E-voting worries 
 
By Herbert H. Thompson, Contributing Writer
01 Nov 2004 | SearchSecurity.com  
 
 Palm Beach County, Florida is famous for its luxurious country clubs, affluent residents and extravagant homes. Thanks to punch cards in the 2000 presidential election, it's also well known for voting controversy. Few of us will forget the pictures of election officials scrutinizing punch card ballots with magnifying glasses and the infamous "hanging chads."

To avoid a repeat this year, Palm Beach is among many municipalities to adopt new electronic voting machines for tomorrow's elections. E-voting promises the end of ambiguity in vote tabulations and, thanks to initiatives by the U.S. government like the Help America Vote Act, many counties have received the funding they need to purchase and deploy these new machines. Additionally, many municipalities use tabulation software that takes voter data from polls and computes overall totals. The promise of e-voting is clear: precise, unambiguous election results.

Electronic voting has, however, remained mired in controversy. On Oct. 12, Palm Beach County suffered a setback when one of the computers that tabulates results from the touch-screen voting machines crashed during a systems test. This only reinforced what e-voting critics contend in this week's high-stakes races: the reliability of these machines is in question due to possible tampering and lack of a paper record as back-up. 
  

In some counties, votes are cast by a variety of methods: touch screen machines, optical scan ballots, punch cards, etc. No matter what the method, these votes are counted by electronic machines that store tallies digitally. Data are then sent to a central location where tabulation software consolidates it and computes totals. The most popular tabulation software GEMS, made by Diebold came under scrutiny in 2002 when Bev Harris, an investigative journalist, found a copy of the source code on an unsecured Diebold Web site. The application runs on a standard Windows PC and requires a password to access vote data. Harris discovered vote data tored in an unprotected Microsoft Access database where anyone with physical access to the machine could tamper with the results no password needed.

The problems with GEMS raise some wider concerns about the state of software engineering. Is software ready to be the sole and official record for the will of the people?

Then there is the issue of transparency. While a voter stuffing 50 ballots into a box instead of one is likely to be noticed by a vigilant poll worker, what about the voter who spends an extra two minutes on a computerized touch screen voting machine? In most cases the software that records and processes these votes is proprietary and closed source and cannot be inspected by the concerned citizen or even the curious election official.

Perhaps the biggest concern is what will happen after Tuesday. Activists have already begun to posture for lawsuits challenging the integrity of the election process. This, coupled with what is shaping up to be a tight presidential race, promises to create controversy over the accuracy of election results.

Whatever the outcome, e-voting problems have underscored something that software vendors have known for years: It's hard to make secure software. The question of whether the current e-voting systems are "secure enough" may ultimately be answered by a judge in the months following the election.

About the author
Dr. Herbert H. Thompson is director of research at Security Innovation Inc. in Melbourne, Fla. and is the co-author of several books, including How to Break Software Security (Addison Wesley 2003) and The Mezonic Agenda: Hacking the Presidency (Syngress 2004).