Will The Next Election Be Hacked?

The primary author and steward of HAVA was Rep. Bob Ney, the GOP chairman of the powerful U.S. House Administration Committee. Ney had close ties to the now-disgraced lobbyist Jack Abramoff, whose firm received at least $275,000 from Diebold to lobby for its touch-screen machines. Ney's former chief of staff, David DiStefano, also worked as a registered lobbyist for Diebold, receiving at least $180,000 from the firm to lobby for HAVA and "other election reform issues." Ney - who accepted campaign contributions from DiStefano and counted Diebold's then-CEO O'Dell among his constituents - made sure that HAVA strongly favored the use of the company's machines.

Ney also made sure that Diebold and other companies would not be required to equip their machines with printers to provide paper records that could be verified by voters. In a clever twist, HAVA effectively pressures every precinct to provide at least one voting device that has no paper trail - supposedly so that vision-impaired citizens can vote in secrecy. The provision was backed by two little-known advocacy groups: the National Federation of the Blind, which accepted $1 million from Diebold to build a new research institute, and the American Association of People with Disabilities, which pocketed at least $26,000 from voting-machine companies. The NFB maintained that a paper voting receipt would jeopardize its members' civil rights - a position not shared by other groups that advocate for the blind.

Sinking in the sewage of the Abramoff scandal, Ney agreed on September 15th to plead guilty to federal conspiracy charges - but he has already done one last favor for his friends at Diebold. When 212 congressmen from both parties sponsored a bill to mandate a paper trail for all votes, Ney used his position as chairman to prevent the measure from even getting a hearing before his committee.

The result was that HAVA - the chief reform effort after the 2000 disaster - placed much of the nation's electoral system in the hands of for-profit companies. Diebold alone has sold more than 130,000 voting machines - raking in estimated revenues of at least $230 million. "This whole undertaking was never about voters," says Hood, who saw firsthand how the measure benefited Diebold's bottom line. "It was about privatizing elections. HAVA has been turned into a corporate-revenue enhancement scheme."

No case better demonstrates the dangers posed by electronic voting machines than the experience of Maryland. As in Georgia, officials there granted Diebold control over much of the state's election systems during the 2002 midterm elections. (In the interests of disclosure, my sister was a candidate for governor that year and lost by a margin consistent with pre-election polls.) On Election Night, when Chris Hood accompanied Diebold president Bob Urosevich and marketing director Mark Radke to the tabulation center in Montgomery County where the votes would be added up, he was stunned to find the room empty. "Not a single Maryland election official was there to retrieve the memory cards," he recalls. As cards containing every vote in the county began arriving in canvas bags, the Diebold executives plugged them into a group of touch-screen tabulators linked into a central server, which was also controlled by a Diebold employee.

"It would have been very easy for any one of us to take a contaminated card out of our pocket, put it into the system, and download some malicious code that would then end up in the server, impacting every other vote that went in, before and after," says Hood. "We had absolute control of the tabulations. We could have fixed the election if we wanted. We had access, and that's all you need. I can honestly say that every election I saw with Diebold in charge was compromised - if not in the count, at least in the security."

After the election, Maryland planned to install Diebold's AccuVote-TS electronic machines across the entire state - until four computer scientists at Johns Hopkins and Rice universities released an analysis of the company's software source code in July 2003. "This voting system is far below even the most minimal security standards applicable in other contexts," the scientists concluded. It was, in fact, "unsuitable for use in a general election."

"With electronic machines, you can commit wholesale fraud with a single alteration of software," says Avi Rubin, a computer-science professor at Johns Hopkins who has received $7.5 million from the National Science Foundation to study electronic voting. "There are a million little tricks when you build software that allow you to do whatever you want. If you know the precinct demographics, the machine can be programmed to recognize its precinct and strategically flip votes in elections that are several years in the future. No one will ever know it happened."

In response to the study, Maryland commissioned two additional reports on Diebold's equipment. The first was conducted by Science Applications International Corporation - a company that, along with Diebold, was part of an industry group that promotes electronic voting machines. SAIC conceded that Diebold's machines were "at high risk of compromise" - but concluded that the state's "procedural controls and general voting environment reduce or eliminate many of the vulnerabilities identified in the Rubin report." Despite the lack of any real "procedural controls" during the 2002 election, Gov. Robert Ehrlich gave the state election board the go-ahead to pay $55.6 million for Diebold's AccuVote-TS system.

The other analysis, commissioned by the Maryland legislature, was a practical test of the systems by RABA Technologies, a consulting firm experienced in both defense and intelligence work for the federal government. Computer scientists hired by RABA to hack into six of Diebold's machines discovered a major flaw: The company had built what are known as "back doors" into the software that could enable a hacker to hide an unauthorized and malicious code in the system. William Arbaugh, of the University of Maryland, gave the Diebold system an "F" with "the possibility of raising it to a 'C' with extra credit - that is, if they follow the recommendations we gave them."