Black Box Voting: Second Volley - Truth About Rob-Georgia

[BevHarris]

Don't pass this link out, it's the temp link until it becomes morning in New Zealand. I'll post the permanent link in a few hours. Scoop is continuing to distribute those files.

The story of the day is:

Bald-Faced Lies About Black Box Voting Machines
and
The Truth About the Rob-Georgia File

Temp address: http://www.talion.com/lies.htm

See ya,

Bev

[papau]

1. Unless the US Media likes to be laughed at by the worlds media

I think this will get picked up. It may be a long hot summer for Bush.

But then the Wilkinson Report in Capitol Hill Blue and Japan Today is 10 hours into the news cycle, and US media is playing the pretend that they do not report allegations.

So Wilkinson must be "confirmed" before the ethics bar of US media is met and our media folks will allow wide distribution.

They may pull the same game with your story Bev.

Which means it may be time to blast the media with the story again, and let them know how loud and easily heard by non-media folks is the horse laugh of the free press media in other countries as they view the inaction of US media.

[Freddie Stubbs]

26. What about liberal publications?

One would think they would be picking up this story. Anyone have any ideas why that hasn't happened yet?

[dmr]

31. Hopefully they are

reviewing the data now as we speak.

[Freddie Stubbs]

32. If liberal American publications do not touch this story

It will never go anyhwere. But it is early, so they may be researching the story.

[dmr]

76. Yea, that's what I'm hoping

they are researching the story themselves before going out on a limb.

You never know with today's media, though some of them are starting to write contrary to Bush* these days.

[sybylla]

2. This is great work Bev

You must not be getting any sleep. I look your threads over and you post at all hours of the day and night. Take care and don't kill yourself. We need you to be lucid when the big media starts knocking on your door.

I've started spreading the word to my acquaintances within and without my state's party. This is very exciting to watch. I very much appreciate all your hard work and that of your helper elves.

:toast:

[jimmynochad]

3. Is Bev going to the election officials meetings this summer?

Bev,

Are you attending any of the election official meetings this summer? Going to have a face to face with Diebold in such a public forum?

I'd love to see it hashed out in public. Bring in the whole cast of characters. Better than any reality tv... I am thinking pay-per-view... We could vote on the outcome on Accuvote machines... A recall vote on Diebold...

JNC

[BevHarris]

7. End of July? That one? Denver?

most likely.

[jimmynochad]

10. IACREOT in Denver

Yes, that is the big one in Denver. There is also the SOS meeting in Maine a few days prior. There is also the National County Meeting and there is Doug Lewis' meeting and there are various state meetings (don't know when GA's meeting is). Don't know if I will be let out of my cage to attend any of these meetings. Would pay my own way to see you and Radke debate on the show floor.

[angka]

11. really-here in denver?

<sharpening pencil>

[jimmynochad]

12. Dates for those interested

Denver meeting info found at www.iacreot.com

Meetings are the week of 7/28

[SharonAnn]

4. You're wonderful! This is terrific!

I love the way you explain things.

SharonAnn - formerly known as ShaddAnn

[Fredda Weinberg]

5. I can't be the only one here ...

who knows that there's such a thing as "dial out only capability"? Do a Google, for Pete's sake.

Or that a connection to a web server doesn't mean a connection to the Internet

[Name removed]

18. Deleted message

Message removed by moderator. Click here to review the message board rules.

[Name removed]

22. Deleted message

Message removed by moderator. Click here to review the message board rules.

[Nederland]

23. Yeah Fredda!

Dissent will not be tolerated here. What do you think this is, a diverse political forum? </sarcasm>

[punpirate]

24. You're entitled to your speech...

... as is Fredda.

But, speech doesn't make you right. Dig the code, my man. Dig the manuals. Then come back and say, "you're all wrong."

For example, Fredda says, "am I not the only person who understands dial-out only?" Maybe Fredda should ask herself what happens at the end of election day and that modem on the Accumulator station queries and _something_ , _somewhere_, goes "ACK."

Geez. Let's just waste time with "it can't possibly happen."

There's a might large difference between being obstreperous and being helpful.

Cheers.

[Name removed]

35. Deleted message

Message removed by moderator. Click here to review the message board rules.

[alfredo]

42. We don't need O'Really's

nor do we need trolls. Yes we need devil's advocates. Let's let Fredda speak and have her arguments stand or fall on their merits.

[birdman]

43. Sounds an awful lot like

just tell the people that Iraq has nukes
and then they'll support the war we want to fight.

[BevHarris]

50. Fredda often has useful counterarguments, though generally

not very accurate. I've yet to see anything useful from birdman. Just my opinion, and delete if I'm breaking a rule, stayed up all night and feeling grouchy.

Bev

[birdman]

84. Well, Ms. Harris you're the one who promised "The Pentagon Papers"

and the Scoop site told us this was "bigger than Watergate"
and you told your friends here that if you don't post every day
they might as well start dragging the river. Is that not correct?

But thus far all I've seen is some security holes and a very large, confused hardware and software rollout that prompted some last minute
hysteria, none of which is all that atypical in the computer business.
Neither are employees who badmouth their former employers.

I haven't seen one vote flipped so far and the disclaimer on the Scoop
site yesterday flat out says that you have no evidence of
election tampering.

As I've said to you before if your point is that greater safeguards
are needed for the new voting technologies then I heartily agree but
if, as some of your supporters here claim, the contention is that
there is widespread election fraud and the newer machines are being
used to rig elections for Republicans then you're coming up way short.

[Eloriel]

91. Oh, you're right, birdman

Nothing to see here, move along.

(PLEASE move along.)

Eloriel

[birdman]

92. I didn't say move along

if you would like to dwell on PC security issues
and software patches go ahead, Eloriel. But I
think this was hyped as a good deal more than
that.

\

[republicansareevil]

93. If Bev is correct, I wouldn't call it hype.

How would you like those same security issues associated with your bank account? How would you like untested and unverified software patches applied to the electronic system that keeps track of your money? I'm sorry you don't find this subject sexy enough, but I feel sorry for anyone who doesn't consider serious security issues with the electronic voting systems that determine who runs our governments a big deal.

[birdman]

96. Having worked in the computer field

for a number of years I would suspect that you wouldn't
want to know about the security issues at your bank.

The hype in no way matches the story and there's no evidence
at all of vote fixing (they admitted as much on the Scoop site).

[republicansareevil]

99. Well, you may or may not be right about banks.

But people generally know how much they have in their accounts and would know if something happened to their money. With black box voting it's all hidden. I hardly ever hear a story of someone's money being electronically stolen from their bank account. But if someone steals your vote, how would you ever know?

[Kelvin Mace]

102. I am not trying to be a smart ass

but I'd like to point out that the system is demonstrably insecure and ripe for abuse.

The nature of the security problem is that *if* someone chooses to rig the system, there is an excellent chance their will be NO evidence of tampering.

This the whole danger we are trying to get people to recognize.

If there is NO evidence of a vote other than what is digitally encoded on a piece of magnetic media, you have ABSOLUTELY NO way of knowing if your vote is recored correctly or not. The whole process may be subverted, accidently or deliberately.

If we show you that the bank's employees can't be trusted, show you that the vault is made of cardboard, show you that the auditors are incompetent or non-existant and show you that the guards are are deaf, blind and have no bullets in their guns, why do I also have to catch a thief in the act of stealing before anyone will admit there is a problem?

David Allen
Publisher, CEO, Janitor
Plan Nine Publishing
1237 Elon Place
High Point, NC 27263
http://www.plan9.org

[Fredda Weinberg]

105. "the vault is made of cardboard"

hyperbole doesn't further the cause.

If the point is that all paperless systems are faulty, making baseless accusations against Diebold doesn't help. All you do is improve their competition ES&S.

If there was anything deliberately put into Diebold's code to commit fraud - let's see it; but to have Bev Harris criticize GEMS's architecture is frankly ludicrous to observe.

[republicansareevil]

110. that's not hyperbole

That was a hypothetical analogy for the purpose of making a point. I cannot believe you are actually so obtuse as to think that the poster was actually suggesting that any bank vault is made of cardboard. I have to conclude that you are deliberately "playing dumb." The point was that when a system is shown to have severe security holes, it should not be necessary to also prove that those security holes have been exploited and that the system has been infiltrated. It is enough to show that such a thing is easily possible. That in itself is a very important problem.

[Kelvin Mace]

118. Let me restate what you just said

If there is anything in the architect's blueprints that proves they deliberately wanted the bridge to fail - let's see it. But to criticize the bridge's engineering is frankly ludicrous to observe.

This statement is as ludicrous as your claim that a "service pack" isn't a patch.

This kind of thinking is what got Challenger and Columbia's crews killed.

David Allen
Publisher, CEO, Janitor
Plan Nine Publishing
1237 Elon Place
High Point, NC 27263
http://www.plan9.org

[Fredda Weinberg]

271. You insult Feynman

he was able to reproduce the O ring behavior under operating temperatures. Just this week, we've seen a demonstration that conclusively demonstrated the cause of the Columbia accident.

In both instances, there was a documented record of previous physical evidence to prove that management ignored warnings.

Compared to that, you've got bubkus. And the less you have, the more you bluster. And the less secure you are, the more viciously you attack.

Your statements border on the absurd: to claim that those who use MS products don't care about security isn't credible.

[BevHarris]

113. LOL! good one, David!

"If we show you that the bank's employees can't be trusted, show you that the vault is made of cardboard, show you that the auditors are incompetent or non-existant and show you that the guards are are deaf, blind and have no bullets in their guns, why do I also have to catch a thief in the act of stealing before anyone will admit there is a problem?"

Anyone ever tell you that you have a real mouth on you?

[TheUnionDemocrat]

180. Good GOD!

Can you just IMAGINE how many Democrats we could elect if we took all the energy being spent on this kooky issue and turned it into activism?

This is all embarrassing as HELL!

[DEMActivist]

183. That assumes

that this kooky issue of converting Democratic votes into Republican votes will go away all by itself.

What part of "you can't vote them out if you didn't vote them in" don't you understand?

[dmr]

191. Embarrassing?

Good grief! This is activism at it's finest!

That's a mighty big assumption - insinuating these people aren't invovled in other forms of activism!

[aquart]

214. Sweetie, the point is that we can't elect any Democrats

until we take care of this "kooky issue."

Activism can only get the voters to the polls. If their votes are then stolen, it was all for nothing.

I'm not a bit embarrassed by this "kooky issue." I'm embarrassed that a fascist coup took place in my country and we didn't lift a finger to stop it. I'm utterly humiliated by that.

[Trajan]

324. No ....

***>>> M O V E . . A L O N G ! ! ! <<<***

I suppose the beauty is in the eyes of the beholder ...

WHO are YOU ? .... the "You Promised Me A Rose Garden" earth-shattering-story-for-all-the-ages" neilson pollster ? ....

Watergate took 18 months to fully develop, and this is JUST hitting the outlets now ....

I LOVE those IDIOTS (NOT You Birdman, I would NEVER call you an idiot .. THAT would violate the rules ) who dont do a FUCKING THING in their lives, except criticize anyone else who does, while holding an IMPOSSIBLY HIGH threshold defining when another has 'success': making THEM happy .. yeah: as if .....

Tell ya what ? .... you will NOT be happy, nor is Bev nor ANYONE ELSE HERE obligated to MAKE you happy .....

Dont ASK to have all your dreams fulfilled by others ... and you WONT be disappointed ...

SHEEEEESH .. the NOIVE ! ....

"I suggest you pick up a rifle, and stand a post: ... either way: I dont give a DAMN what the FUCK you think you are entitled to ! " ... Colonel Jessup ...

[BevHarris]

112. birdman: take bookkeeping 101

computer programming and basic accounting is not the same thing.

As posted on slashdot.org: It's a feature, not a bug.

[Eloriel]

120. Yes, it IS a feature

and that's precisely the problem. Unfortunately, what Diebold is going to have to do is exactly the reverse: try to prove it's a bug and NOT a feature.

Eloriel

[BevHarris]

46. Admittedly reluctantly, am weighing in for Fredda

appreciated her comment, and need to tweak the wording of the "one-way" modem info unless I'm sure it's bullshit. I've had a zillion programmers tell me that's bullshit about the "one way" communication, and it probably is, because we know they can get email on these things and a county official has reported getting patches on the GEMS machine, interestingly, foisted in by tech support rather than dialled out for on purpose. (That one could be big, but I'd want to triple confirm or see it with my own eyes.)

But, it's not that important and it does help to fine tune the story a bit. HOWEVER: If the modem is two-way and they are taking the trouble to hype it as one-way, that would be in the "methinks thou dost protest too much" category and would justify a much closer examination of what they are doing with modems.

Clearly, Fredda has taken to concentrating only on nitpicking, but we need to get as bulletproof as possible, so pick the nits.

I guess Fredda doesn't feel the need to explain Dr. Brit William's statement that the machines have no communications connection at all?

Bev

[Az]

51. The nits need to be picked

Yes you can configure a system to not dial out. But that in no way limits the system to be switched back to be able to dial out. Its not a hardware only solution. Thus the system is not isolated. It merely requires a mod to the registry which can easily occurr during any of the patch sessions.

[Fredda Weinberg]

55. I'm not defending Diebold

Or Williams or anyone else. I'm pointing out that you could do a Google on dial out only capability and find multiple instances where that's the case.

They're not nits ... you're calling people liars - but their statement is plausible.

Getting email still doesn't mean you're on the Internet. Intranets carry messages too.

[ParanoidPat]

238. Fredda, how do you get e-mail without getting to the mail server?

And if the e-mail is from the intranet these machines are on, can you show us where the mail server program is loaded and running? :shrug:

:evilgrin:

[cap]

242. if you can email to that machine...

then there is a fair chance that machine is hooked up to the internet directly or indirectly. It may not have a domain name, but it is reachable via its IP address.

[Pobeka]

246. Time for a new thread on modems

See my post #189 below. Seems like some education is in order for the non-techies?

[Fredda Weinberg]

276. I guess you've never worked on an intranet

You get to the mail server, all right - which could have Internet connectivity. But depending on the topology, you could connect peer to peer, or on the same side of a firewall or use a protocol like Netware or Appletalk.

There's lots of ways.

[ParanoidPat]

280. Fredda, I'm well aware there are 'lots of ways' however....

....we're talking about the election system computers here. We're also talking election workers checking their personal e-mail not a 'peer to peer' network. Just what intranet are they connected to that is running a mail server? :shrug:

Why you bring up Appletalk I have no idea and the Diebold system has nothing to do with Novell. (Show me the drivers!) Please go back to the original post where the receipt of e-mail was first mentioned and give us an explanation of how it could have occurred on this system without a connection to the Internet. :)

BTW: As far as "I guess you've never worked on an intranet" is concerned, I've worked with an Intranet system that used satellite lease lines to connect facilities around the globe in more countries than I can remember, tracking thousands of production and test stations in 'real time' 24/7/365 operation. The same system also offered inter connectivity to all of our management and engineering groups via Lotus Notes on a Novell Netware based network. All of our database management was done with Oracle to achieve JIT manufacturing and delivery.

In short, you guessed wrong. :evilgrin:

[Fredda Weinberg]

288. You're talking apples and oranges

The GEMS machine connects peer to peer, and you can receive mail on an intranet. Try to keep the two separate - because the barrage of stories doesn't.

[ibegurpard]

47. Anyone pulling your mike?

You're still posting aren't you? Who cares whether people want to listen to you or not? You think that everyone has to sit back and listen to what you have to say and if they disagree then THEY should just keep it to themselves? Free speech is a two-way street, buddy.

[Nederland]

61. Take a look at the posts dude

Oh, that's right, you can't anymore because they got deleted. The got deleted because the moderator agreed with me, not you.

If you don't like what a person is saying, use the ignore button, don't tell them to "shut the fuck up". Its that simple.

[ibegurpard]

94. So why didn't you just ignore what I just said?

Like I said, YOU are still here so no one is censoring your opinion. And since my posts are still here I assume I'm getting my disagreement with you across without being too rude or attacking so what's the problem?

[Nederland]

20. No you are not

Unfortunately most of the people here at DU are so caught up in this, convinced that somehow it will bring Bush or some other Republican down, that they won't listen to reason. If I were Diebold, I would set up a machine in public and say to Bev and her crew, "Here you go. Here's a machine with a modem in it, and here's the phone number. Let's see you rig an election." If they did this I'm pretty sure that many here would end up looking pretty foolish.

This is not to say that I think the product isn't horribly flawed. I've looked at a large portion of the code and was disturbed by what I saw. Its clear to me that a system like this cannot be trusted to count votes properly 100% of the time. However, there is a huge difference between a machine that is unreliable and a machine that was rigged. I've seen lots of evidence that Diebold makes a flawed product, but absolutely none that an election was ever rigged.

BTW, I liked your comment on yesterday's thread that people were assuming that CandidateCounter and SumCandidateCounter were copies. Like so many comments that are critical of the DU conventional wisdom, it was ignored.

[w4rma]

117. But, they didn't did they, Nederland? They won't, will they, Nederland?

If there wasn't a problem then Diabold would prove that there isn't a problem, right? Why haven't they?

And you are a total idiot if your only interest in this if whether it will bring Bush or a Republican down, Nederland. There is NO way short of the American Civil War II to bring whomever decideds to use the gaping security holes to cheat in elections down. So, we have to fix this problem before we can even have a shot at bringing Bush down. Got that?

[Nederland]

148. We will see

I wouldn't be at all surprised if Diebold made the offer.

As for bringing "Bush or a Republican down", no that's not my only concern. You'd know that if you read my posts more carefully.

[cap]

202. Diebold will never do that...

they would be scared that we would bring in some "white hat" hackers -- legitimate hackers that work side by side with the FBI -- who know where the backdoors are a lot better than the rest of us.

[hunter]

25. Oh dear, we are short some fleas!

Okay, Bev has got the mad dog that bit us in a cage, and it's snarling and foaming at the mouth, all covered with ticks and fleas, and some people are complaining that she didn't catch all the fleas?????

I'd be willing to bet that the "Dial out only capability" in these machines is merely a software abstraction, and not something hardwired. All we have to do is look at the modem, but even if it is some fancy device with hardwired encryption, it is still connected to Windows CE, which is a steaming pile of crap...

Oh yeah, Diebold says, half your stew is fresh crap, but it's been boiling all night, so it won't hurt you, we promise! Eat hearty, it's good for you!

I love Behler's description of the bad serial numbers and general inventory control problems. I've been there, done that... I've seen frankenstein machines cobbled together at the last minute on the warehouse floor, just before they are shipped out...

Wow... wow... This story is amazing.

Peace

[ParanoidPat]

111. Hunter! Good to 'see' you!

Straight from the play book eh'? :evilgrin:

Kinda like the Nixon era on steroids. :) COINTELPRO anyone? :shrug:

[angka]

27. no no i admire motivated disruption.

like a few days ago, when fredda's breathless contention (the only way she could have added any emphasis would be to go all caps) that because dan spillane hadn't gotten back to her on his testing, it was all unreliable and speculative or 'hype.'

well, it would appear that this guy spillane got back to somebody:

http://www.democraticunderground.com/discuss/duboard.php?az=show_topic&forum=104&topic_id=8019&mesg_id=8019&page=

you might notice that as of this writing (9:40a MDT), there's a distinct lack of "this is a bullshit story" replies to that post.

but of course the GEMS-to-net connection angle of the story is what's bullshit today. i wonder what it will be tomorrow?

big smile

[Fredda Weinberg]

38. Spillane's review is lukewarm, as I predicted

and has enough caveats to drive a truck through.

[angka]

45. <chuckle>

On that basis, I concluded the following:

This software violates normal or best practices and the certification guidelines in the following areas:

1) General - Data path verifiability ("integrity", "accuracy"); cannot prove votes are those of the voters as cast.

2) General - Security and Access control; cannot prove vote count was safe from fraud.

3) Specific - Component in question (as identified by me) is explicitly prohibited from allowing data modifications, yet, given the tests illustrated, allows them. (An area for more exploration, given subsequent non-published information).

4) Incidental - there is a question of whether MS Access should be used at all in this context, given it is insecure, and due to loopholes in the guidelines and lax application of them, a data management layer such as Access may never be reviewed at all, yet hold all the votes.

ONLY apparent caveat:

Now, the code is assumed to be genuine, and if the detailed analysis is correct...and this is actually the code used in various elections, this is a big problem. The second report below seems to include confirmations which allay my earlier questions as to whether or not this is a genuine problem.

which appeared to be resolved for him:

So, it appears that it is a genuine problem. Moreover, it seems to show, once again, a severe breakdown in the application of the certification process, which hundreds of millions of our tax dollars are bound to.

i'm looking for the lukewarm part of this, or the caveat i can drive a truck through. not only am i not finding it, but i expect that other reasonable people are also failing to find it, which might make you appear a bit un-ah, you figure it out.

so these people whom you purport to work for...do you suppose they're reading this tripe?

[Fredda Weinberg]

48. "it appears that it is a genuine problem"

Yes, appearances can be deceiving. That's why I'm looking for answers.

[angka]

80. okie dokie

that was such a monumentally weak response that i think i'll just let it speak for itself.

[dmr]

34. Fredda, really

I like and want the devil's advocate on any thread, but as I read your numerous posts day after day, what I see is not a devil's advocate but someone who is following, or maybe even stalking these threads with the intent to discredit, embarass and demand.

With all due respect, what is your motivation here?

[Fredda Weinberg]

37. My motivation is truth

Implying that there's no such thing as dial out only capability is simply false. What's your motivation in overlooking such a glaring error?

[dmr]

57. Easy answer

There is no "motivation in overlooking such a glaring error" as conversations with county IT professionals indicate that the support for the GEMS computers comes from remote access with a company in another state. He says "We call them up and they call the computer to download patches and fix corrupted files." That doesn't imply dial out only in my book.

[Fredda Weinberg]

60. The statement didn't limit itself to the GEMS machines

it questioned whether dial out only capability existed at all.

[dmr]

66. I'll tell ya what

I'll be happy to read any thread you post on DU with your research.

I don't flame, ever, so I will skip over your posts here and wait for your thread.

[Fredda Weinberg]

90. Wait for the next issue of Vanity Fair

for an article on Saudi funding of terrorist networks that I've been working on all morning for my client. If you want something on this subject, see http://www.wordsunltd.com/voting_machine_fiasco.htm

[ParanoidPat]

124. Straw man, meet Mr. match......

.....Someone seem to confuse the term 'dial out only' with 'one way communications'. "Dial out only" merely means that communications are initiated by the terminal only. No 'dial in' access is allowed. If someone attempts to 'dial up' that unit the connection is refused!
Hence the 'dial out only' designation.

Once the connection is established by the terminal , two way communications are established. :evilgrin:

For those of you playing along at home, simply go to the B.O.M. (Bill of Materials] .pdf file for the terminal and locate the modem IC, note the Manufacturer and part #. Go to the manufacturers web site and download the specs. Now try to find out how one could possibly limit the communications to one way only. The short answer is, you can't! All communications through a modem depend on a series of 'back and forth communications to establish the packet timing across the network. :)

[Fredda Weinberg]

275. The original article was obviously confused

and showed the author didn't understand. Otherwise how she could question whether dial out only capability "really exists"?

[ParanoidPat]

281. I guess you've never heard of 'scripts'...

....like JAVA, Active X, Pearl and the like. If you knew anything about what is really in this code, you wouldn't keep dwelling on the 'dial out only' aspect of this. Remember all of those strange files with nothing but one or two numbers each? :evilgrin:

Did it ever occur to you how easy it would be to bury a small code snippet that would auto dial a number on its own or just flip a bit from false to true for a permission setting? :)

If you want to play confuse the issue, Two can play that game!

Hmmm, "the author didn't understand" and you publicly stated Access is an adequate database for elections! LOL! Give it a rest. :(

[Fredda Weinberg]

287. Java, ActiveX, Pearl (sic) ... you're grasping at straws

I have GEMS installed on my system, as well as the source code that was available. What strange files are you talking about?

You are playing a game - but I'm serious. I don't know where you got the idea that Access wasn't suitable for a standalone application that counts votes, but it's reasonably priced and is obviously adequate.

I'm not dwelling on anything. I'm responding to a load of confused insinuations, baseless accusations and otherwise reasonable paranoia.

[angka]

308. i think the point about access...

is that it is relatively insecure compared to other database products which would also work very well.

furthermore, and ominously, there are functions in access which allow GEMS password controls to be bypassed and the database totals altered. please read "Inside A U.S. Election Vote Counting Program" (haven't you?).

[ParanoidPat]

347. See how easy that was....

....throw out some speculation and meaningless technobabble and....:evilgrin:

Like I said, two can play that game all day long! But I have more important things to do. :) Thanks for playing!

[ianbruce]

153. Fredda, you understand that the single limitation of "dial-out" modems...

... is that they must initiate the communication with the outside world. After a connection is established, anything goes. I'm not much of a programmer, but I could write a simple AppleScript, running in the background, that dials-up my ISP at regular intervals, checks my email, and logs off.

Imagine having a standard phone with the ringer disabled -- you can still call and chat with anyone you like, pass information back and forth... whatever.

Also, if you friends are familier with your "ringer" problem, they'll know that when you're on the phone they can get your attention via call-waiting, and that you'd be more than happy to take their call.

In the case of computers -- where you've got a fixed IP or block-range address -- I could simple "ping" those addresses until I saw that it went online.

This is assuming it didn't just call me directly.

[Fredda Weinberg]

273. I guess I understand them better than you do

When you care about security, you don't leave your machines connected when they don't have to be. The GEMS machines are, as documented, not to be connected on public networks. They do their business peer to peer and disconnect.

[republicansareevil]

44. I did a Google search...

Here are a couple things I found:

"In pre-Internet times, dial-out modems were considered safe to use, but with PPP that is no longer the case since IP supports initiating traffic in both directions."

"Dial-Out Modems
Those modems that are set to dial out only are more secure. Unlike dial-in modems, the outsider cannot attempt to trespass at their leisure. Instead, they must wait for the user to make a connection to the Internet themselves. However, this is one of their few security advantages, overcome by the attacker waiting for the connection to appear, made easier when – as is often the case – the user is assigned a fixed IP address, or address range. The attack is then very much like an attack on a fixed connection except that there is generally less security: no firewall and sometimes no router."

In any case, there are people even on DU with a heck of a lot more knowledge in this area, so don't expect me to get into a technical discussion about this with you. But I see no reason for Bev not to publish her research and open it up to public debate. And I see no reason you shouldn't participate in that debate if you choose.

Also, there are massive security problems she notes that don't require any computer expertise to understand -- people walking around without any ID badges, fixes being done last minute without anyone checking them. Many, many machines that are not functioning properly at all. Why don't you address those?

[angka]

58. lol

yes, the fact that i worked for rocky mountain internet, and was also a network administrator for a VoIP long distance provider is pretty much irrelevant to this debate.

i keep remembering something about refusing to engage in a battle of wits with unarmed people...

[republicansareevil]

63. Was that a reply to my post?

Or did mean to reply to another post?

[angka]

73. hmm

i thought i was agreeing with you. but i have had alot of coffee this morning...

:)

[republicansareevil]

79. ok

:)

[Fredda Weinberg]

59. So you've confirmed that dial out only capability exists

thank you.

[republicansareevil]

65. Well, at least that the term "dial-out modem" exists.

But my interpretation was that they are "dial-out" in name only and are not actually completely secure in the sense of the communication being only one way. I think that is what Bev was trying to get at, but she acknowledged in post #46 that her wording could be improved.

[Fredda Weinberg]

77. It's not a matter of communication being one way

it's a question of knowing with whom you're handshaking. Not accepting inbound connections is one way of securing a system.

[sendero]

138. Not if...

... the system it is calling is part of the rigged game.

[ianbruce]

158. Fredda, please post your current IP address here.

Nothing wrong with that, right? I'll post it at a friends hackz site, and then you can let me know "with whom you're handshaking". I might suggest you back up you hard drive first.

I suspect the Diabold systems use a bank of fixed IP's so no one even needs to ask what the addresses are.

No disrespect, but you'd do well to research this subject a little bit more.

[Fredda Weinberg]

274. No disrespect? You get nasty quickly.

I don't have to research security again. It's been my day job for twenty years.

Your scenario assumes that the dial-out makes a connection to a network. The system connects peer-to-peer, just like my good ol' slip days. You remember serial line interface protocol, don't you?

Stick to your day job ... I'll keep up with technology.

[angka]

305. as much as i hate to admit it,

there is probably some limited accuracy to this. it's necessary to clarify in our minds what we're talking about:

certainly dialup connections are possible that have nothing in any way to do with IP networking (or the relatively unsecure connection it implies). a variety of communications protocols exist for simplified peer-to-peer dialup connections, going all the way back to an original Bell system spec of 110 bits per second. anybody who ever used an apple II or IBM PC-XT to dialup a BBS has (wait for it) connected via modem without exposing his system to attack from the larger internet (even if it had existed at the time).

which means that yes, many updates to the voting system *could* be performed on a relatively secure basis by using dialup into a BBS or other host. various ecrypted modulation standards exist for such direct, secure, dialup communications (this means that if you don't have the right encryption, you can't even connect—cool stuff), and the host computer need not be connected to any IP network.

the problem is that's not how they're updating these machines! this report shows clearly that updates were not taking place with any meaningful controls—or even organized procedures to carry them out. total chaos in the tech rooms. multiple FTP xfers from a public site. 'bug fix' after 'bug fix.' and no—no!—security during the process, physical or IT.

and goddamn it, i'm not so worried about the system being broken into from outside. why don't you try getting your head around that.

[Fredda Weinberg]

309. Keep a civil tongue, will you?

If you want a convincing argument, don't distract with obvious inaccuracies.

If we want the authorities to overlook their own interests and change procedures that make their jobs easier, we have to overcome objections that are going to be raised by technically sophisticated opponents.

I'm a friendly critic - but DUers are losing their cool and supporting absurd statements in our enthusiasm.

You shouldn't be reluctant to concede a point, if the greater objective is being served.

[angka]

321. i could make a joke here, honey,

about just how 'civil my tongue' is on the right day, but i think i'll just chuckle to myself and spare you.

i agree that every technical claim made as a result of this investigation must be thoroughly vetted to ensure its veracity and use of proper context. i think bev also has conceded this point, and made corrections based upon your punctilious, semantic objections here and there. that serves a purpose even if it does occasionally annoy.

the point on this subject (GEMS connectivity to the public network) is that the system doesn't use this secure dialup technology i just described to you. there is a detailed system described in the GEMS for realtime streaming results reporting (JResults), straight from the GEMS PC. so, let's see, you've got a continuous connection, with a TCP/IP stack loaded, and IP transport. stop me when you find the BOLDLY WORDED ADDENDUM in the GEMS documentation about how to secure this now highly exposed computer on election night. of course you and i know how to do it, but what was that thing bev said about these election officials when they meet the diebold pitchmen? 'clueless, meet snakeoil salesman.' how funny is that?

so i'll say it again: all this babble about ways to secure a modem carrier connection is completely useless. because that's not how they do it in the field. and because there IS a TCP/IP public network connection running on these GEMS PCs on election night. period.

i don't like hyperbolic claims any more than you do. if you can show me one i've made, sure go for it, i'm happy to take some of your heat so others busier than myself don't have to. were you addressing that whole 'obvious inaccuracies' remark towards me?

and yes, some DUers should get a grip, but some DUers always need to get a grip. it's their nature, and we should go ahead and let them vent. the occasional overreaction of DU posters regarding various subjects does no, imo, impugn the credibility of bev's investigation.

[Pale_Rider]

234. Secure sockets and VPN are other techniques ...

... ensuring that only 'deeply authorized' connections are accepted. I believe that userid and (with no) password is the lowest level of a secured system.

secure socket layer
http://www.webopedia.com/TERM/S/SSL.html

VPN, or Virtual Private Network
http://www.webopedia.com/TERM/V/VPN.html

For mo' information on good secure systems ...
http://www.nsa.gov/snac/index.html

and Tempest-I rated hardware systems.
http://www.nsa.gov/isso/bao/tempest1/endorsed.htm

I would want to hold the Diebold election systems to such high standards in the interest of national security. Hey its my vote! OK, I might compromise a bit on the Tempest ratings.

[angka]

71. sure it exists.

that is, until you hit the hayes-compatible modem in question with the command ATA. it's like a blow-up girlfriend. it'll do anything you want with the right command.

as was pointed out in post #57, once these GEMS computers dialup (using a fixed or highly predictable dynamic IP like any government agency), they are meat at the hands of anybody with basic knowledge of the huge number of vulnerabilities which exist in win2k (and that's assuming these machines are up to date with the win2k service packs and security patches, which is highly unlikely).

also, #57 pointed out that county elections officials were aware of dial-IN capability to update and patch remotely. that statement would appear to make a few people liars.

you sound like microsoft, insisting it's not possible, when it absolutely is.

[Fredda Weinberg]

88. That 'hit' has to come from the inside

But if you're there to key in the AT command, why do you need to dial in?

[angka]

97. sure but since they ARE dialing in,

isn't this whole line of questioning misdirecting and irrelevant?

(and of course my point was that dial-out only versus autoanswer is just a setting).

[Pale_Rider]

230. In a way ...

... as I remember a claim like a "dial out only capability" modem is only valid if the modem's internal registers have auto-answer off.

I'm assuming of course Hayes compatible modems.

And most modem purchase will typically have their default settings as auto-answer on. If a call comes in, the modem will answer and attempt to establish a connection.

If a modem is intended to provide 2-way communication (why modems have auto-answer turned on as default), the modem will come ready to support both dial-in and dial-out. This 'configuration issue' definitely can be a security risk (unauthorized external access) unless the technician ensures that auto-answer is off.

If the modem is intended for only 1-way comm, then it needs to have it's auto-answer register set to off. I'm not aware of any solely 1-way/dial-out (Hayes compatible) modems that are manufactured with auto-answer turned off.

Excellent point about the web server, it also can be an intranet or extranet web server. However that then assumes an office network exists and that would most likely have a gateway to the internet.

[punpirate]

6. Here's the best quote of the interview....

Uhhh: "I was absolutely astounded that they functioned at all in the election."

Not perfectly, not mostly right, not marginally, but "at all."

BWAHAHAHAHAHAHAHA!!!!!!

Great stuff!

[angka]

8. oh my god what a read.

untested patches. no security. wide-open communications links from GEMS, despite insistent denials from diebold. techs report total chaos trying to update voting machines before public testing. 'political men' you're not supposed to talk to. patch after patch, applied in this chaotic environment without safeguards or even knowledge of the contents by public officials. company men showing up in vans to fix the continuing problem before the public gets inconvenienced (which might look bad for elections officials).

saxby chambliss elected to the united states senate.

god. god!

[seemslikeadream]

9. Thanks to Bev

and to all the people here at DU who have given their support to you. This is amazing stuff and I feel so blessed to have been a fly on the wall during the unfolding of this story.
I am sending all info my friends at the Interfaith Network. I'm sure they will be very interested in your work also.
And I can not wait to here more about R Doug Lewis.

[Walt Starr]

13. A HUGE wuote that was not in blue in the article

"The only people that that cost was Diebold, who had to pay all kinds of extra expenses. The rumor around the office was that Diebold lost maybe $10 million on the Georgia thing. I mean, they only sold the machines for what, $2,000, or $2,500, and then you have to build them and then you're paying people $30 an hour and you are out touching 22,000 machines FOUR TIMES -- there's no way they didn't lose money on this deal.

They didn't care that they were losing money. They know damn well and good they'll be making a bundle after these machiens are mandated for use in every precinct in the country, not to mention kickbacks and quid pro quos from teh guys who get "elected".

[DEMActivist]

You're right, Walt....

If they did Georgia right, they stood to win the $3.9 billion the feds were gonna hand out!

My favorite Rob quote is this one:
It was supposed to say either 'low battery,' 'high battery' or 'charging.' But when the real time clock was messed up, you'd boot the machine and it would say 'No battery!' I mean, you don't have the machine plugged in, you boot it up, and it starts, and says it 'has no battery.' That's like saying, 'this morning I got out of bed and I stood up and I had no brain.'

[republicansareevil]

74. I wonder if that's how George Bush feels in the morning?

"This morning I got out of bed and I stood up and I had no brain."

O8)

[donsu]

28. they are also selling the machines to other countries

nt

[Az]

14. What if anything should we be telling the local press?

Can we maintain a list of links that we can push to the local media?

[BevHarris]

15. Drive 'em straight to the links, with a summary paragraph BUT

I don't want a flood to this temp address, need to wait for New Zealand to wake up. The site the temp gets hacked, and the permanent home (the one reporters get) should be Scoop. It will be up in, my guess, 2-4 hours. I'll post here when that one goes live, and I'll also start blasting it out.

I just jumped the gun and gave you guys a peek.

Bev

[Az]

17. Just pushed the first salvo to local public radio station

Will see if we get a bite. I will push the second salvo once you have the perm site updated.

[sendero]

16. interesting...

... as someone who has worked on similar small-computer systems, I can tell you the scenario depicted by Rob is unsettlingly familiar.

Trying to get machines running on a tight deadline do-or-die is every techs nightmare.

But I'm curious about some stuff. First, the picture painted in the interview is more one of a lot of rampant incompetence than a controlled vote theft. On the other hand, one could make the case that what better way to sneak a black patch onto the systems under the radar than to create a fabricated need to go into "we don't have time for protocol" mode. Would probably be easy to do.

It would be very interesting to know if other states, using the same model machine, had similar last minute problems. Especially states where the outcome of the election was pretty much as predicted by the polling.

Because if the last minute mad dash only happened in the "strange result" states, well, theres another brick in the wall.

[JHB]

21. Even a case of mere incometency...

...underscores the insecurity of these machines and their unsuitiblity for use in their primary function: as voting machines.

[sendero]

40. I agree with that....

.... but being able to make a case for actual fraud is a lot more likely to light a media fire.

If incompetency in critical situations were news... well, you get my drift :)

[Kelvin Mace]

41. Tight deadlines are another problem

This is an area I feel folks haven't thought about a lot. There is a concentration on rigging an election by changing the vote tallies, but an easier, less elegant way, is to simply blow the data away totaly.

If you want to swing an election one way, then attack machines in precincts/counties with a major one party advantage.

Most blacks vote Democrat. It data is destroyed in predominently black precincts then their votes are eliminated. How do you destroy the votes? Attack the machines.

How do you do that?

1) When you go into cast your vote, steal the PCMCIA card from the machine and replace with another one. It doesn't matter that the card won't work. It will be assumed to be a malfunction. All votes are stored on the card and unless the machine has an alarm to sound when a card is removed during an election (haven't see evidence of one), who will know?

2) Fry the electronics - This can be accomplished any number of ways by simply running current through a USB/serial/modem port. You are bypassing the surge supressor, so it won't take much to destroy the circuitry. The battery would fit in your pocket. A simple re-worked stun gun would fit the bill

3) Upload a virus - This can be done via a USB memory key. When you plug in a memory key (it is about the size of a Bic lighter and can store 512MB of data) when the Windows OS detects new hardware and sends a query command to the key, the key could respond by invoking an installation program. The program could then scramble voter data.

And who says that any of this has to be deliberate? Just the usual problems of life can screw things up. The system's Achilles heel is:

Power

The machines have a battery backup, but only two hours capacity. Anything longer than this and you can't record votes. In North Carolina this past year, ice storms knocked out power all over the state. Some places were without power for over four weeks. What happens when an ice storm takes out power the morning of the election? Paper ballots? I asked my local registrar and they had no provision to record votes on paper if they lost power. The thought had never occurred to them.

Ice storm not your bag? Well, regular thunderstorms can wreck havock on the power grid. November is the tail-end of hurricane season in the Atlantic. Tornadoes have occured.

A single moron with a car hitting a telephone pole with a transformer can take out several blocks for an entire day.

Voting in this copuntry takes place on a *single* day. Anything that causes disruption to the voting process for that day, prevents people from voting.

Also, what happens if the software has an unforseen bug which only manifests itself under certain weird conditions (having exactly 22 races of which six have Libertarian candidates and at least 52 votes are cast for the Libertarian candidates (and please don't tell me this doesn't happen, it does)).

Here it is, election day in our favorite state of Florida. Around about 11:30 AM, the bug begins to manifest all over the state. Tens of thousands of machines STOP WORKING. How many techs does the vendor have in Florida? How many programmers does it have to devote to the problem? How long will it take figure out the bug? (Also remember that the election is going on in 49 other states and techs and programmers will be dealing with the usual collection of problems as well).

A good Heisenbug can take WEEKS to find.

Your comments?

David Allen
Publisher, CEO, Janitor
Plan Nine Publishing
1237 Elon Place
High Point, NC 27263
http://www.plan9.org

[starroute]

335. Selective screw-ups could definitely be a problem

When I was a kid, my father told me about what it was like counting paper ballots back in the old days. There's be one person counting from each of the parties, and you'd try to gently nudge things in favor of your own party.

So if you were counting in a precinct where the other party had the advantage, you'd insist on being very strict about the standards and disquality any ballot where the X went outside the circle, or where the voter made a checkmark instead of an X. On the other hand, if your own party had the advantage, you'd push for more generous standards. Either way, you'd try to present your position in such a natural, just-trying-to-do-the-job-right sort of way that the other party's representative never suspected what you were pulling.

It sounds like it is definitely possible to deal with electronic voting in the same way. If you can make sure the machines in the precincts that favor you record all the votes impeccably, while the machines in the precincts that are likely to go against you have a greater tolerance of error, you will subtly slant things towards your own candidate without ever having to actually change a vote.

It isn't even necessary for votes to go uncounted. A setup that randomly records occasional votes as being for the wrong candidate will always take more votes away from the candidate who is ahead than from the one who is behind. For example, if candidate A gets 60 votes and candidate B gets 40, then a glitch which randomly switches every tenth vote will move 6 votes from A to B but only 4 votes from B to A. The result is that the count will show not 60-40 but 58-42.

It was clear in Florida in 2000 that a lot of this sort of thing was happening simply because the poorer distracts had inferior voting machines -- but what I'd like to know is whether it would be possible to build it in as a deliberate feature on a system like Diebold's.

[trumad]

19. Stunning... Absoulutely Stunning !

I read the whole damn thing...AND I encourage everyone to read it all and not just the Blue fonted parts. How anyone on DU read this and still be skeptical of what you are doing Bev is beyond me....

Bravo!

[Az]

29. I have contacted a number of senate and congressional staff

and they are shocked to hear just the basic summary of this. No one in DC knows about this yet. Call your congresspeople. Call your senators. Get the word out. NOW.

[Freddie Stubbs]

33. Some Congressional staff read DU

So some of them are surely aware of this. I had spoken with someone who works on the Hill about this issue a few months ago. The Congresswoman who he works for was aware of this issure, but did not think that there was anything to it.

[leftchick]

89. I contacted my congresspeople about this

Months ago. I was shocked to see the lack of enthusiam for this, from
the Democrats especially! I will continue to correspond with them, along with state election officials, armed with Bev's news releases. We will not be ignored!

[Freddie Stubbs]

100. It's not that they don't think that vote fraud is wrong

It is that they have yet to be convinced that there is a problem.

[aquart]

216. "Do you want me to vote for you on THIS machine?"

Try saying that. And including Rob-Georgia's statement. And maybe offer a few Tumms.

[Dob Bole]

30. I knew it... I'm from Georgia...

And we hadn't had a Republican governor in 130 years... until the 2002 election, that is. After I read "The Best Democracy Money Can Buy" I was pretty sure that something like that had to have happened in my state. There is no other explanation.

[ursacorwin]

49. what's bothering me is only the 1000+ types

seem to be reading this! (i know i'm not there yet but give me time ;-) but seriously, looks like we need to get the rest of the internet to pull a dean with this, and get it out into the massmind as quickly as possible. oh, and btw- dean has already mentioned this! he and his staffers are at least aware and acknowledging the problem.

[dmr]

62. Hi ursacorwin

Welcome to DU, don't let the 1000+ get in your way of having an enjoyable and informative experience here. We are all equal.

Where did Dean mention this? Can you provide a link?

:)

[revcarol]

195. I alerted Kucinich's people to this at the Santa Fe rally.

He had spoken that people must be aware and active locally, especially techie types(not his word) and equal justice types(also not his words). Will do follow-up tomorrow.

[DEMActivist]

36. Folks...about the detractors here...

Please realize that this one (rob-georgia) really hurts them badly. We now have PROOF that they not only used these files on the FTP site, they used them at the direction of Diebold at the highest levels. And the guy in charge of Security was watching them do it.

These people are going to try to do a lot of deflection from the issues. They'll twist your posts and change your words. They have no choice.

[Nederland]

70. As one of the detractors

I'll ask you a simple question, just as I did above.

What would you do if Diebold were to set up a machine in public and say to Bev and the rest of you, "Here you go. Here's a machine with a modem in it, and here's the phone number. Let's see you rig an election." Could you do it?

Now perhaps you've keep something up your sleeve that you are not revealing yet. If so, kudos to you for playing the media game well. If not, I'm afraid all you've got here is a story about a flawed product. Its nothing along the lines of the Pentagon Papers, and certainly nothing the deserves all the cloak and dagger shit I've been listening to for the past few weeks.

So answer my simple question. Could you rig an election?

[sendero]

106. uh...

... I don't think anyone thinks that an *outsider* is rigging anything.

But the real possibility that *insiders*, who have essentially directed the addition of the backdoors in the code, could do pretty much anything they want because there is nothing in the code to stop them.

[Nederland]

116. Precisely

I don't think anyone thinks that an *outsider* is rigging anything.

Precisely my point. If this story isn't about the ability of an outsider to rig an election, why talk about the fact that the machines are connected to the outside and can be accessed remotely? If this story is only about the fact that voting machine hardware and software could theorectically be rigged by insiders, I'm wondering what the big deal is. Of course elections can be rigged by insiders--that is not news. Heck, insiders can rig paper ballot elections if they wanted to. Granted, an insider can rig electronic elections more easily, but I don't think that is news either.

In other words, if the goal of this story is to spur interest in the reform of the laws surrounding the testing of election systems and software, I think it will probably succeed. (And, I have to say, I think succeeding in that regard is very important). If however, you think this story is about election fraud and Republicans stealing elections, I simply don't see it. This story was billed as being as big as the Pentagon Papers. So far, I don't see anything remotely like that.

[sendero]

121. semantics...

Well, now you are arguing semantics. What is important about this is that it makes "insiders", i.e. people who know how to take advantage of the carefully built-in flaws of the system -- into virtual *outsiders* who can do their dirty work from a remote location with practically no possibility of detection.

*If* you can access these machines remotely over a network and fool with data, well no matter how you slice it that is a huge big fat hairy deal because there is no amount of hand-waving that can justify any need to be able to do so, period.

[DEMActivist]

127. There's no IF to it....

I have county officials who tell me they call the GEMS computer from home.

[sendero]

132. Well, I don't doubt that...

... one bit. I was just covering my ass for the sake of debate. Since it was not a fact I was prepared to back up :)

[DEMActivist]

133. LOL, not to worry...

we've got your back. :evilgrin:

[Nederland]

134. Question

Are you saying that the answer to my question in post #70 is yes?

[DEMActivist]

137. Question back....

are you saying you can set up such a demonstration?

If so, please do.....you'll get your answer live and in living color.

[BevHarris]

140. Dem: How do you do "version control" if Diebold sets it up?

As you know, I've been fishing for places to go live with this too. But let's not let the adversary give us a specially clean and newformed system.

Bev

[DEMActivist]

142. Got it covered....

but, since the only objective here is to get someone to admit they can hack an election ---> get them arrested, I doubt we'll see any such offer.

[SharonAnn]

166. Yes, how do you know the HW and SW they give you to test

isn't some special setup? It's not hard to rig a special "demo" machine, ask computer salespeople.

And then, given the machine to test, how could you possibly assemble enough qualified staff, though it would be easier with the high unemployement, take the time to write test and audit procedures, pay everyone who's not a volunteer, and believe you accomplished anything?

Even if it worked and couldn't be compromised, that doesn't mean that they don't have different HW or SW on the other machines out there or that they wouldn't do that at any time they chose.

No, Diebold's offer to "see if you can compromise this" is not an adequate answer.

An adequate answer is agreeing to all the necessary safeguards, printing copies for later recounting if necessary, and doing it openly.

[Nederland]

143. Nope

I have no connection to Diebold that would allow that.

Now if you wanted to hack on Hart InterCivic systems, I could help you out...

[dmr]

151. Nederland

Do you work for Hart InterCivic systems?

[Nederland]

157. No

A former boss of mine does, and I've kept him aware of what's going on here. He told me about Diebold and its long history of problems months ago, so all this comes as no surprise. As a Diebold competitor, he's pleased as punch to see all this coming out. He is a diehard Democrat and a good guy. My biggest dispute with him is that he thinks that a paper based audit trail is a bad idea. I'm trying to turn him around on that one, but in the end it may not matter. Hart Intercivic is aware of the pending legislation, and they will do whatever the law requires. From his point of view its a simple business decision--the company will do whatever its customers (i.e. the government) asks it to.

[dmr]

160. Thank you for your honest reply, Nederland, but

reading your post and now knowing that there is someone in the industry who knew about all of this makes me want to sit here and cry!

My God, a Democrat, no less!

After what we went through in 2000! After all that has happened in this country after the coup - your friend should be ashamed of himself. Here it is taking an author, along with DU activists to research the process of our Constitutional right that is so very vital to our present and future democracy and our existance.

I realize he may be in fear, but so are some of our DUers. But they don't intend to be opportunistic about it.

[DEMActivist]

167. Well, ya see...this is how it is....

Nederland's "former boss" is sitting there beside him/her and helping compose the answers and posts in these Diebold threads.....

I mean, seriously, how else is Nederland coming up with these immediate and prompt responses all day and night?

Nederland, say hi to that "former boss" for me the next time you happen past a mirror, will ya?

Oh, and how many times have we heard those "life long Democrats" who now "support this president" on CSPAN?

True to republican behavior, the chickenhawks will "let the women handle it" for them.

[birdman]

203. If you expect

to be taken seriously and to have this issue
taken seriously it might be in your interest
to stop behaving like a whacko conspiracy theorist.
It's a common technique of the foil hat crowd to accuse
anyone who disagrees with them of being a part of the
conspiracy. It really discredits anything you have to
say.

[DEMActivist]

206. Bwahahahaahaha, birdman

The R. Doug Lewis' and Britian Williams' gave up calling us conspiracy theorists some weeks back.....you really need to get with the game.

They've elevated us to "terrorists" now. You're missing your daily talking point memo, me thinks.....your email went out, huh?

[birdman]

211. Evildoers huh ?

I'm a good deal more impressed.

[Nederland]

307. You've Lost It

You think I'm lying about where I work? You've obviously lost it. You pick the method of verification, and I'll comply. The only request I have is that after it is determined that I do not in fact work for Hart Intercivic, you have to apologize for calling me a liar. Deal?

[BevHarris]

162. I may know who your friend is. A Hart-Intercivic guy calls me

every now and then.

[Eloriel]

175. And I think it would have been appropriate to

reveal your own involvement at a much earlier time, since it puts such a different light on everything you've said.

What puzzles me is that if your at long last admitted connection to the industry is what you say it is, why are you as contrary to what's going on as you are? Seems to me you would have been more eager to HELP rather than mucking things up. I know, I know, you call it devil's advocate or whatever.

Just seems passing strange to me.

And what I've never understood, and still don't, is why you've been so eager to raise the bar: Oh, no, just having opportunity, motive, method to commit vote fraud, not to mention a past history of same, isn't nearly enough. Bev&Crew have got to come up with actual proof of vote fraud in order to be taken seriously. Why is that, exactly?

And tell me something else, while we're on the subject. Just who else has your former boss worked for in this industry? What industry were you both in when you worked for him? Have you had any jobs in the voting machine or software industry?

I'm sure I'm not the only one who would like to know these things.

Eloriel

[Nederland]

312. Response

I'm not really sure why this is such a big deal, but since I have nothing to hide I'll answer your questions.

My "connection" to the industry consists of the fact that three of my former co-workers currently work at Hart Intercivic. One individual is a project manager and my former boss, and the other two are developers. We all worked together at a little dot com startup called NetDelivery, now a dot-bomb barely hanging on with a new name and a much smaller set of employees. Because of the twenty or so developers that worked at NetDelivery but now work elsewhere, I suppose it can be said that I also have "connections" to the medical imaging industry, the web site development industry, the aerospace industry, and the telecommunications industry. Gosh, I didn't realize how well connected and influential I was until just now </sarcasm>.

As for why I think Bev&Crew have got to come up with "actual proof" of vote fraud in order to be taken seriously, I guess its because I'm sick and tired of my fellow Democrats looking like complete idiots and conspiracy freaks. The post above where DEMActivist actually claims that I am lying about where I work and the very existence of my former boss without any proof whatsoever other than his wild imagination is a classic example of this. Here's a hint: if you want to be taken seriously, you need proof, not speculation. In any case you are misrepresenting me because unlike Fredda, I actually agree with much of what Bev has to say. I do believe she has proof that the Diebold product sucks, I just don't think she has proof that any elections were rigged (at least, I haven't seen any yet). As a result, I think calling this "bigger than Watergate" is a bit overstated.

Finally, my former co-workers have only worked in this space for less than a year, and their role is simply to develop software. As for me, while I've several years of experience involving cryptography and secure systems, I've never worked in the voting machine industry. All told I've worked in the software industry for 14 years now.

Hope that answers your questions.

[angka]

332. yep

the best man at my wedding now works for lockheed martin, so you might say that i have connections to orbital surveillance and the military-industrial complex.

:)

[BevHarris]

115. I've got two guys who want to take that challenge

They've been asking for it for months. That said, I would think that (duh) Diebold might put a slightly special version of their programs on the demo version, if they were controlling it, and if they were doing anything wrong. Thus, it would not prove anything quite as well as a couple other methods, also going live with it in real settings.

I sure as hell wouldn't let Diebold set it up. It's a little tricky; even with "permission" each state has different regulations as to who is allowed to test a voting machine. Some states allow officials at the county level to conduct tests on their voting machines, others allow it only at the state level. And (I'm a few steps down the walkway on this actually) the permission needs to come from a person who is friendly, or at least neutral, but also who holds a position where they have statutory permission to do the test.

Of course, there are our, ahem, "less formal" meet-ups, but we can't use those at all to document without screwing over sources. All they are good for is to get confidence we're on the right track, which has value.

Actually, Nederland, I value your contributions very much and may on occasion PM you to look at something before we finalize, if you don't mind. Skeptical points of view are very much needed.

Bev

[Nederland]

139. Response

This where you are in a real catch-22. In order to prove without a doubt that the system is fatally flawed, you need to be able to demonstrate the flaw in public. Not in words, articles, and descriptions, but a real live display of the flaw on a running machine. Problem is, if you let Diebold set things up, like you pointed out, they would probably change the configuration so your hack doesn't work. If you insist on setting up the machine yourself, Diebold can always claim that you configured the machine wrong. Now in my book, it should be impossble to setup an election machine "wrong". The design should prevent that inherently, and that is my biggest problem with the Diebold product. However, I have a feeling that my opinion is not really relevant here. Diebold will point the finger at you and most people will believe them--especially election officials that made the choice to buy Diebold and who would be made to look bad by a clear demonstration of a flaw.

[BevHarris]

164. The outside (and best) chance is in a county election office

Let's see, there are installations in...300 counties or so -- oh yeah, I have the list -- oh yeah, I have all their phone numbers -- oh yeah, some people are trying to pull strings on this right now.

We'll see if we have any luck.

Bev

[Nederland]

314. Sincerely

I wish you the best of luck in this. People can argue back and forth all day long over what code and systems can and cannot do, but if you can get a live demonstration put together no-one can dispute you. It makes for great TV too :)

[Pale_Rider]

241. As devil's advocate ....

If I use their system, Bev's team findings and the system requirements that you specified, I probably could do it now. Within a typical six-month election cycle, probably a few on this board could setup a rigged election. There are enough security lapses (nevermind modems, firmware, MS-Access)in the system design from what I've read so far.

Diebold has done nothing to address these security issues. And what this? They had to design their own motherboard? That's gotta be buggy as all hell. Hopefully they haven't used any of those faulty Taiwanese capacitors that leak all over the motherboard. I highly doubt these systems would comply with NSA guidelines.

Though the icing on the cake for the serious criminal conspiracy charge of vote rigging and product fraud, the law will still require a demonstrated pattern of irregularity and malicious conduct with these system and specific corporate executives.

[cosmicdot]

338. it's not possible for a test bed to be rigged?

I seriously don't know.

[Az]

39. Dameware

Bev, did you find any hint of a program called Dameware? It is an application that allows a system to be taken over. It can load itself onto a PC and does not require software to be preloaded on the recieving end. It is used on Win2k and XP systems only. You do not need apps such as PCanywhere to take over a 2k system.

[Walt Starr]

52. The underlying OS on these machines is Windows CE

The embedded version of Windows. I've never attempted using Dameware ona CE machine. It's an interesting thought...

[Az]

53. 2k or CE

From the recent posting:

"When you say build a server it's not physically assembling a hardware. We added a component or two to make it do what we needed to do, modems, we load the Windows 2000, put the software in then we test it against their touch-screen machines."

If they are loaded with 2k then they are open to Dameware sessions and those can be nearly invisible to local users and require no software preloaded.

[Walt Starr]

56. Ahhh, the GEMS servers are 2K

The touch screen devices are CE.

[BevHarris]

Actually the GEMS computers are supposed to be NT

I noticed that. I assume James Rellinger knew what he was talking about, after all, he loaded it on 159 machines in a row -- but I did notice the discrepancy. The manual clearly says to run it on Windows NT and no other system.

And if they CHOSE to install Windows 2000 (when the Manual says Windows NT) -- that would be require an explanation, IMO. A formal explanation. Especially since the GEMS manual says to use NT and no other, and they are supplying the OS as part of the package.

What telltale signs would one look for with Dameware?

Bev

[Az]

86. 2k is the replacement for NT

In fact the directory 2k installs to is called WINNT.

[Kelvin Mace]

103. Among techs we call

Windows 2K NT 5.0.

David Allen
Publisher, CEO, Janitor
Plan Nine Publishing
1237 Elon Place
High Point, NC 27263
http://www.plan9.org

[Pale_Rider]

247. Windows, eh? Any service packages required by the Diebold ...

They got to be sending our field service notices for these systems. And hopefully they would be requiring all systems devices and operating systems to be at current (not recent) patch levels. All Windows 2K, NT and XP OSes would be required to have the latest service package installed. I believe that Win 2K just had SP4 released.

[Pale_Rider]

255. Pocket 2003 is supposely out ...

Though the hardware may not be compatible (especially if its Diebold properiety hardware).

[HFishbine]

54. Observations

Hi Bev,

I've been following your investigations from the edges for a while, so forgive me if I'm behind the curve here. But a few observations for what they are worth:

Your case appears to be largley circumstantial so far. What I gather is that there may be security holes (although I don't think you've found a clear and concise way of articulating this yet -- a necessity if the mainstrem media is going to latch on to this).

The double-talk and confusion you report in interviews with election officials further suggests the possibility that problems exist which nobody wants to acknowledge yet -- all circumstantial however, at best.

They way I see it, there are two elements to this story that need to be resolved. First, are there security holes? If so, can you find a way to conclusivley and simply explain what they are?

Second, if there are security holes, were they exploited? This, of course, would be the bigger story and it shouldn't be that hard to validate -- assuming you can get some cooperation.

As Dr. Williams notes in his explaination of how these sytems work, "the computer system must provide audit data that is sufficient to track the sequence of events that occur on the system," and "For transactions that occur on the system, a record is made of the nature of the transaction, the time of the transaction, and the person that initiated the transaction."

Can you not obtain the audit logs of the systems in question? This may take a Freedom of Information request, but this information could go a long way in resolving the issue.

[Kelvin Mace]

68. An audit log

which can be edited and your tracks erased is pretty useless.

David Allen
Publisher, CEO, Janitor
Plan Nine Publishing
1237 Elon Place
High Point, NC 27263
http://www.plan9.org

[sendero]

159. That...

... in and of itself is a smoking gun to me. Anybody who has rudimentary understanding of technology and systems understands the uselessness of an "audit log" that is easily "corrected". In fact, it is worse than useless, it can be used to "prove" something did not happen when in fact it did.

I know - it won't make the 6 oclock news but it is a travesty.

[BevHarris]

72. HFishbine: Are you saying you read the story about

how I overwrote the audit log (that was the story from yesterday, here's the link) http://www.scoop.co.nz/mason/stories/HL0307/S00065.htm

or not? Because if you actually read that story and don't know if a security hole has been shown, that tells me one thing. Your suggestion that we check the audit log when the security hole was the audit log makes me think you missed the story?

Thanks,

Bev

[HFishbine]

87. Bev

No, I hadn't seen that story, but it's much clearer and much more compelling. Just to continue to play devil's advocate though, you've now demonstrated just how vulnerable these systems are to an "intruder or insider;" where do you go from here? Still lacking is evidence that any of the scenerios you paint as possible actually happened. Don't get me wrong, what you have discovered so far is a monumental achievement, but do you have any evidence that there was, in fact, any tampering?

(P.S. the article above says that votes are transmitted "by modem." (Which would open up other security issues). But Dr. Williams says that the cards are actually transported in locked cases, under armed guard, to the elections office. Which is it?)

[cap]

95. it's not "just a bug" -- it's "Against the Law"

Start looking at the HAVA act for the legal requirements of the software. Legally the election system is required to register the votes precisely. You can't legally field a system with bugs that do not count the vote accurately. The legal requirements for election systems are much higher than your typical ecommerce system.
The legal requirements do not permit bugs in the precise count of the vote.

There are legal requirements for security as well.

The real kicker here is the system not meeting the legal requirements of the HAVA act. Unlike a dotcom system, you can't just say there are bugs, so what, we'll fix them. The system must meet the legal requirements before fielding.

[Walt Starr]

107. THE POST I AM RESPONDING TO IS INCREDIBLY IMPORTANT

The point made in that post is what's important about this whole story. The fact that the security is lacking and there are holes all over the software makes the system ILLEGAL!!!!

This IS bigger than Watergate or the Pentagon Papers. It doesn't matter one hoot whether or not there was actually election fraud in 2002. What matters is the system used does not meet the legal requirements, ergo the election could have been rife with fraud. What's more, because of the nature of the secutiry holes and software bugs, THERE IS NO WAY TO TELL WHETHER OR NOT THERE WAS FRAUD IN THE 2002 ELECTION!!!

I don't give a damn if there's ever any proof thaat election fraud occurred in 2002. What's important is the fact that there could have been and we can never be certain.

Diebold should be held criminally liable simply because they openmed up the possibility of election fraud with no way to audit it.

[rman]

129. indeed: insecure = illegal. that's the main point

the main point of the investigation of the voting software/hardware.
other investigations about the elections have turned up other damning issues.

[HFishbine]

147. Mr. Starr

It's important that you understand that I'm not trying to diminish the efforts here. They are extremely important and the people giving of their time and expertise are true patriots. My opinion is one of someone who is not a software or legal expert, but who is interested in knowing the truth -- in short, the kind of person to whom you ultimatley will have to make the case.

Simply telling me that this is ILLEGAL (with four excalmation points) and that it is bigger than Watergate is interesting, but unconvincing. I may even sense that you could be right. But it's not enough for me (and certainly won't be for a newspaper reporter.) It's unfortunate that a Woodward or Bernstien hasn't emerged, but it looks like Bev, et al are going to have to assume that role. Therefore, the nits I pick are in hope that your work continues so that this story become rock solid and doesn't get submarined because of innacuracies or hyperbole.

So, to the points made above:

1) What law was violated by what has been discovered so far? Can you cite a subsection of the HAVA or other law that has been violated? Maybe now is the time to solicit the opinion of some legal experts if this is the direction this story should go.

2) It DOES matter whether or not there was election fraud in 2002. Without it, the issue is one of sloppy (possibly illegal, as you contend) workmanship, which no matter what it may have allowed, seems not to even be backed up by indications of malicious intent, much less motive to change an election. The issue of poor industrial practices, even if ultimately illegal, is one that will be of interest to a smaller segment of the population.

If, on the other hand, there is evidence of actual vote tampering, that is a lead story for the nightly news and a front page, above the fold story for even the reluctant Atlanta Journal Constitution. You'll do the cause a favor by avoiding calling something election fraud prematurely.

You might not appreciate the distincition, Starr, but saying that there is no distinction for you between the possibility of fraud and whether or not there was any is a lot like saying it dosn't matter if WMDs are found or not in Iraq; that the possibility of their existince is as good as the unproven reality of their existince. It's the despised "Absence of evidence is not evidence of absence" argument -- a weak one that never got traction on WMDs and won't fly here.

(edit: spelling)

[Walt Starr]

291. Face the facts

Even if there was fraud in the 2002 election, those who were put in office would have to be associated directly with the fraud in order to be removed from office. Even if you can prove the fraud in the 2002 election, you're not likely to be capable of proving Saxby Chambliss had any knowledge of that fraud.

That said, I'm most concerned about keeping fraud out of the 2004 election. THAT'S WHAT THIS THING IS ALL ABOUT!

In regard to my post about the post being responded to being important, if you read the post I responded to, it lays out how the security holes are, in fact, violations of election law. IF you want a state by state accounting of precise laws being violated, that will take some time as election laws vary state by state, however, I can guarantee ytou that the laws requiring accountability are violated by the Diebold system.

[Fredda Weinberg]

108. HAVA came later ...

but I've looked at the FEC site and don't see anything in Diebold's system that violates the regulations.

As for bugs, has anyone found any?

[Eloriel]

114. It's possible you might

if you actually understood Diebold's system.

Eloriel

[cap]

136. for starters, look at the Accuracy requirements

GEMS does not meet the accuracy requirements legally mandated.
I am not sure it was even tested to meet these standards. After I finish compiling the mandates, then I will cross check it against the test cases.

Voting System Standards Hardware Section 3.2
For a voting system, accuracy is defined as the ability of the system to capture, record, store, consolidate and report the specific selections and absence of selections, made by the voter for each ballot position without error. Required accuracy is defined in terms of an error rate that for testing purposes represents the maximum number of errors allowed while processing a specified volume of data. This rate is set at a sufficiently stringent level such that the likelihood of voting system errors affecting the outcome of an election is exceptionally remote even in the closest of elections.

The error rate is defined using a convention that recognizes differences in how vote data is processed by different types of voting systems. Paper-based and DRE systems have different processing steps. Some differences also exist between precinct count and central count systems. Therefore, the acceptable error rate applies separately and distinctly to each of the following functions:
a. For all paper-based systems:
1) Scanning ballot positions on paper ballots to detect selections for individual candidates and contests;
2) Conversion of selections detected on paper ballots into digital data;
b. For all DRE systems:
1) Recording the voter selections of candidates and contests into voting data storage; and
2) Independently from voting data storage, recording voter selections of candidates and contests into ballot image storage.
c. For precinct-count systems (paper-based and DRE):
Consolidation of vote selection data from multiple precinct-based systems to generate jurisdiction-wide vote counts, including storage and reporting of the consolidated vote data; and
d. For central-count systems (paper-based and DRE):
Consolidation of vote selection data from multiple counting devices to generate jurisdiction-wide vote counts, including storage and reporting of the consolidated vote data.
For testing purposes, the acceptable error rate is defined using two parameters: the desired error rate to be achieved, and the maximum error rate that should be accepted by the test process.
For each processing function indicated above, the system shall achieve a target error rate of no more than one in 10,000,000 ballot positions, with a maximum acceptable error rate in the test process of one in 500,000 ballot positions

[BevHarris]

141. A tricky bit here: GEMS was certified under 1990 standards

You heard me.

Check and see -- if you have what's on FEC.gov, it's 2002 standards.

Bev

[cap]

152. yes.. but to maintain certification, you need to pass current standards!

otherwise your certification lapses. Also the 2002 standards build on earlier standards. So whatever is new under the 2002 standards is what Diebold may not be in compliance with.

You are right to point this out. In the introduction to the new standards, they point out the key areas where the standards are different. I do need to go back and double check exactly which requirements were never legally met either by the 1990 standards or the 2002.

I think we are on good ground to say that the voting machines must conform to current standards otherwise they should not be used. Unless someone can show the legal waiver.

[cap]

154. yes.. but to maintain certification, you need to pass current standards!

sorry dupe...

[Az]

64. Bev, Important question

Does our knowledge of altering the vote come from our theorising based on what was found or is the method spelled out in the documents found on the FTP site?

[DEMActivist]

75. Not sure I understand your question, but...

I'll try to answer what I'm assuming the question is....

The evidence of vote manipulation is in the files on the FTP. We are being especially careful not to "color" opinions of folks who are newly looking through those files. If we point the finger at the problem, saying "look here, look there," they have not independently verified our findings.

[Az]

81. Understood but

The question is does the knowledge of how to change the voting record come from our research or from the files present at the site? That is did we look at what was present and determine that tampering could occurr or was there what amounts to instructions on how to do it already present. My take on what I have read so far is that the documents available amounted to a roadmap to steal an election. Whether the map was used or not we cannot tell. But the existance of such a roadmap on Diebolds site is damning enough without evidence of use.

[DEMActivist]

83. Already present

in many forms - the programs, the manuals, the instructions.

The roadmap led us to the evidence.

[BevHarris]

78. Before I answer that, did you read the method described

in the article yesterday? http://www.scoop.co.nz/mason/stories/HL0307/S00065.htm

Because it wouldn't seem that a readme type file would at all be needed, would it?

Bev

[Az]

85. Rereading now

The reason I am pursuing this issue is that for the public to grasp this they are going to need to be smacked in the face with something substantial that does not require an understanding of computer issues. A complex issue will be boiled down to a minor problem by the spindoctors of the right.

[DrBB]

67. Was kinda hoping "Rob" wd be a verb. Rob needs

...a good lawyer and a secure location. He sounds like most of the real engineers I know--decent straightforward guy who just wants to fix the thing and do it right.

I expect he's about to face some serious attempts at libel, entrapment, slander, and even physical intimidation. That is some seriously ugly shit he's talking about these guys, and if they really are up to what it seems like, look out Rob-Georgia. I hope he didn't sign a non-disclosure--though I'd be surprised if he didn't have to--cause they'll come after him with some serious law as well.

[BevHarris]

82. Well, there again, I believe he is totally protectable under

whistleblower laws and legal support. You've got a situation where Diebold orders you to install patches, then Diebold orders you not to tell the official voting machine examiner what you're doing, and you get in trouble when you answer an honest question, and after you report the problem to the CEO, they dump your ass.

If he has any problems at all, I know exactly who I will call on his behalf.

Bev

[Pale_Rider]

260. Or the poor field service person ...

... gets put on a small private airplane to fly out to some backwoods precinct to service its' Diebold systems.

[John_H]

69. Bev, I can't for the life of me believe

that the ATl. Journal-Constitution would not be interested in this! Some well meaning advice from a fan and old PR hack, if you're not already doing it: Pitch these stories to the relevent local print and TV outlets before you post this stuff here, in NZ, or your site.

This story is a solid, sexy, up front sell--INDEPENDENT COMPUTER EXPERTS accross the nation are beginning to SUSPECT that there MAY be some questions about voting machines USED IN GA since the code was inadevertantly published on the internet. Now we have PROOF that a major player lied to a major news source about a major method that could POSSIBLY be used to alter elections, incuding the one in GA that HELPED TIP THE SENATE.

It can't hurt to offer them the scoop first-- if they say, "No, Bev, we don't do stories from whack jobs like you." Then do NZ, and you can, as the story unfolds keep going back to them and say, "still think I'm a whack job? All I'm trying to do is make your f'n career, Pal."

[BevHarris]

104. Been there, done that. You could walk in the front door of the AJC

with two rigged machines and a candidate in handcuffs and they'd look the other way. Let me tell you what some poor excuses for reporters did: When we discovered 40,000 voting system files floating around in the wild where any hacker with a laptop could get at them, and I called the political reporters at AJC AND OFFERED TO GIVE THEM A GUIDED TOUR OF THE WEB SITE they turned me down, saying they did not consider the story "important" and wanted to write stories about the state flag instead.

There have been numerous attempts by many reputable people to interest AJC in the story. We need a reporter there who is a real reporter. There are some. Then, we need editors with the integrity to cover the story.

Oh yes, and the AJC, after receiving written information confirming the security flaws, ignored looking into that but DID print a two-month old press release about how much fun it is to vote on the machines, urged on them by Georgia Secretary of State Cathy Cox, who was well aware of the problems.

Bev

Bev

[monkeyboy]

122. How about inundating them with Letters to the Editor?

Pretty simple really, just send them to [email protected]. Whadya think? Start a seperate thread, perhaps?

[John_H]

277. Great Idea

I'll post mine tomorrow.

[jos]

98. Lawsuit?

Has anyone discussed filing a lawsuit enjoining use of these machines? Bush v. Gore could be relied on as legal precedent. Sweet irony there!

[w4rma]

126. Bush v. Gore

"Our consideration is limited to the present circumstances, as the problem of equal protection in election processes generally presents many complexities."
http://www.geocities.com/dearkandb/supremeqanda.html

Decision:
http://www.supremecourtus.gov/opinions/00pdf/00-949.pdf
(December 9 stay stopping the recount) - PDF format

http://frwebgate.access.gpo.gov/supremecourt/00-949_dec12.pdf
(December 12 opinion) - PDF format
{Andrys’ alternative for the Dec. 12 opinion, including Dissents}

http://supct.law.cornell.edu/supct/html/00-949.ZPC.html
(December 12 opinion and dissents) - HTML browser and PDF formats

[Walt Starr]

128. There's a problem with your precedent

Under the majority decision which none of the felonious five would admit to authoring, Bush v. Gore CANNOT BE USED AS PRECEDENCE IN ANY LEGAL ARGUMENT.

This means that if, in 2004 for instance, The exact same thing were to occur with identical numbers of votes in Florida etc. etc. etc. with the only exception being the numbers are reversed and it's Bush demanding the recounts, the SCOTUS could make a decision that is 180 degrees in opposition to Bush v.s Gore putting Bush back in office.

It's all there in the treasonous decision.

[jos]

172. But

That doesn't mean lower courts can't consider it, or necessarily that that all the justices in the majority meant what they said. In any event, an action could be brought under the Constitution or the Voting Rights Act that the machines do not assure people of their right to vote, and to have that vote counted.

[HiroP]

101. Technical details

First off, I think Bev Harris et al. are doing a great job trying to cut through all the secrets surrounding these voting machines and that there is still lots of investigating to do. Just hearing "Windows" and "Access" in conjunction with voting machines gives me the creeps.

On the other hand, reading this "second volley", I did encounter some passages that do not seem accurate to me, from a technical point of view:
1.Setting a modem to "dial-out only" per software is pretty basic. I'd assume everyone sharing a line between phone and modem would have to do that since otherwise the modem would pick up on every incoming phone call. The handshake issue is beside the point because a handshake only takes place after the connection is established (i.e. the modem has picked up), which doesn't happen if the modem is correctly set to "dial-out only". (I'm not taking into account any configuration or software errors or malware that is acting behind the user's back.) Naturally, once the connection is set up properly, it works both ways.
2.Manuals mentioning "modems, ports, uploading, downloading, TCP/IP protocols, transmissions" or "wireless communications" do not equate to "this machine has an Internet hook-up". I can do all those things with two machines that are only connected to each other, but not to the Internet, or even a single box. I can even run (and use) my own web server without it having anything to do with the Internet. In short, a "Web Server" or "Internet JAVA & HTML reports" depicted in a diagram do not necessarily mean that these reports are served to the public from that same box.

In my opinion, these inaccuracies should be addressed before distributing the story. It only hurts the overall message if it's not ironclad. I would absolutely hate to see it discredited just because of some details.

To clarify: I have not looked at any of the original Diebold files, I'm just referring to Bev's article. If anything in the original files (or anywhere else) invalidates my points, then please ignore my comment.

/me puts his asbestos suit on ;)

[hunter]

119. Layers, and layers, and layers...

The "dial out only" issue is a diversion. In any case it appears that the upstream machines are connected to the internet, which means yes, the entire system ("dial out only" modems and all!) becomes "connected" to the internet.

[w4rma]

123. IMHO, you are correct, HiroP and I doubt you'll need that asbestos suit

Note, that there will most likely be some detail somewhere that was missed or some mistake is made. The challenge is to keep the number and scope of these inaccuracies down to a minimum so that the inevitable discussions on this major story don't lead off onto tangents based on these details.

[Hubert Flottz]

109. Did you show this story to the people who lost the elections in GA?

Some of those who this may have hurt in election 2002 may still have enough stroke to help out! If the Robbed Georgians don't know about this, it's high time they find out! If the Evil Ones cheated the war hero from Georgia out of his senate seat this could be the straw that breaks the elephant's back! - Total Recall!!!!!

Bush is running a three ring circus, this gets better everyday for us hatters!

[BevHarris]

125. Okay, New Zealand is waking up now,

if someone gets a chance to revisit the link in the original post, I toned down the business about one-way modems, because it is in no way central to the point of the story.

Naysayers, weigh in please. Show your nits now.
Bev

[elfling]

135. any modem opens up a whole class of exploits

Even if the modems are one-way (and it's likely that they are so because of software or firmware, either of which could be overwritten with a malicious patch - is an attempt to dial in via modem part of the test suite?), there is still the question of where those modems connect to.

- The modem could presumably connect to any computer, not just the GEMS system. So again, a malicious patch could cause the machine to dial up any other machine for instructions.

- What secures the computer that is intended to receive these dial-ins from the precinct? A possible attack is to masquerade as a legitimate precinct machine and upload those "vote counts" to the central point. If the computer were to receive two inputs from allegedly the same precinct, what does it do?

[Eloriel]

177. Oh, good point, elfling

and welcome to DU!

Eloriel

[Pobeka]

189. The modem part is important!

Dial out, dial in, is just who initiated the connection. The *real* questions are, after the connection is made:

1) Is the application that dialed out in complete control of the modem, and if so, what data is the application transfering in and out of the modem connection?

2) If the application is not in complete control of the modem connection -- which is the default for most connections -- what services are running on the computer that are able to be contacted remotely while the apparently legitimate application is simultaneously using the modem connection?

--
On edit -- changed "initiated the question" initiated the connection.

[SDent]

130. this is definitely an interesting read

and after having read everyone's responses as well, the lingering question for me is why are the technical details being left to the world of political and computer forums??? why have you not turned this over to a reputable computer firm who can tell you exactly what all this means, and thereby ensure your story is credible?

[cap]

144. you have to pay a computer company to do this...

however, there are people at Stanford who are looking into this.

[BevHarris]

145. I assume you have the hundred grand that would take?

I accept VISA and Mastercard.

Bev

[Name removed]

150. Deleted message

Message removed by moderator. Click here to review the message board rules.

[w4rma]

163. One tactic might be to let the mainstream media pick this up

and then let them front the bill for the research (as they'll be the ones making the money off of it at that point).

[ParanoidPat]

171. I guess that explains Bevs motives....

.....but what about the rest of us? :shrug:

Can you please tell me why my friends and I have been working 16 or more hours a day on this. Can you explain why we put ourselves at risk of being considered 'terrorists' who are trying to undermine the electoral process in this country? Would you let us all know what we stand to gain from all of this other than the knowledge that our votes will count in the next election? :shrug:

All I am is a screen name on a web site. Nobody knows who the hell I am and they sure don't know the others involved in what we're doing. We are NOT in any way associated with Bevs group. With any luck NO ONE will ever know who we are and that's just fine with us. :)

So I ask again, What's our motive? Why would we lie about something that is actively being looked at by others and soon be exposed?

On occasion when they think they've found something they may ask us to verify what they are seeing. Those requests are made in the broadest possible terms. We're simply asked things like, "what do you think of this routine?". First we check the documentation to see what the intended function is 'per the Diebold manual'. Only then do we look at the source code and 'follow the logic' of how the hardware will respond to what the software is asking it to do. We then relay our concerns back to them. Only after we have described our assessment of the situation do they tell us if we're in agreement on interpretation of the logic path. So far we've found no evidence that their people are misinterpreting the logic flow. :)

I can equate the voting system to a 'high tech' chess game. Only in this game the board is on multiple levels and is a mile square with thousands of pieces! It takes a team of players to see what's going on on all the levels and from every angle of the board. The difference between how we're playing the game and how Diebold plays it is simple.

Diebold holds their game in private, behind closed doors with only invited players. Then they invite us to bet on the outcome. They don't allow us to see how the game is actually played, they only give us a book of rules and swear they played by them. We only get to see the outcome of the game after it's over. They only show us the final position of the pieces. You are forbidden to watch the game in progress. If the game is questioned, they go back behind closed doors and replay the game. When the doors reopen, even if all the pieces are not in the same final position, they declare the same outcome and victory for one side.

We just took the game and opened it to the public. Anyone can play and anyone can see for themselves how the moves are made. The best part about how we play the game is that in the end everyone wins. :bounce:

So umm, what's my motive? :evilgrin:

[SDent]

176. If you're referring to my post that was deleted

nowhere in that post did I accuse anyone of lying. nowhere did i say i didn't believe the research. all i asked was why every semi-quasi wanna be geek to potentially great experts but we don't really know because they're participating via the internet is being asked to research this. This is a very important issue, as you state, to our democracy. don't you think it deserves to be treated a little more seriously than this? with all the effort and pushing for sales and interviews and speaking gigs don't you think some funds for research could have been raised? don't you think that there might be some companies who also share our concerns who would donate their company's services for this issue? I'm just asking and all i got was a rude smart*aleck* response.

[DEMActivist]

178. Please, SDent...

take it upon yourself to pick up the phone and start calling some of these places to solicit assistance. We'd welcome your participation and activism.

I won't bother you with the responses we've gotten from these folks. It might discourage you.

As Bev says, grab an oar and start rowing.

[cap]

179. no I dont think any company would "donate" their services...

companies are for-profit entities. Also, any blowback from working on this software would be potentially embarassing to government officials who award contracts. No company likes to piss off government sponsors.

That's why it has to be non-profit and volunteer groups who do this. If you are interested in working with people who have more of a standing in the community, look at Stanford University. There are some academics who are highly critical of the current voting systems over there.

[SDent]

186. has anyone contacted the group at stanford

about the discoveries you've made so far?

[cap]

194. sdent... I would like you to follow up and contact them yourself...

please double check us...

[SDent]

197. would you now

yeah that'd be really great cap. i could call them up and say "I don't know any of these people except for online, but they say they are Democrats and I think this issue is really important. They're spreading all this stuff all over the internet and they say they've found a back door. Could you please call them up and see what they've got?" I'm sure that'd go over really well.

Again, I ask a sensible, straight forward question: Has anyone involved in investigating this very serious issue that affects the core of our democracy, anyone involved in the group that is getting press for leading this investigation, the "lead investigator", "expert", "erin brokovich of electronic voting" or any of her delegates contacted Stanford to ask the expert scholars who are already studying this situation whether or not they can verify your findings. What I get back is the implication that I only criticize and never participate in activism. what. ever.

[cap]

199. I most certainly would think it would be great if YOU

contacted Stanford yourself. You can present your own concerns about these machines -- which you do have, don't you? And simply ask for their opinions. You don't need to involve us.

Please do not pass off my suggestion that you contact Stanford as your own idea. You did not even know there was a group over at Stanford examining these issues. Now that you do know, if you think there is any merit to what we are doing, go ask them about it.

I think you would be a whole lot more satisfied if you asked them yourself. On the other hand, if you think this thread is a lot of idle chatter, please ignore it and go away.

Don't forget, you also need to contact software companies and ask them to inspect the voting machine software for free.

You've got a lot of work to do.

[SDent]

210. glad to see your sense of humor's still intact

even if your judgment isn't.

[cap]

212. you have too much work to do to afford to troll this board...

get back to work.

[DEMActivist]

201. Asking that question at this late date

leaves you wide open to the criticism you are receiving.

In fact, if you bothered to go to blackboxvoting.com and read you'd quickly discover a great deal from Dr. Dill there already.

Excuse our contempt while we cover ground we've already covered and that which you could have been aware of if you were doing anything but getting personal attack posts deleted at DU.

If you're really interested in helping, I can only repeat "grab and oar and start rowing."

[SDent]

217. i've been there

and i've read many threads on the history of involvement from DUers on this issue. Just because i'm only posting recently doesn't make me troll or uninformed. and just because i disagree with you doesn't make me any less of an activist.

[cap]

223. SDent, quit causing trouble and get back to work!!!

You still need to contact Stanford University and those software companies that you were going to line up for us to do a free audit. Also, now that you know about Dr. Dill, you can ask him about his opinion on the whole thing.

Get to work!!!

Your task list is growing as we speak! You do want to make a positive contribution to this effort dont you?

[cap]

224. SDent, quit causing trouble and get back to work!!!

dupe!

[hunter]

205. I'm just a tech whore, but...

I think I'm a little less disreputable than most, sort of like Julia Roberts in "Pretty Woman" or Rebecca De Mornay in "Risky Business." At the moment I don't have a pimp, does anyone want to be my pimp? I could use the money. (And I do good electronic BJ!)

After I read your first post, SDent, I assumed you were an innocent, but you made it clear soon enough that you were not, and I had to dump the nice "Welcome to DU" I was writing for you.

But enough of that.

Actually, it's pretty easy to get in touch with scholars. A lot of them answer their own email, their own phones, and they are quite happy to discuss interesting problems like this.

But there are some horrible legal problems here, so many that I would be reluctant to touch this thing for any amount of money. Diebold has some pretty deep pockets, and it's clear they've got some powerful political connections.

If you want some civil discussion I can do that, but it would be nice to know a little bit about you first. Why are you here? You can't just step into DU with guns blazing, accusing Bev Harris and Dave Allen of engineering this as a publicity stunt, and expect folks won't fire back at you.

Peace

[SDent]

218. what exactly have you concluded

I'm guilty of since I'm "not innocent"? i didn't step into anything guns blazing. I asked polite questions and got rude answers from people who are too defensive about their own involvement in this important issue to hold a civil conversation.

[cap]

225. the conclusion, Sdent is...

out of 13 posts, 6 of them have been calling people names...

I have given you a task list so that you can redeem yourself. Go out and get to work and bring back some results. Then you will have something to show for yourself and you can get back on everyone's good side. We all want to like you, SDent. Just give us a chance.

Do a bit of work and posts the results and we will all love you. Dont you want us saying all the nice things that we say about Bev about you as well? Would you prefer to be called a god or a goddess?

[SDent]

239. cap

i couldn't give a flip what anyone here thinks of me. i've already voiced my concerns as a Democrat as to how this is being handled. and rather than address those, you deign to put together some "task list" for me in order for me to "redeem" myself?? WTF. get a grip. i do plenty of "work" and my work constitutes more than getting on a forum and calling other people gods and goddesses. apply a little bit of critical thinking and discernment and you might "redeem yourself" with me.

[cap]

245. actions speak louder than words...

do your work and present your results.

If you have done work other than what's on your task list, please post it if it pertains to the subject of this thread.

[SDent]

259. further

your statement re: my posts (when they were at 13) is untrue. i had not called anyone names. at all.

[cap]

265. you need to redeem yourself...

why dont you post your work about voting systems. Maybe that will give you back some standing. I think you might feel better by doing so. You are not eliciting many positive responses from people. By creating a piece of work and posting it you will stand a better chance. You are doing nothing now to help yourself and I am offering you a chance: either take me up on my little "task list" and make a contribution or post your own -- or just take a time out from the discussion and let the rest of us go back to the matter at hand.

I just alerted the mods and they will let you know if you are out of line.

[SDent]

270. the only person stalking anyone on this thread

is you stalking me repeating yourself and harassing me. i've alerted the mods to this behavior and they will let you know if you are out of line.

[SDent]

237. in addition

did bev or did she not say "bring on the naysayers and the nit pickers"? that's what i thought i read. i wouldn't call myself either one really. just a person who has read about this issue, considers it very important and doesn't want to see it mishandled. i don't believe i've accused dave allen of anything. as far as my "accusation" toward bev it wasn't even that. i merely quoted herself (under her other name or pen name or whatever it is) back to her when she got rude and condescending towards me. like i wouldn't know that asking a credible computer company to verify results would cost money...please. i know i'm new here as far as posting goes (not reading). and i know i have managed to piss a few people off with this but i didn't stride right in with my size 10 boots you know. i asked questions and demonstrated that i held a different opinion and out come the accusations of beinga troll and not innocent etc. i feel strongly enough about my convictions to discuss them with anyone anywhere and can discuss the logic behind them. apparently more than a couple of people here don't. as for statements like "we don't have time to hold your hand", 1) i'm not a child 2) you seem to have a whole lot of time to post "way to go!" 300 times a day, even if i didn't know anything about bbv, wouldn't it seem like educating others is a worthwhile thing to do? 3) if you can't take a challenge from a fellow liberal who happens to also think the issue is important but differs with you on how it should be handled then the freepers are gonna Loooooovvvve you.

[SaddenedDem]

240. Ya know....

you really, really need to change more than the lack of the enter key to hide your true identity....

The behavior is telling, along with the arrogance. Just can't resist can you? Too many people had you on ignore, huh?

[SDent]

254. huh

check your meds SaddenedDem. This has got to be at least the third or fourth mysterious person i've been accused of "really" being in this thread or hadn't you noticed. I've never been on this board under any other name. I'm not a republican trying to disrupt or whatever. i'm not a troll of any kind unless you consider disagreement troll behavior. that part's up to you.

[SaddenedDem]

261. How many people?

I see just one - but then again, I haven't taken my Tylenol yet.

[SaddenedDem]

243. Wait! Let me make you feel right at home....

In the infamous words of grasswire:

YAWN

[dmr]

181. That's the beauty of American Ingenuity

Something I try to teach my son -

Your suggestion is nice if people had the money to do just that, but they don't.

However, Americans who have the expertise to begin an investigation, and an extremely thorough one at that, are to be commended for their sacrifices and willingness to help place our country on the right track again.

The big companies can do their thing later on. Tell me, which coporate entity would have investigated this on their own accord? Probably none to zero. I have an incredible amount of respect for each and every one of the researchers - talk about American ingenuity. It rocks. They gave this cancer legs that can't crawl away.

[BevHarris]

182. I, for one, very much want THIS research to be public domain

I also see no reason to jump to conclusions about what skills people do or do not have. Creativity and persistence and sometimes even hunches and quirky thinking can uncover the answer to little mysteries. We share the answers and build upon it.

Let's drop the elitist approach and go clean this toilet.

Bev

[SDent]

192. I didn't jump to any conclusions

and I didn't insult anyone or their abilities. i asked a question. You however, are insulting me at every turn. My approach isn't "elitist". It's pragmatic. And for someone who claims to know so much about the media, you should know that if this story gets legs in the mainstream media and the claims you're making are not verified by expert sources then there is a possibility that the opposition will shred you and the story, thereby convincing everyone that there really was no election issue. It's a valid concern in my opinion, and for you to try to dismiss it as "elitist" is offensive. but i do understand your motive for trying to keep everyone grabbing oars and cleaning toilets. keep churning...

[Pobeka]

196. Consider this...

<soapbox backed with reality>
Open source has changed the computing world dramatically. The quality of open source software is head and shoulders above most software that is generated by private companies. Why? (and that is the point here),

1) Generally, employees of software companies don't have a driving interest in what they are doing when programming software, it's just a day to day job with a paycheck

2) Software companies can not afford to pay the number of person-hours it takes to create truly good software.

Open source programs overcome those 2 obstacles with ease, particularly given the nature of the internet.

I think those 2 points apply very well in this situation -- those folks behind the scenes here have a driving interest in finding out the truth behind the GEMS software, and there's like more working on it than you'll ever be able to afford to pay from any private company.
</soapbox>

Three cheers for the team!!!

[SDent]

184. out of curiosity

you mention you and your friends and then you refer to "them" and "they" when you talk about the independent verification going on. who are they?

[Eloriel]

215. "They" are

Knights in white shining armor.

Warriors and Warrioresses who are out to do nothing less than save democracy itself. (And THAT's no hyperbole either.) Modern day Paul Reveres and Harriet Tubmans.

Gods and goddesses of truth, justice and the American way (the real one, not the fake one).

A small handful of truly incredible, talented, brave and courageous, totally AWESOME people, led by the Joan d'Arc of Electronic Voting herself.

Now. Who the hell are YOU?

I'm:

Eloriel

[SDent]

219. good lord

i'm sdent. nice to meet you eloriel. now would anyone care to answer the question? i'm not asking for personal information about people, i'm just asking who "they" are since the original poster didn't make that clear. fer chrissakes - talk about a cult of personality...

[Eloriel]

227. I already told you who they are

a small group of people who've come together to research this. Had you been here at DU all along, you'd have seen some of them talking about some of this right here at DU. (And what DOES bring you to DU, btw? Is there somebody at HartCivic who is your former boss too? Or -- ???? )

:shrug: Perhaps if the old DU software is set up for it yet, you can do some searches.

Eloriel

[SDent]

244. well that's where the confusion lies

if you read the post i asked the question about you will see (as i said) that the author refers to himself and a group of his friends and then separately to "they/them". i just wanted to know who these two groups are that are independently verifying work because it wasn't clear if they were both at DU or if one group was DU members and the other group was other people not at DU. i do read DU. not religiously, but when a topic interests me. this one does. i have read some of the earlier posts on this subject. what brings me to DU is what brings me to any other liberal website or forum: information and occasionally exchange of ideas. i have no idea what HartCivic is but whatever it is i doubt any of my former bosses are there.

i am truly amazed at the amount of people in this thread who assume because i disagree or either don't know every minutae of what every person in this very large forum has done toward this issue, i must therefore have never read anything about this on any site, any of the press that bev has generated, or any previous threads at DU. or that i'm a troll!

[cap]

229. sdent, get back to work....

what is the status of your task list?

If you are idle, I can give you more tasks...

[ParanoidPat]

231. "They" refers to whoever it is out there....

....working on this on Bevs end. Truthfully, I really don't know who 'they' are! :evilgrin:

And I prefer to keep it that way. :)

I only know who my contacts are.

Wait, I have to qualify that statement. I don't even know all the people on this end either. I deal with a group of computer and IT specialists from different backgrounds, each with unique skills in different areas. They work in different companies from small consulting firms to Fortune 100 corporations. Some of us are unemployed thanks to the Bush* economy and have more time than others to coordinate efforts. Everything we do for the most part is done 'off line', face to face. The people that I personally know and deal with, in turn, have their own friends and co-workers that have been looking at this.

I have no idea of who they are either. :shrug:

All I get is their summary of what they find through my contacts.

I use a trusted, time tested method of 'following the logic' and documenting where it leads. They have their own methods unknown to me. Between us, we keep arriving at several crossroads so to speak that invite questions. What makes it fascinating is the coders comments in the source code related to the mystery modules at those crossroads. I'll be publishing more on that later.

For what it's worth, I don't know and I don't care who does what. This is a matter of pure logic. Personalities and credentials really don't matter at all. The answers are purely logic driven.

YES/NO

ON/OFF

1/0

Nothing else matters!

Do the answers from all the sources fit the logic confines of the hardware/software interface.
This is after all just a machine, with a finite number of possibilities.
The software defines what the hardware does. It has to be loaded in a specific order for it to work. If you start with the first thing the machine loads and go back to the source code, you can then establish a logic flow chart of the include statements to see what else is called and in what sequence. At each 'include' level the source code also defines what actions are taken and/or permitted by the hardware. Step by step, line by line, module by module it's the same thing over and over. follow the logic. Every line is a question with only two possible answers. Yes or no, on or off, high or low, in or out. Just logic.

The hardware can only do what the software allows it to do. Understanding the logic flow is a complex and time consuming task but it's not an impossible one. At the end of the day it's not who initially discovers what that matters, rather, do we agree on the logic of the situation and can we prove it! :)

I've already wasted too much time watching people argue semantics and prop up straw men. I still have a lot of work to do so I'll bow out now.

I hope that helps answer your question. :evilgrin:

[SDent]

248. it absolutely answers my question

and I appreciate the straightforward, polite and non-dramatic response. really. I agree with everything you've said above re: your approach, testing methods, etc. i'm intrigued by the independent groups finding issue with the same things. the only thing i disagree with you on is that i think credentials do matter. not when it comes to analyzing, but when it comes to standing up to the criticism that will come if this story goes mainstream. that was my only point in asking the questions i have today. but i understand you have work to do and i think we both have expressed our opinions thoroughly so good luck on the work.

[Pale_Rider]

253. These systems are nothing more than a spin-off from your ...

... typical tavern video poker machine. House usually wins ... IMHO.

[sendero]

168. you'd be lucky...

... if it only cost 100K. Thats about 8 man/woman months of quality analyzer. Given my understanding of the amount and nature of the code here, you are probably talking more like 500K.

Thank goodness there are people who are willing and able to devote their time to this analysis, I salute all of you!! :)

[govegan]

165. Now if only Linus Torvalds had turned Linux over.....

Bad idea, my friend. Very bad idea.

At the end of the day, the citizens of a free democracy should NEVER entrust their votes, and thereby the whole electoral process and the foundation of representative democracy, to money-grubbing proprietary interests.

What was so bad about a personal scrawl on a piece of paper?

[elfling]

187. commercial auditing not the answer

SDent, I've been around computers and computer systems a long time.

If you want to find security holes, there is no better way than to involve the open source community, give people a puzzle and let them hunt it down.

There are many experts, reputable experts, who will poke their noses in on their own curiosity. Plenty of graduate students, too.

Offhand, I can think of very few companies with enough expertise. There's not one whose word I would trust more than the open source community, especially not for something so important to all of us.

Remember, allegedly a commercial company ALREADY audited this.

I'm glad this is out on slashdot.

[SDent]

200. Open source community

Elfling, as I have. And I'm not by any means saying I don't trust the open source community to do a good job with this. I'm just saying that the community that is investigating this is unknown and when the press starts looking for holes in the story the fact that some unidentified people on the internet referring to themselves as experts says there is a problem is not going to be good enough. I too am glad it's out on slashdot. It's certainly more enlightening to read their comments on the issue than 197 post long threads of "ooh what's this?!? hmm that looks interesting! who's that?" The sad part is that all that stuff is already on publicly accessible boards and when it comes time for the republicans to discredit this effort it won't be hard for them to do.

[DEMActivist]

204. Who called themselves an expert?

Seriously, show me ONE post from any DUer who called themselves an expert in this topic.

You won't find a single instance. Not one.

What this group is are patriots - citizens who refused to sit down and shut up when they were told to. Americans who believe, beyond all else, that the right to vote and have that vote counted as CAST is the basis of our democracy.

I am truly sorry you don't see it that way. It does, however, say a lot about what you think of our democracy.

[SDent]

226. you don't think

"Bev Harris, author of "Black Box Voting" implies expertise? but that's beside the point...do you think she's going to write articles that say "a bunch of people who don't know what the hell they're doing think they've found a back door"? you're either so intent upon not seeing my point because a challenge to your thinking equals troll in your world or you have challenged abilities to reason.

[DEMActivist]

228. No, I see your point clearly

along with your agenda and your deleted post.

I'm simply not wasting my time responding to it.

[dmr]

233. SDent, really

I like and want the devil's advocate on any thread, but as I read your numerous posts, what I see is not a devil's advocate but someone who is following, or maybe even stalking this thread with the intent to discredit, embarass and demand.

With all due respect, what is your motivation here?

Seems like I said this once today already ....

It's like the old saying: 'Same shit, different day'

These posts are like: 'Same shit, different poster', or 'even same shit, same poster', who knows anymore.

[Name removed]

235. Deleted message

Message removed by moderator. Click here to review the message board rules.

[SaddenedDem]

236. HEY! You said what I was thinking!

You can fool some of the people some of the time, but you can't fool ...... and all that bullshit.

[SDent]

250. show me

ONE issue I've "hounded". people responded to my point and i've made several responses trying to explain my position after having been accused of being a troll (which ironically is exactly what you're doing now). ONE instance of diversion. ONE instance of demeaning posts where it wasn't a response to a rude or demeaning post. ONE demand (despite several demands made to me in order to prove or worse yet "redeem" myself). I produce plenty mate, just not here, yet. but you know i don't really have time to "hold your hand" through it if you haven't been following me already. and i have no idea who the * FW is. or SSDD.

[Name removed]

256. Deleted message

Message removed by moderator. Click here to review the message board rules.

[SDent]

266. another dupe sorry

again

[SDent]

267. DEMA

if you want to carry on with this delusion that i'm pretending to be SDent carry on. I obviously can't prove that's not true. I'm just me so how can i prove i'm not someone else.

as for my posts, my FIRST post is still up. so you're wrong. but instead of calling you pathetic or sad etc. I'll just leave it at wrong. the post that was pulled was the response to bev's smartass response to my question.

now, read your post above and tell me who's being demeaning

[SDent]

269. WAIT - stop the presses

I think (no offense to fredda) based on your reference above (i read the thread (this one? different one? i don't know) where someone asked fredda to show her stuff and she posted a link to an article.

DEMA i think you're saying you think i'm fredda! heh. no. i'm not. i'm SDent.

as far as i can tell fredda has been chiming in on her own. i don't know her and don't know much about her other than she seems to be bev's main naysayer and they don't get along well.

[SDent]

249. dmr

you and demactivist it would seem have had some experience with other naysayers and this is causing you to think i have some "agenda". i don't like some of the smarmy publicity tactics bev uses. but i'm not the first to say that nor was that my intention when i decided to participate in this thread. but i have also said i think the work is important and the issue is extremely important. i'm hopeful that as a skeptic i will be proven wrong. but i keep seeing things that cause concern for me and the further it goes along the more worried i get.

i didn't come here to stalk or discredit. nor have i demanded anything. i saw an invitation to the skeptics to speak out, and as one i responded. and i did so POLITELY. you guys need to get less paranoid or more thick-skinned, one. unless of course you only want yes people on your "team".

[Eloriel]

252. If you were so POLITE

why was one of your posts pulled?

Eloriel

[SDent]

264. You tell me

because i responded aggressively to an agressive post. however, i did not use profanity (on edit: that's not correct...i actually called her response "smartass") or call names. i just quoted bev back to herself. and i notice that several rude posts here have NOT been pulled, but i guess that's just cause i'm new and that's understandable if that's the reason.

also, my original question when i entered this thread was polite and was not pulled. there are several other polite posts you can read in this thread where people have dealt with me reasonably and i do the same in turn. but if someone dishes it up they can expect to get some back. if that's against the rules someone ought to put it on the site.

[cap]

257. please show us your stuff....

maybe you want to work more independently...

Then show us what you've done.

[SDent]

263. where

"What this group is are patriots - citizens who refused to sit down and shut up when they were told to. Americans who believe, beyond all else, that the right to vote and have that vote counted as CAST is the basis of our democracy.

I am truly sorry you don't see it that way. It does, however, say a lot about what you think of our democracy."

i wasn't questioning their patriotism DEMA. I was questioning the approach. And please don't tell me what I think is the basis of our democracy or what i think of our democracy because you have absolutely no basis for making statements about that. also known as talking out of your @ss.

[seemslikeadream]

208. SDent you've come very late

to the party. Don't blame us for your inability to understand what's been happening here for the last few months, you've got alot of catching up to do and no one here has the time to hold your hand.

[SDent]

131. accidental dupe

sorry about that

[On the Road]

146. Bev, I've Been Following Your Research with Great Interest

This story has been a long time in building and I'm sure it will be developing for months. It's extremely important.

However, to get picked up in the general media and have the maximum effect, it's important to have the right headline and sound bite. I believe focusing on Diebold's lies and misstatements about the software is the wrong way to do this. The most obvious reason for a Diebold employee to lie is to protect his or her job, or prevent their product from getting a bad reputation.

Likewise, proving that security was sloppy does not suggest bad intent. Lots of businesses do shoddy work and cover up the problems. In government contracting, it's endemic, and usually driven by laziness, deadlines, cost reduction, and a knowledge that the government will rarely follow up. So far, everything is standard operating procedure.

What's needed is an angle that would make a sophisticated independent reader sit up and say "What's this? This is new and unexpected! I want to read more." I believe that angle is the software structures you found, specifically the storage for multiple vote totals and the backdoor. A WSJ-type headline along these lines might read:

Suspicious Software Features Discovered in New Voting Systems
Why Were Backdoors, Erasable Audit Trails, and Multiple Vote Totals Built into Diebold's GEMS System?

The discussion would discuss the alleged reasons for the features and why those reasons are unlikely. Diebold's misrepresentations of their software add interest, weight, and drama, but they are a secondary point.

Just a suggestion. I want this story to get legs and traction.

[cap]

149. I say let's prove non-compliance with legal mandates

first and then if there has been intent, let's look into that afterwards. We can do the important thing which is to keep these systems from going into production. Then, if there's more to it, the truth will out.

[BevHarris]

155. You style the writing for the target market

Internet traction for a story like this is critical, because it has to keep bubbling while editors dither about whether to cover it.

See the link on how it is propagating...

I haven't done the mainstream blitz on this, because it's pissing up a rope. Let the chatter heat up for at least a couple more days, then we'll reach for the next rung.

But you are right, of course. For the main targest the style is toned down a lot.

Story 1 is a better mainstream hook; story 2 keeps them talking. A smash story 3 MAY be burbling up, but I hardly dare to count on it, for now, figuring something's gonna fall through...

If we make this story a centipede, hopefully two of those legs will walk into the mainstream.

[HFishbine]

156. Suspicious Software Features Discovered in New Voting Systems

Ribofunk, you've nailed it. Your headline and subhead clarify the issue as it stand now -- and intriguingly so. You have distilled the crucial points that are, so far, documented. The case for fraud in the Georgia (or any other election) has yet to be made. But as you show, that doesn't mean that the story is not yet important.

[Capn Sunshine]

188. IF it was WSJ, one more things to the subhead:

"Was Max Cleland Robbed"?
:nuke:

[BevHarris]

161. PERMANENT web address on Scoop for this article

http://www.scoop.co.nz/mason/stories/HL0307/S00078.htm

If you like the Rob-Georgia story, please send it to your friends, lists, cohorts, blogs.

Reversing the momentum towards unauditable voting machines will be no small task, but the media is awakening. Eyes blinking. Studying us in bemusement. Your help in spreading the word is very much needed.

Bev


Bev

[SharonAnn]

169. Done! My circle of activists is now informed!

Thanks for the quality of work you do.

Thanks for the focus of the work you do.

Thanks for helping us save our democracy!

[dmr]

170. Welcome to DU, SharonAnn

Good to see you here! :) :hi: :)

[SharonAnn]

174. Thanks, I was formerly ShaddAnn, but in honor of DU2,

decided to change my DU name to my real name. I wasn't sure how trusting I could be when I first came on here (Fall 2002?) but you guys and gals have won me over. I'm just SO impressed with the information on DU.

Guess I'm pretty well addicted.

Thanks for the nice welcome (or welcome back)

[cap]

173. Bev, do you know where the 1990 standards are...

I am comparing things back and forth -- but I can only guess from the overview on the web what the difference between the 2 documents are.

Do you know where the 1990 version of the voting systems standards are?

[BevHarris]

185. Dan Spillane has them

well worn and dog-eared. I'll PM you with his email, he's usually very helpful. And the regs are his thing, he's one of the real experts on them.

Bev

[jimmynochad]

293. I have a copy of them also

They are not in electronic format. I had to call FEC and have them mail me a copy. It is a three inch binder of stuff. The new 2002 standards are at fec.gov. Remember the 1990 standards are voluntary. State law is what will stick when it matters.

[revcarol]

198. Can you give us the address for yesterday's article, too?

Needs wider publicity than just the county clerk.

[DEMActivist]

232. Here ya go

http://www.scoop.co.nz/mason/stories/HL0307/S00064.htm

Sorry it took so long.

[TheUnionDemocrat]

190. GOOD God!!!

Can you just IMAGINE how many Democrats we could elect if we took all the energy being spent on this kooky issue and turned it into activism?

This is all embarrassing as HELL!

[cap]

193. yup... just think how much work you would get done for your candidate

if you would just stop reading this stuff, theUnionDemocrat!!!

Never mind, calling on us to fugedabout it!!! Please go back to working for your candidate!! Leave the rest of us to piddle as we will.

[sendero]

207. LOL

O'really ?

What are your computer science credentials? How long have your studied the code?

[seemslikeadream]

213. Hey Mr. TheUnion Democrat

I am one of those "out of touch, idiot leftist, irrelevant, leftist idiots that you were referring to on other threads. The name of this place is Democratic Underground what did you expect to find here?
If you are so embarrassed it's easy to fix just go back to your gun tottin' buddies and leave us peaceniks to do the math.

[alfredo]

220. What good is activism and a great

get out and vote campaign if the winner has already decided by some corporate crooks?

This is part of the struggle. Without fair elections, all the good work will be for nothing.

[nothingshocksmeanymore]

258. Yes I'd imagine research and a source for opinions is embarrassing for you

[Forkboy]

272. Look at the bright side NSMA

At least he's consistant.Consistantly what I'd better not say :)

[4dog]

209. What happened to thread on Volley 1?

Was the list of links too long? It seems to have vanished from page 1 of GDF.

[dweller]

222. here

it is
http://www.democraticunderground.com/discuss/duboard.php?az=show_mesg&forum=104&topic_id=6502&mesg_id=6502&page=6

it's heading into the archives.

dp

[BevHarris]

221. I thought with such a long article you might have missed THIS:

When I was asking him how long it takes to do a logic and accuracy test, and Rob was explaining why it doesn't take long:

Behler: "The L&A testing -- You would just enter, like, one vote and -- you just choose one -- you don't need to be specific on which one. When they did this L&A testing, that's when they did the FINAL update to the software."

Check Brit Williams explanation of tampering security -- if there is tampering, the L&A test will catch it.

Okay. "You would just enter, like, one vote..."

I'm convince punching in one vote would catch fraud, aren't you?

Bev

[Pale_Rider]

251. What sort of testing is that?

One stinking vote! What if there is some floating point 'error'?
Of course all bets are off if they download new system software to the terminals. They would definitely need to retest and recertify with a single vote. /sarcasm

[cap]

268. another thing is that ...

buffer overflow is expressly forbidden by the 2002 voting system standards.

[govegan]

262. What's the old song? There's a dead skunk in the middle of the road?

Hey, I am way behind the curve,
as the salmon sucked sun slowly ebbs into the silver streaked sea...

but, THIS SKUNK REALLY STINKS!

All of this techno-babble hand-wringing gets a little old.

The burden is clearly on the software company, the government and their agents to show that they are competent.

This now you see it, now you don't, system of vote taking and counting is strictly for the totalitarian, citizens be damned set of ruling elite and their apologists.

The technology is, and has been for many moons, there to build a solid and complete vote-taking and tabulating system.

The fact that we are being patronized with this steaming pile of dead skunk is an extreme insult to civic minded individuals everywhere.

[jimmynochad]

295. Brit Williams told an audience

at IACREOT last year that the Georgia L/A testing was a person standing in front of the screen and voting in "public view" a series of voting patterns that go:

Vote once for first candidate, two times for second candidate, three times for third candidate, etc. until the ballot (he never defined the size of the ballot) was finished.

Claimed that all 19,000 machines would be tested that way.

One thing that bugs me is that the machines are in a test mode when they are L/A tested. Why not make them in real voting mode? Since it appears you can wipe the slate clean, why not use the same mode that the voter will see?

[BevHarris]

303. Now that's a nice catch, JimmyNoChad -- tweaking my memory...

sometimes you see the exact phrase and you think, "where have I seen that..."

I think the procedure you describe is in a memo or an article that I've retained somewhere. I remember actually trying to calculate the amount of time it would take to do all those L&A tests on that article. Maybe it documents what Brit Williams said.

If so, that would be an excellent thing for me to lay my hands on now. Doing a search...

And thanks!

Bev

[scottxyz]

278. Open-source / simplicity / straw man / TimeDateStampAdjuster smoking gun

At least one country (Australia) knows how idiotic it would be to use proprietary Microsoft blackbox spaghetti code for something like voting where transparency is vital:

Electronic voting and counting
Development of the system
http://www.elections.act.gov.au/EVACS.html#code

EVACS was written using Linux open source software to ensure appropriate transparency. A copy of the source code is available in a zip file (127 kb). The source code ... is in a separate file (38 kb). For more information contact Software Improvements.

In Australia anyone can download the open-source code they use in their voting systems, so the public can verify that it works. (The same way we know paper ballots work. Voting technology should be transparent, not blackbox.) Of course we couldn't do this in America for "copyright" or "profitability" reasons.

There's no reason for a voting system to be complicated or proprietary
Let me tell you something. I'm a programmer with about 10 years of experience with Microsoft Access. It's considered an insecure "toy" programming environment with minimal or no auditing capabilities and only appropriate for small projects. Access provides two programming languages to work in: SQL and VB (also known as VBA). SQL (Structured Query Language - a rock-solid industry standard that predates Microsoft) is where you write the guts of the system - you define tables (consisting of rows and columns) and then define "SELECT" queries computing totals based on adding together rows from those tables. VBA (Visual Basic for Applications - a crappy Johnny-come-lately language introduced to the programming world by Microsoft, full of weird confusing semi-documented behavior that drives most programmers up the wall for the first few months they use it - and generates lots of fees for Micro$oft at their 900-number help hotline) is where you write the code that displays the screens and menus. It's very easy to write "spaghetti code" in Access's built-in VBA language but a good programmer can avoid that by doing all of the computational work in SQL queries and then using just a modicum of VBA to get the various screens and menus to work together. (Note: You can of course write "spaghetti code" in any language.)

However, for a voting system, only an idiot programmer would write any more than a minimal amount of VB code. There's very little to do here: display a screen, let the user enter a vote, and close the screen.

You only need to define a base table with the votes (this is done in SQL, not in VB), and then write a GROUP BY query in SQL using the base table to tally up the votes. There's no procedural VB coding required for the guts of such a program. A little VB needs to be used to tie the whole thing together with some pretty menus and screens, but it would just be minimal window-dressing. A voting program that does one thing - entering and then totalling up ballots - is about as simple as you can get.

Which just shows how idiotic it is for Diebold to be saying there's anything "proprietary" or "trade secrets" or "copyrighted" here. They may have told their clients it was rocket science (to fatten up their fees), but any first-semester database programming student can write a GROUP BY query in SQL which computes a total. It's not something that needs to be copyrighted or protected like some kind of vital secret. It's about as complicated as doing a SUM() or a SUBTOTAL() function in Excel, which I'm sure many non-programmers have done. The whole notion that Diebold has to "protect its investment" in programming this trivial program is a load of crap.

Heck, right here I can write the a reasonable facsimile of the code that Diebold is claiming is a "proprietary" "trade secret" (and which they probably charged hundreds of thousands of dollars for).

Here's some simple code in SQL to, respectively, define a list of counties, define a list of candidates, record ballots, and then finally total ballots:

CREATE TABLE county (
county_id varchar(127) PRIMARY KEY
);

CREATE TABLE candidate (
candicate_id varchar(127) PRIMARY KEY
);

CREATE TABLE ballot (
ballot_id integer PRIMARY KEY,
county_id REFERENCES county,
candidate_id VARCHAR(127) REFERENCES candidate,
timestamp DATE DEFAULT NOW()
);

CREATE VIEW ballot_total
AS
SELECT count(*), candidate_id
FROM ballot
GROUP BY candidate_id;

Wow. Would you pay hundreds of thousands of dollars for this? Would you let a company clamp a copyright on this sort of standard stuff like it was some kind of "proprietary software"? (Yeah, there'd be a few more wrinkles to handle write-ins, etc - but you get the idea. Not a lot going on here.)

Diebold and ES&S are not only making our elections insecure, they're getting overpaid a lot of taxpayers dollars to do so!

That's pretty much all there is to programming a voting system. Sorry if it's a letdown for folks who think that programmers are geniuses or something but it's really pretty simple to write code that performs elementary addition and subtotalling.

Slap on a data-entry form which gets displayed so the voter can enter data once into the ballot table to cast their vote (Microsoft Access and most other database development environments often have built-in "wizards" which create such a data-entry form for the programmer automatically, or the programmer can roll up their sleeves and work for five minutes or so and make such a form themselves via a graphical programming environment) and then add in some sort of insecure modem-based unencrypted lame Internet communication protocol to send the subtotals down to some central office, and presto! you've got a big government contract for a completely insecure amateur voting system worthy of the slimiest backwater dictatorship!

The straw man: "one way dialup modems"
I won't even stoop to consider (at much length) the silly argument earlier over "one-way dialup modems" because once a machine is on a network a clever hacker - especially an "insider" hacker - can do whatever they want with it - whether or not the user manual says it's using a "one-way dialup modem" (yeah, bear in mind, Diebold says it's a one-way dialup modem. Since we never get to inspect these machines, why the hell are we even supposed to believe this abstruse claim?). Suffice to say that all you need is common sense here folks, and a recollection of what you've read in past few years about viruses running rampant particularly through systems that use Microsoft products. An email comes in (over that ultra-secure "one way modem dialup" connection or whatever the hell that is) and some fool opens it (maybe one of those unauthorized fools with security badges who for some mysterious reason has access to the room where the voting computers are) and then you've got a emailed virus running in the system every time the machine boots up again - a virus which can do all kinds of fun things like change tables in the Access program. (Even without an emailed virus coming in via modem, let's remember there are obviously plenty of other ways to get a virus onto a machine when the contractor can cry "copyright" whenever anyone attempts to look at their pathetic overpriced hodgepodge of hardware and software they have attempted to pass off as a voting workstation.)

But you don't even need such distracting arcana as "one-way dialup modems" or viruses to tinker with the database. Just go in and add and delete some rows like Bev explained in her article. A high-quality database (not Access) could use "triggers" to generate an audit trail to catch such a scenario - but Access doesn't support triggers.

The real smoking gun: TimeDateStampAdjuster
And while we're on a techie discussion... can I rant a bit about that special plug-in Bev illustrated in a screenshot - the one that lets you re-jigger the DateTimeStamp field? What on earth is that doing there?

You can check it out down at the bottom of this page:
http://www.blackboxvoting.com/scoop/S00065.htm

Yeah, instead of harping all day about the straw man in this case (the "one-way dialup modem") could we talk a bit about that bizarre little add-in called TimeDateStampAdjuster?



Talk about a smoking gun!!! What could that possibly be for except to blow away what little audit trail there might be in Access? There is NEVER any need on a database system to re-jigger a DateTimeStamp that's been set to Now() using the field's default setting when the ballot was first entered. You'd be kind of upset if you found that your ATM had a little add-on like that running on it - the better to post-date your check deposit so it won't be credited to your account on time.

I submit the ONLY reason that little TimeDateStampAdjuster add-in could be in the system is to allow tampering. There's absolutely no other reason to include such an "add-in". The meaning of "stamp" in the name TimeDateStamp is just what you'd think it is -- it's a system-generated stamp which is used to show when a record was entered (or last updated). It's there for security and it's supposed to be read-only - no user's supposed to be able to edit it. You don't "adjust" Time/Date stamps - you let the system generate them and they're strictly hands-off to humans.

Access doesn't actually even have Time/Date stamps - but you can get something similar with a bit of simple coding, using one of two methods:

(1) You can create an AfterUpdate event on the data-entry form, but this isn't very secure because it only works for records being edited via the data-entry form - it doesn't work if someone were to go and tamper with the underlying tables, bypassing the form - which is easy to do if you just (a) use the menu called 'Window' > 'Unhide' to bring up the screen showing all the underlying tables, or, if that's been blocked by some whiz-bang "security" you can also (b) hold down the SHIFT key when you open the database. (This isn't a secret - it's in the Access manual.)

(2) You could define a field and name it something like DateTimeCreated in table ballot and set it to the function Now() so that the current Date/Time is entered into the ballot record the instant it gets entered - but even that could be overridden using (a) or (b) above as well.

But I guess the thugs infiltrating the Georgia voting system were too lazy to go through all that manual labor, so they had the clever little labor-saving add-in called TimeDateStampAdjuster so they could save a few precious minutes while they're sneaking around tinkering with the voting machines. (As we all know from those suspense thriller movies where the clock is ticking while someone's desperately trying to hack into the computer, this can be a high-adrenaline moment, so I guess it does make sense to automate this step so avoid hacker error and make sure the criminals can get in and get out quickly.)



Microsoft Access is a toy database
By the way, as you probably suspected, no ATMs, no flight-reservation systems, no field-deployed Department of Defense software is ever written the "toy" language Microsoft Access. Microsoft Access just isn't used for any major work ever, because all programmers know it isn't able to provide the auditing, security, networking or scalability required for mission-critical projects. The very fact that Diebold was allowed to win a bid for a wide-area network system using the "desktop" database Access speaks volumes about the incompetence of the government officials who ran the bidding process. If I had a potential client needing a wide-area networked database and I had the gall to show up and offer a system based on Access, I'd be laughed out of the room. It's only used for "desktop" or "departmental" databases - it's not a client-server database (it's a "file-server" database, which is vastly inferior to client-server), and it's not secure. And to top it all off, the Microsoft Access password file (*.MDW file) is known to be preeminentaly hackable and crackable.

While some people here are arguing about tangential issues such as so-called "one-way dialup modems", check out what the nerds over at slashdot are saying about the notion of even thinking about using Microsoft Access for a voting system. They find the idea utterly laughable.

Go to this page and do the "Find" command in your browser to search for "Access":
http://slashdot.org/article.pl?sid=03/07/08/1949200&mode=thread&tid=103&tid=126&tid=99

Or check out these derisive posts:
http://slashdot.org/comments.pl?sid=70364&threshold=1&commentsort=0&tid=103&tid=126&tid=99&mode=thread&cid=6395360

http://slashdot.org/comments.pl?sid=70364&cid=6395382

As you will notice, programmers don't even bother to get bogged down in the niceties of so-called "one-way dialup modems" - for them, the very idea of using Microsoft Access for something as serious as a voting system is humorous and/or horrifying enough in itself.


And if you're still uncertain about what a hacker can do once a modem is established check out the popular hacker program "Back Orifice" (a kind of disgusting-sounding name parodying Microsoft's "Back Office" product):

http://www.nwinternet.com/~pchelp/bo/bo.html

Back Orifice is not a virus. It is in essence a remote administration tool.

It gives "system admin" type privileges to a remote user by way of the computer's Internet link.

What does this mean? It means that if Back Orifice is running in your computer, a remote operator anywhere on the global Internet can gain access and do almost anything you can do on your computer -- and some things you can't do -- all without any outward indication of his presence.


A modest proposal - from a programmer
How's this for a voting system: Carbon-paper ballots, in triplicate. Voter checks off their choices. White copy goes in the white bin (tallied by Republican-appointed polling officials). Pinnk copy goes in the pink bin (tallied by Democratic-appointed polling officials). "Goldenrod" or "canary" copy goes in the yellow bin (tallied by a UN-approved auditing company).

[scottxyz]

279. PS to Fredda and SDent

(As some of you may have figured out, the last remarks about Back Orifice and the links to slashdot.org in my previous post were meant in particular to rebut the diversionary nonsense posted here by Fredda - not to mention the poorly punctuated hallucinations posted by SDent, if anyone felt those incoherent ravings were deserving of any sort of attention. Sorry to be verging on getting sort of ad hominem here, but someone's got to say it: the so-called "points" raised by Fredda and the blathering of SDent are irrelevant garbage. Fredda may try to sound sort of techie and smart here talking about working in "security" for so many years, but it's just a bunch of gobbledygook when you remember that we're talking about an inherently non-secure language Microsoft Access. Go over to slashdot Fredda and try talking about "security" and "Access" in the same breath and see how seriously they take you over there - they won't even dignify you with a response, they'll just laugh at you and spray you with onomatopoetic responses like

http://slashdot.org/comments.pl?sid=70364&threshold=1&commentsort=0&tid=103&tid=126&tid=99&mode=thread&cid=6395360


because all programmers know there is no security in Access. If Bev wants to leave out references to "one-way dialup modems" that's of course fine - because the fact that a voting system was written in Access is quite damning enough.)

[Fredda Weinberg]

290. "written in Access"?

I don't have to sound "techie"; it's what I do for my day job.

The security in GEMS is essentially physical; it's meant to run on a dedicated, standalone PC. Licensing a more powerful DBMS would be a waste of money.

It may not be the system you'd design - or I would - but I've seen enough of GEMS to conclude that it's an otherwise reasonable product and it meets the criteria I saw on the FEC website.

I've posted elsewhere where the first open source election system kept its audit files in plain text. I suppose you'd laugh at that too ...

I'm sorry such a derisive atmosphere has been created by this PR crew. It's distorted the original noble intention of cooperative research into a pissing match.

All programmers know there's no security in Access? Damning enough? Scott, on this issue, you've bought a red herring.

[T Roosevelt]

294. Oh come on - Access is undependable

to say the least. It was M$'s attempt to undercut all the other available desktop DB packages (dBase, Paradox) - and all the while managed to be a typical M$ product - half thought out, incomplete, basically a kludge of a product. I cannot tell you how many times I have seen Access-based programs crap out because it is not a complete DB package. The fact that it is packaged with Office should be enough indication that it was never intended for heavy lifting.

And if you think the voting process is not critical enough to demand the best (ie Access is "good enough") then...

[Fredda Weinberg]

299. It's not what I think

it's the implication this "story" is trying to plant.

Undependable? What does that mean?

The history of Access is irrelevant; so is our shared hostility toward Microsoft. The fact is, Access is suitable for a desktop application that sums and reports the ballot tallies.

It's reasonably priced - and that is a valid consideration.

[T Roosevelt]

325. Price is not the only consideration

Access was not written to be a mission-critical application. It was written to be basic, quick and dirty desktop database for common everyday people to be able to use (yes, the history of Access is VERY relevant). I am not bashing M$ in this (though I think they deserve the bashing they get); I am simply stating a fact.

If you consider the process of choosing the most powerful person on Earth a mission-critical application (I can't understand why anybody wouldn't), then Access would not even be on the list for consideration.

As for cost, I am sure that if Diebold (or any machine manufacturer) approached Oracle or Sybase and said "hey, we want to put your database software in every voting machine we make", I'm certain some price deal could have been made.

BTW - how did high levels of security not make it into the bid specifications for voting machines anyway? And if they were, how were they so completely ignored by allowing a system to be based on Access?

[Fredda Weinberg]

331. There's nothing "dirty" about Access

and for a desktop system that only accumulates vote totals, it's more than adequate.

There's no scandal here. You may disagree with the election officials' priorities, but you're not making a convincing argument with hyperbole.

[trumad]

282. tallied by a UN-approved auditing company...Snarf

Dude... Excellent...excellent post...

[ParanoidPat]

283. Thanks, we went through all of this about a week or so ago...

....but it's always good to have another voice of reason to echo it! :)
Dial up modems aside, these suckers have an open PCM CIA slot for an Ethernet or WiFi card as well! Drive by vote tampering! :evilgrin:

For all practical purposes it would be safer to use a PLC and ladder logic. And a hell of a lot cheaper too.

[German-Lefty]

284. Open Source Voting Systems -- Many Points -- It's not that easy

http://www.free-project.org/
Jason Kitcat did try to make "GNU.FREE Internet Voting package", but he concluded that he could not provide a secure system and is now against electronic voting.

Sorry to pick on you scottxyz, but you fail to grasp the complexity of the voting problem. Generally you have to do two things:
1) let people just once and prove election results.
2) keep details about who voted for what secret (secret ballot)

The cytpographic solution lies in blinded certificates. You create ballot message signed and blinded by you. Prove to autority A who you are, who checks to see if you've voted before and then signs it. You then unblind it and turn it in annoymously to authority B. A public list of unblinded ballots can be published were everyone can look to make sure thier vote was counted.

The system would be fool proof IFF you were doing this computational work. The problem with voting machines is you AREN'T. You sit down at some little terminal with a touch screen and you never know if your vote gets counted(or how). This among many other reasons is why I believe that in a digital age you need a trusted "personal computer" to be a person.

I can build a terminal that looks like it counts your vote but doesn't.
I can build a terminal that looks like it runs your software but doesn't.
It is proven NP hard to break the crypto your personal machine is running.

For now people like Jason Kitcat suggest that it if we have 3rd party voting terminals, they should at least give us paper reciepts. This was your suggestion too.

I think digital voting would be really cool. I just don't think we're there yet. Too many people aren't computer literate. It reminds me of African elections where they check off pictures because the literacy rate is too low. Who do you trust to set up a voting program on your machine when you don't understand it? Party leaders? Local community orgainzations? Some random guy on the net who wrote an open source version? A company? I'll definately go with the open source version, and I might just double check it.

[BevHarris]

286. Scottxyz: I thank you for such a cogent and thorough analysis

Thank you for taking the time to write this, and obviously, it took some time -- and by the way, your explanations of complex subject matter are quite easy to understand. You write like the "Mr. Science" of computers.

Really, really appreciated. Thank you so much.

Bev Harris

[tinanator]

289. Bev can you get this guy on Flashpoints?

I think he would be perfect for a followup story, and that is requisite for keeping the story out there, reaching listeners who missed it yesterday, and what he has to say would be an awesome story in itself. CONGRATULATIONS both of you, Thanks!

[Fredda Weinberg]

292. GEMS *is* a desktop system

Scott, you're opining on a subject you obviously don't understand. There's no reason for a client/server architecture in GEMS. So by your own analysis, Access is a suitable DBMS.

[jimmynochad]

296. One major reason Diebold uses Access

is very simple - Diebold needs the foreign language capabilies. Diebold is trying to sell into LA County which requires seven languages. Other vendors at the time could not do all of the languages on one screen because they were using graphics (too much memory) to create chinese, korean, etc. Access provides multiple language support whereas SQL did not at the time make it easy. Now SQL can support all the languages so why didn't Diebold switch? Too much effort? Too much money to retest? Didn't care?

[sybylla]

319. Language isn't an issue in programming

It is an issue for the HMI/screen development. Multiple screens utilizing multiple languages can be developed to access the same program. I've done it. Didn't need special software to do it. Language isn't an excuse to use a subpar program.

[Lurking Dem]

297. Delurking to say

that is the best damn post I have read all week.

Thank you so much!

[Fredda Weinberg]

300. But totally bogus

 

[Lurking Dem]

306. Yes I am totally convinced

by your erudite and succinct commentary. :shrug:

I am, however, openminded. Instead of telling me it is "totally bogus" why don't you explain to me your reasoning.

[Fredda Weinberg]

311. Take a look at reply #284

it references a source I cited previously. Also see my reply #292, which uses Scott's own logic to demonstrate that his conclusion is fatally flawed.

[republicansareevil]

317. #284 (by German-Lefty) doesn't seem to support your points

In my non-technical opinion, it sounds like that poster is arguing that even an open-source based electronic voting systems would not be secure enough and that paper ballot voting is preferable. That doesn't seem to support your contention that the Access-based system is secure enough for voting.

[Fredda Weinberg]

320. Apples and oranges

Scott designs a few tables and proclaims, "That's pretty much all there is to programming a voting system." That's the bogus part. To misquote German-Lefty, "It ain't that easy"

And you apparently don't understand that Access isn't used for voting. It's used in a standalone, desktop application that gathers the totals from the remote machines and produces reports. Anything more is overkill, even from a security standpoint.

[Cocoa]

304. Access is an excellent product, imo

I've worked with a lot of different databases, and I like Access. VBA is an excellent language also, for many purposes.

It's not appropriate for all purposes, of course, but I don't know how it's used in GEMS, and I don't think you do either.

There's evidence from the files that a larger-scale database IS part of the system. There were a set of files with table definition scripts written in a version of SQL that Access doesn't support.

Regarding that form, that raises a point that I also brought up before. The existence of that form may be an indication that security is built into the system. Without that form what's to prevent anyone from changing that value directly in the database? Maybe the form is a way to provide a logging capability?

When I write a form, that is acutally one of my main motivators. There are times when you want a certain amount of control over changes to the database. In my case it's not about tampering, but about quality, but quality is an important consideration as well, and of course it would be in the voter system just as much.

That's an issue that hasn't been discussed, btw. Not a lot of talk about data quality, which is extremely important and a very big plus in favor of automation. Not to say that there aren't potential flaws in automation, but this whole discussion has some luddite undertones to it that ignores the benefits.

[SDent]

318. Scottxyz Thanks

As I read through your article I thought this corresponds with everything I know (and no I'm not an expert) about Access and database design/security. I appreciate the good read.

As I read through your follow up I thought that last night's dialogue (it takes more than one) was unfortunate and I certainly got riled up and played a part in the ugliness but do not accept 100% blame or accusations of trolldom.

I have never on this forum or elsewhere said that I think the Diebold system is secure, that I doubt the technical information being presented, that this issue isn't important or anything remotely close to that. So I'm not sure why I'm being lumped in with other who may have, apart from the fact that the point I was making about mainstream press and credibility was responded to in the same fashion as those types of posts.

My punctuation may suck but in the heat of the argument some things get left by the wayside. It doesn't make me an idiot or a bad person. Again, thanks for the post.

[SDent]

328. friendly question for scottxyz

Your mention of the DateTimeStamp Adjuster intrigued me so I did a google to see if anyone is promoting the use of utlities like this for some sort of productive reason. I didn't find much, but I did find the product below touted for troubleshooting development work that has recently added the Adjuster to its product:

http://www.pe-explorer.com/

My dummy question is whether it's possible something like this could have been "left behind" in the system or if the DateTimeStamp Adjuster has actually been added to the Access database application they've created?

I'm still unclear, even in the scenario presented above, as to how a DateTimeStamp Adjuster would aid in troubleshooting vba work for instance...just on the surface a stamp adjuster sounds ominously like a "TouchIt" type utility. (on edit: found here - http://www.simtel.net/pub/pd/61471.html)

Just curious...

[DEMActivist]

333. PE Explorer is a GEMS.exe plugin

Which Dr. Britian Williams touts as follows:

· A security program, similar to a virus detector program, is run against the Windows operation system and the GEMS object code prior to beginning the definition of an election to verify that the code has not been altered. This program is repeated after the close of the election to verify that the code did not change during the election.

[SDent]

334. interesting

So if it's a source code/control/security program that is available over the internet for use on different kinds of applications, then it's possible that the datetimestamp Adjuster, which is a part of the PE Explorer plugin, has some purpose for other types of applications and isn't necessarily something that was introduced to GEMS for the purpose of falsifying election results?

I realize I'm starting to sound like someone who doesn't believe that election rigging occurs here, that's not the case. I'm just interested in finding out if the presence of this Adjuster is cause for suspicion or not. If it's presence signifies what Scottxyz is saying it implies - intent to rig.

[DEMActivist]

337. The significance is even more damning

Take a good, hard look at PE Explorer. It's a disassembler. It provides a complete roadmap to all the classes, functions and calls in the entire system.

It's free dowmload on the internet for 30 days. It's a free roadmap to the election system added as a plugin.

[SDent]

341. that may be but

but what i'm asking is whether:

1) PE Explorer is a utility that is used in the development community on many different applications for the purpose of code control/security and is used for the same purpose in the case of GEMS, in order to check that code hasn't been changed. If this is the case it should be removed after usage.

or

2) PE Explorer is a utility that was developed solely for the purpose of checking code control/security on GEMS only and was made available over the internet in order to provide hackers with an open door to the source code and the ability to alter it.

[Fredda Weinberg]

343. Do a Google

You'll see the Portable Executable file editor everywhere.

[DEMActivist]

344. Moot point

It's distributed in GEMS.exe as a plugin and touted by Dr. Britian Williams (HEAD of Security for Georgia voting machines) as a security tool.

The thing not only opens the door, it hangs the welcome sign.

The man wrote the manuals for security in the Georgia law. He touts this tool in his April 23, 2003 screed as if it is the be all, end all to confirming the code isn't changed. When, for all practical purposes, it's a free, and freely available, open door with a welcome sign on it.

[SDent]

346. So number one then

It can be used to check code/version control but should removed after that task is completed.

[Junkdrawer]

285. Everything about GEMS follows two patterns...

1.) As much as possible, provide the APPEARANCE of a secure and auditable system.....

WHILE

2.) Provide copious opportunity to hack the database without leaving a trace.

From Bev's article (and previous posts on DU1) we know:

* They could have used database-enforced referential integrity - they did not.

* They could have used Autonumber primary keys - they did not.

* They could have cleared the summary report tables before each report - they did not.

* They could have used Access database encryption - they did not.

* They could have used an Access database password - they did not.

* They could have used System.mdw based user/group security - they did not.

What they did seems more of a conjuring trick: divert the buyer's attention with meaningless "security" while designing a structure that seems purpose-built for cheating.

I ask again: Where's the Amazing Randi?

[PATRICK]

298. What next?

Diebold could have made it simple. The only thing simplified was a lack of security. All the analyses are alarming.

The replies by some people have an odor of similar debates on vote fraud on other sites when freepers descend in timely fashion. Not making any accusations, but even with total lack of expertise in the area on my part, the KIND of negative arguments made sound less constructive than malicious- to discourage, divide, provoking revelations of the limits of the studies. Paranoid? That is the only purpose it seems to serve whatever the motivation.

Musings about the law. DON'T tell me what is going on, really. I'm just meandering. Lawsuits suing Diebold for product misrepresentation. Lawsuits by candidates not allowed recounts. Suing for damages. People's lawsuits against the election commissions and Dibeold(et. al.) This is BEFORE we get to the issue of vote fraud. Obviously EVERYONE in politics steers kind of clear of this issue. The penalties are token. The degree that in this case mounts to high treason against the nation(not to mention international implications)is beyond the scale of political will and thought. This is like getting Gotti for tax evasion. If it does the trick....

My favorite though is investigative bodies OUTSIDE the U.S.A. Brazil has elections and those new machines. Jeb and Kate go to Brazil shortly after 2000 decision. Canada comtemplating new machines. Jeb visits Toronto, again on business and trade. Maybe the Mounties can query people Jeb(Gingrich, Hagel, Diebold execs, etc.) might have been selling on our wonderful voting machines? Other nations? That would certainly be easier(treason there too) than getting anything done in OUR recalcitrant system.

This never would have happened had not the ground been fertile through laxity, backward investigative and party apparatus, etc.

Meanwhile the grassrootsfire is spreading in many places simultaneously. I think this may make Net history. First a stunning charge is made along with the release of documents needing study and evaluation on many levels. The last time this happened on the Net was Drudge in a sleazy tabloid style revelation no one would at first touch. This is unimaginably bigger. And it is prefab so that the major media is already too late to the table. My local reporter here probably typifies the stage "waiting for developments". I don't think they know what to do. No actual fraud proof, just truckloads of circumstantial evidence that America has been betrayed. Everyone else in the world doing THEIR job, discussing, speculating, interpreting on their own with the majors AWOL in the middle of the dry grass.

I can guess their eventual spin. searching through the article for ANY disclaimers, qualifications and ways out of damning Diebold and the GOP. THAT will be sold first along with the typically chicken stress that NO fraud accusations or "proofs" are being offered, which is not quite true of course.

The rob-Georgia interview suggests "deliberate mess" which affects elections badly as it is. Only, in that deliberate mess of smoke and mirrors, confused and deliberately incompetent workers, are doorways to vote control.

But meanwhile, the computer community will have chewed over and rallied around the simple points stated above, leaving it to the usual orangutangs to spout invective and nonsense to counter the obvious conclusions. But like Watergate, it is too late. People will be interested enough to get the "techie" stuff the media will say is oh too much for our pretty little heads. Hey, if I can get it anyone can.

Was I expecting handcuffs and arrests at the first stages? No, only witnessess, confiscated machines and plea bargaining will get that. Thanks to Digital Graveyard. 2004 will happen before we even get to trial. NO, the first goal is to get rid of these companies and their boxes. The NAACP lawyers could not get the felon list scandal fixed for 2002. Every delay will be implemented to bull through "elections" and installations of this junk, here and abroad.

It does answer one question. How on earth did we ever hope to have friendly democracies in the ME in particular? Blackbox voting and chaos, that's how. They should be warned too. Or is that betraying the Regime?

[Junkdrawer]

301. Great Question!!!

The answer I keep coming to amounts to more questions:

When does all this rise to the level of "probable cause" so that, on any given suspicious race, a recount is ordered?

Can we, as citizens, demand sufficient documentation though the Freedom Of Information Act, to double-check the additions done by GEMS?

Will the SCOTUS intervene to prevent any of the above?

[jimmynochad]

302. One correction on Brazil machines

Diebold and ESS both claim to have made the Brazil machines. In fact it was Unisys and National Semiconductor... see link to press release http://www.national.com/news/item/0,1735,757,00.html. Diebold came in after the sale.

[Junkdrawer]

315. No naysayers?

:shrug:

[Fredda Weinberg]

326. It's a standalone system

why would it need a system.mdw file?

What does database reinforced referential integrity have to do with anything?

You've brought in the kitchen sink, but all you have is your practices stacked up against theirs, not a deliberate attempt at voter fraud.

[Junkdrawer]

336. System.mdw is Microsoft's way of securing a database...

whether it's stand-alone or not. Same with an Access database password.

Database inforced referential integrity would have prevented some possibly rogue entries from being made.

Autoincrement primary keys would have made editing the audit log MUCH more detectable.

And why didn't they clear the "summary" report tables before printing summary reports?

All in all, I detect a pattern.

[Fredda Weinberg]

339. The pattern is that the application was designed to be standalone

and on the face of it, appropriate to the application, which was documented as running on a workstation that was meant to be physically secured and kept off a network.

In retrospect, we can come up with many ways to improve it, but nothing so far points to negligence.

[Junkdrawer]

340. What about clearing the summary report tables before running...

a summary report? If they had, much of the "3 sets of books" argument would disappear.

[Fredda Weinberg]

342. What difference does it make?

I couldn't follow the 2 books argument; on my system, CandidateCounter and SumCandidateCounter aren't identical *without* manipulation, so there's obviously some kind of processing going on that hasn't yet been explained.

And what possible difference could it make if summary tables are cleared or not? If I'm selecting data for a report, the query grabs the data I need and ignores the rest.

[Junkdrawer]

345. It's the crux of the whole matter...

And what possible difference could it make if summary tables are cleared or not? If I'm selecting data for a report, the query grabs the data I need and ignores the rest.

That's what it should do, but if, as Bev has shown, one can change data in SumCandidateCounter, run a new report, and the report NOT overwrite SumCandidateCounter but rather use the changed numbers, it clearly does not.

[jimmynochad]

310. Congressman Wexler wants printers retrofitted

on Florida voting machines. Anyone contact his office?

Link to story - http://www.palmbeachpost.com/localnews/content/auto/epaper/editions/thursday/local_news_f3c04d0b168b319c009e.html

[Fredda Weinberg]

313. It's not a retrofit

It was an option LePore didn't choose.

He used to be my congressman, and he's fully aware of the shortcomings of the Palm Beach County systems.

[jimmynochad]

316. It would be a retrofit because

Sequoia does not have a printer that can print a voter verifiable paper record. None of the big four vendors have a certified system that can print voter verifiable paper records. Two companies, Avante and Tru-Vote are the only NASED DRE systems that can do it.

[BevHarris]

322. All say they are already equipped for it. Sequoia, ES&S, Diebold

offered touch screen voting with a paper trail to Santa Clara County, California (who turned it down ?!?!?!?!).

There are other issues than just a printer, though, so actually you are correct. The software would need to be redone and recertified. Here's why:

Avante spent much of their development time doing two things:

1) Figuring out ways to make the actual vote entry process idiot-proof, so voters don't "forget" to vote a question by scrolling back and forth, so that voters are unlikely to have to change that paper ballot once it is printed out. They found that an amazing number of people fill their touch screen ballots out incorrectly and/or incompletely when voting on standard touch screen machines, and when those people see the paper ballot, they then want to correct the problem. That can be done, but obviously is a cumbersome process that involves voiding a ballot and printing a new one. So, key point for a machine designed to print voter-verified paper trail is to get the psychology right to minimize correcting votes after they are printed.

2) Self-testing: Avante realized that when the paper trail arrives, it will demonstrate that machines either do or do not count accurately (assuming it is used for a robust audit). Therefore, systems with error rates will create huge snafus and become unpopular. They then focussed on designing test routines to get their machines 100% accurate every time. Other manufacturers do not have those routines built into their systems, apparently.

To do 1) and 2) above will require software reengineering and recertification.

Bev

[SDent]

329. another friendly question

this one has been on my mind for awhile and it is not a naysayer or a skeptic question:

With the reference manuals, testing information and files, etc. that were available on the site, and access to people involved in testing/implementation, has anyone so far been successful in getting their hands on any technical specification requirements documents or better yet design documentation?

I would think a lot of the speculation about "why" various things are there and what purpose they serve could be answered with some of the information in that type of documentation. If they're the kind of IT outfit to have any documentation at all, they most likely follow some sort of development methodology and require similar documentation along the way.

that would be a grea smoking gun to find.

[Fredda Weinberg]

323. I remember the county commission hearings

the printer option available at the time, but LePore didn't choose it. It may have been a prototype, but I question whether that qualifies it as a 'retrofit'.

[jimmynochad]

327. They do not have it in anywhere near production mode

I have seen all of the so-called printer concepts from the three above vendors. ESS is mimicking their idea from Avante. Lou Dedier was SOS tester for Avante's system. Lou quits in October to work for ESS. Lou develops paper record system. It is still in prototype mode. Diebold had system that printed record but no "idiot proofing", to use Bev's term. The record had a time stamp on it. This is no good because I could use it to trace back to the voter. If you read the Santa Clara contract, Sequoia would have to develop the paper record and recertify it. I have talked to Wyle and they would not certify a system that prints the paper in a way that would allow the voter to possibly take it out of the polling place. This violates even the 1990 FEC standards.

Theresa LePore must have seen the Avante system (they were in Florida at one point - I was told Avante was denied certification because the paper record was told to be illegal). She wanted it as an option but was talked down by the vendors' lobby efforts.

[trumad]

330. I just started another thread on this very subject.....

It will make it a heck of alot easier to navigate...

http://www.democraticunderground.com/discuss/duboard.php?az=show_topic&forum=104&topic_id=18642&mesg_id=18642&page=

[newyawker99]

348. Please continue in thread #2

http://www.democraticunderground.com/discuss/duboard.php?az=show_topic&forum=104&topic_id=18642&mesg_id=18642&page=


I am locking this one.


NYer99
DU Moderator