[IP] Diebold GEMS central tabulator contains a stunning security hole
___
Dave Farber +1 412 726 9889
...... Forwarded Message .......
From: EEkid@xxxxxxx
To: dave@xxxxxxxxxx
Date: Tue, 31 Aug 2004 17:48:10 -0400 (EDT)
Subj: Diebold GEMS central tabulator contains a stunning security hole
Dave,
I don't know if this is real or the product of someone's imagination but,
addtional investigation is needed.
Jerry
*************************************************
http://www.blackboxvoting.org/?q=node/view/78
Consumer Report Part 1: Look at this -- the Diebold GEMS central tabulator
contains a stunning security hole
Submitted by Bev Harris on Thu, 08/26/2004 - 11:43. Investigations
Issue: Manipulation technique found in the Diebold central tabulator --
1,000 of these systems are in place, and they count up to two million votes
at a time.
By entering a 2-digit code in a hidden location, a second set of votes is
created. This set of votes can be changed, so that it no longer matches the
correct votes. The voting system will then read the totals from the bogus
vote set. It takes only seconds to change the votes, and to date not a
single location in the U.S. has implemented security measures to fully
mitigate the risks.
This program is not "stupidity" or sloppiness. It was designed and tested
over a series of a dozen version adjustments.
Public officials: If you are in a county that uses GEMS 1.18.18, GEMS
1.18.19, or GEMS 1.18.23, your secretary or state may not have told you
about this. You're the one who'll be blamed if your election is tampered
with. Find out for yourself if you have this problem: Black Box Voting will
be happy to walk you through a diagnostic procedure over the phone. E-mail
Bev Harris or Andy Stephenson to set up a time to do this.
For the media: Harris and Stephenson will be in New York City on Aug. 30,
31, Sep.1, to demonstrate this built-in election tampering technique.
Members of congress and Washington correspondents: Harris and Stephenson
will be in Washington D.C. on Sept. 22 to demonstrate this problem for you.
Whether you vote absentee, on touch-screens, or on paper ballot (fill in
the bubble) optical scan machines, all votes are ultimately brought to the
"mother ship," the central tabulator at the county which adds them all up
and creates the results report.
These systems are used in over 30 states and each counts up to two million
votes at once.
(Click "read more" for the rest of this section)
The central tabulator is far more vulnerable than the touch screen
terminals. Think about it: If you were going to tamper with an election,
would you rather tamper with 4,500 individual voting machines, or with just
one machine, the central tabulator which receives votes from all the
machines? Of course, the central tabulator is the most desirable target.
Findings: The GEMS central tabulator program is incorrectly designed and
highly vulnerable to fraud. Election results can be changed in a matter of
seconds. Part of the program we examined appears to be designed with
election tampering in mind. We have also learned that election officials
maintain inadequate controls over access to the central tabulator. We need
to beef up procedures to mitigate risks.
Much of this information, originally published on July 8, 2003, has since
been corroborated by formal studies (RABA) and by Diebold's own internal
memos written by its programmers.
Not a single location has yet implemented the security measures needed to
mitigate the risk. Yet, it is not too late. We need to tackle this one,
folks, roll up our sleeves, and implement corrective measures.
In Nov. 2003, Black Box Voting founder Bev Harris, and director Jim March,
filed a Qui Tam lawsuit in California citing fraudulent claims by Diebold,
seeking restitution for the taxpayer. Diebold claimed its voting system was
secure. It is, in fact, highly vulnerable to and appears to be designed for
fraud.
The California Attorney General was made aware of this problem nearly a
year ago. Harris and Black Box Voting Associate Director Andy Stephenson
visited the Washington Attorney General's office in Feb. 2004 to inform
them of the problem. Yet, nothing has been done to inform election
officials who are using the system, nor have appropriate security
safeguards been implemented. In fact, Gov. Arnold Swarzenegger recently
froze the funds, allocated by Secretary of State Kevin Shelley, which would
have paid for increased scrutiny of the voting system in California.
On April 21, 2004, Harris appeared before the California Voting Systems
Panel, and presented the smoking gun document showing that Diebold had not
corrected the GEMS flaws, even though it had updated and upgraded the GEMS
program.
On Aug. 8, 2004, Harris demonstrated to Howard Dean how easy it is to
change votes in GEMS, on CNBC TV.
On Aug. 11, 2004, Jim March formally requested that the Calfornia Voting
Systems Panel watch the demonstration of the double set of books in GEMS.
They were already convened, and the time for Harris was already allotted.
Though the demonstration takes only 3 minutes, the panel refused to allow
it and would not look. They did, however, meet privately with Diebold
afterwards, without informing the public or issuing any report of what
transpired.
On Aug. 18, 2004, Harris and Stephenson, together with computer security
expert Dr. Hugh Thompson, and former King County Elections Supervisor Julie
Anne Kempf, met with members of the California Voting Systems Panel and the
California Secretary of State's office to demonstrate the double set of
books. The officials declined to allow a camera crew from 60 Minutes to
film or attend.
The Secretary of State's office halted the meeting, called in the general
counsel for their office, and a defense attorney from the California
Attorney General's office. They refused to allow Black Box Voting to
videotape its own demonstration. They prohibited any audiotape and
specified that no notes of the meeting could be requested in public records
requests.
The undersecretary of state, Mark Kyle, left the meeting early, and one
voting panel member, John Mott Smith, appeared to sleep through the
presentation.
On Aug. 23, 2004, CBC TV came to California and filmed the demonstration.
On Aug 30 and 31, Harris and Stephenson will be in New York City to
demonstrate the double set of books for any public official and any TV
crews who wish to see it.
On Sept. 1, another event is planned in New York City, and on Sept. 21,
Harris and Stephenson intend to demonstrate the problem for members and
congress and the press in Washington D.C.
Diebold has known of the problem, or should have known, because it did a
cease and desist on the web site when Harris originally reported the
problem in 2003. On Aug. 11, 2004, Harris also offered to show the problem
to Marvin Singleton, Diebold's damage control expert, and to other Diebold
execs. They refused to look.
Why don't people want to look? Suppose you are formally informed that the
gas tank tends to explode on the car you are telling people to use. If you
KNOW about it, but do nothing, you are liable.
LET US HOLD DIEBOLD, AND OUR PUBLIC OFFICIALS, ACCOUNTABLE.
1) Let there be no one who can say "I didn't know."
2) Let there be no election jurisdiction using GEMS that fails to implement
all of the proper corrective procedures, this fall, to mitigate risk.
-------------------------------------
You are subscribed as roessler@xxxxxxxxxxxxxxxxxx
To manage your subscription, go to
http://v2.listbox.com/member/?listname=ip
Archives at: http://www.interesting-people.org/archives/interesting-people/