Independent Analyst Submits Positive Review of Diebold Machine

September 23, 2003

Upon the recommendation of the Maryland Department of Budget & Management, Governor Robert L. Ehrlich, Jr., today authorized the State Board of Elections to proceed with the statewide installation of the Diebold AccuVote-TS electronic voting machine.

Governor Ehrlich reached his decision after reviewing a positive independent analysis of the Diebold machine and its source code.

"In August, I ordered my administration to subject the Diebold machine and source code to the strictest of tests to ensure it met my high standards," Governor Ehrlich said. "This month, a third party analyst submitted to me a positive independent review indicating that the Diebold machine and source code, if operated properly, can contribute to one the safest, most secure election systems available. Because of this report, Maryland voters will have one of the safest election environments in the nation."

Governor Ehrlich in August ordered Science Application International Corp., (SAIC), under an existing contract for security services with the State, to conduct the independent analysis of the Diebold machine and its source code. The SAIC review responded in part to a report published by Aviel Rubin of Johns Hopkins University that questioned the use of the Diebold source code.

SAIC's independent review states, "While many of the statements made by Mr. Rubin were technically correct, it is clear that Mr. Rubin did not have a complete understanding of the State of Maryland's implementation of the AccuVote-TS voting system...The State of Maryland's procedural controls and general voting environment reduce or eliminate many of the vulnerabilities identified in the Rubin report."

SAIC's report continues, "Rubin states repeatedly that he does not know how the [Diebold] system operates in an election and he further identifies the assumptions that he used to reach his conclusions. In those cases where these assumptions concerning operational or management controls were incorrect, the resultant conclusions were, unsurprisingly, also incorrect."

Diebold has incorporated three new security features in response to the independent review. The enhancements include 1.) implementing a dynamic assignment of security keys to enable the State to determine the pass codes used by smart cards to access the system, 2.) incorporating encryption into the electronic transmission of election results, 3.) providing personal identification numbers for when election officials access the system. Additionally, in an effort to ensure maximum public confidence in the State's election system, the State Board of Elections is adopting the following recommendations by SAIC that further solidify its own election security system:

• Bring the AccuVote-TS voting system into compliance with the State of Maryland Information Security Policy and Standards
• Consider the creation of a Chief Information Systems Security Officer at the State Board of Elections
• Implement a formal, documented, complete, and integrated set of standard policies and procedures.
• Implement a formal, System Security Plan that is consistent with State Information Security Policy, Code of Maryland Regulations, Federal Elections Commission standards, and industry best practices
• Apply cryptographic protocols to protect the transmission of vote tallies
• Require 100% verification of unofficial election results
• Establish a formal process requiring the review of audit trails
• Provide formal information security awareness, training, and education appropriate to each user's level of access
• Review any system modifications through a formal, documented, risk assessment process to ensure that changes do not negate existing security controls,
• Implement a formal documented process to detect and respond to unauthorized transaction attempts
• Implement a formal, documented set of procedures describing how the general support system identifies access to the system
• Change default passwords and passwords printed in documentation.

"SAIC's robust analysis of the Diebold technology benefits every Maryland voter," said Gilles W. Burger, Chairman of the Md. State Board of Elections. "Because of SAIC's comprehensive and independent review, voters and election workers in Maryland will now have one of the leading election systems in the nation."

A copy of SAIC's independent review can be obtained via PDF file at http://www.dbm.maryland.gov/SBE.

A copy of the Md. State Board of Elections Action Plan can be obtained by contacting the Md. State Board at (410) 269-2840.