Can you hear the headlines in the distance? “Hack Yes He Won!” “A Vote in the Hand Worth A Thousand in the Mouse” “Hacktrix: Revolutions” “Your Vote Might Not Matter, But Your PC’s Does” Ok, admittedly the last is a bit too long for most banners, but there will be plenty of time to think of better ones.

In 2002 Congress passed the Help America Vote Act, a pet project of President Bush. In theory, the bill is supposed to assist the electoral process by making voting easier and by preventing what happened in Florida during the last Presidential election. In practice, it achieves the opposite.

For one thing, in an attempt to cleanse the voter rolls, it has eliminated easy-registration services like the ones that once existed at the Department of Motor Vehicles. It requires the use of name-checking as applied in Florida during the last election. For those unfamiliar, Florida paid $1 million to a private Company, Database Technologies, to get a list of convicted felons throughout the country (who are not allowed to vote in Florida). The list was shoddy at best – names and dates were wrong, with some people’s convictions coming as late as 2007. A Harvard University study estimated 95% of the names given were erroneous.

Worse, the application of the list was laughable. If you shared a birthday with one of these “felons” and had a similar name, you were disenfranchised. In some cases, a matching name alone was enough (I don’t know about you, but in Baltimore where I grew up, there were at least two other people that shared my name, one with the same middle initial. This almost resulted in a dreadful dental visit.). Tens of thousands of legitimate voters were barred from the polls. Interestingly, most of the disenfranchised were from demographics that have historically voted Democratic. For example, 54% of the names given were of African Americans, who have voted 80% Democrat in the Sunshine State. The removal of people from the voter rolls is now going to happen in a similar way throughout the country.

Another controversial development is the requirement of each state to computerize and centralize all voter information. In large part this is being done through the installation of touch-screen voting machines, usually made by one of three companies: Deibold, ES&S (Election Systems and Software), or Sequoia. These machines have – well, let’s be nice – more holes than Swiss cheese. The heat on them right now is immense.

To begin with they are extremely fraud friendly, as Bev Harris, an election activist, has uncovered. For instance, let’s look at Diebold (only because they were foolish enough to leak many revealing internal memos). In each Diebold machine there are three ledgers of votes. The first database is the actual votes. Why a second one should exist is a bit of a conundrum, but it sure does open up some interesting doors.

While the first database is accurate, it is not the one that is seen by the Election Supervisor. Only a compilation of all the secondary databases will ever be seen by an election monitor, whether it is county-wide or precinct-wide. And here comes the tricky part: Diebold’s voting software, GEMS, (which was, erroneously, a free download from a Diebold ftp site, along with system manuals, codes, the works) allows you to run Microsoft Access, get into the second database and change the numbers. As much as you want (though it is best to add and subtract equal numbers, so the voter total doesn’t stray from fact). Anyone on the ground at an individual district can be sent the votes from the first database and recognize it as true (even holding up against a paper check). Anyone involved with compiling numbers will see the second database, which can be as false as any single person.

Oh yes, of course, when running the GEMS software on your home PC you do need to hack your way onto the server (unless you have access to the server itself). Also you need a password. While grabbing a single password is not particularly difficult (and there are programs available on the web that will do it for you) Diebold made it much easier than that. In the software manual (again, from the ftp site) it states plainly that anyone using GEMS for the first time may simply use the password GEMSUSER. Your software will be up and running then, and although you need a password for each individual district, that’s no problem. Go to “Operator” in the system and all the passwords are listed. Yes, they are encrypted, but that’s no worry. A simple cut-and-paste works fine. You’re in. Do your tallying magic inside the second book and voila, your favorite politician wins.

But wait! The audit trail! Surely if someone somewhere tampers with votes the system will have a record of an unknown user’s activity. No problem. Again, simply open the election database in Access and edit to your heart’s content. Although Access encourages logs to be numbered automatically (so any deletions or additions will create a noticeable havoc with the order) in the GEMS software this feature is disabled. In short, using Access, you can change the votes in the second database and erase your presence on the audit logs.

According to the internal memos that were leaked out of Diebold (and which the company has frantically tried to cover, using cease-and-desist letters relying on the copyright laws meant to protect music from internet piracy) these backdoors not only exist, but have been exploited. In a series of emails Ken Clark, the software engineer of GEMS, talks about King County, Washington, being famous for employing this sort of backdoor in elections. Is it true? Who knows… and who could ever know, given the only evidence is found in these private emails. Many questions swirl about other recent elections, most notably and heatedly in Georgia.

On top of all this, recently a small company named VoteHere experienced a security breach. The FBI and other authorities are on the trail trying to figure out exactly who got in, and what information they stole (or altered). As of yet the only thing we know, according to VoteHere, is the attack was likely conducted by an advocacy group that is antagonistic to electronic voting. Seems they proved their point.

Even easier is the fix coming from inside the company itself. Now, if you’re the type of person that thinks every ump is fair, all elections are honest, and Halliburton really earned their no-bid shot at profiteering, then you aren’t worried about anyone nasty inside of these electronic voting companies. Of course, then I’d assume you hadn’t heard that until recently Diebold employed 5 convicted felons who all served time. One of them, Jeffrey Dean, even specifically served time for sophisticated computer fraud. He was working as a programmer. Not very tight security, eh?

The computers seem, let’s be gentle, glitchy as well. Twice the machines have totaled polls at mid-day. Strange, as that alone is illegal, but even stranger is that the polling stations would need to shut down in the middle of the day and all phone home at once. This happened once in the aforementioned King County (according to the Diebold memos) and once in San Luis Obispo, CA, on March 5, 2002 at 3:31 p.m. (according to Bev Harris). What is really going on? Again, who knows… well, we know one thing. When you’ve got a leaky backdoor as these programs do and anything fishy happens, the accusations will go flying. True or not, it won’t be very pretty.

Ok, let’s say you have no interest in all these slightly technical angles, but you still want to help your candidate get the extra two hundred votes he or she deserves. No problem! Most of these machines use some sort of ID card that is printed out to insure each voter is a separate person. Any bozo can make convincing copies of these cards and fool the machines. Send one to all your friends! Spend the day hitting each polling station!

Of course, it doesn’t end there. Sophisticated hackers can access the voting network any number of ways, giving commands as subtle as delivering every nth vote to Candidate Cheat. Everything is now centralized on computers, after all, and each computer is equipped with a modem that Diebold and others claim is one-way, though that is an impossibility given each modem must handshake onto a network. Indeed, in response to the installation of touch screen voting booths in Maryland, John’s Hopkins University conducted a study that concluded the machines are sitting ducks for hacks and fraud. The University of Maryland ran a follow-up study that concluded the same thing.

Plus, the software used in elections has often been different from the software approved for use. Under federal law, all software must be thoroughly tested before it can be put into booths, and GEMS has been. Just not the correct versions. GEMS 1.11.14 and 1.17.17 are certified, but a number of times versions 1.14.XX or 1.15.XX have been installed. The only people who have ever seen these versions are the few programmers who wrote them.

Ah, but that’s not the end. According to the leaked Diebold memos, programmers have also been investigating ways to intercept and change vote tallies via remote sources, i.e. cell phones. It almost seems cool, like a Bondsian gadget MI6 might issue if it really, really needed to make sure Bush didn’t win.

Of course, it would more likely lean the other way. Diebold CEC Walden O’Dell, a member of Bush’s upper circle of donors – The Pioneers – said in a GOP fundraising letter that he was “committed to helping Ohio deliver its electoral votes to the president next year.” Always good to know the people counting the votes are politically involved. You’d hate to have someone bored with it all at the helm.

Do not think the, ahem, interest is limited to Diebold. ES&S, the largest supplier of voting machines and software, has got all sorts of surprising connections. For instance, Nebraskan Senator Chuck Hagel (R) is a former president of and current shareholder in the corporation that owns ES&S. It certainly doesn’t look good that Hagel not only shocked everyone by beating the strongly favored incumbent (and six years later Charlie Makulta) for his seat, but he (both times) won in a landslide that saw him take every demographic in the state. Including demographics that had never come close to voting Republican in any previous election. 80% of Nebraska’s votes were counted by the company that later became ES&S. Did Hagel cheat? Beats me, but boy, if owning stock in a regulated company counts as a conflict of interest, then what is this? And in one of those quirks that remind you this is America, while no one has taken legal action to investigate Hagel’s connections, company lawyers have threatened Bev Harris with a lawsuit for revealing his connection to ES&S.

When Makulta – who strongly believes fraud was involved – asked for a hand recount, he was told that a newly-passed law made it illegal for anyone to count ballots. Only the machines might do it. The machines made, programmed, and run by ES&S. Of course, that won’t be an issue anymore.

In the old days if there was a problem you could always do a recount. Here come the new days, where there is no paper trail, no way to verify a correct vote, nothing but faith in the microchip and it’s “safeguards.” Many have clamored for a receipt to be printed with each vote and put into a separate ballot box for verification purposes in the event of a dispute. Both Diebold and ES&S have fought against this tooth and nail, first claiming that the added expense of a printer would price them out of the market; after it became obvious to everyone that the machines already came equipped with a printer for use at the start and end of each election day, the two companies claimed… well, just no, we don’t wanna. And even if you had a paper trail, it is a fairly simple process to have each polling station come up with the correct count, but finagle the numbers before they get tallied together. Some people think adding a paper trail is actually the worst possible thing, as it will likely sooth everyone’s fears while doing nothing but applying small cosmetic fixes.

In practice, the machines had a mixed day on Super Tuesday. Used by about 10 million voters, a decent number of machines malfunctioned through both technical and human error; 22 machines were left unlocked and unguarded at a school center; it was discovered that the locks on machines in Maryland were one of two identical patterns on every machine, thus every machine had 32,000 keys out there that could open it up; said locks are pretty easy to pick anyway; it was discovered that you could stuff certain cards into the machines to affect the vote one way or the other, depending how you programmed the card; and a simple tug or snip of wires could cause votes to be miscounted. You might not be able to control that one as easily though, so you Republicans head for the cities, Democrats to the rural districts.

One proposed security enhancement involves complex cryptography. Every vote would produce a receipt – one to stay with the voter, another to go into the public domain on the internet. You could check your online receipt using your social security number to ensure it is legitimate. Meanwhile, a whole slew of election officials would each be given a partial key – the only way to unlock any vote would be through the total cooperation of everyone involved. Pretty nifty. The decoded ballots would then be placed on the internet sans social security numbers, though the authors of this system say the mathematically savvy could easily deduce whether any tampering had taken place. How they might do that is left rather vague, though perhaps it is better that way – I left my Ph.D. in Statistics in the car.

The best proposed fix thus far has been to have each voting machine produce a receipt… and then only count the receipts, not what is on the software. We sure have come a long way – finally, our technology is great enough to (potentially) allow paper ballots to be tallied. The one plus is there will be no hanging chads, and disabled voters will be able to vote unassisted. Still, millions have already been spent on these electronic systems. There must have been a cheaper fix to these minor snags…

Well, those paper ballots won’t be in effect this election, when around 50 million folk – out of around 105 million voters – will be using an electronic machine. What can we do to know there isn’t any funny stuff going on?

How about exit polls? That should alert us to anything fishy, right? Not anymore. They are almost gone, and according to the corporations that own the news media, they will stay gone. What is good enough for us to use as election monitors to ensure fair representation in other countries is a bit too honest when we examine our own system. Away it goes. It looks like there is now one exit poll that every media outlet has signed up for – it’s a lucky thing monopolies are so good for honesty, right?

Throughout the history of this country there has been electoral fraud. The limiting factor has been – don’t get caught. With the extinction of paper ballots and the placing of total faith in modem-equipped machines, it has now become a lot easier to finagle figures undetected. If it hasn’t happened yet, it will soon. There’s too much at stake, and it’s just too easy. Hacktivism is taking on a whole new meaning.


SIDEBAR:


If you think electronic voting machines are scary, then it should petrify you that, this election cycle, there will be votes collected directly over the internet. Yes, this is the same internet that hackers regularly overload, graffiti, and use to steal/alter information. And that’s usually just an echo of political thought. Imagine the energy hackers around the globe will put in if directly altering an American election was in the cards?

The Pentagon has put together a $22 million pilot project for different groups of Americans living abroad to test the system during the 2004 primary and general elections. A 10-panel member of experts in this field was brought together to study the possible effects, and they are horrified.

The security of the system is not close to being ready. Anyone with the know-how and gumption can easily alter the votes. Officials working on the project believe that is a risk worth taking in order to collect more ballots from overseas voters – traditionally a pretty disenfranchised bunch. Of course, should the entire system be compromised, that would seem a fairly disenfranchising thing in and of itself.

The Pentagon and supporters of the program wonder how anyone could be against an experiment that can be used as a guide for future elections. Detractors point out this is no experiment – the results will be tallied and count in this year’s election. Worse, should it be a limited success, there might be a big push to transfer more votes to an internet system by 2008. Even if this pilot project manages to fly under the radar, it won’t be due to security. Add more votes to the mix, and you’ll attract a lot more attention from those looking for ways to injure America. Bin Laden wins in 2008?

For now, luckily overseas ballots rarely make a difference – why, they haven’t been a deciding factor since 2000, in Florida.

Maybe this is a bad idea.