N.C. judge dismisses voting machine case; vendor may pull out

CentreDaily.com ^ | November 29, 2005 | Staff reporter

[Zuben Elgenubi]

Yes, open code

[MineralMan]

"It's easy to hide stuff."

It is, indeed. I had a friend in the shareware business who worked out a deal with a publisher to publish a different version of one of his shareware programs. He was worried, though, that the company would end up stiffing him somehow on royalties.

Naturally, the company insisted that he provide source code for the version they bought, and he complied. They looked it over carefully, too.

Well, he did have a routine in the program that was built of carefully hidden bits of code. The routine watched for an open internet connection, and sent an email message to the programmer, containing just a randomly generated number. Once it did that, it set a variable and never did it again. He hid stuff in copyright info statements, and other places, and nobody ever knew it was there.

So, he had a count of the number of products sold by the publisher. Sure enough...the publisher was stiffing him on royalties for about 50% of the products sold. He sued. He won. Clever lad, that.

[Blood of Tyrants]

"Let the voter take it home with him/her."

Someone pointed out some of the follies of that to me, such as vote buying.

[NonValueAdded]

Understood, but that would not stop the losing RAT politician from having a bunch of people show up with the tickets. Also consider how they can violate the secrecy of the ballot with the driver of the bus of homeless instructing them to return with their tickets showing a straight party vote before the smokes and bottles of MD20/20 will be distributed; or the union boss; or the employer. I understand you meant only good things with your proposal but past threads have itemized fraud schemes revolving around a vote receipt that make it a very bad idea. There is ONE way that an ATM-style receipt could be used, though. The voting machine spits it out, you get to view it to be sure your vote is properly recorded, and you deposit it in a ballot box on the way out of the polling area. Then a chain of custody is maintained and there is paper backup. But why spend the extra money to turn electronic voting back into optical scan?

[Howlin]

Oh, Judge Narley was kind enough to inflict the State of North Carolina with the damn Miss North Carolina (bogus) lawsuit.

RALEIGH, N.C. (AP) — An arbitrator will decide the breach of contract lawsuit filed by Rebekah Revels against the Miss North Carolina organization, a judge has ruled.

Wake County Superior Court Judge Narley Cashwell ordered Monday that an arbitrator would hear Revels’ case against the pageant. He previously had ordered arbitration in her lawsuit against eight people, including five pageant board members.

Revels’ lawyer, Barry Nakell, objected to Cashwell’s order, but said after the hearing that he was satisfied with the judge’s decision. He said he hoped arbitration could begin in late May or early June, allowing a decision before the next Miss North Carolina pageant.

That would be “in time for the new pageant so she could be celebrated as Miss North Carolina 2002 … and then crown the new Miss North Carolina,” Nakell said after the hearing.

Harley Jones, attorney for the state organization, sought the arbitration order after Cashwell denied his request to dismiss Miss North Carolina as a defendant in one of two lawsuits that Nakell has filed in Wake and Robeson counties.

Revels won the crown last June but resigned in July after an ex-boyfriend told state pageant officials he had topless photographs of her. She later said she was forced to step down.

Her successor, Misty Clymer, represented North Carolina in the Miss America pageant, but Revels was invited to represent the United States in the Miss World competition.

After the Miss America pageant, Cashwell ruled that neither woman could claim she was Miss North Carolina until the matter was settled.

Revels’ case against the Miss America Organization is still scheduled to go to trial in Robeson County, Nakell said. Last month, Cashwell denied a motion by the Miss America Organization to send that lawsuit to arbitration.


He's GOT to be a Democrat.

[Cicero]

So far, he sounds like the kind of judge who puts on his thinking cap and says, "Hmmm. How can I cause the most trouble?"

[MineralMan]

You're probably both right. I do like a verifiable second way of counting, however. I mistrust a pure machine count that has no separate verification.

[beef]

I'm for the optical forms. Machine count + hard copy. It's the best of both.

[kindred]

[The dispute centers on the state's requirement that suppliers place in escrow ``all software that is relevant to functionality, setup, configuration, and operation of the voting system,'' as well as a list of programmers responsible for creating the software.
...The company does not have the right to provide Microsoft's code, he said, adding it would be impossible to provide the names of every programmer who worked on Windows.
The State Board of Elections has told potential suppliers to provide code for all available software and explain why some is unavailable.]

Could it be possible that providing this code information to members of biased state board of elections could lead to the elections being manipulated by less than ethical board members?

[Sonny M]

Yep. An easier solution is to have a hard printout that is viewable after the voter is finished for postive verification.

How would you find a way that would make sure to protect the privacy of someones vote?

Its almost a guarantee that liberal organizations would use underhanded tactics to verify its members and others voted the way they wanted them to vote.

I can't tell you how many teachers I know in NYC, who voted for Bush but would never ever admit it in public or to the people they work with.

[Zuben Elgenubi]

"Could it be possible that providing this code information to members of biased state board of elections could lead to the elections being manipulated by less than ethical board members?"

That's a core issue, regionally.

[Zuben Elgenubi]

I've tried to get an affiliation but cannot find the source. Narley ran unopposed in the last election cycle and the news reports did not give an affiliation. But I agree with Howlin', he's got to be a Democrat.

[Cicero]

They tend to cover party affiliation up. Often the only way you can tell is to find the results of the last judicial election. Thanks for trying.

[Blood of Tyrants]

The printout would be behind a view window of the kind difficult to photograph through. The window would have a shutter that would only open after the votes have been registered and stay open until voter verified them. The hard copy would then fall into a sealed hopper so that they would naturally randomize. You could even make the hopper similar to a clothes dryer that would turn 1/4 turn after the ballot is dropped in.

[jerry639]

We use the same voting system. Ever since we started using it Republican candidates have started getting a fair count.
No more manipulation of the mechanical voting machines by the Democrats, who are in charge.

[Just A Nobody]

Any interest (?) ping

[Calpernia]

More Calls to Vet Voting Machines
By Louise Witt

Story location: http://www.wired.com/news/politics/0,1283,59874,00.html

02:00 AM Aug. 04, 2003 PT

A recent report that showed touch-screen voting machines could be vulnerable to hackers spurred the National Association of Secretaries of State, a majority of whose members are in charge of their states' elections, to consider whether the standards for the machines should be beefed up to prevent tampering.

Voting machine standards weren't on the agenda at the association's annual meeting, held in late July in Portland, Maine. But after the study (PDF) by Johns Hopkins University researchers was publicly released, the group discussed asking the National Institute of Standards and Technology, or NIST, the government's standards-setting organization, to prepare a white paper on security standards for the new generation of computerized voting machines.

No decision was made, said Kay Albowicz, a representative for the Washington, D.C., group. NIST, a nonregulatory agency based in Gaithersburg, Maryland, works with industry to develop and apply technology, measurements and standards.

Computer scientists have raised concerns about the security of computerized voting machines for the past few years, but they haven't been able to gather much support from election officials, who remain confident that the systems are basically secure from tampering and breakdowns. The Johns Hopkins study is the first piece of evidence that current touch-screen technology could be seriously flawed.

While stressing that more studies will have to be conducted to find out just how vulnerable these are, "there is a sense that in the past (critics of computerized machines) were part of the black box crowd and conspiracy theorists," Albowicz said. "No one is saying that now."

Aviel Rubin, technical director of the Johns Hopkins Information Security Institute, led a team of three computer scientists to examine source code for touch-screen voting machines made by Diebold. More than 40,000 Diebold voting machines are in use in 37 states. Most use touch-screen technology, while the rest use optical-scanning equipment, said Mike Jacobsen, a company spokesman.

The code was downloaded earlier this year from a company FTP site. The site isn't public, but it's also not secure. Diebold's field representatives used the site to fix the company's voting machines. Diebold has since pulled the source code off the Internet. The company's employees now carry discs.

Within a half-hour of examining the code, Rubin's team found its first red flag. The password was embedded in the source code. "You learn (not to do) that in security 101," said Tadayoshi Kohno, one of the report's co-authors. "The designers didn't follow standard engineering processes."

Other "stunning flaws" Rubin said the team found in Diebold's source code included voter smart cards that could be manipulated to cast more than one vote, software that could be reconfigured by malicious company workers or election officials to alter voters' ballot choices without their knowledge and machines that could be electronically broken into through remote access.

"The people who wrote this code didn't have very good security training," Rubin said. "They didn't use encryption."

Diebold spokesmen said the code Rubin downloaded and examined was more than a year old. The code he obtained was "less than 5 percent" of the whole application, they said. In addition, the application Rubin examined "on the whole is not the same" as applications in machines used in elections in places like Georgia and Maryland, said John Kristoff, Diebold's director of communication and investor relations.

Diebold cannot determine whether the lines of code that raised concern for Rubin were used in machines in the field, Kristoff said.

When asked if the source code contained the passwords to the system, Diebold's Jacobsen said, "I can't say. The flaws that the researchers found were found in a very controlled, clinical environment and weren't subject to the stringent auditing and security processes, including the logic and accuracy testing." Jacobsen said he believed Wylie Laboratories tested Diebold's software.

Kristoff also pointed out that Rubin examined code on a networked personal computer running Windows 2000. In the field, no one could connect a voting machine to a network, or attach a keyboard, monitor or mouse to make its innards as accessible as a PC's. Kristoff said the machines run on Windows CE, a specialized, non-consumer version of the Windows operating system.

David Dill, a professor of computer science at Stanford University and a member of the California Secretary of State's Ad Hoc Touch Screen Task Force, said Rubin's report confirms what he and other computer scientists have believed for years: Electronic machines are vulnerable and there needs to be a backup system to verify voters' ballots.

The ad hoc task force recommended a voter-verifiable audit trail. One solution could be a machine that generates paper receipts behind a glass barrier showing voters that their votes have been properly cast. The receipts later could be used for recounts.

"I think it's been obvious that (these machines) can be hacked and Aviel shows that they can be hacked," Dill said. "They've blown up all the arguments that the present machines are OK and the process will solve all these problems."

Mary Kiffmeyer, Minnesota's Secretary of State and the new National Association of Secretaries of State president, said there shouldn't be a "rush to judgment" to condemn the current technology used in touch-screen voting machines.

She pointed out that Georgia used new touch-screen machines in its 2002 elections without incident. But she said the association will push for the federal government to release additional funding from the Help America Vote Act, or HAVA, to study what standards should be in place.

"Standards are being revised as new equipment comes along," she said. "We need to speed up the process and focus on (the standards) as we are rapidly making decisions about our equipment."

Congress passed HAVA in 2002 in response to the November 2000 presidential election debacle, with its hanging chads, butterfly ballots and messy voter-registration records and administration.

Congress authorized $3.9 billion for HAVA to replace outdated punch-card and lever voting machines, to improve voter education, to provide better ballot booth access for the disabled and to modernize statewide voter-registration databases.

Congress also appropriated $1.5 billion for HAVA in the fiscal year ending in September. Of that, the federal government gave states $649.5 million to buy new voting machines and to improve their electoral administration. Another $830 million is waiting to be dispersed as soon as an election commission is established. Congress appropriated only $500 million for fiscal 2004.

Penelope Bonsall, director of the Federal Election Commission's Office of Election Administration, said the president has named the commission's four members, but they have not been officially nominated. Congress is now in recess and won't be able to approve the commission until it returns in September.

The 2006 deadline for states to comply with HAVA looms. Even though new standards may be needed for computerized machines, states and local governments are rushing to buy equipment.

At the end of 2002, 19.6 percent of votes nationwide were recorded on touch-screen equipment, up from 3.9 percent in 1992, according to the Federal Election Commission. Another 31.6 percent were recorded using optical-scanning equipment. Georgia had all new machines in place for its elections in 2002. Maryland just placed a $55 million order with Diebold for 11,000 machines -- the state will have all new machines. Maryland first bought Diebold machines in November 2002.

Some computer scientists say HAVA's deadline should be extended to give the government more time to establish better standards for new computerized voting machines. Rebecca Mercuri, a research fellow at Harvard University's John F. Kennedy School of Government and president of Notable Software, a consulting firm in Lawrenceville, New Jersey, says that in the absence of new standards, the Institute of Electrical and Electronics Engineers, of which she is a member, has formed a committee to create standards for the machines. One of the committee's concerns is a voter-verified audit trail.

Rep. Rush Holt (D-N.J.) introduced a bill, H.R. 2239, in May to amend HAVA to require computerized voting machines to provide voter-verified audit trails. So far, his bill has 26 sponsors and it's unlikely to get out of the Committee on House Administration.

"As the computer scientists at Johns Hopkins recently reported, these new machines are vulnerable to massive fraud," Holt said in a statement. "Unless Congress acts to pass legislation that would make sure that all computer voting machines have a paper record that voters can verify when they cast their ballots, voters and election officials will have no way of knowing whether the computers are counting votes properly."

[Calpernia]

>>>>Diebold machines were blamed for voting disruptions in a California primary election last year. California has refused to certify some machines because of their malfunction rate.


Since Rep. Holt (D-NJ) introduced a audit trail bill, is that why Codey made mail ins easier this election?

[Calpernia]

Thanks for the ping. See my 37.

[Just A Nobody]

Voting should not be this complicated.

We need a sheet of paper with the photos of the candidates, for those that can not read, and a black permanent magic marker. Draw a line through the face, dip your finger in permanent purple (or some bright color) and go on with your day.

No repeat voting, nothing to guess at. Voila - problem solved and money saved.