|
California Restricts e-voting
Californias
secretary of state has mandated tough new security standards for the states
e-voting systems and curtailed their use, following an independent review
of the technology.
The state will still allow the use of e-voting systems
manufactured by Diebold Election Systems and Sequoia Voting Systems, but
under strict new conditions. Polling stations will not be allowed to have
more than one of the Diebold AccuVote-TSx and Sequoia Edge Model systems
in place, and county registrars will have to do things like reinstall
the devices software and firmware, reset the machines encryption
keys, and take new measures to prevent physical access to systems.
Similar security measures are now mandated for Hart InterCivics
voting systems, but without the single-machine limitation. Systems from
a fourth e-voting system maker, Election Systems & Software (ES&S),
were decertified after ES&S was late in providing access to their
products. The ES&S InkaVote Plus systems, which are used in Los Angeles
County, are now being evaluated and they could be approved for use in
the February 2008 election, the secretary of state said in a statement.
Californias review of e-voting has been a rushed
affair, since it was kicked off in early May. Thats because the
state subsequently moved its upcoming presidential primary vote ahead
by four months, to February 5, 2008. State law requires that county registrars
be given six months notice on any decertification of voting systems, forcing
Bowen to come up with decisions by Friday, earlier than she had first
anticipated.
E-voting systems were used by between a quarter and a
third of Californias 8.9 million voters in last Novembers
election, the secretary of state said.
The researchers findings were not encouraging for
backers of the current electronic voting systems. A red team
of penetration testers found 15 security problems in the devices. For
example, researchers were able to exploit bugs in the Windows operating
system used by the Diebold GEMS election management system to circumvent
the systems audit logs and directly access data on the machine.
They were able to get a similar level of access to Sequoia WinEDS data
as well.
Testers were also able to overwrite firmware, bypass
locks on the systems, forge voter cards, and even secretly install a wireless
device on the back of a GEMS server.
A source-code review, released earlier this week found
problems in all three e-voting systems it evaluated, saying that Diebolds
systems were subject to a virus attack.
|