e-voting source code disclosures

Efforts by Microsoft and a few vendors of e-voting technology recently failed to amend New York state legislation in a way that would have weakened source code escrow provisions.

New York state passed legislation in 2005 requiring that e-voting software source code be placed in escrow for examination. Microsoft (whose Windows operating system is used by some e-voting products) lobbied to amend that legislation. This amendment would have exempted code not specifically designed for voting technology. I suppose this would have made it easier for Microsoft and the e-voting vendors to claim that most or all of their code is to generalized to be considered voting-specific, and would therefor be exempt from examination.

California has similar source code disclosure provisions regarding e-voting technology. One e-voting vendor (Election Systems & Software) had been holding out for months, but recently (and grudgingly) turned over their source code to the California Secretary of State.

Looks like event Presidential candidate John Edwards is getting into the act.

e-Voting Update, DST Lameness

This is mostly an update to last week's e-voting rant. The Diebold suit against Massachusetts is still in litigation, but it was dealt three significant setbacks this week:

1. execution of Massachusetts' contract with Diebold's competitor will not be blocked
2. Diebold will not be granted an accelerated discovery process
3. and Massachusetts will be able to view Diebold internal documents

An enlightened judge. How refreshing.

Also, HR 811 is making its way through US Congress. HR 811 is an e-voting reform bill which, among other things, requires a paper trail to be an integral part of any e-voting solution. It also forbids e-voting machines to have wired or wireless Internet connections, and it requires that e-voting software source code be made publicly available. Signs of enlightenment in Congress--also refreshing.

And, to no one's surprise, it looks like the change in Daylight Savings Time accomplished very little other than to annoy computer system administrators. Like me. So much for Congressional enlightenment.

Recent e-Voting Developments

There were a couple of interesting e-voting-related items in the news this week.

The state of Massachusetts decided to purchase a large number of e-voting machines, and they solicited bids in order to select a vendor. They ended up choosing AutoMARK, a competitor of Diebold. Diebold, annoyed at losing a $9 million contract, is suing the state of Massachusetts. The term 'sore losers 'comes to mind.

The state of California is looking at imposing a very strict set of requirements for e-voting machines. These requirements are in fact so strict that no e-voting vendor may be able to meet them in time for the presidential primary in February 2008 (which is about four months earlier than in previous elections), which might mean that the election will be conducted with paper ballots.

The articles state that both decisions (Massachusetts' AutoMARK selection and California's interest in tougher standards) were motivated at least in part by legislation requiring voting facilities for voters with certain types of disabilities.

In a somewhat related story, the New York Review of Books published an article which contains some interesting speculation about the outcome of the 2000 presidential election had Florida prisoners been allowed to vote. This is a fairly long article, but it's one of the most thought-provoking things I've read in a while.

More on passports and e-voting

A recent article from The Register describes some passport-cloning research (these are UK passports). These people were able to read and clone the RFID data while the passport was being mailed to the owner, before he/she even had the chance to take possession of it.

And it looks like Diebold is thinking of getting out of the e-voting business. I guess they think that all the bad press about security problems in their electronic voting machines has damaged their image. So rather than trying to improve the technology, they'd rather just dump the whole thing. So scads of expensive e-voting machines would remain in service (because municipalities blew their budgets buying them in the first place, and may not be able to replace them for a while), with a big question mark over the prospect of future support and updates. Classy.

better-than-wholesale e-voting machines

Wired has an article describing a method one computer science researcher is using to acquire e-voting machines for security analysis: he bought them cheap off eBay. No background check, no non-disclosure agreement, nothing. And by cheap I mean he paid $82 for $25,000 worth of Sequoia e-voting equipment (that's a 99.672% markdown).

Although the Wired article claims that the research finds these machines to be more secure than products from competing companies, the researcher's Web page about his evaluation paints a dimmer picture.

destroying democracy the easy way

A recent slashdot post caught my eye. It involves two of my favorite topics: e-voting and lockpicking. According to the slashdot article, Diebold (a company which makes e-voting machines) recently posted, on their own freaking Web site, high-quality images of the key which can be used to unlock the access panels on their e-voting machines. The images were apparently good enough that it was possible for someone to make a quick trip to Home Depot, buy a metal file and a few blanks of the right kind of key, file the keys to the correct shape, and start unlocking Diebold machines.

Word to the wise: next time you feel like photographing your keys (and let's face it, who doesn't love photographing their keys?), put the pictures in a scrapbook on your bookshelf, not the Internet.