State: E-voting open to hacking

By: CHRIS BAGLEY - Staff Writer | Friday, July 27, 2007 11:48 PM PDT

Voting machines used in Riverside and numerous other California counties are vulnerable to manipulation by politically motivated hackers, according to computer scientists who examined the machines at the behest of the state's chief elections official.

A team of computer scientists hacked into the Edge II touch-screen systems used in Riverside and a dozen other counties, according to a report released Friday. The report laid out eight ways the system could be infected by rogue software capable of changing votes, including seven ways the team said it had successfully tested this summer on the actual Edge II systems manufactured by Sequoia Voting Systems.

The report, produced by two UC Santa Barbara computer scientists, paralleled scientists' reports on other electronic voting systems, which were released Friday by Secretary of State Debra Bowen.

In a conference call with reporters, Bowen said she expected to issue new guidelines for voting machines by the end of next week. Bowen plans to recertify, decertify or require modifications to each voting system after reviewing the security reports, which she said she herself received only Friday. Bowen plans a public hearing Monday to get feedback from county-level elections officials and voting-machine manufacturers.

"These reports are only one piece of the decision-making process on what we should do," Bowen said. "My duty is to determine whether any of the flaws are so great that they cannot be offset" by individual counties' security procedures.

The computer experts conducted the tests over a period of several weeks in conditions that weren't necessarily similar to what most voters and elections workers encounter.

But the scenarios described in the Sequoia report were also plausible. In four of the eight scenarios, an outside hacker infects the computer system with software code that causes individual votes to record incorrectly. Voting the full ballot and examining the printed paper receipts can help voters correct such "mistakes," but when a voter does so, the code can temporarily switch off to avoid detection, according to the report.

Another scenario described a junior elections employee being able to infect an entire Sequoia system with software that would change votes and other election data in large numbers.

A Sequoia official declined to comment, saying that company representatives hadn't observed the testing process or had time to fully digest the report, which they also received Friday. A Riverside County elections official said Bowen had pledged to provide Sequoia and other manufacturers with detailed technical versions of the reports by Monday.

Riverside County supervisors have asserted that the 3,700 Edge II machines used at the polls are secure as used by county elections staff and that any system is open to fraud in the absence of oversight. Several have repeated that assertion since an advisory panel recommended that the county abandon touch-screen systems, which it led California in adopting in 1999 and 2000. Supervisors now plan to decide the issue in September.

Supervisor Jeff Stone, a particularly vocal defender of the Edge II, repeated his previous stance Friday after the reports' release.

"Any system, electronic, paper or manual, is subject to fraud in the appropriate environment," Stone said.

Tom Courbat, a Murrieta resident who has frequently criticized Riverside County's use of the Edge II, said Stone misses the point.

"There are five ways to throw a paper-ballot election and 120 ways to throw an electronic election," Courbat said.

Registrar of Voters Barbara Dunmore echoed Stone's confidence, noting that the reports didn't necessarily describe real-world conditions. No such hacking attempts have been documented in actual elections, either in Riverside County or elsewhere, Dunmore and Stone have frequently noted.

As chief of the Senate Elections Committee in 2005 and 2006, Bowen, a Democrat from Redondo Beach, authored several pieces of legislation intended to make the voting process more secure. She was elected secretary of state in November after promising closer oversight of voting systems.

Soon after taking office in January, she announced her intentions to test the machines extensively, saying they had been certified without sufficient examination.

Federal law requires all states' voting systems to be certified by private-sector testing labs, but Bowen and skeptical citizens groups have argued that the labs are beholden to the manufacturers that fund the process.

Courbat praised the results as independent of the manufacturers' influence, saying they publicly validated conclusions that multiple computer scientists had already reached. He predicted that Bowen would disallow all touch-screen systems next week after reviewing the reports.

"It is encouraging to know that there is a way to prove that these systems are not impenetrable," Courbat said.

The report on the Sequoia system that includes the Edge II terminals is at www.tinyurl.com/2a6oza. Contact staff writer Chris Bagley at (951) 676-4315, Ext. 2615, or cbagley@californian.com.

Next
Bookmark and Share

Advertisement

Pre-Registration Comments[-]Go to Top

Three strikes wrote on Jul 28, 2007 12:30 AM:First the Election Integrity folks (SAVE R VOTE, etc.) study the problems and report the dangers and suggested ways minimize them to the Board of Sups (BOS). The board turns a deaf ear. Then the BOS' hand-picked "Blue Ribbon" Elections Review Committee points out the same problems and even more, and makes recommendations (return to paper ballots), and the BOS forms a committee to study the committee report. Now the Secretary of State (SOS) issues the most damning of all reports - pointing out nearly a dozen ways to easily penetrate the Sequoia voting system, stating more would have been listed with just a little more time. The SOS will make her final ruling on Friday, August 3rd, leaving 6 months (as provided by law) for the county to find the "right" way to conduct an election. Any 1000 to 1 bets now by Supervisor Jeff Stone as to what the SOS will recommend? "Decertification!" And after spending $30+ million foolishly, after repeated warnings of the inappropriatness of throwing good taxpayer dollars after bad, the BOS will likely still fight to keep their favorite Sequoia voting machines. The President of the California Association of County Elections Officials (CACEO) has gone so far as to say counties just may decide to disregard the law and the decertifications and run elections on the flawed machines - the heck with what anybody says. Now what level of government is giving them the idea that they can disregard the law like that, and treat voters as second-class citizens? I wonder!

Does Not Compute wrote on Jul 28, 2007 12:44 AM:Supervisor Stone says any voting system is subject to fraud, but it looks like Sequoia's machines are worse than Diebold's. Locks bypassed with a screwdriver, plastic covers and multiple ways to manipulate software make Sequoia the worst of the worst. But according to Stone, election fraud is just a way of life in America. Is he a cyborg?

This is a real concern wrote on Jul 28, 2007 7:14 AM:Please, let's just go back to paper ballots. I want to know my vote is counted correctly! I can't beleive the State is just getting to this issue. This tampering issue has been a problem for years.

Stephan wrote on Jul 28, 2007 7:52 AM:When power and money are at at stake, there will always be cheating.... Why are we even going this direction? I work with computers and I have never seen a computer system that is totally hack-proof. They can all be broken into if someone is given enough time and resources. Are we really naive enough to think that no one is going to actually do this? The easiest way possible to hack a system is with help from someone on the inside. Why couldn't a candidate buy off someone who knows the program or system to aid him in throwing the election? I think the government is looney tunes for even trying to set up a system like this. The whole system will probably have more holes than swiss cheese. Remember, all the hub-bub about hanging chads.... now we will have to deal with computer hiccups or hacker digressions, etc...

A voter wrote on Jul 28, 2007 8:42 AM:Does this really surprise any thinking person? Request your permanent absentee ballot now and vote on a written ballot. If you don't want to mail it, you can drop it off at your polling place. Please don't use these machines if you want your vote to be counted- use paper!And EVERY polling place should have printed ballots just like an absentee ballot. These are the old scan-tron type forms that we all used in junior high school. Then there IS a permanent record. Call the voter registrar today and ask them for absentee/scan-tron ballots.

No Way! wrote on Jul 28, 2007 8:51 AM:I'm not in favor of Barbara Dunsmore "disenfranchising" me, and many of my neighbors AGAIN by not mailing the absentee ballots ON TIME, and picking & choosing which ballots she wants her crew to deliver to us. I'd rather take the extra time to volunteer at the polls than be cheated again on my voting priveleges!

Open Source wrote on Jul 28, 2007 9:11 AM:This report points out what any computer savvy person knows. Software is full of bugs and security holes. This is why Microsoft and other companies deliver regular patch bundles. Going to an open source system that allows all people to examine the code and system is the only way we can begin to trust a software voting system. However, even open source is vulnerable after it's in the field subject to manipulation by over zealous poll workers. A great method for ensuring your vote is counted is to receive a receipt with your votes and a number. You can enter this number into the voting registrar's web site to ensure they match. This provides an audit trail that is open for all to see.

John wrote on Jul 28, 2007 11:21 AM:If there are only "5 ways to throw a paper ballot election, and 120 ways to throw an electronic ballot election", then it's clear the electronic voting method should be OUTLAWED! At least precaution's can be taken against the "5 ways" aginst "throwing" the paper ballot election. ELIMINATE THE E-VOTING!

susan wrote on Jul 28, 2007 3:12 PM:Dunmore and Stone say no such such hacking attempts have been documented in actual elections. The real questions is, HOW WOULD THEY KNOW? By its very nature an program designed to switch votes every 20 persons or so would be virtually undetectable. It is disheartening to say the least that these individuals would continue to defend a system that is so porous (made even more so by the ROV's apparent inability to keep a secure chain of custody from the voting stations to the counting sites and the "sleepovers wherein machines are left unsecured at voting sites several days before the actual election). Flood the sups. with calls demanding a return to paper ballots and observed counting. Remember, they work for US.

Bill wrote on Jul 28, 2007 9:49 PM:If any blame is to be placed, lay the blame on our adversaries the Voting System Vendors. The founding members of the Voter Verified Paper Ballot Movement agree that the results of the Holt Hoyer HR 811 compromise is "to little to Late "in Washington. We the people do not stand a chance with the well funded Vendor controlled Lobby which has Usurped our years of work. After the California's SOSs "Top to Bottom" review, the Vendors no longer can lie to the public about DRE Security issues. Decertification of the Vendor's DREs is the only legitimate path Election officials can Take, unless they are on the Take. The Citizens of Florida feel more & more disenfranchised with upcoming Federal HAVA Legislation. Federal Law is being written by the Corporations, just like the Vendors were allowed to do in Florida under Jeb Bush. Money does the talking for the Voting System Vendors in Washington. Where's the People's Voice? Why do Corporations and their Vendor Lobbyists have more say than Citizens? Corporations do not have the right to Vote. Corporations need to get out of the Citizen's Elections. If ER Activist want to solve these proprietary issues in our Elections? Then Banning proprietary source code is a Band aid, not a fix. To fix Corporate corruption within our political system means the following will take the rest of our lives; "We must return Elections to the Citizens by stopping privatization of Government, Abramnoff Lobbyists and the abuses of power political parties bring to this volatile mix." Citizen Bill PS. Now Florida's recent Victories in the State Senate are at stake.

Mr. Chad wrote on Jul 29, 2007 1:48 PM:Hi I'm Chad. I'm the guy you all looked at in 2000. I lived in Florida at the time. Everyone was looking at me after the 2000 election. I was touched, manhandled, womanhandled and held up to bright lights. I was questioned, prodded, poked and glared at. I was the subject of controversy. I was soon disCARDED because I was full of holes. I was dumped for a new form of vote counting, DRE's. DRE's or DREE and I call my friend, was found out years later to have more holes than me. Sort of a holier than thou attitude he had. He was better, beefier and was SUPPOSED to cost less, gain more use and be foolproof. So it seemed. We now find out that my friend is sometimes a fiend. He can be bought. He can be compromised. We'll I guess I wasn't so bad after all. I really didn't mind all that touching. The lights were not so bad. I actually miss the spotlight! At least I can be COUNTED upon to do the job. And if you don't believe me the first time you can take a second, third and fortieth look. I don't mind it. I can handle it. I'm very transparent and I don't lie. Paper or plastic, that's my motto! After all, who wants to be plastic? Thanks for reading my story. By the way, my full name is “Dangling” Chad.

Stone Age wrote on Jul 29, 2007 2:03 PM:Jeff, when are you going to finally admit you and your buddies who bought these machines were WRONG? Jus because Riverside was one of the first biggest counties to buy (into) these DRE's does not mean Riverside is king. Just admit you made a king-sized mistake in buying TWO sets. By the way, why two sets? Oh yeah, you had to get ride of the damning data on the first set. Yeah baby!

REVOLT! wrote on Jul 29, 2007 2:07 PM:Enough is enough! Time to pull the plug on these machines. No more debate, no more talk and NO MORE studies! If our Supervisors won't toss them than we will toss them (Supervisors). Listen up boys, do it or be put out to pasture. The clock is ticking.

How To Win A Contest wrote on Jul 30, 2007 1:07 PM:1. Make up your own rules 2. Exclude opposition. 3. Have lots of people too ignorant to know the difference.

Registered Comments[-]Go to Top

Advertisement

Videos