Ohio Opts to Put Touch Screen Voting on Hold

Dachannien writes "The AP reports that Ohio's Secretary of State Kenneth Blackwell is asking the Feds for an extension of the deadline for installing touch-screen voting machines at polling places for the 2004 election, citing numerous security concerns. The problems discovered in a review of 57 areas of concern include such gems as "software that permits votes to be counted more than once" and "unauthorized poll workers or others could gain access to hardware that could allow them to perform supervisory tasks, such as closing the polls.""

Comments

About time...

[Ianoo]

Finally they're getting the message about poorly written voting software. In an critical areas like this proper software engineering techniques should be applied lavishly. It seems Diebold in particular has forgotten how to write secure software, or more likely never knew. For example, why couldn't a voting machine do what airplanes do, and have several separate machines processing the same input data, with software written by several different organisations?

Re:Go Ohio!

[sfjoe]

I don't understand what the insane rush to e-voting is all about. (not flamebait) I suspect it has something to do with the hissyfit that certian elements of the political spectrum threw when GWB "stole" the election.

Having concerns about minorities being removed from the registration lists is hardly a "hissy fit".

Re:Go Ohio!

[cgenman]

Counting votes require quite a bit of manpower and are expensive. E-voting could be auditable, verifiable, hard to counterfeit, accurate, and with a fast, cheap tally.

Of course, in a bit of bait-and-switch, the e-voting machines have been none of the above except for fast, which doesn't help unless they are also accurate. Somehow, I doubt the people elected want total verifiability. Once in a position of power, it becomes almost trivial to fake a vote... Or at least bump your numbers by a few hundred dead people.

Now if only my state would clue in

[R2.0]

I live in the People's Republic of Maryland, and they are bulling ahead despite the fact that THEIR OWN STUDY said it was insecure.

Basic response: "We're confident that the problems will be fixed in time."

Keep in mind this is one of the only 2 states that have implemented UCITA. Why? "Virginia has implemented it, so we need to implement it to stay competitive."

Physical Security

[BrynM]

From the article:

"These software enhancements will be implemented in all touch screen units deployed within Ohio and the process-related questions are addressed in the Diebold Election Systems training manuals," Radke said.

Why is everyone assuming that software is the only problem. It would seem to me that physical security is just as important. Blackwell points it out, but even most /.ers ignore it. The machines need locking cases. All media needs to be locked up tight. Transportation of these devices is, at least to me, the second weakest link in the security chain (Wireless networking is the top and is to me another physical security issue). During transportation, there is little supervision and scheduled arrival times can be fudged. Just imagine, a laptop with drive image and a power source for the target box are all you would really need. Take a snap of the drive and then see how you could manipulate the software via the wireless connection or even figure out how to fake your own connection. Sure it won't work for the current election, but the next one...

The problem is: physical security takes money and genuine work by the vendor. Software, as we all know, can be made to "seem" to work rather easily.