BREAKING NEWS: Voting System Integrity Flaw

Walk right in, sit right down. Replace vote-counting files with your own.

Feb 5, 2003: Yesterday, technicians and programmers for Diebold Election Systems, the company that supplied every single voting machine for the surprising 2002 results in the state of Georgia, the company that is preparing to convert the state of Maryland to its no-paper-trail computerized voting, admitted to a file-sharing system that amounts to a colossal security flaw.

"Technology transfer for updates!" This is among the benefits in the Diebold PowerPoint sales presentation given to the State of Georgia. Easy updating -- too easy, apparently.

In "Black Box Voting: Ballot-Tampering in the 21st Century," author Bev Harris examines the integrity of current electronic voting systems. She recently installed a Whistleblowers page at her web site ( http://www.blackboxvoting.com/whistle.html). "We've been getting about four new whistleblower reports a day," says Harris, "and some of them are quite serious." Like this:

Diebold Election Systems, which builds the AccuVote machines, both optical scan and touch-screen, was parking files on an unprotected public Internet location. Not a few files -- thousands of files; election files, hardware and software specifications, program files, voting program patches -- and sometimes, files with curious names.

Though the address is obscure, whistleblowers found the FTP site using a simple Google search. A Global Election Systems web site, located at http://www.geocities.com/Tokyo/Towers/2256/ contains a list of links like "History," "Press Releases," "Staff" and -- amazingly -- "FTP."

The FTP button gave total access to anonymous users, allowing anyone to download or upload to the motherlode. The FTP site contained no copyright statement, asked for no user name, put locks on no directories. Visitors (or vote-riggers) from anywhere in the world could simply walk in the front door. (Have a look at part of the file directory: http://www.blackboxvoting.com/WalkRightIn.html)

A person interested in tampering with an election would have to wonder why in the Sam Hill anyone would hand over what amounts to an instruction manual for vote-rigging to anyone who can navigate a Google search.

"Sometimes our customers use the FTP site to transfer their own files," explains Guy Lancaster, whose web site, http://www.guylancaster.com/guylancaster.html, says that he developed and maintains the intranet web site for Global Election Systems, now called Diebold Election Systems. "It has been up quite some years. It started when it was Global."

"People go there from counties, cities, sometimes there is stuff there for state certification boards, federal certification, a lot of test material gets passed around," Lancaster explains. Here is part of the interview between Bev Harris and Guy Lancaster on Feb. 4, 2003:

Harris: "Do you know if your FTP site has ever had a security breach?" Lancaster: "I'm trying to think, for a security breach, I think it got shut down by someone…Recently someone shut it down." Harris: "Would you know if someone came to your ftp, or replaced files at your ftp?" Lancaster: "Well, we have recently just discontinued what's considered anonymous access, so people could before, yes, but now we use a different means…" Harris: "It was available during the 2002 election?" Lancaster: "I think so."

In fact, according to "Black Box Voting" whistleblowers, Diebold Election Systems' FTP site was unprotected until around January 29, 2003. And, according to an e-mail that Harris obtained dated October 3, 2000 written by Lancaster, he expressed concern about lack of security in this file-sharing method more than two years ago.

In this e-mail, Lancaster admits that his company was allowing people to access a service over "an untrusted network," the Internet. He pointed out that the information could easily get redirected by a third party to another server. Apparently in both Election 2000 and Election 2002, Diebold / Global Election Systems had not devised any way to make the file-sharing system secure.

These files, freely shared and sometimes snagged from the FTP and e-mailed to election workers and technicians, included hardware and software specifications, election results files, the vote-counting program itself, and "replacement files" for Diebold's GEMS vote-counting system and for the Windows software underlying the system. In fact, anyone with a modem could have hunkered over a computer to download, upload or slightly change and overwrite the files on Diebold's FTP site.

Some files had simple "zip" passwords attached to them, but dozens had no protection at all. And even the passwords, Lancaster admitted in his October, 2000 e-mail, were easy to guess. "I can find no way of authenticating a PIN without revealing enough information to crack it," he says, adding that he was beginning to think it was impossible to make the system secure.

"Black Box Voting" whistleblowers voiced concerns about many of the files. Harris can't read a lick of code, but apparently computer enthusiasts have been surreptitiously downloading the Diebold files for some time now, examining them quietly. When the "Black Box Voting" whistleblower page went live recently, geek-reports began flowing.

One whistleblower called in with a terse question: "Why would we want a utility that can duplicate memory cards in optical scan voting machines? Are the cards serialized? Are they serialized internally? Is it hard-wired into the card?" Apparently something he'd read in those FTP files had gotten him all riled up about a memory card duplication utility. So Harris asked another of her sources, a voting machine engineer, about this.

"Oh no, no, no." He said. "That wouldn't meet FEC regulations!"

Another "Black Box Voting" whistleblower who had visited Diebold's FTP site wants urgently to find out if the company has an election technician named Rob. So Harris asked Guy Lancaster.

Harris: "Do you have a technician named Rob who works anywhere?" Lancaster: "There is a Rob doing some kind of West Coast sales." Harris: "Do the salespeople have access to this FTP site too?" Lancaster: "Yes, the salespeople have access to it. A lot of the purpose is to keep them up to date." Harris: So technicians, and salespeople, and counties, cities and states and election workers and all of the staff for Diebold…" Lancaster: "As needed."

Another whistleblower pointed out that one of the names on the Diebold FTP files, Kerry Martin, happens to be the same name as the poll worker who did press interviews after the flubbed Florida primary election in September 2002, when ES&S machines (Diebold's main competitor) did not operate properly.

>From the Miami Herald, Sept. 15, 2002: "When the touch screens died at Thena C. Crowder Elementary School in Miami, the precinct was closed for five hours until a troubleshooter arrived, poll worker Kerry Martin said," according to a Sept. 15 article in the Miami Herald.

>From the Sun-sentinel & The Associated Press: Sept. 10, 2002 - In a predominantly black Miami neighborhood, voting at one precinct didn't begin until 11:45 a.m., nearly five hours after polls were supposed to open. Officials said 500 people left without voting. At a nearby precinct, the touchscreen machines stopped working at 11:50 a.m. and were shut down for nearly five hours, causing more than 100 would-be voters to be turned away, election worker Kerry Martin said. So Harris asked Lancaster who Kerry Martin is.

Lancaster: "Kerry Martin, he's based in McKinney." Harris: "What is his position?" Lancaster: "I'll log in and look him up. He is an Election Support Specialist for Diebold." Harris: What does an Election Support Specialist do?" Lancaster: "Election support is mostly helping with software." Harris: "Was Kerry Martin in Florida last fall?" Lancaster: "I don't know."

So Harris called the McKinney, Texas headquarters of Diebold Election Systems and spoke with Kerry Martin.

Harris: "I have a couple questions and got your name…you are a technician, or a programmer?" Martin: "No, no, I handle the sales." Harris: "You don't do technical stuff? I've been told that you have tech files under your name on the FTP site." Martin: "I do sales and do tech support." Harris: "Were you in Florida last September?" Martin: "No, I was in Norfolk." Harris: "Don't all the programs used in these machines need to be certified? It seems that people are uploading and downloading files at this FTP site and using them in elections." Martin: "Certain hardware things and certain software things, most of them, you only are allowed to use the certified version." Harris: "Why, then, would you have files that say 'replace the files with these?'" Martin: "Replace all the files with these -- normally that could be a windows thing." Harris: "I got an e-mail that you guys have a file on your FTP that says "Replace the GEMS files with these." Martin: "Replace the GEMS files … I don't know what that would be."

GEMS is an acronym for Global Election Management System, and the GEMS files include the vote-counting program itself.

Harris: "Was there a guy named Rob working in Georgia?" Martin: "No that would be Keith Long, he's the guy who worked in Georgia."

Harris called Bob Urosevich, CEO of Diebold Election Systems (also founder of ES&S, a competing voting machine company). After her third call to ask for his comments, his assistant said Urosevich had the message. "If he wants to talk to you, he'll call you," she said. Apparently Urosevich had nothing to say about the election security glitch.

Tech-savvy citizens, however, have a lot to say about the risks of an open FTP site, and the files it contains. http://www.blackboxvoting.com/WalkRightIn.html is adding citizen comments and concerns about the Diebold security breach, and technicians continue to contribute file information to the site from Diebold's FTP files.

© Scoop Media