Diebold code leaked again
Diebold source code leaked again Another breach on the e-voting front as elections near Robert McMillan
October 21, 2006 (IDG News Service) — Source code to Diebold
Election Systems Inc. voting machines has been leaked once again.
On Wednesday, former Maryland state legislator Cheryl C. Kagan was
anonymously given disks containing source code to Diebold’s
BallotStation and GEMS (Global Election Management System) tabulation
software used in the 2004 elections. Kagan, a well-known critic of
electronic voting, is Executive Director of the Carl M. Freeman
Foundation, a philanthropic organization based in Olney, Maryland.
The disks were created and distributed by two federal voting machine
testing labs run by Ciber Inc. and Wyle Laboratories Inc. They had
been testing systems on behalf of the state of Maryland, Diebold said
in a statement.
This is not the first time that Diebold source code has been leaked.
In early 2003, Diebold critic Bev Harris uncovered similar source
code while conducting research using Google Inc.’s search engine.
Soon after, researchers at Johns Hopkins University and Rice
University published a damning critique of Diebold’s products, based
on an analysis of the software.
They found, for example, that it would be easy to program a
counterfeit voting card to work with the machines and then use it to
cast multiple votes inside the voting booth.
Diebold says it has since introduced security enhancements to its
products, but the fact that the company’s sensitive source code has
again leaked out is not a good sign, according to Avi Rubin, a
computer science professor with Johns Hopkins and one of the authors
of the 2003 report.
The first leak should have taught Diebold a lesson on securing its
source code, he said. “You would think that given the amount of
embarrassment that caused them, they would do a better job of
protecting it.”
Rubin, who was shown the latest source code by a reporter at the
Washington Post, said that it appeared to be “just another version”
of the code that was published in 2003.
The disks came with a letter that was highly critical of Maryland
State Administrator of Elections Linda Lamone, Rubin said on his
blog. “It read like it was from somebody with a very, very serious
axe to grind,” he said. “It was one of the more outlandish things
I’ve read.”
Rubin believes the disks were given to Kagan because of her past
criticism of electronic voting machines. “I guess whoever did this
knew she would pursue it doggedly, which she did.”
Diebold said the source code was for BallotStation 4.3.15C, which is
no longer being used in the U.S., and for GEMS 1.18.19, which is
being used in a “limited number of jurisdictions.”
The FBI is investigating the leak, Diebold said.
The leak comes with just three weeks before elections in the U.S.,
but Maryland Board of Elections Deputy Administrator Ross Goldstein
expressed confidence in the Diebold voting machines. The leaked code
was “not software that’s in use in this election,” he said. “The
software now is different and has many more security features.”
Diebold echoed Goldstein’s comments. “Voters and election officials
can be confident that on Election Day, votes and vote totals will be
safe, secure and accurate,” the company said.
Kagan, however, wasn’t so sure, saying that the security of the
source code raised concerns. “The idea that it could be that readily
available and could be delivered to me and who-knows-who-else around
the state [is disturbing],” she said. “Who know what any other people
may be doing with it?”