By Michael Hampton
Posted: September 14, 2006 9:29 am
Updated: September 19, 2006 10:28 am
Share this story: Digg del.icio.us reddit.com Newsvine
Researchers at Princeton University announced Wednesday that common
electronic voting machines can be subverted by installing software
which undetectably alters vote totals and, as a computer virus,
spreads itself from one voting machine to the next.
Computer science professor Edward Felten, along with graduate
students Ariel Feldman and J. Alex Halderman, published a paper in
which they demonstrated the ease of installing malicious software
onto a Diebold AccuVote-TS touchscreen voting machine which would
alter vote totals in a real election, but be undetectable to
election officials by allowing the logic and accuracy tests to pass,
and by deleting itself from the voting machines at the end of the
election.
“This report should finally put to rest the myth that the current
generation of e-voting machines adequately protects the integrity of
the electoral process,” said Electronic Frontier Foundation staff
attorney Matt Zimmerman.
And to add insult to injury, the team posted videos of the entire
process of hacking a Diebold touchscreen voting machine.
This paper presents a fully independent security study of a Diebold
AccuVote-TS voting machine, including its hardware and software. We
obtained the machine from a private party. Analysis of the machine,
in light of real election procedures, shows that it is vulnerable to
extremely serious attacks. For example, an attacker who gets
physical access to a machine or its removable memory card for as
little as one minute could install malicious code; malicious code on
a machine could steal votes undetectably, modifying all records,
logs, and counters to be consistent with the fraudulent vote count
it creates. An attacker could also create malicious code that
spreads automatically and silently from machine to machine during
normal election activities — a voting-machine virus. We have
constructed working demonstrations of these attacks in our lab.
Mitigating these threats will require changes to the voting
machine’s hardware and software and the adoption of more rigorous
election procedures. — Security Analysis of the Diebold AccuVote-TS
Voting Machine
Diebold Election Systems marketing director Mark Radke said the
researchers should have contacted the company, because they have
since updated their system to address some of the issues raised.
“I’m concerned by the fact we weren’t contacted to educate these
people on where our current technology stands,” Mark Radke said.
Radke also question why Felten hadn’t submitted his paper for peer
review, as is commonly done before publishing scientific research.
Felten said he and his colleagues felt it necessary to publish the
paper as quickly as possible because of the possible implications
for the November midterm elections. — Associated Press
Considering that Diebold election equipment is about as secure as
Swiss cheese, as confirmed by numerous reports over the last couple
of years, that the company doesn’t care about election security, and
that that’s why they were run out of North Carolina, I don’t think
it will mean all that much that the researchers didn’t wait for peer
review. You can peer review it for yourself by watching the
researchers’ video of the process.
Now don’t you feel good about your vote last Tuesday? The Brad Blog
has documented instances all over the country where elections have
gone haywire and election officials have been sent scrambling to
implement emergency security measures because of security problems
such as this.
“The challenges presented by the introduction of electronic voting
are systemic and require a systemic response,” Zimmerman said.
“Paper trails, regular audits, and robust physical security are a
good start, as are improved pollworker training and radically
upgraded machine certification requirements and procedures. H.R.
550, making its way through the House of Representatives, would go a
long way towards implementing many of these fixes on a nationwide
basis.”
As for Diebold, one funny YouTube video seems to sum it up:
Update: Felten writes on his blog that the locks on the Diebold
AccuVote-TS machines which allow access to the memory card slot can
be opened with a key anyone can buy on the Internet, such as the key
to a hotel minibar.