Black Box: Diebold puts more files on NEW ftp site; someone hacks into it

[BevHarris]

That's right. It seems that someone figured Diebold might just stick its files on another ftp address, so they went looking. Found it. Apparently there was a password this time, but this person immediately bypassed that and downloaded all the files from Diebold ftp 2. Then they sent all the files to a major media outlet.

The files appear to be genuine. (Gosh. I'm in them. They refer to me as "Paranoid Bev" and the "Black Box problem.") No, I haven't seen them, but have had portions of them read to me over the phone by a reporter.

A particularly interesting section refers to a "bug" with the memory cards that hold the votes; when the votes are recovered, the audit log has disappeared. DeKalb County Georgia, I believe, and also one location in California.

These files have whole sets of interoffice memos, something that wasn't on ftp 1. I have also found that there were at least two ftp sites originally, so this find actually makes three ftp sites. Maybe there are some more ftp sites out there...maybe some old Global Elections employees liked to keep their own stash, who knows?

Bev

[NewYorkerfromMass]

1. "someone"?

Someone interested in exposing the fraud? an ally?

[Junkdrawer]

2. My advice would be to keep those files at arms length...

Hacking password protected company sites is almost certain to invite a DMCA probe and our current press sympathy may well evaporate.

[BevHarris]

4. LIghten up, JD. This was not done by anyone associated with BBV

And it is a huge media outlet, who is running a story on Diebold security. I'm not looking at the files, but they are fair game for reporters.

When you are touting a product that supposedly has bulletproof security, you damn well better have bulletproof security. Obviously, they didn't.

The press is handling this exactly right: As a security story.

Bev

[Junkdrawer]

5. Glad to hear no one from BBV was involved.

:thumbsup:

[punpirate]

6. Doesn't matter....

Do a Google for your name, and you'll find that forum pages are included. Check your PM.

Cheers.

[DagmarK]

14. Hell, if they can't keep their files safe from hackers......

what could happen to the files themselves?

this is just more corroboration of insecure nature of everything Diebold!

[GAspnes]

3. verrrrrrrrrrrrrry interestink

The inter-office memos sound like fun reading.

It would be fascinating to compare any differences between this version of the source code and the original stuff -- especially any code deleted in the later version.

[gristy]

7. Interoffice memos?

Why are interoffice "memos" on an ftp site? Are these emails?

Legitimate "memos", depending on what's written on them, are the kind of thing that gets the Justice Department (or a motivated State Attorney General) very interested.

[BevHarris]

8. I think this stash ends in March (before the last story broke)

Timing:

- Original ftp site files end Jan 26 2003
- Diebold ftp 1 was taken down Jan 29, 2003
- I broke the story around Feb 6. about Diebold ftp site
- I broke another story a week later about 22,000 patches
- I reported a week later about everyone lying about the patches
- I wrote another story a week later about Dan Spillane suing VoteHere and it was picked up nationally
- Newsday broke a story on Feb 28 about election.com Saudi ownership
- Miscellaneous stories all month about paper trail, Santa Clara county decision, David Dill.

Apparently the most recent files on this new site were dated in March 2003. I asked what the most recent version of the GEMS program was on that site; actually, the New Zealand files appear to have later versions.

I don't know if there was any source code on it. The quantity of files was only about a tenth of what was on the original site.

Bev

[Room101]

33. What was the Santa Clara county decision I'm one county over

?

[DrBB]

17. Given the kinds of things they say in their code comments

...about how shitty and ass-backward and stupid their own code is, I would expect some of those memos might make for some very embarrassing revelations indeed. T

[farmbo]

9. "Paranoid Bev"...has a nice ring to it...I smell a new DU monicker

...and you're in some good company, with other Diebold nemesises: "Delusional New York Times" and "Sociopathic Johns Hopkins University"

Great work...sit back and enjoy it!

[LifeDuringWartime]

10. why is diebold so stupid?

youd have to be retarded to put this kind of stuff on the internet

unless youre a whistleblower...hmm

[DEMActivist]

11. I don't think they ARE stupid

My feeling is that this is nothing but a setup. Not a game the BBV folks are willing to play.

Nothing about this makes sense at all. Why would ANY company, much less one that manages ATMs worldwide, put internal memos on a web site (secure or NOT).

[Vitruvius]

12. Naah -- it's not a setup -- just simple arrogance & stupidity.

If it were a setup, nobody could guarantee that those files would be found.

In addition, they sent it to REPORTERS, not to Bev Harris...

Don't be too scared to take advantage of good luck!

Vitruvius

P.S: Anybody who's worked for big business has seen worse screwups day in & day out, year after year after year.

[DEMActivist]

15. As an ex-IBMer, I'm here to tell you this is a setup

Plain and simple. Yeah, I've been in the corporate world, one centered on security.

This was NO MISTAKE.

[Gin]

18. Who are they seting up? Bev?...DU? all democrats??

I am extremely interested in all of this and it's all over my head.
What can I do as a concerned person to help the cause?

[DEMActivist]

19. The biggest thing you can do...

Is to alert your state representatives to the insecurity of these machines. If you state doesn't use them now, don't let them buy them. This is a state decision, not a federal one. Get involved with your state electors and Secretary of State to ensure these machines aren't used in your elections.

If they are in your state, demand a voter verified paper ballot. Demand to see your vote on a piece of paper, verify that it registered as you cast it and demand that paper ballots trump the computer version.

DEMAND THAT YOUR VOTE BE COUNTED AS YOU CAST IT.

on edit:
The setup is for Bev and her group of detectives.

[hunter]

22. It does smell like bait...

But at this point I don't think it matters. This was probably set up when Diebold thought they had a mouse-sized problem. Now they've got a tiger on their ass.

[Junkdrawer]

23. I'll second that. n/t

.

[bemildred]

35. Stinks a bit.

The comments in the code, are OK, I've seen that sort of
thing many times, but the "immediately bypassed" the ftp
password protection smells a bit like Hollywood hacking,
not the real world.

[hunter]

40. It's not "Hollywood Hacking..."

They put a very simple lock on the door so that when you break it and step inside they can accuse you of trespassing.

The Digital Millenium Copyright Act and the so-called "Patriot Act" are some really bad shit, even if you are a good guy wearing a white hat.

[Eloriel]

36. Eggsackly

Or maybe they will try to claim they haven't heard of email??

Eloriel

[DagmarK]

13. You are famous Bev!!! The Black Box Problem!

That's just so, so, how can I say it? Soooooo "deep throat" sounding. I can see it in the history books...and then came along "the black box problem" aka "Paranoid Bev"!

LOL

so, are you related to Paranoid Pat? Or are they confusing the two of you? LOL

Oh......this is great..... I just sure hope that the person who got those files stays SAFE (and unnamed) and that no media CEO intervenes on behalf of the BIG BOSS to make someone lose these...... Oh..... lots of dirty things can happen (and Paul Boutin would be ever so helpful, I am sure!)

BTW: Here's my letter to the MSNBC editors re Boutin's article:

Ltr to MSNBC editors

I caught the NYT story on the Diebold code. And I read the 26-page Johns Hopkins report. And I didn't get the feeling that they had been manipulated by the woman who found the code on the net and gave it to them.

But I sure do sense some antagonism from journalist Paul Boutin about the person who luckily found the code and passed it on -- regardless of whatever biases she has (if indeed she has biases; Boutin didn't quite clarify that).

Other than that strange detour from unbiased journalism (Does Boutin own a bunch of Diebold stock or something?), I am glad MSNBC covered this story. I don't have a good technical understanding about how all of this works, but I do know that there is a lot of controversy about the fairness of elections in this country. And whether there is validity for concerns or not, the very fact that a large portion of the voting public question the fairness is the threat to democracy.

It is crucial to the future of democracy that we go the distance to scrutinize all election processes to inspire confidence in the system. I do not understand Diebold's problem with that. Makes me think there *is* a red herring.

We need to keep looking at this until there are no more questions. I look forward to more articles on this sub

[punpirate]

20. Microsoft claims no editorial license...

... regarding MSNBC, but if you were the world's biggest seller of operating systems, and one of your OSs was used in Diebold machines, you might want to nip any nasty talk in the bud, yes?

Maybe even more so if you'd recently said publicly that you might just want to dip your corporate toes into the waters of electronic voting?

Cheers.

[ParanoidPat]

30. We're only related by the shared passion.....

.....to help the people 'see' how their votes get counted! :evilgrin:

MESSAGE TO DIEBOLD: If you really want to get us to buy your election systems it's really very easy. Simply build the system we want.

It's a 'no brainer', it's called responding to market forces. :shrug:

"We, the People, don't want the product you currently offer. We might be convinced to buy a similar system with an open source polling routine and custom OS that does only what it needs to, nothing more, nothing less. Add a printed ballot that allows them to be read by people in the event of questionable results arising from a machine malfunction or sabotage, and you can come out of this as a hero rather than the villain.

Think about it. The choice is yours. Go down defending your forever questionable product or follow that old business axiom, "The customer is always right!" :)

[arcane1]

16. "paranoid Bev" lol

"it's not whether you are paranoid, but whether you are paranoid enough

(paraphrase from Strange Days)

[cap]

21. get your rhino hide out, Bev...

you're going to need it to deflect these attacks. This is just the beginning.

[donsu]

24. kick

nt

[ret5hd]

25. kick

[goobergunch]

26. DeKalb GA...that's McKinney's old district

Georgia Senate Election Returns-recorded by Diebold

Chambliss  44,721 26% 
Cleland   123,689 73% 
Thomas (L)  2,335  1% 

Georgia Governor Election Returns-recorded by Diebold

Perdue   39,824 23%
Barnes  125,261 74% 
Hayes (L) 4,736 3%

[DEMActivist]

27. Just another piece of the bait

They know a lawsuit is pending in DeKalb County regarding the primaries.

None of these machines were used in Cynthia McKinney's race. This was BEFORE the Diebold machines were in general use and they were only used in 2 counties for that primary - not DeKalb.

The DeKalb reference makes me MORE ASSURED this is a setup.

[Gordon25]

28. Paranoid Bev

Bev - In Nam we used to say: You're only paranoid if they're NOT out to get you. :wow: :hi: These days I say if you ain't paranoid you ain't awake.
Gordon25

[ramblin_dave]

29. How do you know if the ftp site is for real

or if it is a setup as some suggest? Did the reporter give any details about what was done to check this out?

[hunter]

32. "Real" in what sense?

As in: Did the ftp sites actually belong to Diebold?

Or as in: Was the stuff posted on the ftp sites for "real?"

Personally I would like to have a Diebold touch screen terminal that was used in an actual election to dissect on my test bench, but that would not make me a "real" or even a credible source, and worse, I might be put in jail if someone somehow "procured" one for me.

This is a very complicated dance that's going on here...

[ParanoidPat]

41. Sounds like a classic 'honey bucket'....

....set up as a beautiful pile of shit to lure the unsuspecting! :evilgrin:

Anyone who gets by my router and firewall to do a netbios lookup sees, computer name: HNY_BKT, computer user: NO ONE, computer type: NONE AT THIS ADDRESS :)

[4dog]

31. Are you able to say more about the two original sites?

Just want to stay abreast of the gossip.

[BevHarris]

37. Yes, I'll say more: Complete brain fart on my part

I went back and looked up the old web page I found with the ftp site. It was a Geocities address.

Then I looked in the User Manual for Diebold where it says to go to the ftp site and download files "it's fun" "your tech has installed Cute ftp for you!" (interesting, isn't it, in view of the many denials from company officials that machines can connect to the Internet). In the User Manual it had a site with a gesn.com address.

Okay, I hadn't had my coffee yet. Duh.

The web page was Geocities, the ftp link on the web page led to gesn.com. There was only one site. Maybe I need to get more than three hours of sleep a night, ya think?

Using the wayback engine, here is the web page I found when I wrote the original story. It is the ftp archive on this web page that kept getting visits from around the world, downloading away. I originally found the web page in Google:

http://web.archive.org/web/*/http://www.geocities.com/Tokyo/Towers/2256/

By the way, some idiot with an agenda from Slate online magazine interviewed me, then must have thrown away his notes and made stuff up entirely. He writes that I found the above site while "obsessively looking for information to tie Diebold to George Bush."

Not. I told him the exact same thing I told all the other reporters, which is the truth: Because there is such a complete wall of secrecy around these machines, no one is able to look at one or even find out how it works. My publisher asked me if I could get my hands on a tech manual somehow. We were concentrating on ES&S at the time, by the way, and I had little interest in Diebold.

I went to the web and started trying to find voting machine technicians I could call. I found about 80 of them by doing a google search for everyone with the company email (this would be an easy way to find programmers to bribe, by the way. Some had posted to listserves that they were worried they were about to get fired, some posted their wedding photos and vacation plans, you got all kinds of information about the programmers).

Anyway, back to the story: I had gotten all the essvote.com emails I could find, and was looking at the gesn.com emails, which were for Diebold, once called Global Election Systems. On about page 15 of Google while collecting contact information for Diebold technicians I got a link to this page. I started clicking the links because I wanted to see what they'd written in their press releases.

Then I clicked the ftp link and there I was staring at directories full of files. I immediately called my publisher and said "What the hell am I looking at?" He got on the web at the same time and we sat discussing the files and meandering through them. There was no sign in, and no proprietary notice whatsoever.

We both called people; I called some of the activists, including the famous ones. I also called a lawyer, and asked about the subtleties of the law in this regard. He went to the site too, and said the way it was configured, it was clearly inviting people in, there were no restrictions posted whatsoever, and he advised me that both viewing and downloading the files was permissable, but there might be restrictions on using the files (which I have taken care not to violate).

To this day none of us know all the people who downloaded, and in subsequent research I found out that people have been downloading for years, including Diebold's competitors.

There you have it. More than you ever wanted to know, I'm sure.

Bev

[hunter]

39. Thanks Bev!

You are doing wonderful work... This is certainly not a "more than you ever wanted to know..." kind of story.

I believe the political ramifications of these discoveries will be greater than any of us expect, so it is very worthwhile to keep an adequate history. (Hopefully it will be a history we won't have to recall while defending ourselves in some Ashcroftian court!)

Peace

[Shakeydave]

34. Damn, I luv you!

Gonna find me a computer scientist here in Sarasota to check ours out!

[RedEagle]

38. OK, If All Those Files Were Accessible...

and....

"To this day none of us know all the people who downloaded, and in subsequent research I found out that people have been downloading for years, including Diebold's competitors."....

then, do we know that Diebold code isn't running in ES&S, Sequoia, or HartIntercivic?

We already can't know for sure what code is in each machine, what verison, all that. We also can't know if it's ES&S code or Diebold. Maybe the reason to leave the site open was to make it accessible to anyone who needed it, any time they needed it, without a complex system for communicating passwords around. And what better way to get local people with just enough savy to download and install, but not to know what they were looking at?
:shrug:

[BevHarris]

43. I think ES&S and Sequoia don't use Windows

and the Diebold stuff is all designed to run on Windows. I have wondered a lot about the real reasons the stuff was on ftps.

1) I agree with comment above that putting company memos on an ftp is extremely strange. Is it like a company bulletin board or forum? That would make sense (maybe) -- the ftp files might be the text log of a company in-house forum. But sticking memos up seems an invasion of privacy and quite strange.

2) As for ftp 1, I've wondered if one reason isn't that they use programmers in different countries. The ostensible reason is that it is a "workbench" that programmers can swap versions back and forth as they are working on them, and also that it is an "update" site that county election officials can use to update their programs. That doesn't explain why ftp 1 included:

- the entire Microsoft Windows System Developer Kit (SDK), which is supposed to be licensed and is certainly not supposed to be stuck on a public ftp site. I think the license is pricey, maybe someone knows how much? Sheesh, over 15,000 Windows source code files -- a bit odd, don't you think? Unless they were sharing them inappropriately...

- Other commercial software programs, including redistricting software

- Lists of names, home addresses and birthdates for about 100,000 voters in Texas

- Expense reports

You get the picture. It's almost like they used this as a public filing system.

Bev

[RedEagle]

45. Sequoia is a bit of a mystery....

Saw a Sequoia demo recently, had a blind voter try to use it. 25 minutes later this person still wasn't through. They used up/down buttons, not a keyboard, and I wonder how many of the blind can't use a keyboard? Anyway...

Sequoia salesperson says their machine does not have a modem.

Would have to tear one apart to test that statement.

However, the card reader you use before inserting the card into the voting machines does.

And while I'm trying to decipher my notes (own worst enemy), I note we were told the DRE doesn't use a Windows system, but I'm not sure about the card reader.

Just a thought. The claim can be made about one piece of the system. But there can be more pieces to the system.

And it sounded like counties or the state would incur annual maintenance license fees on software every year. Doesn't that sound like Microsoft?

And I have a note that "software loaded from Windows requirements."

OK, is that what the local officials use to construct the ballot, I don't have more info on that.

:shrug:

[dusty64]

42. Much more important than

another vegetarian bashing thread.
:kick:

[Eloriel]

44. Just a little

:kick:

Eloriel