Slashdot Mirror


Vote Tabulator Security Hole Exposed

Doc Ruby writes "Black Box Voting has exposed a security hole in Diebold machines that tabulate votes collected from electronic voting machines. A code entered into the tabulator's user interface duplicates the "secure" counts into an insecure count which can be changed, and counted instead. The "double books" vulnerability and exploit were reported to the manufacturer over a year ago, and confirmed, while major customers (California and Washington states) were notified shortly thereafter. In spite of some revisions, the latest version of the software remains insecure. Diebold voting machines running GEMS version 1.18.x are vulnerable, running in about three dozen states. Although the software is widely deployed, and scheduled for use in shortly upcoming elections, risk mitigations are available, mostly protocols restricting physical or network access to the machines. Other auditing/accountability measures for ensuring only trusted access to the system are recommended."

20 of 530 comments (clear)

  1. Re:Captain Obvious Strikes Again… by Short+Circuit · · Score: 5, Informative

    The original country that ignited the passions of democracy was wiped out in a war with Sparta thousands of years ago...

    The country that currently champions democracy, well, yeah, we do lack passion.

  2. Re:Election Stealing by LMCBoy · · Score: 4, Informative

    It's about how someone will steal the election... It's not our fault that everyone immediately jumps to the Republicans as the theives.

    Let's not pretend that Diebold is non-partisan, okay?

    To which party is Walden O'Dell (Diebold CEO) a major fundraiser? To which party does Diebold itself make large contributions? Of which candidate did O'Dell say: "I am committed to helping Ohio deliver its electoral votes to [candidate] next year", in 2003?

    It's not exactly a stretch to guess which party Diebold would attempt to swing the election toward, if given the opportunity. Oh wait, they already gave themselves the opportunity!

    --
    Liberal (adj.): Free from bigotry; open to progress; tolerant of others.
  3. Diebold at it again? by Reene · · Score: 3, Informative
    I keep wondering when the states are finally going to give Diebold the proverbial finger. This isn't the first time this sort of thing has happened with Diebold machines and it probably won't be the last. A quick search on The Register reveals that this sort of thing has been going on for quite some time. Among several concerning incidents from 2003:
    The Oakland Tribune reported last week that several thousand voters in Alameda County used electronic voting machines made by Diebold that were never certified for use by state and county voting officials. Diebold altered the software running on the machines prior to the election, but never bothered to submit the software for testing or even notify the state that the software update had been made.
    Come on. Enough is enough, you know? This kind of thing is too important to leave it to people and/or technologies with a track record like this.
    --
    "He does look a bit Oompa like, even if his Loompa is a bit off-kilter."
  4. Look what happened at Venezuelan elections!!!! by josevnz · · Score: 4, Informative

    Venezuela was the victim of one of the bigges frauds in its history, thanks to the electronic voting machines provided by a company called 'Smartmatic'.

    Americans (and the rest of the world) should learn about what just happened in Venezuela; The real chances to prove than there was a fraud are minimal.

    Here are some articles you can red to get more informed about the problem:

    http://www.miami.com/mld/miamiherald/news/847151 7. htm
    http://news.phaseiii.org/article3109.html
    ht tp://www.newsmax.com/archives/articles/2004/8/20 /131240.shtml
    http://www.wjla.com/news/stories/07 04/158551.html
    http://gnosis.python-hosting.com/v oting-project/Ju ne.2004/0259.html

    Hopefully things like this will never happen in the US.

    --
    Jose Vicente Nunez Zuleta RHCE, SJCD, SJCP
    1. Re:Look what happened at Venezuelan elections!!!! by dcam · · Score: 2, Informative

      Excuse me? The machines in Venezuela provided a paper trail therefore proof of fraud is possible. The election monitors also said the election was free and fair.

      Just because you disagree with the results of the election doesn't mean it wasn't fair. What is rather funny about Venezuela is that the US tried to topple the popularly elected president in a coup. He then gets reinstated by the people, and then holds a referendum with a clear victory. Democracy in motion, however the US disapproves because they don't like the guy.

      --
      meh
  5. Re:Wow... by yo303 · · Score: 2, Informative
    Is anyone else suprised by how bad diebold's coders are?
    It should be surprising to most people, because Diebold is one of the largest makers of automated bank machines. When was the last time an ATM counted wrong? Conspiracy theorists, now increasing in numbers, are not surprised, because the bank clients want accuracy and security while the Republican election clients don't.

    Widely quoted examples:

    - Jeb Bush, unconcerned about 2002 Florida touch-screen election debacle, says "What is it with Democrats having a hard time voting?"

    - Diebold CEO says he is "committed to helping Ohio deliver its electoral votes to the president next year."

    - etc.

    yo.

  6. Re:If you can sue McDonalds for coffee... by peragrin · · Score: 1, Informative

    Why does everybody get this wrong???

    MCDonalds won on Appeal. Their might of been some medical bills, but to things still stand.

    Their coffee is really hot, and they didn't pay the millions. Just thousands for medical bills.

    --
    i thought once I was found, but it was only a dream.
  7. Sorry, don't buy it. by CFD339 · · Score: 2, Informative


    1. You don't write test code to be hard to remove.

    2. Once reported, you don't leave it in for a year.

    3. Once public, you don't claim months of work to remove it.

    It may have started as test code, but someone went to a lot of trouble to bury it. A company like this doesn't have a few guys each working from home sending finished code libraries up to the boss. Code goes through review processes, it sees auditors, and it gets stored.

    this isn't the result of someone leaving in a line like:

    if(keySequence == "rigthevote") voteCount.replaceWithHackable ;

    -- just my opinion here, but commenting something like that out wouldn't be a multi-year issue.

    --
    The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
  8. Re:Captain Obvious Strikes Again by Deep+Fried+Geekboy · · Score: 5, Informative

    A huge scandal is exactly what this Diebold fiasco needs, and nothing is going to happen until it does. Every ambitious local journo in the country should be assiduously courting sources in the local elections offices. Eventually someone will Watergate it. That's the only way it's going to change.

    I know this because I was once an investigative journalist. You would happen upon a story that seemed so shocking it was unbelievable, and when you asked around, everyone involved would say "Oh, yeah, that's right, everyone knows about that".

    In one case (abuse at a psychiatric hospital) there were 600 documented allegations of abuse which had been investigated. Not one had been upheld, because the evidence of psychiatric patients was held to be unreliable. When we exposed it, it became national headline news for several days and resulted in year long government inquiry and, finally, change.

    But everyone already knew about it.

    Diebold is going to blow up horribly and sad to say the sooner it does the better. People are not interested in potential vulnerabilities, only post-facto scandals.

    --

    I'm not wrong. You haven't thought about it hard enough.

  9. Senator Hagel by ortholattice · · Score: 5, Informative
    There is speculation that the election of Nebraska Republican Chuck Hagel could have been rigged by electronic voting machines, but there's no way to prove or disprove it since there's no paper trail. But with purposely programmed-in cheats like this one it makes you wonder. Excerpts from this article by Thom Hartmann:

    "Perhaps it's just a coincidence that the sudden rise of inaccurate exit polls happened around the same time corporate-programmed, computer-controlled, modem-capable voting machines began recording and tabulating ballots..."

    Unfortunately "...if any of [it] is true, there's not much of a paper trail from the voters' hand to prove it..."

    "Back when Hagel first ran there for the U.S. Senate in 1996, his company's computer-controlled voting machines showed he'd won stunning upsets in both the primaries and the general election. The Washington Post (1/13/1997) said Hagel's "Senate victory against an incumbent Democratic governor was the major Republican upset in the November election." According to Bev Harris of www.blackboxvoting.com, Hagel won virtually every demographic group, including many largely Black communities that had never before voted Republican. Hagel was the first Republican in 24 years to win a Senate seat in Nebraska."

    "Six years later Hagel ran again, this time against Democrat Charlie Matulka in 2002, and won in a landslide. As his hagel.senate.gov website says, Hagel "was re-elected to his second term in the United States Senate on November 5, 2002 with 83% of the vote. That represents the biggest political victory in the history of Nebraska."

    "What Hagel's website fails to disclose is that about 80 percent of those votes were counted by computer-controlled voting machines put in place by the company affiliated with Hagel. Built by that company. Programmed by that company...."

  10. Discovery Times Documentary: Ballot Battles by KB1GHC · · Score: 5, Informative

    If anyone wants to watch a really good documentary about the 2000 election, and the security of the 2004 election. I recommend a documentary called "Ballot Battles" on the Discovery Times Channel.

    In part of this documentary. a woman who is against electronic voting machines (who isn't a computer expert) was googling a manufacturer of electronic voting machines, and she stumbled apon all the firmware and source code to all their voting machines, she downloaded it, and filled 7 CD's and brought it to a computer security expert, and they were shocked about the poor coding of the voting machines operating system. With this information, she was able to easily hack the voting machine, and was able to teach an 8 year old to do it too.

    it's a really good documentary, check it out.

    unfortunatly, i don't know when it will air again, i just checked the TV schedule and didn't see it anywhere.

  11. Um, did you read those links? by flimflam · · Score: 4, Informative

    Three are purely speculative, one is about supposed problems with the elections that had nothing to do with the voting machines, and the last is about how the machines actually do provide a voter-verified paper-trail. While voter fraud may or may not have occurred in Venezuela (frankly, it's a little hard to trust most of the news out of Venezuela for the last few years), if it did happen it almost certainly happened the old fashioned way.

    (I lived there during the second election of CAP, and I remember finding with a few friends of mine a ballot box lying in a ditch about a week after the election.)

    --
    -- It only takes 20 minutes for a liberal to become a conservative thanks to our new outpatient surgical procedure!
  12. 2000 election by dpilot · · Score: 2, Informative

    Besides, the chads in 2000 were sleight-of-hand, with differences in the few hundred to few thousand votes. Somehow they distracted us from the systematic disenfranchisement of tens of thousands of black voters by mis-classifying them as felons. The story I read on the topic, link lost, but easy to find on google, made it seem deliberate. But even if it wasn't, it was badly WRONG. Malfeasance or Misfeasance, take your pick. Both are cause for impeachment. Instead, the person at the top of the process is a Party Hero.

    --
    The living have better things to do than to continue hating the dead.
  13. Re:The main difference by ibbey · · Score: 2, Informative

    And Kerry, in the link that was posted, is saying he'd have done the same thing in Iraq that Bush did.

    That's not quite what Kerry's saying, though that's certainly what you'll be hearing on Fox. In reality, all he said was that he stands ny his initiial "Yes" vote:

    The U.S. senator from Massachusetts said the congressional resolution gave Bush "the right authority for the president to have."

    If you remember, at the time of the vote, Bush was saying that we would not go to war until he had exhausted all diplomatic avenues.

    Kerry went on to say:

    "I would have done this very differently from the way President Bush has." He challenged Bush to answer four questions.

    "My question to President Bush is why did he rush to war without a plan to win the peace?" Kerry asked. "Why did he rush to war on faulty intelligence and not do the hard work necessary to give America the truth?

    "Why did he mislead America about how he would go to war? Why has he not brought other countries to the table in order to support American troops in the way that we deserve it and relieve a pressure from the American people?

    "There are four, not hypothetical questions like the president's, but real questions that matter to Americans," Kerry said. "And I hope you'll get the answers to those questions because the American people deserve them."


    Bush, on the other hand, even knowing that Iraq didn't have WMD's, still would have gone to war:

    "Everybody thought they would be there. We haven't found them yet," Bush said. "But he did have the capability of making weapons. Knowing what I know today, I would have made the same decision."

    So, how are these two indistinguishable?

  14. Re:The Second Coming by Lux · · Score: 4, Informative


    Misquoted too:

    "The best lack all conviction, while the worst
    Are full of passionate intensity."

    I like Yeats' version better. :)

  15. Re:Nixon, anyone? by DAldredge · · Score: 2, Informative

    How is this.

    * Harold Ickes Is A Member Of DNC's Executive Committee And Head Of The Media Fund And Chief Of Staff To America Coming Together. Ickes "Admits That He Occasionally Tells The Kerry Camp What He's Up To, And He Insists It's Perfectly Legal."
    (Jim Drinkard, "'Outside' Political Groups Full Of Party Insiders," USA Today, 6/28/04; Paula Dwyer, "Why 527 Is The Dems' Lucky Number," BusinessWeek Online, 7/28/04)

    * Bob Bauer Of Perkins Coie Is Legal Counsel To Both Kerry Campaign And America Coming Together (ACT).
    (Jim Rutenberg And Kate Zernike, "Veteran's Group Had GOP Lawyer," The New York Times, 8/25/04)

    * Kerry Campaign Paid Bauer's Law Firm, Perkins Coie, $360,244.28 For Legal Services And Other Expenses.
    (Federal Election Commission Records, http://www.fec.gov, Accessed 8/5/04)

    * Joe Sandler Is General Counsel To DNC While Serving As Legal Counsel To 527s MoveOn.org And Moving America Forward.
    (Jonathan Groner, "Power Punch," Legal Times, 4/26/04)

    * Erik Smith Is The Media Fund's Executive Director And Worked With Steve Elmendorf, Kerry's Deputy Campaign Manager, On Dick Gephardt's Presidential Campaign.
    (Jim VandeHei, "Kerry Expected To Emerge From Battle Stronger Than Ever," The Washington Post, 3/3/04)

    * Minyon Moore, A Kerry Campaign Consultant, Serves On Executive Committee Of America Coming Together.
    (Glen Johnson, "Kerry To Press 'Environmental Justice,'" The Boston Globe, 4/22/03; Lisa Getter, "Kerry Aided By 'Illegal' Soft Money, GOP Claims," Los Angeles Times, 4/1/04)

    * Media Fund Ad Consultant Bill Knapp Hired By Kerry Campaign.
    (Thomas B. Edsall, "Shifting The Money So The Votes Will Follow," The Washington Post, 5/11/04)

    * Kerry's New Mexico Caucus Director, Geri Prado, Is Leading ACT's GOTV Effort In That State.
    (Michael Finnegan, "Kerry's Low Profile May Cost Crucial Latino Votes," Los Angeles Times, 5/3/04)

    * The Dewey Square Group Provides Political Consulting Services For Both Kerry Campaign And America Coming Together (ACT).

    * Kerry Campaign Has Paid Dewey Square Group $194,936.48 For Political Consulting And Other Expenses.
    (Federal Election Commission Records, www.fec.gov, Accessed 8/5/04)

    * America Coming Together (ACT) Has Paid Dewey Square Group $51,808 For Political Consulting And Other Expenses.
    (Political Money Line Website, www.tray.com, Accessed 8/5/04)

    * At Least Four Kerry Advisors Are Associated With Dewey Square Group: Michael Whouley, Jill Alper, Minyon Moore And Joe Ricca.
    (Glen Johnson, "Kerry To Press 'Environmental Justice,'" The Boston Globe, 4/22/03; Dewey Square Group Website, http://www.deweysquare.com/, Accessed 2/5/04; Peter Grier, "How Kerry Turned The Corner," Christian Science Monitor, 2/5/04; Glen Johnson and John Aloysius Farrell, "Kerry's New-Look Campaign Relies On A Few Key Players," The Boston Globe, 1/9/03)

    * Michael Meehan, Now A Communications Advisor To Kerry, Was Hired By NARAL In 2003 To "Oversee Its Vastly Expanded Soft-Money Operation." His Hiring Was "Billed As A Two-Month Leave From His Job As Political Director Of NARAL."
    (Carol Beggy and Mark Shanahan, "Names," The Boston Globe, 11/21/03; Chris Cillizza, "NARAL Plans Big '04 Effort," Roll Call, 5/8/03)

  16. Re:Things Fall Apart by MarsDefenseMinister · · Score: 2, Informative

    The poem is actually by Yeats, and it's called "The Second Coming"

    --
    No weapon in the arsenals of the world is so formidable as the will and moral courage of free men.-Ronald Reagan
  17. Get your absentee ballots here!!! by Anonymous Coward · · Score: 1, Informative

    Absentee Ballot Forms for ANY US State are available here: http://www.fec.gov/votregis/pdf/nvra.pdf (Single PDF file that includes every state.) See: http://www.fec.gov/votregis/vr.htm

  18. Re:Things Fall Apart by Anonymous Coward · · Score: 2, Informative
    I first read this poem around grade 6 or so. I always remembered the opening lines....

    Turning and turning in the widening gyre
    The falcon cannot hear the falconer;
    Things fall apart; the centre cannot hold;
    Mere anarchy is loosed upon the world,
    The blood-dimmed tide is loosed, and everywhere
    The ceremony of innocence is drowned;
    The best lack all conviction, while the worst
    Are full of passionate intensity.
    Surely some revelation is at hand;
    Surely the Second Coming is at hand.
    The Second Coming! Hardly are those words out
    When a vast image out of "Spiritus Mundi"
    Troubles my sight: somewhere in sands of the desert
    A shape with lion body and the head of a man,
    A gaze blank and pitiless as the sun,
    Is moving its slow thighs, while all about it
    Reel shadows of the indignant desert birds.
    The darkness drops again; but now I know
    That twenty centuries of stony sleep
    Were vexed to nightmare by a rocking cradle,
    And what rough beast, its hour come round at last,
    Slouches towards Bethlehem to be born?

  19. A Discourse on Computerized and Electronic Voting by SlashCrunchPop · · Score: 4, Informative

    For many years now Bruce Schneier has been writing on this topic extensively and since I share his views I decided to put together the most relevant excerpts from his excellent Crypto-Gram newsletter and let them speak for themselves. If you really want to get up to speed on this topic, this is what you've been looking for.

    Crypto-Gram: September 15, 2003 :: News:

    Interesting report on the security of Diebold's voting machines. Scary stuff, especially if you consider that these are already being purchased for use in U.S. elections.
    http://avirubin.com/vote.pdf

    Crypto-Gram: October 15, 2003 :: News:

    Despite admitting that Diebold voting machines have a high risk of compromise, the state of Maryland is going to buy them:
    http://www.wired.com/news/business/0,1367,60583,00 .html

    Crypto-Gram: December 15, 2003 :: Computerized and Electronic Voting:

    There are dozens of stories about computerized voting machines producing erroneous results. Votes mysteriously appear or disappear. Votes cast for one person are credited to another. Here are two from the most recent election: One candidate in Virginia found that the computerized election machines failed to register votes for her, and in fact subtracted a vote for her, in about "one out of a hundred tries." And in Indiana, 5,352 voters in an district of 19,000 managed to cast 144,000 ballots on a computerized machine.

    These problems were only caught because their effects were obvious--and obviously wrong. Subtle problems remain undetected, and for every problem we catch--even though their effects often can't be undone--there are probably dozens that escape our notice.

    Computers are fallible and software is unreliable; election machines are no different than your home computer.

    Even more frightening than software mistakes is the potential for fraud. The companies producing voting machine software use poor computer-security practices. They leave sensitive code unprotected on networks. They install patches and updates without proper security auditing. And they use the law to prohibit public scrutiny of their practices. When damning memos from Diebold became public, the company sued to suppress them. Given these shoddy security practices, what confidence do we have that someone didn't break into the company's network and modify the voting software?

    And because elections happen all at once, there would be no means of recovery. Imagine if, in the next presidential election, someone hacked the vote in New York. Would we let New York vote again in a week? Would we redo the entire national election? Would we tell New York that their votes didn't count?

    Any discussion of computerized voting necessarily leads to Internet voting. Why not just do away with voting machines entirely, and let everyone vote remotely?

    Online voting schemes have even more potential for failure and abuse. Internet systems are extremely difficult to secure, as evidenced by the never-ending stream of computer vulnerabilities and the widespread effect of Internet worms and viruses. It might be convenient to vote from your home computer, but it would also open new opportunities for people to play Hack the Vote.

    And any remote voting scheme has its own problems. The voting booth provides security against coercion. I may be bribed or threatened to vote a certain way, but when I enter the privacy of the voting booth I can vote the way I want. Remote voting, whether by