Guess what? There's an electronic voting machine controversy!

There may be a recount in the City Council District G election, where Pam Holm won by a 27-vote margin over Jeff Daily. The timing is perfect, coming on the heels of yet another report that electronic voting machines, including the eSlate machines used in Harris County, have security flaws.

The analysis, conducted for the Ohio secretary of state, of Hart InterCivic and three other vendors' systems found 57 potential security problems. Hart InterCivic, Harris County's eSlate vendor, had 10 potential risk areas, including four rated as high.

"We believe because of weaknesses we found in all of these systems, the vendors need to go back and take care of the weaknesses," said Glenn Newkirk, president of InfoSentry, one of two firms hired to conduct the review.

[...]

Researchers from InfoSentry, of Raleigh, N.C., and Detroit-based Compuware Corp. reviewed Hart InterCivic, Diebold Election Systems, Election Systems and Software and Sequoia Voting Systems. The six-week review was prompted after security concerns were raised in Ohio and elsewhere.

The review found, among other things, the potential for an unauthorized person to gain access to eSlate's supervisory controls and shut down the polls early. A password is required to shut down the system here. Hart InterCivic contends that if the system were shut down, voting data would not be lost.

The report also notes that eSlate lacks encryption to protect voting data, and Hart InterCivic is now considering the change.

Another risk identified in the report is that the connection between the system's units can be accessed by voters and disconnected. More security would alleviate the risk, the report states.

Results in which security breaches failed include: an unsuccessful attempt to access the system from an external source, failure to load a program through external sources and failure to upload results twice.

"Compuware has identified several significant security issues," the report states of the eSlate system, "which left unmitigated would provide an opportunity for an attacker to disrupt the election process or throw the election results into question."

The fact that the testers were unable to fully hijack the eSlate system is a point in its favor, but when I read things like "lack of encryption", I have to wonder what Hart InterCivic was thinking when they designed the system. All we've really got here is assurances from the vendor and the County Clerk that we shouldn't worry our pretty little heads over all of this, and they both have strong incentives to take a sunny view of things. Whether it happens in this recount or not, I believe it's just a matter of time before we get bitten on the ass. When we do, I hope everyone remembers what the responsible parties have been saying all along.

UPDATE: Rob actually read the report, and has some good thoughts on the subject. Check it out.

Posted by Charles Kuffner on December 15, 2003 to Election 2003 | TrackBack