CA: Sen. Bowen on Diebold TSx Security "Flaw" ~ 12 Counties' Votes at Risk

[nicknameless]

Received from Bowen's office today:

DIEBOLD REVEALS NEW “SECURITY VULNERABILITY” WITH ITS TOUCHSCREEN
VOTING MACHINES CERTIFIED FOR USE IN CALIFORNIA


COMPANY TELLS PENNSYLVANIA ABOUT FLAW IT SAYS COULD
LET “UNAUTHORIZED SOFTWARE” BE LOADED ONTO THE SYSTEM


“HOW DOES THE SECRETARY OF STATE PLAN TO RESOLVE THIS SECURITY NIGHTMARE AND GURANATEE PEOPLE’S VOTES ARE ACCURATELY COUNTED?”

SACRAMENTO – “Is it embarrassing that California’s Secretary of State certified voting machines that the company itself now admits suffer from a serious security flaw that could allow anyone to load software onto them to change people’s votes and potentially change the outcome of an election? I’m sure it is, but we have a statewide election in less than four weeks and we don’t have time for people to be embarrassed, we need to get the problem solved.”


That’s how Senator Debra Bowen (D-Redondo Beach), the chairwoman of the Senate Elections, Reapportionment & Constitutional Amendments Committee reacted to the revelation that Diebold has informed Pennsylvania elections officials that the AccuVote-TSx – a touchscreen voting machine that at least 12 California counties plan to use in the June primary – contains a serious “security vulnerability.”


“I called on the Secretary of State back in February to reverse his decision to certify the Diebold TSx because the machine doesn’t meet the requirements laid out in state law,” said Bowen. “Now, two-and-a-half months later, Diebold, which touts itself as using ‘industry leading security,’ comes out and tells Pennsylvania about a security flaw found in every TSx machine that lets people change the vote totals on the machines and, possibly, change the election results in the process. Voters in 12 California counties are going to have to rely on these machines to accurately record their votes, so why wasn’t California’s Secretary of State told about this security problem and if he was told about it, why has he been sitting on this information?”


On May 1, Diebold wrote to the Pennsylvania Secretary of the Commonwealth, stating it:


“. . . has determined there is a security vulnerability to the AccuVote-TS and AccuVote-TSx equipment in the system installation and upgrade mechanism. This security vulnerability could potentially allow un-authorized software to be loaded onto the system. The probability for exploiting this vulnerability to install un-authorized software that could affect an election is considered low.”


The following day, May 2, 2006, the Pennsylvania Secretary of the Commonwealth issued a directive to all Pennsylvania counties using Diebold machines, stating:


“In order to mitigate any immediate risk, all counties using the Diebold AccuVote-TSX shall re-install the authorized software during system startup prior to installing, testing, and sealing the election data PCMCIA card into the unit.”


“I really want to know how the Secretary of State is going to fix this debacle,” continued Bowen. “Why should the voters in the 12 or so counties using Diebold equipment have to cast their ballots on machines the company itself says aren’t secure? Voters wouldn’t be in this position if the Secretary of State hadn’t certified the Diebold machines in violation of state law back in February. This entire security nightmare has turned the intent of the Help America Vote Act on its head. Requiring voters to cast ballots on machines that don’t comply with California law and that the company itself now says are vulnerable to tampering runs completely counter to the intent of HAVA, which was supposed to make it easier for people to vote and to ensure every vote is counted accurately.”


On February 17, 2006, the Secretary of State’s Voting Systems Technology Assessment Advisory Board (VSTAAB) released a report identifying 16 security flaws in the Diebold machines, but not the flaw Diebold revealed to Pennsylvania officials on May 1. The Secretary of State certified the Diebold machines that same day and imposed additional security procedures, including one requiring the machine’s memory cards to be programmed under the supervision of the registrar of voters. However, it appears the process won’t cover the security problem disclosed by Diebold because the process deals solely with when the electronic ballot is loaded onto each machine, not when the operating software is loaded onto the machine.


A copy of the letter from Diebold to the Pennsylvania elections officials is attached, along with a copy of the directive from the Pennsylvania Secretary of the Commonwealth to counties that plan to use Diebold machines in the state’s May 16th primary election.

Why is this garbage being forced on CA voters -- yet Vote-PAD can't be used?!
"Twelve Counties" is an estimate. ("12 or so counties" -- Bowen). Hopefully that number will be plummeting soon.

Looking through ERD, I couldn't locate the PA documents (?) so I'm posting them below.

[nicknameless]

1. Attached Doc. #1: Diebold Notice to PA

Notification of Potential Security Threat to
AccuVote-TS/TSx Machines

May 1, 2006

Overview:

Diebold Election Systems, Inc. (“DESI”) has determined there is a security vulnerability to the AccuVote-TS and AccuVote-TSx equipment in the system installation and upgrade mechanism. This security vulnerability could potentially allow un-authorized software to be loaded onto the system. The probability for exploiting this vulnerability to install un-authorized software that could affect an election is considered low.

To exploit this risk, physical access is required to the PCMCIA slots on the machine during system startup.

Diebold Election Systems is currently working on a fix to this security vulnerability and once it is tested and certified it will be made available to customers.

Procedures to mitigate the risk:

If there is a concern that this security vulnerability has been, or could be, used to load un-authorized software on the system then re-install the authorized software during system startup prior to installing, testing, and sealing the election data PCMCIA card into the unit.

[nicknameless]

2. Attached Doc. #2: PA Security Directive

DIRECTIVE CONCERNING THE INSTALLATION OF FILES REGARDING THE
DIEBOLD ACCUVOTE-TSX ELECTRONIC VOTING SYSTEM
ISSUED BY THE SECRETARY OF THE COMMONWEALTH

Pursuant to Section 1105-A of the Pennsylvania Election Code, at 25 P. S. §3031.5, and revised as required by Act 150 of 2002, the following Directive is issued by the Secretary of the Commonwealth for the installation of files for the Diebold AccuVote-TSX electronic voting system.

1. Diebold Election Systems, Inc. (“DESI”) has determined there is a potential security vulnerability in the system installation and upgrade mechanism to the AccuVote-TSX version 4.6.4 equipment, which is currently certified in Pennsylvania. This security vulnerability could allow un-authorized software to be loaded on to the system. The probability for exploiting this vulnerability to install un-authorized software that could affect an election is considered low. To exploit this risk, physical access is required to the Personal Computer Memory Card International Association (PCMCIA) slots on the machine during system startup.

2. Diebold Election Systems shall develop a permanent solution to this security vulnerability, which shall proceed through the ordinary certification process. Once the permanent solution is certified, Diebold shall make that solution available to its customers through the normal software upgrade process.

3. In order to mitigate any immediate risk, all counties using the Diebold AccuVote-TSX shall re-install the authorized software during system startup prior to installing, testing, and sealing the election data PCMCIA card into the unit. The Department of State will furnish the authorized software to the counties on a PCMCIA card along with instructions for its installation.

[kster]

3. KICK-N-RECOMMENDED........nt

[Tiggeroshii]

4. K&R

Go Debra Bowen!

:yourock:

[caligirl]

5. Likely my county is one of them? Alameda

[nicknameless]

6. It looks like your county is returning to paper ballots

http://www.verifiedvotingfoundation.org/article.php?id=6351

One of the first counties in the state to embrace electronic voting is headed back to paper -- and it's not the only one.

Alameda County residents going to the polls June 6 will be asked for the first time in five years to fill in ovals on paper ballots rather than casting their votes on costly touch-screen machines.

"It's a little bit of back to the future," joked Elaine Ginnold, the county's acting registrar of voters.

The decision to go back to paper stems from changes in state law that toughen requirements for touch-screen machines and render the county's equipment inadequate.

:)

[Hekate]

7. What are the other counties? I'm in Santa Barbara.

Keep up the good work of keeping us informed. :hi:

Hekate

[nicknameless]

8. There were a few named in the article at the link.

I didn't see Santa Barbara mentioned. It looks like in 2005, your county used Diebold AccuVote Opti-Scan machines.
But after this year's re-certification of TSx machines, many counties moved towards purchasing them.
Was Santa Barbara one of those counties?

A lawsuit was filed by VoterAction.org against CA's SoS and 18 County Registrars for the purchase or use of Diebold touchscreen machines (which were re-certified illegally). http://www.bradblog.com/archives/00002581.htm
And, if I recall correctly, seven counties decided against using them, and were dropped from the suit.

Sorry, I'm bleary-eyed from looking for those. :crazy: Maybe someone else has a link to that info.

[nicknameless]

9. It looks like Santa Barbara WAS one of the Counties that dropped the TSx

DRE machines and was dismissed from the lawsuit. So at least you'll get paper ballots...
The counting of the ballots is another issue, of course.

http://www.voteraction.org/States/California/CA.html

Seven Counties Dismissed from California Voters Lawsuit to Block Use or Purchase of Electronic Voting Machines
Humboldt, Marin, Placer, San Luis Obispo, Trinity, Tulare, and Santa Barbara Counties Opt for Paper Balloting Citing Cost, Accuracy and Security Concerns

For Immediate Release: San Francisco, April 26, 2006 – California Voters marked their latest legal action today by lauding officials in seven California counties for their commitments to use or switch to all paper balloting rather than electronic voting systems. The Counties of Humboldt, Marin, Placer, San Luis Obispo, Trinity, Tulare, and Santa Barbara were dismissed today from the California Voters Lawsuit (Holder v. McPherson), supported by Voter Action, and filed in San Francisco Superior Court last month. The suit seeks to nullify Secretary of State Bruce McPherson’s “conditional” certification authorizing purchase of the Diebold TSx electronic voting system – which has a history of security, verifiability, and disability access problems –for use in California elections.

“These seven counties are leading California “back to the future”, by selecting verifiable, all paper balloting over electronic voting systems with significant security problems, and the risk of fraud and vote manipulation,” said Lowell Finley, Esq., co-director of Voter Action, and co-counsel for the plaintiffs in the California Voters Lawsuit. “These counties appreciate the importance of transparency and verifiability in clean elections. Diebold TSx electronic voting machines contain technology that is easily hacked and nearly impossible to audit or recount, and which is illegal under the California Elections Code”.

:)

[Hekate]

10. Thanks, I feel a little better. We've been using scanned ballots forever

... as far as I know. I've been calling them Scantrons, after the forms my husband uses for grading tests in his classes.

I never questioned their accuracy because there are paper ballots on file. Naive of me, as I now know, but paper ballots ARE available to be checked.

Years ago we had a hotly contested election for a seat on the County Board of Supervisors, and it looked like the challenger won. He took office, but it was such an incredibly close race that the "loser" asked for a recount. I can't remember if it was before or after the recount was demanded that a couple of overlooked boxes of ballots turned up.

When the dust finally settled and the shouting stopped, the original incumbent, Bill Wallace, won by seven (7) votes and retook his seat on the Board.

I hope we can restore the paper balloting system to this nation once and for all.

Hekate

[nicknameless]

11. Exactly -- Step 1: Paper ballots ... And then HAND COUNTING,

like all of the sane countries do.

There was a great article (from Scotland?) posted a few months back. It showed tables set up for the votes to be counted and observed out in public -- for everyone to see. They even had video cameras taping the counting. Then the winner was announced.

No machines to screw up or screw voters over. No transporting of data or ballots before the counting is complete. So simple and obvious. ... No wonder our current crime syndicate is opposed to it.

[caligirl]

13. thanks.

[nicknameless]

12. Want a good laugh?

This little blurb is excerpted from a McPherson email sent out in March:

The Secretary remains committed to ensuring the reliability and accuracy of every vote, and that is precisely why he has set such high performance criteria to ensure that the integrity of the vote has been protected. With these qualifications for our voting systems, we believe voters can have confidence in the electoral process and the equipment used to capture their votes.

:rofl: :rofl: :rofl: :rofl: :rofl:

[Hekate]

14. I don't want my votes "captured," I want them freed!

great quote

Hekate

[nicknameless]

16. Here's another:

Secretary McPherson shares your concern that we have only the most secure, reliable voting systems, and he is committed to ensuring the accuracy and integrity of every vote cast. That is why he has established the most stringent requirements for voting systems in the nation.

It would be funny if it weren't such a serious issue.

[nicknameless]

15. I can't find these PA docs posted anywhere else on DU.

Have these been seen before?

[patriothackd]

17. Kick for California's hopes

I say "hopes" because the officials there don't seem to be on the same wavelength.

[Einsteinia]

18. And McPherson Redacted this critical. . .

information that shows Diebold's equipment had not only a mean to easily hack it without a trace, but also that it was done DELIBERATELY.

I think it's orange jumpsuits for Diebold and those complicit in this crime against democracy.

[nicknameless]

19. I hope Bowen is aware of that.

[patriothackd]

20. I don't think the latest Hursti info was ever in the Calif. rept.

That report was about a different class of flaws, interpreted code, accubasic, memory cards and the like wasn't it? The new information that was in the NYT etc was about back doors built into the underlying platforms, Windows CE, bootloader.

The new study has nothing to do with the Calif. study unless I missed something.

That should make it even worse though. According to one of the computer journals Calif. was told about the new findings weeks ago but chose not to do anything so the ball was kicked over to Pennsylvania where Shamos took action.

[Einsteinia]

21. I understand that it was uncovered

in the October logic and accuracy testing, but it was kept under cover for fear of public knowledge.

There was the thought that Diebold should have an opportunity to rectify the situation, so I'm told.

Utah's Mr. Funk was tipped off and they looked for it

The point is that McPherson went ahead on February 15, 2005, and gave the greenlight to Diebold while suppressing (readacting this critical information)

The sad fact is that McPherson likely was, and still is, clueless.

HE is a huge problem for California's election integrity.