News item: Investigative journalist Bev Harris discovers that one of America's most popular electronic voting systems, based on Microsoft's popular Access database program, can be easily hacked. Her work raises fears that the system could be used to rig election results without detection ...

Billmon, I love you more than I love the concept of Ann Coulter tied to a bed and me with the Collected Works of Bill Clinton with which to flog her. But I've found that Scoop ain't always that accurate or reliable.
On the other hand, anything that one geek can program, another geek can hack, so it's not out of the question. Maybe the headline should read, "JOSH SCHMEDLAPP, 24 YEAR OLD STUDENT, ELECTED PRESIDENT -- Declares Dungeons & Dragons as the National Pastime"
sgc
On the other hand, anything that one geek can program, another geek can hack, so it's not out of the question.
Very true, and any system without a voter-verified hardcopy for recounts is equivalent to "just trust us" from the voting-machine makers.
I'll echo Stephen's post from above, as far as the source goes. They were also running that "Katherine Harris dead in a plane crash" story, too.
Better to err on the side of cynicism until there's further proof, I think.
Scoop is not the source here--Bev Harris is. Thanks, Billmon, for the graphic.
Everyone should check into this story, especially you computer tech whiz kids. And everyone should demand that the new touch screen voting machines leave a paper trail that can be verified by the voter and counted by hand, if desired.
Hell, I'll take Gates over Bush any day. At least he can run a profitable business.
I've never understood why Americans ever got into the idea of a voting machine. I go to a school near my house and get a paper ballot from an enumerator who crosses my name off the voter's list. I mark it with an "X" and drop it in a box in front of the enumerator.
When the polls are closed, the enumerator counts the ballots in front of representatives of the political parties. The results are telephoned to the central office where they are rolled into the totals. The ballots are resealed into the ballot boxes in case of recounts.
It is simple, cheap and difficult, if not impossible, to rig.
A machine? Why?
Tom,
In big metropolitan areas, your system would mean a helluva lot of work, and workers. I've worked the polls for a number years here in Maricopa County, Arizona (Phoenix area), and we have a best-of-both-worlds system. You mark a paper ballot, and feed it into a machine which reads the votes. It can even tell you whether you made a mistake, like voting for two candidates for the same seat, allowing you to reject that ballot and let you vote a new one. At the end of the day, the ballots are collected into two piles - one of ballots with write-in candidates that have to be manually counted (usually a much smaller pile) and one without write-ins. In the machine is a memory device with a modem, you hook the machine to a phone line, send in the results, and they are rapidly toted countywide. The memory device, voted ballots - along with unused ballots, as ALL ballots must be accounted for - and paper printouts of the tally are returned to a central location and stored under security. I won't go into the details of the verification process, but it is extensive. If a recount is necessary, the ballots can be brought out, run through the machine again, or manually counted to confirm the results.
What's troubling is that the vastly larger pile of ballots we deliver at the end of the day is the unused ballots. I've only worked one election where more than 50% of the ballots were used - 1996.
I think I will copy your graphic (OK?) to email and to make paper flyers and I will use it to introduce this esoteric topic to my local election officials. I've been pestering some of them since February when I first found the blackboxvoting.com website.
This approach--picture with humor--should help a lot. I used to think that campaign finance reform was a prerequisite to all other political reform, but a credible balloting system is surely a more basic need.
Of course, the standing joke for us is to tell voters, "OK, just feed your ballot into the shredder there."
While you're at it, drop by VerifiedVoting.org and endorse their Resolution on Electronic Voting.
BTW, I can't believe that this program is anything but a quick 'n dirty demo by a not- very- good programmer. I (or any other reasonably high- level techie) could hack together a better one in an afternoon.
Still, it speaks poorly of Diebold for leaving it on an unsecured server.
Scoop is not the source here--Bev Harris is.
Sorry, but Scoop is the source, and the source matters. I know the name Bev Harris, and I'm not disputing a thing she says, necessarily. But the source matters.
It took months for the Niger forgeries to make CNN. Like it or not, that's what's going to win or lose the election for Bush; not the thousands of web sites that ran the story months ago. It's going to be CNN, the NY Times, ABC, NBC, and CBS.
Scoop ran a story earlier in the week that breathlessly reported the death of Katherine Harris in a plane crash in Toronto. It was based on some very suspicious reporting by some flack nutcase in Florida. It was also proven to be absolutely false.
As was the Jessica Lynch story.
As was the Iraqi Children's Prison story.
As was the yellowcake story.
I'm not saying every story has be linked from the NYTimes for authentication, but give me some background on
Sludge Report #154 – Bigger Than Watergate!
Tuesday, 8 July 2003, 6:13 pm
Column: C.D. Sludge
before declaring this true.
C.D. Sludge wrote this story?
C.D. Sludge?
Yesterday, Billmon posted a link to a CapitolHillBlue story that has now been discredited.
Enough, please. We get dumped on enough when our sources are impeccable. Let's not make it easier for the other side, ok?
Yesterday, Billmon posted a link to a CapitolHillBlue story that has now been discredited.
Actually, it was earlier today, in an update to a post from the wee hours of this morning. But thanks for the tip, I've updated the update.
As for this business about the voting machines, I don't know what to think. But I really was just using the Microsoft angle to set up a gag.
I try to not pass along erroneous information, and I certainly wouldn't do it knowingly (Jeez, I'm starting to sound like Ari Fleischer) But this isn't the New York Times. I allow myself a little comic license now and again.
In big metropolitan areas, your system would mean a helluva lot of work, and workers.
This is bad? I'm not sure exactly how many temporary workers Elections Canada hires to enumerate the electorate (they go door to door registering voters) and then manning the polling station. Lots. I haven't done the job, but my mother - she was a housewife at the time - used to do it every election.
It works the same way in Toronto and Montreal and Vancouver as it does in Medicine Hat and Moose Jaw. The system is just scaled up with more enumerators and more polling stations.
The ticket is more complicated in the US and that might be a good reason.
I allow myself a little comic license now and again.
And your readers (including me) probably allow you more license than you do yourself. Which makes you one of the 4 or 5 sites I visit every 10 or 15 minutes, when I'm not mowing the lawn or making dinner.
Keep up the good work. Just stay away from suspect sources.
Here, it's mostly retirees looking for an extra $75-150 a day who man the polls. And it is a loooong day - about 14 or 15 hours, and you cannot leave for anything but dire medical emergency. It's very difficuly getting enough people to do it. As an inspector, I have the legal power to draft voters and make them work the polls. It's never come to that, but one time we worked with just 3 people running the precinct. It was a single-issue election and turnout was about 18 percent, so we got away with it.
And, yes, the ticket can be very complicated. Each and every Superior Court judge and above has to be on the ballot very 4 years - about 40 or 50 names. Plus, Arizona came into the Union at the tail end of the Progressive period, and we've got initiative and referendum. Cities, counties and the state can have issues either referred or initiated.
Sorry for prattling on about this, but the process interests me. It started one day when I voted and said to myself, "Who are these geeks I'm trusting with my franchise?" Now I am one of those geeks.
I read Bev Harris's article (yes, Scoop's still-standing link to the Katherine Harris article spoke volumes about that site) and found her reasoning flawed. The mere existence of similarly structured tables in the database could have a dozen different meanings, most of which are innocuous. And she admits herself that she has not attempted to hack either the presumed vote-count table or the audit table in situ, in the Diebold machine itself. Certainly her security concerns are worth investigating. But Bev Harris jeopardizes her considerable body of credible work by publishing something as weak as this, in a publication as shady as Scoop.
That said, as one who makes his living tapping code, I favor a return to paper ballots, coupled with a greatly tightened chain of custody of both marked and blank ballots. Such a change would be neither easy nor cheap, and Americans would have to give up their insatiable appetite for same-night election results. Any system can be cheated... any system whatsoever... but I cannot understand why any person who actually believes in representative government would want to make it as easy to cheat as apparently some voting machines do, or could, make it. Ours in Harris County, TX (that's Houston) leave no paper trail; if that isn't an open invitation, I don't know what is.
Personally, I think a lot of ill-intended people don't really want honest elections. E-voting probably suits them just fine.
Your Gates parody is hilarious... I love Bill Gates humor... but when a Republican U.S. Senator wins elections by suspicious margins obtained from machines made by a company he used to head (see Bev Harris's site, Black Box Voting), I don't think it's Bill Gates we need to worry about!
Scoop's a dog; I'm pretty familiar with it. This from their Mission Statement:
The Scoop.co.nz publication is a new media, born of the internet and populated by material of the internet. It delivers news in a totally new way – unprocessed and raw “from the horse’s mouth”.
and
The majority of internet based news services are based on feeds of news from the old - real-world – media, transcribed and regurgitated online. Scoop.co.nz is not – it’s raw news as it gets released.
IOW: unedited, ill-considered, unquestioned, totally credulous reporting. Relatively easy work for those involved, but not at all reliable.
L
Scoop isn't a dog, but nor is it the place to find reliable reporting of stories like this.
Sludge is an invention that allows them to push the envelope in regards to connecting dots that might not actually be on the same page, but the point of using such an obvious (and humourous) non de nom is to warn readers of just that. So pinch of salt etc. Sometimes this allows them to begin something that has something to it, for others to build on. You never know, this might turn out to be such.
Scoop also links quickly to stories broken on the internet and elsewhere that are too raw to be contextualised easily, so that later reports change the impression you may have initially gotten.
But on the other hand Scoop is an important Wellington institution - all major political press releases are put up on scoop, and it is the first place to get the transcripts of question time in NZ parliament (similar to the UK system). Call it multiple aspects of the same personality.
I found the Bev Harris story troubling for a different reason - I live in Senator DeWine's district (and in fact in his home town) so it bothered me to see the contributions Diebold made to his election campaign. This part of Ohio is notoriously conservative, but the town I live in is the one "liberal" stronghold, and I did suspect the reason they are really pushing to have electronic voting first in the region in our town was that they wanted to control the election results - but I had nothing with which to prove the suspicion. Now it looks more corrupt than the usual "Ohio is pro-business so of course they'll make large donations to Republican candidates" ... I wonder if I can somehow demand a paper ballot - you always could with the other machines ...
I guess it comes down to what you value in a news source. I agree that it has its uses; for parliament transcripts and other such official, don't-need-editing releases it's fast, and that's a big benefit. But they trouble is that it masquerades as and can be mistaken for a news or news analysis source. Which it ain't, at least not in any sense which places value on consideration, research, fact-checking, those sorts of things.
I'm from Wellington (though I'm not there now, so I'm a bit disconnected from it all), and while it was useful to have an alternative to the DomPost/stuff.co.nz and the TV news, it really wasn't mandatory reading for me. And a Wellington institution? I don't think so.
L
hey, kids-
the point isn't whether or not Scoop is a reliable source. The point is that ANY electronic system comes down to trusting the developers of the system. Without going into detail ad nauseum, trust a certified information systems security professional*: We need paper trails.
*that would be me, btw
Great find Billmon! I was wondering how long it would take for someone to find a flaw in those things. The fact that it's a Diebold machine is particularly troubling, especially in light of this graphic.
And here are some links to Diebold crowing about their voting systems.
I don't think we even have any law or procedure to apply in the case that an entire state's voting was proved to be tampered with other than recounting the vote.
When it became evident to me (purging of the felon's names) that Florida vote was as bogus as hell the entire state's votes should have been invalidated in my opinion.
Our government while representative should not be an excuse for the people (you and I) who actually make up the electorate to being held accountable if their elected leaders are corrupt.
Tom Benjamin: You're a Canadian probably like me. What you don't realize is that the Americans have set elections at fixed intervals, so that instead of just having a Federal Member of Parliament to vote for when Cretin (Chrétien) pulls the plug, they may have Federal (say, electors for President and Vice-President, a representative for the lower House, a Senator) State (Governor, Lt. Governor, Secretary of State, State Comptroller, State representative, State Senator, State Supreme Court judge, State Appellate Court judge, etc.) and local officials (Mayor, Councillor, Water Board member, Zoning Board member) to elect plus three or four state and local initiatives and propositions to vote on. So instead of having one position being elected at a time, you have maybe quite a few. All of which makes for some interesting reading in the voting booth.
I understand the American system and I understand how the ticket is much more complicated. Maybe that means the system needs machines.
But I don't think it is a good idea to have so many elected offices and I do think it is a good idea to simplify the system and the ballot if that is the problem, rather than go to a machine.
I think the ballot is at least one of the reasons American voter turnout is so low.
Howdy folks!
A reporter friend of mine passed your site on to me because of the comments on Bev's book.
For the record, I am the publisher, and unofficial tech consultant (before publishing I was a systems engineer for 17 years and I still keep up the systems here).
I just wanted to take a moment to address some of your comments:
About the source - Personally I am not happy with conspiratorial tone of Mr. "Sludge's" story and headlines. I have seen some of the source code in question and have not seen evidence of chicanery. What I have seen are some very curious code and structure in a program that my cat could hack. When one is serious about security, one does not use Windows CE and MS Access.
Scoop was the only media source willing to collect the files in one place and make them available for programnmers to critique. They are taking a risking a fair amount by doing so.
Is the code "production code"? - Yes it is. It is the same code used in the 2002 election last fall in Georgia and other states.
Why computers and not paper? - We are not opposed to computer voting machines (CVMs), just CVMs with secret code and no paper trail. A trusted system must have code which can be inspected and print a ballot which can be audited. A CVM allows you to create a ballot that is *unambiguous*.
President: You voted for Mr. X
Governor: You voted for Mr. Y
Senator: You voted for Mr. Z
Water bond: You voted YES.
No chads, incorrectly filled in ovals, misaligned punch pins, incorrectly scanned ballots.
The CVM industry for some reason opposes an auditable paper trail. Why should I trust them?
The CVM industry is in this to make money, not to safeguard democracy. One company is majority owned by a private Saudi firm.
Why this is a CLEAR and PRESENT danger - Let's skip the problem of rigged elections for a second. Does anyone here trust a Micrososft product to function correctly with something this important?
What happens when you get up election day and an ice storm has knocked out power state-wide? (I mention this because I have yet to find an election board who have thought of this contingency).
What happens when a subtle bug results in an entire state's vote count being reported thus?
George Bush: &^%,^75,21x votes
Howard Dean: (&+,876,t`7 votes
Ralph Nader: 999,999,999 votes
Now let's look at fraud. The US has a long and hallowed tradition of vote fraud. If a system has a weakness the weakness WILL be exploited for political and/or financial gain.
With tens/hundreds of billions of dollars riding on the outcome of presidential elections, why is it so hard to believe someone would cheat?
With a CVM, you can cheat and erase the evidence of cheating (Bev was able to edit the GEMS audit log and erase all her tracks when she changed the results of her sample election http://www.blackboxvoting.com/scoop/S00065.htm)
This software is written by Diebold, a company which makes ATM machines and other banking software. If it had a company motto, it would be "Trust no one!"
But, if you follow their philosophy on CVMs, you should walk into a bank, hand the teller your cash with no deposit slip, obtain no receipt, and trust the bank statement they send you to be correct.
I hope this helps clarify the problem. I'll check back for other comments when I get a chance.
Tom Benjamin --> When the polls are closed, the enumerator counts the ballots in front of representatives of the political parties. The results are telephoned to the central office where they are rolled into the totals. The ballots are resealed into the ballot boxes in case of recounts.
It is simple, cheap and difficult, if not impossible, to rig.
A machine? Why?
Because they're complicated, expensive, and easy to rig, of course. It's the Nu American Way!
Louis:
a Wellington institution? I don't think so.
It kinda is now, though. Public servants and parliamentary staff rely on it for quite a few things, and "I'll check on scoop" has entered the lexicon.
Rioting in Silicon Valley is a nice touch. Imagine the gnashing of teeth at Oracle HQ; Ellison is drawing up coup plans, no doubt.