The Big Gamble on Electronic Voting

Every 15 seconds or so, however, the rogue program checks the internal vote tallies, then adds and subtracts votes, as needed, to reach programmed targets; it also makes identical changes in the backup file. The alterations cannot be detected later because the total number of votes perfectly matches the total number of voters. At the end of the election day, the rogue program erases itself, leaving no trace.

HANGING chads made it difficult to read voter intentions in 2000. Hotel minibar keys may do the same for the elections in November.
By RANDALL STROSS / New York Times / September 24, 2006
Illustration by the New York Times
Go to original.

The mechanics of voting have undergone a major change since the imbroglio that engulfed presidential balloting in 2000. Embarrassed by an election that had to be settled bythe Supreme Court, Congress passed the Help America Vote Act of 2002,which provided funds to improve voting equipment.

From 2003 to 2005, some $3 billion flew out of the federal purse for equipment purchases. Nothing said “state of the art” like a paperless voting machine that electronically records and tallies votes with the tap of a touch screen. Election Data Services, a political consulting firm that specializes in redistricting, estimates that about 40 percent of registered voters will use an electronic machine in the coming elections.

One brand of machine leads in market share by a sizable margin: the AccuVote, made by Diebold Election Systems.

Two weeks ago, however, Diebold suffered one of the worst kinds of public embarrassment for a company that began in 1859 by making safes and vaults.

Edward W. Felten, a professor of computer science at Princeton, and his student collaborators conducted a demonstration with an AccuVote TS and noticed that the key to the machine’s memory card slot appeared to be similar to one that a staff member had at home.

When he brought the key into the office and tried it, the door protecting the AccuVote’s memory card slot swung open obligingly. Upon examination, the key turned out to be a standard industrial part used in simple locks for office furniture, computer cases, jukeboxes — and hotel minibars. Once the memory card slot was accessible, how difficult would it be to introduce malicious software that could manipulate vote tallies? That is one of the questions that Professor Felten and two of his students, Ariel J. Feldman and J. Alex Haldeman, have been investigating. In the face of Diebold’s refusal to let scientists test the AccuVote, the Princeton team got its hands on a machine only with the help of a third party.

Even before the researchers had made the serendipitous discovery about the minibar key, they had released a devastating critique of the AccuVote’s security. For computer scientists, they supplied a technical paper; for the general public, they prepared an accompanying video. Their short answer to the question of the practicality of vote theft with the AccuVote: easily accomplished.

The researchers demonstrated the machine’s vulnerability to an attack by means of code that can be introduced with a memory card. The program they devised does not tamper with the voting process. The machine records each vote as it should, and makes a backup copy, too.

Every 15 seconds or so, however, the rogue program checks the internal vote tallies, then adds and subtracts votes, as needed, to reach programmed targets; it also makes identical changes in the backup file. The alterations cannot be detected later because the total number of votes perfectly matches the total number of voters. At the end of the election day, the rogue program erases itself, leaving no trace.

Read the whole story