Feeds

Diebold voting systems critically flawed

'It is like the nuclear bomb for e-voting systems'

Remote control for virtualized desktops

Michael Shamos remembers that the call came late at night, during the last week of April.

The call - from election watchdog BlackBoxVoting.org - described a critical vulnerability in Diebold Election Systems' touchscreen voting systems that could allow any person with access to a voting terminal the ability to completely change the system code or ballot file on the system. As a professor of computer science at Carnegie Mellon University and adviser to the Commonwealth of Pennsylvania on electronic voting, Shamos realized that, at the very least, a workaround for the flaw needed to be in place by Pennsylvania's next election - at the time, less than three weeks away.

"This one is so bad, that we can't do just nothing," Shamos told the state's election officials at the time. "Any losing candidate could challenge the election by saying, 'How do I know that the software on the machine is the software certified by the state?'"

Late Thursday, BlackBoxVoting published a redacted version of a paper describing the design flaw in Diebold AccuVote TSX and TS6 touchscreen election systems. Because of the seriousness of the flaw, the full report detailing the issue has only been distributed to a limited group of computer scientists, state and federal election officials, and security groups.

"We have elections every single week this month, and there is no way to do meaningful remediation at this point," said Bev Harris, founder of BlackBoxVoting.

Three states have already issued alerts on the flaws to election officials. The Pennsylvania Department of State told county clerks to reinstall the software on election devices and then lock them up in a secure location until the May 16 general primary.

"The Department of State will furnish the authorized software to the counties on a PCMCIA card along with instructions for its installation," a copy of the memo seen by SecurityFocus stated.

Both Iowa and California have also issued alerts, according to the Associated Press.

The incident represents the most major failure of the federal process to create secure election technology to date. While researchers and civil rights groups have voiced strong criticism of electronic voting technology - and in particular the systems' security - the national elections held in November 2004 saw only small problems that would likely not have impacted the outcome of the election.

However, trust remains a significant issue. Voting machine makers and the certification labs that have tested election systems have been secretive about the technology. And, while older machines and the method for counting votes tallied by the older technology were easily understood by the average voter, electronic voting systems have become more impenetrable and have not undergone significant and public testing, according to computer scientists that have called for more rigorous security testing.

Diebold has had a more turbulent relationship with states and security experts over e-voting. The company's CEO stepped down in December, a day before a law firm filed a shareholder suit against the company, claiming - among other issues - that the company misled investors about the state of its e-voting technology. The U.S. Securities and Exchange Commission announced this week that it has opened an inquiry into how Diebold reports revenue, following the company's admission in SEC filings that its election business overstated revenue and understated deferred revenue.

A representative of Diebold Election Systems could not immediately be reached for comment on the SEC inquiry or the design flaw, but Pennsylvania's memo to election officials stated that the company had confirmed the vulnerability and acknowledged that the issue could be used to load malicious software on an election system.

"The probability for exploiting this vulnerability to install unauthorized software that could affect an election is considered low," the memo to election officials stated. "To exploit this risk, physical access is required to the Personal Computer Memory Card International Association (PCMCIA) slots on the machine during system startup."

Other computer scientists do not believe the threat to be theoretical.

"It is like the nuclear bomb for e-voting systems," said Avi Rubin, computer science professor at Johns Hopkins University. "It's the deal breaker. It really makes the security flaws that we found (in prior years) look trivial."

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
I'll be back (and forward): Hollywood's time travel tribulations
Quick, call the Time Cops to sort out this paradox!
Musicians sue UK.gov over 'zero pay' copyright fix
Everyone else in Europe compensates us - why can't you?
Megaupload overlord Kim Dotcom: The US HAS RADICALISED ME!
Now my lawyers have bailed 'cos I'm 'OFFICIALLY' BROKE
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
BT said to have pulled patent-infringing boxes from DSL network
Take your license demand and stick it in your ASSIA
Right to be forgotten should apply to Google.com too: EU
And hey - no need to tell the website you've de-listed. That'll make it easier ...
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.