Where would we be if these machines hadn’t been used in the last two presidential elections? One has to wonder when you see how easy it is to fraudulently change the outcome of a vote using them. Hopefully, the rest of the country can follow California’s lead.

California Bars Voting Machines – US Considers

California’s top election official on Friday decertified systems produced by Hart Intercivic, Diebold Election Systems and Sequoia Voting Systems effectively barring their use anywhere in the state. However, California Secretary of State Debra Bowen has agreed to allow counties to use the machines in February’s presidential primary if strict new security precautions were taken.

What brought this on? These next two items detail what was found with the systems.

Electronic Voting Systems Fail California’s Security Testing

On Friday, California released the results of the state’s extensive testing of electronic voting systems. State-sanctioned teams of computer specialists were able to break through the security of every model of voting machine and change results or take control of some of the systems’ electronic functions.
[...]
The study was designed to discover vulnerabilities in the technology of voting systems used in the state. It did not deal with any physical security measures that counties might take and “made no assumptions about constraints on the attackers,” Secretary of State Debra Bowen said in a telephone news conference Friday.

More California E-Voting Reports Released; More Bad News

It is interesting (at least to me as a computer security guy) to see how often the three companies made similar mistakes. They misuse cryptography in the same ways: using fixed unchangeable keys, using ciphers in ECB mode, using a cyclic redundancy code for data integrity, and so on. Their central tabulators use poorly protected database software. Their code suffers from buffer overflows, integer overflow errors, and format string vulnerabilities. They store votes in a way that compromises the secret ballot.

Many will say, “So what?” Or put another way, we’ve come to accept that the powers that be want to rig the results and that we’re screwed. This is only a minor setback for them. Or put a third way, so who’s going to be our next Bush in the upcoming election?

As far as I can tell, major news outlets haven’t taken much notice of these reports. That in itself may be the most eloquent commentary on the state of e-voting: reports of huge security holes in e-voting systems are barely even newsworthy any more.