Skip the navigation

Expert Calls for Increased E-voting Security

By Marc L. Songini
January 23, 2006 12:00 PM ET

Computerworld - Herbert Thompson, director of research at Wilmington, Mass.-based Security Innovation Inc., is a co-author of several books, including How to Break Software Security (Addison Wesley, 2003). He volunteered last May and again last month in Leon County, Fla., to hack an optical scan system made by Diebold Elections Systems Inc., after county officials voiced fears about the system's accuracy and security. Thompson recently discussed the result of the test hacks in an interview with Computerworld.

Herbert Thompson, director of research at Security Innovation Inc.
Herbert Thompson, director of research at Security Innovation Inc.
Can you provide some details of your effort to hack into Leon County's Diebold e-voting machines on Dec. 13? We conducted a hack of the Diebold AccuVote optical scan device. I wrote a five-line script in Visual Basic that would allow you to go into the central tabulator and change any vote total you wanted, leaving no logs. It requires physical access to a machine. In Leon County, they have good policies and procedures in place. But in many counties, where such awareness doesn't exist, that brings up some serious concerns about someone being able to tamper with the results.
[Finnish security specialist] Harri Hursti [who also took part in the hacking exercise] changed the contents of a memory card used in the optical scan device and preloaded it. If you can get access to the memory card, you can change its logic and have it do whatever you want. That hack was like prestuffing a ballot box to handicap one candidate by giving them negative votes and giving another positive ones.
Do you think e-voting security has become a political issue? I'm strictly an independent person donating my time. It's not political. Bad software is the issue. I'm a software security guy. I see a lot of bad software. All software has security vulnerability -- this is just particularly bad. As an election official, you have to be wary when touching a tabulator or a memory card; it has to be treated like a box of live ballots.
How do you respond to Diebold's claims that the hacks were unfair? I would love to do a demonstration where Diebold participates. There are certainly other voting companies that make tabulation software as well as optical scan gear, and we're seeing the same vulnerabilities as we've seen in Diebold's systems, which raises a broader question. That's about whether the verification and validation processes these machines go through are woefully inadequate or not. The e-voting companies aren't volunteering their systems for independent audits and analysis.
Is the security in e-voting up to the standards that business executives would demand in their applications?No way. Definitely not. Five years ago, yes, but in the current climate, no. These guys are betting their critical business processes on software. They need to consider who might do harm to that system. This level of rigor isn't applied to e-voting systems.
What should be done? There should be much more severe security-testing requirements. The key is you need to raise awareness that these vulnerabilities do exist and can be exploited, and you need a way of measuring security.

Read more about Security in Computerworld's Security Topic Center.



What is Tech Briefcase?
TechBriefcase is a new, free service where IT Professionals can Search, Store and Share IT white papers and content like this. Learn more
Bookmark content
Speed up your research efforts with content across the web.
Search and Store
Find the white papers you need. Create folders for any topic.
View Anywhere
Open your briefcase on your iPhone, tablet or desktop. Share with colleagues.
Don't have an account yet?
Additional Resources
Security KnowledgeVault
WHITE PAPER
Security is not an option. This KnowledgeVault Series offers professional advice how to be proactive in the fight against cybercrimes and multi-layered security threats; how to adopt a holistic approach to protecting and managing data; and how to hire a qualified security assessor. Make security your Number 1 priority.

Read now.

Cut Communications Costs Once and for All
WHITE PAPER
New IP-based communications systems are being deployed by small and midsized businesses at a rapid rate. Learn how these organizations are enabling faster responsiveness, creating better customer experiences, speeding office or mobile interactions, and dramatically reducing existing communications costs.

Read now.

Gov't Legislation/Regulation White Papers
Activities Streams Base An Integrated Social Layer
The enterprise social software market is exploding thanks to converging trends of consumerization, cloud, and mobile. In this must-read report, "The Forrester Wave:...
Finding the right cloud solutions for your organization
HP is driving the evolution of what we call the Instant-On Enterprise. It is an enterprise that embeds technology into everything it does...
Converged Infrastructure for Dummies
As you know, everything is mobile, connected, interactive, and immediate. This is exactly why organizations need a highly agile IT infrastructure in order...
Measuring the Business Value of CI in the Data Center
One of the key strategies that IT teams are pursuing to reduce capital costs while boosting asset utilization and employee productivity is the...
Seven Priorities for Integrated Network Management - How HP Intelligent Management Center Delivers an Enterprise-class Solution
This white paper describes the major requirements for network management solutions to help the organizations become more profitable, efficient and reliable.

Intel and the...
All Gov't Legislation/Regulation White Papers
Gov't Legislation/Regulation Webcasts
Delivery Management -- Extending Lifecycle Management
Date: Wednesday, June 20, 2012, 1:00 PM EDT

Siloed organizations continue doing the wrong things and doing things wrong, leading to increased costs,...
Leverage automation today to reduce IT complexity
Date: Tuesday, June 5, 2012, 2:00 PM EDT

Whether your B2B complexity is caused by multiple technologies due to M&A, business or application specific...
Redefine Expectations in the Data Center
Need to do more with less? Watch this video to learn how HP ProLiant Gen8 servers can help your business deploy servers three...
BMC Control-M - Single Point of Control Demo
With BMC Control-M, you schedule and manage everything - down to the very last platform and application - from one simple interface. It's...
Operational Analytics - Changing the Competitive Dynamics of the Business
Date/Time: June 5, 2012, 11:00 a.m., EDT, 4:00 p.m. BST / 3:00 p.m. UTC

Please join us for this webcast, as Dr. Barry...
All Gov't Legislation/Regulation Webcasts
Newsletter Sign-Up

Receive the latest news test, reviews and trends on your favorite technology topics

Choose a newsletter
  1. View all newsletters | Privacy Policy
IT Jobs