Flaws found in vote machines

A review found that widely used electronic machines can easily be compromised.

STAFF AND WIRE REPORT

COLUMBUS — A Palm Treo Smartphone and a magnet would be tools enough to tamper with the workings of electronic voting machines used in Ohio as well as across the country, the political swing state’s top elections official said Friday.

In a $1.9 million review with national implications, both corporate and academic scientists identified a host of ways in which votes cast on touch-screen technology are vulnerable to manipulation. Such machines have been purchased across the U.S. as part of a $3 billion conversion laid out in the federal Help America Vote Act.

The Ohio report does not address how likely it is someone would attempt to tamper with the machines, which are operated under the supervision of 88 county boards of elections and citizens who volunteer as poll workers.

The risks are severe enough, however, that Democratic Secretary of State Jennifer Brunner wants to revamp the way Ohioans vote in time for the fall presidential election in order to guard against problems.

She proposes replacing current voting locations with a smaller number of more centralized voting centers, combining eight to 12 existing precincts, and having voters use paper fill-in ballots that would be counted on centrally located optical scanners. If that can’t be done by the general election, Brunner favors giving voters leery of electronic machines the option of using a paper ballot.

To prevent confusion and long lines, she also wants voters to be able to cast ballots 12 hours a day at the new voting centers starting 15 days before the election.

Kelly Pallante, Trumbull County Board of Elections director, said she believes the electronic voting equipment Trumbull County is using is popular among voters. Pallante also said she doesn’t look forward to perhaps getting rid of the equipment now that her staff and poll workers are becoming comfortable with it.

Dan Tokaji, associate director of Election Law Moritz, a project of the Ohio State University law school, said Brunner’s recommendations could be disastrous. He said counting optical scan ballots at central locations, rather than at individual precincts, means voters would lose an electronic reminder telling them they’ve made a ballot error.

“Following that recommendation would be a huge mistake, and one that could possibly change the outcome of the election,” Tokaji said. “The social science has consistently shown that centrally counted votes are prone to inaccuracies.”

He said Brunner’s idea of voting centers will also put undue burden on minority and low-income voters to get transportation to a location farther from their home — reintroducing the legal question of whether the state’s election system is fair to everyone.

The League of Women Voters, however, endorsed establishing voter centers, which they said has proved successful in Colorado to address machine issues as well as poll worker shortages.

Currently, only one company — Election Systems & Software — manufactures central-count optical scan machines, but Brunner said two other models are set to be certified early next year.

The review, groundbreaking for encompassing previous security findings nationwide, computer source codes and access to internal election procedures, sought to hack into voting machines built by ES&S, Hart Intercivic and the former Diebold, now Premier Election Solutions based in Allen, Texas.

“These computer systems do not meet minimum industry standards for computer security,” Brunner said at a news conference. “And if we’re going to use computers for voting, they need to be as secure as everything else we use in our everyday lives.”

Brunner said she will not force Cuyahoga County — Ohio’s most populous county, and one plagued with electronic voting problems — to select optical scan machines for the March primary. In light of the study, though, she said she would be disappointed if they don’t.

Ohio House Speaker Jon Husted, a suburban Dayton Republican, joined Brunner at the report’s release to send a signal to Ohioans that any attempt to swiftly react to the report’s findings is not partisan.

Both he and Brunner appealed to the U.S. Congress to consider making more money available to the economically strapped state to pay for replacing machines and tightening security in advance of the 2008 presidential election.

In a statement, Austin, Texas-based Hart InterCivic stood by its voting systems as secure, accurate, reliable and accessible to all voters. The company said it has already incorporated the findings of its own security testing into the machines, and will continue to improve them based on the Ohio study.

Premier noted in a company statement that it fully cooperated with Brunner’s review.

“It is important to note that there has not been a single documented case of a successful attack against an electronic voting system, in Ohio or anywhere in the United States,” the company said. “Even as we continue to strengthen the security features of our voting systems, that reality should not be lost in the discussion.”

A messages seeking comment was also left with ES&S, based in Omaha, Neb.

Reviewers said voting was potentially vulnerable on all three companies’ machines, Premier and Hart machines did not protect properly against “malicious insiders,” ES&S machines did not protect against improper access to election data and Premier machines did not adequately protect voters’ privacy.

Brunner said some of the hacking test required high levels of sophistication, but others did not.

Researchers found that invasive computer messages could fairly easily be introduced by a voter to an electronic voting machine using a Treo, Palm Pilot or similar device and spread rapidly in “the equivalent of sharing a toothbrush.” Or results could be corrupted with a magnet.

Software that elections boards use to create ballots often are not password-protected, or use a universal password provided in a procedures manual.