E-Voting or 'Bust' in California
Patrick Mallon
Monday, Feb. 23, 2004
California's headlong rush into electronic voting met a judge this week who apparently doesn't give much weight to a mountain of expert evidence against the use of machines still vulnerable to malfunction.

From lack of convincing protections against software and hardware tampering, to impacts of standard computer tasks like upgrades, preventive virus scanning, and an almost constant need for the installation of patches and service packs, it would appear that touch-screen voting machines are less than ready for prime time.

Judge Raymond M. Cadei of the Sacramento Superior Court was appointed by former Gov. Gray Davis in May 2002. On Wednesday, Feb. 18, Cadei refused to order new security measures for touch-screen machines scheduled to be installed in San Diego and several other counties for the March 2 election.

According to the San Diego Union Tribune, "Citizens from four counties requested a temporary restraining order in Sacramento County Superior Court. They asked that up to 18 counties using machines made by Ohio-based Diebold Election Systems add more safeguards to protect them against hackers." Cadei said no.

A copy of the lawsuit can be viewed at www.blackboxvoting.org/dieboldlawsuit.pdf on the Tribune's Web site.

The plaintiffs' numbered complaint contains substantive arguments against the use of Diebold's machines, including:

35. On July 23, 2003, four computer security scientists, three from the faculty of Johns Hopkins University and the fourth from the faculty of Rice University, published "An Analysis of an Electronic Voting System." The article reported on their analysis of the source code for the Diebold AccuVote-TS voting terminal. The authors concluded that "this voting system is far below even the most minimal security standards applicable in other contexts."

39. On September 2, 2003, Science Applications International Corporation ("SAIC") issued a "Risk Assessment Report: Diebold AccuVote-TS Voting System and Processes" commissioned by the governor of the State of Maryland. The report identified 328 security flaws, 26 of them critical" and concluded that "[t]he system, as implemented in policy, procedure, and technology, is at high risk of compromise." Diebold offered to make free software modifications for Maryland, but not for customers in California or other states.

41. On December 2, 2003, the Ohio Secretary of State released a "DRE Technical Security Assessment" prepared by a private firm, Compuware. The report assessed touch screen voting systems sold by Diebold and three other vendors. It found that the Diebold AccuVote-TS voting system had more security risks rated "high" than any other vendor.

Still Not Enough Doubt for the Judge?

Judge Cadei stated in his ruling that he is convinced there is "no serious actual threat to the election process." I am puzzled as to how much evidence the judge needs. California's secretary of state, Kevin Shelley, known to recall junkies as the election arbiter during the six legal efforts by the ACLU and other groups to halt the California recall process, relied on his spokesman Doug Stone to back the judge and announce this week as well that "all systems are go."

Perhaps the public should be aware of some problems Diebold had in Georgia during the November 2002 election.

Months before that election, two Diebold engineers at the company's Georgia warehouse installed three separate patches on its voting machines. The law says that once a machine is certified, you can't tamper with it without it being re-certified by an independent testing authority. The tests, by the way, are called logic and accuracy tests, in which a dry-run vote count is ed and the input has to match the output. California law requires these tests as well.

It is unclear whether the patches were tested before installation on the voting machines. But the critical issue as reported by Bev Harris, author of the book Black Box Voting, and one of the plaintiffs in the lawsuit brought before Judge Cadei is this: nobody but the programmers at Diebold could have known what was on these patches because the source code is proprietary.

One of the engineers said that Diebold's machines had major problems, where 25 percent to 30 percent of the machines in one shipment either crashed upon booting or had problems with their real-time clocks, causing the systems to freeze up.

So they used Windows CE to fix the dates using a patch available for company troubleshooters posted on a Diebold FTP site. The patch was transferred from a laptop, put on memory cards, and the flash was reprogrammed with the fix. The machines were then rebooted.

Later, a demo was conducted in the primary. Fifty percent of the machines failed at 137 polling places. After the general election, Fulton County election officials reported that memory cards from 67 electronic voting machines had been misplaced, so ballots placed on machines using those cards were omitted from the total vote count.

Soon after they found most of the cards and reported that the vote tallies were restored to the count. Two other counties reported lost cards as well. In Dekalb County, the elections director explained that some voting terminals were taken out of service because of technical problems and some memory cards were not collected.

I would like to ask the judge: Would any of these electronic accountability issues occur with the mechanical punch-card or optical scan machines we have used for years?

Has Anybody Had a Computer Problem Lately?

Diebold's e-voting machines use Global Electronic Management System (GEMS) software. The software runs on the Windows 2000/NT platform. I use Windows NT at home. During a routine troubleshooting session, Microsoft informed me that my system needed 17 service packs to upgrade my system, protect against viruses and attacks, and bring the computer up to date. I installed the upgrades and system performance improved.

All computers face these issues. Diebold's system runs on a computer. This is simple logic.

The integrity of the voting process is at serious issue. This doesn't seem to matter with certain people in authority positions.

In examining the cumulative evidence from over 1,500 respected computer experts, there's no way Diebold's systems should be used in the March 2 election.

Diebold is the supplier of 66 percent of the nation's ATM machines. They became involved in manufacturing voting machines in 1999 when they bought a Brazilian company that used their equipment to upgrade that country's voting machines.

If we had a well-designed touch-screen ballot system, one that had cryptographic protections and a verifiable audit trail, as well as a paper receipt, most people would endorse it.

However, state and local governments are delivering systems that have been hacked, that do not contain satisfactory audit features and that are highly vulnerable to tally manipulation because access to source code is in the hands of very few people.

Kevin Shelley himself is aware of the fact that Diebold installed unapproved software on machines in 17 counties.

Yet this still is apparently not enough evidence to delay installation of the machines.

Back when the ACLU launched its final, pathetic lawsuit in a desperate attempt to halt the California recall election, it complained of the "thousands" of people who would be "disenfranchised" if they used paper ballots. Now with electronic voting, we are at serious risk of disenfranchising far more people. And for what?

Why is it suddenly that America can no longer perform such a simple task as casting a vote and having it counted, with a paper trail?

Though Shelley has agreed that e-voting machines will have printed receipts in 2005 and 2006, the public is entitled to more effective protections of the most sacred right of a democracy.

"Success Stories," a feature in the September/October 2002 issue of Sacramento Lawyer, a Sacramento County Bar Association publication, gave a brief biography of Judge Cadei:

"He received his bachelor's degree in economics from University of California, Santa Cruz in 1970, during a time when UC Santa Cruz, where students did not receive letter grades, was getting established as an idyllic and avant-garde home for hippies. Cadei received a master's degree in public administration from UCLA in 1971 and a law degree from McGeorge in 1977."

If California voters were made more aware of the decisions made by their judges and the evidence, or lack of evidence, they use to reach their conclusions, we all would be better able to comprehend why there seems to be so much turmoil in our governmental processes.

And if we had to give them grades for performance, well ? Santa Cruz is a pretty cool place to hang out if you've been there.