California County Keeps E-Vote 

Despite the release of a comprehensive report on Wednesday that showed the Diebold touch-screen voting machines to be "at high risk of compromise," election officials in California say they have no plans to replace the machines before the upcoming gubernatorial election.

The report (PDF), commissioned by the governor of Maryland after researchers at Johns Hopkins and Rice University found that the Diebold software was badly written and full of serious security flaws, confirmed that Diebold's AccuVote-TS system "as implemented in policy, procedure and technology, is at high risk of compromise."

Special Partner Promotion

Become one of 64.

Story Tools

See also

• Maryland: E-Voting Passes Muster
• E-Vote Machines Face Audit
• No Consensus on Voting Machines
• Picture Yourself in Politics
• You know IT/IS Important

Today's Top 5 Stories

• Game Biz Mystified by Code Theft
• Broadband: Pick Cheap or Speedy
• Waiting for DVDs, the Sequel
• Quirky Scientists Win Ig Nobelity
• VeriSign to Shut Down Site Finder

Alameda County, which includes the Northern California cities of Oakland and Berkeley, used 4,000 of the touch-screen machines in the state's last gubernatorial election, and Alameda Registrar of Voters Brad Clark said the county will not replace the machines before the recall election on Oct. 7.

Clark, who was in the process of reading the report, said, "As soon as Diebold gets the new software update approved, we'll upload the new software, but not before this election."

The county uses an optical scan unit for absentee and provisional ballots, but Clark said this is not an option for regular votes since the county doesn't have optical scanners for each precinct and has no plans to obtain them.

Among the problems cited in the report were issues that security professionals consider basic to secure computing, such as the use of strong encryption for the transfer of voting data and the use of strong passwords and smartcard authentication for officials and workers accessing the systems. Diebold, it was found, had not designed these features adequately to meet security standards.

The audit, conducted by Science Applications International, or SAIC, in San Diego, stated that if the flaws were exploited, "significant impact could occur on the accuracy, integrity and availability of election results."

The report included an "action list" of 23 items that needed to be completed to "reduce the risk to the system" but did not indicate how much the machines would still be at risk after these changes were made. Changes were recommended for policies and procedures for the use of the machines by election officials.

Alameda County could play a significant role in the election. Alameda has 674,000 registered voters as of Aug. 8, the date of the last published report. Of those, 55 percent are registered Democrats, and 19 percent are Republicans.

"It's a big county with a big margin of difference. It's a Democratic stronghold; it's a place (that) Davis can count on to come through for him against the recall," said an election expert in California who asked to remain anonymous. She's concerned that "if there are any questions with the vote count in Alameda, there won't be a meaningful paper trail to verify the election results."

David Dill, professor of computer science at Stanford University, said, "If somebody in Alameda was thinking about not voting because they would have to vote on a touch-screen machine, they should vote absentee instead.

"Any election conducted on these machines is questionable," said Dill. "You don't have any proof that the election results are sound. On the other hand, a challenging party doesn't have any proof that the election is unsound, because the evidence is not there either."

"In fact, they have a disclaimer in the report saying they won't guarantee that they've found all the problems," said Dill. "Nowhere in the report is there any evidence that the machines are actually sound. All the report says is that they can mitigate the risks by changing procedures. But saying they can minimize the risks doesn't say they can make the risks acceptable."

Dill maintained that a voter-verifiable paper trail is the better option, though one that can't be implemented in this election. This would provide voters with a receipt against which they can verify their vote and then deposit in a ballot box for later reference should a dispute about election results arise.

Story continued on Page 2 »