Remote Hack of Diebold Systems Analysis

[RedEagle]

Due to contraints in how much can be posted, please check out article at:
www.blackboxvoting.org, main page,
and forums:
http://www.bbvforums.org/forums/messages/1954/5512.html

(On edit: Morning, I'll get this right yet)

Much more coming on this but rest needed after an exhausting field trip by Black Box Voting.

Please read whole article, lots to it. As I understand it:

Touch Screens - Relatively easy to hack
Op Scan - Harder but not by any means impenetrable
Touch Screens - Allow access to Op Scan

What I want to know, is why delay the Auto Mark, which marks an op scan ballot?
Does encryption really help security of our votes, or the security of a potential hack?


Posted on Wednesday, May 04, 2005 - 09:25 pm:

Black Box Voting has discovered that the addition of a single Diebold touch-screen – with or without a paper trail -- introduces a change to the remote access configuration such that malicious tampering of the entire system (including the paper ballot-based portion) becomes easier.

----- snip -----

The HAVA-triggered move to add a touch-screen in each polling place to accommodate the visually impaired will make it easier for political operatives – located in another state, or even in a foreign country -- to take a crack at your election.

Black Box Voting, together with a team that includes telecommunications and security experts, has been conducting field tests on remote access vulnerabilities with Diebold voting systems. These hacking tests differ from those performed by RABA, Avi Rubin, and the demonstration by Bev Harris with presidential candidate Howard Dean, because Diebold was able to claim that those demonstrations involved a contrived setup, never-used software, or were impossible in the real world of elections.

----- snip -----

We have received a report from an elections official that ES&S has put a hold on federal certification of the Automark, which will delay the ability to comply with ADA requirements by purchasing Automark. If the Automark certification occurs after the HAVA deadline, election officials may be forced to buy touch-screens.

[JohnGideon]

1. False Rumor

The fact is that AutoMark is in the process of the final test which will be done sometime today. The reports will then go to NIST and EAC for review and then to NASED to get it's number.

This information comes directly from a principal with Vogue Elections who is in a meeting with ES&S this morning.

ES&S holding up certification of a voting system that can make them tens of millions of dollars so they can sell a million dollars more DREs is ridiculous on the face.

I will give you the name of the principal so you can check this yourself if you want. Give me a call

[RedEagle]

2. Re: Auto Mark

John,

The information received by Black Box Voting came from an election official in the field who wanted to purchase Auto Mark and was told he could not for the reasons mentioned in the article.

So we have two sources and different information. Yes, will work on this and see if we can get a straight answer.

This guy was ready to hand over a check to ES&S for the system.

[JohnGideon]

3. Yes, I talked To Bev

I am not the source of the information. Vogue and ES&S are the source.
I wish that any quotes or information on the qualification of AutoMark would come from the source and not from me.

[RedEagle]

4. Whatever the outcome of different sources...

The message of the investigation into remote access capabilities of Diebold systems, especially through touch screens, is clear:

No Diebold touch screens.

That should be a boon to Auto Mark.

If it's going through without hold up, then this should encourage them to expedite it all the more and make it available ASAP. We need it.

If there is a hold up anywhere, then the Diebold access information should put pressure on to shake it loose.


Meanwhile, what are we doing with voting systems with ANY kind of remote access?

[kberland]

14. False rumor that AutoMark is on hold

Suggest that you call the AutoMark office in Lombard, IL at 630-916-0030 to verify that certification testing is complete and that volume manufacturing is underway.

Kerry Berland

[JohnGideon]

9. AutoMark Completed Testing Just Hours Ago

The ES&S AutoMark is now completely tested according to a highly placed official with Vogue Elections who just called me. Vogue developed the AutoMark and licensed it to ES&S. All testing is complete. The National Institute of Standards and Technology must review the paperwork and then NASED gives the machine a number. It is then fully federally qualified.

There will be a press release on this event next Monday. This is a big deal for many, many state and local officials and for voters.

[RedEagle]

10. Great News

Want a copy of that press release, if you don't mind.

Will post it for follow up.

[RedEagle]

5. The answer to the question is "yes", it can be done

And it affects far more than thought.

Now just why is HAVA sold as requiring touch screens?

Diebold counts, what, 40% of the vote?

On edit:

Bob Ney of Ohio, House sponsor of HAVA

Ohio, Diebold....

Ney also head of committee holding up Holt's legislation last year.

Just makes you wonder....

[kster]

6. kick.n/t

[autorank]

7. Kick

:kick:

[RedEagle]

8. Remote Access Found

Kick

[RedEagle]

11. Dial in, Change the Vote

Kick

[kster]

12. kick...nt

[kberland]

13. AutoMark definitely not on hold

There is a press release on the ES&S website posted 5/9/05 confirming that the AutoMark machine has completed certification testing. www.essvote.com.