Diebold/Premier Actually Admits Its Machines Are Faulty! And That It Lied About Antivirus Software...

from the wonders-never-cease dept

Consider me to be in a state of shock. For nearly half a decade Diebold has always responded in the identical way to every single report of a problem or security vulnerability with its e-voting machines: attacking those who pointed out the problem and claiming it really wasn't a problem at all. This has happened time and time again that I'm not even sure how to react when the company (renamed Premier to get away from the Diebold name stigma) has finally admitted that its machines have a flaw that drops votes. Oops. It's warning 34 states that use the machines of the problem which was highlighted in the lawsuit Ohio filed against Premiere/Diebold. Not only that, but it's admitting the flaw in the software has been in the software for the past decade.

So, uh, why was the company blaming anti-virus software just a couple months ago?

It should also make us question Premier/Diebold's longstanding claim that independent outsiders should not be allowed to inspect its machines for problems. Of course, Diebold execs are already downplaying all of this, claiming that they were "confident" that this hadn't actually impacted any elections, though they offer no proof of that. The company's president admits he's "distressed" that they were wrong in their previous analysis, but he fails to explain why the company is so against letting outsides inspect the machines to avoid such flaws. In the meantime, the company insists that the problem will be patched in time for the November election, and I'm sure we're all confident that there won't be any other problems with their machines, right?

Filed Under: e-voting, security, vulnerabilities
Companies: diebold, premier voting

Premiere/Diebold: You're Doing It Wrong

from the a-little-Friday-humor dept

Earlier this week, we wrote about Ohio's lawsuit against Premiere Elections Systems -- better known by its previous name, Diebold -- where we noted Premiere's claim that the problems were the fault of antivirus software. That didn't make much sense, as we noted, but Randall Munroe has explained just how ridiculous this is (in a way that only he can) with his latest xkcd comic:

Filed Under: e-voting, ohio
Companies: diebold, premiere voting

Ohio Sues Diebold/Premiere Over Lost E-Voting Votes

from the instead-of-a-fine,-the-lost-votes-would-be-great dept

You may recall late last year that an investigation in Ohio turned up that all e-voting machines used in the state during the 2004 election had malfunctioning problems. Earlier this year, officials declared machines from that election a crime scene to be investigated, and now Ohio has filed a lawsuit against Premiere Election Solutions, the company better known as Diebold (it changed its name after tons of bad press).

Premiere/Diebold, of course, were at the heart of early stories about e-voting machine flaws, and the company consistently fought against anyone who suggested there was anything wrong with its machines, despite overwhelming evidence. Instead, it tried to bully those who spoke out against the company, or paint them as extremist kooks. Yet, with each passing story, it appears that the concerns were very, very real. As per usual, Premiere/Diebold is doing little to actually address the issues in this particular lawsuit, claiming:

"We certainly feel strongly that we, in fact, have fulfilled the contract with the state of Ohio. It's a high-quality voting system that continues to operate in many, many Ohio counties with great success."

I'm not sure if the "contract" allowed for completely dropping votes, but assuming it did, that's hardly something to brag about. Also, pointing out that other states use the same machines isn't a defense -- it should be an alarm for those other states to start investigating as well. Other than that, Premiere/Diebold has relied on its usual defense: "It wasn't our fault!" Instead, the company claims that antivirus software interfered with the voting tabulation system. That's a pretty weak excuse -- especially since (as Ohio points out) the system was certified with antivirus software installed. Besides, what kind of software is Premiere/Diebold building if antivirus software causes it to lose votes? Not the type of software I'd want running my elections.

Filed Under: e-voting, ohio
Companies: diebold, premiere voting

How Come There Aren't More Technologists On The Board Setting Voting Tech Standards?

from the questions,-questions,-questions dept

Ed Felten raises a rather important question concerning the lack of knowledgeable computer scientists or other voting technology experts on the Election Assistance Commission (EAC) Board of Advisors. As Felten notes, the EAC is in charge of setting voting technology standards, and four slots (out of 39) on the board are specifically allocated for "members representing professionals in the field of science and technology." Already, only 4 out of 39 seats seems rather low, considering how important the technology choices are -- but it's even worse when the people filling those slots aren't actually technologists. Yes, Felten points out that three of the four slots are held by folks who are:

accomplished people who have something to offer on the board. But as far as I can tell they are not "professionals in the field of science and technology," so their appropriate positions on the board would be somewhere in the other thirty-five seats.

So, basically, as it stands, the group in charge of setting voting tech standards appears to have only one technologist on board, and that person, Barbara Simons, was only recently appointed.

Filed Under: e-voting, eac, election assistance commission, technologists, voting

Study Shows Greater Voting Errors With E-Voting

from the more-evidence dept

Whenever we point to problems with e-voting systems, there are always some who respond by pointing out (correctly) that there are problems with the old paper ballot system as well, and the e-voting system must be better. Not so far. Jose Luis Campanello writes in to let us know that a study in France found that when compared to traditional paper ballots e-voting systems showed more errors. There were definitely voting discrepancies in both cases, but it was significantly more noticeable with e-voting systems. The study also found that it wasn't just an issue of pollworkers being unfamiliar with the e-voting machines that led to so many problems at e-voting stations. That's because the problems didn't get better as pollworkers became more familiar with the machines -- and there wasn't a correlation between sites where there were more complaints concerning how to use the machines and the discrepancies. Once again, we're left wondering why we've been so quick to rush into e-voting when there's so much evidence that it's neither accurate nor reliable?

Filed Under: e-voting, errors, france

How Could Anyone Possibly Mess With With E-Voting Machines... When They're Left Unguarded For Days?

from the oh,-that's-right,-it's-easy dept

One of the common complaints from the e-voting companies about the various independent security tests that find problems with their machines, is that those test occur under conditions that would never happen in the real world. Specifically, the e-voting companies like to claim that most of the "hacks" revealed would require a lot of access to the machines with no one noticing -- and that just wouldn't be feasible during an election with election officials all around. While even that might be questioned, a much bigger issue is that most polling places leave the e-voting machines totally unguarded and totally unprotected, sometimes for days before the election -- giving anyone with nefarious intent plenty of time to mess around with the machines.

Ed Felten has been pointing this out for years. He took photos of such machines at Princeton in 2006 and then again at the primary election earlier this year. This past Tuesday was another election day in many places, including New Jersey, and Ed Felten, once again, took photos of a whole bunch of totally unguarded e-voting machines that any passerby could have accessed. Of course, given that the software itself doesn't seem to work maybe someone will actually adjust the machines to make them work better. Always look on the bright side.

Filed Under: e-voting, ed felten, princeton, security

ES&S E-Voting Machines Gave Votes To A Totally Different Election

from the i'd-say-that's-a-whoops dept

You may recall last year that when we had a series of posts about the fact that e-voting companies refused to let independent security experts review their machines, we had a representative from e-voting firm ES&S show up in the comments and repeatedly berate us for not knowing what we were talking about. That individual insisted that the machines were perfectly well tested. He also insisted that elections using e-voting machines were "extremely scrutinized and very reliable." Of course, we haven't heard from that individual lately -- not since an independent review of ES&S's machines found that security was seriously lacking leading various states to quickly decertify many ES&S machines. Oops.

Reader Jose Luis Campanello writes in to point out a story we missed from last week, about how some ES&S machines used in a state primary in Arkansas didn't just screw up counting the votes, it assigned votes to a totally different election -- and those "lost" votes changed the result of the election. No one seems to have any idea how this is even possible, let alone how it happened. Somehow, I get the feeling that no representatives from ES&S will show up this time to tell us how their machines are perfectly reliable and don't need any kind of independent review. Luckily, in this case there was a voter-verified paper trail (which some insist are a bad thing), which allowed election officials to backtrack and figure out what had happened and correct the mistake. Without the paper trail, there would have been no way to have even realized this mistake happened.

Filed Under: accountability, arkansas, e-voting, reliability
Companies: es&s

New Jersey Court Says Independent Investigators Can Review E-Voting Machines

from the protect-the-vote dept

Last month, e-voting firm Sequoia threatened both independent researchers and New Jersey election officials if those independent researcher were allowed to inspect Sequoia's e-voting machines. This seemed like a very odd threat for a variety of reasons. Why wouldn't Sequoia want its machines inspected? The very fact that it was threatening legal action seemed like grounds to simply never use Sequoia e-voting machines. Sequoia claimed that existing inspections were enough, despite a history of problems in those inspections. Furthermore, Sequoia's own explanations for the problems with its machines in the primary elections this year were wrong. Ed Felten found that Sequoia's explanations didn't actually explain many of the problems. Unfortunately, though, with the threat of legal action, New Jersey agreed not to have Felten test the machines.

However, a New Jersey state judge has now ruled that it's perfectly reasonable for independent inspectors to review the machines. Unfortunately, she pushed back the date for such inspections until September, meaning that it won't affect this year's presidential election -- which will still use machines that may have problems. So while Sequoia didn't succeed in stopping independent examination of its machines, it did stall the process long enough so that the existing machines will stay in use for this year's elections -- despite the long list of problems that have been discovered with them. Apparently, we're still in beta when it comes to democracy.

Filed Under: e-voting, ed felten, inspections, new jersey
Companies: sequoia

We Can't Afford Even One E-Voting Morris Worm

from the catastrophic-failure dept

Over at CNet, Declan McCullagh has an interview with probably the most prominent computer scientist who supports paperless e-voting, Michael Shamos. In a wide-ranging discussion, Shamos acknowledges that e-voting isn't perfect but insists that every voting system has its flaws, and that e-voting can be made to work better than either paper ballots or touch-screen machines with paper trails (which he points out tend to jam a lot). Mike already pointed out some problems with Shamos's analysis, and you can check out Dan Wallach's post for a comprehensive rebuttal. But I found one of Shamos's comments particularly striking. He says:

Remember Robert Tappan Morris and the Internet worm? I would get worried if we start to see systematic evidence (of increasingly robust) attacks. But we've never seen any of those.

Shamos is referring to probably the most famous malware attack in the history of the Internet. In 1988, a grad student named Robert Morris created a worm that infected hundreds, if not thousands, of computers across the Internet. It was by far the most damaging Internet worm up until that time, and as a proportion of all hosts on the Internet, probably still ranks among the most successful worms in Internet history. The important point for our purposes is that nobody saw the Morris worm coming. The security vulnerabilities exploited by the Morris worm were known ahead of time, but few people other than the worm's author realized their seriousness.

Of course, once the Morris worm brought the Internet grinding to a halt for several days, everyone became acutely aware of the importance of security, and so they quickly fixed the bugs Morris had exploited. And luckily, at this point the Internet was still a relatively small, academic network, so while it cost millions of dollars of work to clean up the mess, no irreparable damage was done. But there wasn't a series of "increasingly robust" attacks leading up to the Morris worm that could have provided fair warning to Internet users of the day. The Morris Worm was a lot more sophisticated and successful than anything that had come before it. And by the same token, there's no reason to think that the bad guys will give us some advance warning by incompetently trying to steal a few city council seats before they disrupt a presidential election. If we continue to vote on insecure e-voting machines, we run the risk that our first clue that something is wrong will be when the voting machines in a key swing state "malfunction," throwing the presidential election into turmoil. I don't think we can afford to take that risk.

Filed Under: e-voting, michael shamos

Are E-Voting Paper Trails A Bad Idea?

from the depends-on-your-point-of-view dept

News.com is running an interview with Carnegie Mellon CS professor Michael Shamos, who is rather opinionated about everyone who keeps pushing for a voter-verified paper trail in e-voting machines. He thinks that a paper trail is a bad idea, but his reasoning is a bit problematic. Most of his complaints are around the fact that paper ballots aren't particularly reliable either (which no one denies). But that, alone, isn't a reason to get rid of a paper trail. After all, the idea is that the paper trail is a backup -- a way to check and verify that the electronic votes are counted correctly.

From there, Shamos complains that various voting laws say that if the e-voting totals and the paper totals don't match up, you have to use the paper totals. To him, that's a problem because (as he pointed out) the paper totals are not particularly reliable. But, again, the problem here isn't actually with the paper trail, but the laws that automatically ditch the e-voting result, rather than specify a way to verify what the real vote total is.

Towards the end, Shamos does make some good points about how the real focus should be on building a system that does end-to-end verification for reliability, so that people can feel confident that their vote was counted correctly. However, he falsely accuses supporters of paper trails of not being interested in this. That's simply inaccurate for the most part. Almost every expert on the subject that you talk to wants a better overall e-voting system that is more secure, accurate and reliable. Having a verified paper trail isn't meant to solve all the problems, but as a temporary solution for an obvious problem with current e-voting machines. Yes, we need a better overall system, and, no, paper isn't perfect -- but Shamos seems to be accusing the paper backup supporters of stuff they're not saying.

Filed Under: e-voting, michael shamos, paper trail