hacking the Mass vote: Part II (the plot thickens)

[welshTerrier2]

this is a cross-post from the Massachusetts forum where PDA Board Member John Bonifaz is challenging the incumbent Democratic Secretary of State, Bill Galvin

if you missed Part I and don't want to come in in the middle, read this: http://www.democraticunderground.com/discuss/duboard.ph ...

today i called the Elections Division of the Massachusetts Secretary of State's Office to follow-up on my concerns about inadequate testing procedures for Massachusetts voting machines ...

for now, I'm leaving out the names of the people I spoke to ... I'll call them "Junior Guy" and "Senior Guy" ... i started with Junior Guy ...

wt2: Hi, I'm calling with a couple of questions about the testing procedures used for Massachusetts voting machines and I'm trying to ascertain to what extent the integrity of our voting process is protected.

Jr. Guy: Oh, you've come to the right place. What would you like to know?

wt2: well, a couple of weeks ago I spoke to my Town Clerk about the testing procedures used in my town. I was told that the company that supplied the voting machines, we use Accu-Vote, provides the town's elections officials with a new "memory disk" for each election. i was told that this new disk is inserted into the optical scanner and then is tested a week or two prior to the election. the test is open to the public and is conducted by running a "test deck" of 50 completed ballots through the scanner. the anticipated totals are compared to the machine totals for accuracy. if the totals match, the equipment, including the new memory disk" is deemed to be ready for use in the actual election.

Jr. Guy: that's right ... so, what's your question?

wt2: my question is: what would happen if an ill-intentioned programmer supplied code that produced accurate results on any date OTHER THAN election day? or, let's say the programmer, knowing that Massachusetts law specifies a test deck of exactly 50 ballots wrote the program to only distort the totals if the totals exceeded 250 ballots?

Jr. Guy: whoa ... I'm really not an expert on this ... I'm going to have to transfer you to Senior Guy. Leave your call back info on his voicemail ...

3 hours later, receiving no call from Senior Guy, I called him again ...

Senior Guy: Hello ... Elections Division ...

wt2: Hi ... I'm calling with a few questions about the internal control process to ensure the accuracy of vote count totals from voting machines used in Massachusetts ... (Note: I reiterated the type of code that could be embedded that could produce incorrect totals) ...

Senior Guy: oh, well ... that would be a crime ... look, it's like terrorism ... there's no perfect system ... you're not going to catch absolutely everything ...

wt2: yes, that's certainly true but i would think the objective should always be to lower the risk as much as possible within reasonable cost constraints ... let me ask you this, if a programmer wrote that kind of code that only distorted the results on election day, wouldn't that cause the test to be inadequate ...

Senior Guy: i already told you, you're never going to catch everything ... besides, we do have a process available if that kind of thing ever happened ...

wt2: ah, that's what i'm trying to learn about ... how does that work?

Senior Guy: any candidate can call for a recount (i think he said if just cause exists) ... the candidate can even request a hand count of the ballots ...

wt2: so, what you're saying is that there is no post election audit of the results, even on a sampling basis, if no candidate requests a recount?

Senior Guy: that's right ...

wt2: one last question: how long do the disks need to be retained after the election in case someone decides to investigate or audit the election results ...

Senior Guy: the disks must be kept intact, this is, they can't be erased, for a period of 30 days after the election ...

wt2: thanks very much for your time ... this has been very informative ...

when i hung up, i was almost shaking ... candidates choose not to call for recounts for all kinds of reasons ... this process does NOT protect the voters nor the integrity of the vote ... a candidate might feel that challenging the vote might jeopardize their political future ... this should NOT be the only process for verifying the vote and testing the accuracy of the counting process ... this appears to be a major loophole ...

a few points ... first, Senior Guy may be ill-informed ... more research is needed ... second, it's possible that the software in the optical scanners we use is tested elsewhere and is separate from the "memory disk" provided for each election ... the "memory disk" could contain data only and not program code ... this remains an unknown thus far ...

so, what did i do with all this information in addition to posting it here for my DU compadres? why, i called the Bonifaz campaign of course ... i spoke to "a high level campaign official" who shall also remain nameless for now ... he/she said they were extremely interested in this research and we agreed that they, and I, would be taking it to the next level ... this could be nothing or it could be a really big deal ... btw, what is being researched here is the internal control process, i.e. the integrity of the process ... no one is suggesting results were tampered with in Massachusetts ... of course, if the controls are weak, that remains a possibility ... it wouldn't take much tampering to elect 16 years of republican governors in a Democratic state ... food for thought there, eh??

the other loose cannon in the mix is the media ... the Boston Globe is so pathetic it's not clear whether they still employ any investigative reporters ... most of the paper is just reprints from other sources ... still, this would be a page one blockbuster if they could verify the process is as flawed as it appears to be ...

stay tuned ... some criticize us online activists for not really doing anything; it was all of you DU election fraud posters that put the bee in my bonnet to dig into this ... maybe something good will come out of it ... feel free to jump on this research and post anything you think would be helpful ...

[BeFree]

1. You have just entered the Twilight Zone...

...where things are never as they appear to be.

Good for you for finding out how your vote is counted, we all need to research how our local elections are processed.

I am no expert on any of the machines, and not many are, so any info you can peel off will be of use to us all.

One machine I am slightly familiar with is the ivotronic touch screen.

That machine has a card inserted in it with "ballot definition files" which are used to tell the machine which ballot you will be using. These files are part of what caused a recent miscount in Iowa. See thread on these pages.

Then, another similar card picks up the cast votes from each machine and then downloads those into a main computer.

Each of these cards have programming written onto them to tell them how and what to count. That programming has been found to be easily altered. No passwords, no encryption, no nothing.

It really is a Twilight zone type of operation, these machines and those cards. Good luck breaking through, and keep us posted.

[WillYourVoteBCounted]

2. this is a good question

maybe would be cool to shorten it and make it into a sort of
factoid,
also consider including how mistakes in the ballot definition files
could "accidentally" throw a contest.

The fact is there are honest mistakes, as well as deliberate ones can occur.

I wonder if anyone does audits of the SAT tests that are scored by
optical scanners?

[harmonyguy]

5. SAT Errors Raise New Qualms About Testing

"I wonder if anyone does audits of the SAT tests that are scored by
optical scanners?"

http://www.nytimes.com/2006/03/10/education/10sat.html?ex=1299646800&en=bdee18e15eda2019&ei=5088&partner=rssnyt&emc=rss

There sure seems to be a need. I recall that Pearson is the maker of some of the high-volume scanners used for ballot scanning.

[WillYourVoteBCounted]

3. I clicked on your link

and got a "page not found" error....

[welshTerrier2]

4. thanks ... here's the corrected link

http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=158x9064

i cross-posted here using copy/paste but it truncated the url ... this one should work fine ...

thanks for the heads up ...