Black Box: Georgia Libertarian Party files records request on Diebold

[BevHarris]

NEWS RELEASE
Georgia Libertarians request Diebold docs; California Republican does too; so do Arizona Democrats
http://www.blackboxvoting.org

AUG 7 2000 -- The Libertarian Party in Georgia filed a formal request for records pertaining to the Diebold voting machines used in the November 2002 general election. In Alameda County, California, a Republican filed a Public Records Act Request, also seeking documents pertaining to the Diebold voting machines. And the Pima County Democratic Party, in Arizona, has also launched proceedings to investigate the use of Diebold optical scan machines.

Diebold machines are used in 37 states. Maryland has just purchased machines statewide, and Ohio will make a decision on whether Diebold will be the preferred vendor by Aug. 15. Utah is also considering the touch screen machines, and San Diego County committed to buying 10,000 Diebold touch screens last week.

In Georgia, unexamined program changes were made to all 22,000 voting machines shortly before the Nov. 2002 general election. State officials claimed there was no need to look at the “patches” because they made changes only to the Windows operating system which underlies the voting software. However, Bev Harris, author of Black Box Voting: Ballot-Tampering in the 21st Century, wishes to differ.

“I have a copy of two of the program patches,” says Harris. “One of them is called ‘rob-georgia.zip’ and in this is a folder for the GEMS voting program that says ‘replace GEMS files with these.’ Another folder instructs technicians to overwrite Windows operating system files. Harris says the Windows files were significantly altered from the original Microsoft version, a violation of FEC regulations unless specifically disclosed and examined. Windows changes can be used to set up specific pathways to enable hacks into the machines, especially if there are changes in Remote Procedure
Call (RPC) and ActiveX functions.

EXCERPTS FROM GEORGIA RECORDS REQUEST:
http://www.blackboxvoting.org/ORA-Request-Georgia.pdf

1) Was the Windows Operating System, as used on voting machines certified for use in the 2002 Georgia general election, represented by Diebold/Global as being unmodified commercial off-the-shelf software?

2) If not, was the Windows Operating System, as used on voting machines certified for use in the 2002 Georgia general election, represented as being modified by third parties such as Diebold/Global, or BSquare Corporation or any other organization?

3) If not, was the Windows Operating System, as used on voting machines certified for use in the 2002 Georgia general election, itself specifically certified for such use?

4) Did any Georgia certifying authority conduct tests to independently verify whether any modifications were made to items represented to be commercial off-the-shelf software?

5) Did any Georgia certifying authority certify whatever modifications may have been made?

Please provide written certification documents, pertaining to all of the above questions. Please include the precise names and version numbers of the software involved.

The purpose of the California records request is “to evaluate the logistics of doing an on-site inspection of the Diebold software and data handling at the County Registrar's office.
http://www.equalccw.com/voteprar.html

Pima County actions focus on evaluating the appropriateness of Diebold machines in view of the security flaws found by Harris.

==============================================================
Related news:
1. True cost of a voter verified paper trail: All major touch screen manufacturers already sell machines that have a printer in them. The issue is simply putting paper in the printer. A large precinct may have as many as 3,000 voters. The cost of paper for a precinct this size is about $15.

2. Federal funds promised under the HAVA act may not be fully realized, making mandatory purchase of voting machines into another unfunded mandate. http://www.govexec.com/dailyfed/0803/080403nj1.htm

3. The state of Maryland has hired defense contractor Science Application International Corp. (SAIC) to conduct a review of the Diebold voting system. SAIC is also involved in electronic voting, SAIC was hired by Diversified Dynamics, another defense contractor, to make voting machines. (Yet another defense contractor, Northrop Grumman, has also entered the electronic voting business.) SAIC has also marketed electronic voter registration systems, and has had two board members who are now on the board of VoteHere.

# # # # #

[Robbien]

1. Really? This is good news, yes?

Small thing, your dateline is listed as August 7, 2000.

[BevHarris]

3. Whew -- looked at the blast that went out, date was 2003

This was cut and pasted from an earlier version. That would have been embarrassing.

[0007]

2. I hope this can get some steam!

I'm starting to think that we're getting smothered by the highest.

[BevHarris]

4. I gave the information on research in the SAIC thread

to reporter Lynn Landes, who did the chapter for BBV on voting company ownership for companies with ties to the military-industrial complex. I'm going to see what she'll do with it -- she's willing to go more strongly on the military-industrial angle than I should.

Will keep you posted on that one.

Yes, this is VERY good news about the FOIA requests. Understand that the Windows request should give fascinating answers.

1) If they say it was changed but not certified, that's illegal
2) If they say it was not changed...ahem, some computer people would like to show you some files...
3) If they say it was changed and certified: Show us the documents and what the changes did
4) If they say they did not check, since the files were changed, that debunks the certification process

Pay very close attention to this one. The changes in Windows, depending on exactly what they do, may best be described as not a bug, not a feature, but a hack.

Bev

[Mairead]

12. There is one change that would be GOOD

And that's closing port 135, the RPC port. Port 135 appears to be open by default, on Win2K at least, which is a major exploitable vulnerability for which M$ put out a patch (I'm doing this from memory, though, so you might like to check).

[ibegurpard]

5. Excellent

A great reminder that the the vulnerability of these machines is a non-partisan issue that EVERYONE should be concerned about.

[BevHarris]

6. The hidden menace in this request:

No matter what the answers are, they will document that laws have been broken. The only question is: how many and which ones.

The Windows issue may sound a bit arcane, but it is, in my opinion, the most dangerous issue of all for Diebold. Stay tuned.

Bev

[RedEagle]

7. Aiding and Abetting Crime by Maryland's Secretary of State?

Hey, wasn't it Maryland's Secretary of State that told you that they had found the open Diebold ftp site and weren't worried about it because they told Diebold not to use any files from it on their machines? But those files are the certified version, so how could they not use them....

If that is the case and those files are on the machines....

And if that is the case, and the site was a wide open security breach, didn't the SOS have a duty to report it? Would it be criminal negligence to not have done anything? I mean, she admitted she knew about it.

What was to prevent anyone in Maryland from downloading from those files to indivdual machines?

Is she another SOS on NASED or FEC committees?

Was Maryland supposed to go through a RFP or RFQ process, was this circumvented?

Weren't there objections by other people in the state to the purchase of these machines? If so, and they were ignored, then why should the state of Maryland pay anyone to whitewash the SOS decision to cover someone's aft landscape? Shouldn't the people with the previous objections be raising heck right now?

[BevHarris]

8. Well goodness, I wish you were a reporter. We could use more like you

I had to fax questions to reporters to get them to ask Diebold anything (it did seem to result in Diebold reversing their stand on their lie "the source code they studied was never used in any election") -- questions suggested to reporters were: What version number was used? What version number is certified? What version number is in the source code?

If more reporters asked questions like you just did, things would turn around in a hurry.

They don't seem to pay a lick of attention to taxpayers asking the same question. Perhaps a letter to the editor?

Bev

[RedEagle]

11. Go Ahead and Fast Blast Those Questions to Maryland Media Outlets...

... along with a few select quotes you already have documented from the Maryland Secretary of State.

Who, What, Why, When, Where, How?

Geeeezz, it's been YEARS since Journalism 101, wasn't my main area of study, and I can still remember that.

Guess I'm getting too old and the journalism schools, "helped" by entities backed with money on how to teach journalism, must have different standards they go by nowdays....

Or is is just an appalling lack of curiosity rampant in our country now?

It's a sad state when professionals in other fields and ordinary citizens do a better job at stories than our glorified media.

[starroute]

9. The Maryland/SAIC story is now up on Slashdot

"We already knew Diebold software is insecure, now the Baltimore Sun is reporting that the Governor of Maryland has asked SAIC to review the software in Diebold voting machines. Diebold has graciously allowed SAIC access to their proprietary code. Why isn't this code open source by law?"

http://slashdot.org/articles/03/08/07/1350208.shtml?tid=103&tid=185&tid=99

[alfredo]

14. Diebold machines are used

in Jefferson county in Kentucky. My cousin is a state rep from that county. I will start hammering away at this.

[BevHarris]

28. Good. If your rep thinks they are secure, you can give him

the three Jefferson County files that were left sitting on the ftp site. Oops, make that six.

JeffCoKYGen2002.ZIP
JeffCoKYxfer.ZIP
JeffCoMakeUp.zip
JeffersonCoKy.zip
JeffersonCOKYWithAudio.zip
JeffersonKYAudio.zip

(one of their favorite things to say is "but each election is configured differently and someone trying to rig would have to know exactly how the ballots are set up and everything."

Guess what? They've been parking that stuff on the web for Jefferson County, Kentucky.

Bev

[Gordon25]

10. A tool for stopping state purchase of Diebold systems

This is a repost of something I put up late last night which doesn't seem to have been noticed much. I think it may be valuable. Here in Arizona, we have found a powerful tool for preventing the state from buying Diebold Machines, and it might be usable in other states.

If your state is considering a purchase of Diebold systems in accordance with Help America Vote Act requirements, there may well be a way to stop it. Get a copy of the Request for Proposal (RFP) put out by the state for voting equipment. One is published prior to any significant purchase and they are public records. Any library or elected state representative can tell you how to get it. Then read it carefully.

When we did that here in Arizona, we found two very significant things. First: it appears there are no systems available which comply with the requirements in the HAVA Request for Proposal!

The HAVA RFP states that the new equipment and software must comply with HAVA. HAVA requires systems to comply with the Federal Standards in place on Oct. 29, 2002, the date HAVA went into effect. The 2002 Federal Standards were approved on April 30, 2002.

Hence, systems purchased under this RFP must comply with the 2002 standards.

There exists a list of approved systems on the National Association of State Elections Directors (NASED) web site. NASED sets certification standards. Inspection of the list shows they were ALL approved under the old 1990 standards. Unless the web site is wrong, or the Independent Testing Authorities are all working flat out to requalify these systems under the new standards, it seems doubtful there are any systems which can be procured under the HAVA RFP.

Secondly, in our case, the HAVA RFP item 5.4.7.3 (from its section on security ) asks: “Has the system experienced any security-related exposures? If so, describe the exposures and what corrections were made."

This requirement means they MUST notify the state about the Harris Report, the Rubin Report, and the fact that its source code is freely and publically available on the internet. Since the only ways to make "corrections" involve extensive rewriting of major sections of code, any such corrections would necessitate recertification under the new 2002 standards. Thus no purchase of their system is possible without recertification.

We have legislators at work on this. Read your RFP. If it requires adherance to HAVA, any system purchased must meet 2002 standards. Pitch it to you representative as a way to be a hero and keep the state from wasting tens of millions of tax payer dollars.
Hope this is of some help.

Gordon25

[Eloriel]

13. Brilliant!

I think you should start a new thread -- or resurrect the old one if you posted this as a thread. Lots of people need to see this. We'll help keep it kicked.

Thanks!

Eloriel

[grasswire]

15. all excellent news

I wonder if the people at slashdot know the scope of SAIC, and know that SAIC also is involved in voting machines/software.

[artr2]

21. I cut & pasted Bev's original post about SAIC and got someones ...

panties in a bunch - looks like someone who works for SAIC

[jimmynochad]

20. Some personalRFP knowledge

All RFPs have clauses that get around the HAVA requirement. As long as the system is in testing at NASED, then the company can bid. All purchasers reqest custom reports and formats that have to go back through certification which is why they don't make certification an entrance requirement.

FYI, Diebold is a finalist for the AZ RFP.

[Gordon25]

22. True, they can bid, but...

Good comments, and when you say "As long as the system is in testing at NASED, then the company can bid." you are correct. (Except that the testing is done at Ciber, Inc. to NASED standards). However, that doesn't change the basic situation. They can bid, but as long as the RFP requires compliance with HAVA then it requires compliance with 2002 standards. So while they can bid, short of recertification of the software to 2002 standards, they can not be awarded the contract. And most RFPs have a security breach disclosure clause. With their source code all over the internet, and the security flaws exposed in the Rubin and Harris reports, there is no way thier current system is acceptable. In fact, decertification of it is almost a certainty with time.

However, we do not know if Diebold has an entirely new system with all new source code (which would be the only acceptable solution since the source code for their earlier certified system is now all over the internet) in testing at Ciber, Inc. My guess is they do not, or they would have touted it as a way to defuse the Rubin study story. And if that were the case, I suspect they wouldn't need to be going to SAIC for credence.

With the people in the Arizona legislature who are now aware of this situation, and with those additional representatives who will be aware of it soon, any attempt to award the contract to Diebold will almost certainly result in legal action to enjoin the award until legislative hearings can be held and Diebold be forced to answer, under oath, all the questions we have been asking.

Gordon25

[BevHarris]

25. Thanks, Gordon -- I transferred this into the BBV activism forum

where it will last longer.

[Gordon25]

26. Tip o' the hat. n/t

[DagmarK]

43. Gordon, that's brilliant! I will do that for Oregon.

Thanks for reposting this.....I missed it the first go around.

[alfredo]

16. Wired in the case

they will not let it die either.

http://www.wired.com/news/privacy/0,1848,59925,00.html

[Hubert Flottz]

17. The Devil went down to Georgia;

He was lookin' for votes to steal
In political bind;
Had a greedy mind;
And a job that wasn't quite real;
But he came down on a mission;
Though he was dumber than a hickony stump;
And said, "Boy" let me tell you what;
As all hands he started to pump;
I guess I didn't show it;
But I'm a uniter too;
And if you'd care to take a dare;
I'll make a crooked bet with you;
Now you played pretty good politics,boy;
But give the devil his due;
I bet my Nazi gold against your soul;
Cause daddy sez I'm better than you;
The boy said "My name's Jimmy;
And it might be a sin;
But I'll take you bet, your gonna regret;
Cause you're the worst rez that's ever been";
And so on!

Jimmy Carter needs to get the UN to look at the election in Georgia and Florida!

[BevHarris]

24. LOL! I have to remember that as a headline

Great verses, too

Bev

[Hubert Flottz]

29. Bev, I can't begin to tell you how much I admire your work!

I salute your tireless effort and I think it WILL pay off bigtime! I've passed your story around the net and every one I've shown it to becomes excited, energized and grateful for your good work! Keep on Truckin'!

[Eloriel]

18. OMG -- Look at this info from Dan Spillane -- More connect the dots

http://www.democraticunderground.com/discuss/duboard.php

Eloriel

[Junkdrawer]

23. Better link:

http://www.democraticunderground.com/discuss/duboard.php?az=show_topic&forum=102&topic_id=55469&mesg_id=55469

[RedEagle]

27. You have to go further than this link to the amendment record

Dan has a link to an amendment proposed by Ensign. If you click round on the other sites that you can link to, you get to read that there was an original amendment, then a MODIFIED amendment. That modification pretty much took all the starch out of it.

On that day, somewhere between the morning session and afternoon, Ensign's amendment was modified.

And we got what we got in HAVA.

[Character Assassin]

19. But, but, but....they're all dope-smoking republicans! This can't be good

[RedEagle]

30. Sending this one up front too...

Kick

[Robbien]

31. Diebold got hacked again! story is in Wired 8/7

A hacker read about Bev getting the source code, so tried to hack the Diebold site himself and got employee e-mail. This can only be good news right? Link in LBN.

Ha! Diebold had to shut down its website.

[rhite5]

32. Kick!

[BigLed]

33. Kick it

Bottom of page 2 as I do this. We need to keep this up front.

[Liberal Classic]

34. Bits are not votes. Give us paper ballots.

The electronic voting machine in my area left me less than impressed. There were twice as many lines to wait in to use the machines, and the machines themselves were designed to be easy to use but ironically they were less user-friendly than any orginary teller machine or kiosk.

EDIT Go Libertarians!

8)

[4dog]

35. Does anyone have dirt on Sequoia to slow down..

use of their machines? Or at least enforce the use of the voter-verified paper ballot. (Recently bought in at least some part of NJ) I don't think I'm personally up for a lawsuit but at least I could alert some of my local legislators.

[BevHarris]

36. Sequoia has miscounts just like all the others

and with the touch screens, you never really know what the count should be. In New Mexico, the machines forgot to count 25% of the votes in one election, and in Snohomish County, Sequoia machines missed counting 21% of the votes. The difference was that in New Mexico, there was no record of the votes so they had to ask a tech what to do. The tech e-mailed the results. (you heard me).

In Snohomish, the missing votes were in the absentee ballot count, so they did a recount and recovered them all.

Also, Sequoia has had more run-ins with the law than most other companies, and had an executive indicted (then charges were dropped) in a bribery prosecution. Another Sequoia official, Kathryn Ferguson, was accused of both bid-rigging and election tampering, but the lawsuit ended up going nowhere.

A Sequoia machine in Louisiana was videotaped by a candidate registering votes over and over for the opposite of who the voter cast the vote for. The video of this can be found in Dan Hopsickers video, "The Big Fix 2000." (Mad Cow Productions, available online, and well worth the investment if you find yourself going up against Sequoia; this video is filled with investigative details. Go to http://www.madcowprod.com/videos.html

Bev Harris
http://www.blackboxvoting.org
Have you signed the Carter letter yet? A plea from an American voter...http://www.blackboxvoting.org/petition.htm

[Jim March]

37. No offense, but you've missed something here...

When we successfully expose the Diebold software as a fraud at worst, horribly flawed security at *best*, realize who else we're targeting: the Feds who were supposed to have tested this crap.

In other words, if the Diebold product is junk, no other such program lacking open source and a paper trail can be trusted if the same Feds were involved in the "certification".

I therefore advocate focusing on Diebold rather than getting distracted going after Sequoia or whatever.

[BevHarris]

39. Thank you. And you're right --

As the flaws of Diebold become more thoroughly vetted, we'll see that, if the concept of ITA certification really protects us from flawed or crooked products, this product could not have been certified.

It is not that the other systems are any better than Diebold -- it is that Diebold's system is the only one we've been able to examine. Dr. Rebecca Mercuri has had a little more opportunity to examine Sequoia than the rest of us -- she has been an expert witness in cases with Sequoia -- and she has grave concerns about the viability of Sequoia as a secure and trustworthy system.

You may be able to find some of these at http://www.notablesoftware.com

Our best chance, though, is to thoroughly vet Diebold, as quickly as possible.

Bev

[papau]

44. Welcome to DU, Jim

And thank you for helping Bev.

:-)

[Jim March]

38. Alameda County responds - with a stonewall

Alameda County's response to my PRAR (California Public Records Act Request) is online as of late Friday the 8th of August:

http://www.equalccw.com/alamedaprarresponse.pdf

See last URL below (in my tagline) for the PRAR this is a response to.

A small amount of the county's response might be on target, but most is utter BS. I'm in the process of looking up the code cites listed and will have a more formal response soon (definately by Sunday, I'm aiming for earlier).

I'm going to file a follow-up PRAR that, among other things, will ask for the contracts with Diebold. Let's see what sort of exotic secrecy clauses are really in there. I expect to have the revised PRAR done by Sunday at the latest, ready to file Monday (8/11).

The good news: we can analyze the Bev Harris allegations just by looking at a set of actual vote data files from the last election. Big problems are coded into the database structure, particularly the lack of audit trail item numbers and the "duplicated data structures" pointing to a "double set of books problem" (actually triple set, 'cept we don't know what set #3 does).

---------------

There's a comment I need to make here. Yes, I'm a regular at www.thehighroad.org, and yes, I'm a gun rights activist. But that's not why I'm here on DU - this is "ground central" for discussing Bev Harris' activism and findings. Hence, I'm not going to talk gun stuff here - don't even bother trying to lure me into all that.

That aside, it might interest y'all to learn that the THR crowd is JUST as concerned with the implications of Bev's findings as the DU crowd is:

http://www.thehighroad.org/showthread.php?s=&threadid=33256&perpage=100

So yes, in this case, the majority of the folks on both DU and THR are 100% in agreement :D. More seriously, a lot of us on THR may be Republicans (with the rest either Libertarians or libertarians (note case on the first character)) BUT we're smart enough to know that even if the first generation of mass-scale election cheater politicians are OK (highly unlikely), the next batch...well, we'll end up having to choose between shootin' 'em or "life" in a concentration camp (grrrr).

[BevHarris]

40. I think I speak for everyone in saying that you are welcome here, Jim

And by the way, there are several gun rights people on this list.

Your contributions, through your records request and follow up, to the voting machine issue are substantive and of great interest to many here.

Thanks for posting the response you got -- I'm off to take a look! Welcome to DU.

Bev

[DrBB]

41. Thanks Jim--and yeah, not all gun rights people are right wing

We seem to have a pretty strong contingent on DU, though I guess I'm not one of them. In any case, your input is valuable and welcome.

[Mairead]

42. "there are several gun rights people on this list"

Yes indeedy...many, perhaps most, strong 'leftists' (e.g. Sam Smith of Progressive Review) are very strongly pro-BOR, very much including the RKBA.

Welcome to DU, Jim.

[DagmarK]

45. Yes, lots of pro gun folks on DU........BUT

it seems we don't mix guns with the rest of our politics......and if you ever want to talk up some about guns...go to the Justice forum.

:-)

Welcome to DU Jim. VERY glad to see you here. And very glad that folks from 'the other side of the aisle' are as disturbed about the voting machine stuff.

You are correct in the worry about what the 2nd generation of 'winners' may signal for this country.

(Wow......those are some smart people over at THR! Impressive!)

[Eloriel]

46. Jim -- A hearty welcome, and a big thank you

It's a great relief to people like me to see evidence that there are people across the political spectrum who realize this is a non-partisan issue and are taking action. Such a relief I've got tears in my eyes.

Thanks for your efforts AND for ginning up enough courage to come here to DU to post. :evilgrin:

Eloriel

[DagmarK]

47. It *is* a breath of fresh air to see this move into "non-partisanship"

'cause frankly, if it were just a dem contingent trying to get to the bottom of it, there is that ridiculous rhetoric that we just can't get over the SCT appointing Bush Jr. (Okay, we can't get over it......but that's not what motivates our concerns in the voting machine issues.)

It does bring tears to one's eyes......

(Eloriel, check out the link Jim gave for THR. That is a brilliant group of people over there.....and a team I'd want on my side any day!!)

[Trajan]

48. Hey Jim ....

We do have our share of 'gun nut' types here in DU, and some of us 'leftists' do battle rhetorically with them occasionally ..

But: THIS issue, like you said, is one that transcends petty bickering of even Second Amendment issues, and cuts to the CORE of a Democracy ....

THe right to have your vote HONESTLY counted, is the most basic right we possess ... Democracy means NOTHING if the ballots are not properly accounted ...

Bev Harris is the center of gravity on this issue, and we are proud of the stupendous efforts made by her AND many others here to bring this issue to the fore ...

Thanks for your contribution, Jim ...

[RedEagle]

49. Across the board

Welcome Jim.

I'm an Independent myself. (Coming out about that!)

We have a growing state group made up of all kinds, including Greens, although, to date, not to many GOP, which makes me sad. I think our state GOP leader is responsible for some of that.

I am SO HAPPY this is getting to look more like the nonpartisan effort it is!:bounce: :bounce: :bounce: :bounce:

[ursacorwin]

50. gun owning lesbian here,

jumping in to welcome and thank you jim.

the DU tent is stuggling, but evolving into a truly big tent place. we have our flame outs, but mostly in the spirit of debate and tolerance, even if that tolerance is birthed painfully.

kick!

[Jim March]

51. FOLLOW-UP PRAR IN ALAMEDA TO BE FILED MONDAY 8/11!

Take a look; all comments on this VERY welcome, barring suggested changes this gets filed Monday (it's very early Sunday as I write this).

Since the formatting is rather critical to understanding it, here's links to the Acrobat PDF version:

http://www.equalccw.com/alamedafollowup.pdf

...and the same in HTML:

http://www.equalccw.com/alamedafollowup.html

Again: criticism or suggestions for other things to look for welcome.

Note that the request for the purchase orders *should* include the hardware listings, including modems. Not guaranteed though.

If the results of this query show problems, hopefully we can force even more digging. At some point, we need to physically inspect the vote-count system; I'll try and do that on 8/11 when I'm dropping the revised PRAR off at both the county attorney's office and the registrar's office.

My "voteprar" page in my tagline has been updated with links to the above, and a link to the county's initial response.