First-hand report of problems with "secure" e-voting

[Declan McCullagh <declan () well com>]

----- Forwarded message ------

Declan and Dave,

Please (please!) remove my e-mail address if you decide to post this.

I'm an undergraduate in a large Georgia university, which also happens
to be the place I vote at election time.  Although I have been a casual
follower of the voting security debate, I now find myself in a unique
position.  A sitting position.  More precisely, sitting 10 feet away
from a stack of 10 unguarded electronic voting machines.  Despite
having been here for for 120 minutes (and taking a conspicuous number
of photos), I have yet to see any security presence, or anyone
associated with these machines at all.

First thing: this terrifies me.  Because although I have no reason to
suspect these machines have been tampered with, I really have no way of
knowing for sure.  Even though it would be difficult for someone to
tamper with these machines on-site without being noticed, there is a
huge potential for a machine to be stolen (at which point it could
either be tampered with, and then (in theory) returned, or just
analyzed to locate problems with the voting software).  It's one thing
to debate how secure the software is, especially when being used within
sight of elections officials.  It's another thing entirely when anyone
who wants to can take the machine home to play with.

Even more alarming than the lack of security around these machines is
the response I have received from anyone I have tried to point this out
to.  The friend who initially directed me to this problem has called a
half dozen different groups, ranging (in order) from the state voting
commission, the local paper, the local news, campus security, and even
the campus newspaper.  The voting commission assured us the machines
were locked.  As someone standing next to the machines, I can assure
you that they are not, unless a zip tie now qualifies as a lock.  The
press brushed us off entirely.  Campus security told us it was "not
their problem".

If someone could tell me that this is somehow okay, that I'm
overanalyzing the problem, and that this is in fact not dangerous
behavior, it would reassure me a great deal.  But if this is in any way
representative of the way electronic voting systems are being deployed
around the rest of the country, I fear for tomorrow's election.


Now, descriptions of the machines.  I have about 70 pictures of these,
should anyone require them (but I'm holding on to them for now, in the
interest of remaining anonymous until I feel these machines are
secured).  I have removed information that identifies directly which
county these machines belong to; I am happy to reveal it later, once
these machines are set up and under active surveillance.

Each container is roughly 2 feet by 2 feet square, by 1 foot deep, with
collapsable legs.  These containers are stacked in two piles of 5
machines each, with a larger box and a briefcase resting nearby.  The
small boxes have wheels on the bottom and a suitcase style handle and
clasps.  They appear identical to the system displayed on
http://www.diebold.com/dieboldes/ .  One such machine has the following
information on the front, near the handle:
A barcode with a green and a yellow sticker attached.  The barcode
reads "123678"
A barcode labeled "[county name] County - Ga Purchase".  The barcode
reads, "265345893"
A half-removed label with the following word fragments:
[bottom portion of a large word]
Election S[unintelligible]
4.3.14 UPGRA[unintelligible]
This text appears consistent with the Diebold Election Systems logo, as
seen at the above Diebold Election Systems website.

Also, written on the top, where the legs are collapsed:
"P/N 663-1141 REV--4

Model/Revision
AVTS--BOOTH.1.01.004"
Next to that, a yellow sticker with the text,
"A-H
6-12-02"

The boxes are sealed with a large plastic zip tie (some are pulled
tight; others only about halfway tight), and with a red tag with a
serial number.  One such tag is labeled,
"SEALED
0144481"

One machine also has a label attached to the side opposite the wheels.
The label is attached with a zip tie, and enclosed in a plastic
container.  The label reads,
"02X
2 [scribbled out numeral 4] of [scribbled out numeral 4] 9".  [It is
probably worth reiterating that there are, in fact, 10 machines stacked
here].

The larger box is roughly 1.5 feet by 2 feet, and 1.5 feet tall, with
the text, "Property of [county name] County Government, Registration,
and Elections" embossed in the side.

The briefcase is blue, 3 inches deep, 2 feet wide, 1.5 feet tall, and
has a handwritten label attached with the words "Provisional Voting"
written on it.

I will be monitoring both Politech and Interesting People for
responses, should this get posted.

----- End forwarded message -----
_______________________________________________
Politech mailing list
Archived at http://www.politechbot.com/
Moderated by Declan McCullagh (http://www.mccullagh.org/)