So simple a monkey could do it

[IcemanCometh]

But could George Bush?

[Nbadan]

Critics of the Diebold (search) touch-screen voting machines turned their attention Wednesday from the machines themselves to the computers that will tally the final vote, saying the outcome is so easy to manipulate that even a monkey could do it.

And they showed video of a monkey hacking the system to prove it.

In the minute-long video produced by Black Box Voting (search), Baxter the chimp is shown deleting the audit log that is supposed to keep track of changes in the Diebold central tabulator, the computer and program that keeps track of county vote totals.

Black Box Voting founder Bev Harris said the demonstration shows that the system — which will be used in more than 30 states, including Maryland — is dangerously inadequate when it comes to stopping election fraud.

But a Diebold spokesman insisted that the system is secure despite "incessant" criticism from organizations such as Black Box Voting.

"The fact of the matter is what you saw was a staged production ... analogous to a magic show," said David Bear, the Diebold spokesman.

Even if the system could be hacked, he said, it could only be done by a person with "unfettered access to the system." Bear noted that elections are not just the machines, but also the people who work the elections.

Yeah, why would someone with 'unfettered access' want to intentionally manipulate the vote count? So, there you go.

Here is another secret about paper-less voting machines that you may not have heard about...

According to election industry officials, electronic voting systems are absolutely secure, because they are protected by passwords and tamperproof audit logs. But the passwords can easily be bypassed, and in fact the audit logs can be altered. Worse, the votes can be changed without anyone knowing, even the County Election Supervisor who runs the election system.

The computer programs that tell electronic voting machines how to record and tally votes are allowed to be held as "trade secrets." Can citizen's groups examine them? No. The companies that make these machines insist that their mechanisms are a proprietary secret. Can citizen's groups, or even election officials, audit their accuracy? Not at all, with touch screens, and rarely, with optical scans, because most state laws mandate that optical scan paper ballots be run through the machine and then sealed into a box, never to be counted unless there is a court order. Even in recounts, the ballots are just run through the machine again. Nowadays, all we look at is the machine tally.

Therefore, when I found that Diebold Election Systems had been storing 40,000 of its files on an open web site, an obscure site, never revealed to public interest groups, but generally known among election industry insiders, and available to any hacker with a laptop, I looked at the files. Having a so-called security-conscious voting machine manufacturer store sensitive files on an unprotected public web site, allowing anonymous access, was bad enough, but when I saw what was in the files my hair turned gray. Really. It did.

The contents of these files amounted to a virtual handbook for vote-tampering: They contained diagrams of remote communications setups, passwords, encryption keys, source code, user manuals, testing protocols, and simulators, as well as files loaded with votes and voting machine software.

Diebold Elections Systems AccuVote systems use software called "GEMS," and this system is used in 37 states. The voting system works like this:

Voters vote at the precinct, running their ballot through an optical scan, or entering their vote on a touch screen.

After the polls close, poll workers transmit the votes that have been ac ulated to the county office. They do this by modem.

At the county office, there is a "host computer" with a program on it called GEMS. GEMS receives the incoming votes and stores them in a vote ledger. But in the files we examined, which were created by Diebold employees and/or county officials, we learned that the Diebold program used another set of books with a copy of what is in vote ledger 1. And at the same time, it made yet a third vote ledger with another copy.

Apparently, the Elections Supervisor never sees these three sets of books. All she sees is the reports she can run: Election summary (totals, county wide) or a detail report (totals for each precinct). She has no way of knowing that her GEMS program is using multiple sets of books, because the GEMS interface draws its data from an Access database, which is hidden. And here is what is quite odd: On the programs we tested, the Election summary (totals, county wide) come from the vote ledger 2 instead of vote ledger 1, and ledger 2 can be altered so it may or may not match ledger 1.

Now, think of it like this: You want the report to add up only the actual votes. But, unbeknownst to the election supervisor, votes can be added and subtracted from vote ledger 2. Official reports come from vote ledger 2, which has been disengaged from vote ledger 1. If one asks for a detailed report for some precincts, though, the report comes from vote ledger 1. Therefore, if you keep the correct votes in vote ledger 1, a spot check of detailed precincts (even if you compare voter-verified paper ballots) will always be correct.

And what is vote ledger 3 for? For now, we are calling it the "Lord Only Knows" vote ledger.

Scoop

[Nbadan]

Just last week, the Maryland Court of Appeals rejected a challenge to the use of similar Diebold machines, which do not print out ballots as they are cast.

A panel of top experts on election technology and administration warned Tuesday that the American system of voting is broadly vulnerable to error and abuse, and called for a crash-course of study and reform to make results more reliable and to promote better access by voters, especially those who have historically encountered serious impediments to exercising their right to vote.

While pointing out that problems can arise with any form of casting votes, panelists noted that new touch-screen computer technology has come under recent sustained attack because most such systems leave no paper trail to verify the final count. Last year, computer scientists at Rice University and Johns Hopkins University reported significant security flaws in Diebold Inc.'s AccuVote-TS electronic voting system. Just last week, the Maryland Court of Appeals rejected a challenge to the use of similar Diebold machines, which do not print out ballots as they are cast.

"What can go wrong? Everything," lamented AAAS panelist Susan Inman, director of elections for the Pulaski County Election Commission in Little Rock, Ark. "If the method of voting is made too complex for a poll worker to manage, it can create more problems than are solved." Panelist George Gilbert, director of elections for the Guilford County Board of Elections in North Carolina, put it more tersely: "The system is a Rubik's Cube inside a maze."

Black Box Voting

[Nbadan]

Avi Rubin, a computer-security expert and professor at Johns Hopkins University who was slipped a copy of Diebold’s source code earlier this year. After he and his students examined it, he concluded that the protections against fraud and tampering were strictly amateur hour. “Anyone in my basic security classes would have done better,” he says. The cryptography was weak and poorly implemented, and the smart-card system that supposedly increased security actually created new vulnerabilities. Rubin’s paper concluded that the Diebold system was “far below even the most minimal security standards.” Naturally, Diebold disagrees with Rubin. “We’re very confident of accuracy and security in our system,” says director of Diebold Election Systems Mark Radke.

After Rubin’s paper appeared, Maryland officials—who were about to drop $57 million on Diebold devices—commissioned an outside firm to look at the problem. The resulting report confirmed many of Rubin’s findings and found that the machines did not meet the state’s security standards. However, the study also said that in practice some problems were mitigated, and others could be fixed, an at ude Rubin considers overly optimistic. “You’d have to start with a fresh design to make the devices secure,” he says.

In the past few months, the computer- security community has been increasingly vocal on the problems of DRE terminals. “I think the risk [of a stolen election] is extremely high,” says David Dill, a Stanford computer scientist. The devices are certified, scientists say, but the process focuses more on making sure that the machines don’t break down than on testing computer code for Trojan horses and susceptibility to tampering. While there’s no evidence that the political establishment actually wants vulnerable machines, the Internet is buzz-ing with conspiracy theories centering on these “black box” voting devices. (The biggest buzz focuses on the 2002 Georgia gubernatorial election, won by a Republican underdog whose win confounded pollsters.)

Su ions run even higher when people learn that some of those in charge of voting technology are themselves partisan. Walden O’Dell, the CEO of Diebold, is a major fund-raiser for the Bush re-election campaign who recently wrote to contributors that he was “committed to helping Ohio deliver its electoral votes for the president next year.” (He later clarified that he wasn’t talking about rigging the machines. Whew.)

MSNBC

[Nbadan]

From the article above...

The biggest buzz focuses on the 2002 Georgia gubernatorial election, won by a Republican underdog whose win confounded pollsters.)

Of course, those of us who follow such things know that the Georgia Governor defeated was none other than Max Cleland. Georgia uses exclusive Diebold machines.

Here is a poll taken right before the Nov election

****Poll by Atlanta Journal Cons ution Nov. 1 for Georgia Senate

Max Cleland (D) 49% up 5
Saxby Chambliss (R) 44%

**"Official Results" from the 'Diebold Electronic Voting Machines'

Max Cleland (D) 46%
Saxby Chambliss 53% up 7 - that's a 13-point pro-Bush swing - was it magic?

Bartcop

San Antonio uses Diebold paperless ballots.