Computer Voting Is Open to Easy Fraud, Experts Say

The software that runs many high-tech voting machines contains serious flaws that would allow voters to cast extra votes and permit poll workers to alter ballots without being detected, computer security researchers said yesterday.

"We found some stunning, stunning flaws," said Aviel D. Rubin, technical director of the Information Security Institute at Johns Hopkins University, who led a team that examined the software from Diebold Election Systems, which has about 33,000 voting machines operating in the United States.

The systems, in which voters are given computer-chip-bearing smart cards to operate the machines, could be tricked by anyone with $100 worth of computer equipment, said Adam Stubblefield, a co-author of the paper.

"With what we found, practically anyone in the country ? from a teenager on up ? could produce these smart cards that could allow someone to vote as many times as they like," Mr. Stubblefield said.

The software was initially obtained by critics of electronic voting, who discovered it on a Diebold Internet site in January. This is the first review of the software by recognized computer security experts.

A spokesman for Diebold, Joe Richardson, said the company could not comment in detail until it had seen the full report. He said that the software on the site was "about a year old" and that "if there were problems with it, the code could have been rectified or changed" since then. The company, he said, puts its software through rigorous testing.

"We're constantly improving it so the technology we have 10 years from now will be better than what we have today," Mr. Richardson said. "We're always open to anything that can improve our systems."

Another co-author of the paper, Tadayoshi Kohno, said it was unlikely that the company had plugged all of the holes they discovered.

The move to electronic voting, which intensified after the troubled Florida presidential balloting in 2000, has been a source of controversy among security researchers. They argue that the companies should open their software to public review to be sure it operates properly.

Mr. Richardson of Diebold said the company's voting-machine source code, the basis of its computer program, had been certified by an independent testing group. Outsiders might want more access, he said, but "we don't feel it's necessary to turn it over to everyone who asks to see it, because it is proprietary."

Diebold is one of the most successful companies in this field. Georgia and Maryland are among its clients, as are many counties around the country. The Maryland contract, announced this month, is worth $56 million.

Diebold, based in North Canton, Ohio, is best known as a maker of automated teller machines. The company acquired Global Election Systems last year and renamed it Diebold Election Systems. Last year the election unit contributed more than $110 million in sales to the company's $2 billion in revenue.

As an industry leader, Diebold has been the focus of much of the controversy over high-tech voting. Some people, in comments widely circulated on the Internet, contend that the company's software has been designed to allow voter fraud. Mr. Rubin called such assertions "ludicrous" and said the software's flaws showed the hallmarks of poor design, not subterfuge.

The list of flaws in the Diebold software is long, according to the paper, which is online at avirubin.com/vote.pdf. Among other things, the researchers said, ballots could be altered by anyone with access to a machine, so that a voter might think he is casting a ballot for one candidate while the vote is recorded for an opponent.

The kind of scrutiny that the researchers applied to the Diebold software would turn up flaws in all but the most rigorously produced software, Mr. Stubblefield said. But the standards must be as high as the stakes, he said.

"This isn't the code for a vending machine," he said. "This is the code that protects our democracy."

Still, things that seem troubling in coding may not be as big a problem in the real world, Mr. Richardson said. For example, counties restrict access to the voting machines before and after elections, he said. While the researchers "are all experts at writing code, they may not have a full understanding of how elections are run," he said.

But Douglas W. Jones, an associate professor of computer science at the University of Iowa, said he was shocked to discover flaws cited in Mr. Rubin's paper that he had mentioned to the system's developers about five years ago as a state elections official.

"To find that such flaws have not been corrected in half a decade is awful," Professor Jones said.

Peter G. Neumann, an expert in computer security at SRI International, said the Diebold code was "just the tip of the iceberg" of problems with electronic voting systems.

"This is an iceberg that needs to be hacked at a good bit," Mr. Neumann said, "so this is a step forward."

Here's a pertinent piece I wrote in December 2002.

Ballot Transparency to Eliminate Fraudulent Counts

Voters have read and seen all sorts of assurances that the new touch-screen balloting systems are fool proof, tamper proof, and nothing to worry about. Many, including those who are familiar with the technology, are not at all reassured.

The concerns are on two levels. First, from the perspective of those not familiar with the technology, it is a device whose inner workings and inherent security they cannot possibly understand. If they can't understand it, how can they be assured that it is honest? Second, those who DO understand signal processing, software, and communications technology know that is far too easy to defraud the system in a way that would be irreversible and undetected. Either way, touch-screens are a loser.

Now, as users of ATMs, cell phones, the Internet, and other electronic media, it might at first seem a little strange that so many people have such concerns. Upon further consideration however, the key distinctions between voting and a service handling mere money become obvious:

Customers have a choice of banking vendors. Citizens don’t have a choice of governments.
There is a major difference between mere financial assets at risk, and a risk to individual liberty.

Governments are monopolies. One can go down the street to another bank and take the offending bank to court. An evil government can land you in prison (or worse) because they ARE the court. The stakes associated with voter fraud are far higher than with an ATM and so is the temptation to defraud the system.

Necessary and Sufficient

So, given that we are still smarting over hanging chads, what are the alternatives? Let’s begin to answer that question by looking at the requirements.

The system has to be simple and familiar to the voter.
There must be NO SOFTWARE involved, because it is too easy to change.
The system must be capable of completely manual operation.
The count must be capable of being validated by all parties involved and each count must be separate and distinct.
There must be no possibility to count a ballot twice or "lose" counts along the way.

Electronic sensors and interlocks are permissible as long as they can be duplicated manually.

Here is my proposal for a system that meets these requirements:

At the Polling Place

Ballot boxes are preprinted, serialized and tracked by a physical chain-of-custody document.
The box must be destroyed to be opened.
The box is locked under a ballot receiving machine.
The ballot receiving machine at the polling place reads the box number and records it on the ballot in Scantron form on the back side (fill in the dots). Note that one could do the same manually under observation.
The voter completes the standard optical ballot and delivers it to the receiving machine.
The machine prints the box number on the back of every ballot it accepts with a Scantron dot pattern. This too can be both read and performed manually. Then a dry film coating (basically an adhesive or heat activated tape) is applied to the ballot on the way into the sealed ballot box.
The coating is transparent but reveals a "watermark" when exposed to UV light. The ballot is now tamperproof.
The receiving machine totals the number of ballots in every box. The total is read manually and a receipt is delivered to each political party and candidate detailing the box numbers, precincts, and tally of ballots in every uniquely identified box.
Representatives of all Parties check the box tallies before the boxes leave the polling place.
If they agree on its accuracy, they record the ballot tally on the box using Scantron dots, initial it, and put a similar dry film over the number.

Note that the Scantron pattern is the perfect bridge between human and machine. It is readable by people for manual counting but does not require an optical character reading machine that needs cameras or software.

Both parties thus know the EXACT number of ballots cast in every precinct and in every box. Every box is signed. All parties can thus run check sums at the processing centers and verify the chain-of-custody.

At the Ballot Counting Center

The total of the ballots on the box is read by the counting machine. It would be very similar to the existing optical reader and might only require very minor modifications.
The counting machine reads the box code for precinct and ballot count or accepts that data input from a keypad read off the box by at least two witnesses with keys. The machine will not count the ballots without the UV visible watermark on the ballot over the votes AND matching precinct codes on the box and the ballot.
The machine halts and will not display the vote totals if the number of ballots recorded on the box and the number it counts do not match.
The ballots leave the counting machine get a NEW ballot box. Counted ballots are stamped again with output box number, recoated, and then deposited into the new sealed ballot box.
The new coating was applied in case of a recount, thus each ballot thus maintains a recount history.

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.