Hacker to try to attack state voting machines

In today's San Francisco Chronicle, John Wildermuth reports on the California Secretary of State's plan to allow a computer security expert sponsored by Black Box Voting to attempt to hack into Diebold's voting system. The security test will be held Wednesday, Nov. 30. Excerpts from the Chronicle article are featured below.



--------



A computer hacker will be trying to break into one of California's electronic voting machines next week, with the full cooperation of the secretary of state.



Harri Hursti, a computer security expert from Finland, will be trying to demonstrate that voting machines made by Diebold Election Systems are vulnerable to attacks by computer hackers seeking to manipulate the results of an election.



"This is part of our security mission,'' said Nghia Nguyen Demovic, a spokeswoman for the secretary of state's office. "We want to make sure that every vote is counted and registered correctly.''



The stakes are high for Diebold, one of the nation's largest manufacturers of electronic voting systems. The company is trying to get its new voting system approved for use in California, the nation's biggest market, but Secretary of State Bruce McPherson refused certification after 20 percent of the new, printer-equipped voting machines malfunctioned during a July test in San Joaquin County.



"The secretary said that performance wasn't good enough,'' Demovic said.



The new security test, tentatively scheduled for Wednesday, will play a role in Diebold's future certification efforts.



Last May, Hursti and another computer security expert tested a Diebold system for the elections supervisor in Leon County, Fla. They quickly broke into the system, changed the voting results and inserted a new program that flashed the message "Are we having fun yet?" on the computer screens.



"Granted the same access as an employee of our office, it was possible to enter the computer, alter election results and exit the system without any physical record of this action,'' said Ion Sancho, the election supervisor, in a report on the county's Web site.



The California test will use a randomly selected voting machine from one of the 17 counties that use a Diebold system -- either touch screen or optical scan machines. The original plan for the test would have used a machine provided by Diebold, something opposed by the state and the critics of the company.



"We want to test a machine that's already been used in a California election,'' said Jim March, an investigator for Black Box Voting, the consumer group bringing in Hursti for the test. "We want to avoid a so-called 'lab queen,' a voting machine specially rigged for the test.''



Black Box Voting and other groups have complained that the programs loaded into the Diebold machines can be undetectably changed to provide a specific election result. Officials of the company argue their machines provide secure, accurate results.



Officials of the company did not return telephone calls Wednesday.



Diebold has been a popular target, for those worried about the security of electronic voting and for Democrats complaining about the company's links to the Republican Party.



---



The company also has a checkered record in California. Problems with the company's electronic voting system caused disruptions at 180 Alameda County precincts during the March 2004 primary election. During the October 2003 recall election, several thousand votes for Democratic Lt. Gov. Cruz Bustamante in Alameda County were somehow electronically transferred to Southern California Socialist John Burton.



In May 2004, then-Secretary of State Kevin Shelley yanked certification of the Diebold machines in four counties and restricted their use in 10 other counties until their security and reliability could be improved.



The state has mandated that all electronic voting machines have a paper-ballot backup to record votes by the June 2006 primary.