Suspect Code Used in State Votes 

02:00 AM Nov. 06, 2003 PT

An investigation by California's secretary of state has revealed that Diebold Election Systems placed uncertified software on electronic voting machines in a California county.

Voters in Alameda County, a densely populated region in the San Francisco Bay Area that includes the cities of Berkeley and Oakland, used a Diebold touch-screen-voting system utilizing uncertified software in Tuesday's election and in last month's gubernatorial recall election.

Although the software was used in at least two elections, Doug Stone, spokesman for the secretary of state, said voters should not worry about the integrity of the election results. He said the state tested the software but did not elaborate on when that testing occurred.

Stone said his office learned late last week about the possibility that uncertified software may have been used in the machines. The state then launched an investigation into the matter and halted certification of the AccuVote-TSx, a newer model of Diebold's touch-screen machines, which were supposed to be used in California's primary election in March 2004.

Marc Carrel, assistant secretary of state, surprised Diebold representatives and others at a meeting of the state's voting systems panel Monday by announcing that his office had received "disconcerting information" about the company and would hold off certification until an investigation was completed.

The AccuVote-TSx is a modified version of AccuVote-TS, an electronic touch-screen machine that is used in Alameda and Plumas counties. Los Angeles County also uses a small number of the machines for votes cast prior to regular election days.

Diebold and state election officials say the TSx is lighter and more compact than the TS and includes minor software modifications from the previous version.

Alameda County purchased 4,000 touch-screen machines last year at a cost of $12 million.

Before a state can use a voting system, the software and hardware must be audited by an independent testing authority that examines the code according to certification standards set by the Federal Election Commission.

Once the independent authority certifies the system, states can then test and certify the systems for their polling places.

California election law requires voting companies to notify state officials when they make changes to software after certification has been completed. Secretary of state spokesman Stone said Diebold did not do this when it applied a "software upgrade" to systems in Alameda County.

He said the state's investigation of the Diebold machines is ongoing. Among the outstanding questions is when the uncertified software was placed on voting systems and in which elections it was used.

Stone said the state would be examining "corrective steps to come up with ways to ensure that these types of actions do not occur again."

He also said it was unclear whether any measures would be taken against Diebold for its actions since the matter is still under review. The state needs to evaluate the election law, he said, and investigate what happened with the software.

Alameda County election officials did not return calls for comment. But Elaine Ginnold, the county's assistant registrar of voters, told the Oakland Tribune that she had no idea the uncertified software was used. "We were upset, to say the least," she said.

The state's decision to delay certification of the new Diebold machines means that several California counties are waiting to hear whether they will be able to use them in the 2004 election.

San Joaquin County in Northern California has purchased 1,600 TSx machines at a cost of $5.7 million. The machines already have been delivered, but the county does not have to pay for them until they pass testing and state certification.

Solano County paid $4.6 million for 1,171 TSx machines. And San Diego County is currently in negotiations with Diebold to purchase 10,000 TSx machines at a cost of $30 million.

Critics say the incident in California highlights a number of security problems that have emerged since states began switching to electronic voting machines that use proprietary software created by private companies.

Voting companies and election officials insist that rigid certification procedures ensure the security of the machines.

But critics say the fact that Diebold could install uncertified software on machines without the state's knowledge suggests that current certification procedures cannot ensure the integrity of election systems or, for that matter, election results.

Kim Alexander, founder and president of the California Voter Foundation, said, "Voting companies and election officials who have embraced electronic voting say that certification procedures and testing are adequate to protect the integrity of the voting systems. But for a vendor to be accused of placing unauthorized software into a voting system undermines one of the prime arguments they have been making for the past year and brings into question the integrity of the entire voting system."

Voting-machine companies and state election officials say that individual states and counties provide enough protection of the systems to prevent anyone from tampering with them.

However, a Wired News investigation in Alameda County prior to last month's gubernatorial recall election revealed lax security measures.

This is not the first time Diebold has been accused of circumventing voting rules and procedures.

A former worker in the Diebold warehouse in Georgia has alleged that the company installed three uncertified software patches last year on 22,000 machines that it sold to Georgia for $56 million.

The employee, who worked as Diebold's deployment manager in its Georgia warehouse in July 2002, said workers installed three patches to fix malfunctioning machines before delivering them to Georgia counties. He said Diebold never notified state officials about the changes or submitted the patches for review and certification by an independent testing authority. A fourth patch that state contractors applied after the machines were delivered to the counties and shortly before the gubernatorial election in 2002 was passed through an independent testing authority, according to a state contractor.

Diebold did not return calls for comment.