Feeds

Diebold voting systems critically flawed

'It is like the nuclear bomb for e-voting systems'

Top 5 reasons to deploy VMware with Tegile

Michael Shamos remembers that the call came late at night, during the last week of April.

The call - from election watchdog BlackBoxVoting.org - described a critical vulnerability in Diebold Election Systems' touchscreen voting systems that could allow any person with access to a voting terminal the ability to completely change the system code or ballot file on the system. As a professor of computer science at Carnegie Mellon University and adviser to the Commonwealth of Pennsylvania on electronic voting, Shamos realized that, at the very least, a workaround for the flaw needed to be in place by Pennsylvania's next election - at the time, less than three weeks away.

"This one is so bad, that we can't do just nothing," Shamos told the state's election officials at the time. "Any losing candidate could challenge the election by saying, 'How do I know that the software on the machine is the software certified by the state?'"

Late Thursday, BlackBoxVoting published a redacted version of a paper describing the design flaw in Diebold AccuVote TSX and TS6 touchscreen election systems. Because of the seriousness of the flaw, the full report detailing the issue has only been distributed to a limited group of computer scientists, state and federal election officials, and security groups.

"We have elections every single week this month, and there is no way to do meaningful remediation at this point," said Bev Harris, founder of BlackBoxVoting.

Three states have already issued alerts on the flaws to election officials. The Pennsylvania Department of State told county clerks to reinstall the software on election devices and then lock them up in a secure location until the May 16 general primary.

"The Department of State will furnish the authorized software to the counties on a PCMCIA card along with instructions for its installation," a copy of the memo seen by SecurityFocus stated.

Both Iowa and California have also issued alerts, according to the Associated Press.

The incident represents the most major failure of the federal process to create secure election technology to date. While researchers and civil rights groups have voiced strong criticism of electronic voting technology - and in particular the systems' security - the national elections held in November 2004 saw only small problems that would likely not have impacted the outcome of the election.

However, trust remains a significant issue. Voting machine makers and the certification labs that have tested election systems have been secretive about the technology. And, while older machines and the method for counting votes tallied by the older technology were easily understood by the average voter, electronic voting systems have become more impenetrable and have not undergone significant and public testing, according to computer scientists that have called for more rigorous security testing.

Diebold has had a more turbulent relationship with states and security experts over e-voting. The company's CEO stepped down in December, a day before a law firm filed a shareholder suit against the company, claiming - among other issues - that the company misled investors about the state of its e-voting technology. The U.S. Securities and Exchange Commission announced this week that it has opened an inquiry into how Diebold reports revenue, following the company's admission in SEC filings that its election business overstated revenue and understated deferred revenue.

A representative of Diebold Election Systems could not immediately be reached for comment on the SEC inquiry or the design flaw, but Pennsylvania's memo to election officials stated that the company had confirmed the vulnerability and acknowledged that the issue could be used to load malicious software on an election system.

"The probability for exploiting this vulnerability to install unauthorized software that could affect an election is considered low," the memo to election officials stated. "To exploit this risk, physical access is required to the Personal Computer Memory Card International Association (PCMCIA) slots on the machine during system startup."

Other computer scientists do not believe the threat to be theoretical.

"It is like the nuclear bomb for e-voting systems," said Avi Rubin, computer science professor at Johns Hopkins University. "It's the deal breaker. It really makes the security flaws that we found (in prior years) look trivial."

Beginner's guide to SSL certificates

More from The Register

next story
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
Assange™ slumps back on Ecuador's sofa after detention appeal binned
Swedish court rules there's 'great risk' WikiLeaker will dodge prosecution
NSA mass spying reform KILLED by US Senators
Democrats needed just TWO more votes to keep alive bill reining in some surveillance
'Internet Freedom Panel' to keep web overlord ICANN out of Russian hands – new proposal
Come back with our internet! cries Republican drawing up bill
What a Mesa: Apple vows to re-use titsup GT sapphire glass plant
Commits to American manufacturing ... of secret tech
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?