New voting machines have major security flaws

[SUBMAN1]

Nice - Election rigging is in our future! Of course, this will be to everyones benefit! :p

-S

http://openvotingfoundation.org/

OPEN VOTING FOUNDATION
9560 Windrose Lane
Granite Bay, CA 95746
Phone (916) 295-0415
alan@openvoting.org

PRESS RELEASE -- JULY 31, 2006
FOR IMMEDIATE RELEASE Subject: WORST EVER SECURITY FLAW FOUND IN DIEBOLD TS VOTING MACHINE
Contact: Alan Dechert
Reference: PICTURES (http://www.openvotingfoundation.org/ts/)

(Click on thumbnail. Click again on lower half of picture for high resolution)
SACRAMENTO, CALIFORNIA -- “This may be the worst security flaw we have seen in touch screen voting machines,” says Open Voting Foundation president, Alan Dechert. Upon examining the inner workings of one of the most popular paperless touch screen voting machines used in public elections in the United States, it has been determined that with the flip of a single switch inside, the machine can behave in a completely different manner compared to the tested and certified version.

“Diebold has made the testing and certification process practically irrelevant,” according to Dechert. “If you have access to these machines and you want to rig an election, anything is possible with the Diebold TS -- and it could be done without leaving a trace. All you need is a screwdriver.” This model does not produce a voter verified paper trail so there is no way to check if the voter’s choices are accurately reflected in the tabulation.


Open Voting Foundation is releasing 22 high-resolution close up pictures of the system. This picture, (http://www.openvotingfoundation.org/5-bt-cfg.jpg) in particular, shows a “BOOT AREA CONFIGURATION” chart painted on the system board.


The most serious issue is the ability to choose between "EPROM" and "FLASH" boot configurations. Both of these memory sources are present. All of the switches in question (JP2, JP3, JP8, SW2 and SW4) are physically present on the board. It is clear that this system can ship with live boot profiles in two locations, and switching back and forth could change literally everything regarding how the machine works and counts votes. This could be done before or after the so-called "Logic And Accuracy Tests".


A third possible profile could be field-added in minutes and selected in the "external flash" memory location, the interface for which is present on the motherboard.
This is not a minor variation from the previously documented attack point on the newer Diebold TSx. To its credit, the TSx can only contain one boot profile at a time. Diebold has ensured that it is extremely difficult to confirm what code is in a TSx (or TS) at any one time but it is at least theoretically possible to do so. But in the TS, a completely legal and certified set of files can be instantly overridden and illegal uncertified code be made dominant in the system, and then this situation can be reversed leaving the legal code dominant again in a matter of minutes.


“These findings underscore the need for open testing and certification. There is no way such a security vulnerability should be allowed. These systems should be recalled”


OPEN VOTING FOUNDATION is a nonprofit non stock California corporation dedicated to demonstrating the need for and benefits of voting technology that can be publicly scrutinized.



http://www.openvotingfoundation.org/ts/slides/7-top-rt.jpg

[tycho102]

Yeah, I've been pissed with Diebold for years. I've never doubted the 2004 election had some outright falsified votes, all courtesy of Diebold, all intentionally.

I want an open system that is verifiable. Proprietary systems and methods for voting is unaccepable anywhere but an Orwell book.

Our entire democratic system is f*cked up. That is the only way to put it with all the special interests and campaign financing schemes. Diebold is right there in with them, too. The whole system needs an enema. Diebold needs to be banned until they're using open-source operating systems and hardware, and a printed "receipt" that the voter can verify before handing it to the voting supervisor.

I understand the poli's want electronic voting because it gets them into power faster. You can have the party that night, instead of 2 days later like it used to be back in the early 80's. You don't spend two days in limbo, playing soccer with your kid while you're worried if you got beat or not.

But the system with Diebold is crooked. Crooked like the Big Dig, Crooked like the Roman Senate. And it's crooked in the worst place possible: the people counting the votes.

[TteFAboB]

You are absolutely correct tycho.

This is already a reality in Brazil. The Brazilians developed an electronic voting machine that is usually regarded as innovative, fantastic, a great invention. Pure naivity. The reality is the opposite.

An Uncle of mine participated in this development, I'd post pictures and newspaper covers but I don't want death threats from newly-registered users in my PM box. It's election time and the party in power, which polls indicate is going to loose the Presidency, had a secretary say that their militants should patrol the internet and fight a "dirty" war against opponents.

It was supposed to be all fine and dandy, yes, but few politicians would miss their chance to destroy such a system and turn it into an obscure and fragile and certainly undemocratic machine. The stronger argument against it: Brazil attempted to export this machine for free to all South American and even African countries, almost none of them accepted because, without making a public statement out of it, they recognized the danger of such machines. I would have to research the specific nations, but I clearly remember two African dictatorships accepted them gladly.

Given the irrelevancy of Brazilian electoral procedures, I'm not going to make a mega-post here but will give you two links in case you're interested:

Introduction: http://noleakybuckets.org/brasil-history.html

If you want more plus some technical stuff: Is Brazil ahead of it's time? By Brazilian Pedro Rezende.
http://www.rsasecurity.com/rsalabs/cryptobytes/CryptoBytes_Fall2004.pdf

Nothing beats the old paper vote. The Brazilian political parties use paper voting in their own interal affairs, and the Brazilian Congress and Senate also uses paper ballots when the occasion is deemed too important. If I'm not mistaken, only Venezuela and Brazil have a pure electronic voting machine below the Rio Grande (Cuba might use imported Venezuelan machines, I'd have to research on that). The irony being that the Venezuelan machine has a printer for fraud-proof recounting and the Brazilian does not while Venezuelan elections are fraudulent and Brazilian, well, we'll have to wait and see if fraud appears.