A comprehensive study of electronic voting machines used in California has exposed some security weaknesses in machines used here in Houston.
The tests, administered by the University of California at Davis, found that absent tighter procedures, hackers could alter vote totals, violate the privacy of individual voters and delete audit trails.Harris County election officials called the test helpful, saying it identified places where the technology can be improved, but said the tested scenario was not relevant to live elections.
"The laboratory experiment, as conducted by the UC-Davis researchers, seems almost impossible to replicate outside that laboratory environment.
"Thus, voters in Harris County should be aware, but not be concerned by the results," said Hector DeLeon, a spokesman for Harris County Clerk Beverly Kaufman, whose office administers elections.
DeLeon called the test unrealistic because it is "premised on providing unfettered access to the voting equipment to a malicious individual with the technological savvy and ingenuity to violate the system."
It does not take into account controls and procedures designed to ensure accuracy, security and integrity of the voting system, he said.
It's true, in order to devise the attacks, researchers had unfettered access, said UC-Davis computer science professor Matt Bishop, who led the study.
But he said it didn't take long to devise attacks; some took five minutes, others took a few days.
"Relying on security through obscurity is a terrible thing to do," Bishop said. "(Attackers) can get the info, the only question is how hard do they have to work to get it. Any defense that relies on ignorance underestimates how ingenious attackers can be and overestimates how fallible people are."
Bishop could not say whether voters should be comfortable using the machines in place. He did, however, say that voters should "feel they can do a better job of building a better system."The vulnerability that the study uncovered speaks more to the vendors than the election officials, he said, because security should be part of the design and implementation of the system.
I agree with Bishop and Charles and all those who believe we can do better...One voter, one vote...every time. Recent studies in California and Florida are important baby steps in providing secure, fair and honest elections. However, reaction by vendors and county officials seems shortsighted. In computer security, there are two longstanding axioms: Locks keep the honest people out. And if it can, it will. It's only a matter of time. More importantly, the more certain we are that, it can't happen here, the greater the risks are that it will. The more open portals a system has, the more prone it is to a breach. We must do more, be more business wise. We must implement high-bar stringent guidelines for voting machine providers and elections officials to uphold. And we must fix our election laws to protect us from machine and human error.
Sadly, we have even more to fear from insiders than we do from the hackers outside. Hackers are more likely to leave a trail, while an insider is more informed and thus more dangerous. This is why I chose an ex-employee pent on revenge for my villain in "A Margin of Error Ballots of Straw."
While the heroine of my novel scoffs at the notion of a silent coup marching across the country in her fictitious voting machines. How will we know it's right?
Posted by: lbrown on August 6, 2007 1:54 PMfrom:
Paul Lehto on the news from California
http://markcrispinmiller.blogspot.com/2007/08/paul-lehto-on-news-from-california.html
What makes anybody think there is such a thing as "secure machines?" This is the quest we are placed on by Bowen's orders.
Computerized voting machines can not possibly be made secure against criminal insiders, yet this is when we need our inalienable right to kick the bums out THE MOST, to remove a criminal insider. It's doubtful that any government report can squarely and honestly deal with this fundamental and powerful objection, because we know from human nature that people are very poor at auditing themselves, investigating themselves, or checking and balancing themselves. Only citizens can provide the control of elections without high levels of conflict of interest.
The red team and source code investigators basically said "boy, I don't know HOW these things could be made secure, the problems are just so severe and at the most basic architectural levels." But in various ways, we're going to try this very doubtful task pursuant to the "reapproval" process and see what happens.
Whether this is an example of great leadership by Bowen, by forcing vendors and officials to sit down and draft new plans, and thereby realize in the process (at least by election officials) that there is no way out of the enormous raft of problems at the ARCHITECTURAL LEVEL revealed by the CA reports, or whether it is a misleading exercise in false confidence and band aids that will in the end leave plenty of holes (for insiders especially) remains to be seen. This depends on events and reactions that have not yet happened.
As always, it is incumbent on activists and citizens (IMHO) to advocate for the right thing, and not advocate for a pre-compromised position. The political horsetraders (lobbyists and politicians) are the ones to make the compromises and do the horse trading, if such is appropriate and must be done. Moreover, it doesn't do Bowen much good if it looks like she's just delivering "victory" to activists, it makes here look "extreme" to some. Therefore, we should advocate as always for what's right. Though we need not slam Bowen, we should be sure to say where this does not go far enough, because at a minimum that creates political "space" for Bowen to operate in.
In any event, there are many reasons why the holy grail of "secure machines" doesn't exist. Computers do as they are told regardless of law or ethics, which means that insiders that control or possess those computers have unlimited power to alter elections either (1) without leaving any evidence of the same, or at the very least (2) not getting that evidence in a timely basis for the VERY short statutes of limitation for filing election contests (and raising the money and support necessary for the same).
Any real solution has to deal with the problem of invisible, secret first counts of votes, and the statuses (winner, loser) and consequences that get locked in by election headlines. In-precinct hand counts could do that. But that's because they deal with the FIRST count, not because they are by hand. Late arriving hand-audits are basically worthless, and highly subject to legal challenge, unlike the first counts.
As one can see, I'm more concerned with the political "ecology" of how this process will work out for democracy, than in the question of what thank you notes should be in the mail and to whom. For that, it's too early to tell, except that wwe can salute Secretary Bowen in taking us down, and the state and nation down, a valuable educational learning curve.
Paul Lehto
...................
Are Rove's missing e-mails the smoking guns of the stolen 2004 election?
by Bob Fitrakis and Harvey Wasserman
April 25, 2007
http://www.freepress.org/departments/display/19/2007/2562
E-mails being sought from Karl Rove's computers, and recent revelations about critical electronic conflicts of interest, may be the smoking guns of Ohio's stolen 2004 election. A thorough recount of ballots and electronic files. preserved by a federal lawsuit, could tell the tale.
The major media has come to focus on a large batch of electronic communications which have disappeared from the server of the Republican National Committee, and from White House advisor Rove's computers. The attention stems from the controversial firing of eight federal prosecutors by Attorney-General Alberto Gonzales.
But the time frame from which these e-mails are missing also includes a critical late night period after the presidential election of 2004. In these crucial hours, computerized vote tallies may have been shifted to move the Ohio vote count from John Kerry to George W. Bush, giving Bush the presidency.
Earlier that day, Rove and Bush flew into Columbus. Local election officials say they met with Ohio Secretary of State J. Kenneth Blackwell in Columbus. Also apparently in attendance was Matt Damschroder, executive director of the Franklin County (Columbus) Board of Elections.
These four men, along with Ohio GOP chair Bob Bennett, were at the core of a multi-pronged strategy that gave Bush Ohio's twenty Electoral College votes, and thus the presidency. Bennett and Damschroder held key positions on election boards in the state's two most populous counties, with the biggest inner city concentrations of Democratic voters.
There were four key phases to the GOP's election theft strategy:
1. Prior to the election, the GOP focused on massive voter disenfranchisement, with a selective reduction of voter turnout in urban Democratic strongholds. Blackwell issued confusing and contradictory edits on voter eligibility, registration requirements, and provisional ballots; on shifting precinct locations; on denial and misprinting of absentee ballots, and more. Among other things, election officials, including Bennett, stripped nearly 300,000 voters from registration rolls in heavily Democratic areas in Cleveland, Cincinnati and Toledo, with no notice given those being disenfranchised.
2. On election day, the GOP focussed on voter intimidation, denial of voting rights to legally eligible ex-felons, denial of voting machines to inner city precincts, malfunctioning of those machines, destruction of provisional ballots and more.
In Franklin, Cuyahoga and other urban counties, huge lines left mostly African-American voters waiting in the rain for three hours and more. A Democratic Party survey shows more than 100,000 voters failed to vote due to these lines, which plagued heavily Democratic inner city precincts (but not Republican suburban ones) throughout the state. The survey shows another 50,000 ballots may have been discarded at the polling stations. In addition, to this day, more than 100,000 machine-rejected and provisional ballots remain uncounted. The official Bush margin of victory was less than 119,000 votes.
3. After the final tabulation of the votes, and the announcement that Bush had won, the GOP strategy focused on subverting a statewide recount. A filing by the Green and Libertarian Parties required Ohio's 88 county boards of election to conduct random precinct samplings, to be followed by recounts where necessary.
A lawsuit was filed to delay the seating of Ohio's Electoral College delegation until after the recount was completed. Among other things, the plaintiffs sued to get access to Rove's laptop. But Blackwell rushed to certify the delegation before a recount could be completed. The issue became moot, and the suit was dropped. In retaliation, Blackwell tried to impose legal sanctions on the attorneys who filed it.
But two felony convictions have thus far resulted from what prosecutors have called the "rigging" of the recount in Cuyahoga County (where Bennett has been forced to resign his chairmanship of the board of elections). More are likely to follow.
The practices that led to these convictions were apparently repeated in many of Ohio's 88 counties. The order to violate the law---or at least tacit approval to do so---is almost certain to have come from Blackwell.
4. Ultimately, however, it is the GOP's computerized control of the vote count that may have been decisive. And here is where Rove's e-mails, and the wee hours of the morning after the election, are crucial.
Despite the massive disenfranchisement of Ohio Democrats, there is every indication John Kerry won Ohio 2004. Exit polls shown on national television at 12:20am gave Kerry a clear lead in Ohio, Iowa, Nevada and New Mexico. These "purple states" were Democratic blue late in the night, but, against virtually impossible odds, all turned Bush red by morning.
Along the way, Gahanna, Ohio's "loaves & fishes" vote count, showed 4,258 ballots for Bush in a precinct where just 638 people voted. Voting machines in Youngstown and Columbus lit up for Bush when Kerry's name was pushed. Rural Republican precincts registered more than 100% turnouts, while inner city Democratic ones went as low as 7%. Warren County declared a "Homeland Security" alert, removed the ballot count from public scrutiny, then recorded a huge, unlikely margin for Bush.
These and many more instances of irregularities and theft were reported at www.freepress.org and then confirmed by U.S. Representative John Conyers and others who researched the election.
But the most critical reversals may have come as exit polls indicated that despite massive Democratic disenfranchisement, and even with preliminary vote count manipulations, Kerry would win Ohio by 4.2%, a margin well in excess of 200,000 votes.
The key to that reversal may be electronic. It has now become widely known that the same web-hosting firm that served a range of GOP websites, including the one for the Republican National Committee, also hosted the official site that Blackwell used to report the Ohio vote count.
This astonishing conflict of interest has been reported at the epluribusmedia.org on-line investigative service. Cross-postings have come from luaptifer at Dailykos and blogger Joseph Cannon's Cannonfire.blogspot.com. They all confirm that the RNC tech network's hosting firm is smartechcorp.com, based in Chattanooga, Tennessee. SMARTech hosts georgewbush.com, mc.org, ohiogop.org and gop.com among other Republican web domains, in a bank basement.
Furthermore, the same hosting site that handled redirections from Blackwell's "official" site also handled the White House e-mail accounts that have become central to investigations of the Gonzales purge of eight federal prosecutors, some of whom were themselves involved in vote fraud investigations.
Conflicts of interest in programming services and remote-access capability appear throughout the RNC's computer networks, Rove's secret White House e-mail, and the electronic vehicles used by Blackwell to finally reveal his "official" presidential vote counts for Ohio 2004.
One factor may be Ohio's electronic touch-screen voting systems, on which were cast more than 800,000 votes in an election decided by about one-seventh that total. Such vulnerabilities, among other things, have been confirmed in exhaustive reports by Conyers's Committee, by the Government Accountability Office, by the Carter-Baker Commission, by Princeton University, by the Brennan Center, and by others.
But overall, the electronic record of every vote in Ohio was transmitted to the Secretary of State's office, and hosted in real time in Chattanooga. Under such circumstances, the joint hosting of the White House e-mail system and accessibility by Blackwell and Rove to the same computer networks linked to the Ohio vote count, takes on an added dimension.
Mike Connell, a Republican computer expert, helped create the software for both Ohio's official 2004 election web site, and for the Bush campaign's partisan web site during the 2000 election. The success of Connell's GovTech Solutions has been attributed by Connell to his being "loyal to my network," including the Bush family.
Blackwell shared those loyalties. Like Connell, he worked for the Bush-Cheney campaign, serving as its Ohio co-chair. He was also in control of the vote count that was being reported on software Bush loyalist Connell helped design.
It was in a crucial period after midnight on election night 2004 that these paired conflicts of interest may have decided the election. As exit polls showed a decisive Kerry victory, there was an unexplained 90-minute void in official reporting of results. By this time, most of the vote counts were coming in from rural areas, which are traditionally Republican, and which, ironically, usually report their results earlier than the Democratic urban areas.
In this time span, Kerry's lead morphed into a GOP triumph. To explain this "miraculous" shift, Rove invented a myth of the greatest last-second voting surge in US history, allegedly coming from late-voting fundamentalist Republicans. No significant evidence exists to substantiate this claim. In fact, local news reports indicate the heaviest turnouts in most rural areas came early on election day, rather than later.
According to a January 13, 2005, release from Cedarville University, a small Ohio-based Christian academy, Connell's GovTech Solutions helped make the shared server system run "like a champ through the early morning hours as users from around the world looked to Ohio for their election results."
After 2am, despite exit polls showing very much the opposite outcome, those results put Bush back in the White House.
In January, 2005, the U.S. Congress hosted the first challenge to a state's Electoral College delegation in our nation's history. At the time, the compromised security of the official Ohio electronic reporting systems was not public knowledge. But the first attempt to subpoena Karl Rove's computer files had already failed.
Now a second attempt to gain such access is being mounted as the Gonzales scandal deepens.
Congressman Henry A. Waxman (D-CA) has raised "particular concerns about Karl Rove" and his electronic communications about the Gonzales firings.
Rove claims both his own computer records and the RNC's servers have been purged of e-mails through the time the Ohio vote was being reversed. Rove's attorney, Robert Luskin, has told a Congressional inquiry that Rove mistakenly believed his messages to the RNC "were being archived" there.
But the RNC says it has no e-mail records for Rove before 2005. Rob Kelner, an RNC lawyer says efforts to recreate the lost records have had some success. But it's not yet known whether communications from the 2004 election can be retrieved.
Nor is it known whether the joint access allowed to top GOP operatives Rove and Blackwell was responsible for the election-night reversal that put Bush back in the White House.
But there remains another avenue by which the real outcome of Ohio 2004 could be discovered. Longstanding federal law protected Ohio's ballots and other election documentation prior to September 3, 2006. Blackwell gave clear orders that these crucial records were to be destroyed on that date.
Prior to the expiration of the federal statutory protection, a civil rights lawsuit was filed in the federal court of Judge Algernon Marbley, asking that the remaining records be preserved. The request was granted in what has become known as the King-Lincoln Bronzeville suit (co-author Bob Fitrakis is an attorney in the case, and Harvey Wasserman is a plaintiff).
Thus, by federal law, the actual ballots and electronic records should be available for the kind of exhaustive recount that was illegally denied---or "rigged," as prosecutors in Cleveland have put it---by Blackwell, Bennett and their cohorts the first time around.
Ohio's newly-elected Secretary of State, Jennifer Brunner, has agreed to take custody of these materials, and to bring them to a central repository, probably in Columbus.
This means that an exhaustive recount could show who really did win the presidential election of 2004.
It may also be possible to learn what roles---electronic or otherwise---Karl Rove and J. Kenneth Blackwell really did play during those crucial 90 minutes in the deep night, when the presidency somehow slipped from John Kerry to George W. Bush.
--
Bob Fitrakis & Harvey Wasserman are co-authors of HOW THE GOP STOLE AMERICA'S 2004 ELECTION & IS RIGGING 2008, available at www.freepress.org and, with Steve Rosenfeld, of WHAT HAPPENED IN OHIO?, from the New Press. Fitrakis is publisher, and Wasserman is senior editor, of www.freepress.org
................
In Violation of Federal Law, Ohio's 2004 Presidential Election Records Are Destroyed or Missing
By Steven Rosenfeld, AlterNet. Posted July 30, 2007.
In 56 of Ohio's 88 counties, ballots and election records from 2004 have been "accidentally" destroyed, despite a federal order to preserve them -- it was crucial evidence which would have revealed whether the election was stolen.
The missing presidential election records were discovered this past spring by Brunner, a Democrat and former judge who was elected Secretary of State in 2006. Her predecessor, Republican J. Kenneth Blackwell, was sued in August 2006 by a Columbus community organization that alleged the former Secretary of State and other "unnamed" officials "selectively and discriminatorily designed and implemented procedures for the allocation of voting machines in a manner to create a shortage. For certain urban precincts where large numbers of African-Americans resided," according to the complaint.
Under federal and Ohio law, all ballots and election records from federal races must be preserved for 22 months after Election Day, which fell on Sept. 2, 2006. While election integrity activists and reporters from a Columbus website, FreePress.org, had sought the ballots and other election records soon after the presidential election, Blackwell would not allow county boards to release the ballots, citing court challenges to the 2004 results and a 2005 suit from the League of Women Voters alleging the state was not following the newest federal election law, the Help America Vote Act. By spring 2006, after the League's lawyers stipulated they were not challenging the 2004 election results, some counties began to release their 2004 election records. Scrutiny of those records raised questions about the conduct of the election and some county vote totals.
On Aug. 23, 2006, lawyers for the King Lincoln Bronzeville Neighborhood Association notified the Secretary of State's office of their voter suppression suit. The following day Blackwell's office sent letters to all 88 of Ohio's county Boards of Election, notifying them of the suit. It is customary for public officials to preserve potential evidence when notified of pending litigation. Ian Urbina, a New York Times reporter working on the story, reported that Blackwell said he would be creating a process whereby county election records could eventually review and dispose of the 2004 ballots.
On Sept. 11, 2006, U.S. District Judge Algenon Marbley ordered the election boards "to preserve all ballots from the 2004 Presidential election, on paper and in any other format, including electronic data, unless and until such time otherwise instructed by this Court."
Two months after Marbley's order, Blackwell lost the race for governor to Democrat Ted Strickland and Brunner was elected Secretary of State. During the following winter and spring, Brunner and the state's attorneys began negotiating a settlement for the voter suppression suit, according to lawyers involved in those talks. Part of that agreement, which has not yet been brought before the federal district court, was the creation of a statewide repository of the 2004 presidential ballots. When conducting an inventory and attempting to collect those records, Brunner's office learned that seven counties had no ballots to turn over and 56 counties only had partial records from the 2004 vote.
"This is not just a violation of a 22-month ballot retention law. It is a violation of a court order," Arnebeck said. "Blackwell told the New York Times that he would create a clearance procedure before destroying any ballots. The combination of Blackwell's directive and my letter should have been enough to give the counties notice."
What Happened to the 2004 Ballots
The presidential ballots and election records were lost, misplaced, damaged by water, taken to landfills - all apparently by mistake, due to miscommunications, or because the local election administrators were not aware of the state ballot preservation law or the federal court order, according to letters to Brunner's office from the various county election boards.
more