Equipment test under fire - Manufacturer says its voting system may now be vulnerable (Florida)
Tallahassee Democrat. 10 June 2005. By Bill Cotterell, DEMOCRAT POLITICAL EDITOR

An attorney for the company that makes Leon County's voting equipment told state and county officials Thursday it was "very foolish and irresponsible" for Elections Supervisor Ion Sancho to let an outside group try poking holes in vote-tabulation security systems.

Michael Lindroos, senior corporate counsel for Diebold Election Systems Inc., said the company "cannot confirm at this time whether you can conduct any future elections reliably." He suggested that the county do a complete system evaluation before any future elections.

But Sancho said the equipment recently put through its paces by Black Box Voting will never be used again in a regular election. He said the nonprofit, nonpartisan organization was closely monitored as it tried to "hack" into the system - and that even if Black Box had left some bugs behind, his office has ordered an upgraded model that will be used in the 2006 elections.

The equipment will be used in next Tuesday's special election in House District 7. He said there have been very few early votes cast - and only one race on the ballot - so his staff could hand count them if Republican Marti Coley or Democrat Carl Duncan has any doubts about the outcome.

An aide to Secretary of State Glenda Hood said the Division of Elections "will be contacting all appropriate parties to review this matter."

In a blistering letter to Sancho, all seven county commissioners and Paul Craft, the head of voting-system certification in Hood's elections office, Lindroos said Sancho compromised the security of the system by letting Black Box Voting try to crack it. He said Sancho may have "intentionally and negligently allowed unauthorized personnel to make modifications to your system that are not discernible to you or your IT staff.

"Aside from potential violations of our licensing agreements and intellectual property rights, we believe this to have been a very foolish and irresponsible act," Lindroos wrote.

Sancho, contacted at a meeting of county elections supervisors in Pasco County, said he would do it again. He said it is important "to maintain public confidence in the integrity of elections" by allowing people with doubts to come in and test the systems under tightly controlled conditions.

Bev Harris, founder of Black Box Voting in Renton, Wash., said she made three visits to Tallahassee and worked with two computer-security experts between February and May. They tried unsuccessfully to penetrate the computer system from outside the courthouse but Sancho then allowed access to a secure room - where only one of his employees has the codes to operate the computers.

Harris said Black Box Voting demonstrated that a corrupt employee could easily get around security walls, tamper with vote totals and exit the system without leaving any tracks, the Tallahassee Democrat reported Saturday. By changing a memory card, the report said, her team was able to make 65,000 votes disappear in the test.

Sancho said "the level of rhetoric" shows that Diebold and the state are defensive about security and that groups like Black Box Voting are ready to believe the worst. Florida voting methods have been a touchy topic since the 2000 presidential election, which was decided for President Bush by 537 votes after 36 days of court fights, street demonstrations and on-again, off-again recounts in some counties.

"I don't believe in conspiracy theories," Sancho said. "I believe there is sometimes simply human error and negligence, but not conspiracy. What we really need is more honesty and less heat in these situations."

Lindroos said it was not realistic for someone to be given access to a system that is always under tight security.

"Your improper actions, Mr. Sancho, are equivalent to leaving your car unlocked, with the windows down and the keys left in the ignition, and then acting surprised when your car is stolen or the interior vandalized," wrote Lindroos. "Other examples would be acting surprised if anomalies were discovered after you left paper ballots exposed in an unsecured area and invited individuals of questionable character to visit the room, or asked some unknown person to deliver paper ballots to a central counting location without a trusted escort."

Harris, contacted in Washington state, said she has confidence in Sancho's security systems and employees. But she said similar Diebold systems are used in about 800 cities and counties across the country, with three to five employees having access in each jurisdiction, and that the system "should send up a red flare" if a dishonest employee tries to change vote totals.

Harris said Black Box evaded security systems and changed votes without setting off any alarms in its tests.

"It took us less than a minute to replace the Diebold system with something we wrote and to hijack the whole system," she said. "I would venture to say it doesn't happen in Leon County, but that's like saying nobody ever embezzles. When you have 800 jurisdictions and three to five employees with access in each, that's like saying you've got 3,000 to 4,000 employees and none of them will ever try something."

Jenny Nash, a spokeswoman for the secretary of state's office, said the elections office will monitor the controversy.

"The security of Florida's voting systems is a top priority for the Department of State," she said.

"It is disappointing to hear that Supervisor Sancho did give access to unauthorized personnel," she added. "With any system in the world, no matter how secure it is, if the person in charge gives outside access, well then that's a real problem."