State set to approve less-flawed e-voting machines

By Ian Hoffman, STAFF WRITER

California elections officials are poised Monday to approve a new Diebold electronic-voting system for Alameda, Los Angeles and Plumas counties that still leaves some published security holes unplugged and the fix for a troubling vote-counting problem unproven.

Electronic-voting critics wonder whether the state has become so eager to clear the three counties' use of the touchscreens for November that officials are overlooking potential flaws.

"These concerns are just completely glossed over," said Lowell Finley, an Oakland election lawyer handling two lawsuits that target Diebold e-voting machines. He discovered them Friday after filing public-records requests for testing reports on the new Diebold system.

"This thing is so fundamentally flawed that it can't be fixed by November," Finley charged.

State elections officials say that, to the extent Diebold's system remains vulnerable local officials will have to abide by new rules for using the system that are aimed at limiting the security loopholes.

"We're confident that it provides significant security improvement over the current system when it is used as the Voting Systems and Procedures Panel requires," said Douglas Stone, spokesman for Secretary of State Kevin Shelley.

The new touch-screen voting system lets poll workers and local elections officials get rid of Diebold Election Systems Inc.'s old fixed password "1111" that could have been used to gain poll supervisor access to any Diebold touchscreen nationwide and add or subtract votes.

Moving to "dynamic passwords" took new software in Diebold's touch-screens and central vote-counting computers, but it also will take new rules requiring local elections officials to program new passwords. The touch-screens still restricts passwords to four digits.

A panel of state officials and consultants are expected to approve the new software and rules Monday. But the approval by the California's voting systems panel still leaves widely publicized security holes unfixed.

If not physically locked up, the central Diebold vote-counting computers remain vulnerable to anyone capable of making a direct connection and destroying files or running Microsoft Access, a database application that can alter the vote databases.

A single key opens the critical panel where votes are stored in all of Diebold's AccuVote TS touch-screens. The state's voting-systems consultant has advised that pollworkers check to make sure the seals are unbroken on Election Day, but seal-making kits are not hard to come by.

Those are two of nine outstanding security problems cited by a state voting-system tester. Stone said state officials required Diebold to deliver extra rules for using the machines that, if followed by local elections officials, are likely to restrict the security gaps.

But one of the largest problems left after the voting system panel's action Monday is the question of whether Diebold correctly diagnosed and fixed a software flaw that can give thousands of votes to the wrong candidates.

The core vote-tabulating software of Diebold Election Systems Inc. gave thousands of Democratic absentee votes to other candidates in the October gubernatorial recall election in Alameda County and in the presidential primary in San Diego County in March.

Diebold officials say the problem is fixed in their latest software. But state officials say it will take three days of arduous testing to make sure. They stress-test the system with loads of ballots, some ripped or mismarked, some photocopied or otherwise counterfeited. That testing is set for later in the week, with a report due to the voting systems panel within a week or so afterward.

"We're working in an expeditious manner to move these systems through testing and approval," Stone said. "The process takes time, but we want to be as accurate and as thorough as possible."

Finley is not convinced the state is holding Diebold's system to a high enough standard for the presidential election.

The chief elections officer in Ohio, the home state for Diebold's corporate parent, ordered three counties on Friday to suspend plans to use the firm's touchscreens in November after discovering several security problems remained unfixed.

"At this point, I'm really ready to throw up my hands and say we're back to ground zero, and there's no reason to have confidence in this voting system," Finley said. "It's voter beware."