Diebold GEMS central tabulator contains a stunning security hole

[Dave Farber <dave () farber net>]

___

Dave Farber  +1 412 726 9889



...... Forwarded Message .......
From: EEkid () aol com
To: dave () farber net
Date: Tue, 31 Aug 2004 17:48:10 -0400 (EDT)
Subj: Diebold GEMS central tabulator contains a stunning security hole

Dave, 

I don't know if this is real or the product of someone's imagination but, 
addtional investigation is needed.
 
Jerry

*************************************************

http://www.blackboxvoting.org/?q=node/view/78

Consumer Report Part 1: Look at this -- the Diebold GEMS central tabulator 
contains a stunning security hole

Submitted by Bev Harris on Thu, 08/26/2004 - 11:43. Investigations
Issue: Manipulation technique found in the Diebold central tabulator -- 
1,000 of these systems are in place, and they count up to two million votes 
at a time.

By entering a 2-digit code in a hidden location, a second set of votes is 
created. This set of votes can be changed, so that it no longer matches the 
correct votes. The voting system will then read the totals from the bogus 
vote set. It takes only seconds to change the votes, and to date not a 
single location in the U.S. has implemented security measures to fully 
mitigate the risks.

This program is not "stupidity" or sloppiness. It was designed and tested 
over a series of a dozen version adjustments.

Public officials: If you are in a county that uses GEMS 1.18.18, GEMS 
1.18.19, or GEMS 1.18.23, your secretary or state may not have told you 
about this. You're the one who'll be blamed if your election is tampered 
with. Find out for yourself if you have this problem: Black Box Voting will 
be happy to walk you through a diagnostic procedure over the phone. E-mail 
Bev Harris or Andy Stephenson to set up a time to do this.

For the media: Harris and Stephenson will be in New York City on Aug. 30, 
31, Sep.1, to demonstrate this built-in election tampering technique.

Members of congress and Washington correspondents: Harris and Stephenson 
will be in Washington D.C. on Sept. 22 to demonstrate this problem for you.

Whether you vote absentee, on touch-screens, or on paper ballot (fill in 
the bubble) optical scan machines, all votes are ultimately brought to the 
"mother ship," the central tabulator at the county which adds them all up 
and creates the results report.

These systems are used in over 30 states and each counts up to two million 
votes at once.

(Click "read more" for the rest of this section)

The central tabulator is far more vulnerable than the touch screen 
terminals. Think about it: If you were going to tamper with an election, 
would you rather tamper with 4,500 individual voting machines, or with just 
one machine, the central tabulator which receives votes from all the 
machines? Of course, the central tabulator is the most desirable target.

Findings: The GEMS central tabulator program is incorrectly designed and 
highly vulnerable to fraud. Election results can be changed in a matter of 
seconds. Part of the program we examined appears to be designed with 
election tampering in mind. We have also learned that election officials 
maintain inadequate controls over access to the central tabulator. We need 
to beef up procedures to mitigate risks.

Much of this information, originally published on July 8, 2003, has since 
been corroborated by formal studies (RABA) and by Diebold's own internal 
memos written by its programmers.

Not a single location has yet implemented the security measures needed to 
mitigate the risk. Yet, it is not too late. We need to tackle this one, 
folks, roll up our sleeves, and implement corrective measures.

In Nov. 2003, Black Box Voting founder Bev Harris, and director Jim March, 
filed a Qui Tam lawsuit in California citing fraudulent claims by Diebold, 
seeking restitution for the taxpayer. Diebold claimed its voting system was 
secure. It is, in fact, highly vulnerable to and appears to be designed for 
fraud.

The California Attorney General was made aware of this problem nearly a 
year ago. Harris and Black Box Voting Associate Director Andy Stephenson 
visited the Washington Attorney General's office in Feb. 2004 to inform 
them of the problem. Yet, nothing has been done to inform election 
officials who are using the system, nor have appropriate security 
safeguards been implemented. In fact, Gov. Arnold Swarzenegger recently 
froze the funds, allocated by Secretary of State Kevin Shelley, which would 
have paid for increased scrutiny of the voting system in California.

On April 21, 2004, Harris appeared before the California Voting Systems 
Panel, and presented the smoking gun document showing that Diebold had not 
corrected the GEMS flaws, even though it had updated and upgraded the GEMS 
program.

On Aug. 8, 2004, Harris demonstrated to Howard Dean how easy it is to 
change votes in GEMS, on CNBC TV.

On Aug. 11, 2004, Jim March formally requested that the Calfornia Voting 
Systems Panel watch the demonstration of the double set of books in GEMS. 
They were already convened, and the time for Harris was already allotted. 
Though the demonstration takes only 3 minutes, the panel refused to allow 
it and would not look. They did, however, meet privately with Diebold 
afterwards, without informing the public or issuing any report of what 
transpired.

On Aug. 18, 2004, Harris and Stephenson, together with computer security 
expert Dr. Hugh Thompson, and former King County Elections Supervisor Julie 
Anne Kempf, met with members of the California Voting Systems Panel and the 
California Secretary of State's office to demonstrate the double set of 
books. The officials declined to allow a camera crew from 60 Minutes to 
film or attend.

The Secretary of State's office halted the meeting, called in the general 
counsel for their office, and a defense attorney from the California 
Attorney General's office. They refused to allow Black Box Voting to 
videotape its own demonstration. They prohibited any audiotape and 
specified that no notes of the meeting could be requested in public records 
requests.

The undersecretary of state, Mark Kyle, left the meeting early, and one 
voting panel member, John Mott Smith, appeared to sleep through the 
presentation.

On Aug. 23, 2004, CBC TV came to California and filmed the demonstration.

On Aug 30 and 31, Harris and Stephenson will be in New York City to 
demonstrate the double set of books for any public official and any TV 
crews who wish to see it.

On Sept. 1, another event is planned in New York City, and on Sept. 21, 
Harris and Stephenson intend to demonstrate the problem for members and 
congress and the press in Washington D.C.

Diebold has known of the problem, or should have known, because it did a 
cease and desist on the web site when Harris originally reported the 
problem in 2003. On Aug. 11, 2004, Harris also offered to show the problem 
to Marvin Singleton, Diebold's damage control expert, and to other Diebold 
execs. They refused to look.

Why don't people want to look? Suppose you are formally informed that the 
gas tank tends to explode on the car you are telling people to use. If you 
KNOW about it, but do nothing, you are liable.

LET US HOLD DIEBOLD, AND OUR PUBLIC OFFICIALS, ACCOUNTABLE.

1) Let there be no one who can say "I didn't know."

2) Let there be no election jurisdiction using GEMS that fails to implement 
all of the proper corrective procedures, this fall, to mitigate risk.


-------------------------------------
You are subscribed as interesting-people () lists elistx com
To manage your subscription, go to
  http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/