http://www

http://www.sci-tech-today.com/story.xhtml?story_id=01100000CT9F

Sci-Tech Today

The Plot Thickens for Electronic Voting

By Barry Levine

August 2, 2007 9:53AM

While Diebold responded to the Florida optical scanning machine issue with a promise to be cooperative, Diebold and other voting machine vendors responded harshly to the California report on the security of e-voting systems, complaining mainly that the e-voting security tests were conducted in a lab, not in a real-world voting scenario.

Cady Palmer, Miami Deputy Elections Supervisor, discovers that hacked election voting machines have delivered victory to the governor, who has set his sights on the White House. But she won't let go of the truth, even when terrorized by a stalker.

The plot of "A Margin of Error: Ballots of Straw," a new novel by a former Florida county election official, gained credence for the fictional hacking from two state-sponsored studies, released in the past week, on the security Relevant Products/Services of voting machines.

California E-Voting Brouhaha

In California, Secretary of State Debra Bowen held a contentious hearing on Monday following last week's release of a study by the University of California showing that voting machines from three major vendors -- Diebold Election Systems, Hart InterCivic, and Sequoia Voting Systems -- could readily be compromised.

The California study led U.S. Senator Diane Feinstein (D-CA) to announce on Tuesday that a hearing would be held in the fall to address the security risk of electronic voting machines that do not have a verifiable paper record. The risk is "yet another reason that states and counties should consider a move to optical scan machines that provide an auditable, individual voter-verified paper record without having to rely on a separate printer Relevant Products/Services," she said in a statement.

But a study in Florida, commissioned by that state's Secretary of State, has found that even optical scanning machines are hackable. The study, released on Friday, indicates that election results could be changed by poll workers or others.

Hackable Optical Scanners

The optical machine testing, by the Florida State University Security and Assurance in Information Technology Laboratory, checked through a list of problems that had previously been discovered on Diebold machines. "While the vendor has fixed many of these flaws," the report said, "many important vulnerabilities remain unaddressed." A preprogrammed memory card could be quickly replaced, the lab discovered, which could change all or some of the votes for one candidate to another.

Florida Secretary of State Kurt Browning said that Diebold, the manufacturer of the optical scanners, has agreed to make fixes by an August 17 deadline. Otherwise, Browning said, the machines would be decertified.

Of Florida's 67 counties, 15 use touch-screen machines with no paper record. The others use paper ballots, which are counted with optical scanners. A new Florida law requires a verifiable paper trail for all machines, and the paperless machines are being junked.

The Vendors Respond

While Diebold responded to the Florida Secretary of State with a promise to be cooperative, Diebold and other voting-machine vendors responded harshly to the California report.

"Nothing in life happens in isolation," read a statement released Tuesday from Sequoia Voting Systems. California's review "was not conducted in a true election environment," and so was "not a security risk evaluation but an unrealistic worst case scenario." The researchers had noted that their job was to try to compromise the machines without assumptions about what access or tools hackers would or would not have.

Diebold complained that California didn't examine the company's most recently developed software, which is intended to deal with low-risk, previously identified issues. But, according to Forbes magazine, that software has not yet been approved for use by the state.

Voting Objectives, Recounts

"The objective," said Gartner analyst Ray Wagner, "should be that the voter can enter his vote, see how it has been entered," and, optimally, check that it has been recorded correctly. Some observers have suggested that voters should be able to obtain a receipt for their vote, but Wagner said doing so would raise the possibility of vote-buying, because voters could be compelled or induced to show outsiders exactly how they voted.

There needs to be the possibility of a recount, he said, which did not exist, for instance, in the touch-screen counties in Florida that did not have a paper trail -- except by looking at the same electronic counter that is being audited. If these principles are observed, he added, electronic voting can be made secure, as it has been in Australia.

But, he said, Australia has one voting system, while the U.S. has 50 state systems. The U.S. voting machine companies "are not going to do anything more than required by our regulations," he said, "and our regulations have not yet caught up."