When California AG Bill Lockyer joined in the suit, our cut ("our" being myself, Bev Harris and our attorney) went from 30% max to 15% max.
Fine by us: it means first that Diebold is more likely to settle, and second Lockyer is inviting other counties to join in the suit. How many more (on top of Alameda County) is unknown right now but it could be a substantial number - Solano County agreed to pay Diebold $415k to "go away" (to break the contract, in other words) whereas the Harris/March/Lockyer suit allows counties to get rid of Diebold and GET PAID:) based on Diebold's software being an illegal, unsecure piece of crapola.
You tell me which the counties will like better.
Solano's contract was worth about $5mil or so. Alameda's is worth $14mil. San Diego is the biggie, at $33mil. Others vary across that spectrum.
If enough join in based on Lockyer adding his professional credibility to the suit Bev and I started, the total actual contract (refund) amount could hit $70mil pretty easily.
So instead of 30% of $14mil, we could end up with 15% of God knows how much more than that:).
That works:). And that's not counting how there's a triple damages multiplier if we prove fraud, although Diebold will probably settle for less.
Once we actually have the winnings, if it's by settlement our attorney Lowell Finley gets 25%, if by court decree, 33%. I consider that fair.
When Lowell came to me back in October of '03 to propose all this, the first thing I said was "we're bringing Bev Harris in". That means I caused my cut to drop in half as the first choice I made in this case...so saying I was in this for the money is...well, silly.
Lowell knew he needed a lead plaintiff who had generated new info on Diebold, who lived in California. He picked me based on work I'd done to that point.
---------
Last detail: because this is a whistleblower suit, the government doesn't just get our info (valuable enough). Whistleblower suits have the damage tripler for fraud. That gives the government a much "bigger stick" to beat Diebold into submission (settlement) with.
Jim March
PS: yes...knowing that I'm probably going to be worth a lot more money pretty soon is cool. As it is...my only ride is a motorcycle that was a great deal at $300 once I got the dead spider out of the left carb:).
The GEMS (Global Election Management Software) program runs on a fairly
standard P4 "server grade" box supplied by Diebold, usually a Dell of
some sort. It "tallies the vote" on election night from both
optical scan and touchscreen voting terminals.
Counties that use touchscreen terminals still use large-model optical
scanners to process absentee votes back at county elections
headquarters where the GEMS box is.
It's got the usual server stuff, lots of RAM, fair amount of disk
space, etc. Funky stuff: a Digiboard multi-port serial card,
usually 16 ports on PCI, sometimes two. A CD burner for
backups...floppy, USB, etc. I examined the one in use in Fresno
County California pretty carefully.
Software:
Most now are running Win2k; there are hints of XP here and there and
some old ones have NT. They've had NT or better at least since
2000 (the year that is).
It's got the MS-Jet database engine and related goodies...including an
MS-Access runtime. All the libraries to run Visual Basic script
files are also present.
GEMS is itself an MS-Access application, and it's data files are fully
readable by MS-Access.
IF MS-Access is loaded on the same PC as GEMS and it's data files, it's
dead obvious that the data can be diddled with in Access without
leaving an audit trail record and without requiring a password.
Votes can be changed, the audit trail can be edited in a fashion that
can't be detected later (because Diebold disabled automatic line
numbering that would show a sequence problem!), etc.
We've known that for a while. And we knew that since GEMS was
basically a "giant MS-Access script file itself" in compiled form, it
would be possible to write small "hack scripts" to alter vote data.
What Professor Thompson has shown is that it's possible to write VB
scripts in the notepad to do alterations to a vote data file.
These scripts can be so small they could be typed in via MS-Notepad on
election day.
Mind you, Diebold wouldn't need to go to even that much trouble.
Election observers (myself included) have personally seen Diebold techs
on elections night with full access to either the terminals feeding
PCMCIA cards from the field into the GEMS box, or the server itself.
We know that on 3/5/02 during the California governor's primaries, a
Diebold tech in San Luis Obispo County stole the complete early results
file right off of the server at 3:31pm, hours before the polls closed,
and uploaded it to a Diebold FTP site. We know because we found
it later. The ZIP password was defeated by a dictionary crack and
turned out to be "sophia" - the Diebold tech on duty that day in that
county was Sophia Lee.
So they damned well DO have enough on-site access to load hack scripts
of the size range Prof. Thompson demonstrated.
Remote access:
We've played with various GEMS versions on various PCs. IF you
run it on a box with firewall software like ZoneAlarm, you get random
warning that GEMS is trying to make an outside connection of some
sort. We call this the "ET phone home problem". We don't
know where it thinks it's calling but that's how you'd beat a firewall
on a county LAN if the GEMS box is so connected...set up GEMS to start
the conversation from the inside.
Are GEMS boxes on such LANS? We know the IP addys that the
Alameda GEMS box modem ports were set up at: 166.107.248.210 to
220. Now go ping the Alameda County website (www.acgov.org)...hmmmmm? Sure
made 'em compatible, didn't they?
On those modems: the software behind them is MS-Remote Access Server
(RAS). Diebold regularly tests the connections with
laptops. They also know the phone numbers of these modem banks
that the terminals dial into on election night to do early
results. Looks like a security hole from hell to me!
As to the actual GEMS "double set of books" hack, here's the
screenshots and explanation:
It's #3 that basically nobody else is talking about except Bev Harris and her immediate supporters, of which I'd classify myself as one:).
Think about how a bank deals with cash: there's a paper trail AND electronic trail every step of the way, including use of publicly available encryption algorythms - NO use of "security by obscurity".
There are decent PC accounting programs today that meet these standards (business grade programs that is...) which proves this is doable.
Too many of the people advocating a "geek friendly encrypted vote system" are NOT dealing with this whole issue as an "accounting problem".
Bev and myself think it is!
On #4, you're absolutely right, the technical term for a CD burner system is "WORM" and for a good long time, that will probably be the best option for writing out the data at the terminal. With the cost of CD-R drives as low as they are, they're cheaper than PCMCIA gear.
We'll formalize this later but in "rough draft" form, here's our
recommendations:
1) Open source. Not necessarily GNU licensed, but the source code
of all voting systems must be publicly available on the vendor's
website plus at least one gov't website if not multiple - choices
include the county elections department's websites, the Federal
Election Commission, state SecState sites, etc. ALONG WITH the
compiler and operating system makes and versions under which the code
was compiled; that will allow us geeks to do our own compiles and
generate our own hash results so that we can compare with "in the
field" binaries. (I have to disagree with Dr. Dent on his point
#2 in that I don't want to have to trust somebody else's hash
numbers...I want to roll my own.)
2) Voter verifiable paper trails. The best such schemes are
similar to the one Avante developed - your vote is printed on a paper
strip "behind glass". You get to look at it, make sure it's OK
and if you like it, hit "OK" on the touchscreen. A "robot
snipper" clips off that piece of paper, it drops to the bottom of a
sealed bucket and it's the official vote of record in case of
recount. You don't use a take-up reel because then you can
cross-ref the voter order with the vote order and figure out who voted
for what. The voter cannot later prove who they voted for (it's
not a "reciept") - that way "Guido" can't breaka you legga for voting
"wrong" or pay you for voting "right". Oh, and the paper vote of
record has an encrypted bar code strip to ID false "extra bits of
paper", and minor mistakes in the dot-matrix print that are hard to
spot but form their own second tamper-code.
3) This is the major piece that Bev Harris has contributed.
Harris used to be a forensic accountant, meaning she dug into financial
fraud for a living. In any accounting system, there are auditing
procedures and steps at EVERY step of the way as cash is handled.
Votes need to be handled the same way - there's documentation every
time they change hands, there's a REAL audit trail, and similar steps
that need to come from the CPA community. As one example: in a
real audit trail, if data entry was done wrong and needs to come out,
it isn't erased. It's MARKED (and datestamped) as "not valid" but
it's still in there so you can see what happened. None of the
current systems do this, with the possible exception of Avante (I'd
have to take another look on that point.) Diebold, Sequoia,
ES&S and Hart sure don't!
4) Mandate Read-Only-Memory storage of votes at the terminals!
This is another thing Avante got right - and no, they ain't paying me
or BBV.org a red cent. Their voting terminals burn the vote data
to CD-ROM. Diebold, ES&S and Sequoia burn data to PCMCIA
memory cards...which can be stuck in a laptop, encryption cracked and
the data messed with as happened in Volusia County FL, Nov2000.
---------------
This is PRELIMINARY and should be viewed as such, but it's a pretty
good guide to where our heads are at. Blackboxvoting.org (not just
a website, we're a non-profit public interest educational/research
foundation) will be meeting to discuss a formal proposal ASAP.
Jim March
Member of the BBV.org
board of directors (Bev Harris is our Executive Director)
I'm also a co-plaintiff (with Bev Harris) in the current lawsuit
against Diebold in California which State Attorney General Bill Lockyer
just joined.
Who needs 30+ round clips? We do!
on
Assault Weapons Ban
·
· Score: 3, Informative
First point: the 1994 "ban" didn't do anything. Since there's no
"core technical difference" between a standard semi-auto hunting rifle
like this Remington:
The Remington is pictured with a 5rd magazine but 10rd that poke out of
the bottom of the gun are available now and with the ban on 10+
magazines gone, they'll be available there soon.
Both guns are semi-auto, magazine fed. After midnight tonight, it
will be possible to sell either with such accessories as bayonette
lugs, flash dohickey on the end of the barrel, etc...none of which
affect lethality.
Because the guns that "look scary" aren't technically different from
those that look more "sporting" like that Remington (one of many
examples I could show), back in '94 Congress banned certain "evil
features" that were purely cosmetic, in an attempt to home in on the
"evil looking guns" and leave the deer rifles alone.
Which made the law arbitrary and stupid, and is what's really causing
it's death tonight.
Which leaves two questions:
1) Why would anybody want a "military pattern rifle" in the first place?
A: first, parts are widespread and cheap. They usually share at
least some components and accessories with the full-auto military
versions which are banned; as long as the parts in question don't add
full-auto capability, they're legal.
Second, when rifles are engineered to be able to handle full-auto
stresses and battlefield conditions via rigorous testing, they're tough
as nails. Once the full-auto capability is stripped for the
civilian market, they're even tougher as they don't need to cope with
that. (Full-auto fire can wear out a barrel in just a few hundred
shots in some cases, which is why real military machine gunners keep
extra barrels with them for quick swaps.)
Why have a tough gun?
Because competitive shooters must practice a lot - practice
levels beyond what hunting rifles can cope with. The vast
majority of full-power rifle competition happens not with deer rifles
or even high-accuracy target rifles, but with AR-pattern critters
distantly related to the US military M16 family, hot-rodded for
accuracy.
The Remington probably has a total lifespan of a couple thousand
rounds. Less in the hotter calibers like 30-06 or 270Winchester.
AR-pattern rifle owners can sign up for a three-day class in riflework
by nationally known instructors such as John Farnham, and shoot 1500
rounds in a three day weekend...and the gun will *probably* hold
up. He has loaner spares just in case they don't, as that's one
hell of a duty cycle...one that no "pure civilian origin" rifle could
even hope to survive.
-----------
Which leaves the other, more controversial issue: the full-capacity
magazines of 20 to 30 rounds, or the truly high-cap mags like the
Beta-C drums of 75 - 150.
Who needs that?
Slashdotters of all people should know a critical thing: the majority
isn't always right. If you thought otherwise, why don't we format
all our Linux partitions and run Windoze? I mean, the market has
spoken, right?
Spoken in favor of rank idiocy. "The market" is made up of the
same technoturnips that try and find the "any key" when the screen says
"press any key to continue".
That particular kind of idiocy is harmless. But every once in a
while, the sheeple masses get violently stupid all at once. They
riot in LA because of a court decision, or a bunch of morons decide to
loot after a hurricane or other natural disaster.
Those are recent examples; in both, homeowners and business owners
often sto
Regarding the media being "accused" of Liberal bias:
You're making the wrong argument to the wrong guy there!
Please recall that I'm also a self-defense rights activist. I'm the paid state lobbyist and field rep for the Citizen's Committee for the Right to Keep and Bear Arms (www.ccrkba.org). This voting thing is what I got into purely because I care.
(For the record: I'd been involved in Diebolddrama for about six months when attorney Lowell Finley figured that a Qui Tam type suit (yes, the one Lockyer just validated) was necessary. He knew he needed at least one California plaintiff and he came to me after deciding that I was the strongest activist in the state. I in turn said that Bev was deeper in than me, and insisted she be brought in - cutting any possible "take" on my part in half.)
I've seen "Liberal Bias" up close and personal on the GUN issue in spades.
Need an example?
You're no doubt aware there's been a dozen or so "school mass shootings" over the last decade, all of them reported very widely. One happened at Pearl, Mississippi - nutcase kid with a deer rifle shot the place up and was stopped by an assistant principle.
That's what over 400 reporters printed in the week following the event. What fewer than a dozen mentioned is that said principle sprinted 1/4 mile to his car, retrieved a.45 and sprinted back to take the bastard prisoner at gunpoint.
But oh my, we can't possible mention that an eeeevil GUN was used for good by somebody who wasn't a COP, right?
I could list similar examples for days if I did nothing else.
So do NOT tell me "Liberal Bias" doesn't exist. Don't you DARE.
Well the thing is, we didn't expect Lockyer to actually get this decision right. He took his own sweet time about it (correction though: we filed in November '03, not Oct. '03).
But now that he HAS done the right thing, it's the wrong time to put political pressure on him.
We should know fairly soon whether or not Diebold is going to settle. The AG's office says they're going to amend the complaint to reflect the results of their technical inquiry that they apparantly did this year.
The real question is, how do we use Lockyer's decision to affect Maryland, Ohio, etc? I'm not sure.
I think we hang tight for now. Understand, a settlement in California that drives them out of state WILL drive Diebold out of the vote biz (which is a small percentage of their overall revenues and leaving the vote biz will probably drive their stock price UP because the hideous PR will start to dry up).
We take whatever happens in the next month (settlement or an enhanced amended complaint) and we use that to bash the elections departments in other states with.
The "Optical Scan terminals" by Diebold are seriously proprietary inside. Trying to cut a Linux or similar OS for same would be a pain, and then you've got to know the specs for the scan hardware in extreme detail to write the app.
But let's say we scrapped those and went to touchscreens (WITH paper trail printer!).
The Diebold touchscreen hardware is seriously weird. Doing a Linux build would be *possible* but annoying.
The real killer is the cost per terminal (over 3k!), and that it would still give Diebold access to the firmware and I wouldn't even trust 'em with that at this point.
Nope. Better to take cheapo basic PCs and write an app for those - I'm convinced that a good user interface that's even compatible with blind folks and a headset for audio instructions can be done with just four buttons - left/right for forward/back, up/down for yes/no. That eliminates the expensive and error-prone touchscreens and lets you use basic monitors.
Here's what we do with the Diebold terminals:
We set up a big Trebuchet. At a shotgun range. We invite every geek with a 12ga to take pot-shots at them as they fly by overhead, and we cheer as we blow the crap out of 'em while they achieve "terminal velocity":).
THAT is what Diebold is best known for, along with bank vault security systems.
Voting stuff is a recent sideline that happened when they bought a Canadian company called Global Election Systems in 2002. See my other post in this thread discussing the history of that.
Funny sidenote: the Diebold ATMs sure as hell feature a "paper trail":).
If we're successful, the courts will determine (or Diebold will admit via settlement) that their software was...well, crap. It didn't have the security features they claimed for it when they sold it, or even the security features required by Federal (FEC) regulation and the California Elections Code.
So the gov't gets back the money they paid for the junk, because Diebold didn't live up to their contract.
Basic fraud.
The SIDE EFFECTS:
1) Diebold could leave the elections business. At a minimum, a court loss of this scope would hurt sales something fierce. Voting is a small percentage of their overall business but is the cause of most of their negative PR; closing up the voting division they bought in 2002 becomes a serious option at some point coming up REAL soon now.
2) With strong evidence that the Diebold software was crap, people may finally start realizing that the Federally approved oversight process (independent testing labs approved by the FEC and hired by the voting system vendors to check source code, etc) is seriously broken. That same oversight process approved the ES&S, Sequoia, Hart Intercivic and other such computerized voting system products. If the oversight process is broken, then those products aren't trustworthy either. The ultimate oversight would be via Open Source; that concept in voting is gaining momentum (see also the Open Voting Consortium via google).
At a minimum, those other products need scrutiny. Fast.
Jim March
This year, the California legislature came up with a simple "recommendation only" bill to the Calif SecState urging him to look at Open Source as a concept. It was fought bitterly by, basically, Microsoft (via industry flunkies).
M$ doesn't want Open Source seen as a higher-security alternative in a mission-critical app that *everybody* is involved in...even if it's the better alternative.
Everybody is looking at how Diebold "Corporate" in Canton OH (the parent company) is riddled with Bush/GOP links. And that's true.
But it's NOT true of Global Election Systems, the Canadian company that Diebold bought in 2002 and renamed "Diebold Election Systems" (still based in Vancouver BC to this day). Diebold corp of Ohio had been investing slightly before buying them outright but the investments do NOT go all the way back to Oct. of 2000.
Late Oct. 2000, GEMS version 1.17.5 was released. Per Bev Harris, this was the earliest version she could find that had the "double set of books" hack in it apparantly designed for election fraud. See also:
http://www.equalccw.com/deandemo.html...for a more complete demo.
Early Oct. of 2000, Global hired a new head programmer for GEMS: Jeffrey Dean.
During the mid to late '80s, Dean embezzled more than $400,000 from a Seattle law firm he was doing computer consulting for. Dean was convicted in the early '90s of 23 counts of computer-aided accounting fraud in what the court called a "sophisticated scheme".
How did he end up hooked up with Global?
He shared a jail cell with another of the founders during the '90s.
Upshot: Global appears to have been run by a genuine bunch of crooks. *Not* political crooks, just plain ol' crooks. Diebold corporate didn't do enough background checks at the time of the buyout and I doubt they understood what sort of pirates they'd swallowed.
I can't be sure of course, 'cuz maybe the Canton boys DID know what they were getting involved in. But if they didn't, then the whole "Bush/GOP connection thing" that the Diebold Corporate people in Ohio are now famous for was a deeply unfortunate coincidence and God only *knows* what's going to happen in November!
Keeerist.
Think this is unlikely?
The big MONEY in election fraud involves rigging *local* elections, esp. building projects, construction bonds and the like. And people don't pay near the attention to that like they do national races.
I suspect that's what Global was really after. And I suspect keeping a secret all the way up to the Bush White House would be...unmanagable and dangerous as hell.
Am I certain Bush is "clean" (of this, at any rate)? Hell no. I *do* know that a heck of a lot of Democrats in various places have pushed for Diebold (starting with Georgia) and I know that county election officials can use the "cheats" Diebold built in very damned easily. Guys, I've personally seen MS-Access loaded onto GEMS boxes within counties - Fresno County's elections staff let me peek at their systems some months back (but the MS-Access was an older version (97) not compatible with the more recent GEMS databases so any ill with it happened some time ago, not recent).
Anyways. I don't want to end up betting on whether or not Diebold will "win out" in "hacking contests" with county elections officials:(. This crap has to go regardless.
As the author, I can tell you that's a good page and the links to actual code still work.
The information therein should be supplemented with this later data:
http://www.equalccw.com/deandemo.html
That's a "walkthrough" of the "hack demo" Bev Harris did with Howard Dean on CNBC a bit over a month ago. Complete with screenshots. It can be replicated with pieces downloaded from the "Dieboldtestnotes" page.
Putting the actual code and sample data online REALLY pissed Diebold off something fierce; they filed a cease'n'desist notice against my ISP.
Which did NOT succeed in taking my site down; on the contrary, mine is the only site to have completely survived a Diebold C&D with no downtime.
To see how I pulled that trick off:
http://www.equalccw.com/liebold.html
My main "Diebold page" is at:
http://www.equalccw.com/voteprar.html - the "Dean Demo" page will be linked from there soon (prolly tomorrow).
AP is covering the same story in a wee bit more detail:
http://www.theledger.com/apps/pbcs.dll/article?A ID =@@2004409071097
Yup - Lockyer didn't FILE suit, he joined in the one by Bev Harris (Executive Director of BlackBoxVoting.org) and myself (Member of the Board of Directors, same org).
AP keeps reporting that I'm a "programmer". Not true, I've tried to correct that several times now (I'm a former LAN sysadmin/tech support type).
You can see an alternate version of Bev's "cheat code problem" described with screenshots here:
http://www.equalccw.com/deandemo.html
See also my other posts in this thread for more of the background by one of the OTHER plaintiffs - Bill Lockyer is only the newest:).
NOTE: Bev and I demoed the same stuff as described in the link above to the California SecState's staff on August 18th of this year. Also present was an attorney from Lockyer's office. That may have been the final "tilt" Lockyer needed to join in; that or he saw how Solano County hosed themselves by paying Diebold $415,000 to go away less than two weeks ago.
The problem with this "blaming of the victims" (California and it's "customer counties") is that they weren't allowed to see the source code for the product!
Only the Federally approved "Independent Testing Authorities" (ITAs) are allowed to see voting product source code. In the case of Diebold, this was Wyle Labs and Ciber Inc. (formerly "Metamor"), both in Huntsville Alabama and often relying on the same pool of employees. These agencies are approved for this "certification" process by the Federal Elections Commission.
These two acted as the "Arthur Andersons" to Diebold's "Enron".
We know that in at least two cases Diebold specifically decieved the testing labs. We have Diebold's internal memos in which managers instructed lower-level people to lie to the labs; in one case Ken Clark (Sr. Engineer and head of the tech support group) didn't think that the BS they were to pass off would fly, but the report came back from the underling that it did.
For detailed quotes of all this and technical analysis, see also my first two letters to the California Secretary of State, archived in the yellow table, right column:
http://www.equalccw.com/voteprar.html
Without the ability to even see source code, it's rather hard to blame anybody in California for this fiasco.
Diebold on the other hand had a contractual duty to provide software that obeys the Federal certification process sans fraud AND California's election laws (which require high-security products). They blew off both contractual elements, so this isn't "tort law", it's "contract law", a much more cast-in-stone (and legitimate) area of law.
This is the March/Harris lawsuit. Lockyer has decided to "join in", bringing the government in as a co-plaintiff.
At around 10:30am today, Lowell Finley (our lawyer) calls me with the news that Lockyer and the AG's office have decided to join the suit Bev Harris and I filed all the way back in October. Lockyer and company have taken this long to decide whether or not to jump in.
Their decision to do so is VERY welcome by myself, Bev and our lawyer.
Here's the repercussions:
* Bev, Lowell and myself will be splitting 15% of any winnings, versus 30% if we had to prosecute this on our own.
* We ain't complaining, first because we were never in this for the money and second because Diebold is much more likely to settle early, confronted with Lockyer's legal staff instead of just Lowell. MAYBE they'll cave in before the November election, which would be great.
* Second, our odds of any sort of win is now better.
* Third, Lockyer has sent notice to the REST of the Diebold customer counties in California that they can "join in the fun". So this could spread beyond Alameda County, the original gov't entity that Bev, Lowell and I filed on behalf of.
* This idea of suing Diebold for fraud becomes the alternative to what Solano County decided to do: pay $415,000 in their case to get out of their Diebold contract! (Note: Solano's settlement means it's TOO LATE to join in the March/Harris/Lockyer lawsuit and solution. There's a fair chance Lockyer announced all this today to prevent any more "Solano-style" mistakes.)
Other bits:
The AG's staff are promising Lowell that they are NOT getting into this in order to "sabotage the case and settle early for peanuts". They *could* do that but I believe them that they aren't.
The fact that this is being done as a "whistleblower suit" by two private citizens strongly HELPS the government versus a situation where they did it themselves, even when you factor in the small "bounty" to Bev, Lowell and myself. This is because the whistleblower laws include a triple damages provision if we can prove fraud. This becomes a "big stick" to threaten Diebold into settlement with (for less than triple damages; we'll be OK with actual costs returned plus 15% so that the gov't agencies get "made whole" despite the 15% cut.)
Without whistleblowers, first off the gov't wouldn't have had the data to do this at all and even if we just gave them the data "for free", the gov't wouldn't have the damage tripler "stick".
Finally, the question WILL come up (and already has among these replies): "Is all this legit? Did Diebold REALLY screw up here in a fashion worth suing over?"
My answer to that is at this new page showing the actual vote fraud rigged into Diebold's central tabulator software via screenshots of actual Diebold code and database structures:
http://www.equalccw.com/deandemo.html
That is all I need to say about the basic morality of this lawsuit.
Diebold *corporate* is financially solid in ATMs, bank vault security, etc.
Diebold Election Systems is hemmoraging money.
My theory:
When Diebold bought Global Elections Systems in...lesse, I *think* the sale was finalized in 2002 with partnerships/investments prior, I don't think the larger corp understood what a pack o' jackals they were dealing with.
I could be wrong mind you, but...
OK, here's a piece of evidence. Alameda County first bought their touchscreen voting system off of Global. They signed a contract. When Diebold corporate swallowed Global, the contract was re-written so that BOTH the newly-renamed Diebold Election Systems Inc ("DESI") subsidiary AND the parent company(!) were named co-contractors for Alameda County.
Which means even if corporate cuts "DESI" loose and destroys them, they're in hock on that contract if it all goes south.
IF they had suspected the old Global bunch was playing fast and loose with elections laws, they would NEVER have co-signed the contract, would they?
Second point: we have the stash of Diebold EMails running from 1999 (Global era) through early 2003 (Diebold era). The names of the players involved in the tech support, programming and marketing internal mailing lists DO NOT change. No new management team was brought in from Corporate, no new major names appear, there's virtually no references to new procedures or oversight, nothing.
My conclusion: corporate thought they were buying a smoothly running little org, rather than a pack of rampaging pirates.
There's no WAY Diebold corporate can continue hemmoraging CREDIBILITY! Forget the money for a sec - corporate makes their money supplying security gear for BANKS for God's sake. What happens when the banks start saying "errr...hey guys, don't look now but the name "Diebold" has become synonymous with terms like "idiots" and "crooks" and whatnot...".
And here's the cool part, folks. The really hilarious part.
All of this has happened before.
1966. A small electronic voting company called Harris (no relation to Bev!) gets bought by a megacorp...which within a couple of years, realizes that the voting subsidiary is worth 2% of the profits and 80% of the negative PR.
IBM isn't in the voting business anymore. Took 'em three years to wise up. See also:
http://www.csl.sri.com/users/neumann/dugger.html
Y'all can bet your Palm Pilots Diebold Corporate is gonna get the same clue.
This is doubly not true. Possibly tripply:) if that's a word.
First: I can't get Rachel Konrad at AP to STOP calling me a "programmer". I was a full-tilt sysadmin when I left the techie fields but have never claimed to be a programmer anywhere. Apparantly her editors don't want to waste the space to put in "system administrator/tech support" or something. And because it's all over, it keeps getting re-broadcast. I can't freakin' stop it, although as God is my witness I've tried.
Second: I never, ever threatened or tried to surprise anybody with cutlery or otherwise. Anyone who knows me knows I'm not *wired* to want to threaten or bully or scare anybody. I'm very sorry if I accidentally scared someone while stripping wires or something...I can recall a couple of times that happening over the years but I always tried to make my lack of threatening intent VERY clear.
Third: what's this about me being a "leader"?
I'm serious. That was never my intent, nor is it the case today. I just rolled up my sleeves and *worked* at this stuff, analysing programs, helping Bev Harris go through the massive stash of stuff she downloaded, helped go through the EMail stash that somebody (we still don't know who) slipped out apparantly around 3/15/03(???) and released broadly around August(?). See for yourselves:
http://www.equalccw.com/voteprar.html - I would recommend in particular the "DieboldTestNotes" page linked from there, and my letters to the California Secretary of State...the first two of which (still the most important stuff I've written I think) were done before meeting Lowell Finley.
Now let's talk about Lowell. He is an fair voting rights activist first, lawyer second. He decided that the best way to kick the snot out of Diebold was to do a Qui Tam...go after their money. So in late October, he looked for a California resident (he knew he had to have at least one) who had made the MOST original research in the area of Diebold. Original research is what matters in a Qui Tam.
He came to me.
I had *no* idea what a Qui Tam was, and no idea that any part of this could possibly be profitable. Anybody who says I'm "in this for the money" is crazy. The offices of attorney Lowell Finley is at 510-290-8823. Call him up - ask him what was the FIRST thing I said when this whole "Qui Tam" concept sunk in. I'll tell you what he'll report me saying: "we have to bring Bev Harris in". I knew she'd done more work AND more original research than I had and there was no way I'd walk away with cash without her being involved.
Bev's the leader here, not me. Anything I've done, I've published so others can build off of what I'm doing...see also the URL above.
Leader? Literally, I'm not. You wanna go do something? Cool. Do it. You wanna build off my work, or ignore it, or some mix, ain't no skin off my back.
I'm gonna do what I do. Which is see something wrong, try and fix it...without stealing anybody else's work, without backstabbing anybody else, without trying to hurt anybody else's effectiveness.
And without posting anonymously, even if that opens me up to somebody who's either pissed off, or possibly somebody I accidentally scared God knows how many years ago. I'm really sorry if that's the case...reading that post I'm replying to was like a punch to the gut.
But ask Bev, Lowell or a lot of other people whether or not I'm crazy.
Slashdot Mirror
Oh, it's funnier than that.
:)
/. previously:
h tm l
The Nevada Secretary of State hired the Nevada Gaming Commission to take a look at the Diebold system.
The Gaming Commission promptly published a four-page report saying basically "you gotta be KIDDING! This shit stinks!"
Discussed on
http://slashdot.org/articles/03/12/04/1443257.s
Hit the dang thing with a 9v stun gun (zap!) and it'll puke and die right quick.
Sheesh :)
(yes, that's my page )
When California AG Bill Lockyer joined in the suit, our cut ("our" being myself, Bev Harris and our attorney) went from 30% max to 15% max. Fine by us: it means first that Diebold is more likely to settle, and second Lockyer is inviting other counties to join in the suit. How many more (on top of Alameda County) is unknown right now but it could be a substantial number - Solano County agreed to pay Diebold $415k to "go away" (to break the contract, in other words) whereas the Harris/March/Lockyer suit allows counties to get rid of Diebold and GET PAID :) based on Diebold's software being an illegal, unsecure piece of crapola.
You tell me which the counties will like better.
Solano's contract was worth about $5mil or so. Alameda's is worth $14mil. San Diego is the biggie, at $33mil. Others vary across that spectrum.
If enough join in based on Lockyer adding his professional credibility to the suit Bev and I started, the total actual contract (refund) amount could hit $70mil pretty easily.
So instead of 30% of $14mil, we could end up with 15% of God knows how much more than that :).
That works :). And that's not counting how there's a triple damages multiplier if we prove fraud, although Diebold will probably settle for less.
Once we actually have the winnings, if it's by settlement our attorney Lowell Finley gets 25%, if by court decree, 33%. I consider that fair.
When Lowell came to me back in October of '03 to propose all this, the first thing I said was "we're bringing Bev Harris in". That means I caused my cut to drop in half as the first choice I made in this case...so saying I was in this for the money is...well, silly.
Lowell knew he needed a lead plaintiff who had generated new info on Diebold, who lived in California. He picked me based on work I'd done to that point.
---------
Last detail: because this is a whistleblower suit, the government doesn't just get our info (valuable enough). Whistleblower suits have the damage tripler for fraud. That gives the government a much "bigger stick" to beat Diebold into submission (settlement) with.
Jim March
PS: yes...knowing that I'm probably going to be worth a lot more money pretty soon is cool. As it is...my only ride is a motorcycle that was a great deal at $300 once I got the dead spider out of the left carb :).
The GEMS (Global Election Management Software) program runs on a fairly standard P4 "server grade" box supplied by Diebold, usually a Dell of some sort. It "tallies the vote" on election night from both optical scan and touchscreen voting terminals.
Counties that use touchscreen terminals still use large-model optical scanners to process absentee votes back at county elections headquarters where the GEMS box is.
It's got the usual server stuff, lots of RAM, fair amount of disk space, etc. Funky stuff: a Digiboard multi-port serial card, usually 16 ports on PCI, sometimes two. A CD burner for backups...floppy, USB, etc. I examined the one in use in Fresno County California pretty carefully.
Software:
Most now are running Win2k; there are hints of XP here and there and some old ones have NT. They've had NT or better at least since 2000 (the year that is).
It's got the MS-Jet database engine and related goodies...including an MS-Access runtime. All the libraries to run Visual Basic script files are also present.
GEMS is itself an MS-Access application, and it's data files are fully readable by MS-Access.
IF MS-Access is loaded on the same PC as GEMS and it's data files, it's dead obvious that the data can be diddled with in Access without leaving an audit trail record and without requiring a password. Votes can be changed, the audit trail can be edited in a fashion that can't be detected later (because Diebold disabled automatic line numbering that would show a sequence problem!), etc.
We've known that for a while. And we knew that since GEMS was basically a "giant MS-Access script file itself" in compiled form, it would be possible to write small "hack scripts" to alter vote data.
What Professor Thompson has shown is that it's possible to write VB scripts in the notepad to do alterations to a vote data file. These scripts can be so small they could be typed in via MS-Notepad on election day.
Mind you, Diebold wouldn't need to go to even that much trouble.
Election observers (myself included) have personally seen Diebold techs on elections night with full access to either the terminals feeding PCMCIA cards from the field into the GEMS box, or the server itself.
We know that on 3/5/02 during the California governor's primaries, a Diebold tech in San Luis Obispo County stole the complete early results file right off of the server at 3:31pm, hours before the polls closed, and uploaded it to a Diebold FTP site. We know because we found it later. The ZIP password was defeated by a dictionary crack and turned out to be "sophia" - the Diebold tech on duty that day in that county was Sophia Lee.
So they damned well DO have enough on-site access to load hack scripts of the size range Prof. Thompson demonstrated.
Remote access:
We've played with various GEMS versions on various PCs. IF you run it on a box with firewall software like ZoneAlarm, you get random warning that GEMS is trying to make an outside connection of some sort. We call this the "ET phone home problem". We don't know where it thinks it's calling but that's how you'd beat a firewall on a county LAN if the GEMS box is so connected...set up GEMS to start the conversation from the inside.
Are GEMS boxes on such LANS? We know the IP addys that the Alameda GEMS box modem ports were set up at: 166.107.248.210 to 220. Now go ping the Alameda County website (www.acgov.org)...hmmmmm? Sure made 'em compatible, didn't they?
On those modems: the software behind them is MS-Remote Access Server (RAS). Diebold regularly tests the connections with laptops. They also know the phone numbers of these modem banks that the terminals dial into on election night to do early results. Looks like a security hole from hell to me!
As to the actual GEMS "double set of books" hack, here's the screenshots and explanation:
http://www.equalccw.
It's #3 that basically nobody else is talking about except Bev Harris and her immediate supporters, of which I'd classify myself as one :).
Think about how a bank deals with cash: there's a paper trail AND electronic trail every step of the way, including use of publicly available encryption algorythms - NO use of "security by obscurity".
There are decent PC accounting programs today that meet these standards (business grade programs that is...) which proves this is doable.
Too many of the people advocating a "geek friendly encrypted vote system" are NOT dealing with this whole issue as an "accounting problem".
Bev and myself think it is!
On #4, you're absolutely right, the technical term for a CD burner system is "WORM" and for a good long time, that will probably be the best option for writing out the data at the terminal. With the cost of CD-R drives as low as they are, they're cheaper than PCMCIA gear.
We'll formalize this later but in "rough draft" form, here's our recommendations:
1) Open source. Not necessarily GNU licensed, but the source code of all voting systems must be publicly available on the vendor's website plus at least one gov't website if not multiple - choices include the county elections department's websites, the Federal Election Commission, state SecState sites, etc. ALONG WITH the compiler and operating system makes and versions under which the code was compiled; that will allow us geeks to do our own compiles and generate our own hash results so that we can compare with "in the field" binaries. (I have to disagree with Dr. Dent on his point #2 in that I don't want to have to trust somebody else's hash numbers...I want to roll my own.)
2) Voter verifiable paper trails. The best such schemes are similar to the one Avante developed - your vote is printed on a paper strip "behind glass". You get to look at it, make sure it's OK and if you like it, hit "OK" on the touchscreen. A "robot snipper" clips off that piece of paper, it drops to the bottom of a sealed bucket and it's the official vote of record in case of recount. You don't use a take-up reel because then you can cross-ref the voter order with the vote order and figure out who voted for what. The voter cannot later prove who they voted for (it's not a "reciept") - that way "Guido" can't breaka you legga for voting "wrong" or pay you for voting "right". Oh, and the paper vote of record has an encrypted bar code strip to ID false "extra bits of paper", and minor mistakes in the dot-matrix print that are hard to spot but form their own second tamper-code.
3) This is the major piece that Bev Harris has contributed. Harris used to be a forensic accountant, meaning she dug into financial fraud for a living. In any accounting system, there are auditing procedures and steps at EVERY step of the way as cash is handled. Votes need to be handled the same way - there's documentation every time they change hands, there's a REAL audit trail, and similar steps that need to come from the CPA community. As one example: in a real audit trail, if data entry was done wrong and needs to come out, it isn't erased. It's MARKED (and datestamped) as "not valid" but it's still in there so you can see what happened. None of the current systems do this, with the possible exception of Avante (I'd have to take another look on that point.) Diebold, Sequoia, ES&S and Hart sure don't!
4) Mandate Read-Only-Memory storage of votes at the terminals! This is another thing Avante got right - and no, they ain't paying me or BBV.org a red cent. Their voting terminals burn the vote data to CD-ROM. Diebold, ES&S and Sequoia burn data to PCMCIA memory cards...which can be stuck in a laptop, encryption cracked and the data messed with as happened in Volusia County FL, Nov2000.
---------------
This is PRELIMINARY and should be viewed as such, but it's a pretty good guide to where our heads are at. Blackboxvoting.org (not just a website, we're a non-profit public interest educational/research foundation) will be meeting to discuss a formal proposal ASAP.
Jim March
Member of the BBV.org board of directors (Bev Harris is our Executive Director)
I'm also a co-plaintiff (with Bev Harris) in the current lawsuit against Diebold in California which State Attorney General Bill Lockyer just joined.
First point: the 1994 "ban" didn't do anything. Since there's no "core technical difference" between a standard semi-auto hunting rifle like this Remington:
http://www.remington.com/firearms/centerfire/7400w d.htm
and this "AR Pattern" rifle available in one of the *weaker* calibers Remington supports on the 7400 (the 308 Nato):
http://armalite.com/sales/catalog/rifles/ar10b.htm
The Remington is pictured with a 5rd magazine but 10rd that poke out of the bottom of the gun are available now and with the ban on 10+ magazines gone, they'll be available there soon.
Both guns are semi-auto, magazine fed. After midnight tonight, it will be possible to sell either with such accessories as bayonette lugs, flash dohickey on the end of the barrel, etc...none of which affect lethality.
Because the guns that "look scary" aren't technically different from those that look more "sporting" like that Remington (one of many examples I could show), back in '94 Congress banned certain "evil features" that were purely cosmetic, in an attempt to home in on the "evil looking guns" and leave the deer rifles alone.
Which made the law arbitrary and stupid, and is what's really causing it's death tonight.
Which leaves two questions:
1) Why would anybody want a "military pattern rifle" in the first place?
A: first, parts are widespread and cheap. They usually share at least some components and accessories with the full-auto military versions which are banned; as long as the parts in question don't add full-auto capability, they're legal.
Second, when rifles are engineered to be able to handle full-auto stresses and battlefield conditions via rigorous testing, they're tough as nails. Once the full-auto capability is stripped for the civilian market, they're even tougher as they don't need to cope with that. (Full-auto fire can wear out a barrel in just a few hundred shots in some cases, which is why real military machine gunners keep extra barrels with them for quick swaps.)
Why have a tough gun?
Because competitive shooters must practice a lot - practice levels beyond what hunting rifles can cope with. The vast majority of full-power rifle competition happens not with deer rifles or even high-accuracy target rifles, but with AR-pattern critters distantly related to the US military M16 family, hot-rodded for accuracy.
The Remington probably has a total lifespan of a couple thousand rounds. Less in the hotter calibers like 30-06 or 270Winchester.
AR-pattern rifle owners can sign up for a three-day class in riflework by nationally known instructors such as John Farnham, and shoot 1500 rounds in a three day weekend...and the gun will *probably* hold up. He has loaner spares just in case they don't, as that's one hell of a duty cycle...one that no "pure civilian origin" rifle could even hope to survive.
-----------
Which leaves the other, more controversial issue: the full-capacity magazines of 20 to 30 rounds, or the truly high-cap mags like the Beta-C drums of 75 - 150.
Who needs that?
Slashdotters of all people should know a critical thing: the majority isn't always right. If you thought otherwise, why don't we format all our Linux partitions and run Windoze? I mean, the market has spoken, right?
Spoken in favor of rank idiocy. "The market" is made up of the same technoturnips that try and find the "any key" when the screen says "press any key to continue".
That particular kind of idiocy is harmless. But every once in a while, the sheeple masses get violently stupid all at once. They riot in LA because of a court decision, or a bunch of morons decide to loot after a hurricane or other natural disaster.
Those are recent examples; in both, homeowners and business owners often sto
Regarding the media being "accused" of Liberal bias:
.45 and sprinted back to take the bastard prisoner at gunpoint.
You're making the wrong argument to the wrong guy there!
Please recall that I'm also a self-defense rights activist. I'm the paid state lobbyist and field rep for the Citizen's Committee for the Right to Keep and Bear Arms (www.ccrkba.org). This voting thing is what I got into purely because I care.
(For the record: I'd been involved in Diebolddrama for about six months when attorney Lowell Finley figured that a Qui Tam type suit (yes, the one Lockyer just validated) was necessary. He knew he needed at least one California plaintiff and he came to me after deciding that I was the strongest activist in the state. I in turn said that Bev was deeper in than me, and insisted she be brought in - cutting any possible "take" on my part in half.)
I've seen "Liberal Bias" up close and personal on the GUN issue in spades.
Need an example?
You're no doubt aware there's been a dozen or so "school mass shootings" over the last decade, all of them reported very widely. One happened at Pearl, Mississippi - nutcase kid with a deer rifle shot the place up and was stopped by an assistant principle.
That's what over 400 reporters printed in the week following the event. What fewer than a dozen mentioned is that said principle sprinted 1/4 mile to his car, retrieved a
But oh my, we can't possible mention that an eeeevil GUN was used for good by somebody who wasn't a COP, right?
I could list similar examples for days if I did nothing else.
So do NOT tell me "Liberal Bias" doesn't exist. Don't you DARE.
Jim March
Well the thing is, we didn't expect Lockyer to actually get this decision right. He took his own sweet time about it (correction though: we filed in November '03, not Oct. '03).
But now that he HAS done the right thing, it's the wrong time to put political pressure on him.
We should know fairly soon whether or not Diebold is going to settle. The AG's office says they're going to amend the complaint to reflect the results of their technical inquiry that they apparantly did this year.
The real question is, how do we use Lockyer's decision to affect Maryland, Ohio, etc? I'm not sure.
I think we hang tight for now. Understand, a settlement in California that drives them out of state WILL drive Diebold out of the vote biz (which is a small percentage of their overall revenues and leaving the vote biz will probably drive their stock price UP because the hideous PR will start to dry up).
We take whatever happens in the next month (settlement or an enhanced amended complaint) and we use that to bash the elections departments in other states with.
Jim March
The "Optical Scan terminals" by Diebold are seriously proprietary inside. Trying to cut a Linux or similar OS for same would be a pain, and then you've got to know the specs for the scan hardware in extreme detail to write the app.
:).
But let's say we scrapped those and went to touchscreens (WITH paper trail printer!).
The Diebold touchscreen hardware is seriously weird. Doing a Linux build would be *possible* but annoying.
The real killer is the cost per terminal (over 3k!), and that it would still give Diebold access to the firmware and I wouldn't even trust 'em with that at this point.
Nope. Better to take cheapo basic PCs and write an app for those - I'm convinced that a good user interface that's even compatible with blind folks and a headset for audio instructions can be done with just four buttons - left/right for forward/back, up/down for yes/no. That eliminates the expensive and error-prone touchscreens and lets you use basic monitors.
Here's what we do with the Diebold terminals:
We set up a big Trebuchet. At a shotgun range. We invite every geek with a 12ga to take pot-shots at them as they fly by overhead, and we cheer as we blow the crap out of 'em while they achieve "terminal velocity"
PULL!
We'll call it "Geek Skeet".
Jim March
THAT is what Diebold is best known for, along with bank vault security systems.
:).
Voting stuff is a recent sideline that happened when they bought a Canadian company called Global Election Systems in 2002. See my other post in this thread discussing the history of that.
Funny sidenote: the Diebold ATMs sure as hell feature a "paper trail"
Jim March
Huh. Works for me. Anybody else have a problem?
...still works.
That AP link is down, but:
http://www.equalccw.com/deandemo.html
Jim March
If we're successful, the courts will determine (or Diebold will admit via settlement) that their software was...well, crap. It didn't have the security features they claimed for it when they sold it, or even the security features required by Federal (FEC) regulation and the California Elections Code. So the gov't gets back the money they paid for the junk, because Diebold didn't live up to their contract. Basic fraud. The SIDE EFFECTS: 1) Diebold could leave the elections business. At a minimum, a court loss of this scope would hurt sales something fierce. Voting is a small percentage of their overall business but is the cause of most of their negative PR; closing up the voting division they bought in 2002 becomes a serious option at some point coming up REAL soon now. 2) With strong evidence that the Diebold software was crap, people may finally start realizing that the Federally approved oversight process (independent testing labs approved by the FEC and hired by the voting system vendors to check source code, etc) is seriously broken. That same oversight process approved the ES&S, Sequoia, Hart Intercivic and other such computerized voting system products. If the oversight process is broken, then those products aren't trustworthy either. The ultimate oversight would be via Open Source; that concept in voting is gaining momentum (see also the Open Voting Consortium via google). At a minimum, those other products need scrutiny. Fast. Jim March
Yup!
This year, the California legislature came up with a simple "recommendation only" bill to the Calif SecState urging him to look at Open Source as a concept. It was fought bitterly by, basically, Microsoft (via industry flunkies).
M$ doesn't want Open Source seen as a higher-security alternative in a mission-critical app that *everybody* is involved in...even if it's the better alternative.
Jim March
It's a weeee bit more complicated than that.
...for a more complete demo.
:(. This crap has to go regardless.
OK.
Everybody is looking at how Diebold "Corporate" in Canton OH (the parent company) is riddled with Bush/GOP links. And that's true.
But it's NOT true of Global Election Systems, the Canadian company that Diebold bought in 2002 and renamed "Diebold Election Systems" (still based in Vancouver BC to this day). Diebold corp of Ohio had been investing slightly before buying them outright but the investments do NOT go all the way back to Oct. of 2000.
Late Oct. 2000, GEMS version 1.17.5 was released. Per Bev Harris, this was the earliest version she could find that had the "double set of books" hack in it apparantly designed for election fraud. See also:
http://www.equalccw.com/deandemo.html
Early Oct. of 2000, Global hired a new head programmer for GEMS: Jeffrey Dean.
During the mid to late '80s, Dean embezzled more than $400,000 from a Seattle law firm he was doing computer consulting for. Dean was convicted in the early '90s of 23 counts of computer-aided accounting fraud in what the court called a "sophisticated scheme".
How did he end up hooked up with Global?
He shared a jail cell with another of the founders during the '90s.
Upshot: Global appears to have been run by a genuine bunch of crooks. *Not* political crooks, just plain ol' crooks. Diebold corporate didn't do enough background checks at the time of the buyout and I doubt they understood what sort of pirates they'd swallowed.
I can't be sure of course, 'cuz maybe the Canton boys DID know what they were getting involved in. But if they didn't, then the whole "Bush/GOP connection thing" that the Diebold Corporate people in Ohio are now famous for was a deeply unfortunate coincidence and God only *knows* what's going to happen in November!
Keeerist.
Think this is unlikely?
The big MONEY in election fraud involves rigging *local* elections, esp. building projects, construction bonds and the like. And people don't pay near the attention to that like they do national races.
I suspect that's what Global was really after. And I suspect keeping a secret all the way up to the Bush White House would be...unmanagable and dangerous as hell.
Am I certain Bush is "clean" (of this, at any rate)? Hell no. I *do* know that a heck of a lot of Democrats in various places have pushed for Diebold (starting with Georgia) and I know that county election officials can use the "cheats" Diebold built in very damned easily. Guys, I've personally seen MS-Access loaded onto GEMS boxes within counties - Fresno County's elections staff let me peek at their systems some months back (but the MS-Access was an older version (97) not compatible with the more recent GEMS databases so any ill with it happened some time ago, not recent).
Anyways. I don't want to end up betting on whether or not Diebold will "win out" in "hacking contests" with county elections officials
Jim March
As the author, I can tell you that's a good page and the links to actual code still work.
The information therein should be supplemented with this later data:
http://www.equalccw.com/deandemo.html
That's a "walkthrough" of the "hack demo" Bev Harris did with Howard Dean on CNBC a bit over a month ago. Complete with screenshots. It can be replicated with pieces downloaded from the "Dieboldtestnotes" page.
Putting the actual code and sample data online REALLY pissed Diebold off something fierce; they filed a cease'n'desist notice against my ISP.
Which did NOT succeed in taking my site down; on the contrary, mine is the only site to have completely survived a Diebold C&D with no downtime.
To see how I pulled that trick off:
http://www.equalccw.com/liebold.html
My main "Diebold page" is at:
http://www.equalccw.com/voteprar.html - the "Dean Demo" page will be linked from there soon (prolly tomorrow).
Jim March
AP is covering the same story in a wee bit more detail:
A ID =@@2004409071097
:).
http://www.theledger.com/apps/pbcs.dll/article?
Yup - Lockyer didn't FILE suit, he joined in the one by Bev Harris (Executive Director of BlackBoxVoting.org) and myself (Member of the Board of Directors, same org).
AP keeps reporting that I'm a "programmer". Not true, I've tried to correct that several times now (I'm a former LAN sysadmin/tech support type).
You can see an alternate version of Bev's "cheat code problem" described with screenshots here:
http://www.equalccw.com/deandemo.html
See also my other posts in this thread for more of the background by one of the OTHER plaintiffs - Bill Lockyer is only the newest
NOTE: Bev and I demoed the same stuff as described in the link above to the California SecState's staff on August 18th of this year. Also present was an attorney from Lockyer's office. That may have been the final "tilt" Lockyer needed to join in; that or he saw how Solano County hosed themselves by paying Diebold $415,000 to go away less than two weeks ago.
Jim March
The problem with this "blaming of the victims" (California and it's "customer counties") is that they weren't allowed to see the source code for the product!
Only the Federally approved "Independent Testing Authorities" (ITAs) are allowed to see voting product source code. In the case of Diebold, this was Wyle Labs and Ciber Inc. (formerly "Metamor"), both in Huntsville Alabama and often relying on the same pool of employees. These agencies are approved for this "certification" process by the Federal Elections Commission.
These two acted as the "Arthur Andersons" to Diebold's "Enron".
We know that in at least two cases Diebold specifically decieved the testing labs. We have Diebold's internal memos in which managers instructed lower-level people to lie to the labs; in one case Ken Clark (Sr. Engineer and head of the tech support group) didn't think that the BS they were to pass off would fly, but the report came back from the underling that it did.
For detailed quotes of all this and technical analysis, see also my first two letters to the California Secretary of State, archived in the yellow table, right column:
http://www.equalccw.com/voteprar.html
Without the ability to even see source code, it's rather hard to blame anybody in California for this fiasco.
Diebold on the other hand had a contractual duty to provide software that obeys the Federal certification process sans fraud AND California's election laws (which require high-security products). They blew off both contractual elements, so this isn't "tort law", it's "contract law", a much more cast-in-stone (and legitimate) area of law.
Jim March / jmarch@prodigy.net
Folks,
This is the March/Harris lawsuit. Lockyer has decided to "join in", bringing the government in as a co-plaintiff.
At around 10:30am today, Lowell Finley (our lawyer) calls me with the news that Lockyer and the AG's office have decided to join the suit Bev Harris and I filed all the way back in October. Lockyer and company have taken this long to decide whether or not to jump in.
Their decision to do so is VERY welcome by myself, Bev and our lawyer.
Here's the repercussions:
* Bev, Lowell and myself will be splitting 15% of any winnings, versus 30% if we had to prosecute this on our own.
* We ain't complaining, first because we were never in this for the money and second because Diebold is much more likely to settle early, confronted with Lockyer's legal staff instead of just Lowell. MAYBE they'll cave in before the November election, which would be great.
* Second, our odds of any sort of win is now better.
* Third, Lockyer has sent notice to the REST of the Diebold customer counties in California that they can "join in the fun". So this could spread beyond Alameda County, the original gov't entity that Bev, Lowell and I filed on behalf of.
* This idea of suing Diebold for fraud becomes the alternative to what Solano County decided to do: pay $415,000 in their case to get out of their Diebold contract! (Note: Solano's settlement means it's TOO LATE to join in the March/Harris/Lockyer lawsuit and solution. There's a fair chance Lockyer announced all this today to prevent any more "Solano-style" mistakes.)
Other bits:
The AG's staff are promising Lowell that they are NOT getting into this in order to "sabotage the case and settle early for peanuts". They *could* do that but I believe them that they aren't.
The fact that this is being done as a "whistleblower suit" by two private citizens strongly HELPS the government versus a situation where they did it themselves, even when you factor in the small "bounty" to Bev, Lowell and myself. This is because the whistleblower laws include a triple damages provision if we can prove fraud. This becomes a "big stick" to threaten Diebold into settlement with (for less than triple damages; we'll be OK with actual costs returned plus 15% so that the gov't agencies get "made whole" despite the 15% cut.)
Without whistleblowers, first off the gov't wouldn't have had the data to do this at all and even if we just gave them the data "for free", the gov't wouldn't have the damage tripler "stick".
Finally, the question WILL come up (and already has among these replies): "Is all this legit? Did Diebold REALLY screw up here in a fashion worth suing over?"
My answer to that is at this new page showing the actual vote fraud rigged into Diebold's central tabulator software via screenshots of actual Diebold code and database structures:
http://www.equalccw.com/deandemo.html
That is all I need to say about the basic morality of this lawsuit.
Jim March / jmarch@prodigy.net
Diebold *corporate* is financially solid in ATMs, bank vault security, etc.
l
Diebold Election Systems is hemmoraging money.
My theory:
When Diebold bought Global Elections Systems in...lesse, I *think* the sale was finalized in 2002 with partnerships/investments prior, I don't think the larger corp understood what a pack o' jackals they were dealing with.
I could be wrong mind you, but...
OK, here's a piece of evidence. Alameda County first bought their touchscreen voting system off of Global. They signed a contract. When Diebold corporate swallowed Global, the contract was re-written so that BOTH the newly-renamed Diebold Election Systems Inc ("DESI") subsidiary AND the parent company(!) were named co-contractors for Alameda County.
Which means even if corporate cuts "DESI" loose and destroys them, they're in hock on that contract if it all goes south.
IF they had suspected the old Global bunch was playing fast and loose with elections laws, they would NEVER have co-signed the contract, would they?
Second point: we have the stash of Diebold EMails running from 1999 (Global era) through early 2003 (Diebold era). The names of the players involved in the tech support, programming and marketing internal mailing lists DO NOT change. No new management team was brought in from Corporate, no new major names appear, there's virtually no references to new procedures or oversight, nothing.
My conclusion: corporate thought they were buying a smoothly running little org, rather than a pack of rampaging pirates.
There's no WAY Diebold corporate can continue hemmoraging CREDIBILITY! Forget the money for a sec - corporate makes their money supplying security gear for BANKS for God's sake. What happens when the banks start saying "errr...hey guys, don't look now but the name "Diebold" has become synonymous with terms like "idiots" and "crooks" and whatnot...".
And here's the cool part, folks. The really hilarious part.
All of this has happened before.
1966. A small electronic voting company called Harris (no relation to Bev!) gets bought by a megacorp...which within a couple of years, realizes that the voting subsidiary is worth 2% of the profits and 80% of the negative PR.
IBM isn't in the voting business anymore. Took 'em three years to wise up. See also:
http://www.csl.sri.com/users/neumann/dugger.htm
Y'all can bet your Palm Pilots Diebold Corporate is gonna get the same clue.
Jim
Yup.
:).
Errr...not ALL of it though
(I hope nobody here is as humor-impaired as a few of the DemocraticUnderground folks seem to be.)
Jim
(yes, that Jim)
This is doubly not true. Possibly tripply :) if that's a word.
First: I can't get Rachel Konrad at AP to STOP calling me a "programmer". I was a full-tilt sysadmin when I left the techie fields but have never claimed to be a programmer anywhere. Apparantly her editors don't want to waste the space to put in "system administrator/tech support" or something. And because it's all over, it keeps getting re-broadcast. I can't freakin' stop it, although as God is my witness I've tried.
Second: I never, ever threatened or tried to surprise anybody with cutlery or otherwise. Anyone who knows me knows I'm not *wired* to want to threaten or bully or scare anybody. I'm very sorry if I accidentally scared someone while stripping wires or something...I can recall a couple of times that happening over the years but I always tried to make my lack of threatening intent VERY clear.
Third: what's this about me being a "leader"?
I'm serious. That was never my intent, nor is it the case today. I just rolled up my sleeves and *worked* at this stuff, analysing programs, helping Bev Harris go through the massive stash of stuff she downloaded, helped go through the EMail stash that somebody (we still don't know who) slipped out apparantly around 3/15/03(???) and released broadly around August(?). See for yourselves:
http://www.equalccw.com/voteprar.html - I would recommend in particular the "DieboldTestNotes" page linked from there, and my letters to the California Secretary of State...the first two of which (still the most important stuff I've written I think) were done before meeting Lowell Finley.
Now let's talk about Lowell. He is an fair voting rights activist first, lawyer second. He decided that the best way to kick the snot out of Diebold was to do a Qui Tam...go after their money. So in late October, he looked for a California resident (he knew he had to have at least one) who had made the MOST original research in the area of Diebold. Original research is what matters in a Qui Tam.
He came to me.
I had *no* idea what a Qui Tam was, and no idea that any part of this could possibly be profitable. Anybody who says I'm "in this for the money" is crazy. The offices of attorney Lowell Finley is at 510-290-8823. Call him up - ask him what was the FIRST thing I said when this whole "Qui Tam" concept sunk in. I'll tell you what he'll report me saying: "we have to bring Bev Harris in". I knew she'd done more work AND more original research than I had and there was no way I'd walk away with cash without her being involved.
Bev's the leader here, not me. Anything I've done, I've published so others can build off of what I'm doing...see also the URL above.
Leader? Literally, I'm not. You wanna go do something? Cool. Do it. You wanna build off my work, or ignore it, or some mix, ain't no skin off my back.
I'm gonna do what I do. Which is see something wrong, try and fix it...without stealing anybody else's work, without backstabbing anybody else, without trying to hurt anybody else's effectiveness.
And without posting anonymously, even if that opens me up to somebody who's either pissed off, or possibly somebody I accidentally scared God knows how many years ago. I'm really sorry if that's the case...reading that post I'm replying to was like a punch to the gut.
But ask Bev, Lowell or a lot of other people whether or not I'm crazy.
I'm not.
Jim