Today is election day, and before I talk about who I'm voting for, I thought I'd point out what is, to me, a far more serious issue - the growing use of electronic voting machines in spite of the demonstrated insecurity of these machines as they exist today. Imagine the 2000 election with claims that Bush or Gore had hacked the Florida voting machines and caused untraceable changes in votes. Think about the challenges to Bush's legitimacy today, and imagine what they'd be like in the event we were confronted with a series of news reports waking up - finally - to the insecurity of these systems. On Declan McCullogh's Politech list, this email went out today (it's not up on his site yet, so I'm posting the entire thing):
----- Forwarded message ------ Declan and Dave, Please (please!) remove my e-mail address if you decide to post this. I'm an undergraduate in a large Georgia university, which also happens to be the place I vote at election time. Although I have been a casual follower of the voting security debate, I now find myself in a unique position. A sitting position. More precisely, sitting 10 feet away from a stack of 10 unguarded electronic voting machines. Despite having been here for for 120 minutes (and taking a conspicuous number of photos), I have yet to see any security presence, or anyone associated with these machines at all. First thing: this terrifies me. Because although I have no reason to suspect these machines have been tampered with, I really have no way of knowing for sure. Even though it would be difficult for someone to tamper with these machines on-site without being noticed, there is a huge potential for a machine to be stolen (at which point it could either be tampered with, and then (in theory) returned, or just analyzed to locate problems with the voting software). It's one thing to debate how secure the software is, especially when being used within sight of elections officials. It's another thing entirely when anyone who wants to can take the machine home to play with. Even more alarming than the lack of security around these machines is the response I have received from anyone I have tried to point this out to. The friend who initially directed me to this problem has called a half dozen different groups, ranging (in order) from the state voting commission, the local paper, the local news, campus security, and even the campus newspaper. The voting commission assured us the machines were locked. As someone standing next to the machines, I can assure you that they are not, unless a zip tie now qualifies as a lock. The press brushed us off entirely. Campus security told us it was "not their problem". If someone could tell me that this is somehow okay, that I'm overanalyzing the problem, and that this is in fact not dangerous behavior, it would reassure me a great deal. But if this is in any way representative of the way electronic voting systems are being deployed around the rest of the country, I fear for tomorrow's election. Now, descriptions of the machines. I have about 70 pictures of these, should anyone require them (but I'm holding on to them for now, in the interest of remaining anonymous until I feel these machines are secured). I have removed information that identifies directly which county these machines belong to; I am happy to reveal it later, once these machines are set up and under active surveillance. Each container is roughly 2 feet by 2 feet square, by 1 foot deep, with collapsable legs. These containers are stacked in two piles of 5 machines each, with a larger box and a briefcase resting nearby. The small boxes have wheels on the bottom and a suitcase style handle and clasps. They appear identical to the system displayed on http://www.diebold.com/dieboldes/ . One such machine has the following information on the front, near the handle: A barcode with a green and a yellow sticker attached. The barcode reads "123678" A barcode labeled "[county name] County - Ga Purchase". The barcode reads, "265345893" A half-removed label with the following word fragments: [bottom portion of a large word] Election S[unintelligible] 4.3.14 UPGRA[unintelligible] This text appears consistent with the Diebold Election Systems logo, as seen at the above Diebold Election Systems website. Also, written on the top, where the legs are collapsed: "P/N 663-1141 REV--4 Model/Revision AVTS--BOOTH.1.01.004" Next to that, a yellow sticker with the text, "A-H 6-12-02" The boxes are sealed with a large plastic zip tie (some are pulled tight; others only about halfway tight), and with a red tag with a serial number. One such tag is labeled, "SEALED 0144481" One machine also has a label attached to the side opposite the wheels. The label is attached with a zip tie, and enclosed in a plastic container. The label reads, "02X 2 [scribbled out numeral 4] of [scribbled out numeral 4] 9". [It is probably worth reiterating that there are, in fact, 10 machines stacked here]. The larger box is roughly 1.5 feet by 2 feet, and 1.5 feet tall, with the text, "Property of [county name] County Government, Registration, and Elections" embossed in the side. The briefcase is blue, 3 inches deep, 2 feet wide, 1.5 feet tall, and has a handwritten label attached with the words "Provisional Voting" written on it. I will be monitoring both Politech and Interesting People for responses, should this get posted. ----- End forwarded message -----I've been reading Bruce Schnier's great book on security (review to follow) and the reality is that all the high-tech, intrusive, civil-rights violating security measures in the world don't mean a damn thing if you leave the hardware unattended and unsecured.