NC Board of Elections Helps Diebold Subvert the Law!

[KoKo]

Thanks to DU'er Kelvin Mace (1000+ posts) Mon Dec-05-05 03:01 PM
Original message
{b]NC Board of Elections helps Diebold subvert the law


http://news.zdnet.com/2100-9588_22-5980671.htm
North Carolina defends e-voting certifications
ZDNet

It has been a turbulent week for electronic voting systems in North Carolina.

Watchdog groups say the state "illegally" certified systems built by two e-voting vendors just days after one admitted it couldn't meet stringent new laws about disclosing its source code. Meanwhile, a voting-systems manager defended the decision to award the contracts.

At the heart of the issue are new rules, issued by the state's board of elections in October, that require all e-voting vendors applying for contracts with the state to deposit "all software that is relevant to the functionality, setup, configuration and operation of the voting system" and the names of all programmers responsible for its creation with a third-party "escrow agent" approved by the state government.


The law also requires that the code be examined by the SBoE prior to certification.

Diebold, an Ohio-based company that also makes automatic teller machines, filed a court complaint objecting to the requirements. It insisted that not all of its code could be turned over because some of it belonged to third parties, such as Microsoft, which would be loathe to disclose it and already store it in their own separate escrow accounts.

"We don't know how we'd provide source code for Windows CE or whatever third-party vendor it may be," David Bear, a spokesman for the company, said Friday, noting that the company already puts its proprietary code in an escrow account that can be made accessible to those who require it. "It's like buying a computer at Best Buy: You don't own Microsoft Word; you license the use of it."


Diebold has lied yet again. Microsoft's license agreement for Windows CE actually

http://www.microsoft.com/resources/sharedsource/Licensi...

ALLOWS the source code to be disclosed, so the claim that this is not possible is a lie and Diebold probably knew this was a lie when it filed suit last week.

On Monday, a judge in Raleigh, N.C., dismissed that complaint, saying Diebold and others could be subject to penalties for not complying with the new law. That's why the Electronic Frontier Foundation, which filed a brief encouraging the court not to give Diebold special treatment, found it baffling that a mere three days later, the State Board of Elections announced it would certify Diebold anyway.

"The Board of Elections is required to review all of this code for security purposes before they certify it," said Matt Zimmerman, an EFF attorney. "If by some miracle they've actually complied with the statute, sometime between Monday and Thursday they've reviewed millions of lines of code for security, accuracy and integrity purposes."

Keith Long, a North Carolina voting systems manager, insisted that there was "nothing tricky" going on. First of all, he said, the Board of Elections didn't need to review all of the code again on its own because it made use of reports by an independent testing authority authorized by the federal government to run tests on e-voting software.



Keith Long is a former Diebold employee (who worked for Diebold until earlier this year) who has not been candid about his past "successes" working with Diebold voting products. The fact that the SBoE has hired him is evidence of their contempt for the voters of North Carolina and the newly passed election law.

The law is QUITE specific:

Prior to certifying a voting system, the State Board of Elections shall review, or designate an independent expert to review, all source code made available by the vendor pursuant to this section and certify only those voting systems compliant with State and federal law. At a minimum, the State Board's review shall include a review of security, application vulnerability, application code, wireless security, security policy and processes, security/privacy program management, technology infrastructure and security controls, security organization and governance, and operational effectiveness, as applicable to that voting system.

A report from an "independent testing authority" does not count since:

1) The ITA works for, and is paid by, the voting machine company, therefore is NOT "independent".

2) The ITAs are selected by The Election Center, a PRIVATE agency that was recently revealed to have been taking secret contributions from voting machine companies.

3) The ITAs refuse to reveal their testing methodology so we have no idea whether their testing meets the standards of NC law.

4) The report from the ITAs are secret and not revealed to the public.

Anyway you look at this, a report from a company not legally beholden to the voters of North Carolina is unacceptable.

And second, after polling the companies that had submitted bids and discovering that none of them could reasonably hand over third-party software code, the Board of Elections decided at the last minute that it would allow the companies to be certified as long as they provided the state with the outside escrow locations of all the codes. They have until Dec. 22 to do so.


It is NOT the job of the SBoE to excuse companies from complying with the law. The arrogance and reckless disregard for the law shown by these people will not go unaddressed.