Registered: Aug 2000
Location: In a Blue, Blue State
Posts: 13332

Touchscreen Hack Effort Called 'Monkey Business'
Thursday, September 23, 2004
By Joseph Bacchus and Stacy Kaper

Critics of the Diebold touch-screen voting machines turned their attention Wednesday from the machines themselves to the computers that will tally the final vote, saying the outcome is so easy to manipulate that even a monkey could do it.

And they showed video of a monkey hacking the system to prove it.

In the minute-long video produced by Black Box Voting (search), Baxter the chimp is shown deleting the audit log that is supposed to keep track of changes in the Diebold central tabulator, the computer and program that keeps track of county vote totals.

Black Box Voting founder Bev Harris said the demonstration shows that the system — which will be used in more than 30 states, including Maryland — is dangerously inadequate when it comes to stopping election fraud.

But a Diebold spokesman insisted that the system is secure despite "incessant" criticism from organizations such as Black Box Voting.

"The fact of the matter is what you saw was a staged production ... analogous to a magic show," said David Bear, the Diebold spokesman.

Even if the system could be hacked, he said, it could only be done by a person with "unfettered access to the system." Bear noted that elections are not just the machines, but also the people who work the elections.


"Quite honestly it's somewhat insulting to elections officials and volunteers," he said to the idea that elections officers would tamper with vote results.

He cited "multiple levels of redundancy" that would ensure that "any deviation would immediately be noticed" and dealt with.

But Black Box Voting on Wednesday demonstrated two quick ways that "an unscrupulous person with no computer skills whatsoever" could sabotage vote totals, according to Associate Director Andy Stephenson.

The entire voting record can be deleted by choosing "reset the election" on a drop-down menu, he said, or a hacker can destroy a tabulator's ability to recognize ballots by un-selecting three checkboxes on a program control panel.

Once those changes are made, a hacker could cover his tracks by deleting the audit log, as Baxter did.

The Diebold central tabulators use a program called "GEMS" that saves vote totals in Microsoft Access, a Windows-based database program.

GEMS (search) requires users to enter a password to access the vote totals, but Harris showed that the totals can also be opened -- and altered -- with Access, without ever running GEMS.

Because Access functions are already built in to the Windows operating system, the totals could be altered even if a computer did not have Access installed on it, said Herbert Thompson, a computer security expert who teaches at the Florida Institute of Technology (search). He demonstrated how to change vote totals with a six-line program in Microsoft notepad, "a simple text editor" that comes with all copies of Windows.

But Maryland election officials agreed with Bear that no hacking can happen unless the hacker is physically at the computer. The central tabulators are safe from any such outside tampering, said Donna Duncan, director for the Maryland State Board of Elections election management division.

State elections officials also said Wednesday that they are confident they can protect the system from a decidedly lower-tech threat.

Elections administrator Linda Lamone (search) said she told Maryland State Police and the Governor's Office of Homeland Security in a conference call Wednesday that contingency plans are in place, should a terrorist attack or weather disaster occur during the election.

Without going into details, Lamone told the Election Law Subcommittee of the House Ways and Means Committee that alternative polling sites have been identified and the elections board is prepared to handle a recount, should it be necessary.

"We probably have the most secure system in the nation," said Lamone, adding that her office is working with state police to "go over and above" security measures currently in place.

Lamone, who was dismissed earlier this month as elections administrator before winning a stay from the state's highest court, said all of Maryland's voting machines were upgraded this summer and are on schedule to be used Nov. 2. She said the machines will also undergo a series of security tests before and on the day of the election.

She did not discuss the potential for outright acts of aggression at the polls, something that worries Nancy Dacek, president of the Montgomery County Board of Elections.

Dacek said Wednesday that she fears that critics of the new voting system may try to physically sabotage the machines. She pointed to a recent incident in which a poll judge had to be ordered to return a voting machine that was used for demonstrations at an suburban folk festival.

As a precaution against such sabotage, some Montgomery County machines will not be set up until the morning of the election, rather than the usual night before.

Republican Delegate Jean Cryor told Lamone she hopes the state is ready for whatever happens after the election.

"I think votes will be challenged all over the state," she said.

http://www.foxnews.com/story/0,2933,133214,00.html

-----------------------------------------------------------------------------------

My faith in e-voting just went as negative as possible.

Report this post to a moderator | IP: Logged

Registered: Sep 2000
Location: Kansas City
Posts: 7504

At this point, the public's perception of the system as being vulnerable to fraud is as big a problem as its actual vulnerability to fraud.

Paper ballots, for chrissake! Spare everyone the frenzy.

Report this post to a moderator | IP: Logged

Registered: Sep 2001
Location: ........
Posts: 15056

Luddite

Report this post to a moderator | IP: Logged

Registered: Oct 2000
Location:
Posts: 9397

Clearly its Bill Gates (Ape overlord) attempt at taking over the world!

I think he's going to win.

Especially since he leads the black monkey's whome everyone knows are unstoppable.

Report this post to a moderator | IP: Logged

Registered: Jul 2000
Location: Location Location
Posts: 26484

What's maddening about this is it isn't particularly hard to see coming.

Both teams have hired scores of laywers and pledge to fight like hell on this. All it takes is one of the campaigns in any of these states to say "We demand a recount", or "what about this irregularity", to which they'll reply "We don't do recounts", or "just trust us, bub, everything went fine, you have our word," and boom, Supreme Court and utter madness.

Whether or not you believe concerns are justified or not, do you think this stuff has been vetted and litmus tested enough to hold up under amazingly sharp public scrutiny and Supreme Court level judicial review? Because if not, it's a problem, and even the notion that it might not be means it'll likely end up there.

__________________

[Ignore Sig]

Report this post to a moderator | IP: Logged

Registered: Jul 2000
Location: Minneapolis, MN
Posts: 10318

I personally think this is a bigger problem than people realize. I think the total lack of response is not only disturbing, but telling, and I seriously hope it's addressed publically, and these systems are replaced. Trust our election officials? What!?!?!?! Would they be election officials if they werent heavily involved in politics to start out with?

Report this post to a moderator | IP: Logged

Registered: Jul 2000
Location: Minneapolis, MN
Posts: 10318

And before the bush-backers come screamin liberal conspiracy, this is a long ongoing story which is just starting to get a tiny bit of the press it deserves, and it's more of a republican conspiracy than anything, funny the companies involved have made substantial contributions to the republican party...

The fact that any company with the slightest political ties could be involved in any way with our voting, much less escape any sort of reprimand or more appropriately termination for their obviously fraudulent tactics, is beyond me.

It's quite interesting, and you won't find it in the papers or on FoxNews, check it out

Last edited by Dingle on 09-24-2004 at 11:03 AM

Report this post to a moderator | IP: Logged

Registered: Jul 2001
Location: Norfolk, VA
Posts: 4731

I've had no faith in Diebold since their ATMs were all knocked offline by Blaster.

The fact that they have not even "created" a solution--just spent a shitload of money to get some nerd to make them an Access database--also bothers me. Using a robust industry standard (like SQL) or heavy encryption and all that is apparently beyond them. I could think of a better voting setup in my sleep.

That said, I have to point out that the criticisms in this article are pretty fucking stupid. I've been just noticing this of tech writers who are concerned with hacking--at first I just thought that they were being inaccurate because they don't know any better. Now it's apparent after reading Diane Kennedy's hyperactive ranting about blacklists that these writers put agenda first, accuracy second.

In this case the agenda (Diebold = teh suck) is a laudable one, but fuck, they don't have to bullshit to make their point. Having a monkey delete an audit log is a bullshit stunt (albeit a funny one). Likewise the claims that "Access is a part of windows"--no, it's a part of MS Office, which can be removed. This inanity doesn't shoot holes in the essence of the story (which, again, is "Diebold = teh suck") but the author is a friggin idiot in his own right.

Report this post to a moderator | IP: Logged

Registered: Jul 2000
Location: Minneapolis, MN
Posts: 10318

it said there is access functionality built into windows, not that access is part of windows. There very well may be, I don't know, but I don't doubt MS would embed code into their OS which would help their product run faster and interoperate with other MS products better.

Report this post to a moderator | IP: Logged

Registered: Oct 2000
Location:
Posts: 9397

Im reminded of an episode of Dilbert by all this shinanigans.

Report this post to a moderator | IP: Logged

Registered: Oct 2001
Location:
Posts: 18340

The Dems got LBJ elected to the Senate with a simple box and some ballots from dead people. I don't see how any system is beyond being compromised if there is a political machine in place.

Report this post to a moderator | IP: Logged

Registered: Aug 2000
Location: In a Blue, Blue State
Posts: 13332

quote:

---

Originally posted by Mugtoe
The Dems got LBJ elected to the Senate with a simple box and some ballots from dead people. I don't see how any system is beyond being compromised if there is a political machine in place.

---

Report this post to a moderator | IP: Logged

Registered: Oct 2001
Location:
Posts: 18340

so the simple solution is for everyone to vote absentee then?

Report this post to a moderator | IP: Logged

Registered: Jul 2000
Location: Location Location
Posts: 26484

Both the Bush campaign and the DNC have suggested it.

__________________

[Ignore Sig]

Report this post to a moderator | IP: Logged

Registered: Aug 2001
Location: Hilbert Space
Posts: 35763

quote:

---

Originally posted by Mugtoe
The Dems got LBJ elected to the Senate with a simple box and some ballots from dead people. I don't see how any system is beyond being compromised if there is a political machine in place.

---

Report this post to a moderator | IP: Logged

Registered: Jan 2003
Location: mediocre apartment
Posts: 2649

How hard would it be to attach a little printer to the voting machine that would mark a little X in the Bush column when he got a vote and a little X in the Kerry column when he was chosen? That way, at least, there would be a little (well, big I suppose) peice of paper physically documenting the count. This seems like a very simple solution to this "crisis," what are the aspects am I not seeing that are preventing this from being done?

Report this post to a moderator | IP: Logged

Registered: Apr 2004
Location: Den
Posts: 11596

Willimo, I think we're a little late here, but yeah, or what about a piece of paper with the names in little boxes where you cross out who you're voting for?
That's how we do it over here.

Report this post to a moderator | IP: Logged