"Campaign for Verifiable Voting in Maryland"
www.TrueVoteMD.org · 7711 Garland Ave., Takoma Park, MD 20912 ·
301-270-6150
FOR IMMEDIATE RELEASE CONTACT:
TrueVoteMD.org
October 6, 2004
Linda Schade 301-270-6665
Jim Johnson 301-589-3434 ext. 160
E-Voting Computer Group Submits Pointed Inquiry
Security Concerns Outlined to State Election Bd
In an eleventh-hour appeal for corrective action regarding the vulnerable Diebold AccuVote-TS DRE voting machines scheduled to be used throughout Maryland on November 2, TrueVoteMD today sent a letter to the State Board of Elections identifying and requesting a response to the most serious electronic voting issues that threaten voting integrity in the state on November 2 (http://www.truevotemd.org/Resources/TrueVote_Tech_Letter.pdf).
TrueVoteMD's Technical Committee, comprised of computer professionals across the state, documented six major areas of concern for the high-stakes equipment test facing voters as they turn out at the polls possibly in record numbers.
Chief among the issues identified in the letter is the possibility of machine failures - due either to boot-up problems or a major power failure - and the state's lack of a backup plan if that occurs. Maryland Election Administrator Linda Lamone testified at a State House Ways & Means Committee hearing in February 2004 that paper ballots would be available in every state precinct in the event of power outages.
However in the Prince Georges County District 2 election of September 2004 voters were disenfranchised when the machines failed to boot-up and paper ballots were not available. TrueVoteMD's Technical Committee identified five other electronic-voting machine priorities:
--The Diebold Election Management System (GEMS) that aggregates and tabulates votes cast at polling stations, operates on Microsoft Windows. This operating system supports back-end serves and Microsoft Access as its tabulating tool. According to the Cert Center at Carnegie-Mellon Institute, the United States government's computer security clearinghouse, the vast majority of security breaches occur on systems using Microsoft Windows and other Microsoft products running under Windows, such as the Access Database.
TrueVoteMD's letter points out that "it is therefore critical that all security patches issued by Microsoft be applied to these servers and that network security and physical security of these servers be as sound as possible. This weakness becomes more alarming given the hundreds of people who have access to the GEMS back-end servers at the precinct, county, and state levels."
The minimum level of protection identified is one-time passwords and installation of monitoring tools to detect intrusion or unauthorized data changes. As reported by RABA Technologies, a firm hired by the State of Maryland to evaluate the Diebold system, scripts written by those with malicious intent are easy to install and execute within the GEMS system.
--During the March 2004 primary, voters using the AccuVote-TS machines in Maryland experienced machine boot-up failures, machine crashes during voting, frozen screens, vote-switching, and electronic ballots missing one or more candidates or entire slates. The letter asks what steps the State Board of Elections have taken to determine the cause of failure and ensure the bugs have been fixed.
--No procedures are in place nor resources provided for formal quality-control and documenting system problems for later evaluation and improvement. TrueVoteMD currently has made an effort to fill this gap with its nonpartisan pollwatchers (See http://www.truevotemd.org/take_action_watchers.asp).
--According to the Maryland Association of Election Officials' "Lessons Learned" report published in May 2004, no back-end disaster recovery plan for the state was in place. "Consider the consequences of an election day system crash in the Diebold environment where there is no paper trail and no tested, reliable disaster recovery procedure in place," the letter stated.
--The "Lessons Learned" report also noted that technicians representing themselves as Diebold employees entered polling places and made system changes and repairs without leaving any documentation. The letter asks what procedures have been established to identify certified Diebold technicians, respond in a timely manner when local election officials report AccuVote-TS machine failures, and document these activities.
TrueVoteMD's Technology Committee requested a written response from the State Board of Elections to these minimum priority issues.
***********
TrueVoteMD is a statewide nonpartisan citizens' campaign to protect the integrity of voting in Maryland. Its active representatives include people with expertise in elections, computer security, and election reform. TrueVoteMD believes a democracy requires a transparent election process with meaningful recount and audit capacities and that since computers, by their nature, are inherently subject to programming error, equipment malfunction, and malicious tampering, a voter-verified paper audit trail in Maryland is necessary to ensure transparent fair elections that can be accurately recorded and manually recounted.
TrueVoteMD is endorsed by Maryland Common Cause, Maryland Sierra Club, Maryland Business Leaders for Sensible Priorities, and Baltimore Interdenominational Ministerial Alliance.
###