For background, see:
Part I: Pull the Plug on E-Voting •
Go to Original
Part II: Pull the Plug on E-Voting
By Bruce O'Dell
OpEdNews
Thursday 26 October 2006
Here's an indictment of the IT profession, and a fine irony: the degree of
independent hand-auditing of paper ballot records sufficient to verify the corresponding
computerized vote tallies is comparable to the effort required to more accurately
count all the ballots by hand in the first place, dispensing with the machines.
But until that day arrives, the programs that the voting vendors actually distribute
- as opposed to the software they may say they distribute - will continue
to determine who takes power after the votes are tallied.
How does Diebold or ES&S software wind up in my precinct?
Consider that while there are a relative handful of programmers at companies
like Diebold or ES&S, there are hundreds of thousands of voting machines
out in the field. After a programmer writes a piece of software, compiles it
into binary form, and tests it well enough to say it's done and working properly,
many additional people - dozens to hundreds of them, in fact - get involved
in the long chain of events to get that software out to the polling station
and election office, ready to be used.
This highly complex process includes the programmers who write the "application
programs" that display ballots and counts votes electronically; the testers
who install a copy of the application program as provided by the programmer,
to run it for themselves to verify that the specified inputs correspond to the
specified outputs; and the software deployment specialists who take a copy as
provided by the tester to distribute to their customers (once they're told by
management it's good enough to be used by the public).
Deployment specialists package the software so that it can be cloned thousands
of times to be installed by vendor field representatives or election administrators
on the vast number of precinct machines and central tabulators out in the field.
Vote counting application programs don't just run themselves: there's a vast
array of supporting software modules, such as operating systems - rock-solid,
dependable products like Windows; device drivers - software that hooks up to
input-output devices such as wireless network cards and telephone modems (you
did know that voting equipment can be accessed remotely) and firmware - the
software that all other software depends on to interact with the physical world.
Thousands upon thousands of software modules and hardware components from vendors
all over the world all playing some supporting role in vote tallying.
If all this sounds complicated, well, it is. It's awesomely difficult to get
this just right even within the relatively safe confines of a private network
inside a bank. While Diebold, ES&S and other vendors certainly pay lip service
to accepted professional standards of best practice for system development,
testing and deployment, there are abundant indications that each link in the
end-to-end software process has been compromised.
Software developers and other insiders pose the greatest risk
Above and beyond the well-documented criminal records of some of the key programmers
who wrote a large portion of our current voting systems (just start at http://www.bbvforums.org/forums/messages/1954/17305.html?1138394704
and go from there), there's ample room for insider misconduct in any organization.
My profession has largely failed to adequately inform the public that the most
severe security risks in any organization are from insiders. Quoting from Dan
Verton's book "Identity Thieves:"' as excerpted at CSO Magazine Online:
The modern American bank has recognized the security risks associated
with the new electronic frontier and, as a result, has deployed all the state-of-the-art
electronic security devices that one would expect to find in a security conscious
enterprise - firewalls, intrusion detection devices, password management systems,
and powerful encryption technologies. Yet banks and financial institutions continue
to lose millions of dollars every year to trusted insiders who understand where
the weaknesses are in the system. In fact, insiders accounted for approximately
70%, or $2.4 billion, of the $3.4 billion that banks lost as a result of both
internal and external fraud and hacker incidents in 2004."
Electoral systems grant regulatory power over a $12 trillion economy and access
to the world's largest checkbook: the federal procurement budget. By the Willy
Sutton rule, voting systems are truly "where the money's at".
Constant, ruthless and highly sophisticated attempts by insiders to subvert
voting software should be assumed as a given. And yet a representative from
Diebold can still say - with a straight face, and without being laughed out
of the room: 'For there to be a problem here, you're basically assuming a premise
where you have some evil and nefarious election officials who would sneak in
and introduce a piece of software,' he said. 'I don't believe these evil elections
people exist.' (New York Times, 5/12/2006)
Testing can't prove software is safe
The second link in the chain - testing - is no better. When it comes to computerized
voting systems, internal and field software testers as well as external "certification
labs" are one astonishingly lackadaisical and inattentive bunch, judging
by the vast array of bugs in the public record (as tallied at http://www.votersunite.org/info/messupsbyvendor.asp
and many other places). As a consultant to financial institutions I'd be fired
- and then likely sued for gross professional misconduct - if I did my job so
poorly and so publicly.
To be fair, of course, although bug reports show voting software testing is
mind-bogglingly lax, all any software testing process can do is find problems
that testers know to look for and report honestly. There are countless billions
of internal states within all but the simplest of programs. Both practically
and theoretically, it is impossible through
testing to determine that any computer system has no flaws - much less, to rule
out the existence of secret backdoor functions to be triggered on a future date.
(This is no science fiction; see http://www.bbvdocs.org/reports/BBVreportIIunredacted.pdf
).
Software distribution: a shell game with an invisible pea
It will come as no surprise that the third link from programmer to voter, field
deployment, is also wide open to covert manipulation. As soon as the programmer
is done typing, software becomes invisible - it lives on as magnetic and electrical
impulses on silicon chips, disk drives, memory cards, and CD-ROMs. Specialized
software called a "configuration management system" is then used to
control which of the many versions of which of the thousands of software components
are sent to which device in the field.
This is not a magic process ordained by saints and administered by angels.
Voting software is software distributed through use of software, vouched for
by other software, that itself vouches for other software. Surely nothing can
possibly go wrong with such a system, even though the highly complex
logistics of installing thousands of software modules on tens of thousands of
precinct devices and country central tabulators is under the full control of
ordinary people fully susceptible to blackmail, greed, or the pursuit of their
own ideological agendas.
Did I mention this is done entirely outside public view?
To make things even more interesting, sometimes a lot of voting software is
changed all at once with distribution of a brand new version with many new features,
while other times, just a few software modules are updated (often called a "patch").
Patches occur especially frequently to poorly-written software; just ask any
PC user who pays attention to the pitter-patter of incoming Microsoft security
updates. The level of scrutiny that a patch receives is even less than the ordinary
lax standard applied to voting software. That there were last-minute patches
to voting software in Georgia and Minnesota immediately before the elections
of 2002 is indisputable. That may have had nothing at all to do with the surprising
outcomes of two US Senate races a few days later... but we can never know for
sure.
Pre-Election Slumber Party
Sure, just one vendor insider with access to just one of the master copies of
one of the software version or patch distributions can compromise thousands
of devices long, before the equipment ever reaches the voter. But you'll be
comforted even further to know that even after the devices are readied for an
upcoming election, local election officials have a surprising degree of cozy
hands-on access to voting equipment. In fact, all over the country -most notoriously
in California Congressional District 50 this year - voting machines are commonly
brought home by poll workers for "storage" prior to the election.
Voting equipment vendors allege that their equipment has tamper-proof seals,
while in reality, it takes only minutes using household tools to gain sufficient
access to voting equipment to permanently and in practice undetectably alter
the software (see http://www.bbvforums.org/forums/messages/1954/36510.html?1158778859
).
An apology on behalf of the information technology profession
Here's the truth, and the truth hurts: my profession has enabled the development
and deployment of voting systems which are obviously and patently unfit for
use.
In fact, the whole system of computerized voting in America is so far removed
from standard best practices for information technology that I can only conclude
that - far from being the product of accidental defects or stupid sloppiness
- the vast array of security vulnerabilities found in every type of electronic
voting equipment that has
ever been independently examined can quite plausibly be seen as deliberate features
introduced to subvert the voting process itself.
And so I can only say: I apologize on behalf of my profession, to the American
people. You have been so ill-served by those of us who bear the unique responsibility
of ensuring that the computer systems upon which our
civilization is now almost totally dependent operate in the public interest.
But even knowing what we do know, many of my IT colleagues continue to try
to salvage some application of computer technology to voting. To them I say
- just look at what we have done in the name of automation. We led the public
into this predicament and we owe it to them to help lead the way out. We have
an ethical duty to honestly advise the public when most appropriate choice is
not to use computers.
Pull the Plug!
So let it be computer professionals who finally help he public to pull the plug
on electronic voting.
The most urgent ethical duty facing the American information technology profession
is for once to see past our technocentric arrogance and acknowledge that from
a whole-systems perspective, computerized voting is
surely one of the great blunders in the history of technology. Let us lend our
full support to replacing computers as quickly as possible with the worst way
of tallying votes - except, of course, for all the others:
citizen-run elections using the most appropriate and secure vote tallying technology
of all, hand counted paper ballots. While it may take a while to get there,
let's start now. This is the least we can do to be worthy of all those who laid
down their lives to win and defense our right to vote, the foundation of our
freedom.
Don't throw good money after bad: ban computer technology in voting. Put ballots
back on paper for everyone, using the VotePAD device for the visually impaired.
My profession has talented user interface designers who can craft a paper ballot
to meet the needs of the people who fill it out and count it - rather than dumbing
it down to accommodate the pitiful limitations of an optical scan program, or
making a paper ballot look like a 19th century newspaper to skimp on printing
costs. Get serious about security for early and absentee ballots; treat them
at least as well as if they were bearer bonds; their true value is, of course,
priceless.
Let citizens take control of the election process to cast paper ballots by
hand, and count them on election night in the polling place, in public. In the
final analysis, we ourselves are the only people we can trust - or should ever
trust - to safeguard the Republic.
We, the people, have the inalienable right to run our own elections. Pull the
plug.
-------
Jump to today's Truthout Features:
(In accordance with Title 17 U.S.C. Section 107, this material is distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes. t r u t h o u t has no affiliation whatsoever with the originator of this article nor is t r u t h o u t endorsed or sponsored by the originator.)
"Go to Original" links are provided as a convenience to our readers and allow for verification of authenticity. However, as originating pages are often updated by their originating host sites, the versions posted on TO may not match the versions our readers view when clicking the "Go to Original" links.
Print This Story
E-mail This Story