Q&A: E-voting systems hacker sees ¿particularly bad' security issues

Computerworld - When Herbert Thompson, director of research at Wilmington, Mass.-based Security Innovation, talks about e-voting security, he speaks from firsthand experience. Security Innovation conducts security testing and Thompson is the co-author of several books, including How to Break Software Security. He volunteered to use his expertise in tests to determine whether it's possible to hack electronic voting gear last May and again last month in Leon County, Fla. With fellow security expert Harri Hursti, Thompson took part in the hacking of an optical scan system made by Diebold Elections Systems Inc., allegedly proving that election results could be changed.
Thompson spoke recently with Computerworld about e-voting reliability. Diebold declined to make anyone available for an interview on the topic, but a spokesman dismissed the concerns raised by Thompson. Diebold's response follows Thompson's comments below.
Can you tell us about some of your e-voting machine hacking activities? On Tuesday, Dec. 13, we conducted a hack of the Diebold AccuVote optical scan device. I wrote a five-line script in Visual Basic that would allow you to go into the central tabulator and change any vote total you wanted, leaving no logs. It requires physical access to a machine, which in many counties isn't very difficult to get -- you have elections offices full of volunteers. In Leon County, they have good policies and procedures in place. But in many counties, where such awareness doesn't exist, that brings up some serious concerns about someone being able to tamper with the results.
Harri Hursti changed the contents of a memory card used in the optical scan device and preloaded it. During the [pre-election testing] procedure, it will tell you there are no votes on the card, but there is executable content on it. If you can get access to the memory card, you can change its logic and have it do whatever you want -- even print a smiley face. That hack was like prestuffing a ballot box to handicap one candidate by giving them negative votes and giving another positive ones.
Is e-voting security a political issue? I'm strictly an independent person donating my time. It's not political. Bad software is the issue. I'm a software security guy. I see a lot of bad software. All software has security vulnerability -- this is just particularly bad. As an election official, you have to be wary when touching a tabulator or a memory card, it has to be treated like a box of live ballots.
Diebold has claimed that the hacks have been unfair. Your response?