|
|
|
|
|
Ehrlich Orders Check on Voting System |
|
Sean R. Sedam, Maryland Gazette
Aug. 8, 2003 ANNAPOLIS -- Gov. Robert L. Ehrlich Jr. trusts that the maker of Maryland's new electronic voting machines has fixed software glitches in its system, but on Wednesday he ordered an independent review of the system just to be sure."The governor trusts the Diebold [Election Systems Inc.] report," said Shareese N. DeLeaver, an Ehrlich spokeswoman. "But Gov. Ehrlich insisted on digging deeper to assure voter confidence in elections." The review comes two weeks after researchers from Johns Hopkins University released a study that found security flaws in the voting machines' software. The Hopkins study came exactly a week after the Board of Public Works approved a $55.6 million contract for 10,931 new touch-screen voting machines manufactured by Ohio-based Diebold. Science Application International Corp., which holds a $2.6 million contract to handle security for computer systems in state offices, will conduct the review at no cost to taxpayers. The company is expected to report its findings to the state in four weeks. The review will address software flaws, which Diebold officials said have been corrected. SAIC will simulate an election environment that takes into account state regulations, standards and procedures at the polls, DeLeaver said. "The administration is convinced that the stance taken by the review is broader in scope and methodology than the Hopkins study," she said. Diebold criticized Hopkins researchers for testing the software on a laptop computer and not considering security measures taken for elections. The company also said the software used in the Hopkins study, which researchers found on a Web site from New Zealand, was outdated. The researchers welcomed the broader scope of the independent review. "I think that that's good, but I also think that it's critical for them to look at the new source code," said Aviel D. Rubin, an associate professor of computer science and technical director of Hopkins' Information Security Institute in Baltimore. The source code contains "the instructions telling the computer what to do," said Rubin, who led the group that raised concerns about the Diebold software. "So if there's anything malicious, it's going to be in the source code. If there's anything poorly done, it's going to be in the source code." Diebold has agreed to release the source codes, said Michael Jacobsen, a Diebold spokesman. The Hopkins report focused on smart cards that voters insert in the machines in order to vote. It found that a voter could use a forged card to cast multiple votes for the same candidate without being detected. "Obviously, the [Hopkins] report raised interesting points," DeLeaver said. "But the methodology that SAIC will use will evaluate whether they are valid points." Rubin, who is familiar with SAIC, which bought his former employer, said the computer security company would be among his "top three or four choices to do this [review]." Diebold stands by its product, Jacobsen said. "We understand Maryland's decision to order the independent review of our electronic voting system," he said Thursday. "And we remain very confident in the integrity and security of the system. We and many election officials around the country believe that the electronic voting system holds the greatest potential for ensuring secure, impartial and accurate elections." Last year, the state tested 5,000 of the machines in Allegany, Dorchester, Montgomery and Prince George's counties. Gilles Burger, chairman of the State Board of Elections, welcomed the review, but said the board "is only playing a support role in this study. We're not going to drive it. We're not going to tell them what to do. We're going to treat it like an audit." If any flaws are found, the state will put additional security measures in place, he said. "No system is entirely protected information security-wise through the internal makeup of the system," Burger said. The election system also must have security precautions that have nothing to do with computers, he added. But that is not enough, Rubin said. "The physical and the procedural solutions are the backup," he said. "And you shouldn't have to rely on your backup."
|
|
| |
| |
|
|
