Q&A: E-voting systems hacker sees ¿particularly bad' security issues
Herbert Thompson took part in a hacking of Diebold voting equipment last year
January 19, 2006 12:00 PM ETComputerworld -
When Herbert Thompson, director of research at Wilmington, Mass.-based Security Innovation, talks about e-voting security, he speaks from firsthand experience. Security Innovation conducts security testing and Thompson is the co-author of several books, including How to Break Software Security. He volunteered to use his expertise in tests to determine whether it's possible to hack electronic voting gear last May and again last month in Leon County, Fla. With fellow security expert Harri Hursti, Thompson took part in the hacking of an optical scan system made by Diebold Elections Systems Inc., allegedly proving that election results could be changed.
Thompson spoke recently with Computerworld about e-voting reliability. Diebold declined to make anyone available for an interview on the topic, but a spokesman dismissed the concerns raised by Thompson. Diebold's response follows Thompson's comments below.
Can you tell us about some of your e-voting machine hacking activities? On Tuesday, Dec. 13, we conducted a hack of the Diebold AccuVote optical scan device. I wrote a five-line script in Visual Basic that would allow you to go into the central tabulator and change any vote total you wanted, leaving no logs. It requires physical access to a machine, which in many counties isn't very difficult to get -- you have elections offices full of volunteers. In Leon County, they have good policies and procedures in place. But in many counties, where such awareness doesn't exist, that brings up some serious concerns about someone being able to tamper with the results.
Harri Hursti changed the contents of a memory card used in the optical scan device and preloaded it. During the [pre-election testing] procedure, it will tell you there are no votes on the card, but there is executable content on it. If you can get access to the memory card, you can change its logic and have it do whatever you want -- even print a smiley face. That hack was like prestuffing a ballot box to handicap one candidate by giving them negative votes and giving another positive ones.
Is e-voting security a political issue? I'm strictly an independent person donating my time. It's not political. Bad software is the issue. I'm a software security guy. I see a lot of bad software. All software has security vulnerability -- this is just particularly bad. As an election official, you have to be wary when touching a tabulator or a memory card, it has to be treated like a box of live ballots.
Diebold has claimed that the hacks have been unfair. Your response?
Cybercrime/Hacking
Additional Resources



White Papers & Webcasts
Mastering eDiscovery: The IT Manager's Guide to Preservation, Protection & Production
Get this paper now!
Key Strategies for Managing Data Growth
What are you storage challenges?
Not Just Words: Enforce Your Email and Web Acceptable Usage Policies
Get this paper now!
Extending Client Refresh - 11 Steps to Maximize Savings
Register Now!
Email Archiving: A Business-Critical Application
Get this paper now!
Lower the Cost and Complexity of a Mobile Workforce through Automation
Download This Resource Now!
IBM ISS X-Force Threat and Risk Report
Learn about all aspects of threats that affect Internet security.
Managing Mobility: Improve Data Security, Compliance and Manageability
Download This Resource Now!
The New World of eCrime: Targeted Brand Attacks and How to Combat Them
Download This Whitepaper Now!
Consolidate Your Servers and Storage to Lower Costs with Oracle Database 11g
Register for this webcast!
