Vote machine tests skipped, expert says

Professor testifies in lawsuit that seeks to bar use in Nov.

Ann Imse, Rocky Mountain News

Friday, September 22, 2006

Federal certification of some computerized voting machines skipped significant security tests, an expert witness testified Thursday in a lawsuit seeking to bar use of the machines in the November election in Colorado.

The testimony about the federal tests could undermine confidence in the equipment across the nation, not just in Colorado. It follows an announcement last week that Princeton University experts installed vote-distorting software in one such machine with just one minute of access.

In Colorado, a bipartisan group of citizens is suing Secretary of State Gigi Dennis, saying her office did too little testing to meet state law, and the machines are susceptible to tampering.

Deputy Attorney General Maurice Knaizer countered that Colorado also relies on federal and county testing, and the triple effort is effective.

Denver District Judge Lawrence Manzanares may rule on the case as soon as today.

Much of the state's defense centered on warnings that not allowing the machines to be used on Election Day could be disastrous since every county uses some or many of the machines.

The plaintiffs's attorneys said absentee ballots could be substituted.

If the judge rules against the state, he could bar the machines entirely or throw the problem back at the secretary of state. He could also order specific solutions, such as use of absentee ballots, or tighter physical security to prevent access by someone seeking to install distorting software.

The machines in question are manufactured by Diebold, Hart, ES&S and Sequoia. Voters mark their ballots on a computer screen and the votes are counted electronically.

Colorado has begun requiring the machines to make a backup printout, but not all will have that feature available in November.

Rice University professor Dan Wallach testified that one federal test on a Hart machine was supposed to check for protection against malicious software such as a virus. It was marked, "not tested."

Similarly, a check on the security of data being transmitted back to vote-counting headquarters was marked "not applicable," even though that feature is available and is used, Wallach said.

Some federal security tests also were skipped on an ES&S machine, Wallach said.

The plaintiffs' attorney, Paul Hultin, said Wallach's testimony exposed the "Wizard of Oz" in certification of the machines - that federal testing is merely "a pathetic little man behind the curtain, who does nothing."

Wallach said the state's certification of the machines was also faulty because it skipped some basic security checks that would routinely be used on computerized equipment.

County officials called as witnesses by the state said they test machines after purchase, but only to see if they work, not to look for vulnerabilities.

The county officials testified they have locks, access logs and surveillance cameras to keep hackers away from the machines.

Mike Lyons, systems coordinator for the Douglas County clerk, said the Hart machines used there performed well in the August primary. Only one of 285 failed, and it counted its votes before it stopped working, he said.

Results from outlying vote centers were transmitted in one- to two-second bursts to the central counting station, and "by 7:10 p.m., the results were there. I was ecstatic," Lyons said.

Rudolfo Santos, election manager for Weld County, said the loss of the Diebold machines used there would be "an absolute disaster."

He said that wasn't enough time to print an additional 120,000 paper ballots just seven weeks before Election Day.

imsea@RockyMountainNews.com or 303-954-5438