Diebold source code leaked again

IDG News Service - Source code to Diebold Election Systems Inc. voting machines has been leaked once again.

On Wednesday, former Maryland state legislator Cheryl C. Kagan was anonymously given disks containing source code to Diebold's BallotStation and GEMS (Global Election Management System) tabulation software used in the 2004 elections. Kagan, a well-known critic of electronic voting, is executive director of the Carl M. Freeman Foundation, a philanthropic organization based in Olney, Md.

The disks were created and distributed by two federal voting machine testing labs run by Ciber Inc. and Wyle Laboratories Inc. They had been testing systems on behalf of the state of Maryland, Diebold said in a statement.

This is not the first time that Diebold source code has been leaked. In early 2003, Diebold critic Bev Harris uncovered similar source code while conducting research using Google Inc.'s search engine.

Soon after, researchers at Johns Hopkins University and Rice University published a damning critique of Diebold's products, based on an analysis of the software.

They found, for example, that it would be easy to program a counterfeit voting card to work with the machines and then use it to cast multiple votes inside the voting booth.

Diebold says it has since introduced security enhancements to its products, but the fact that the company's sensitive source code has again leaked out is not a good sign, according to Avi Rubin, a computer science professor with Johns Hopkins and one of the authors of the 2003 report.

The first leak should have taught Diebold a lesson on securing its source code, he said. "You would think that given the amount of embarrassment that caused them, they would do a better job of protecting it."

Rubin, who was shown the latest source code by a reporter at The Washington Post, said that it appeared to be "just another version" of the code that was published in 2003.

The disks came with a letter that was highly critical of Maryland State Administrator of Elections Linda Lamone, Rubin said on his blog. "It read like it was from somebody with a very, very serious axe to grind," he said. "It was one of the more outlandish things I've read."

Rubin believes the disks were given to Kagan because of her past criticism of electronic voting machines. "I guess whoever did this knew she would pursue it doggedly, which she did."

Diebold said the source code was for BallotStation 4.3.15C, which is no longer being used in the U.S., and for GEMS 1.18.19, which is being used in a "limited number of jurisdictions."

The FBI is investigating the leak, Diebold said.