Open Source Program Reveals Diebold Bug

Mitch Trachtenberg writes "Ballot Browser, an open source Python program developed by Mitch Trachtenberg (yours truly) as part of the all-volunteer Humboldt County Election Transparency Project, was instrumental in revealing that Diebold counting software had dropped 197 ballots from Humboldt County, California's official election results. Despite a top-to-bottom review by the California Secretary of State's office, it appears that Diebold had not informed that office of the four-year-old bug. The Transparency Project has sites at humetp.org and http://www.humtp.com." Trachtenberg also points to his blog for the Transparency Project, and his own essay about the discovery and the process that led to it.

Comments

Is Hanlon's Razor sharp enough to cut this?

[sapphire wyvern]

It's usually correct to not blame on malice what can be explained by incompetence. But I do find it hard to understand how a seemingly-simple requirement (essentially, count the number of times a button has been pressed) can be so badly botched by a company whose other "secure terminal" products (eg, ATMs) seem trustworthy and reliable, without the implication of a sinister motive.

Re:Is Hanlon's Razor sharp enough to cut this?

[Benfea]

I am also a believer in Hanlon's Razor. In fact, I I'll stick with Hanlon on this one and disagree with you.

When the owner of Diebold boldly promised to "deliver" Ohio to the Republicans (was it in 2004?), I'm pretty sure he was talking about how easy his product is to hack, not about bugs in the software (intentional bugs or otherwise). There is strong circumstantial evidence that Diebold has been involved in intentionally changing the results of elections, but I don't think this particular counting mishap is further evidence of that; I think it's just shoddily-written software.

Re:Is Hanlon's Razor sharp enough to cut this?

[Elder Lane Hour]

All the more reason not to trust even a full blown QA team with our votes.

Re:Is Hanlon's Razor sharp enough to cut this?

[betterunixthanunix]

There are a few differences between ATMs and voting machines. First of all, ATMs are used daily, and if there was a bug in an ATM, it would be caught very quickly. Second of all, ATMs can be reflashed using the same connection that they use to contact the bank, so if a bug was found, it could be corrected very fast. Also, a bank has a HUGE financial incentive to test ATMs extensively before putting them in service, so it is unlikely that a bug would make it into the real world.

In general, it is hard to reflash a voting machine when a bug is found. The states' have laws about modifying those machines, and require that a long certification process take place after the modification (which is not to say that the certification process is in any way useful). The only incentive to check the machines for accuracy is idealism about the voting process, which is great in theory but not really shared by the majority of society.

I'm not defending the voting machine companies here. Malice is a stretch though; so is ignorance. I would blame it on tight schedules, poor internal engineering standards, and lack of initiative on the states' part to require useful certification. What probably happened was a small team was told to put their ATM project on hold for as short a period of time as possible to develop a voting machine, and their manager got uppity and tried to get them to finish even faster.

Re:Is Hanlon's Razor sharp enough to cut this?

[Elder Lane Hour]

The fact that we are being asked to swallow this is disgusting.

The fact that we're being asked to swallow electronic voting is disgusting. Some things electronics simply don't do well, and one such thing is accountability. We should be demanding accountability. Not just in angry letters to congress-critters, but outside voting booths, to the people who mindlessly register their vote, without any real clue if their vote will count or not.

Re:Is Hanlon's Razor sharp enough to cut this?

[SleepingWaterBear]

That's shit. I'll take the ballot I handle and allow it to be scanned. If the count is suspect then the ballots exist outside of some computer generated fantasy and real humans can count them.

Well, that's why you have a printout which the voter verifies and essentially acts as your 'ballot'. Then you make sure that in the case of any remotely reasonable doubt you do a hand recount. I know I'm repeating myself, but your response suggests I wasn't clear enough.

Re:Is Hanlon's Razor sharp enough to cut this?

[hairyfeet]

I know this is weird, but I think the new machines we used this year in little small town AR finally got electronic voting right. I don't know who made them, but I doubt Diebold made anything that fool proof. It had a nice big, easy to read touchscreen and a big yes/no button by each candidate, which would then pop up a conformation box when you chose that said "You picked...is this your choice? If not please hit the blue cancel button". And finally when you confirmed a nice big, easy to read paper ballot was printed behind a clear glass slot next to the screen pointing up at you. This way you could simply look at the paper and see quite clearly it was putting down who/what you voted for. When you were finished voting the election volunteer used a small cartridge to collect the electronic vote and picked up your paper ballot and while the paper ballot was placed in a box in front of 3 officials the electronic one was set on the desk in front of the same until the next vote was cast.

I have to say that this year they really seemed to have everything down to a science. Everything was fast, smooth and orderly, and finally what I thought was a really nice touch was what they did when someone was in the wrong place. While I was in line 2 of the folks ahead of me had not been switched over from their previous voting district, but instead of making them drive across town and hope they were on the other polling district rolls an election official would simply ask them to wait aside for a few minutes while he called the polling district in question and had them switched over to the new district. Both of those that were in the wrong place got to vote with only a 10 minute delay. Very efficient, very orderly and polite. considering the messes we had had in 2000 and 2004 with junky machines I was quite impressed how quickly and smoothly everything ran. I just wish all my interaction with the government was so smooth.

Re:Is Hanlon's Razor sharp enough to cut this?

[pbhj]

There is a key difference in Islam in the Imam's are the ultimate authority (or perhaps you could weasel it and say their interpretation of the Koran and Haddith is the ultimate?) whilst in a Christian church the ultimate authority is the word of God, especially as expressed in the Bible. Christianity is about personal faith, Islam is about a whole system for living.

Thus Islam is a political system too, whilst Christianity is not.

I think Judaism leans more towards the Islamic side with the rabbinic tradition.

On a side note I'm interested to know which "church" you are referring to that believes in multiple gods? Hindus for example use a temple. Church is a specifically Christian word as it's etymology is of greek words for a "congregation of the Lord".

One area where open source will definitely win

[Raleel]

In testing. You need to be able to verify the testing mechanism. Open Source will win there because of the ability to view and modify the code. Just verify that you are testing with the same stuff that you reviewed.

64,161 votes with 197 errors

[zoomshorts]

Sounds like they used humans to count the vote in reality.

A very small percentage. Still a concern.

Start by informing everyone you know.

[Anonymous Coward]

We don't need this garbage determining public offices. We have to start educating people that don't understand otherwise that these are a bad idea. Don't be condescending or anything like that, just start discussing with your friends and family that these are a bad idea and why they are a bad idea. Might help if you keep articles like this handy.

What bothers me more

[WindBourne]

is not that companies like Diebold would be corrupt. It is that BOTH dems and pubs have pushed NOT to have a paper trail. Basically, they claim to have our best interest at heart, and yet, we have the likes of Cheney, Rove, Libbey, Delay, Hastart, Stevens, Jefferson, Blogovitch, Daley (certainly original ) , possibly Jackson Jr, etc, etc, etc. Even now, some dems are pushing for NO punishment for Stevens and others are saying no investigations into all of W's admin hijinks. Makes you wonder who these ppl are really representing.

a pretty normal software bug .. :)

[rs232]

"it looks like a pretty normal software bug"

maybe on your planet the ability to count up in single integer increments is considered too esoteric for the average QA team, but here it's something the average IT student can manage ..

Are you sure your vote counted?

[whoever57]

Mine too. After the OCR machine acknowledged my ballot was readable, they gave me a sticker that said "I voted".

It may well have been readable, but the first articles I saw on this make it clear that being readable is not a guarantee of your vote actually being included in the result.

The first articles make it clear that votes were counted and then, in some circumstances, From that article:

The ballots even showed up in preliminary tallies counted on election night on November 4 and in a report printed out on November 23. But some time after this point, the tabulation software inexplicably deleted the ballots without election officials ever knowing.

Still sure your vote counted?