Third voting report finds flaws, but hope

by Steven T. Dennis Staff Writer 
Paper ballots endorsed again

ANNAPOLIS A third independent study of the state's $74 million Diebold voting system found "considerable security risks," but endorses it as "worthy of voter trust" if a number of fixes are made immediately.

The report also endorsed voter-verifiable paper receipts as "absolutely necessary in some limited form" at some point.

The report by the Department of Legislative Services and RABA Technologies of Columbia confirmed many of the security concerns raised in earlier reports by Aviel D. Rubin of Johns Hopkins University and SAIC Corp. and added some more. The report was discussed Jan. 29 before the Senate Education Health and Environmental Affairs Committee.

The proposed fixes include using tamper-resistant tape to secure the machines physically and installing firewall and d antivirus software on the state's election server.

Michael A. Wertheimer, who directed the study at RABA, said he would like to see a system upgrade that uses a digital signature technique to ensure that the software has not been tampered with on election day.

As for paper receipts, Wertheimer told the committee that having a few machines with voter-verified paper printouts in each precinct would be sufficient to ensure an accurate election. It also would be more economical than providing printouts for every machine, he said.

Wertheimer said adding paper is likely to produce discrepancies, but also could improve voter confidence that their votes are being counted accurately.

Not everyone is as convinced about the security of the March 2 primary.

Sen. Richard F. Colburn (R-Dist. 37) of Cambridge, who is running against U.S. Rep. Wayne T. Gilchrest (R) in the 7th Congressional District, questioned why RABA believes that the March 2 results should be trusted when so many additional steps and software upgrades are proposed for the November election and beyond.

Wertheimer likened the difference to hackers becoming more familiar with Windows, thus requiring continual security upgrades as their familiarity with the software grows.

He said that because many technical upgrades will not be possible by March, RABA is proposing changes in the election process, such as wrapping tamper-resistant security tape, to deter hackers from breaking into the machines.

Wertheimer later told the House Ways and Means Committee that the encryption used to submit voting results by modem should be upgraded.

"You are more secure ordering a book from Amazon," he said.

Linda H. Lamone, the state election administrator, said some of the recommendations, such as the tape, could be implemented by March, but she said she is doubtful that anyone would be able to get away with voter fraud given the security and scrutiny already in place.

"I have confidence that we are going to provide the voters of Maryland in the presidential election with the most reliable, secure system in the country," she said.

Lamone said having separate machine passwords for each of more than 1,600 precincts as recommended could lead to major problems, such as not having the polls open on time.

The state will not install firewall and some other software upgrades to the election server until after the primary, Lamone told the committee. To do that so close to an election would risk a catastrophic failure, she said.

"It's not worth it this late in the game to install all of these fixes," Lamone said, adding that the machines could be upgraded by November.

The report comes after Del. Karen S. Montgomery (D-Dist. 14) of Brookeville has proposed a bill that would require paper printouts as a check against the machines. The Gazette reported last year that a stolen internal Diebold e-mail had recommended charging Maryland "out the yin-yang" for just such an upgrade.

Montgomery said the study backs the reasoning behind her bill.

"There is a high risk that votes will not be counted correctly," she said in a statement. "The study indicated that it might be theoretically possible for Diebold to make their software system secure if they started over and totally redesigned it, but said they were uncertain that Diebold has that capability."

Linda Schade of the Campaign for Verifiable Voting, which backs paper trails, criticized the report for failing to address the possibility of insider fraud from within Diebold.

Montgomery County Councilman Howard A. Denis (R-Dist. 1) of Chevy Chase said in a statement he is "deeply troubled" by the report's discussion of vulnerabilities in the system and regrets that the county's "nearly foolproof" punch-card system has already been sold.

"With a presidential primary looming on March 2, this is a serious problem which goes to the basic integrity of any election result in Montgomery County and anywhere else in Maryland where the system is employed."

But Diebold Election Systems President Bob Urosevich said in a statement that the RABA report confirms the accuracy and security of the company's voting procedures and systems, but acknowledged that there is always room for improvement.

Diebold's voting technology is "the most secure and accurate election system in the history of democracy," he said.