Also see below:     
Button on E-Voting Machine Allows Multiple Votes    [

    Inside the Shocking HBO Film That Rocks the Voting Process
    By Matt Webb Mitovich
    TVGuide

    Thursday 02 November 2006

    HBO's Hacking Democracy (premiering tonight at 9 pm/ET) tells the story of Bev Harris, a grandmother and writer who started investigating the subject of electronic voting in 2002 after questioning her county's switch to electronic touch-screen voting machines. Unsatisfied with their explanation, Harris set out to learn about electronic voting systems on her own, and in doing so stumbled upon shocking revelations about the vulnerability of the software and hardware. Harris, who went on to form the watchdog group BlackBoxVoting.org, recently spoke with TVGuide.com about her illuminating, though unsettling, journey.

    TVGuide.com: Have you read any of this week's news stories, about Diebold [a leading manufacturer of voting systems] asking HBO to slap a disclaimer on the documentary?

    Bev Harris: They haven't seen the real film at all.

    TVGuide.com: Apparently they are taking issue with, among other things, the hacking demonstration which shows how central tabulators can be tampered with by modifying a single memory card [on which a single machine's votes are recorded].

    Harris: It's interesting they would bring that up because the State of California commissioned its own independent study, Diebold was ordered to cooperate with the study, and all of the scientists said, "The hack is real, and it is dangerous." And they found 16 additional vulnerabilities. You have to sort of decide who it is that has more credibility - a manufacturer that wants to sell a system, or six independent scientists commissioned by the State of California.

    TVGuide.com: The machines at issue, how widespread is their current use?

    Harris: The film isn't just about Diebold - it also talks about Sequoia and other companies - but computerized voting systems will account for 80 to 90 percent of this coming [Nov. 7] election, depending on how you define it.

    TVGuide.com: Is it just optical scanning and touch-screen machines that are of concern?

    Harris: Computer systems are complex systems that all interact. So yes, they have optical scanning machines in every jurisdiction, because those are what count the absentee ballots. And there's the central tabulator, which is the one Dr. Herbert Thompson hacks [in Hacking Democracy], which compiles all the different information from the different locations. Diebold now makes an electronic poll book that replaces the sign-in sheet, and that is having a lot of problems in Maryland and Georgia. The film would be overly complex if it talked about all the different computer issues, but there are a lot of them.

    TVGuide.com: Watching this unsettling documentary, you come away feeling like paper-chad ballots are our best bet.

    Harris: Actually, those are counted by a computer, as well. There are a couple of solutions that are more in the direction we want to see. For example, this election, 45 percent of the jurisdictions in New Hampshire will be counting by hand. Dennis Kucinich (D-Ohio) has introduced a bill into the U.S. Congress to have the entire presidential race counted by hand in 2008. Canada counts their federal elections by hand, and they have the results generally in about four hours, and with little controversy.

    TVGuide.com: Why did John Kerry concede in 2004, when there was evidence pointing to "negative vote" tampering [in which a hacked memory card directs a tabulator to subtract votes]?

    Harris: You know, that was something that I was baffled by, because he had specifically promised, and collected money, to fight for every vote and get to the bottom of any issues that arose. It was very disappointing to a lot of people.

    TVGuide.com: One fact reiterated during the film is that if vote totals are somehow cooked, there is usually no electronic record of the tampering.

    Harris: Some of the clumsier tampering efforts we are starting to catch now, because they don't know how to erase their tracks. But the one demonstrated by Harri Hursti [in Hacking Democracy] is particularly elegant because it deletes itself afterward. There's no way to find it at all afterward.

    TVGuide.com: Did Diebold ever step away from its contention that there is no "executable program" on the memory cards? That they can't be hacked to register "negative" votes?

    Harris: They do a lot of parsing of words.... And at one point, they tried to redefine for themselves what "executable" means. [Laughs]

    TVGuide.com: At the end, we see that Ohio's Cuyahoga County, despite much controversy and unanswered questions about the fidelity of its voting system, went ahead and ordered $21 million in new Diebold machines....

    Harris: They did, and what's so interesting is they ordered these touch-screens with a paper trail, and when there was an audit of their May primary, the paper trail did not match the machines. None of the results matched the central tabulator. It was a complete fiasco. I would not want to be the election supervisor there.

    TVGuide.com: With an eye on this coming Tuesday's elections, are there any options for anyone who doesn't feel complete faith in their ballot being accurately cast? Is there any alternate ballot-casting method, anything "old-school" a voter can request?

    Harris: In some places they represent that there is - like, in California, voters can ask for a paper ballot - but those are still counted by machines. It goes into the same system. In Riverside County, some citizens followed those paper ballots to see what they did with them, and what they found is people were hired to enter the paper ballot into a touch-screen. It added insult to injury. This election, what we really have to do as independent citizens - and Black Box Voting is working with them to help them know what to do - is to ask questions and document. Once that body of evidence comes in, we're going to see some real change.

    TVGuide.com: Is there any chance that we as a nation, going into the 2008 elections, will feel complete confidence in the vote-counting system? Is there enough time?

    Harris: It depends on how well we make the case this time around, and how effective we are at solving the problems that we document in this coming election.

    TVGuide.com: After the 2000 election, I remember thinking, "Why isn't there a singular, unified vote-casting system?" But now I realize that in the wrong hands....

    Harris: The missing ingredient has been the citizens. Any system that we end up with has to be one that citizens can oversee. Anything that says, "You don't get to look at how it works" or "You have to trust the vendor," doesn't really cut it. In a communist country, you have to trust the government. In a democracy, you get to check.

 

---

    Go to Original

    Button on E-Voting Machine Allows Multiple Votes
    By Ian Hoffman
    The Oakland Tribune

    Wednesday 01 November 2006

Sequoia touch-screen is California's most widely used.

    Days before the election, state officials have learned that California's most widely used electronic voting machines feature a button in back that can allow someone to vote multiple times.

    Several computer scientists said Wednesday that the vulnerability found in all touch-screen machines sold by Oakland-based Sequoia Voting Systems was not especially great because using the yellow button for vote fraud would require reaching far behind the voting machine twice and triggering two beeps.

    "If the machine beeps loudly and someone has their arms wrapped around the machine, the poll workers are going to become suspicious," said David Wagner, a computer security and voting system expert at the University of California, Berkeley.

    "It's kind of hard for me to see how this could be used very widely," he said. "It's retail fraud, so it's onesies and twosies and can only affect very close races."

    A former poll worker in Tehama County tried alerting state elections officials to the vulnerability about a month ago and said he was told the problem did not seem significant. Ron Watt then obtained poll worker-training documents through a public records request and brought them to the attention last Friday of the state's chief voting systems tester.

    On Monday, state elections officials issued a caution to the more than one-third of California counties that use Sequoia equipment, including Santa Clara County, where the touch screens are the primary voting system, and Alameda

    County, which relies on almost 1,000 machines as a secondary voting system intended for disabled voters. State elections officials reminded the counties to keep a close eye on the machines and post warnings that tampering with election equipment is a crime.

    "All counties confirmed that they had implemented security measures, and they were aware of it," said Susan Lapsley, assistant secretary of state for elections.

    Some counties were backing the machines up against walls; others were roping off the rear of the machines, state officials said.

    "You can't do it surreptitiously," said Guy Ashley, spokesman for the Alameda County Registrar of Voters. "You have to know what you're doing.

    "We train our poll workers to keep their eyes peeled, stay on the lookout for stuff like this. We think that will suffice."

    Recognition of a potential new security problem that requires no knowledge of special passwords or access to the inner workings of a voting machine revives questions about the effectiveness of state and national evaluations of voting systems.

    Twice earlier this year, computer experts and critics of electronic voting have discovered profound vulnerabilities in Diebold touch screens that allow someone with a few minutes of access to a machine to alter or replace its core software and load votes into it undetected.

    Debate about the security and reliability of electronic voting has been central to the race for secretary of state, and Sequoia's yellow button became instant fodder Tuesday night in back-to-back radio interviews with Republican appointee Bruce McPherson and his Democratic challenger, state Sen. Debra Bowen, now neck-and-neck in the polls.

    McPherson has said California's certification of voting systems is the nation's toughest and most stringent and he has certified several electronic voting systems for the November elections, including the Diebold and Sequoia touch screens.

    Bowen has pointed to numerous findings of security problems by computer scientists and argued that electronic voting systems are not mature enough to be trusted in elections.

    "And just this morning we learned that the Sequoia machine will allow a voter to vote multiple times if they do something very simple, which is to hold a button in the back down for three seconds," she said on a Los Angeles radio show Tuesday night, adding that McPherson's office "must have known" about the vulnerability for some time.

    "No, that is not true," McPherson replied later in the same show. "That is not true. I think she is throwing a lot of fear and doubt out there, and it's unwarranted."

    Sequoia's yellow button isn't a hack or flaw. The button has been a feature on Sequoia's mainline AVC Edge touch screens for years, designed as a backup for the typical method of voting on the machines.

    In most counties, poll workers use a separate machine to activate a card that a voter inserts into the touch screen in order to retrieve the proper ballot. The yellow button is for counties that can't afford the separate machine or for cases when the card activator becomes inoperable, as happened to Diebold systems in March 2004 in Alameda and San Diego counties and last primary in Kern County.

    Pressing, then holding the button for several seconds twice and answering a screen prompt sends the machine into a "manual activation" or "poll worker activation" mode. In that mode, someone can call up one ballot after another and vote them.

    "You can literally vote continuously until you are physically restrained," said Watt, the former Tehama County poll worker who reported the problem to state elections officials.

    Unlike the Diebold vulnerability, he said, using Sequoia's yellow button "takes no tools."

    "In 18 seconds I can switch that to manual and start voting. In 30 seconds I can train you to do it," he said.

    Watt and Bowen, the Democrat running for secretary of state, say the vulnerability should have been caught earlier, before the state approved the machine for use in elections.

    "You shouldn't have a reset button on the outside of the machine," Bowen said. "Certainly when I'm secretary of state I'm going to want to know if there's a button that only requires physical access to the machine to vote multiple times. And unfortunately if someone does that, you're in a position where you don't know what votes to throw out."

    Computer scientists say the manual mode can be rendered inoperable in the touch-screen software, but elections officials worry that it is too close to the election to attempt and may not be useful.

    "It's a feature of the machine, it's one that's necessary from a couple of different perspectives but as long as people employ security measures that are already in place then it's mitigated," said Lapsley.