New tests fuel doubts about vote machines (US)

[OneFootInTheGrave]

http://www.miami.com/mld/miamiherald/news/13410061.htm

I will take out a few snippets

Ion Sancho, Leon County's election chief, said tests by two computer experts, completed this week, showed that an insider could surreptitiously change vote results and the number of ballots cast on Diebold's optical-scan machines.

hack one

Sancho first clashed with Diebold in May, when he teamed up with a nonprofit election-monitoring group called BlackBoxVoting.org, which has made a crusade of showing that electronic voting machines are subject to fraud. BlackBox hired Herbert Thompson, a computer-science professor and strategist at Security Innovation, which tests software for companies such as Google and Microsoft.

Thompson couldn't hack into the system from the outside. So Sancho gave him access to the central machine that tabulates votes and to the last school election at Leon County High.

Thompson told The Herald he was ''shocked'' at how easy it was to get in, make the loser the winner and leave without a trace. The machine asked for a user name and password, but didn't require it, he said. That meant it had not just a ''front door, but a back door as big as a garage,'' Thompson said.

From there, Thompson said, he typed five lines of computer code -- and switched 5,000 votes from one candidate to another.

''I am positive an eighth grader could do this,'' Thompson said.

hack #2

Sancho said he tried to discuss the problems with Diebold, but met with resistance. On Monday, he did one final test with Hursti at the Leon County supervisor's office, Hursti hacked the memory card to spit out seven ''yes'' votes on an issue and one ''no'' vote.

Then, six ''no'' votes and two ''yes'' votes were cast into the machine the same way voters would. Those results didn't show up in the final tally -- just the ones hacked into the card.

Officials for ES&S, which makes the systems used in Miami-Dade and Broward counties, couldn't be reached for comment Wednesday.

the main question is

But Sancho said the time for passive monitoring is over. The Diebold problems show that simple tests haven't been done on at least one major voting system, he said.

''These were sold as safe systems. They passed tests as safe systems,'' Sancho said. ``But even in the so-called safe system, if you don't follow the paper ballots, there is a way to rig the election. Except it's not a bunch of guys stuffing ballots in a precinct. It's possibly one person acting in secret changing thousands of votes in a second.''

how could such machines be sold a "safe systems" who did the testing, and was it done at all?

Anyhow an interesting development.

[Arrian]

Thompson couldn't hack into the system from the outside. So Sancho gave him access to the central machine that tabulates votes

And how easy is it to gain access to the central machine? Note that from the outside, the guy hired by the group "which has made a crusade of showing that electronic voting machines are subject to fraud" couldn't do squat...

-Arrian (whose state uses old level-activated machines that are like 100 yrs old)

[Patroklos]

So your telling me that if I give someone complete access to all hardware, connections, and software for a system and unlimited resources to compromise said system, and oh yeah no need to keep it secret, he can bypass the security?

Care to mention any system anywhere that could stand up to that? Care to mention a non-computer based system (like Arrian's) that could stand up to fraud if equivalent level of access was given?

[KrazyHorse]

Why not just ****ing count the ballots by hand like a sane country?

[Edan]

Originally posted by Arrian


And how easy is it to gain access to the central machine?

I dunno. How hard is it to get a job as a janitor or cleaning lady who has access to the room? Or to bribe the current ones?

[Patroklos]

Why not just ****ing count the ballots by hand like a sane country?

The same reason we use calculators instead of the abacus, drive cars instead of ride a horse and buggy, and watch football instead of football.

[Edan]

Originally posted by KrazyHorse
Why not just ****ing count the ballots by hand like a sane country?

We can't count?

[Arrian]

I'm thinking of this central computer and I keep hearing "would you like to play a game?"

Let's play "United States Presidential Election"

-Arrian

[Patroklos]

Everybody knows the US Government goes Skynet style anyways.

Central Computer, BAH! Idiots.

[OneFootInTheGrave]

here it is blackbox voting they are the "investigators", or at least aiding them.

http://www.blackboxvoting.org/

and the related news

http://www.bbvforums.org/cgi-bin/forums/board-auth.cgi?file=/1954/15595.html

so basically on the first question

And how easy is it to gain access to the central machine?

the answer is 3 people have high level access per location it seems.

One thousand two hundred locations in the U.S. and Canada use Diebold voting machines. In each of these locations, typically three people have a high level of inside access. Temporary employees also often have brief access to loose memory cards as machines are being prepared for elections. Poll workers sometimes have a very high level of inside access. National elections utilize up to two million poll workers, with hundreds or thousands in a single jurisdiction.

[Garth Vader]

Originally posted by Arrian


And how easy is it to gain access to the central machine?

Considering that the owner of the company promised to deliver Ohio to the Republicans, the people likely to want to make changes already have access to the central machine. Since there is no way to verify the result afterwards I'd think you should be worried.

[OneFootInTheGrave]

Originally posted by Patroklos
So your telling me that if I give someone complete access to all hardware, connections, and software for a system and unlimited resources to compromise said system, and oh yeah no need to keep it secret, he can bypass the security?

Care to mention any system anywhere that could stand up to that? Care to mention a non-computer based system (like Arrian's) that could stand up to fraud if equivalent level of access was given?

Ummm well perhaps using the high level equipment, but here it seems more like if you have access you can rig votes, and IMHO you shouldn't be able to do that with voting machines.

I guess this was disputed all allong "that it can be done" let alone that it is so easy to do, without leaving any trace at all (as far as I understand, that you don't need to log in individually and that vote number is not traced somewhere).

[Patroklos]

But, alas, no evidence of fraud.

Nice to know Canada uses the same machine, though they seem mature enough to not throw temper tantrums when they lose elections.

[OneFootInTheGrave]

Originally posted by Patroklos
But, alas, no evidence of fraud.

Nice to know Canada uses the same machine, though they seem mature enough to not throw temper tantrums when they lose elections.

No not fraud, but just voting machines that can easily be rigged.

Well Canadians use it too, sure one would think they want them to be "safe" as well.

[Patroklos]

but here it seems more like if you have access you can rig votes, and IMHO you shouldn't be able to do that with voting machines.

Just like non-computerized voting machines. I bet access to them in the various stages of ballot movement is far greater.

I am not sure what you want this article to prove?