MichaelMoore.com

3 states issue directives to relieve security flaw in e-voting

By Dan Goodin / Associated Press

SAN FRANCISCO - Officials overseeing elections in three states have issued notices directing local authorities to take additional steps to prevent election fraud through a popular type of electronic voting machine.

Officials in California, Iowa and Pennsylvania said they issued the directives in recent weeks after researchers discovered a feature that could allow someone to load unauthorized software on Diebold Election Systems Inc.'s computerized machines.

A hacker theoretically could use the software to rig or sabotage an election or to perform some other unauthorized function, said Michael Shamos, a computer science professor at Carnegie Mellon University.

"It's worse than a hole," said Shamos, who has been briefed on the vulnerability of the Diebold machines. "It's a deliberate feature that was added by Diebold that we all believe is unwise."

In the wake of the ballot-tabulating problems that plagued the 2000 presidential election, electronic voting has become a flash point for many people concerned about fair elections. Critics charge that electronic voting machines are too susceptible to fraud and error to be trusted and should not replace traditional balloting until proper safeguards are in place.

Diebold spokesman David Bear said there is no evidence electronic results have been subject to tampering. He added it would be hard for anyone to exploit the recently discovered flaw if officials follow security procedures already in place, but that Diebold is developing a permanent solution to address concerns.

The additional safeguard spelled out in the directives "is one more redundancy to ensure the security of the election," he said.

Pennsylvania's department of state warned local election registrars last week about the vulnerability in the mechanism that installs and upgrades software on Diebold equipment. It said the risk of the vulnerability being exploited was "low" because a person would need physical access to the machine's memory card slot while the system was being booted up.

Until North Canton, Ohio-based Diebold delivers a permanent solution, the notice instructed local officials to reinstall the authorized software just before testing the machine and certifying it for use. Directives issued in California and Iowa called for similar procedures to be followed.

Diebold machines are used in 16 of Pennsylvania's 67 counties, said Leslie Amoros, a spokeswoman for the Pennsylvania Department of State. Pennsylvania's primary election is scheduled for May 16.

In California, 12 of 58 counties use Diebold machines with the vulnerability, according to Jennifer Kerns, a spokeswoman with the Secretary of State's office.

About 30 percent of counties in Iowa use electronic voting machines, affecting about 7 percent of voters in that state, said John Hedgecoth, a spokesman for the Iowa Secretary of State.

The flaw was discovered by a researcher for Black Box Voting, a nonpartisan, not-for-profit organization that has criticized the security of electronic voting in the past. The group expects to release a report on the vulnerability this week, said director Bev Harris.