Serious security flaws found in Diebold electronic voting machines

“Diebold Election Systems plans to make changes to its electronic voting machines, following the disclosure of a number of serious security flaws in the systems. On Thursday, the voting watchdog organisation Black Box Voting published a report detailing how Diebold’s TS6 and TSx touch-pad voting machines could be compromised by taking advantage of “backdoor” features designed to allow new software to be installed on the systems. Finnish security researcher Harri Hursti, discovered backdoors in the boot loader software, in the OS, and in the Ballot Station software that it runs to tabulate votes,” Robert McMillan reports for Macworld UK.

“Diebold plans to address the issue in an upcoming version of the product, which will use cryptographic keys to ensure that only authorised software is installed on the machine, Bear said. He could not say when this feature would be added, but said that it could be available in time for the November 7 general election in the US,” McMillan reports. “These latest set of flaws are the most serious voting machine flaws yet reported, according to Ed Felten, a professor of computer science at Princeton University, and Avi Rubin, a Professor of Computer Science at Johns Hopkins University. ‘The attacks described in Hursti’s report would allow anyone who had physical access to a voting machine for a few minutes to install malicious software code on that machine, using simple, widely available tools,’ they wrote Thursday on the Freedom to Tinker blog. ‘The malicious code, once installed, would control all of the functions of the voting machine, including the counting of votes.’ Diebold’s machines are based on custom hardware that runs Microsoft’s Windows CE operating system.”

Full article here.

MacDailyNews Take: WinCE? Who’s the genius who made that decision? Sheesh. And you thought that the ease with which the deceased can vote in Chicago is odd? Just imagine…

Advertisements:
Get the new iMac with Intel Core Duo for as low as $31 A MONTH with Free shipping!
Get the MacBook Pro with Intel Core Duo for as low as $47 A MONTH with Free Shipping!
Apple’s new Mac mini. Intel Core, up to 4 times faster. Starting at just $599. Free shipping.
Apple’s brand new iPod Hi-Fi speaker system. Home stereo. Reinvented. Available now for $349 with free shipping.
iPod. 15,000 songs. 25,000 photos. 150 hours of video. The new iPod. 30GB and 60GB models start at just $299. Free shipping.
Connect iPod to your television set with the iPod AV Cable. Just $19.
iPod Radio Remote. Listen to FM radio on your iPod and control everything with a convenient wired remote. Just $49.

51 Comments

  1. Jon, are you ignoring the recount which showed Bush did really win?

    Probably, because even though the recount was paid for by the New York Times and several other newspapers, when they got the result they weren’t hoping for, they conveniently didn’t publicize it.

    Conspiracy dorks. Sheesh.

  2. Oh no. Fixing these security flaws in their voting machines mean that Edwin Edwards will not be Governer of Lousiana again! Maybe the won’t fix them all ” width=”19″ height=”19″ alt=”grin” style=”border:0;” />

    MW State How appropriate

  3. The single biggest problem with Diebold machines is the lack of a paper trail. A journal tape such as that used on a cash register would allow both the voter and those performing recounts to determine whether a machine had been hacked.

    R- No Diebold machines were used in Florida in 2000.

  4. R,
    Which recount was that? The only one I’m aware of was in Florida, and they generally don’t use the Diebold machines in that state.
    In Ohio, they used Diebold machines.
    In Ohio, the results varied significantly from exit polls.
    In Ohio, one precinct showed more votes for Bush than they had voters!
    In Ohio, there was no “recount”, they just re-tabulated the machine votes.
    WHY was there no recount? Because the machines kept no paper trail. It seems that these machines, a variant on your basic automated bank teller kiosk, couldn’t be fitted with a printer … for some reason.

    You wouldn’t be part of the 29% who still believe in Dubya, are you? Three in ten and in free-fall.

  5. Jon and R, you should know better than to use MDN pages to open a political debate. It’s not a good venue for this kind of thing and it tend to lead to a very low signal-to-noise ratio in the comments.

    That said, I also want to point out to R that you might want to get rid of the snide tone when discussing topics that you’re not very well-informed about. If you want to talk about recounts and the disputed Florida 2000 results you probably need to show up at the table knowing a little bit more about the topic and not just repeating an inaccurate and misleading line you got from some reassuring source. Alternatively, if you’re content to trust your vague sense of what happened, no matter which side of the issue you’re arguing, you should dispense with the snide tone.

  6. With a Win CE OS on those voting machines it wouldn’t surprise me if the next President of the United States was a Russian National named Boris who made his millions selling internet spam services run by zombie computers.

  7. Geez, will you libbies ever give it up? That was 6 years ago and you lost (after multiple recounts no less), so get over it already. Nixon got screwed out of the election in 1960 (thanks to the dead in Chicago) and you don’t hear people still bitching about that one…

  8. Actually, the 2000 recount study results were not that simple. You’re right that the analysis found that if the entire state had been recounted, Bush still would have won the electoral votes that put him ahead (by 493 votes out of 6 million). But other scenarios had Gore winning. And a secondary analysis suggested that more people intended to vote for Gore than Bush but failed to due to “poor ballot design, voter error and malfunctioning machines.” In any event, the recount study was not an official recount and was “not definitive in its findings.” And Gore did win the popular vote by more than half a million votes, not that that’s worth anything to him, or the country, at this point.

  9. DLMeyer,

    Good points. And you left one out. The CEO of Deibold said that he would do whatever it took to get Bush re-elected.

    Never vote for someone who has never been on a job interview. Our current President failed numerous times in the business world. Finally, he realized he wasn’t successful at running companies, so he invested in a baseball team. Then he decided to use his name to run for Governor of Texas.

    Regardless of your political leanings, this man should have never been elected President, let alone Governor of Texas. He doesn’t have the qualifications and its now showing.

    Who am I? A liberal libertarian. I fear the government. But I fear corporate run governments even more.

  10. >Probably, because even though the recount was paid for by the New York >Times and several other newspapers, when they got the result they >weren’t hoping for, they conveniently didn’t publicize it.

    Actually, the papers ran very long, detailed stories explaining how they performed the recount, who was involved, the different ways they counted ballots, and what the results were.

    I guess you mean they didn’t publicize it the way you wanted, as “Bush really did win.”

    What the recount study actually showed was that Bush won or Gore won depending on how you did the recount.

    The study also showed that Gore would have won if different kinds of overvotes and mistaken votes had been counted–the Palm Beach ballot, the Jacksonville ballot instructions that told people to vote for a candidate on each mistakenly where the presidential candidates covered multiple pages–but that by their nature those are illegal ballots and there isn’t a legal or practical way they would have ever been counted because there is no way to tell how they intended to vote on an individual-ballot basis. (In other words, you know thousands of Pat votes should have been Al votes, but you don’t know that any specific ballot was supposed to be for Gore.)

    The study also showed that if a recount had just been done of the machine-read paper ballots–the ones where people marked on a paper ballot in black their votes–Gore would have won because there were several hundred more Gore ballots than Bush ballots which had been invalidated because the voter pen marked the candidate they wanted and then also wrote the candidate’s name in the write-in blank. (These are only significant because they are ballots where it is obvious from the face of the ballot who the vote was intended for.)

    What I always found interesting was the shiner that exit polls took in 2000 even though the one thing the study did prove (and which it never mentioned, of course) was that the exit polls more accurately guaged voter preference than the actual ballots did! ” width=”19″ height=”19″ alt=”smile” style=”border:0;” />

    I’m sure this post shows too much detail, actual information, and even-handedness for it ever to be noticed on MDN.

  11. We should use physical voting machines. You can make them electrical without using software to count votes. They would cost >$100 each and be easily verifiable.

    take the software out of it. Windows CE?! Why support and entire operating system for a limited multi-choice questionnaire?

  12. Thanks fred. Second the motion.
    And Reality Check, R brought the subject up, and clearly not as a liberal. As for Nixon, Chicago’s dead Democratic voters were at least balanced by phantom Republicans in southern Illinois.

    Let’s bash Microsoft now. Much more fun.

  13. So we make it easy for the dead to vote and impossible for the living if they are black and residents of swing states. God, what a country! H. L. Mencken was right: America is the greatest show on earth. Get your peanuts, hot dogs, and popcorn and be all set to enjoy the 2006 follies er, elections, folks. When that debacle is over you can tune into the movie sequel, Death of Democracy.

  14. Why use voting machines? In most democratic countries voters use a pen or a pencil to place a cross or tick (depending on voting laws).

    In Australia the aforementioned system is used. The votes are then counted by hand by electoral officials under the auspices of the Electoral Commission and overseen by party scrutineers. If there are any problems then the various political parties have the right to appeal to the Court of Disputed Returns. End of story. There are no hanging chats or software problems, it just works.

    Postscript to Reality Check: Perhaps the reason people aren’t complaining about the 1960 Presidential election is that most of the people who voted in that election are dead…it was almost half a century ago. In forty years or so most people won’t give a rat’s arse about the 2000 U.S. Presidential election.

  15. Counting votes with software running on re-programmable hardware is recipie for disaster.

    In addition to producing a paper trail, voting machines need to be designed to run the ballot/tallying code from solid-state hardware (think NES cartridge) which is much more difficult to tamper with and easier to physically secure

  16. It’s regrettable that the flaws of a voting machine have become a partisan issue. If we looked at it from an engineering standpoint, there would be no reason not to build voting machines that are flawless – it’s not rocket science or a cure for cancer. It’s just a voting machine.

    I personally believe that these Diebold machines were comprised by people trying to subvert the democratic process in favor of a particular candidate. Who those people are and what party they belong is not important. These machines should be designed so that it is IMPOSSIBLE to hack the results. That means there has to be a way to verify the results. And they can start by not using Windows CE or any other flavor.

    And get rid of the Electoral College while we’re at it. Every vote should count equally, whether you live in Florida or not.

  17. “Jon, are you ignoring the recount which showed Bush did really win?”

    In a voting process with no paper trail, how do you perform a recount? Ah, yes, check the computer again. The same computer which has been rumored to have been tampered with.

    Not affirming the previous post, this is just quite the weak rebuttal.

  18. “I personally believe that these Diebold machines were comprised by people trying to subvert the democratic process in favor of a particular candidate.”

    Well, that IS one of the steps towards a fascist dictatorship, maintain the “appearance” of a democratic process.

    Although if you get rid of the electorial college, you’d also have to dismantle the current government and replace it with one where individuals have less power, maybe like the “Parliaments” that we always set up other countries with. ” width=”19″ height=”19″ alt=”smile” style=”border:0;” />

  19. The integrity of our democracy, the question of if the votes of citizens actually count, should be of extreme concern to everyone, regardless of their party affiliation (if any).

    Google “India Voting Machine”… maybe low-tech might be the way to go.

    One of the links is below, an article from Slate in 2004:

    http://www.slate.com/id/2107388/

    – – – e – x – c – e – r – p – t – – –
    ” a machine that looks like a cross between a computer keyboard and a Casio music synthesizer…In fact, it’s not much of a computer at all, more like a souped-up adding machine. …Also, the software is embedded—or hard-wired—onto a microprocessor that cannot be reprogrammed. If someone tries to pry open the machine, it automatically shuts down.”
    – – – – – – – – – – – – – – – – – –

  20. If the system is going to be electronic in nature let’s make it unencumbered by any corporation as much as possible.

    Linux or a Unix OS.

    A “Paper” reciept that would tabulate and print each vote as it came in.

    Forget about the past elections no matter what your leanings and views are, they are a red herring here. It’s an old political trick to get off topic to switch any debate to another subject of call into question the individuals involved and avoid the real issue.

    If the press had any balls anymore these sort of things would actually not be an issue. Now large corporations own the news and color it as it suits their interests.

  21. Although if you get rid of the electorial college, you’d also have to dismantle the current government and replace it with one where individuals have less power, maybe like the “Parliaments” that we always set up other countries with.

    ummm why? How does electing the President via popular vote instead of the electoral vote mean we have to trade in congress for a parlaiment? Am I the only one who fails to make that enormous leap in logic.

  22. Um – can ANYONE tell me how all this political crap (on BOTH sides) relates to Apple computers/ipods or computers in general??? I think that MDN was riding the line posting this story anyway, but so what, its their site and its fun to laugh at Microsoft once in awhile anyway, but to everyone who this this is the appropriate venue for a political discussion

    ITS NOT!

    Have a nice day ” width=”19″ height=”19″ alt=”smile” style=”border:0;” />

  23. W, if history is honest, will be seen as the person accelerating the end of an empire. Mark my words, during or before 2008, another inside job will go down, canceling the elections, and we’ll have George the Dictator, just like he prefers.

  24. Wow. Everyone’s still going on about this are they?

    MDN is getting like EastEnders. The same plotlines being repeated again and again and again.

    An still we all fall for it ” width=”19″ height=”19″ alt=”wink” style=”border:0;” />

  25. “How does electing the President via popular vote instead of the electoral vote mean we have to trade in congress for a parlaiment?”

    Don’t think it terms of what you want, think in terms of what is likely to happen. Getting rid of the electoral college is just as likely as having a parliament. ” width=”19″ height=”19″ alt=”smile” style=”border:0;” />

  26. Electronic Voting Systems – a “solution” to a problem which doesn’t exist. And as we have seen, the potential for “errors” and fraud is that much greater.

    What the hell is wrong with a piece of paper and a pencil?

    Takes too long to count for the “business community”?

    Tough shit! Democracy has always been “inconvenient” for business, get used to it already.

  27. What the hell is wrong with a piece of paper and a pencil?

    Amen!

    Whoever entrusted our freedom to Windows CE needs to be taken down.

    2008 is going to be the ugliest election ever. It’ll make 2000 look easy.
    Lets take the electronic factor out right now so there’s ZERO question on that front.
    Paper ballots may be ancient & slow to count. But at least they’re permanent and proven.

  28. The Electoral College was designed to keep concentrated groups from forcing election results on the rest of the country. People in fly-over country don’t want LA, Dallas, Atlanta and NYC deciding the election for them.

    The problem in 200 wasn’t the Electoral College, it was about ChoicePoint and others stealing the election by throwing legitimate voters off of the registration rolls in order to determine the outcome in advance. BTW- ChoicePoint is now selling your personal Data to the Feds to cross-match with the TelCo provided phone data. This is data that the Feds are not legally allowed to collect, so they just buy it.

    Big brother is here and he works for the government under contract.

    http://en.wikipedia.org/wiki/ChoicePoint

    http://www.buzzflash.com/contributors/06/05/con06189.html

    http://www.tsa.gov/public/display?theme=81&content=090005198002d4e5

  29. God! These political debates are tedious here. The level of discourse is tragic. I’d rather not see this moronic crap go here at all (it is so depressing to see the rude and idiotic online behavior of fellow Mac users). If, however, you feel compelled to make a political point, at least provide links to some reference material that can support it. I would hope that most of us are always up to increasing our understanding of issues, but juvinile name calling and spreading of unsupported arguments is no way to debate or persuade.

  30. but juvinile name calling and spreading of unsupported arguments is no way to debate or persuade.

    Call me a Luddite, but the Diebold flaws that brought about this discussion are, IMO, a strong argument that our digital technology isn’t yet up to the challenges of tabulating a presidential election.

    The 2008 election will be particularly heated, and any use of electronics will bring charges of ballot rigging and security breaches (founded or not).

    We need to go back to pen-and-paper ballots until something better can prove itself.

  31. >at all (it is so depressing to see the rude and idiotic online behavior of >fellow Mac users)

    Strange thing is I’ve done craigslist and swap list deals with a lot of mac users in my area and the people I’ve dealt with have been some of the nicest people I’ve ever met. Same with the folks in line at Apple Store openings (damn…missed the Ardmore opening this weekend waiting for an electrician who forgot about the appointment…)

    I have no idea where the assholes that post here come from–they’re certainly not like any of the mac folks I’ve met in person.

  32. The real point is that Diebold machines need to be fixed. No-one has any proof, or even tangible evidence that these voting machines were compromised by any political party.

    With the butterfly paper ballots, the more you count them, the more chads come free and thus, the more votes are invalidated. It’s the same with any paper thing, really. The more you handle it, the more degraded it becomes. Now this especially becomes a problem when dishonesty is so widespread that it begins to affect the national elections. This has been a problem, really, since the late 1960’s. The problem is fundamentally moral, people.

    In Florida, the butterfly ballot was used for years and years. It was only recently that it became suddenly difficult to use. Why? And why did the senior citizens in the 2000 election proclaim that they voted wrongly *after voting* when they had every opportunity to ask for help or ask for a new ballot? Why? Gore had his lawyers on the ground in Florida before voting was done. Why? The networks called the race in Florida early before the west half of the state had a chance to finish voting. What effect did that have? Why was it done? Wherever there were voting irregularities in the 2000 elections in Florida, the Democrats controlled the voting admin boards for that county. Why?

    The answers are plain.

    MDN word: moral.

  33. I am surprised no one has pointed out that DLMeyer is wrong about Ohio: “In Ohio, they used Diebold machines.” I live in Hamilton county (CIncinnati) where we used punch cards. While I voted for the other guy, Bush probably had more votes here than any part of Ohio using Diebold machines. I believe the count in this area was accurate. Punched cards here now have been replaced by paper ballots which are read by an optical scanner in the polling place, in the recent May 06 primary. The voter places the ballot in the scanner. The scanner has a display which tells the voter that the ballot is readable only, not displaying the vote. In the even of a recount the paper ballots themselves may be counted. By the way, the infamous CEO is out.

    mmm MW = ‘not’ as in DLMeyer not always right.

  34. This ought to be the last word in this thread.

    From your link:

    With 99% of Fox viewers believing that the election was “legitimate,” only the constant propaganda of Rupert Murdoch’s disinformation campaign stands in the way of a majority of Americans coming to grips with the reality of two consecutive stolen elections.

    The article goes downhill from there.

    Perhaps the viewers’ beliefs have to do with DEMOGRAPHICS? Perhaps Fox News viewers, who CHOOSE what they watch BTW, might be more supportive of Bush than, say, National Public Radio listeners or Oprah viewers?

    What could have been a good article was peppered with kook jabs. I’m surprised they didn’t try to blame the world’s problems on a “mass right-wing conspiracy”, Elvis, and Roswell aliens. Righteous Right, meet the Lunatic Left.

    If you think your article is the “last word”, I can only conclude:
    1. That electronic voting HAS to go, and
    2. That it’s a good thing Bush won.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.