Will machines decide who'll be president?

Web Posted: 08/08/2004 12:00 AM CDT

Roy Bragg
San Antonio Express-News Staff Writer  08 August 2004 

If 2000 was the "Year of the Hanging Chad," then 2004 is shaping up to be the "Year of the Hacked Vote."

 Election officials had envisioned the addition of touch screen voting machines would eliminate a repeat of the 2000 presidential election, where votes were lost or rendered inconclusive because of punch-card ballots' quirks.

But computers make mistakes and can be hacked, experts say. Without a printed backup of all ballots, no one ever will know if every vote was counted correctly.

"Whoever controls the machine," said Avi Rubin, a computer scientist who has studied voting machine computer code, "controls the outcome."

David Dill is a Stanford University computer scientist affiliated with VerifiedVoting.org, a grass-roots group pushing for election accountability.

"You need election transparency," Dill said. "Under this system, if you vote and you're told your candidate lost, why should you believe it? It's not good enough that the elections be accurate; the public has to know that they're accurate."

Rebecca Mercurri noted that voting always has been vulnerable to human and mechanical error.

"Mistakes happen in every election," said Mercurri, a computer scientist who has lobbied against the widescale adoption of the current generation of digital recording equipment, or DREs. "It's always going to happen somewhere."

She said the addition of DREs "adds a whole new layer of computer problems, and it makes those existing problems even more pronounced."

"We're looking at a pretty big mess," said Bev Harris, author of "Black Box Voting," a book chronicling elections with lost and miscounted votes nationwide.

Consider:

In the March 2 primary in San Diego, Calif., VerifiedVoting.org reports that one voter was allowed to cast two ballots, while 250 machines didn't start when the polls opened. An election judge in one precinct said the number of voters who signed the log to cast ballots differed from the number of votes counted by that precinct's machines.

In Boone County, Ind., electronic voting machines showed 140,000 votes had been cast in the Nov. 4 city elections. Trouble is, Boone County only has 50,000 residents, and fewer than 19,000 of them are eligible to vote. According to voter logs, 5,532 people actually made it to the polls.

According to a study by the Massachusetts Institute of Technology, 6 million to 8 million votes were lost in the 2000 presidential election. Up to 3.5 million Senate and governor votes were lost over the same election cycle.

Representatives of voting machine makers dispute the criticism. They say electronic voting systems have built-in checks and balances to catch errors, which are unlikely, and allow election officials to run accurate, secure elections.

"These machines are very safe," said David Bear, a spokesman for Diebold, an election systems manufacturer. "They're very secure, and they've proven themselves to be very accurate through the years."

After the debacle of the Florida vote in 2000, Congress passed the Help America Vote Act of 2002, which pledged $3.9 billion to replace older voting machines across the country.

Most states took that as a message to convert to computers, Harris said, even though the law doesn't require it. At least 30 states have bought DRE machines, and between 28 percent and 30 percent of voters could use them.

There are, however, no federal guidelines requiring auditable voting or letting election officials inspect the software being used.

Various vendors make the machines, and most of the machines are accused of being questionable.

Take the machines manufactured by Diebold Systems of North Canton, Ohio.

Like other manufacturers, Diebold regards its operating software as proprietary and doesn't make it public.

But in 1998, while doing a Google search, Harris stumbled on 40,000 files of Diebold source code that had been inadvertently posted on the Web.

"As soon as I saw that," she said at a Las Vegas hackers convention last weekend, "I realized they were throwing away the checks and balances in the system and there was no question that someone was going to try to (hack) it."

After Harris' book came out, several computer scientists analyzed the posted code. The most detailed study came from Avi Rubin of Johns Hopkins University and three other academics who, in a 23-page report on the Diebold Accuvote-TS DRE software, detailed a bevy of flaws.

Rubin's report found that a team of hackers, using off-the-shelf computers and armed with a knowledge of the Windows software used by the machines, could commandeer a machine, adding, deleting or modifying votes by substituting their own computerized cards for the 'smart' cards provided at the polling place.

"I think the problem is just that the code in machines is badly written," Rubin says. "Instead of having the best programmers, the A team, to write a system with national security implications, you've got stuff that's got problems in design."

Part of the problem stems the simple truism of computer security: All computers can be compromised.

"Writing code is error-prone," Rubin said. "There's no way to avoid it. They shouldn't try. They should build code and put in a process where you don't trust the machine."

The suggestion from opponents of electronic voting is to allow election officials access to the machine's software. That allows government officials to study the code for mistakes in case of voting machine breakdown.

Some places, such as Bexar County, have that code in escrow. The state of California actually has the code for each machine certified for use in that state, Secretary of State Kevin Shelley said.

The companies involved defend their products.

Diebold's Bear says Rubin's conclusions are wrong.

The study was based on incomplete and outdated code, none of which was shipped with voting machines, he said. And since the machines aren't hooked up to any network, the skullduggery needed to pull off some of the exploits Rubin details can't be accomplished in a real-world voting place, where election judges and poll watchers watch the voting.

Every Diebold machine is checked for logic and accuracy, Bear said, and sent sealed to the polls. Each machine has built-in checks and balances.

There are three separate computer memories, all of which must register the same vote before it's counted. Each machine generates a running log of the number of voters, which is compared to the number of votes at the end of the day. Each vote can be printed out, too.

"It's not a leap of faith based on nothing," Bear said. "It's a leap of faith based on the history of accuracy of these machines."

Bexar County uses machines built by Election Systems and Software, said Cliff Borofsky, the county elections supervisor. Before the polls open, each precinct election judge uses a master cartridge to clear the machine's memory. That cartridge, Borofsky said, is the only way to input or remove data from the machine.

At the end of the day, the cartridge is plugged in and voting data is copied onto it, maintaining the original record in the machine. Each machine then creates two paper copies of the votes it recorded that day.

One copy is posted at the polling place. The election judge takes the second copy, along with the cartridge containing all of that precinct's votes, to a regional center where votes are transmitted to the county's central tabulation center. Officials from that office then confirm, via phone call, the totals sent from each precinct.

The ES&S machine is secure because it's a closed system, without the ability to be networked or accessed via Internet or phone line, spokeswoman Meghan McCormick said. Plus the proprietary software isn't based on Windows or other off-the-shelf software, so hackers have no background knowledge in how to compromise it.

Harris said Bexar has good procedures in place, but it's not a foolproof system.

The printout isn't an auditable piece of paper, but just a copy of what the machine records. If the machine is faulty, the printout will be faulty.

"It's that sort of silent failure that troubles me," said Dill of Stanford.

The perfect system, Harris said, would be completely digital, preserve the secrecy of an individual's ballot, and be auditable.

But that's impossible, Harris and Mercurri say, since an audit would need identifying information about each voter and their vote to reconcile the records. That would abrogate the secrecy of the vote.

Some states have taken steps to provide accountability. Nevada requires each machine print a paper copy of the ballot after each voter finishes. The vote isn't officially cast until the voter sees the copy and approves it. Each copy is then stored in a sealed box in case of a recount. And California will require the same beginning in 2006, Shelley said.

Not good enough, Mercurri says.

"It's still an inauditable system," she said. "We should audit elections at least as well as we audit banks. Holding elections where you can't audit them and (can't) verify the accuracy of the votes should be illegal. It's fiction to say that's an appropriate auditing system. (Voting) is the only place where we transcend reality and say that's an OK way to audit. That's not OK."

The best system on the market, Harris and Mercurri said, is an optical scanning machine.

In that system, voters mark ballots with special pens. Those ballots are then fed into and tabulated by a machine, which can read the special ink. That allows voters to see their vote, and it preserves a paper copy. In case of questions, a manual recount can be conducted without the use of a computer.

Optical scanners are used in 45.4 percent of the nation's precincts, but because of the way the population is spread out, only 32.2 percent of the population will use them, according to a study from Election Data Systems, a Washington-based consulting firm.

"It provides the most reliability," Mercurri said. "It's cheaper. It's easier to use. And those machines can be adapted for people who are blind, disabled, or who don't speak English."

Legislation is pending to set national electronic voting standards, Mercurri said, but it won't affect this fall's election.

"Voters should have confidence their vote is recorded correctly," Mercurri said. "And they don't know that with these machines."