51 Capital March - Blackbox Voting

The election fraud exhibited in the November election, facilitated by the loss of paper trails and "dirty" voting systems, has resulted in the loss of trust in the integrity of our votes. E-voting machines in and of themselves can be easily compromised and manipulated. Bev Harris's Black Box Voting - Chapter 7 sample (If you would like to support the author and publisher of this work, please visit http://www.blackboxvoting.org/support.html. This book is available in paper back at Plan Nine Publishing, www.Plan9.org) reveals the vulnerabilities and threats to vote processing integrity one such widely deployed system contains. (Also, seeDIEBOLD EXPOSED). Furthermore, there are ample 'incidents' of e-voting system so-called 'failures' or 'glitches' in the 2004 November election: see EIRS, Verified Voting.org's 2004 Election Incident Reporting System. the threat transcends the machine we vote on. The really interesting thing about these reported machine 'glitches' and 'failures' is, for each machine model and system type, the very same 'glitches' and 'failures' were consistently reported across the country, wherever each machine/system was used. This, in systems promoted as being designed and developed under one of the IT industry's most stringent software development standards: ISO 9000. Indeed, as an IT systems professional, I know of no professional developer who would design a voting system which can so easily manipulate votes as those systems described here.

Keep in mind these voting systems, while complex, are designed and developed using rigorous requirements, methodologies, planning, and testing. If such a system performs functions consistently and reliably, you can be assured those functions were designed into the system. Let me give you a real example:

DIEBOLD's GEMS software allows systems to be easily configured to default to a specific candidate. When you first approach such a voting machine, a specific candidate is selected before you do anything (interestingly, all default configurations uncovered to date defaulted to George Bush in the 2004 election).
Such machines can also be configured to provide a "feature" whereby voters can choose to vote by selecting a particular party's entire slate of candidates (say, all Democratic candidates, for example).
Also (and this is a very interseting feature), these voting machines can be configured to exclude a candidate selection from being recorded in a given race (say, the Presidential race, for example) when a voter selects to vote a party's entire slate of candidates. WHY???

So, a voter approaches one such e-voting machine, selects to vote the Democratic slate, but as the machine has been configured, no vote is selected for John Kerry and the presidential race defaults to registering a vote for George Bush.
OK, you say, but surely the voter will see this! Right? Well, here is where the system configuration begins to take on the characteristics of an intended and designed exploit:
On DRE machines (touchscreens), the ballot opens for voter review and verification at the very bottom of the ballot, such that battot verification occurs in reverse order from the way the ballot was originally presented to the voter for voting. The presidential race is the first item on the ballot. In order to notice the 'wrong' vote selected for President, it becomes incumbant on the voter to scroll back up through the entire ballot in order to see the 'error' or 'glitch' that has occured. Certainly some voters would conscientiously do such a thorough examination before confirming their votes. Others, however, would not.
So, the voter is unknowingly operating in a "voter beware" environment configured into the voting machine. Never mind that someone is in a hurry, or the ballot is pages long, or the voter has to pass by vote after vote for Democratic candidates to 'discover' the first and only the first candidate selected is wrong!
OK, you say, but this is purely hypothetical! Right? WRONG! This very exploit was described and reported occuring across the country on DREs of various manufacturers (including the DRE I voted on!) and with similar exploits reported on scanning systems as well. Unfortunately, we can never know how many votes were incorrectly cast due to this exploit, but we can know the exploit existed due to voter reports, and we do know these electronic voting systems were "designed" to enable the ability to fool voters.

This brings me to 2 central points, largely ignored, regarding electronic voting systems:
Voters never see their ballot that is counted
Ballots are counted in secret
In these electronic voting systems using scanners and touchscreens, what the voter sees is not the ballot that is counted. The voter sees only a representation of the ballot and casts only a representation of votes. Here is what I mean by that:
On both interfaces (scanners and DREs), a voter's input (touching the screen, marking a paper ballot) is interpreted by a highly configurable and customizable program and is translated into a data record in a database table (like a row in a spreadsheet composed of columns of data).
It is this data record that becomes the voter's ballot that is counted. This is the REAL ballot, the one that is counted, and the voter never sees this ballot.
Is the interpretation correct? Obviously NOT in the real life example I provided above. Is there any opportunity for the voter to examine this REAL ballot? NO!
So, the voter never sees the ballot that gets counted; never has an opportunity to verify the accuracy of the ballot that gets counted; and never has an opportunity to challenge or correct errors in this ballot that gets counted.

Not only is the accuracy of ballots unverifiable in these electronic voting systems, the counting of votes is hidden as well - a fact that violates the Constitution, BTW! Voters have no access to the databases that store the data records that are the real ballots (those that are counted) and that are used to tabulate the vote totals. As you will discover in How to Hack the Vote, these tabulating computers ('tabulators') are so insecure, vote totals can be changed (even reversed) without any trace, in under 2 minutes, and, in some cases (such as in Ohio!), remotely over the Internet. Because electronic tabulators process vote totals unseen by any human, they entirely violate our process of open and verifiable elections.
Aw, you say, but computers do simple addition all day long - its what they do best! Count the rows in a database table and a computer will get the same result every time, right? Well not quite. Of the few audits conducted after the 2004 election NOT ONE AUDIT or machine recount delivered the same result as that reported as the final vote count! Seems our faith in tabulators is a little ill founded. And why, if tabulators are so accurate, as reported in John Conyer's subcommittee report investigating Ohio election irregulariies, did a Triad Systems computer technician, after reconfiguring tabulators in 'preparation' for a so-called recount audit, post the 'official' final vote count in the election office housing the tabulators and 'instruct' election workers to ignore the audit totals and use the posted vote total number he conveniently provided instead (This REALLY DID HAPPEN!)? WHY???
Tabulator PCs are at the heart of 'dirty' voting systems prevalent in 2004. They also counted 80% of the vote in 2004. States with as few as 2 counties with electronic voting machines (like Ohio), by contractual agreement with the electronic voting system vendors, are required to count (tabulate) all votes in the state using the vender's tabulating PCs and software. The 'required' tabulators accept and count the votes from all precincts, regardless of the voting machine employed. Additionally, processes, procedures, and constraints for recounts and audits are contractually stipulated with the vendors as well. Vendors designing electronic voting systems know beforehand exactly how an audit or recount will be performed and, in most cases, provide 'special' configurations under which such audits and recounts take place. That's what that Triad Systems technician was doing in Ohio. In other words, e-voting vendors are told how their systems might be tested and are allowed to change their system in preparation of any such test.

Tabulator PCs, as presently designed, offer the feature of easily changing vote totals without any trace, are highly configurable allowing a single candidate to be cofigured differently from other candidates, provide centralized control of all the electronic voting machines in a county or state, and count all the votes in a state regardless of the voting machine used. Electronic voting systems eliminate the counting of physical ballots, hide the real ballots from voters, and keep the vote counting secret. Consequently, there is virtually no way to detect malicious vote manipulation, no way to verify the accuracy of one's vote, and no way to ensure a fair election. How to Hack the Vote is a tutorial provided by one of the nation's leading "white hacker" computer security experts, Chuck Herrin. In it, you will learn how easily vote totals can be manipulated without any trace.

As you read "How to Hack the Vote", keep in mind one of the findings of John Conyer's subcommitee investigation of Ohio election irregularities. Ohio's tabulators were remotely accessed over the Internet before, during and after the 2004 election by the vendor (Triad Systems). Because these tabulator PCs were accessible by modem dial-up and/or Internet access, it doesn't take a vast conspiracy involving thousands of poll workers to massively subvert the vote. A handfull of connected PCs is all one needs to alter election results by millions of votes!.

These 'dirty' systems has destroyed the integrity of our voting. As it now stands, our voting systems can NOT and should not be trusted. As Americans, we can no longer look to the next election with any assurance that our votes will mean anything. The new voting systems are so easily compromised and so obviously designed to facilitate vote count manipulation that citizens are facing for the first time a future without hope. Without hope, our innate optimism is diminished, our drive to succeed impaired, and our ability to dream lost. That which makes us great as a people and a country will disappear within a generation.

With a compromised voting system, we are open to tyranny and a complete loss of control over our government and elected officials. Without any control on the exercise of power, we now face a very real threat to our democracy and our freedom. No citizen can dare sit idly by in the face of losing all that has brought our country greatness.

The Case of the Diebold FTP Site

Contents

1. Background

2. What We Already Knew

ISO 9000

Compatability and Modes of Use

Use of Third-Party Commercial Off-the-Shelf Components

Self Modifying Code

Communication and Security

3. What Can We Learn from the Diebold FTP Site

4. A Warning

5. Some Disturbing Answers

Limitations of the Hopkins Paper

6. Rebuttals