Feeds

Diebold voting systems critically flawed

'It is like the nuclear bomb for e-voting systems'

Build a business case: developing custom apps

Michael Shamos remembers that the call came late at night, during the last week of April.

The call - from election watchdog BlackBoxVoting.org - described a critical vulnerability in Diebold Election Systems' touchscreen voting systems that could allow any person with access to a voting terminal the ability to completely change the system code or ballot file on the system. As a professor of computer science at Carnegie Mellon University and adviser to the Commonwealth of Pennsylvania on electronic voting, Shamos realized that, at the very least, a workaround for the flaw needed to be in place by Pennsylvania's next election - at the time, less than three weeks away.

"This one is so bad, that we can't do just nothing," Shamos told the state's election officials at the time. "Any losing candidate could challenge the election by saying, 'How do I know that the software on the machine is the software certified by the state?'"

Late Thursday, BlackBoxVoting published a redacted version of a paper describing the design flaw in Diebold AccuVote TSX and TS6 touchscreen election systems. Because of the seriousness of the flaw, the full report detailing the issue has only been distributed to a limited group of computer scientists, state and federal election officials, and security groups.

"We have elections every single week this month, and there is no way to do meaningful remediation at this point," said Bev Harris, founder of BlackBoxVoting.

Three states have already issued alerts on the flaws to election officials. The Pennsylvania Department of State told county clerks to reinstall the software on election devices and then lock them up in a secure location until the May 16 general primary.

"The Department of State will furnish the authorized software to the counties on a PCMCIA card along with instructions for its installation," a copy of the memo seen by SecurityFocus stated.

Both Iowa and California have also issued alerts, according to the Associated Press.

The incident represents the most major failure of the federal process to create secure election technology to date. While researchers and civil rights groups have voiced strong criticism of electronic voting technology - and in particular the systems' security - the national elections held in November 2004 saw only small problems that would likely not have impacted the outcome of the election.

However, trust remains a significant issue. Voting machine makers and the certification labs that have tested election systems have been secretive about the technology. And, while older machines and the method for counting votes tallied by the older technology were easily understood by the average voter, electronic voting systems have become more impenetrable and have not undergone significant and public testing, according to computer scientists that have called for more rigorous security testing.

Diebold has had a more turbulent relationship with states and security experts over e-voting. The company's CEO stepped down in December, a day before a law firm filed a shareholder suit against the company, claiming - among other issues - that the company misled investors about the state of its e-voting technology. The U.S. Securities and Exchange Commission announced this week that it has opened an inquiry into how Diebold reports revenue, following the company's admission in SEC filings that its election business overstated revenue and understated deferred revenue.

A representative of Diebold Election Systems could not immediately be reached for comment on the SEC inquiry or the design flaw, but Pennsylvania's memo to election officials stated that the company had confirmed the vulnerability and acknowledged that the issue could be used to load malicious software on an election system.

"The probability for exploiting this vulnerability to install unauthorized software that could affect an election is considered low," the memo to election officials stated. "To exploit this risk, physical access is required to the Personal Computer Memory Card International Association (PCMCIA) slots on the machine during system startup."

Other computer scientists do not believe the threat to be theoretical.

"It is like the nuclear bomb for e-voting systems," said Avi Rubin, computer science professor at Johns Hopkins University. "It's the deal breaker. It really makes the security flaws that we found (in prior years) look trivial."

The Essential Guide to IT Transformation

More from The Register

next story
Just TWO climate committee MPs contradict IPCC: The two with SCIENCE degrees
'Greenhouse effect is real, but as for the rest of it ...'
Adam Afriyie MP: Smart meters are NOT so smart
Mega-costly gas 'n' 'leccy totting-up tech not worth it - Tory MP
'Blow it up': Plods pop round for chat with Commonwealth Games tweeter
You'd better not be talking about the council's housing plans
Arrr: Freetard-bothering Digital Economy Act tied up, thrown in the hold
Ministry of Fun confirms: Yes, we're busy doing nothing
ONE EMAIL costs mining company $300 MEEELION
Environmental activist walks free after hoax sent share price over a cliff
Help yourself to anyone's photos FOR FREE, suggests UK.gov
Copyright law reforms will keep m'learned friends busy
Apple smacked with privacy sueball over Location Services
Class action launched on behalf of 100 million iPhone owners
UK government officially adopts Open Document Format
Microsoft insurgency fails, earns snarky remark from UK digital services head
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.