Can someone please explain in English

[EFerrari]

how tabulators are vulnerable-- the kind that are used with Opti-Scan systems?

Because that's what I have to explain to a media contact.

[Amaryllis]

1. Op scans are vulnerable too! Not just tabulators. What you need to know

is what kind of opscans and tabulators you use; I'm sure some of the other CA folks know that already. Which county are you in? Are they using Diebold?

[TomInTib]

2. Damn, E, I don't know anything about it but I sure do admire your..

persistence on so many fronts.

[EFerrari]

3. We persist, Tom. That is what we do.

:hi:

[TomInTib]

8. When the Ship Comes In....

We will watch from the Pier...

Oh the time will come up
When the winds will stop
And the breeze will cease to be breathin'.
Like the stillness in the wind
'Fore the hurricane begins,
The hour when the ship comes in.

Oh the seas will split
And the ship will hit
And the sands on the shoreline will be shaking.
Then the tide will sound
And the wind will pound
And the morning will be breaking.

Oh the fishes will laugh
As they swim out of the path
And the seagulls they'll be smiling.
And the rocks on the sand
Will proudly stand,
The hour that the ship comes in.

And the words that are used
For to get the ship confused
Will not be understood as they're spoken.
For the chains of the sea
Will have busted in the night
And will be buried at the bottom of the ocean.

A song will lift
As the mainsail shifts
And the boat drifts on to the shoreline.
And the sun will respect
Every face on the deck,
The hour that the ship comes in.

Then the sands will roll
Out a carpet of gold
For your weary toes to be a-touchin'.
And the ship's wise men
Will remind you once again
That the whole wide world is watchin'.

Oh the foes will rise
With the sleep still in their eyes
And they'll jerk from their beds and think they're dreamin'.
But they'll pinch themselves and squeal
And know that it's for real,
The hour when the ship comes in.

Then they'll raise their hands,
Sayin' we'll meet all your demands,
But we'll shout from the bow your days are numbered.
And like Pharaoh's tribe,
They'll be drownded in the tide,
And like Goliath, they'll be conquered.



Copyright © 1963; renewed 1991 Special Rider Music

Thanks to Robert Zimmerman

[chalky]

4. Found this link with an excerpt from BBV explaining a way to manipulate

tabulators:

Black Box Voting has discovered a backdoor in the Diebold vote tabulators:


Manipulation technique found in the Diebold central tabulator -- 1,000 of these systems are in place, and they count up to two million votes at a time.

By entering a 2-digit code in a hidden location, a second set of votes is created. This set of votes can be changed, so that it no longer matches the correct votes. The voting system will then read the totals from the bogus vote set. It takes only seconds to change the votes, and to date not a single location in the U.S. has implemented security measures to fully mitigate the risks.

...The GEMS central tabulator program is incorrectly designed and highly vulnerable to fraud. Election results can be changed in a matter of seconds. Part of the program we examined appears to be designed with election tampering in mind.

http://www.zetetics.com/mac/blog/00000466.html

There's a link in the blog back to the original BBV post. Hope that helps.

[EFerrari]

5. Thank you, chalky. So, it's the software that makes

tabulators vulnerable?

I know it's unfair to ask for this kind of over simplification, and I am.

[chalky]

9. LOL! I'm not the one to ask, really. But it would seem that it IS the

software.

Also, check out the entries on this BBV forum page on the tabulators:
http://www.bbvforums.org/forums/messages/2197/10519.html?1140499169

Looks like there are other security issues.

[roseBudd]

17. Yes it is the programming, if such and such happens then such and such

will be the result. It's called an if then statement.

Literally it could be if Bush goes below 51% then every fifth Kerry vote will be assigned to the Bush column.

And you would not see this happening.

[dweller]

6. contact Autorank

with a pm, or wait a bit to see if the info comes in here.

dp, edit: i was walking the avatar.

[EFerrari]

7. lol!

I have to remember that one, dyslexic as I am. :)

[nicknameless]

10. San Francisco uses ES&S opti-scans

Specifically: ES&S IV-C (for absentee ballots) & ES&S Optech Eagle III-P (at Polling Places)

The specific systems used in CA are listed at the link below under "Voting Systems Used by Counties"
http://www.ss.ca.gov/elections/elections_vs.htm

(The list comes up as a .pdf file)

[nicknameless]

13. Here’s an ES&S tabulator “glitch” story:

http://brilliantatbreakfast.blogspot.com/2005/06/putting-too-much-stock-in-2006.html

Excerpt:

... The vendor for Broward is ES&S. Part of the problem was that the ES&S tabulator model used for absentees in Broward could not breach its limit of 32,000 votes without generating a massive numerical error, a newly discovered "counting-backward glitch" (that affected also some North Carolina counties and God knows where else, and that ES&S now has to fix and reprogram for future elections).

[nicknameless]

14. ES&S "Vulnerabilities"

http://www.whoscounting.net/TheCompanies.htm#ES&S

In 2000, Washington DC journalist Christopher Bollyn, was working on a piece entitled, “The Death of Democracy”, investigating two-way computer modems found in electronic voting machines. Bollyn had learned that the ES&S vote counting equipment, or tabulators – “Precinct Ballot Counters 2100” (PBC’s) - could be communicated with while the counting was underway by anyone with a modem-equipped computer. He also discovered that the PBC is run by a pre-programmed 512-K memory card that essentially “tells the tabulator what to do.”

Oddly, the programmed memory cards used in ES&S Tabulators are not supplied by IBM or Panasonic, but instead by the small firm of a Russian immigrant - Alex Kantarovich. His company is called Vikant. From the Vikant site, we see that this modest Illinois Company, founded in 1996, has only 3 employees. Again, ES&S was responsible for 61 million Americans’ votes.

<snip>

ES&S former Vice President, Steve Bolton, told the Wireless News in January, 2002, “The iVotronic system uses CDMA (code division multiple access) and CDPD (cellular digital packet data) wireless technology to send the tabulations from ballots to an elections board or central election site.” Thus we have tabulations sent wireless...

The ES&S tabulators’ internal modems are manufactured by Novatel Wireless, a California company related to Novatel, Inc., a Canadian satellite communications company. A spokesman for Novatel Wireless, told Bollyn that the tabulators run the risk of being hacked into “anytime they’re plugged in”....if the hacker knows the computers IP address. When asked who owned Novatel, the spokesman replied, “I have no idea.”

<snip>

(ES&S iVotronic is a DRE, but apparently ALL ES&S machines have internal modems for data transfer)

http://www.voxpolitics.com/weblog/archives/000186.html

Whether it was the Precinct Ballot Counter 2100 (PBC), the Optech Eagle III, the Model 100 Optic Mark Reader (OMR), or the Votronic touch-screen system that counted your vote, these machines have something in common: they are all designed and operated by Elections Systems & Software, Inc. (ES&S). Each contains a two-way modem, allowing them to communicate—and be communicated with—while they are in operation.

What is particularly troubling about these machines is the fact that they contain an internal modem, which enables anyone with a modem-equipped computer, from hackers and vendors to telephone company personnel and politicians, to access and alter the computer's tally of the votes.

[FogerRox]

22. The Ivotronic is networked. In normal operations

the Ivotronic's I saw in Broward County FL-- on the 1st day of early voting '04 -- did not work untill connected to the main frame--- tabulator. SO voting didnt start untill about 11am.

The Sequoia Edge & Advantage DREs also use an internal modem to talk to the Sequoia tabulators-- which are PC based-- using Windows.

The Diebold TSX has a wireless port-- & IIRC an internal modem - since the TSX is most likely a 1st cousin of the ES&S Ivotronic, the TSX very likely has a modem.

A Good portion of Optical scanners are used with precinct based tabulation-- This means that a tabulator is at each polling place-- the precinct level results are tallied by the tabulator and the tallies are transmitted over a modem to a state level tabulator.

[nicknameless]

15. And don't forget those famous 18,181 vote tallies. Chip problems?

These may involve scanner issues rather than tabulator issues. (??) But they're ES&S too.
(I'm assuming that your contact person is mainly interested in machines used locally.)

http://www.opednews.com/hartmann_theft_of_your_vote_just_a_chip.htm

The Theft of Your Vote Is Just a Chip Away
By Thom Hartmann opednews.com

Are computerized voting machines a wide-open back door to massive voting fraud? The discussion has moved from the Internet to CNN, to UK newspapers, and the pages of The New York Times. People are cautiously beginning to connect the dots, and the picture that seems to be emerging is troubling.

"A defective computer chip in the county's optical scanner misread ballots Tuesday night and incorrectly tallied a landslide victory for Republicans," announced the Associated Press in a story on Nov. 7, just a few days after the 2002 election. The story added, "Democrats actually won by wide margins."

Republicans would have carried the day had not poll workers become suspicious when the computerized vote-reading machines said the Republican candidate was trouncing his incumbent Democratic opponent in the race for County Commissioner. The poll workers were close enough to the electorate – they were part of the electorate – to know their county overwhelmingly favored the Democratic incumbent.

A quick hand recount of the optical-scan ballots showed that the Democrat had indeed won, even though the computerized ballot-scanning machine kept giving the race to the Republican. The poll workers brought the discrepancy to the attention of the County Clerk, who notified the voting machine company.

"A new computer chip was flown to Snyder (Texas) from Dallas," County Clerk Lindsey told the Associated Press. With the new chip installed, the computer then verified that the Democrat had won the election.

In another Texas anomaly, Republican state Senator Jeff Wentworth won his race with exactly 18,181 votes, Republican Carter Casteel won her state House seat with exactly 18,181 votes, and conservative Judge Danny Scheel won his seat with exactly 18,181 votes – all in Comal County. Apparently, however, no poll workers in Comal County thought to ask for a new chip.

<snip>

[roseBudd]

18. This is called firmware hacking I believe. The faulty chip wasn't

innocently defective it was executing malicous code.

[EFerrari]

21. How many people had to handle those numbers and NOT

notice that they were identical?

It's mind blowing, isn't it?

[autorank]

11. Hey buddy

Here's a good summary from Brad Friedman with some links.
http://www.bradblog.com/archives/00002156.htm

Basically,

1) They're computers, not just "calculators"
2) They rely on memory packs which can be removed from the machines and carried around like a CD or sandwich.
3) They can be programmed to show "zero" votes but have "plus 2000" for one candidate and "minus 2000 for another...so the plus candidate starts at 2001 and the minus candidate has to get 2000 votes to get to zero...
4) Nobody gets to examine anything because the vendors have "no test" in many cases, and "no examine" in all cases" written into contracts with our elections officials. We've outsourced the elections to Diebold, SAIC, and the pride of Venezueala, Smartmatic, which now owns Sequoia Voting Systems.
5) The damn things can be hacked by any employee of "visitor' (and you know how I love "visitors";) with access to the elections building.

Rock 'em.

[EFerrari]

19. That's exactly what I needed!

Thank you, autorank! :toast:

[autorank]

26. Welcome!

Give 'em Hell expat! Or just tell them the truth and they'll think you're giving them Hell;)

:yourock:

[Amaryllis]

27. OR they can be programmed to flip vote totals...there is NO WAY

to know if what comes from the vendors is rigged or not, and there are dozens and dozens of ways to rig them.

[Amaryllis]

32. No way to know as long as the software is proprietary and no one can

check it! Black box vote counting.

[eomer]

12. Other vulnerabilities

1. Each machine is calibrated individually for sensitivity level. Either incompetence or intentional manipulation can cause accuracy of counting to be drastically different from one machine to another.
   
2. Type of pen or pencil used to mark ballot can also cause differences in likelihood that a ballot will be counted. Incompetence or intentional manipulation can cause differences in accuracy of the count from one polling place to another.
   
3. Insufficient instructions on how to mark a ballot can make it unlikely the ballot will be counted. For example, a single line drawn with a ballpoint pen is not likely to be read correctly by the scanner.
   
4. It is easy to add a mark to a ballot, either before or after it is voted, that would turn the ballot into an overvote and make it not count.

I got the above from an article about Doug Jones' review of the 2004 election in Arizona:
http://votetrustusa.org/index.php?option=com_content&task=view&id=750&Itemid=113

[EFerrari]

20. I didn't know there was so much variation from machine to machne.

Thanks for the link!

[roseBudd]

16. The computers count the votes so NO ONE can see, they say Bush won

I say prove it to me

The assumption is a paper trail be it punch cards or opscan reduces the temptation to cheat but the odds of being caught are so low that it still would be tempting to anyone who wanted to throw an election. One programmer could throw an election and fraudulent tabulationt could be triggered by a time, a precentage, a ballot with an improbable preplanned series of votes.

[Amaryllis]

23. Go here and scroll down to "mess-ups by vendor" and click on ES&S.

http://www.votersunite.org/info.asp
And the way this relates to McP, for your local hook, is to make him aware that all the vendors use basically the same technology, so doesn't matter if it's Diebold or not. Diebold is just coming under a lot of scrutiny right now. The other thing is Guv's argument, which is the bottom line: we have no basis for confidence as long as our votes are being counted in secret, and Land Shark's frame: secret vote counting is illegal. As long as we are using trade secret software, we have no way of knowign that the results are accurate. We are taking it on faith (see Land Shark's recent thread on trust in elections) and we need to have our elections based on checks and balances, not faith and trust. End faith based elections!

[Wilms]

24. What more do you want?

In the last year or so, three ES&S OpScanned elections were overturned after hand-counts confirmed Ballot Definition Settings had thrown them.

[EFerrari]

25. Geezus. I am afraid to ask..

I think the information on this thread alone will make any reasonable person's head explode.

/g->e

[nicknameless]

37. I Googled "Ballot Definition Settings", "Definition Settings" + ballots ..

and only got Democratic Undergound hits.

I couldn't find the stories you were referring to anywhere.
We wonder why there isn't more outrage, maybe it's because the information is being buried.

Do you have any links to the news out of Indiana or Cumberland City, PA?
I only know that the issue of "ballot definition settings" involved those places because you posted about it on another thread.

[JimDandy]

38. Recounts attributed to ballot definition errors

If you Google "recount" + "ballot definitions" or "recount" + "ballot definition" you'll find info about those recounts that were definitely caused by ballot definitions errors. Page six of Ballot Definitions Files, a report prepared by Voters Unite, lists many of these recounts including this one:

"September 2002. Union County, Florida. A programming error caused ES&S Model 100 machines to
read 2,642 Democratic and Republican votes as entirely Republican in the September 2002 election.
The ballot program in the memory packs read the ballots incorrectly. The vendor, ES&S, accepted
responsibility for the programming error and paid for a hand recount."

http://www.votersunite.org/info/BallotProgramming.pdf

JD

[nicknameless]

40. THANKS!

What a difference -- plenty of hits!

[Wilms]

41. Looks like your set, but let me know. n/t

[kster]

28. Great thread

We need more of these threads. Good job (KIS) Keep it simple.

[nicknameless]

29. An aside: the Berkeley study didn't cover the GEMS tabulator.

Excerpt from page 6:

Our study does not constitute a comprehensive code review of the entire Diebold codebase. We had access to the full codebases for the AV-OS and AV-TSx, but we did not even attempt a comprehensive review of the entire codebase. Our attention was focused fairly narrowly on Diebold’s proprietary AccuBasic scripting language, the compiler for that language, the interpreter for its object code, the AccuBasic scripts themselves, and the related protocols and procedures, both for the AV-OS (optical scan) and AV-TSx (touchscreen) voting systems.

In particular, we did not have the source code for the Diebold GEMS election management system, and our security evaluation does not cover GEMS at all. It is widely acknowledged that a malicious person with unsupervised access to GEMS, even without knowing the passwords, can compromise GEMS and the election it controls. This report does not address those threats, however.

Our analysis was based only on reading the source code we were given. We did not have access to a real running system (although we were able to compile and execute modified versions of the compiler and interpreter on a PC). Nor did we have any manuals or other documentation beyond that present in the comments in the code itself. We had access to the source code for a period of approximately four weeks for this review.

[EFerrari]

30. So it is possible to use the study, which McDiebold cites to justify

recertification, to discredit his "decision" . . .

[nicknameless]

34. I would think so.

That re-certification was outrageously unjustifiable, not to mention illegal.

[Amaryllis]

31. Chruck Herrin on hacking op scans:

Hacking Optical Scan Machines:

I can think of a pretty simple way to do it - if it is known that the test run will be, say, 100 ballots, set the software to flip every x vote (5th, 10th, 100th) a certain way after the number exceeds 200 or 300 or 1000. Vendors know the procedures, y'all. There's nothing magical about optical scanners - it's just software, too.

This is similar to a gas pump exploit used by the Mafia in Texas a while back. They knew that the accuracy testing for gas pumps was performed by taking a container measuring exactly 8 gallons from station to station and filling it up to exactly 8 gallons, then checking the gauge. They set the pump software to be right for the first 8 gallons, then started padding the price for gas pumped above that. They only got caught when somebody driving an RV noticed that the numbers didn't add up to what they should have - sort of a "gas pump exit poll".

http://chuckherrin.com/sinceyouasked.htm

[nicknameless]

33. What happened to him? No updates to his website in a long time.

Seems worrisome, given who he was opposing. :shrug:

[Amaryllis]

35. Home page has entry dated 2/26.

[nicknameless]

36. THANKS! I had checked recently, but hadn't noticed anything new.

Great to see that he's still posting. :)

[JimDandy]

39. Glad to see he's still going.

I had also checked his site for months without seeing anything new. I stopped checking a couple months ago, though.

JD

[Ellipsis]

42. Access and opportunity make it vulnerable.

Most often, we are talking about older personal computers built from standardized components with common ports and sockets. A motivated experienced tech/programmer could manipulate the CPU or the software that runs on the machine.

Even custom built tabulators would rely on “off the shelf components” and ISO standard ports.

Memory cards while just another “storage volume” handle file deletion differently. On standard volumes (hard drives etc.) deleting the file causes only the “the table of contents" of the file location to be erased. The tiny 1’s and o’s, the contents of file, lives. Memory cards handle erasure differently. It leaves no remnant.

[garybeck]

43. just show them the video of Howard Dean and BH hacking the tabulator

a video is worth a thousand words.

it is on the CD-ROM.

give them a copy of the CD-ROM because there's a lot more on there they should check out!

[Amaryllis]

44. And while they're watching that, there is a segment of Kevin Shelley

on the same clip talking about the changes he made in CA to protect the vote, and it could be pointed out that McP undid a lot of Shelley's directives.