Diebold Global Election Management System (GEMS) Backdoor Account

[Jérôme ATHIAS]

Date: Tue, 31 Aug 2004 00:38:05 -0400
Subject: http://www.blackboxvoting.org/?q=node/view/78

BlackBoxVoting.org reported a vulnerability in the Diebold GEMS central tabulator.

A local authenticated user can enter a two-digit code in a certain "hidden" location
to cause a second set of votes to be created on the system. This second set of votes
can be modified by the local user and then read by the voting system as legitimate
votes, the report said.

GEMS 1.18.18, GEMS 1.18.19, and GEMS 1.18.23 are affected.

The vendor was reportedly notified on July 8, 2003.


Solution: No vendor solution was available at the time of this entry.

Vendor URL: www.diebold.com/dieboldes/GEMS.htm (Links to External Site)

[Simon]

Marco S Hyman wrote:
>
> All I demand from a voting system is that votes can be voter verified.
> That's not true of ANY voting machine regardless of who writes the code
> unless there is a hard copy audit trail. If there is a hard copy audit
> trail then it doesn't make any difference who wrote the code.

How do you know that the software generating the audit trail is playing
fair if it's closed source?

Sometimes, IMHO, there's just no alternative to pen and paper. Surely
the manual method of ticking a box and having multiple human vote
counters checking ballots is the best option going, even if it is more
expensive. (I confess I've no idea what costs are involved either way.)

[Brian Kirkbride]

I'm a lurker myself but am keenly interested in the problem. I have to agree 100% with Ryan's statement. This is a point that few people make in this argument, because the discussion has been spun to focus on _proving_ some sort of malicious intent on D
iebold's part. I disagree with that fundamental statement of the argument. These people have demonstrated that they are ignoring all of the "right" ways to perform their task (both technically and ethically) and have repeatedly used press releases and l
egal maneuver to avoid addressing the issues people have with their software.

This sort of behaviour is commonplace when it comes to corporations because it is usually less painful financially than doing what is right. But I cannot agree more strongly with the point that this particular service is one that should be performed with
out profit as the highest motive. For those at Diebold that cry foul at those of us that feel the election is more important than their quarterly statement, I humbly suggest that they should choose a less vital service to bring to market. Imagine a comp
any complaining that reliable medical systems would be too costly to implement and would affect their bottom line. There is a greater standard to uphold.

- Brian Kirkbride

Ryan_Ward@Dell.com wrote:
> I usually lurk as well, but wanted to respond to your question.
>
> There's so much debate for one simple reason. All the known solutions
> have been ignored. This is why everyone is getting so upset on this
> issue. Companies like Diebold have ignored all the previous work on
> this subject, work done by people like Bruce Schneier. They've ignored
> all the problems with their system, up to and including their complete
> lack of verifiability. They're already, in a rather short history in
> this field, shown a complete lack of accountability (think the various
> unapproved revisions that got them sued in California).
> That they've been so determined to weasel around the _known_ solutions
> to these issues casts a great deal of suspicion on them. Their
> continued resistance to even the simplest fixes, combined with their
> repeated denials of any problems, is only making things worse.
>
> Unfortunately, I don't see any major changes to this happening until
> some state's electoral votes go to CowboyNeal or Bill the Cat...
>
> Ryan (Not speaking for Dell in any way, shape or form)
> "Every election is a sort of advance auction sale of stolen goods."
> -- H. L. Mencken
>

[Jason T. Miller]

On Tue, 28 Sep 2004 gandalf@digital.net wrote:

> Let me add one more social dynamic. The public will want to see
> instantaneous vote results,

I hear this voiced often in the debate, and that it's one of the big
benefits of DRE systems, i.e., faster results, though I've never seen any
evidence to support the claim that voters are particularly unhappy with
the speed of election returns using current technology (the Florida
recount aside, but that's an exceptional event), or, more importantly,
that "the public" (or, less ambiguously, a majority of voters in this
country) is willing to sacrifice accuracy for speed in elections. Of
course, "all things being equal", it's probably safe to say that "the
public wants faster results", much as it's safe to presume that the masses
would rather be rich and healthy than poor and sick, but that's not really
saying much, as all things are never equal, and, in a world of finite
resources, priorities have to be set.

This member of "the public", for one, doesn't really care if election
results take a day or a week, so long as they're as accurate as available
technologies and resources permit.

On another note, I'm curious what's being done on the paper-trail systems
to prevent vote buying -- seems like I could snap a picture of the receipt
before I leave (with a camera phone, say) and use it as evidence that I've
voted for someone. Sure, such a thing could be Photoshopped, but doing so
untraceably is beyond the skill of most voters, so that isn't much of a
risk for a prospective buyer. Can I say "no" to the verification and vote
again, without leaving the booth or otherwise drawing undue attention to
my actions?

Sincerely,
Jason T. Miller
Shaffstall Engineering

------------------------------------------------------------------------
Shaffstall Corporation http://shaffstall.com / http://theoneview.com
A Division of One View, Inc. jasomill@shaffstall.com
8531 Bash Street / Indianapolis, IN / 46250 317-842-2077 x302


Confidentiality Notice

This message is intended only for the addressee named above. It contains
information that is privileged, confidential or otherwise protected from
use and disclosure. If you are not the intended recipient, you are hereby
notified that any review, disclosure, copying or dissemination of this
transmission, or taking of any action in reliance on its contents, or
other use is strictly prohibited.

If you have received this transmission in error, please reply to the
sender listed above immediately and permanently destroy this message and
accompanying documents.

Thank you for your cooperation.

[David F. Skoll]

On Tue, 28 Sep 2004, Simon wrote:

> Sometimes, IMHO, there's just no alternative to pen and paper. Surely
> the manual method of ticking a box and having multiple human vote
> counters checking ballots is the best option going, even if it is more
> expensive. (I confess I've no idea what costs are involved either way.)

According to Elections Canada, the 2000 general election cost $200.6
million (Canadian dollars). But this included everything, including
maintenance of voter registries, reimbursement of expenses to
political parties and candidates, etc.

Source: http://www.elections.ca/content.asp?section=faq&document=faqelec&lang=e

In that election, there were 28,846,761 voters, so the cost
per voter was around $6.95 Canadian, or $5.43 US.

I suspect that the cost to actually count the votes is significantly less
than this figure. I have no idea what the figures are for electronic
voting, but I doubt it can be done for much under $4 to $5/voter.

Consider that the average polling station contributes a couple of
hundred votes to the total. So you can hire six people at $25/hour
for 5 hours each (two shifts) to man the station and count the
ballots afterwards, and you've spent $750, some of which you recover
in the form of income tax. :-)

Now how many voting machines would such a polling station require? And can
you buy a super-de-duper-de-luxe voting machine for $750?

--
David.

[trh]

Didn't diebold get owned?

Weren't a bunch of incriminating memo's published by a reporter?

Wait... Isn't the CEO a huge contributor to the Republican Party?

All I have to say is wake up.

Seriously.







On Mon, 27 Sep 2004, Bob Toxen wrote:

> Diebold having "swore up and down" that their closed-source system
> is secure and then it's been proven otherwise is exactly why we
> NEED an open source solution or go back to punched card/mechanical
> solutions.
>
> Open Source in this case does not need to be free source. Diebold can
> get a software patent if they want while still keeping the source
> available by audit by everyone.
>
> In answer to the other poster's question as to why didn't Diebold
> use Schneier's public methods, I suggest that it was some combination
> of arrogance and stupidity. I've discussed in the past ways to
> have cryptographically-signed records originated on each voting booth
> device and which travel all the way to the final tallying systems.
> The would would stop a LOT of potential tamper points.
>
> Best regards,
>
> Bob Toxen
> Author,
> "Real World Linux Security: Intrusion Detection, Prevention, and Recovery"
> 2nd Ed., Prentice Hall, (C) 2003, 848 pages, ISBN: 0130464562
> Also available in Japanese, Chinese, and Czech.
>
> On Thu, Sep 23, 2004 at 06:21:03AM -0400, Jeremy Epstein wrote:
>> As someone who's been involved in the electronic voting controversy, I'd
>> like to add a few points:
>>
>> (1) I agree that source code should be inspected by someone truly
>> independent and competent, and that the standards for approving voting
>> machines should be stronger. However, that's NOT the same as open source.
>> And I'd strongly discourage folks from calling for open source, as it plays
>> directly into the hands of folks like Diebold, who claim that the people
>> (like me) who want Voter Verified Paper Audit Trails (VVPATs) are really
>> trying to kill free enterprise. [Yes, I know all the examples of businesses
>> based on open source, but that's not what this is about.] As an example,
>> Harris Miller, the president of ITAA (www.itaa.org), a politically
>> influential consortium of technology vendors, is on record as having equated
>> the VVPAT groups with the open source community. So rather than putting
>> your energy into trying to get Diebold et al to move to open source, it
>> would be far more productive to put your energy into VVPATs. Towards that
>> end, I'll encourage everyone participating in this discussion to look at
>> www.verifiedvoting.org. VVPATs can give us the assurance we need of
>> accurate elections, without delving into the political morass of open source
>> and related topics.
>>
>> (2) WRT the web page showing a "Sun server when discussing Windows", I hope
>> people realize that web pages for companies are made up by marketing people
>> who don't understand the difference. Don't hold that against them... There
>> are plenty of real reasons to oppose Diebold.
>>
>> (3) WRT requiring that the technology protect itself in case the users
>> don't, that's simply unrealistic. In *any* real computer system, there are
>> expectations about the environment (e.g., the administrators aren't hostile
>> to the functioning of the system). It's important to state what those
>> expectations are, but there will ALWAYS be some that rely on non-technical
>> means. The important part about election systems is that they be explicitly
>> stated, and they be enforceable using non-technical means (e.g., by having
>> locks on doors). The problem today is that some of the assumptions (e.g.,
>> the vendor provided software doesn't have any bugs) are clearly unrealistic.
>>
>> (4) WRT getting one set of software approved, and then installing another...
>> that's an old problem in any environment. The way it's supposed to work in
>> election systems is that a particular version is approved, and it's illegal
>> for the vendor to install something different. If there are teeth in the
>> law, and the vendor can be fined for installing illegal software, then it's
>> a reasonable non-technical measure. Of course, one could also use things
>> like cryptographic checksums to verify that what's installed is what was
>> approved. That still requires non-technical elements, such as that the
>> people who ran the checksums weren't deliberately trying to cover up a
>> change, the checksums were protected from tampering, the software that
>> calculated the checksums wasn't subverted, etc. [For those of us old enough
>> to remember, vendors were required to address this as part of "Orange Book"
>> evaluations, and are now required to address it as part of Common Criteria
>> evaluations.]
>>
>> Bottom line, election systems are no different than any other systems in
>> that the security of the whole system is based on risk management. While we
>> should have higher expectations of election software than office automation
>> software, let's recognize what it is. IMHO, VVPATs are the only real way to
>> go.
>>
>> --Jeremy
>

[David F. Skoll]

On Mon, 27 Sep 2004, Marco S Hyman wrote:

> > The answer is not to try to show that open source can be used in
> > captialistic ventures, but rather to be very clear in stating that free
> > enterprise (and capitalism) has no place whatsoever at any time in the
> > creation, formation, and instatement of a government for the people.

> Do expect to return to the age where voting is done with a pen and a
> blank slip of paper,

Yes, indeed. Works very well where I live (the paper isn't blank, though;
it's a pre-printed ballot.)

> both supplied by the voter?

That's not necessary. I trust the ballot and pen given to me by
Elections Canada.

> All I demand from a voting system is that votes can be voter verified.

I demand that it can be voter-verified by any "average" voter. That means
that anyone capable of voting must be capable of fully understanding and
verifying the voting system, which pretty much eliminates electronic
voting machines.

> That's not true of ANY voting machine regardless of who writes the code
> unless there is a hard copy audit trail. If there is a hard copy audit
> trail then it doesn't make any difference who wrote the code.

If you already have a hard copy audit trail, then why not *just* use the
hard-copy and dispense with electonic voting machines altogether?

--
David.