Vermont: front page story on electronic voting

Seven Days is the weekly newspaper based in Burlington Vermont. It is the largest weekly newspaper in the state and seen as "alternative." It's a free newspaper. I'm not sure of the distribution but there is a stack of free papers in nearly every store and they all get taken.

After much work, I convinced them to run a story on electronic voting. They hired a freelance writer to do the story. I am glad that the issue got coverage, but not completely thrilled with the article overall.

I was thrilled, however, that they put the story on the front page, and devoted 4 full pages of text.

I am drafting a response that they will hopefully print in next week's editition.

-------

Voting Machinations
Could electronic election fraud happen in Vermont?

by Kevin J. Kelley (03/01/06).

This Town Meeting Day in Burlington,

<snip>

At least one Vermont expert on election mechanics has a more fundamental concern, however. Richmond resident Gary Beckwith, a WebPages designer and IBM contractor, worries that returns in Burlington and many other places could be doctored by someone tampering with voting machines. To improve safeguards against electoral thievery, Beckwith is working to create a Vermont chapter of the national group United for Secure Elections, which sees a growing danger of vote fraud. (Check election. solarbus.org. for information on Beckwith's efforts.)

In 70 towns and cities, including Burlington, around the state, voters deposit their marked paper ballots in a type of optical scanner that has proven vulnerable to hacking. Beckwith cites a recent test of the scanner in Florida in which hackers were able to falsify the results of a mock election while leaving no trace of their treachery. They did it by manipulating the memory card contained in the same Diebold, Inc. brand of scanner that will count most of the votes cast in Vermont on Town Meeting Day.

"These machines can be hacked to turn election losers into winners and winners into losers," Beckwith says. "It's possible," he offers as an example, "that the result of Bernie Sanders' Senate race could be rigged without any sign of that having happened."


read the article:

http://www.sevendaysvt.com/features/2006/voting-machinations.html

I will post my response shortly.

gb

This is a draft but I have to finish it tonight because of a deadline. I'm pretty sure they will print some of this but I don't know if they will print it completely.

------------------

Dear Seven Days,

I would like to thank you for discussing the electronic voting controversy in your last issue. As the main source for the article, I would like to clarify and respond to a few important points. First, the article intertwined the issue of Instant Runoff Voting (IRV) in the Burlington local election with the statewide elections that occur every year. These are two completely separate issues and should not be confused.

The concern about the Diebold systems we use is primarily about the larger statewide elections. As the articled stated, it is possible for anyone who has contact with the removeable memory cards used in our elections to alter the results without leaving any trace whatsoever. Our state's Director of Elections Kathy DeWolfe remarked that the "hack test" which proved this vulnerability took place under conditions that do not exist in Vermont, because the hacker was given access to a memory card. Since the cards are kept under lock and key, she says, the hack is impossible. However she fails to acknowledge that before our state election officials receive the memory cards, any number of employees at Diebold and LHS have full access to the memory cards. The point is, that the memory cards could come to the state, already programmed to alter the results, and it would be undetectable. That is my main concern - Diebold and LHS, not a local election official who would hack the memory card. And keep in mind, Diebold has on its programming staff several convicted criminals, one who was convicted of 23 felonies involving computer fraud.

Ms. DeWolfe also assures us that if election was rigged, it would be detected by a test that is done by local elections officials before the election. Rather than asking you to take my word for it, I will quote a recent Berkeley University report, commissioned by the California Secretary of State, in which a consortium of experts were asked to review the Diebold software code and concluded: "We determined that anyone who has access to a memory card ... can indeed modify the election results, and change vote totals ... There would be no way to know that any of these attacks occurred."

I wondered who is right -- the computer experts in Berkeley, or our Director of Elections? So I called my Town Clerk and had her describe the test that she does before every election. Then, I described the test (through an associate) to Harri Hursti, the person who performed the infamous "Hursti Hack" test. Sadly, he assured me that Kathy DeWolfe is not correct - her test would not detect what he did.

As a result of the Hursti Hack, many states have taken action. Two counties in Florida and the entire state of Pennsylvania banned the exact machines we are using. California decertified the machines and ordered the software code to be reviewed by an independent testing agency which confirmed the vulnerability. The Governor of Maryland wrote a scathing letter to the state's board of elections saying he no longer has confidence in Diebold election systems.

While other states have taken appropriate action, our Director of Elections, whose job it is to ensure the secrity and integrity of our elections, has done absolutely nothing. In fact, when numerous people have contacted her office for an explanation, she repeatedly and inexplicably defends Diebold and supplies innaccurate information in her reply, assuring that anything like the Hursti Hack would be detected by the testing procedure. We now know that is not true. And when asked if our system complies with the 2002 Voting System Standards which clearly forbid the type of code used on the Diebold optical scan systems, her only reply is that the Standards, which are written by the Federal Election Commission, are not law.

It is imperative that Ms. DeWolfe (and her boss, the Secretary of State) respond to the fact that significant vulnerabilities have been found in our election system and they do not comply with the Standards that were written to ensure the systems are secure. If she continues to ignore this problem, the people of Vermont should take her to task for not performing her responsibilities as our state's Director of Elections. We should also work to reform our laws to require open software code and random auditing of the system - two essential steps that would help ensure the integrity of our elections. I invite those concerned to learn more and join our efforts by contacting me at gary@solarbus.org, or visiting the website: election.solarbus.org.

Dear Seven Days,

I would like to thank you for discussing the electronic voting controversy in your last issue. As the main source for the article, I would like to clarify and respond to a few important points. First, the article intertwined the issue of Instant Runoff Voting (IRV) in the Burlington local election with the statewide elections that occur every year. These are two completely separate issues and should not be confused.

The concern about the Diebold systems we use is primarily about the larger statewide elections. As the articled stated, it is possible for anyone who has contact with the removable memory cards used in our elections to alter the results without leaving any trace whatsoever. Our state's Director of Elections Kathy DeWolfe remarked that the "hack test" which proved this vulnerability took place under conditions that do not exist in Vermont, because the hacker was given access to a memory card. Since the cards are kept under lock and key, she says, the hack is impossible. However she fails to acknowledge that before our state election officials receive the memory cards, any number of employees at Diebold and LHS have full access to the memory cards. The point is, that the memory cards could come to the state, already programmed to alter the results, and it would be undetectable. That is my main concern - Diebold and LHS, not local election officials. My concern is not based merely on the fact that the virtually all the top executives at Diebold contributed the maximum allowable amount to the GOP, it's also that they employ convicted criminals to write their software code. In fact, one of the main programmers at Diebold who wrote the code that counts many of the votes nationwide, was previously convicted of 23 felonies involving computer fraud and served 4 years in prison.

Ms. DeWolfe assures us that if election was rigged, it would be detected by a test that is done by local elections officials before the election. Rather than asking you to take my word for it, I will quote a recent Berkeley University report, commissioned by the California Secretary of State, in which a consortium of experts were asked to review the Diebold software code and concluded: "We determined that anyone who has access to a memory card ... can indeed modify the election results, and change vote totals ... There would be no way to know that any of these attacks occurred."

I wondered who is right -- the computer experts in Berkeley, or our Director of Elections? So I called my Town Clerk and asked her to describe the test that she does before every election. Then, I described the test (through an associate) to Harri Hursti, the person who performed the infamous "Hursti Hack" test. Sadly, he assured me that Kathy DeWolfe is incorrect - her test would definitely not detect what he did.

As a result of the Hursti Hack, several states and municipalities have taken action. Two counties in Florida and the entire state of Pennsylvania banned the exact machines we are using. Colorado put certification on hold. California decertified the machines and ordered the software code to be reviewed by an independent testing agency, which confirmed the vulnerability. The Governor of Maryland wrote a scathing letter to the state's board of elections saying he no longer has confidence in Diebold election systems.

While other states have taken appropriate action, our Director of Elections, whose job it is to ensure the security and integrity of our elections, has done absolutely nothing. In fact, when numerous people have contacted her office for an explanation, she repeatedly and inexplicably defends Diebold and supplies inaccurate information in her reply, assuring that anything like the Hursti Hack would be detected by the testing procedure. We now know that is not true. And when asked if our system complies with the 2002 Voting System Standards which clearly forbid the type of code used on the Diebold optical scan systems, her only reply is that the Standards, which are written by the Federal Election Commission, are not law.

The bottom line is this: I am not necessarily accusing Diebold or LHS of rigging an election. What bothers me is that they can. Elections are supposed to be transparent and they are not.

It is imperative that Ms. DeWolfe (and her boss, the Secretary of State) respond to the fact that significant vulnerabilities have been found in our election system and they do not comply with the Standards that were written to ensure the systems are secure. If she continues to ignore this problem, the people of Vermont should take her to task for not performing her responsibilities as our state's Director of Elections. We should also work to reform our laws to require open software code and random auditing of the system - two essential steps that would help ensure the integrity of our elections. I invite those concerned to learn more and join our efforts by contacting me at gary@solarbus.org, or visiting the website: election.solarbus.org.

SNIP...LaMarche says she has seen no evidence of attempted vote tampering in her 21 years as Burlington's elections director. Diebold optical scanners have been used in Burlington since 1994 and have proven highly reliable, she adds. Several recounts took place during that time, with the actual marks on the paper ballots being compared to the electronic count by the optical scanners. "And we've seen very little, if any, discrepancy," LaMarche reports. The Diebold machines are clearly superior to the type the Queen City used prior to 1994, she notes

(If you recount with the same scanner that counted the votes the first time of course there will be no discrepency)

SNIP...He emphasizes that his apprehension about cooked outcomes has nothing to do with the integrity of election officials in Burlington or the rest of Vermont. Beckwith's concerns are based on the secret design of Diebold's scanners and on the actions of the company's past and present executives

(Thats a good response)

SNIP...Both hacks were successfully executed despite the fact that Diebold refuses to disclose information about the software used in its scanners and tabulators. The publicly held company says it treats this information as proprietary in order to protect its products against competitors and hackers. Critics contend, however, that Diebold has a duty to be more transparent about what's inside its machines because the company plays a key role in the democratic decision-making process in hundreds of localities

(The company is bullshitting thay don't want the voter to see it)

SNIP...Other Diebold defenders point out that no one has demonstrated an occurrence of fraud in any actual elections in the United States involving electronic voting machines. In some quarters, insinuations of election rigging are rejected outright as either fantasies spun by conspiracy theorists or whining by sore losers.

(Cause no one is allowed to look at the machines, first to people who did HACKED A MOCK ELECTION?)

SNIP...During the 20 years he has been selling Diebold election products, Silvestro continues, "there have been nearly a thousand recounts involving our machines and there has never been one instance of anybody making an accusation of fraud

(Again cause no one is allowed to look in the machines)

SNIP...The scanners and tabulators used in Vermont are certified to 1990 federal standards, says Silvestro, head of the firm that distributes the Diebold machines. "The new model in production is certified to the 2002 standards," he adds. But Silvestro did not directly respond to the issue of whether executable code is contained in scanners distributed by LHS. Vermont officials have also not indicated whether the code is present.

(Why haven't they responded?)

SNIP...Beckwith isn't calling for scrapping scanners altogether and going to exclusively paper ballots counted entirely by hand. As Silvestro notes, "Machines have been shown to be more accurate than human beings in counting votes." For Beckwith, rather, the main aim is to come as close as possible to guaranteeing the integrity of the voting process in Vermont and every other state. "I want to live in a democracy," he says, "where everyone can have confidence that elections are conducted openly and honestly."

(Good one this article will open more eyes to the possibility of election fraud.)

I think you either need to clarify or correct your reference to CA. CA did once decertify Diebold but it wasn't in response to the same Hursti hack that led FL to drop Diebold. As I think you know, CA recently granted conditional certification, despite confirmation of the Hursti hack.

HTH.

if the Hursti Hack didn't cause McPherson (temporarily) decertifying Diebold, then what did cause it?

from reading the Berkeley report, it appears clear that whoever commissioned them was concerned about the Hursti Hack. It even says in the summary that one of the purposes of the study was to determine if the Hursti Hack was real.

The Berkeley report was totally damning and did indeed confirm the Hursti hack. McPherson responded by conditionally certifying Diebold. It is mystifying and dumbfounding. The report was the perfect justification for rejecting the certification but instead it was used to grant conditional certification. It is flagrantly lawless, not because of Hursti but because of the confirmed presence of the interpreter code in conflict with the fed guidelines.

That's just a simple re-cap of current events. There was a time when CA de-certified Diebold but that was back in 2004. This led to Kevin Shelley's ouster from the SoS office and in turn the appointment of McPherson.

I'm not referring to the 2004 decertification. I'm talking about in December 2005, when McPherson made his declaration. Do you think it is incorrect to say McPherson temporarily decertified Diebold in December 2005? I have seen others refer to it this way.

i just did a google on it and found one article said:

"McPherson also placed Diebold's certification in limbo,..."

i agree his decision makes no sense. I have to believe there is more to come on this. With Bowen fighting it, and the activists (like you) gaining credibility, I wouldn't give up on California.

I only chimed in here because I thought your draft was unclear and possibly inaccurate on this one point. I'm not trying to pick a semantic argument, only to help you address the one single thing I stumbled over in your otherwise excellent letter.

If you are going to reference 12/05 I suggest being more explicit about the timeline. And if you are going to reference 12/05 I do not think it is accurate to say McP de-certified Diebold because at that time they did not have certification to lose. What he did was delay making a decision by referring the equipment for more federal testing. This move was dubbed by Bowen as "punting."

I think what made it unclear for me was that CA really had two responses to Hursti. First was 12/05 and then was 2/06. You may find it unnecessary to reference both or to draw the distinction. I have no beef with that. I just think for clarity you need to be clear about the timing of whatever response you are referencing.

up and up with the ballot counting machines then they (the state) shouldn't mind if you were to put together a team to recount ALL the Voter Verified Paper Ballots by hand.

I would be curious to know how they would answer that challenge.

stay tuned. i have a feeling they'll come up with an excuse to not let us.

they could have an excuse without looking ridiculous, you are letting Diebold keep their proprietary "bullshit" so no competitors can steal their design "AYE YA YA" (I could make a ballot scanner with parts from a damn science surplus store) and I wouldn't need to steal Diebolds design to do it,

But anyway TAKE IT TO EM.