Wired News
Suspect Code Used in State Votes
By Kim Zetter
02:00 AM Nov. 06, 2003 PT
An investigation by California's secretary of state has revealed that
Diebold Election Systems placed uncertified software on electronic voting
machines in a California county.
Voters in Alameda County, a densely populated region in the San Francisco
Bay Area that includes the cities of Berkeley and Oakland, used a Diebold
touch-screen-voting system utilizing uncertified software in Tuesday's
election and in last month's gubernatorial recall election.
Although the software was used in at least two elections, Doug Stone,
spokesman for the secretary of state, said voters should not worry about
the integrity of the election results. He said the state tested the
software but did not elaborate on when that testing occurred.
Stone said his office learned late last week about the possibility that
uncertified software may have been used in the machines. The state then
launched an investigation into the matter and halted certification of the
AccuVote-TSx, a newer model of Diebold's touch-screen machines, which were
supposed to be used in California's primary election in March 2004.
Marc Carrel, assistant secretary of state, surprised Diebold
representatives and others at a meeting of the state's voting systems
panel Monday by announcing that his office had received "disconcerting
information" about the company and would hold off certification until an
investigation was completed.
The AccuVote-TSx is a modified version of AccuVote-TS, an electronic
touch-screen machine that is used in Alameda and Plumas counties. Los
Angeles County also uses a small number of the machines for votes cast
prior to regular election days.
Diebold and state election officials say the TSx is lighter and more
compact than the TS and includes minor software modifications from the
previous version.
Alameda County purchased 4,000 touch-screen machines last year at a cost
of $12 million.
Before a state can use a voting system, the software and hardware must be
audited by an independent testing authority that examines the code
according to certification standards set by the Federal Election Commission.
Once the independent authority certifies the system, states can then test
and certify the systems for their polling places.
California election law requires voting companies to notify state
officials when they make changes to software after certification has been
completed. Secretary of state spokesman Stone said Diebold did not do this
when it applied a "software upgrade" to systems in Alameda County.
He said the state's investigation of the Diebold machines is ongoing.
Among the outstanding questions is when the uncertified software was
placed on voting systems and in which elections it was used.
Stone said the state would be examining "corrective steps to come up with
ways to ensure that these types of actions do not occur again."
He also said it was unclear whether any measures would be taken against
Diebold for its actions since the matter is still under review. The state
needs to evaluate the election law, he said, and investigate what happened
with the software.
Alameda County election officials did not return calls for comment. But
Elaine Ginnold, the county's assistant registrar of voters, told the
Oakland Tribune that she had no idea the uncertified software was used.
"We were upset, to say the least," she said.
The state's decision to delay certification of the new Diebold machines
means that several California counties are waiting to hear whether they
will be able to use them in the 2004 election.
San Joaquin County in Northern California has purchased 1,600 TSx machines
at a cost of $5.7 million. The machines already have been delivered, but
the county does not have to pay for them until they pass testing and state
certification.
Solano County paid $4.6 million for 1,171 TSx machines. And San Diego
County is currently in negotiations with Diebold to purchase 10,000 TSx
machines at a cost of $30 million.
Critics say the incident in California highlights a number of security
problems that have emerged since states began switching to electronic
voting machines that use proprietary software created by private companies.
Voting companies and election officials insist that rigid certification
procedures ensure the security of the machines.
But critics say the fact that Diebold could install uncertified software
on machines without the state's knowledge suggests that current
certification procedures cannot ensure the integrity of election systems
or, for that matter, election results.
Kim Alexander, founder and president of the California Voter Foundation,
said, "Voting companies and election officials who have embraced
electronic voting say that certification procedures and testing are
adequate to protect the integrity of the voting systems. But for a vendor
to be accused of placing unauthorized software into a voting system
undermines one of the prime arguments they have been making for the past
year and brings into question the integrity of the entire voting system."
Voting-machine companies and state election officials say that individual
states and counties provide enough protection of the systems to prevent
anyone from tampering with them.
However, a Wired News investigation in Alameda County prior to last
month's gubernatorial recall election revealed lax security measures.
This is not the first time Diebold has been accused of circumventing
voting rules and procedures.
A former worker in the Diebold warehouse in Georgia has alleged that the
company installed three uncertified software patches last year on 22,000
machines that it sold to Georgia for $56 million.
The employee, who worked as Diebold's deployment manager in its Georgia
warehouse in July 2002, said workers installed three patches to fix
malfunctioning machines before delivering them to Georgia counties. He
said Diebold never notified state officials about the changes or submitted
the patches for review and certification by an independent testing
authority. A fourth patch that state contractors applied after the
machines were delivered to the counties and shortly before the
gubernatorial election in 2002 was passed through an independent testing
authority, according to a state contractor.
Diebold did not return calls for comment.
*******************************