Easy Voting Fraud Machines

[tw]

Originally Posted by xoxoxoBruce

Well, wouldn't a patch to correct a software glitch be necessary for every one of the 19000 voting machines. I'm going with the assumption that all the machines in the state should be running the same software.

If not, still, every machine must have software (even if different) that is certified. From IEEE Spectrum of October 2004:

Yet certifying equipment even to the 2002 standard is proving to be problematic, since it is voluntarily adopted by the states, and not all have signed on yet. Only three companies are authorized to perform the commission's examinations, which are paid for by the vendors - an arrangement that many critics say compromises the testing.

Even after a system is certified, election officials must strive to ensure that the system that voters use on Election Day is the same as the system that was tested. Yet federal guidelines don't require any kind of electronic or digital signature to track software from certification to installation (although HAVA commissioners have lately said this would be a good idea).

This security hole and many others were identified by experts several years ago, in comments on the earlier 2002 Federal Election Commission certification guidelines. ...

... IEEE Voting Equipment Standards primary working group (P1583), and an attempt was made to push a draft of the standard through the acceptance process.

This first P1583 draft omitted any mention of requirements pertaining to voter-verified paper audit trails. The draft also included what some say is a major security loophole: a blanket exemption for all commercial off-the-shelf components, including operating systems such as Windows or Unix and standard hardware modules such as modems and wireless transceivers. The 2002 Federal Election Commission's guidelines have the same exemption. "The 2002 FEC standard was our starting point," Deutsch notes. "So our first draft was built on that, and we thought major improvements were made."

Protests by IEEE members, academicians, and other concerned individuals led to the submission of more than 1000 specific comments, which have taken nearly a year to resolve. The IEEE new draft does cover the issue of voter-verified paper audit trails, though it does not require them.

Why worry who is changing the software. There is no verifiable paper trail or anything that is equivalent. If that was not bad enough, IEEE even noted how entry to buildings where voting machines are stored was easy - almost routine.

Furthermore is the response of technically naive to the problem.

Knowledgeable advice had been offered and spurned. Information-security expert Jeremy Epstein gave Fairfax officials a three-page list of questions after he attended a pre-election training session. A letter from Margaret K. Luca, who was then electoral board secretary, said that she couldn't respond on the grounds that "release of that information could jeopardize the security of that voting equipment." Critics say that Epstein's experience is typical of the way in which the election community has shut out scientists and engineers and made it impossible to independently test electronic voting systems.

So how did Princeton researchers obtain a machine? Subterfuge? What kind of confirmation is that? Powers that be fear that indepentent analysis might learn electronic voting machine concepts - the secrets of Windows or Unix? Sounds too much like Saddam again has WMDs.

Hearings were held after the primary elections, and on 20 April, California Secretary of State Kevin Shelley released a report charging that Diebold marketed, sold, and installed its AccuVote systems in Kern, San Diego, San Joaquin, and Solano counties prior to full testing, prior to federal qualification, and without complying with the state certification requirements. These and other discoveries were subsequently turned over to the California attorney general's office for possible criminal investigation against Diebold.

Ten days later, Shelley issued a controversial decertification notice, withdrawing approval for all direct-recording electronic voting systems in California, deeming them defective or unacceptable. Because of this, the state required nearly 16 000 AccuVote machines in the four counties involved to be recertified to comply with tighter security and auditability measures ...

Certifying software patches does not even begin to question these machine integrities.