Slashdot Mirror
Suit Claims Diebold Voting Machines Violate GPL
An anonymous reader writes "Diebold Inc. and its subsidiary, Premier Election Solutions, is using Ghostscript in its electronic election systems even though Diebold and PES 'have not been granted a license to modify, copy, or distribute any of Artifex's copyrighted works,' Artifex claims in court papers filed late last month in US District Court for Northern California. The gs-devel list first brought up the possible GPL violation a year ago."
The GPL only applies when you distribute software. They are probably not distributing the software outside their own company.
For one of the people who will be running the election hall on election day, when they get delivery of the election machine, is that counted as receiving a copy of the software?
The machine itself is closed and locked down, and most likely cannot be opened without a special key from Diebold.
If that is not the case, hit me with a cluebat.
The software is distributed with the voting machines.
IANAL, but that should mean that Diebold are required to supply the source to people/organizations that buy their machines.
But not half as cheap and simple as using paper and pencil, and having thousands of volunteers counting in parallel. Oh I know, sometimes the electoral ballots are huge in the US, but really, why does it have to be such bloody rigmarole every time there's an election there?
When they sell the machine to the buyer it is distributing the software that the machine runs.
Google Linksys, they were in a similar situation a few years ago. I'd love to see the same outcome this time!
It is dangerous to be right when the government is wrong.
Correct me if I am wrong, but I believe under the GPL they only need to show the GhostScript source to the people who bought the machines (that is, whoever takes care of elections in the US, assuming someone does). Unless Diebold really used a non-GPL version of Ghostscript, I don't think the lawsuit is reasonable. And if it is about a the AFPL version of Ghostscript, it's not a GPL issue, obviously.
They would have to give source for the version they used. Putting a gostscript.tar.gz in the c:/ would have been good enough.
Linking to a license text or source code on servers other than yours. This amounts to GPL Section "3c" (passing on a written offer), which is only valid for non-commercial distribution. They committed commercial distribution. So they should have just dropped a src tar on the machine or on a cd that came with it.
Diebold's voting systems division was an acquisition of Global Election Systems. The ATM and votings systems share nothing but the brand. They also spun off their voting systems to a new company called Premier Election Systems, I suspect because all the scandal was hurting their brand in other lines of business.
The outcome of this may be that we get the source to the voting machines, so we can analyse it for election rigging. Far more useful than running custom Linux builds on Linksys hardware in my opinion.
The threats are different. With an ATM it's usually the man on the street attacking and the institution (i.e. bank) trying to stop the attack. With voting machines it's the institutions (i.e. political parties) that would be attacking and the man on the street that wants to see it stopped.
With different threat models, come different security methods. I'm sure ATM's are quite secure (at least up to the banks insurance amount). But the same techniques and assumptions don't work to secure a voting box.