Stealing Democracy?

A Finnish security expert, Harri Hursti, successfully hacked a Diebold voting machine, not only submitting a falsified vote count, but getting those same numbers past the central tabulating computer.

In the end, the vote was what Hursti had determined it would be, not what the ballots actually read.

Consequently, the supervisor of elections in Leon County, Florida has stated he will never again use Diebold machines in an election, and has asked for funds to replace the current system.

Instead of Diebold addressing the error, they chose to threaten the supervisor. Note that the letter says Diebold welcomes, "authorized testing and examination of our products by qualified professionals;" the implication is that Hursti is neither qualified or professional. It basically means Diebold will only accept tests made by their hand-picked experts - kind of like letting Uri Geller pick the scientists who are to examine his spoon-bending powers. (And we're all amazed, of course, when those hand-picked scientists affirm Geller's amazing feats, right?)

The letter then goes on to suggest that the test voids the warranty, licensing agreement, and is tantamount to damaging the system.

Has it occurred to the Diebold folks that someone willing to falsify election results doesn't exactly care about licensing, the warranty, or damage to the software insofar as their attempts remain undetectable? Fraud is not an accidental event; it is an act of deliberate malice. The system must be able to differentiate between valid and fraudulent operations. (A general example of this is when a system denies access after several failed login attempts.)

Additionally, predicating a system's security on the presence of non-related physical security is a fallacy. Claiming the system is secure only as long as it is inside a locked room says nothing about the integrity of your system. It ignores the problem of an unauthorized person gaining access and/or posing as an authorized user when, in fact, this is essential to system security.

While this incident is not conclusive proof that fraud has been perpetrated in any given election, the fact that Diebold continues to ignore their failings and threaten election officials who are practicing due diligence does not elevate their reputation.

And though it may be unrelated, Diebold's CEO, Wally O'Dell announced his resignation earlier this week.

(Bruce Schneier's blog also mentions Hursti's test.)

The Ministry has received 1 comment(s) on this topic.