A commenter over at DU asked which states used the ES&S iVotronic touch-screen voting system found vulnerable to an undetectable countywide vote-flipping virus which can be implanted by a single person, as we reported this morning.

Based on our quick review of a county-by-county database of voting systems, sorted by state, as made available by Common Cause (EXCEL spreadsheet downloadable here) just prior to the November 2006 elections, it looks like the answer is 16 states in total.

Since the EAC refuses, as our report detailed, to do their job in notifying Elections Officials about this incredibly serious vulnerability, it looks like it's up to you to notify your state's Secretary of State and/or county Election Officials! Details on the vulnerability and mitigating steps that may be taken are detailed in this brief report at VotersUnite.org as written by a computer scientist and voting system expert well familiar with the newly discovered flaw. Please refer your voting officials to both our original article, and that scientific report for more details at the following URLs:

• https://bradblog.com/?p=4396
• http://www.votersunite.o.../ES&SInsecurity.asp

The states which use the ES&S iVotronic affected (with firmware versions either 8 or 9, with or without a so-called "Voter Verified Paper Audit Trail") are as follows:

• Arkansas
• Florida
• Indiana
• Iowa
• Kansas
• Kentucky
• Missouri
• New jersey
• North Carolina
• Ohio
• Pennsylvania
• South Carolina
• Tennessee
• Texas
• West Virginia
• Wisconsin

If we've missed any, or any of the states above do not use the system in at least one county, please let us know and we'll amend the list.

The BRAD BLOG and You - Doing the EAC's job for them. But without the $15 million budget (or the incomprehensible incompetence).

The New York Times' Ian Urbina (this time with Christopher Drew) continues to stay on point with his Electoral Failures coverage at the Grey Lady. Unlike Urbina's last report, this time he wasn't undermined by the Times headline writers. (Does anyone with a hard copy of the paper know what page this was reported on, btw?)

To his additional credit, he didn't use the word "glitch" even once. Thank you, Ian. Here are a few highlights from his piece in today's paper...

Of course, BRAD BLOG readers will remember our desperate call for "Emergency Paper Ballots" here in the weeks prior to the election. On that, Urbina reports...

Wow. Who could have predicted that?!

And there's more...Of course, the "experts" (word used very cautiously!) are beginning to notice that things on Nov. 7th were worse than they had originally understood. "Voting problems may actually have been wider than initially estimated, with many malfunctions simply overlooked," reports the Times.

So how bad were they? How about 60,000 missing votes in Florida, bad. 20,000 voters who couldn't vote in Colorado, bad. Or in Arkansas, where "election officials tallied votes three times in one county, and each time the number of ballots cast changed by more than 30,000," bad.

And then there's the erstwhile election "expert" Doug Chapin of Electionline.org whose "expert" opinion ensures his presence in just about any mainstream media coverage of these matters. Mr. Chapin continues, on schedule, working all sides of the street in Urbina's piece. It's a tricky juggling act for this "expert" --- mustn't offend the Voting Machine Companies or the Elections Officials who pay his bills, or even, to a lesser extent, the Election Integrity advocates who might just call him a phony if he's not careful --- but, as John Gideon pointed out in yesterday's DVN, even Chapin's having a difficult time avoiding the obvious:

And the award for "Understatment of the Year" goes to...

UPDATE 9:01pm PT: Reader Adele writes to tell us that Urbina's article was on "page 30 of 36 pages in the National section" of today's paper.

Guest Blogged by Alan Breslauer

Pennsylvania Senator Rick Santorum concedes to Senator elect Bob Casey.

UPDATE FROM BRAD 11/8/06 7:56pm: Please note, his concession came only after he succeeded in getting the PA Republican Party to send a letter to Secretary of the Commonwealth demanding that voting machines in 27 counties be impounded after reports that Republican votes were flipping to Democratic on touch-screen machines. Ya don't hear that very often. We support the impounding of those machines...though we received late-night reports that Santorum and the GOP had withdrawn their request. More soon...

First, they're not "glitches"...They are failures! This from AP...

As expected --- and you'll be seeing and hearing a lot of this all night --- the Voting Machine Companies who have created the equivalent of Ford Pintos with these machine that "blow up" during normal use, no matter how careful a "driver" might be, are blaming "human error"...as opposed to themselves...and the election officials who were dumb enough to be suckered in by the wining and dining and false promises of the company lobbyists who are plying their insidious trade courtesy of your tax payer dollars...

These are the top ten states, currently, regarding incident/problem reports coming in to the non-partisan 866-OUR-VOTE hotline. Pennsylvania leads the problem calls so far this morning. They are using paperless touch-screen systems in many counties for the first time this year...

In a related matter, the unspeakable democracy-hater/ABC radio talk-show host Laura Ingraham has apparently encouraged listeners during her morning talk show to jam a different hotline sponsored by the Democrats. Reportedly "crank calls are now flooding in" on that number. Amazing. Firedoglake advises that Ingraham can be emailed here.

John Aravosis over at AMERICAblog reports the dirty tricks are spreading. Note: The fake robo-calls reported here are distinct from the GOP phone-calls reported here by John Gideon, in New Mexico attempting to disinform Hispanic voters that their polling place had "changed"...

The Coalition For Voting Integrity (CVI) in Pennsylvania has announced that beginning tonight and weekly they will be doing a one-hour radio program that centers on voting issues and democracy.

The program can be heard locally in the SE Pennsylvania and S New Jersey area via WNJC Radio 1360AM or it can be heard live via the internet by going here. They are encouraging audience participation so if you have questions/comments for tonights guest, Lowell Finley of VoterAction you can call 856 227 1360.

We are happy to see another group sharing their voices with Brad and the others who are on the radio spreading the good, bad and ugly news about our elections. The whole CVI Press Release has upcoming guests and more information....

This morning, NPR's Weekend Edition covered the latest trouble with Diebold's touch-screen systems. They went to Pottsville, PA during last Tuesday's primary election.

The producer on the story had contacted us last week, prior to the story, for some background information. The resultant report, aired this morning, was generally a good --- and for a chance, accurate! --- one, we think.

By way of quick summary: Diebold spokesman Mark Radke explains the latest security hole, which had caused a lockdown of all Diebold touch-screen machines in PA, just days prior to the election, was there for a good reason --- to update software quickly, he says.

No explanation, of course, for why Diebold didn't feel it necessary to warn PA themselves about such a need for these extreme measures long ago. Especially since they were warned about the problem as long ago as January 2004.

Johns Hopkins computer science professor, Avi Rubin, says he can't think of a problem ever revealed in a voting machine as severe as this one --- the one which Radke predictably downplays --- adding that a TIVO system has more built-in security than a Diebold voting machine!

Radke says the physical security of the machines would make it impossible to exploit the security hole. Radke, of course, knows he's just spinning. Rubin makes that clear in his response, explaining how he could have compromised an election in about 5 seconds as a poll worker through this ridiculous vulnerability.

-- Listen to the full report (about 5 mins) here...

...And let us know what you thought of it in comments.

UPDATE: Barb Burt over at CommonCause, blogs on the NPR item as well this morning, giving it high-marks, along with a few other notable thoughts.

UPDATE 5/24/06: A text transcript of the NPR report is now included below...

From AP...

In April of 2005, we reported on those machines, the UniLect Patriots, being decertified in PA.

Previously, on November 4, 2004 --- two days after the Presidential Election --- we reported that more than 4,500 votes were completely lost on the same machines in Carteret County, NC.

That same day, in the same report, we discussed the same machines in use in Ohio on Election Day.

While the incident in NC led to new laws in the state requiring full source-code submission to the state by Electronic Voting Machine vendors, and the problems in PA have led to state decertification and now a lawsuit against the company, we're aware of no action that has ever been taken by the state of OH to investigate what might have happened and whether or not votes were similarly lost on UniLect Patriot machines in the Buckeye state that same night.

Good thing what happened in OH on November 2, 2004 wasn't all that important.

Following on our earlier report today, covering 100's of electronic voting machines in Philadelphia which failed to start up this morning for Pennsylvania's primary election, we now have a similar report from the other side of the state.

100's of machines in Allegheny County, where Pittsburgh is located, also failed to work correctly today. If we're able to remember correctly (since the story doesn't name any voting machine company names), Allegheny County finally settled on voting machines made by ES&S, after they abandoned hopes of going with Diebold when their machines were found to be hackable, and then later found machines from Sequoia Voting Systems --- who they'd planned to use instead --- were discovered to be similarly hackable.

ES&S eventually won the prize, just weeks before today's primary --- we warned about going with a new system with so little time to prepare, but did they listen? --- yet appear to have lost the day for PA voters, according to this report from Pittsburgh's Post-Gazette...

More details on the failures in the Post-Gazette's story. Amongst those details, apparently Sen. Rick Santorum (R-PA) was locked out of his polling place when an election worker failed to show up to open it this morning.

Pennsylvania is having their primary elections today and, as expected, the train wreck is underway. As reported by Philadelphia Daily News, hundreds of machines (in this case, those made by Danaher Guardian) have failed...

The local ABC affiliate has more details. Amongst them...

More from TheNextMayor.com...

LATE UPDATE: 100's of machines also failed in Pittsburgh across the state in Allegheny County! Details...

"It is like the nuclear bomb for e-voting systems," said Avi Rubin, computer science professor at Johns Hopkins University. "It's the deal breaker. It really makes the security flaws that we found (in prior years) look trivial."
-- From Security Focus, 5/12/06

Pennsylvania officials warned local election registrars last week about the vulnerability in the mechanism that installs and upgrades software on Diebold equipment. It said the risk of the vulnerability being exploited was "low".
-- From AP, 5/11/06

The first graf above, quoting Rubin, comes from a superb and indepth article by Robert Lemos at Security Focus on the latest Diebold security disaster. We recommend his report for a host of reasons, amongst them; his broad coverage of dozens of the stories we've yelled and screamed about here at The BRAD BLOG over the past several months, but also because he adds loads of details to the latest Diebold mess which is finally being picked up by the mainstream media. Big time. (Here's an eye-popping compilation of scores of articles from just last Wednesday, Thursday and Friday, with many more to come.)

We point to Rubin's quote --- similar to on the record statements from of the other computer scientists and e-voting security professionals familiar with the details of the built-in "feature" in Diebold's touch-screen systems now revealed to be an extraordinary security vulnerability --- by way of contrast to the way both Diebold and the State of Pennsylvania (and subsequently the bulk of the media) reported their characterization of the problem. That would be the second graf of this story in which AP quotes PA officials describing the risk as "low."

From Diebold's Mouth to Your Ears...

We're often asked, by media folks and others, why it is that Election Officials seem to stand by their E-Voting Machines and Vendors, such as Diebold, ES&S and others, instead of holding them accountable and independently verifying their (usually unsupported) claims about the security and reliability of their voting machines --- as Leon County, FL Supervisor of Elections, Ion Sancho and Emery County, UT County Clerk, Bruce Funk, both rare exceptions --- did.

Setting aside that both Sancho and Funk have been fighting with state officials to hang on to their jobs ever since, The BRAD BLOG has obtained a few documents which underscore what's really at work in the bulk of Election Official/Election Machine Vendor relationships...

By John Gideon, www.VotersUnite.Org and www.VoteTrustUSA.Org May 15, 2006

Yes, the wheels are wobbling on the locomotives. The vendors --- ES&S, Diebold, and the rest --- attempt to keep a stiff upper lip as they both fail to perform, yet continue collecting tax-payer dollars from the county election coffers. Meanwhile some elections officials have just turned a blind-eye to what is happening while they continue to make excuses for their vendors: The private corporate American Electronic Voting Machine behemoths that are being paid to take over America's Public Electoral system.

And the Election Assistance Commission (EAC) which was put in place by the Help America Vote Act (HAVA), theoretically, to keep all of this from occurring? Well, all they do is raise their hands and shrug and tell anyone who asks, that they don't do voting systems certification so they just don't know anything. The Sergeant Schultz Defense, perhaps?

We've now been able to gather a great deal of additional information concerning details about the story we first posted yesterday on the official Pennsylvania state warning issued about the new "security vulnerability" discovered in all Diebold touch-screen electronic voting machines.

That warning, which has now brought a lock-down on all Diebold systems in PA, where early absentee (non-machine) voting is about to begin prior to their upcoming May 16th primary election, was reported by the Morning Call yesterday. The warning says the serious security vulnerability could allow ''unauthorized software to be loaded on to the system."

Public details about the warning are still sketchy as those in the know have acknowledged that the problem is so serious, they are hoping to keep the info under wraps until mitigation steps can be taken to safeguard systems.

The BRAD BLOG has been told on the record, however, by one person involved in the matter, that the vulnerability is a "major national security risk."

We've been speaking to many sources today, and we've been able to get several first hand comments on the problem from top officials and analysts directly involved in both state and federal certification of the Diebold systems, as well as from those involved in the initial discovery of the problem.

What's clear is that Morning Call's reporting that it was Diebold who found the "glitch" are flat wrong. The discovery of the "glitch" (which is anything but) emanated from the examination of Diebold AccuVote TSx (touch-screen) machines recently in Emery County, UT.

A source has told The BRAD BLOG that Diebold was "cornered" into admitting to the problem, a far cry from them having "found" it, as the Morning Call characterized it.

What's also clear is that neither Diebold themselves, nor federal officials at the Elections Assistance Commission (EAC) have been notifying states about the serious problem which apparently affects all Diebold AccuVote touch-screen systems, including both their newer TSx models, and the older TS and TS6 models.

The Diebold TSx models, with the security vulnerability still intact, were apparently used in the primary election last Tuesday in Ohio.

A document at Diebold's website describes [PDF] the TSx models as featuring "Industry Leading Security."

In Utah's Emery County, state officials are attempting to force Bruce Funk, the 23-year elected County Clerk out of his job in the wake of his having allowed a security evaluation of the county's new Diebold touch-screen systems by both computer security firm Security Innovation and Finnish computer security expert Harri Hursti. According to several sources, that analysis revealed many new vulnerabilities and problems in the Diebold touch-screen systems, including the one that seems to be at the heart of the problem now being warned about by Pennsylvania officials.

Funk --- who has since been "vilified," as one source told us, by both Diebold and Utah state officials as high as the Lt. Governor --- was forced to implement the new Diebold touch-screen systems for the first time this year against his own objections. His prudent subsequent security evaluation of the systems was arranged by electronic voting watchdog organization, BlackBoxVoting.org. (We recently interviewed Funk on the radio concerning that evaluation, and his subsequent removal from office in its wake. Listen to that interview here [MP3].)

Here's some of what we've so far been able to learn from a number of officials, both on the record and off, in Pennsylvania, elsewhere around the country and at the federal level, as well as those involved in the initial Emery County discoveries...

Just weeks before their May 16th Primary Election, the Pennsylvania Sec. of State, Pedro Cortez issued a Security Alert late Tuesday concerning a "potential security vulnerability" in Diebold electronic voting machines which could " allow ''unauthorized software to be loaded on to the system." The warning was revealed yesterday at a meeting in Schuylkill County.

Details about the warning are still sketchy this morning, and we're trying to learn more, but The Morning Call is reporting today that the "glitch" was "found" by Diebold and counties are now being instructed to lock down systems and seal the memory cards into them.

A "fix" is said to be on its way from Diebold, though that begs the question of whether the last-minute software patch will be certified by federal and/or state authorities before it's installed on machines that have already proven to be vulnerable to hackers and other failures.

(As regular BRAD BLOG readers know, even if the software is inspected by federal authorities before being installed in machines, there is no guarantee that those authorities will find the bugs and illegal code that Diebold is quickly becoming famous for. The federal so-called "Independent Testing Authority" (ITA) is paid for by the voting machine company's themselves and has overlooked gaping flaws in software submitted by the vendors for years).

Says the Morning Call today about the security warning...