Race to Replace Randy 'Duke' Cunningham in San Diego Was Run on Hackable Diebold Voting Machines, Kept Unsecured at Poll Worker Houses Overnight Before the Election!
By Brad Friedman on 6/7/2006, 1:57pm PT  

To be clear, at this hour, we have no evidence to show that Democrat Francine Busby --- running in yesterday's special run-off election in San Diego against Republican Brian Bilbray to replace the disgraced Republican Randy "Duke" Cunningham for the U.S. House (CA-50) race --- actually won it.

Neither do we have evidence to believe that Bilbray actually won it.

We do, however, have copious and documented evidence to suggest there is no reason in the world to have any faith that Bilbray won the race.

The fact that the thin margin between the two at this hour (with "100% of the votes counted", according to the CA Sec. of State's website) is a mere 4,732 votes --- in a race where 125,882 votes were reportedly cast in a county with more than 355,000 voters registered --- is not even the largest question. Neither is the so-far unclear question of how the race will be affected by the 68,500 absentee and provisional ballots still to be counted in San Diego County according to the SD Registrar of Voters website at this hour.

The biggest concern about the race, by far, is that San Diego County uses two types of Diebold voting systems --- optical-scan and touch-screen --- both of which have not only proven to be disastrously unreliable in San Diego County and California in the past, but have also been demonstrated over the last six months to feature dozens of exceedingly well-documented and remarkable security vulnerabilities, making them extremely accessible to tampering. Especially if anyone has unsupervised physical access for more than a minute or two with them.

The voting machines used in Tuesday's election were sent home with volunteer poll workers the night before the election, according to the San Diego County Registrar of Voters office today. As well, The BRAD BLOG has received reports that in some cases, poll workers may have had the machines alone at their houses, unsupervised, for a week or even two prior to Tuesday's election....

Last February, California Sec. of State Bruce McPherson, himself, commissioned and released an independent security analysis [PDF] regarding just one aspect of both types of Diebold voting machines used in yesterday's San Diego race, after the memory cards used in those machines were found to have been extremely vulnerable to tampering. A mock election in Leon County, Florida last December revealed that tampering with the memory cards enabled the results of a mock election, run by Election Supervisor Ion Sancho, to be completely reversed.

McPherson's own report, completed by computer scientists at the University of California, looked at just that one aspect of the Diebold system's vulnerability --- the memory cards used to store vote totals and give other instructions to the voting machines --- and determined that "there is a serious flaw in the key management of the crypto code that otherwise should protect the AV-TSx from memory card attacks."

The report described a "number of security vulnerabilities" and found that the flaws on these systems could be exploited easily without the use of any passwords or cryptographic keys.

According to McPherson's report, "Anyone who has access to a memory card...and can tamper with it (i.e. modify its contents), and can have the modified cards used in a voting machine during election, can indeed modify the election results from that machine in a number of ways."

The tampering would be invisible, according to the report. "The fact that the results are incorrect cannot be detected except by a recount of the original paper ballots."

Beyond tampering with both of the Diebold AccuVote systems used in yesterday's election, McPherson's report continues to detail another family of "more serious vulnerabilities" that "go well beyond" the type of attack described above:

[T]here is another category of more serious vulnerabilities we discovered that go well beyond...and yet require no more access to the voting system [used in the attack described previously]. These vulnerabilities are consequences of bugs --- 16 in all --- in the implementation of the AccuBasic interpreter for the AV-OS. These bugs...would not be discovered by any amount of functionality testing; but they could allow an attacker to completely control the behavior of the AV-OS. An attacker could change vote totals, modify reports, change the names of candidates, change the races being voted on, or insert his own code into the running firmware of the machine."

Mind you, the vulnerabilities described so far in this article all came prior to a new, even more disturbing series of vulnerabilities discovered in March of this year in the same models of Diebold voting machines. The BRAD BLOG broke the original details of this latest revelation just days before the same systems were to be used in Pennsylvania's primary election two weeks ago. This even more alarming series of vulnerabilities have been found to reveal systematic flaws that go far and above the previously mentioned problems.

Following our report, scores of mainstream media outlets finally began to understand, and finally began to report on this incredibly serious security breach in our nation's electoral systems.

The New York Times quoted three different computer scientists and security experts who reviewed the newly revealed flaws in San Diego's touch-screen voting systems as "astounding" and "the most severe security flaw ever discovered in a voting system".

NEWSWEEK quoted Johns Hopkins computer sciences professor Avi Rubin a few days later as San Diego's machines thusly: "If Diebold had set out to build a system as insecure as they possibly could, this would be it."

Washington Post quoted yet another computer scientist this way just last week:

In California, David Jefferson, a computer scientist at Lawrence Livermore National Laboratory who consults with the state on its elections, said he was "stunned when he found out" about the vulnerability identified in the Utah test and agreed with the "frequently expressed opinion that this is the worst vulnerability that we have ever seen."

The inspector of the same Diebold AccuVote TSx machines for the state of Pennsylvania, Carnegie Mellon computer science professor Dr. Michael Shamos --- previously an ardent supporter of electronic voting --- said this about the machines used in San Diego yesterday:

"It's the most serious security breach that's ever been discovered in a voting system. On this one, the probability of success is extremely high because there's no residue.... Any kind of cursory inspection of the machine would not reveal it."

Shamos went on to say that the systems could have their entire set of election software, system software and even computer firmware ("BIOS") completely overwritten to do anything the malicious user wanted, in less than two minutes time, with physical access to the machines.

In an NPR report, Rubin described the machines used in yesterday's election this way:

"I believe that this is not only the most serious security problem that I've seen in a voting machine, but I can't think of a security problem that I've seen in any kind of system that is severe as this."

He added that all one needs to exploit the security hole is "a few seconds of physical access to the machines."

Well, guess what? Poll workers in San Diego County had much more than just "a few seconds of physical access to the machines" when they stored the voting machines at their own homes on the night prior to yesterday's election!

You read that correctly. The most vulnerable voting machines ever created and used in an American election were given to random, volunteer poll workers in San Diego to keep in their houses overnight to do with as they please. The systems were "guarded" by little more than a thin strip of plastic "tamper tape" over some, but not all, of each machines' dozens of vulnerable physical access points.

A spokesperson this morning from the San Diego Registrar of Voters office confirmed to The BRAD BLOG that "Yes, the machines were sent home with poll workers the night before the election."

Given the severe security vulnerabilities described above, and given that the number of votes recorded for the two "third-party" candidates alone (6,367 out of more than 355,000 registered voters in San Diego) could have easily swung the announced "victory" from Bilbray to Busby in one of the most important, expensive and closely-watched elections in the country --- an election regarded by both major political parties as well as political analysts and observers as an important bell-weather for the upcoming '06 general elections --- The BRAD BLOG finds no reason to have confidence in the California Secretary of State's announced results in the race.

Who actually won it? Busby or Bilbray? We cannot tell you. Neither can the California state or San Diego County election officials. Even with a full, manual hand-count of all the paper ballots used with the optical-scan systems, and a full, manual hand-count of the so-called "paper trails" created by the touch-screen machines, there will still be questions about the accuracy of the results.

As we documented in an exclusive photo-essay of Diebold's AccuVote TSx machine after a security analysis by the non-partisan e-voting watchdog group BlackBoxVoting.org in March, the printer for the so-called "voter verified paper trail" on the TSx machines is installed behind a plastic door that may be closed by the voter --- or a poll worker --- thus obscuring the printed results and disallowing the voter from confirming that the printed "paper trail" accurately reflects their intended vote.

Therefore, depending on the number of votes cast on the Diebold touch-screen system's so-called "voter verified paper trail" printer there is no way to know if the results are valid.

If state, county or Diebold officials tell you otherwise, if they say that they can prove with certainty which of the two candidates actually won yesterday without a full, manual hand-recount of all paper ballots and paper "trails", they are lying. Plain and simple. They cannot do so.

A complete, manual hand-count of all such paper ballots and "paper trail" records is the only way to know for certain. And then, only if the number of votes cast on the touch-screen systems is smaller than the number of votes separating the two candidates after all of the optical-scan paper ballots have been counted manually. If the margin separating the two after the op-scan ballots are counted is smaller than the number of votes cast on the touch-screens, there is no way of knowing who the winner of the race truly is.

That is all thanks to Diebold's purposely horrendous design of both the hardware and software used in these machines, and Sec. of State Bruce McPherson's willingness to certify the machines for use anyway in this state even after the results of his own report confirmed the vulnerabilities described.

Ultimately, this is precisely what is wrong with using electronic voting machines of these types, tested in secret (barely), by testing labs which are selected and paid for by the voting machines vendors themselves, which employ secret software to both record and count the votes, as written and run by those same private companies for use in our public elections.

As long as our public officials continue to defy the will and best interests of the citizenry and our democracy by allowing private, partisan --- and even foreign-run --- companies who are accountable to no one, to hijack our electoral system, American democracy will be lost. Period.

The Busby campaign has already issued a concession, and we have so far been unable to reach anyone who can speak for the campaign to comment on this matter. A concession, however, is just a nicety with no official meaning. Busby should not concede anything until all of the ballots and "paper trails" in the race are counted by hand in the 50th district.

Yesterday, Lou Dobbs reported on CNN that, "The security of our elections and the integrity of our democracy is in jeopardy."

The day before he told CNN viewers that elections officials have "no concept" of "whether or not they can assure us that this election in mid-terms in nearly every state is accurate and verifiable."

The conservative Dobbs, certainly no "moonbat leftie" or "sour grapes conspiracy theorist", described the electoral crisis we are now facing in this country as an "outright threat to our democracy, to the integrity of our voting system, and to our elections process."

He's exactly right. And the integrity of that system has been violated nearly beyond repair as exemplified by last night's important election in San Diego.

Here we go again? You betcha. Is this what we want in our American elections? Questions about the validity of every single race from here on out? Because that is precisely where we are now at.

So now who is going to do anything about it?

UPDATE 6/8/06: Followup/update now here...

UPDATE: 6/8/06 PM: SD County Poll workers write in about voting machine sleepovers...

UPDATE: 6/9/06: New numbers reported from San Diego county...