Researchers at Princeton University announced Wednesday that common electronic voting machines can be subverted by installing software which undetectably alters vote totals and, as a computer virus, spreads itself from one voting machine to the next.
Computer science professor Edward Felten, along with graduate students Ariel Feldman and J. Alex Halderman, published a paper in which they demonstrated the ease of installing malicious software onto a Diebold AccuVote-TS touchscreen voting machine which would alter vote totals in a real election, but be undetectable to election officials by allowing the logic and accuracy tests to pass, and by deleting itself from the voting machines at the end of the election.
“This report should finally put to rest the myth that the current generation of e-voting machines adequately protects the integrity of the electoral process,” said Electronic Frontier Foundation staff attorney Matt Zimmerman.
And to add insult to injury, the team posted videos of the entire process of hacking a Diebold touchscreen voting machine.
This paper presents a fully independent security study of a Diebold AccuVote-TS voting machine, including its hardware and software. We obtained the machine from a private party. Analysis of the machine, in light of real election procedures, shows that it is vulnerable to extremely serious attacks. For example, an attacker who gets physical access to a machine or its removable memory card for as little as one minute could install malicious code; malicious code on a machine could steal votes undetectably, modifying all records, logs, and counters to be consistent with the fraudulent vote count it creates. An attacker could also create malicious code that spreads automatically and silently from machine to machine during normal election activities — a voting-machine virus. We have constructed working demonstrations of these attacks in our lab. Mitigating these threats will require changes to the voting machine’s hardware and software and the adoption of more rigorous election procedures. — Security Analysis of the Diebold AccuVote-TS Voting Machine
Diebold Election Systems marketing director Mark Radke said the researchers should have contacted the company, because they have since updated their system to address some of the issues raised.
“I’m concerned by the fact we weren’t contacted to educate these people on where our current technology stands,” Mark Radke said.
Radke also question why Felten hadn’t submitted his paper for peer review, as is commonly done before publishing scientific research.
Felten said he and his colleagues felt it necessary to publish the paper as quickly as possible because of the possible implications for the November midterm elections. — Associated Press
Considering that Diebold election equipment is about as secure as Swiss cheese, as confirmed by numerous reports over the last couple of years, that the company doesn’t care about election security, and that that’s why they were run out of North Carolina, I don’t think it will mean all that much that the researchers didn’t wait for peer review. You can peer review it for yourself by watching the researchers’ video of the process.
Now don’t you feel good about your vote last Tuesday? The Brad Blog has documented instances all over the country where elections have gone haywire and election officials have been sent scrambling to implement emergency security measures because of security problems such as this.
“The challenges presented by the introduction of electronic voting are systemic and require a systemic response,” Zimmerman said. “Paper trails, regular audits, and robust physical security are a good start, as are improved pollworker training and radically upgraded machine certification requirements and procedures. H.R. 550, making its way through the House of Representatives, would go a long way towards implementing many of these fixes on a nationwide basis.”
As for Diebold, one funny YouTube video seems to sum it up:
Update: Felten writes on his blog that the locks on the Diebold AccuVote-TS machines which allow access to the memory card slot can be opened with a key anyone can buy on the Internet, such as the key to a hotel minibar.
