Rigged election called possible
Sun Feb 1, 5:47 AM ET

By Elise Ackerman, Mercury News

Could someone hack an election?

Yes, according to a report presented to the Maryland Legislature Thursday by Raba Technologies, a consulting firm. Maryland hired Raba's computer scientists to hack into its Diebold electronic voting system. The researchers found that software vulnerabilities could allow a saboteur to vote multiple times or tamper with computer code to steal an election.

"The team was able to demonstrate the ability to switch two candidates," the Raba scientists warned legislators. "Consequently, the voter appeared to vote for the candidate of his choice but he actually voted for another candidate."

System defended Nevertheless, Diebold marketing director Mark Radke claimed in an interview that the Raba researchers "found the system to be very secure." Voters, he said, can be confident their ballots will be counted correctly.

But recent research and a Mercury News review of California's testing procedures show that voting-machine security remains far from bulletproof.

California and a majority of other states require federal examiners to sign off on a voting systems' hardware and software before it is eligible for state certification.

But until a few weeks ago, the voting-machine standards applied by the federal examiners barely addressed the issue of computer security. Furthermore, other security standards normally used in federal purchasing were not applied to voting machines at all.

Voting requirements A more rigorous federal standard that recently took effect is important because states like California do not examine software code as part of their testing procedures.

Instead, they focus on whether a voting system meets the particular requirements of their elections code, such as the ability to handle ballots in different languages.

County election officials' own pre-election testing, known as logic-and-accuracy testing, does not consider computer security, either. Indeed, computer scientists who reviewed an automated program used to test Sequoia voting machines in Santa Clara County said it only guaranteed that ballots have been set up correctly and the software contains no gross programming errors.

Stricter rules sought "It doesn't prove a thing," said Peter Neumann, principal computer scientist at SRI International who reviewed the test program. He said machines could pass the test and still miscount ballots.

Computer scientists say more thorough logic-and-accuracy tests should be mandated by state or federal governments. And the authors of the Raba report called on the National Institute of Science and Technology, which recently assumed oversight of voting-machine standards, to improve the standards.

"Voting systems are a critical infrastructure component of democracy," the report stated. "They should be expected to meet strict guidelines."

Contact Elise Ackerman at eackerman@ mercurynews.com