Review finds potential flaws in voting systems

July 30, 2007

Flaws that leave electronic voting machines vulnerable to security attacks were discovered by University of California researchers as part of an unprecedented "Top-to-Bottom Review" of the systems commissioned by California Secretary of State Debra Bowen.

The review, begun May 31, was designed to restore the public's confidence in the integrity of the electoral process and to ensure that California voters are being asked to cast their ballots on machines that are secure, accurate, reliable and accessible. Bowen released key findings of the "Red Team" part of the review on July 27. Other sections of the review dealing with source code, voting system documentation and accessibility are to be made public later.

The red teams were able to compromise the physical and software security of all three systems tested. The researchers noted, however, that protecting the security of the voting process entails more than ensuring the security of the voting machines.

"Our task was to analyze the machines, but those machines are just one piece of what makes an election secure," said Matt Bishop, professor of computer science at UC Davis, who led the Red Team review. "In my 30 years in this field, I've never seen a system that was perfectly secure, but proper policies and procedures can substantially improve the security of systems. Paper ballots aren't perfect, either, but we've been working with them longer so we know more about how to control the weaknesses in a paper-based system."

Bishop will testify today, Monday, July 30, at a public hearing on the review at the Secretary of State's office in Sacramento.

The three electronic voting systems examined were made by Diebold Elections Systems, Sequoia Voting Systems and Hart InterCivic, respectively. The voting systems are used in 43 of the 58 counties in California by 9 million of the state's 15.7 million registered voters.

The researchers said that many of the security problems they encountered were fairly similar across the three systems.

"The problem with the systems should have been detected early in their development," said Bishop. "There are ways to develop and implement systems that resist compromise much better than the systems we examined. Many of these safeguards are taught in undergraduate and graduate computer security courses, but it was clear they were not used effectively in the electronic voting systems we evaluated."

The Red Team testers were able to bypass the machines' tamper-resistant seals and locks, physically gaining access to the memory cards that store the votes. Such a vulnerability could potentially be exploited on Election Day, the researchers said.

"In many cases, this could be done in less than a minute, and in a way that would not necessarily be noticed by poll workers, particularly if there are privacy shields and curtains blocking their view of the voter," said Bishop.

Once inside the machine, the researchers noted that an individual could then switch out the memory cards. Such a breach might be detected if procedures are in place to compare the memory cards with the votes stored in the machine's internal memory and with the paper trail that is required in California, the researchers said.

While the Red Team benefited from the work by the source code team, led by David Wagner, associate professor of computer science at UC Berkeley, the researchers emphasized that knowledge of a voting system's source code, while helpful, is not critical to breaking down its security barriers.

"Keeping the source code and other system information secret provides a false sense of security for the systems," said Bishop. "We really only had five weeks to try to penetrate the machines' defenses, but people intent on breaking through the security would spend as much time as necessary to find holes to exploit."

The review also notes that all systems are vulnerable to tampering by people who have access to the machines when votes are tabulated. However, this requires a high level of access, and most counties have careful controls over the people who have access to voting equipment.

Another problem is the potential for the sabotage of machines before an election. Technical glitches in electronic voting machines can take hours to fix, leading to long lines and potentially disenfranchised voters who might be unable to wait, the researchers said.

The 42 members of the UC Davis and UC Berkeley research teams included internationally recognized experts in computer science, computer security, electronic voting, law and public policy. Team members included faculty, post-doctoral scholars, graduate students, and other experts from UC Santa Barbara, Princeton University and other universities, as well as experts from industry, including Consilium, LLC.

Other components of the project include a review of electronic voting system documentation to determine whether those materials are complete and consistent, and an evaluation of system accessibility for voters with disabilities and with special language requirements. The entire report is available online at www.sos.ca.gov/elections/elections_vsr.htm>.

Source: University of California - Davis

Explore further: N. Korea triggers fresh outrage with space rocket launch

Related Stories

Roberts sold more than $250,000 in Microsoft stock

February 4, 2016

The Supreme Court's recent decision to step into a relatively unimportant case involving Microsoft's Xbox 360 gaming system revealed that Chief Justice John Roberts has sold between $250,000 and $500,000 in Microsoft stock ...

Why too much evidence can be a bad thing

January 4, 2016

(Phys.org)—Under ancient Jewish law, if a suspect on trial was unanimously found guilty by all judges, then the suspect was acquitted. This reasoning sounds counterintuitive, but the legislators of the time had noticed ...

Congress passes long-stalled cybersecurity bill

December 18, 2015

Congress on Friday passed legislation to fight cyber threats, pushing the measure through by tucking it into a sprawling government funding bill, after earlier failed attempts.

Long-stalled cybersecurity bill poised for US approval

December 18, 2015

Legislation designed to fight cyber threats appeared poised for congressional passage following several failed attempts, with the White House on track to prevail despite objections from privacy activists.

Recommended for you

Record for fastest data rate set

February 11, 2016

A new record for the fastest ever data rate for digital information has been set by UCL researchers in the Optical Networks Group. They achieved a rate of 1.125 Tb/s as part of research on the capacity limits of optical transmission ...

Math reveals unseen worlds of Star Wars

February 10, 2016

Using a new computer program, EPFL researchers offer unusual insight into the universe of Star Wars, which includes more than 20,000 characters spread among 640 communities over a period of 36,000 years.

Twitter lets hot tweets rise to top of timelines

February 10, 2016

Twitter revamped its timeline Wednesday, allowing the "best" tweets to rise to the top, despite warnings of a revolt from members loyal to the real-time flow of the messaging platform.

Tiny diatoms boast enormous strength

February 8, 2016

Diatoms are single-celled algae organisms, around 30 to 100 millionths of a meter in diameter, that are ubiquitous throughout the oceans. These creatures are encased within a hard shell shaped like a wide, flattened cylinder—like ...

0 comments

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.