TELECOM Digest OnLine - Sorted: Diebold Source Code Leaked Once Again

Diebold Source Code Leaked Once Again

Robert McMillan, IDG (idg@telecom-digest.org)
Wed, 25 Oct 2006 17:28:15 -0500

by Robert McMillan, IDG News Service

Source code to Diebold Election Systems voting machines has been
leaked once again.

Last week, former Maryland state legislator Cheryl C. Kagan was
anonymously given disks containing source code to Diebold's
BallotStation and Global Election Management System (GEMS) tabulation
software used in the 2004 elections. Kagan, a well-known critic of
electronic voting, is Executive Director of the Carl M. Freeman
Foundation, a philanthropic organization based in Olney, Maryland.

The disks were created and distributed by two federal voting machine
testing labs run by Ciber and Wyle Laboratories. They had been testing
systems on behalf of the state of Maryland, Diebold said in a
statement.

Earlier Breech

This is not the first time that Diebold source code has been
leaked. In early 2003, Diebold critic Bev Harris uncovered similar
source code while conducting research using Google's search engine.

Soon after, researchers at Johns Hopkins University and Rice
University published a damning critique of Diebold's products, based
on an analysis of hacks to the software.

They found, for example, that it is easy to program a counterfeit
voting card to work with the machines and then use it to cast multiple
votes inside the voting booth.

Diebold says it has since introduced security enhancements to its
products, but the fact that the company's sensitive source code has
again leaked out and been hacked is not a good sign, according to Avi
Rubin, a computer science professor with Johns Hopkins and one of the
authors of the 2003 report.

The first leak should have taught Diebold a lesson on securing its
source code, he said. "You would think that given the amount of
embarrassment that caused them, they would do a better job of
protecting it."

Evaluating Criticism

Rubin, who was shown the latest source code by a reporter at the
Washington Post, said that it appeared to be "just another version" of
the code that was published in 2003.

The disks came with a letter that was highly critical of Maryland
State Administrator of Elections Linda Lamone, Rubin said. "It read
like it was from somebody with a very, very serious axe to grind," he
said. "It was one of the more outlandish things I've read." The
researcher has commented further on the source code leak on his blog.

Rubin believes the disks were given to Kagan because of her past
criticism of electronic voting machines. "I guess whoever did this
knew she would pursue it doggedly, which she did."

Diebold said the source code was for BallotStation 4.3.15C, which is
no longer being used in the U.S., and for GEMS 1.18.19, which is being
used in a "limited number of jurisdictions."

The FBI is investigating the leak, Diebold said.

Ready for Election

The leak comes with just three weeks before elections in the U.S., but
Maryland Board of Elections Deputy Administrator Ross Goldstein
expressed confidence in the Diebold voting machines. The leaked code
was "not software that's in use in this election," he said. "The
software now is different and has many more security features."

Diebold echoed Goldstein's comments. "Voters and election officials
can be confident that on Election Day, votes and vote totals will be
safe, secure and accurate," the company said.

Kagan, however, wasn't so sure, saying that the security of the source
code raised concerns. "The idea that it could be that readily
available and could be delivered to me and who-knows-who-else around
the state [is disturbing]," she said. "Who know what any other people
may be doing with it?"

Copyright 2006 PC World Communications, Inc.

NOTE: For more telecom/internet/networking/computer news from the
daily media, check out our feature 'Telecom Digest Extra' each day at
http://telecom-digest.org/td-extra/more-news.html . Hundreds of new
articles daily. And, discuss this and other topics in our forum at
http://telecom-digest.org/forum (or)
http://telecom-digest.org/chat/index.html

For more news and headines, please go to:
http://telecom-digest.org/td-extra/technews.html

Post Followup Article Use your browser's quoting feature to quote article into reply
Go to Next message: Michael Tarm, AP : "Chicago Voter Info Vulnerable to Hackers"
Go to Previous message: Jonathan Keehner: "Hackers Disrupt On-Line Brokers"
Next in thread: Scott Dorsey: "Re: Diebold Source Code Leaked Once Again"
May be reply: Scott Dorsey: "Re: Diebold Source Code Leaked Once Again"
May be reply: jmeissen@aracnet.com: "Re: Diebold Source Code Leaked Once Again"
May be reply: Scott Dorsey: "Re: Diebold Source Code Leaked Once Again"
May be reply: mc: "Re: Diebold Source Code Leaked Once Again"
May be reply: Dave Garland: "Re: Diebold Source Code Leaked Once Again"
May be reply: Scott Dorsey: "Re: Diebold Source Code Leaked Once Again"
TELECOM Digest: Home Page