Inside The Certification of the Diebold AccuVote Optical Scan System

[sabra]

I don't know about you, but I couldn't believe these systems were certified. Check out the Security Access Controls and Other Known Problems sections, they will shock you!

<<SNIP>>

http://www.ss.ca.gov/elections/consultant_report_item_5c.pdf

State certification testing was conducted 19-22 July, 2004, at Diebold offices in Coppell, TX, to certify two versions of the AccuVote Optical Scan (AV-OS), versions 1.94W and 1.96.4, with the
new GEMS 1.18.19. The AV-OS, version 1.94W, was previously certified in California under an earlier version of GEMS. This testing was to ensure continued compliance with California election code and rules under the new GEMS 1.18.19 and for the newer AV-OS Version 1.96.4.

The testing for this version configuration showed compliance with the California Election Code but
has broadly published security weaknesses similar to those reported earlier in reports
about the Diebold DREs. In spite of these weaknesses, the tested configuration provides
better security and functional support than the currently certified version and is recommended
for certification in replace of the current version, with suitable Technical Security Plan
procedures compatible with those suggested earlier for the Touch Screen DREs.

The following security weaknesses were noted in testing:
Item GEMS TS OS
1. Weak security of the basic server and operating system Yes n/a n/a
2. GEMS database is accessible by DAO-supported programs Yes n/a n/a
3. GEMS passwords are too weak Yes n/a n/a
4. SSL/TLS encryption may be disabled Yes uses n/a
5. Default encryption keys published (but may be changed) Yes uses n/a
6. Default passwords/pins are hardcode Yes Yes n/a
7. Some passwords/pins restricted to four digits. Yes Yes Yes
8. Key locks on access panels are not secure Yes Yes
a. Memory card not secure Yes Sealable
b. Serial/Parallel ports not secure Yes Yes
9. PS/2 Keyboard port not secure Yes n/a
10. (new) Modem not secure Unused Yes

The election procedures for the AV-TS and AV-OS are being rewritten to address some
of these items but are not finished at in time to be included in this report.




<</SNIP>>

[sabra]

1. Wasn't CA on Madsen's List of Fraud? n/t

[rockedthevoteinMA]

3. yes n/t

[sabra]

5. How were these systems certified?

With so many known security holes? Essentially this report is saying, "hey, atleast it's better than the last version".

[stella2cat]

2. and how did Ohio certify?

I've looked all over for doco on the Ohio certification process and can't find anything anywhere. I found info for some states, but oddly enough, Ohio seems to have done it secretly. I still think this is a true issue -- whether or not the correct software was used, but how can we prove it?

[sabra]

4. I looked too, and couldn't find anything...

but if the CA cert is any indication of what it was like, it just adds to my concerns...

[stella2cat]

6. I think this would be the soundest way to challenge....

but short of checking every machine I don't know how we could establish that they were using either
a) uncertifed versions or
b) versions with uncertified patches

Mr Blackhole has done a fine job of keeping Ohio to himself

[sabra]

7. I agree

but in my opinion, going off the CA certification doc, they seem to be OK with the system being unsecure. I am totally baffled how this is allowed.