Wednesday, December 17, 2008
Humboldt's False Alternative to Diebold
After missing several consecutive monthly meetings of the ad hoc volunteer Election Advisory Committee (EAC), convened by Humboldt County, CA Registrar of Voters Carolyn Crnich, on Tuesday night I rejoined the group to learn Crnich has at last given up on Diebold/Premier's optical scanners and GEMS central tabulator as our official vote counting method. After years of opposing Diebold, this might seem like a dream come true. But that's only the beginning of the story.
Crnich informed the group that we will continue to use paper ballots and precinct based scanning with Hart InterCivic's eScan system (complementing Hart's eSlate machines already in use for HAVA compliance). A distinction was made between Diebold's optical scanners and Hart's so-called digital scanners, though a similarity worth noting is that rather than counting the actual ballots both technically count the images of the ballots internally created within black box technology.
Whatever the supposed relative merits may be for Hart compared to Diebold, this is the epitome of a false alternative, the appearance of choice in a no-win situation. We will still be using an accuracy-challenged proprietary and secret system found vulnerable to undetectable manipulation by California's Top To Bottom Review, Ohio's EVEREST study, and Colorado's Secretary of State.
Humboldt County has made news lately for its Election Transparency Project, which revealed a failure in GEMS that caused Crnich to certify inaccurate results from last month's election. Crnich later told Wired.com:Crnich told Threat Level the issue has made her question her confidence in the voting system because, even though the company provided officials with a workaround, the problem indicated a fundamental flaw in the company's programming. She said she'd heard a lot of stories from other election officials about problems with voting machines, but never thought they applied to California.
Crnich has been widely praised for working with citizen volunteers to create the audit mechanism that identified the problem, which was entirely the fault of Diebold and not at all of Crnich's doing. Certainly some credit is due there, though as I explained last week, this has been exaggerated in an unhelpful way that now will likely make it more difficult to challenge her decision to switch to eScan. Indeed, at the EAC meeting I was accused of "casting aspersions" for raising questions of timing and public input. Yet check out how this almost went down...
"I've always sort of listened to those anecdotal incidents with a jaundiced ear because California has some very stringent requirements of election systems that are in use here as well as some very strict security procedures and I didn't think those things affected us here," she said. "But this has sort of put a cloud over any confidence that I had in the Premier equipment that's been in this department since 1995."
At Tuesday's EAC meeting, Crnich said she has the sole authority to choose our vote counting method and had already done so. In fact, she had hoped to take delivery of nearly 80 new machines on Wednesday in order to get a $28,000 discount offered by Hart if the deal could be completed by year's end. The total cost is estimated to exceed $600,000 and would be paid entirely out of the County's unused HAVA and Proposition 41 funds. Procedurally, Crnich said she needs the County Board of Supervisors to approve her plan, and then approval of the CA Secretary of State for the use of funds.
Crnich said she attempted to get a spot on the agenda at Tuesday's Supes' meeting. An unusually long list of business items prevented that and has likely created a reprieve until January 6. However, that isn't guaranteed as Supervisor Jimmy Smith, in attendance at Tuesday's EAC meeting, suggested the possibility of a short-noticed special Supes meeting that could possibly occur this year if it would still allow the $28k savings.
Crnich told the EAC the next scheduled election is not until November 2009, though there is talk of a possible statewide special election as early as March. In that regard, she did not express urgency for the Hart transition to begin. If anything, she said she looked forward to having the time to evaluate candidates for an open position within the elections department. She lamented the delay between the announced opening in July and her recent receipt of the qualified applicant list.
The intent here is not to attack Crnich. These are the things she has done and said, which fairly raise the following questions.
There is an element of deja vu here. In 2005 I wrote about efforts to prevent Crnich's flirtation with going touchscreen, though it certainly wasn't presented as an argument for the status quo. Crnich periodically receives heaps of praise for nixing the switch, typically without reference to the public resistance.
I can only think to call this a bittersweet irony. After years of urging the immediate abandonment of Diebold equipment, now Humboldt County can't drop the hot potato fast enough. The glow of the Transparency Project is currently blinding and seems to shield the sense of embarrassment for not only certifying inaccurate results but also defending the continued use of equipment known to be flawed all along. Who else will make clear that one laudable achievement does not mean complete deference on important questions of public policy?
* * *p.11
Here are some key observations from Harri Hursti and others about Ohio's EVEREST study:
The Red Team, working in close conjunction with the 2007 TTBR Hart Source Code Team, discovered that the Hart EMS software implicitly trusts all communication coming from devices appearing to be Hart-branded and neither authenticates the devices nor performs adequate input validation on data transmitted to it by the devices. This allows for the possibility that a compromised device, such as an eScan that had been tampered with at a polling station, could infect the EMS systems. In particular, the Source Code Team discovered a weakness in the code that would allow an eScan to perform a buffer overflow attack and execute arbitrary code on the computer running SERVO.
...
The team was also able to access device-level menus that should be locked with passwords but were not. This access could allow an attacker a vector for altering configuration settings and/or executing a denial of service on the eScan.
Some of the findings from previous studies on precinct count optical scanners were replicated on the eScan, and they allowed the Red Team to maliciously alter vote totals with the potential to affect the outcome of an election. These attacks were low-tech and required tools that could be found in a typical office.
The Red Team implemented an attack devised by the 2007 TTBR Hart Source Code Team that was able to extract election-sensitive information from the eScan and issue administrative commands to the eScan. The leaked information would allow an attacker the ability to execute further attacks, while administrative commands issued to the eScan could erase electronic vote totals and audit records from an eScan while putting it out of service for the remainder of the Election Day. For more details on these attacks, please see the 2007 TTBR Hart Source Code Team report.3.2 Insider Defenses
For more see this 2006 report from VotersUnite.org, the same site's Election Problem Log 2004 - Present, as well as BradBlog.com.
Attack Class 6: eScan Manipulation – We were able to exploit a number of vulnerabilities in the eScan that could give election insiders the ability to compromise election results and voter privacy. Some of these were a result of a lack of physical security. We were able to replace the eScan's internal flash memory card containing the eScan executable and configuration file with only a screwdriver in about 2 minutes. After replacing the card, we were able to boot the eScan into the Linux operating system. This simple attack gives a single poll worker with a few minutes of unobserved access to the eScan the ability to undermine all votes cast at a precinct (EVEREST 20.3.1).
While opening the eScan to replace the memory card, we broke three tamper evident seals. While such seals may prove that a machine was opened, a preventative measure is preferable. A poll worker may intentionally break these seals in order to cast doubt on election results. It has also been shown that tamper evident seals do not always correctly show that tampering occurred [14].
Insiders may also wish to use their access to ballots to determine voter choice. This can be done with the eScan due to the design of its ballot box (EVEREST 20.3.4). The eScan's scanner sits on top of its ballot box, which is essentially a plastic tub. When a ballot is scanned, it is subsequently dropped into the box. No measures are taken to disturb the order in which ballots fall, allowing a malicious poll worker to note the position in which certain votes are cast and then relay these positions to an election official with access to the ballots. We observed ten numbered ballots as they were cast with the eScan, and verified that the vote order was preserved.
...
Attack Class 14: Open Audit Interfaces – Both the Hart JBC and eScan have open interfaces that allow for the erasure of votes and audit log records. As detailed in Issue 3 of the CA TTBR, the eScan is managed through an accessible Ethernet port that listens for connections on TCP port 4600. This port is normally used for sending and receiving commands from SERVO, such as file transmission and reading images of the eScan's memory. No cryptographic tokens are required for these operations to occur.
We discovered that with a handheld device such as a Palm computer, an attacker with an Ethernet cable can mimic the actions of SERVO to the eScan during a live election, and cause the vote records and audit logs to be erased from both the eScan's internal memory and the MBB inserted into it (EVEREST 20.3.7). Any voting that had occurred on the eScan to that point would be erased, necessitating a manual recount.
...
Attack Class 19: Autovoting – A final example of unsafe features intentionally added to the Hart systems is the Ballot Now’s "Autovote" feature (EVEREST 20.7.2). Autovote allows for the creation of pre-filled-in paper ballots. Once again, this feature is enabled through Windows registry entries. Once these entries are enabled, Ballot Now displays the Autovote menu option when started.
The Autovote menu allows the Ballot Now user to choose the number of pre-filled-in ballots to print. The user has no control over the selected filled in entry for each contest, however, the selected entries are uniformly distributed. This allows an arbitrary number of ballots with the desired results to be printed with the overhead of some ballots with undesired results that may simply be discarded.
Paper ballots generated by Autovote initially say "Autovote" on the front and back, making them conspicuous and easy to detect in an audit or recount. We were able to overcome this by installing a PNG printer driver on the Ballot Now machine. This driver allows ballots to be printed to PNG image files as opposed to paper. We could then open the files in an image editor, remove the Autovote label and print them. Aside from the label, Autovote ballots are identical to regular ballots. We conducted a normal election and an election with Autovote ballots, and could not identify any differences in the eScan unofficial printout, the audit logs, or the cast vote records on the eScan's MBB.
Autovote could be used in tandem with the eScan's duplicate ballot feature to perform a ballot stuffing attack. Using Autovote ballots is advantageous over using photocopies, as each Autovote ballot has a unique serial number, and thus cannot be differentiated from legitimate votes in an audit.
Permalink:
http://wedonotconsent.blogspot.com/2008/12/humboldts-false-alternative-to-diebold.html
Labels: Carolyn Crnich, Diebold, Election Advisory Committee, eScan, EVEREST, false alternative, Hart Intercivic, Jimmy Smith, Top To Bottom Review, Transparency Project
Tuesday, January 15, 2008
KHUM Humboldt Review Review, EAC and Ron Paul Too
The .mp3 archive of last Thursday's KHUM Humboldt Review finally became available yesterday but I didn't have time to listen and thus no blog post. Having listened now, I can accurately quote the top highlight, by far, which was my introduction, now a permanent part of the WDNC blog template*:"Dave, you're like the conscience of our electoral process."
I was on the show for two segments, the first starting about 20:34 into the .mp3 above. Hoover's great compliment is around 27:35. Click here and look for Arcata's 150th/Voter Information Day to see the rest of the guests. If you aren't here in Humboldt this may give you a few distinct flavors of our community, including celebrating the start of a year-long 150th anniversary for Arcata, and the hot button rail/trail issue. Hoover also interviewed Registrar of Voters Carolyn Crnich. It was so pedestrian that I don't have any other comment on it.
--Kevin Hoover, Editor, Arcata Eye; Host KHUM Humboldt Review
On the other hand, tonight the Registrar convened the monthly meeting of the Election Advisory Committee. The top story there was the announcement of Kelly Sanders as the new Election Manager, effective 1/1/08, filling the position vacated by Lindsey McWilliams last June. The Registrar said this promotion for Sanders, who has worked in the Humboldt Elections Department for years, most recently as Administrative Analyst, is known to other election administrators in the state, but not yet in the local media. A rare scoop here for WDNC.
With Supervisor Jimmy Smith present, the Registrar described two pieces of equipment she said she hoped she could buy from the County General Fund. First is a new DIMS server, which she said contains voter registration info. She also described the regular office scanner as being near death, slyly suggesting that perhaps its replacement would be suitable for the Transparency Project. Acknowledging it could be costly, the Registrar gave a maximum cost of $60,000. I think there was an audible gulp from Smith.
Also of note, I thought, was the approximate number 100 - absentee ballot requests per day. Early voting began on 1/7 with paper ballots and one eSlate available at election department HQ. There is a need for about 8-10 more pollworkers, and the Registrar recommended anyone interested use the application contained in their sample ballot and bring it to HQ.
Another budgetary matter that came up was the Governor's reneging on his promise to reimburse Humboldt County for this February's primary. This was held up as an example of an unfunded mandate. I jokingly suggested we refuse to hold the November election just to spite Arnold.
More seriously, the Registrar said she would be on a conference call tomorrow morning with other Registrars and Secretary of State Debra Bowen. One topic for that call is the "trusted build" program that Bowen implemented following the Top To Bottom Review. According to the Registrar, this involves wiping old memory cards and newly programming them with code supplied directly by Bowen.
The last thing I'll mention from the EAC meeting is the observation panel the Registrar said she wanted to form. If you are interested in this, I think you want to drop by HQ, perhaps Monday at 2pm when the Logic and Accuracy (aka Smoke and Mirrors) dog and pony show will be conducted.
Finally, right after I got home, David Kaftal, my Ron Paul contact, wrote to invite me to talk about election integrity at an "emergency meeting" the local Meet Up group has called for Thursday night at 6pm at the Humboldt Bay Municipal Water District, 828 7th St., Eureka. More details at the link above.
# # #
* Karen Renick, co-host of Vote Rescue Radio also just added a sweet new permanent testimonial to the WDNC left sidebar: "Ultimately, we MUST change the way our votes are being counted - or not counted - and Dave is one of those individuals who is making this a reality."
Permalink:
http://wedonotconsent.blogspot.com/2008/01/khum-humboldt-review-review-eac-and-ron.html
Labels: Arcata Eye, Carolyn Crnich, David Kaftal, Debra Bowen, Election Advisory Committee, Jimmy Smith, Karen Renick, Kely Sanders, Kevin Hoover, KHUM, League of Women Voters, Lindsey McWilliams, Ron Paul
Wednesday, August 29, 2007
Humboldt Hand-Count Campaign Maintains Media Presence
Two Tuesdays ago, on the 21st, the Election Advisory Committee had its monthly meeting. The EAC now meets the third Tuesday of the month at 6:30pm at the Eureka Courthouse. The Eureka Reporter ran an article about the meeting the next day, half of which describes the presentation (.mp3) I gave about the the Voter Confidence Committee report, hand-count campaign, and spreadsheet tool (.xls).
Supervisors John Woolley and Jimmy Smith, as well as Registrar of Voters Carolyn Crnich, all attended the 5.5 minute presentation and participated in the roughly 30 minute discussion that followed. I'm pleased with the way this went. The Registrar stated that she had played with the spreadsheet tool and it is "interesting." Supervisor Woolley said he wouldn't be able to support any kind of change without doing the kind of cost and time analysis that the VCC's spreadsheet tool permits. He said he likes the approach we are taking to developing and presenting this info. We agreed Aryay Kalaki is a fine mentor for community organizing. And I politely emphasized at least three times that we are awaiting the Registrar's best estimates to create the most official labor, cost, and time forecasts.
Last Friday the Eureka Times-Standard (archive) published a column with quotes only from Secretary of State Debra Bowen in response to a study she commissioned on voter confidence. I don't put any stock in these figures showing 44% of respondents have a "great deal of confidence that their votes are being accurately counted." 52% reported "some" or "only a little" confidence. Whatever. Like usual, the un-bylined T-S story strays far and wide from the crux of the matter, which is creating a basis for voter confidence, a reason for people to believe the results.
The Eureka Reporter did not mirror the T-S coverage of Bowen's survey. Last Friday, I did receive a call from Cerena Johnson, the new elections beat writer who had written the EAC article. We spent at least 15 minutes talking about some of the fundamental paradigms of the voter confidence movement. She seemed to understand and I figured there would be an article the next day. Those quotes did not appear until today, in an article that had a gross typo of omission. This is the end of the article:Some say this could create an opportunity to take transparency a step further, with an entirely hand-counted system.
As soon as I saw that on the Reporter website this morning I called Editor Glenn Franco Simmons. I reached his voice mail and left a polite request for a correction to be printed. A little later Ms. Johnson called my cell phone. We spoke for maybe seven minutes or so, continuing to break down and spell out why our current vote counting methods are secretive, how this is the opposite of the basic democratic concept of checks and balances, and that faith and trust are not relevant. She assured me a correction would appear. Also look out for a tight letter to the editor from Ruth Hoke.
Dave Berman, a founding member of the Voter Confidence Committee, said the committee is trying to work with the county by recommending areas for improvement.
Berman said the criteria for a sound voting system should be transparent, secure and verifiably accurate, also distinguishing casting from counting.
"We should be required to have faith in election results," [EMPHASIS ADDED] he said, adding that results should be tangible. "What we have is a secret process."
The committee is in the process of forecasting a workable format by which votes could be hand-counted, factoring in numbers of volunteers, costs and time.
Ultimately, Berman said, the committee would like to be in a position to bring the county information it doesn't have, as well as the support of the community, to advance the idea that there is "not just one way to do elections in Humboldt County."
Humboldt County will hold its next election on Nov. 6.
Now going back to last Friday once again, in the evening I went down to the Ferndale radio studios of KSLG. Plastic Jackson is the evening DJ and he had recently reached out to me wondering how he could plug in to the work of the VCC. First I sent him a public service announcement, which I mentioned last week. He then let me invite myself in for an interview which you can hear in part one and part two (both .mp3 approx. 5.5 min). I hope to return to PJ's "Happy Endings" show, 6pm to midnight, weekdays on KSLG.com.
On Monday I received a phone call from John Matthews, morning host on KSLG, but also producer of the KHUM public affairs show The Humboldt Review, hosted by Arcata Eye editor Kevin Hoover. This week's show (Thursday 6pm PT) will be about election integrity. I will be a guest via phone.
I so prefer to do interviews in the studio, however, I am currently in NY looking forward to my sister's wedding this weekend. More immediately, tomorrow morning at 10:15, my grandfather and I are going to lead a group discussion with his senior's group at the Suffolk Y Jewish Community Center in Commack. This is going to be fun.
* * *
For anyone who missed Dan Rather's expose about voting machines, it is a MUST SEE available here through BradBlog.com.
Permalink:
http://wedonotconsent.blogspot.com/2007/08/humboldt-hand-count-campaign-maintains.html
Labels: Carolyn Crnich, Cerena Johnson, Debra Bowen, Election Advisory Committee, Eureka Reporter, Eureka T-S, Jimmy Smith, John Woolley, Report on Election Conditions, spreadsheet tool, VCC
