State: Fla. voting machines can be hacked

BY MARC CAPUTO

ROBERT SULLIVAN/AFP

The study by Florida State University found that, despite recent software fixes, an ССadversary'' could use a pre-programmed computer card to swap one candidate's votes for another or create a "ballot-stuffing attack'' that multiplies votes for a candidate or issue.

Reversing an unofficial policy of denial, the Florida Secretary of State's office has conducted an elections study that confirmed Tuesday what a maverick voting chief discovered nearly two years ago: Insider computer hackers can change votes without a trace on Diebold optical-scan machines.

The study by Florida State University found that, despite recent software fixes, an ''adversary'' could use a pre-programmed computer card to swap one candidate's votes for another or create a ''ballot-stuffing attack'' that multiplies votes for a candidate or issue.

A Diebold spokesman, Mark Radke, said the company is confident it will upgrade the ''minor'' software glitch by an Aug. 17 deadline the state has set. If it doesn't, Secretary of State Kurt Browning said his office would eventually ban the use of optiscan Diebold machines in Florida, where 25 counties, including Monroe, use its fill-in-the-blank systems.

All other voting vendors are being examined for the same security issues, including Elections Systems & Software machines, which Miami-Dade and Broward use as well. A new state law requires that, by next year, all counties must use paper-trail style machines.

Browning, who credited Diebold for its openness, said he ordered the FSU study in the wake of a test conducted in late 2005 by Leon County Election Supervisor Ion Sancho, who allowed a Finnish computer scientist named Harri Hursti unfettered access to the voting systems to see if they could be compromised. Hursti found that votes could be changed without leaving much of a trace.

At the time, the previous secretary of state, David Mann, said he wasn't concerned and, along with Diebold, dismissed the Hursti study as unrealistic because it didn't take place in a real world-type environment. Radke noted that Hursti declined an offer from California elections officials to repeat his Leon County study.

Browning didn't see it that way.

''There's a new secretary in town,'' he said. ``We kind of categorize this Hursti event as a pretty major issue. It showed you could go in manipulate the system and the key word is to do it undetected.''

In addition to requiring the software upgrade, Browning plans to ask elections supervisors to have a uniform security policy to ensure a chain of custody for elections equipment that would show who touched what elections system and when.

Browning's examination was vindication for Sancho, but the nonpartisan election supervisor said it's just a first step. He said the contested Sarasota congressional race that ultimately helped lead to the demise of touch-screen voting machines in Florida still exposed a big wound in Florida's elections systems: Their software is run and owned by private companies.

''The larger issue in my mind is: Since we've all been asleep at the wheel, there maybe should have been more effective tests on the machines than we've run,'' Sancho said. ``So there's a lot we still don't know about.''

http://www.miamiherald.com