State gives flawed machines vote of confidence

By Tom Elias
Daily Breeze, February 23, 2006

You can call it capitulation to local election officials likely to be called on the carpet if it turned out they had wasted tens of millions of dollars. You can call it practicality, assuring that California counties can put the most modern election equipment into use this year.

But the undeniable fact is that millions of voters in as many as 21 counties will be voting this year on machines that can be hacked to alter election results. This became certain when Secretary of State Bruce McPherson the other day conditionally certified the newest machines made by Diebold Election Systems Inc. for use in this year's elections, starting with several local votes in the early spring.

Although an evaluation by University of California, Berkeley computer experts concluded that hackers can easily change election results on them, thousands of Diebold machines will be in place for the June primary.

McPherson said in December he would not certify Diebold machines until a test was done by an independent federal laboratory, but moved up his timetable when the lab delayed. He then sought help from Berkeley computer scientists, and their 38-page report came in on Valentine's Day.

"We found a number of security vulnerabilities," said that study, whose authors include some of America's most determined critics of electronic voting. "We determined that anyone who has access to a memory card ... and can (modify its contents) ... can indeed modify the election results from that machine in a number of ways."

But the Berkeley report also gave McPherson an out. It recommended "strong control over access to memory cards," adding that "It would be safest if (the Diebold optical scan machine) is not widely used until these bugs are fixed."

Now it is certain that the machines will get wide use starting with an April special election in San Diego County to replace Republican Rep. Duke Cunningham. Because of the certification, Diebold machines will likely also be in use by June in Alameda, Marin, Butte, El Dorado and a dozen other counties, including Los Angeles.

County election officials greeted McPherson's move with joy. In many counties, they've spent tens of millions of dollars on Diebold machines, starting as early as 2003.

McPherson's certification order set unique conditions for use of Diebold machines, including one requiring counties to maintain written logs of the chain of custody of each memory card and another demanding the presence of two election officials every time a memory card is zeroed out and put back into renewed use.

Also, once programmed for an election, memory cards must be immediately inserted into machines beneath a serialized "tamper-evident" seal whose serial number will be logged onto a separate tracking sheet.

The Berkeley panel suggested these two tactics, among others it said would mitigate the security risks it found.

"We're confident we've gone above and beyond the call of duty to test this, above and beyond what other evaluations would have revealed," said McPherson spokeswoman Jennifer Kerns. But McPherson provided neither detail on how the new rules might be enforced nor a guarantee they will be enforced at all by the state. Of course, rules are worthless without strong enforcement.

Meanwhile, South Bay state Sen. Debra Bowen, now seeking the Democratic nomination to oppose McPherson next fall, called the certification premature . "He's basing his decision on a supposedly independent state audit that no one else saw before the certification order," she said. "There's a March 1 public hearing for four other voting machine vendors before their machines can be certified for use in California, so what was the rush to certify Diebold and side-step a public hearing on this issue?"

All this could create greater than ever demand for absentee paper ballots and cause unprecedented slowdowns in vote-counting. It might also spur many thousands of voters to stay away from the polls altogether, feeling that with questionable machines, there's no guarantee their votes will be counted accurately.