"It is like the nuclear bomb for e-voting systems," said Avi Rubin, computer science professor at Johns Hopkins University. "It's the deal breaker. It really makes the security flaws that we found (in prior years) look trivial."
-- From Security Focus, 5/12/06

Pennsylvania officials warned local election registrars last week about the vulnerability in the mechanism that installs and upgrades software on Diebold equipment. It said the risk of the vulnerability being exploited was "low".
-- From AP, 5/11/06

The first graf above, quoting Rubin, comes from a superb and indepth article by Robert Lemos at Security Focus on the latest Diebold security disaster. We recommend his report for a host of reasons, amongst them; his broad coverage of dozens of the stories we've yelled and screamed about here at The BRAD BLOG over the past several months, but also because he adds loads of details to the latest Diebold mess which is finally being picked up by the mainstream media. Big time. (Here's an eye-popping compilation of scores of articles from just last Wednesday, Thursday and Friday, with many more to come.)

We point to Rubin's quote --- similar to on the record statements from of the other computer scientists and e-voting security professionals familiar with the details of the built-in "feature" in Diebold's touch-screen systems now revealed to be an extraordinary security vulnerability --- by way of contrast to the way both Diebold and the State of Pennsylvania (and subsequently the bulk of the media) reported their characterization of the problem. That would be the second graf of this story in which AP quotes PA officials describing the risk as "low."

From Diebold's Mouth to Your Ears...

We're often asked, by media folks and others, why it is that Election Officials seem to stand by their E-Voting Machines and Vendors, such as Diebold, ES&S and others, instead of holding them accountable and independently verifying their (usually unsupported) claims about the security and reliability of their voting machines --- as Leon County, FL Supervisor of Elections, Ion Sancho and Emery County, UT County Clerk, Bruce Funk, both rare exceptions --- did.

Setting aside that both Sancho and Funk have been fighting with state officials to hang on to their jobs ever since, The BRAD BLOG has obtained a few documents which underscore what's really at work in the bulk of Election Official/Election Machine Vendor relationships...

By John Gideon, www.VotersUnite.Org and www.VoteTrustUSA.Org May 15, 2006

Yes, the wheels are wobbling on the locomotives. The vendors --- ES&S, Diebold, and the rest --- attempt to keep a stiff upper lip as they both fail to perform, yet continue collecting tax-payer dollars from the county election coffers. Meanwhile some elections officials have just turned a blind-eye to what is happening while they continue to make excuses for their vendors: The private corporate American Electronic Voting Machine behemoths that are being paid to take over America's Public Electoral system.

And the Election Assistance Commission (EAC) which was put in place by the Help America Vote Act (HAVA), theoretically, to keep all of this from occurring? Well, all they do is raise their hands and shrug and tell anyone who asks, that they don't do voting systems certification so they just don't know anything. The Sergeant Schultz Defense, perhaps?

We've now been able to gather a great deal of additional information concerning details about the story we first posted yesterday on the official Pennsylvania state warning issued about the new "security vulnerability" discovered in all Diebold touch-screen electronic voting machines.

That warning, which has now brought a lock-down on all Diebold systems in PA, where early absentee (non-machine) voting is about to begin prior to their upcoming May 16th primary election, was reported by the Morning Call yesterday. The warning says the serious security vulnerability could allow ''unauthorized software to be loaded on to the system."

Public details about the warning are still sketchy as those in the know have acknowledged that the problem is so serious, they are hoping to keep the info under wraps until mitigation steps can be taken to safeguard systems.

The BRAD BLOG has been told on the record, however, by one person involved in the matter, that the vulnerability is a "major national security risk."

We've been speaking to many sources today, and we've been able to get several first hand comments on the problem from top officials and analysts directly involved in both state and federal certification of the Diebold systems, as well as from those involved in the initial discovery of the problem.

What's clear is that Morning Call's reporting that it was Diebold who found the "glitch" are flat wrong. The discovery of the "glitch" (which is anything but) emanated from the examination of Diebold AccuVote TSx (touch-screen) machines recently in Emery County, UT.

A source has told The BRAD BLOG that Diebold was "cornered" into admitting to the problem, a far cry from them having "found" it, as the Morning Call characterized it.

What's also clear is that neither Diebold themselves, nor federal officials at the Elections Assistance Commission (EAC) have been notifying states about the serious problem which apparently affects all Diebold AccuVote touch-screen systems, including both their newer TSx models, and the older TS and TS6 models.

The Diebold TSx models, with the security vulnerability still intact, were apparently used in the primary election last Tuesday in Ohio.

A document at Diebold's website describes [PDF] the TSx models as featuring "Industry Leading Security."

In Utah's Emery County, state officials are attempting to force Bruce Funk, the 23-year elected County Clerk out of his job in the wake of his having allowed a security evaluation of the county's new Diebold touch-screen systems by both computer security firm Security Innovation and Finnish computer security expert Harri Hursti. According to several sources, that analysis revealed many new vulnerabilities and problems in the Diebold touch-screen systems, including the one that seems to be at the heart of the problem now being warned about by Pennsylvania officials.

Funk --- who has since been "vilified," as one source told us, by both Diebold and Utah state officials as high as the Lt. Governor --- was forced to implement the new Diebold touch-screen systems for the first time this year against his own objections. His prudent subsequent security evaluation of the systems was arranged by electronic voting watchdog organization, BlackBoxVoting.org. (We recently interviewed Funk on the radio concerning that evaluation, and his subsequent removal from office in its wake. Listen to that interview here [MP3].)

Here's some of what we've so far been able to learn from a number of officials, both on the record and off, in Pennsylvania, elsewhere around the country and at the federal level, as well as those involved in the initial Emery County discoveries...

Just weeks before their May 16th Primary Election, the Pennsylvania Sec. of State, Pedro Cortez issued a Security Alert late Tuesday concerning a "potential security vulnerability" in Diebold electronic voting machines which could " allow ''unauthorized software to be loaded on to the system." The warning was revealed yesterday at a meeting in Schuylkill County.

Details about the warning are still sketchy this morning, and we're trying to learn more, but The Morning Call is reporting today that the "glitch" was "found" by Diebold and counties are now being instructed to lock down systems and seal the memory cards into them.

A "fix" is said to be on its way from Diebold, though that begs the question of whether the last-minute software patch will be certified by federal and/or state authorities before it's installed on machines that have already proven to be vulnerable to hackers and other failures.

(As regular BRAD BLOG readers know, even if the software is inspected by federal authorities before being installed in machines, there is no guarantee that those authorities will find the bugs and illegal code that Diebold is quickly becoming famous for. The federal so-called "Independent Testing Authority" (ITA) is paid for by the voting machine company's themselves and has overlooked gaping flaws in software submitted by the vendors for years).

Says the Morning Call today about the security warning...

Blogged by John Gideon

In an article last week I pointed to the copious evidence that our elections are headed straight towards disaster; a "Train Wreck". That "Train Wreck," however, may still be avoided. The engineers of one of those trains, as it were, are the elections officials who are allowing themselves to be cowed by vendors like ES&S, Sequoia, and Diebold. The disaster can be avoided, but it will require the election officials to switch their train to a different track � by first acknowledging that there are problems.

In order to begin that process those officials must finally realize that they are not alone. Counties across the country are finding the exact same problems. The bad ES&S memory cards were not just found in Summit County, Ohio; they were also found in North Carolina and probably other counties in other states. ES&S will fail to deliver on contracts for voting machines in many counties all across the country. Does anyone really expect the engineer of the other train --- the voting machine vendors --- to switch tracks? They only see the money bags at the end of the track and not the other train barreling down on them.

The federal Election Assistance Commission (EAC) --- created by the Help America Vote Act (HAVA) of 2002 --- has likewise not been doing their job. They seem to be content to just sit back and watch as voting systems across the country are in melt-down. Do they really serve any purpose other than to shovel out HAVA funding for these new systems to the states, who in turn pass them on to the vendors? It appears not. Take a look�

Guest Blogged by John Gideon

The BRAD BLOG has received a copy of the 'Complaint For Declaratory and Injunctive Relief', as filed earlier this week in Allegheny County, PA, by several disabled voters. The complete suit is now available here [WORD format].

As the suit itself is some 43 pages, we will distill it for you a bit, and cover the most notable aspects. The BRAD BLOG is just thoughtful that way.

As we reported on Wednesday, the complaint was filed against the Pennsylvania Secretary of State, other state and county officials, an Assistant Attorney General for the Civil Rights Division of the US Dept. of Justice, and Attorney General Alberto Gonzales.

The complaint asserts that the state certified Electronic Voting Machines made by Elections Systems & Software, Inc. (ES&S) are not accessible by voters with disabilities --- contrary to the requirements of the Help America Vote Act (HAVA) of 2002 and the Americans With Disabilities Act (ADA). Nonetheless, Allegheny County has selected their machines for use in upcoming elections. That, after previously hoping to go with Diebold, and then with Sequoia Voting Systems, until finally settling on ES&S after the first two choices fell apart either due to the politics of the companies involved and/or due to the discovery their Electronic Voting Systems were found to be hackable.

As mentioned, the choice to not use Diebold in Allegheny occurred, in no small part, because of the company's known hard-right partisan leanings. The lawsuit, however, points out the irony of finally choosing to go with ES&S --- considering their own dubious partisan background...

By John Gideon, VotersUnite.Org and VoteTrustUSA.Org

Normally this space is taken with my ideas of what are the "Top 5" voting news stories for the week. Today I am going to use this space to talk about what I see as the beginning of a disaster in the making with our elections. This isn't the election fraud that some point to when they talk about the vendors and some elections officials. It's not about recounts or audits. This is a real, get your hands around it, happening problem that will disrupt our election process if we do not do something about it now. While we have been involved in all of our issues about Direct Recording Electronic (DRE or "touch-screen") voting machines or paper ballots the electronic voting machine vendors have been wreaking complete havoc across the country.

So far this year two states have conducted primary elections. In Texas there is at least one candidate who has stepped forward and has challenged the election because of anomalies in vote counts and known voting machine failures. One county's machines counted some votes up to 6 times which resulted in approximately 100,000 more votes being counted than were cast. Though the vendor, Hart Intercivic, initially blamed the problem on human error, they finally had to admit that it was a programming error and not poll workers or voters who had erred. In Illinois some county officials are threatening to withhold final payment of funds on contracts with Sequoia Voting Systems because of failures with their machines that ended with results in the primary not being known for over a week after the voters went to the polls. In both states the involved vendors were very successful in the media with deflecting the blame from their machines to "human errors" or "glitches". However, when you listen to people who were there and who saw and worked through the problems you get a very different picture...

Originally Allegheney County, PA had hoped to use Diebold's electronic voting machines --- until they found out that Diebold machines were hackable.

Then they decided instead to go with Sequoia Voting Systems instead --- until they found out that their machines are hackable too.

Yesterday, with just six weeks left before their primary election, and against the wishes of Allegheny County's Chief Executive who felt it was safer to stay with their old lever systems, Allegheny decided instead to go with new ES&S touch-screen voting machines.

ES&S, of course, is the company whose machines failed all over Texas during the March 7th primary in Texas, leading to state-wide election contest by a Republican former Supreme Court Justice. ES&S saw more than 30% of their memory cards fail in recent pre-election tests in Summit County, OH, more than 1000 cards fail in NC, and their machines failed to work completely this week as early voting began in Indiana.

Good luck with the new ES&S voting machines Allegheny County, PA!

Meanwhile...in Pennsylvania's Allegheny County, where plans to use Diebold's hackable Electronic Voting Equipment have recently been nixed, Plan B seems to be failing too. The machines they'd hope to use instead, as made by Sequoia Voting Systems, have now been shown to be hackable as well.

Pittsburgh's Post-Gazette picked up on the story yesterday, and followed up today on the testing being run in Allegheny County by Dr. Michael Shamos, a Carnegie Mellon University professor, on the "new" Sequoia Voting Machines. The county had hoped to use these systems --- ten-year old Sequoia "Advantage" machines as purchased from Clark County, Nevada who is moving to a different Sequoia system --- in their upcoming Primary Elections in May. That plan, now may be in grave doubt.

The testing of the machines has found so many problems --- including Shamos' findings during "tampering tests" that he was able to instantly "transform a handful of votes into thousands" --- that he has now simply shut down the entire process described as "pointless" due to all of the errors in the software.

According to today's report...

As you may recall, it was machines made by Sequoia which failed so miserably across the state in Illinois just last week during the Primary Elections there. Just a handful of the many mainstream reports covering the meltdown are here, here and here.

Now pay attention...because this can be confusing...

Illinois' Cook County (Chicago) had used new Sequoia "Edge" machines in the recent primary that had been purchased by Clark County, Nevada. Since Illinois' primaries were first, and Sequoia didn't have time or inventory to fill both orders, Cook used Clark's machines for last week's contest only.

Those "Edge" machines, which failed so disastrously in Cook County, IL, are now to be shipped to Clark County, NV who is selling their own ten-year old Sequoia "Advantage" machines to Allegheny County, PA. It is those ten-year old machines which are now being tested in Allegheny and failing so horrendously.

All of which begs the questions: How well were those "Advantage" machines tested in Nevada in the last ten years? How much is Nevada now looking forward to using the new and failed "Edge" machines that they had loaned for a single use to Cook County, IL? And finally, will Clark County, NV bother to test them to find out if they too are hackable like the ones --- modified a bit by Sequoia on the way, apparently --- that they've just unloaded on Allegheny County, PA?

But back to the halted tests in Allegheny...and the claims by Sequoia officials that the problems found were "no big deal". Shamos doesn't see them as "no big deal" and is concerned that a malicious hacker could do precisely what he was able to do in these tests...

Guest blogged by David Edwards

As our readers know, The BRAD BLOG has been a leading source for investigations and reports into the nefarious (and possibly illegal) actions of high-level GOP Operatives that have established a tax-exempt, 503(c)(3) organization called the American Center for Voting Rights (ACVR). The group, since its creation, has released false and misleading information intended to advance GOP plans to disenfranchise millions of voters via legislation calling for national voter registration databases and a demand for photo IDs at the polls.

Increasingly, the mainstream corporate media and independent media sources have caught on to the "dirty tricks" being used by these GOP operatives though the cynically named ACVR.

We were pleased to see a recent article, penned by Dimitri Vassilaros, in the Pittsburgh Tribune-Review titled: 'Study' is political fraud. Vassilaros writes:

Not surprisingly, Vassilaros discovers that the Republican State Committee of Pennsylvania has values similar to the organizers of ACVR...

After November 2nd, 2004, there were increasing reports from elections officials, small local papers, and, yes, bloggers who had bothered to studiously examine official election results, The New York Times published several articles labelling such concerns by Americans as "conspiracy theories".

So we sent them a list of "15 Unanswered Questions" --- all of them based on hard evidence --- that we'd hope they'd investigate and report on to the American people. That was on November 21st, 2004.

One of those questions concerned a single county in North Carolina which had used the UniLect voting machine and, as we reported on November 4th, 2004, had completely lost a full 4,438 votes. Those lost votes later spawned a Special Election in Cartaret County, NC to re-vote some of the local issues because of it.

We had asked suggested to The Times that such hard facts were hardly "conspiracy theories" and we had hoped they'd be able to investigate and report on which other states and counties had been using the identical UniLect machines which --- company officials admitted --- had contained memory chips that stored fewer votes than they had told state officials.

Since UniLect machines were also in use in Ohio, we thought it was a particularly germane point. But apparently The Times didn't agree. They neither investigated, nor reported on the matter to our knowledge.

And now, months after the election, and days after the inaugural, The Charlotte Observer reports this morning that the same model of UniLect machines used in North Carolina were also in use in Pennsylvania and seem to have lost votes there as well [emphasis added]:

As well as lost and erased votes, there was also an unusually high rate of "undervotes" on the Presidential ballot where those machines were in use [emphasis again added] ...

"The voter's choices had vanished."

And we remind you again, The New York Times didn't find it necessary to look into which counties in Ohio used these same machines, if there were any lost votes or an unusually high rate of "undervotes" on them, presumably because such notions were simply the "conspiracy theories" of "leftist bloggers" as they had described them at the time.

That despite just 60,000 or so of 5.5 million in a single state (Ohio) which would have completely flipped a United States Presidential Election.

Repeating: Election officials and the voting machine manufacturer admit that 4,438 votes were entirely lost in just one North Carolina county where UniLect machines were used.

Repeating: UniLect machines were also in use in Ohio.

We will continue to press both the Mainstream Media, the States and the Voting Machine Companies to better serve the American Public whom they are failing to adequately serve at this time. But just in case you wonder why --- on January 23rd, 2005 --- this information is finally being reported by The Observer at all, it is because of inquiries in Pennsylvania that were demanded by the voters who spoke up, made noise, and created a petition to force their elected officials into taking action:

Your voice does matter. When you speak up.

We've set up VelvetRevolution.us to help you do that. Please visit and sign-up (it's free!), so you can speak up, make noise and take part in some upcoming actions that will be announced there in the coming weeks.

Count on no one but yourselves to make a difference.