now the property of Diebold, Inc. Any attempt on your part to ascertain the disposition of your vote is hereby declared to be in violation of federal law, e.g., the Digital Millenium Copyright Act.

You have the right not to vote. Any vote you make can be used against you in a court of law. The judge presiding in such a court of law may be appointed by Diebold, Inc., and need not require a jury, but if a jury is summoned, it need not be a jury of your peers.

By acting to vote you consent to our determining whether your vote is valid, and in the event it is judged not to be valid, you consent to our voiding your vote and further voiding your right to vote in the future.

You furthermore acknowledge that owing to storage and bandwidth limitations that Diebold, Inc., may experience, your vote may be digitally compressed in a way such that your true intent in casting the vote may be lost. If such an eventuality should occur, your vote may be determined using statistical data derived from any source we deem appropriate or convenient.

You have the right to protest if your vote is cancelled, altered, or in any way modified as the result of such action on our part, however, you hereby acknowledge that in such an eventuality, Diebold, Inc. may determine that your right to vote is deleterious to democracy as implement by Diebold, Inc., and therefore may be considered to be an overt act against the national security of these United States.

You have 10 seconds to comply.

God Bless America.

hanging bits?

[kd5ujz]

Are we going to have to check the bit bucket for hanging bits?

I insist on paper and pencil voting

[Anonymous Coward]

How else can I add one option at the end of the ballot:

__X__ CowboyNeal

Re:Why is the mass media not all over this????

[kramer2718]

Why? Because the mass media has no interest in overthrowing the corrupt big-business driven world of politics. And why should they? All the major media companies are owned by huge corporations who profit by people not being fairly represented. How does that work? Well, if people were fairly represented, then campaign finance reform would happen and businesses wouldn't be able to bribe our elected officials. Yes, I know there's not a direct connection to Diebold voting systems except that Diebold IS big business.

Undprecedented!!!

[ChangeOnInstall]

Just read this quote from a Diebold press release that is being refuted on blackboxvoiting.com:

"The thorough system assessment conducted by SAIC verifies that the Diebold voting station provides an unprecedented level of election security." (emphasis mine)

Unfortuantely, in this case, blackboxvoting is quite wrong, and Diebold press release is entirely correct. You see, the word "unprecedented" doesn't necessarily mean "good". It means "without precedent". The level of security offered by these voting machines is most certainly "without precedent".

Auditor Weighs In

[Inexile2002]

We are f**ked. If a political system is so broken that it can't keep this from getting through then... well...

We are f**ked.

I really am an IT Auditor for a living and this is exactly the kind of work I do (although I mostly work for Utility Companies like water or electricity) and I know how these reports are created. There is HUGE pressure to "build assurance".

What that means is that you find an risk that is not addressed by a suitible control - and try to find a control - something, anything, that you can call a control to cover that risk. That's all fine and good, but what it means is that the risks that actually make it into the report are the really big, bad, completely unaccounted for ones. Put another way, for every risk that gets in, three didn't that a normal person would have thought should have.

Long and short, I write reports like this for a living and this is way, way, way worse than it looks.

Why not hand-count?

[daffmeister]

With all the problems with electronic voting, punch-card voting, hanging chads etc, why even use machines for vote counting? Why not just have paper and pencil and hand-count?

Federal elections in Australia with a population of 20 million are run this way with no problem.

Before you say, "but America has many more voters", well, they can also have many more vote counters.

Re:This is very scary: but... Diebolt will lose

[Nogami_Saeko]

On the contrary...

I rather think the Republicans aren't all that worried about a "Florida happening again". After all, it did get a Republican into the oval office didn't it...

It's odd though, speaking as a Canadian who has always though that although not perfect, the US electoral system had a fair number of checks and balances, it absolutely blows my mind that this sort of un-checked corporate crap isn't being stopped in it's tracks.

It's like 9/11 gave the politicians and big business license to do whatever the hell they want to with your entire country and the economy, and they're screwing it up at a simply astounding rate. "Patriot" take-away-your rights acts, a court denying a "do-not call list" that 50 MILLION people want for the benefit of a few telemarketing lobbyists, big companies trying to patent even the most trivial of ideas... Where does it end?

I mean, this latest info about a company making machines to support democratic elections that has no "unalterable record", easy bypassing (or complete lack) of database passwords, and executives talking about just printing "system check" on the screen without any actual checking being done because the electoral regulations require a full system check before the system begins recording votes.

Frightening, absolutely frightening...

N.

The conclusion of that thought

[Anonymous Coward]

The State of Maryland's procedural controls and general voting environment reduce or eliminate many of the vulnerabilities identified in the Rubin report."

And the report itself continues:

However, these controls, while sufficient to help mitigate the weaknesses identified in the July 23 report, do not, in many cases meet the standard of best practice or the State of MarylandSecurity Policy.

Public Beta Test in 13 Days...

[chickenwing]

Great, I live in Alameda County, CA where I remember Diebold machines being used in the last election. Now we have the recall coming up, so I guess we will just have to have some kind of blind faith that our votes are counting. I suppose if the results are other than to be expected from this more liberal area, it will raise some eyebrows.

The horrible thing is, that this is really far below the general public's radar. I find it extremely amusing that we had a court battle over how reliable punch cards are, when electronic voting may be far worse.

The problem is that the general public is very computer illiterate, and have been pretty much been conditioned to accept bugs and viruses as normal. At the same time, strangely, computers seem to be viewed as infallible.

It is very importaint for Democracy that people are able to be able to see and verify that their votes are counted.

My previous experience with the Diebold machines left me more puzzled than anything. Where was my vote counted, on the card that I put in the machine, in the machine itself, or both? Were the votes transmitted via phone, wireless, or physically transported to a centeral location? I don't know for sure, and I'm sure regular people off the street were more puzzled. Then again, maybe the thought never crossed their mind.

Re:Why is the mass media not all over this????

[kcbrown]

Seriously, is this the best we can do? Of course there are vile reasons behind Diebold's getting away with this, but do you have to resort to this tired, adolescent "mass media loves big corporations loves evil government" schtick to get your point across?

Of course, since mass media is big corporations, the above reduces to "big corporations love evil government", something which has been proven repeatedly over time.

Jesus, do you need us to spell it out for you?

1. Large corporations have a common set of interests and attributes:
   • They want to lock out as much competition as possible.
   • They want their labor pool to be as cheap as possible.
   • They want their customer base to be as captive as possible.
   • They want to be as free as possible to do whatever they want.
   • They are short-term thinkers, so they don't care about the long term consequences of their actions upon their market.
   • They are driven only by profit, so ethics never enters the equation when they decide upon an action, only law (and then, only law that they don't think they can get away with breaking) and profit.
2. Because of (1), they will naturally tend to lobby for roughly the same things, and these things will often be at odds with things that would be beneficial to the general population.
3. The media is owned, and thus controlled, by some of those very same corporations.
4. Because of (2) and (3), no federal-level politician who is unwilling to cater to the needs of the corporations that own the media is likely to win their first election, because you can't win an election if the voters don't know about you. In fact, such a politician would be very unlikely to win for that very reason.
5. You're a moron if you think the media corporations and other corporations don't talk to each other about their common interests.
6. Hence, the only politicians that, in general, can win an election are those who bow to the demands of this country's large corporations.
7. And hence, the politicians will listen to large corporations to a much greater degree than they will listen to the voters directly. Rare indeed is the issue that will galvanize an entire voter population against you if you side with the corporations. Rarer still is such an issue that the voter population hears about through the mass media; because, as I said, you're a moron if you think the media corporations don't talk with other corporations about their common interests.

Call it a "tired conspiracy theory" if you want, but the links in the chain from a to b to c are so strong and backed by so much evidence (circumstantial or otherwise) that you'd be a fool to discount this "schtick" out of hand.

Come up with a hypothesis that does a better job of explaining both what we've been seeing and what we haven't been seeing and is consistent with everything we currently know and I, for one, will sit up and take notice. But until then, this "conspiracy theory" does a better job of explaining just about everything that has been happening than anything else I've seen.

I'm no conspiracy nut. My most valuable tool is the scientific method, and most conspiracy theories are certainly crap. But this particular "schtick" is very different, and I'll continue to use it to explain the goings on until I find a better explanation.

Small correction: link to memos, not source code

[BevHarris]

I found the source code on their wide open web site (using the google search engine) in January.

The memos were sent to me by an insider, and I just got them 2 1/2 weeks ago.

This is important, because one is similar to software piracy (though debatable, because they are under some obligation to protect things if they want to call them trade secrets, and no one in their right mind would want to pirate this system, called "junk shit" by their own technicians, to resell it.

The memos, though, are just internal communications that were leaked, and once leaked and public, which they certainly are by now, when used only for fair use reasons in the public interest, the legal issues are quite different.