Area voting machines could have flaws 
by Shane Mizer,   Eureka Reporter   12/16/2005 
  
AccuVote machines used in Humboldt County elections may be vulnerable to hacking, according to a recent test in Florida.

The machines succumbed to security expert tampering in a Leon County, Fla., test observed by elections supervisor Ion Sancho.

In a Wednesday press release from Sancho following a Tuesday test hack demonstration by Finnish security expert Harri Hursti and security expert Herbert Thompson of Diebold?s voting system, Sancho said Leon County will no longer use voting machine systems from Diebold Inc., ?due to contractual nonperformance and security design issues.?

?I don?t know why any election official would allow anyone to have access to their voting system,? Humboldt County Elections Manager Lindsey McWilliams said, criticizing the Leon County test.

One of the nation?s leading vendors of voting machine systems and automatic teller machines, Ohio-based Diebold also supplies many of California?s counties, including Humboldt County, with its voting software and machines.

A similar hack test demonstration was scheduled in California for Nov. 30, but was postponed after security expert Hursti announced he could not attend. Although California Secretary of State Bruce McPherson has not provided an exact date, the California test will most likely occur before Jan. 1, his staff said.

McPherson had no comments with regard to the Leon County voting system hacking demonstration.

?We?ll be evaluating our voting system on a case-by-case basis,? Secretary of State Press Secretary Jennifer Kerns said.

According to the Leon County press release, Diebold?s built-in security failed to prevent Hursti from tampering with the AccuVote-Optical Scan memory card installed in AccuVote machines.

The memory card, which retains voting results, is used in transferring the votes to the Global Election Management System central tabulator.

After Hursti doctored the outcome of the simulated test, the GEMS central tabulator was unable to recognize that a security breach had occurred.

Witnesses at the Leon County demonstration included Florida Fair Elections Coalition Director Susan Pynchon, security expert Thompson and Black Box Voting investigators Bev Harris and Kathleen Wynne.

Black Box Voting, a nonpartisan election watchdog headquartered in Seattle, has been monitoring the security of voting systems, specifically Diebold, since founder Harris stumbled onto an unprotected Diebold Web site in 2003 and proceeded to download approximately 40,000 of their documents and files.

The files provided Black Box Voting with an intimate window into the structure of the company?s internal voting system, Black Box Voting investigator Jim March said.

?In a lot of rural counties, we?ve seen Diebold essentially run the entire elections themselves as consultant staff because the systems are too complex for the counties? technical staff,? March said.

In March?s interpretation of the findings, the primary individuals who could hack the system are not likely to be outside hackers, but crooked election officials or staff, a computer contractor or possibly Diebold?s own on-site support staff.

Dave Berman, a member of the local electoral reform watchdog group the Voter Confidence Committee and author of guvwurld.blogspot.com, has recently called for McWilliams? resignation due to his failure to properly safeguard Humboldt County?s elections.

?The conditions for our elections right now guarantee that we are going to have an inconclusive outcome because we?ve got paperless electronic voting machines across the country,? Berman said. ?If we can?t verify the vote with a recount, how can we know what the true outcome is? Therefore there is no reason for confidence in the results that are given, just blind trust.?

Diebold spokesman David Bear claimed Sancho?s test was not conducted in a real environment and therefore does not reflect a realistic outcome.

?At no time has he ever included us in his test or followed any industry standards or his own policies and procedures on how to properly conduct an election,? Bear said. ?It?s somewhat foolish to be providing people with the ability to bypass securities by supplying passwords and unfettered access. It?s sort of analogous that if I give you the keys to my house and the password to my alarm of course you can get into my house.?

Although Bear said Diebold has been discussing details with McPherson with regard to the California hack test, he did not confirm whether Diebold representatives would stand as witnesses to the test.

Since 1995, Humboldt County has used memory cards purchased through Global Election Systems, which, according to McWilliams, was bought by Diebold in 2001.

?We rely on the secretary of state,? McWilliams said. ?At the moment our system is certified.?