Part II: Pull the Plug on E-Voting
By Bruce O'Dell
Thursday 26 October 2006
Here's an indictment of the IT profession, and a fine irony: the degree of independent hand-auditing of paper ballot
records sufficient to verify the corresponding computerized vote tallies is comparable to the effort required to more
accurately count all the ballots by hand in the first place, dispensing with the machines. But until that day arrives,
the programs that the voting vendors actually distribute - as opposed to the software they may say they distribute -
will continue to determine who takes power after the votes are tallied.
How does Diebold or ES software wind up in my precinct?
Consider that while there are a relative handful of programmers at companies like Diebold or ES, there are hundreds of thousands of voting machines out in the field. After a programmer writes a piece of software,
compiles it into binary form, and tests it well enough to say it's done and working properly, many additional people -
dozens to hundreds of them, in fact - get involved in the long chain of events to get that software out to the polling
station and election office, ready to be used.
This highly complex process includes the programmers who write the "application programs" that display ballots and
counts votes electronically; the testers who install a copy of the application program as provided by the programmer, to
run it for themselves to verify that the specified inputs correspond to the specified outputs; and the software
deployment specialists who take a copy as provided by the tester to distribute to their customers (once they're told by
management it's good enough to be used by the public).
Deployment specialists package the software so that it can be cloned thousands of times to be installed by vendor field
representatives or election administrators on the vast number of precinct machines and central tabulators out in the
Vote counting application programs don't just run themselves: there's a vast array of supporting software modules, such
as operating systems - rock-solid, dependable products like Windows; device drivers - software that hooks up to
input-output devices such as wireless network cards and telephone modems (you did know that voting equipment can be
accessed remotely) and firmware - the software that all other software depends on to interact with the physical world.
Thousands upon thousands of software modules and hardware components from vendors all over the world all playing some
supporting role in vote tallying.
If all this sounds complicated, well, it is. It's awesomely difficult to get this just right even within the relatively
safe confines of a private network inside a bank. While Diebold, ES and other vendors certainly pay lip service to accepted professional standards of best practice for system development,
testing and deployment, there are abundant indications that each link in the end-to-end software process has been
Software developers and other insiders pose the greatest risk Above and beyond the well-documented criminal records of
some of the key programmers who wrote a large portion of our current voting systems (just start at http://www.bbvforums.org/forums/messages/1954/17305.html?1138394704
and go from there), there's ample room for insider misconduct in any organization. My profession has largely failed to
adequately inform the public that the most severe security risks in any organization are from insiders. Quoting from Dan
Verton's book "Identity Thieves:"' as excerpted at CSO Magazine Online
The modern American bank has recognized the security risks associated with the new electronic frontier and, as a result,
has deployed all the state-of-the-art electronic security devices that one would expect to find in a security conscious
enterprise - firewalls, intrusion detection devices, password management systems, and powerful encryption technologies.
Yet banks and financial institutions continue to lose millions of dollars every year to trusted insiders who understand
where the weaknesses are in the system. In fact, insiders accounted for approximately 70%, or $2.4 billion, of the $3.4
billion that banks lost as a result of both internal and external fraud and hacker incidents in 2004."
Electoral systems grant regulatory power over a $12 trillion economy and access to the world's largest checkbook: the
federal procurement budget. By the Willy Sutton rule, voting systems are truly "where the money's at".
Constant, ruthless and highly sophisticated attempts by insiders to subvert voting software should be assumed as a
given. And yet a representative from Diebold can still say - with a straight face, and without being laughed out of the
room: 'For there to be a problem here, you're basically assuming a premise where you have some evil and nefarious
election officials who would sneak in and introduce a piece of software,' he said. 'I don't believe these evil elections
people exist.' (New York Times, 5/12/2006)
Testing can't prove software is safe
The second link in the chain - testing - is no better. When it comes to computerized voting systems, internal and field
software testers as well as external "certification labs" are one astonishingly lackadaisical and inattentive bunch,
judging by the vast array of bugs in the public record (as tallied at http://www.votersunite.org/info/messupsbyvendor.asp
and many other places). As a consultant to financial institutions I'd be fired - and then likely sued for gross
professional misconduct - if I did my job so poorly and so publicly.
To be fair, of course, although bug reports show voting software testing is mind-bogglingly lax, all any software
testing process can do is find problems that testers know to look for and report honestly. There are countless billions
of internal states within all but the simplest of programs. Both practically and theoretically, it is impossible through
testing to determine that any computer system has no flaws - much less, to rule out the existence of secret backdoor
functions to be triggered on a future date. (This is no science fiction; see http://www.bbvdocs.org/reports/BBVreportIIunredacted.pdf
Software distribution: a shell game with an invisible pea
It will come as no surprise that the third link from programmer to voter, field deployment, is also wide open to covert
manipulation. As soon as the programmer is done typing, software becomes invisible - it lives on as magnetic and
electrical impulses on silicon chips, disk drives, memory cards, and CD-ROMs. Specialized software called a
"configuration management system" is then used to control which of the many versions of which of the thousands of
software components are sent to which device in the field.
This is not a magic process ordained by saints and administered by angels.
Voting software is software distributed through use of software, vouched for by other software, that itself vouches for
other software. Surely nothing can possibly go wrong with such a system, even though the highly complex logistics of
installing thousands of software modules on tens of thousands of precinct devices and country central tabulators is
under the full control of ordinary people fully susceptible to blackmail, greed, or the pursuit of their own ideological
Did I mention this is done entirely outside public view?
To make things even more interesting, sometimes a lot of voting software is changed all at once with distribution of a
brand new version with many new features, while other times, just a few software modules are updated (often called a
"patch"). Patches occur especially frequently to poorly-written software; just ask any PC user who pays attention to the
pitter-patter of incoming Microsoft security updates. The level of scrutiny that a patch receives is even less than the
ordinary lax standard applied to voting software. That there were last-minute patches to voting software in Georgia and
Minnesota immediately before the elections of 2002 is indisputable. That may have had nothing at all to do with the
surprising outcomes of two US Senate races a few days later... but we can never know for sure.
Pre-Election Slumber Party
Sure, just one vendor insider with access to just one of the master copies of one of the software version or patch
distributions can compromise thousands of devices long, before the equipment ever reaches the voter. But you'll be
comforted even further to know that even after the devices are readied for an upcoming election, local election
officials have a surprising degree of cozy hands-on access to voting equipment. In fact, all over the country -most
notoriously in California Congressional District 50 this year - voting machines are commonly brought home by poll
workers for "storage" prior to the election. Voting equipment vendors allege that their equipment has tamper-proof
seals, while in reality, it takes only minutes using household tools to gain sufficient access to voting equipment to
permanently and in practice undetectably alter the software (see http://www.bbvforums.org/forums/messages/1954/36510.html?1158778859
An apology on behalf of the information technology profession
Here's the truth, and the truth hurts: my profession has enabled the development and deployment of voting systems which
are obviously and patently unfit for use.
In fact, the whole system of computerized voting in America is so far removed from standard best practices for
information technology that I can only conclude that - far from being the product of accidental defects or stupid
sloppiness - the vast array of security vulnerabilities found in every type of electronic voting equipment that has ever
been independently examined can quite plausibly be seen as deliberate features introduced to subvert the voting process
And so I can only say: I apologize on behalf of my profession, to the American people. You have been so ill-served by
those of us who bear the unique responsibility of ensuring that the computer systems upon which our civilization is now
almost totally dependent operate in the public interest.
But even knowing what we do know, many of my IT colleagues continue to try to salvage some application of computer
technology to voting. To them I say - just look at what we have done in the name of automation. We led the public into
this predicament and we owe it to them to help lead the way out. We have an ethical duty to honestly advise the public
when most appropriate choice is not to use computers.
Pull the Plug!
So let it be computer professionals who finally help he public to pull the plug on electronic voting.
The most urgent ethical duty facing the American information technology profession is for once to see past our
technocentric arrogance and acknowledge that from a whole-systems perspective, computerized voting is surely one of the
great blunders in the history of technology. Let us lend our full support to replacing computers as quickly as possible
with the worst way of tallying votes - except, of course, for all the others: citizen-run elections using the most
appropriate and secure vote tallying technology of all, hand counted paper ballots. While it may take a while to get
there, let's start now. This is the least we can do to be worthy of all those who laid down their lives to win and
defense our right to vote, the foundation of our freedom.
Don't throw good money after bad: ban computer technology in voting. Put ballots back on paper for everyone, using the
VotePAD device for the visually impaired. My profession has talented user interface designers who can craft a paper
ballot to meet the needs of the people who fill it out and count it - rather than dumbing it down to accommodate the
pitiful limitations of an optical scan program, or making a paper ballot look like a 19th century newspaper to skimp on
printing costs. Get serious about security for early and absentee ballots; treat them at least as well as if they were
bearer bonds; their true value is, of course, priceless.
Let citizens take control of the election process to cast paper ballots by hand, and count them on election night in
the polling place, in public. In the final analysis, we ourselves are the only people we can trust - or should ever
trust - to safeguard the Republic.
We, the people, have the inalienable right to run our own elections. Pull the plug.