Blogged by John Gideon and Brad Friedman
The results of California Secretary of State Debra Bowen's "top-to-bottom review" of electronic voting systems previously approved for use by her predecessor is still underway. But before any of the findings from her teams of security specialists, software analysts and voting systems experts have been made public, the unprecedented analysis has already revealed a disturbing anomaly which may have far-reaching implications for both state and federal voting systems laws across the country.
As The BRAD BLOG reported exclusively almost three weeks ago --- precisely zero media outlets bothered to file their own reports on this matter until last weekend --- all voting machine vendors certified in California had submitted their source code to Bowen for the review, except for ES&S, America's largest voting machine company.
After their refusal to submit the code as required for the test, Bowen demanded the source code used for the InkaVote Plus voting systems marketed by ES&S, and used exclusively in Los Angeles, be released to the state by the escrow firm which had been holding it as per state law.
Following Bowen's demand to the escrow company, Iron Mountain Intellectual Property Management, ES&S reluctantly agreed to give their own version of the source code to the state.
Oddly enough at the time, the voting machine company, in an arrogant letter to Bowen (posted here in full by The BRAD BLOG), demanded that she withdraw her request to receive the version of the source code already stored in escrow at Iron Mountain. The letter succeeded in keeping our already-raised eyebrows at full perk, as the demand that Bowen not review the code in escrow, but rather look only at the one ES&S was sending, raised several troubling questions. Among them, we wondered at the time if perhaps the version stored in escrow was not the version actually used on the county's voting systems during last year's election. If so, there could be enormous ramifications for the company, and for the idea of escrowed source code for voting systems in general.
Over the weekend, an article in the Los Angeles Daily News, the first organization to jump into this matter following our series of reports, filed a story on the matter which began to validate our suspicions. The paper reported that due to the late submission, the InkaVote Plus system would not be included in Bowen's "top-to-bottom review", presenting questions about which voting system would be allowed for use in 2008, in the country's most populous county. LA County is larger than many states in America.
It's as yet unclear whether Bowen will completely decertify the InkaVote Plus system for use, or whether she will take other steps.
Perhaps more disturbingly, however, the Daily News report includes comments from CA's Deputy SoS for Voting Systems, Lowell Finley, indicating that our concerns about differences in the submitted and escrowed source code may have been precisely on target.
We contacted Bowen's office for more details, and they shared with us the letter sent from Finley back to ES&S in response to the company's curious demands. The letter is posted in full at the end of this article. And if the issue Finley raises is indeed true, there may be a whole lotta trouble ahead...