Hocking & Programmers see this?

[insane_cratic_gal]

Edited: for my million and 1 typos

About Triad and Hocking county. I read something last night in a 1988 report given by Saltman, in this report he mentions a lot about hidden code.

There is one things that stood out to me. In it he goes on to explain that hidden code can be accessed by a clock. It can be programmed to activated on a particular time of day and on a particular day.

Given that the triad tech changed the CMOS, the battery which controls date and time. Is it feasible that hidden code could be executed with the CMOS?

the computer is 14 years old, so I would fathom the OS is 3.1 bare bones GUI.

It's always bothered me that the CMOS dies on the day of the recount!

what you guys think? Nothing here to see here or is it possible?

[DeepGreen]

1. I don't know about how hidden it would be if proper reviews were done but

yes. It is easy to execute a function based on time/date or
time since something or time before something.

[insane_cratic_gal]

2. I have to pull the article

Up again but did he not patch the pc? The day that cmos crapped out?

[jmknapp]

3. Ballot rotation

The tech asked to know the precinct that they were planning to recount, and was told that it would be "Good Hope 1 #17."

The affidavit goes on to state:

"Michael gave us instructions on how to explain the rotation, what the tests mean, etc."

So he might have wanted to know the precinct so that he would know the specific ballot order rotation for that precinct.

This really is a very curious story.

[insane_cratic_gal]

4. Yup it bothers me

Cmos just decides to crap out before a recount.

you can execute code from a cmos to go off at a set time and date.
He asked them to not shut off the machine, because the battery was recharging or the code was still working it's way through the system?

The machine is connected the centeral tabulator.

I'm not normally a suspicous person but something just doesn't sing right here.

Having him stand there and repeat what he did, will tell them nothing. If they happen to leave a few steps out. If you just replacing the cmos, there is nothing to tell.

For an idea on how little time this takes Look here.

http://www.liverepair.com/encyclopedia/articles/cmosreplace.asp

[mattclearing]

5. Makes perfect sense.

He would have to reset the date to make the machine believe it was Election Day in order to get the "correct" totals.

Every other day of the year, the machine would work perfectly.

[jmknapp]

8. Not so sure

Remember this precinct was being checked first by hand. First the ballots are visually inspected and then run through the machine to make sure the results matched. If the software screwed around with the count in any way, that would just trigger a the countywide recount they so feared.

If fraud software is involved, I think it would have to be that the existing software was rigged, and the task was to replace it with honest software. Just hypothetically, say the the machines were rigged so that any counting done inside the interval Nov. 2-Dec. 31 would give the desired, rigged, result.

[AnarchoFreeThinker]

6. so, was the battery (and the whole visit) just a ploy to

adjust vote totals or to get the word out about a cheat sheet. The cheat sheet, I think, is the most damning part of the episode--direct evidence of an attempt to defraud. We can't get sidetracked from it.

[insane_cratic_gal]

7. your right

We can't forget that, but they seemed to dismiss that as well. I hope Arenbeck brings these factors up with some expert testimony to bring some light on to the truth.

And the 3 hours it took to replace a 20 min job.

I have an A+ cert, I've worked on pc&laptops. I've never had to change a cmos but guess it's a 20 min job, maybe 30 if you can't find the battery right away.

It takes longer to configure a scuzzy then change a battery

[jmknapp]

9. Telling, too

That according to the affidavit, the tech wanted to conceal the cheat sheet from anyone other than BOE staff.

[AnarchoFreeThinker]

11. exactly. Cheat sheet. Time to say it again...WHAT

ARE THEY HIDING?



(ed. to amend subject line)

[jmknapp]

16. I wonder if Inspector Clouseau

...and his boys asked the tech what was to be on his proposed "cheat sheet." And, for that matter, what he meant by "cheat"?

[roseBudd]

47. If it was just the HD parameters because that old of a PC does not

autodetect HD, they would not need to hide it.

[skids]

39. This is EXACTLY the crux of it.

It is of no use to debate the CMOS battery issue -- it was either for real, or it was a carefully constructed ruse to gain access to the computer. The cover story, if that is what is is, will hold up to scrutiny (it could have taken a long time because the technician had to call in to get the drive parameters, and those of us who work tech support know how long it can take to get a simple little peice of information if the right people aren't in the office.)

There are only a few things that could take apart this cover story:

1) If they overused it. One CMOS battery failure in one county is believable. That is, believable unless the machine was not turned off for a very long time. If it was on less than 2-3 weeks before, the CMOS battery failure is pretty unlikely on a machine that stays off most of the time (if the battery was going to fail, why didn't it fail, and get replaced, when they fired up the machine after months of inactivity since the primary but before the general? However arguing this point gets you nowhere. But if they claimed CMOS battery problems at other precincts, that is a bit more condemning, and if that information came to light, we'd have definite reason to call foul.

2) The affidavit's claim that "commands appeared in the lower left corner" could be a BIOS message, or it could be the technician pretending the machine was dead by holding down shift and preventing it from entering a menu system driven by the autoexec.bat file. This has not been answered in any of the reports I have seen. If the BIOS does not put messages in the left bottom of the screen, then what was going on there?

However, on the technical side, the real points are A) because of Blackwell's extension of the canvassing period, it was not legal for the technician to be accessing the machine without strict and qualified supervision. B) The technician could have inserted code as you state above during the process. Not in the CMOS, but in any BIOS firmware chips on the mainboard or in expansion cards, or even a simple software "patch" as he stated (though he could have just been saying that to get them to go away. Many techs are somewhat elitist and don't tell users what they are in fact doing because they don't want to spend the time explaining it.) C) Asking the tech for a reenactment, and believing him, was downright silly -- the people that observed him the first time didn't know squat about computers so he could have reenacted something totally different and none would be the wiser.

Finally all the technical stuff pales in comparison to the cheet sheet. None of the reports explain this away, either.

[gulogulo]

10. this is wrong on so many levels....

1. CMOS is not the battery. CMOS is the little piece of battery powerered memory on old computers that held system settings such as time and hard disk parameters while the computer as a whole was off.

2. CMOS Memory is what *holds* date/time, not what "controls" date/time. The internal clock controls date/time.

3. There is no hidden code that can be "executed with the CMOS". That is an absurd statement on its face.

4. Even though the computer is 14 years old, the operating system doesn't have to be 14 years old.

5. It takes exactly 5 seconds to change the computer's date/time in Windows. But why change it? If the hidden code is activated by a particular time of day on a particular day then (let's say Nov 2nd) then since the clock keeps running and today is not Nov 2nd anymore, that code is not activated anymore.

This whole thread is plain silly. Please stick to things that you know.

[insane_cratic_gal]

12. If it can be done with a Trojan

Once the password is captured, the Trojan will usually either save it in RAM, or on a local or network disk (in a hidden file in a hidden directory), or even in CMOS. .

and found this too

PC's CMOS memory, a virus can NOT ' hide ' there. The CMOS memory is not ' addressable '. Data stored in CMOS would not be loaded and executed in a PC.
A virus could use CMOS memory to store part of its code, but executable code stored there must first be moved to DOS memory in order to be executed.

[gulogulo]

17. CMOS holds a tiny amount of information

typically 256 to 512 bytes. Just drop it - trust me, CMOS has absolutely nothing to do with any "hidden code".

[insane_cratic_gal]

18. I didn't say

it could hold code I said it could execute code for a particular date time on a particular day. Or some hidden code in the machine could execute it using the internal clock.

I asked it if was plausabile that Cmos could be used to carry our a set of parmainters to held date and time to set off hidden code inside the machine?

Why I asked programmers, your right I don't know anything about programming. But it says here in this report: If a clock can be accessed hidden code code be activated to interact or execute on a particular day at a particular time.

[Cronus Protagonist]

48. CMOS can send the computer to execute code on the disk

Code that does not appear in the file listings in Windows. It does it for the boot sector, in particular, and when you change the chip, and hence the code inside it, you can change the boot sector.

Say the boot sector at one location includes hidden code that starts a hidden program and the boot sector at another location loads windows normally; bingo. Code removed with chip removal. Job complete. Coverup complete. The remaining stub of code on the HDD would be undetectable amongst all the other garbage on the drive.

They could even have loaded an entirely new version of windows, even, although that would require visible directories and/or additional disk partitions.




http://brainbuttons.com/home.asp?stashid=13
Buttons for brainy people - educate your local freepers today!

[insane_cratic_gal]

15. What Os

given the memory can't hold anything more then win 95.. ? 14 years old what is the min you need to run 95?

[gulogulo]

19. if all the computer is doing is tabulating stuff

it really does not need any OS more sophisticated than DOS on it. In fact, if the computer is 14 years old (1990), that means that it came out before Win 3.1 came out (1992). It is quite probably that the tabulating software was written in DOS using text screens and no graphics.

[insane_cratic_gal]

22. 3.1

was the first gui.. the programing is basically doe with a gui?

95 requires you to have 8MB of ram

the 1990 dell pc had exactly 8MB this would cause the machine to crawl would be better with 16MB

Dell 1990 486 pizza box style: 33 MHz, 8 MB,

[rman]

33. programming is not done with the GUI

The Graphical User Interface is *only* an interface; it's not a development tool, it's not a compiler.
Windows 1.0 was the first MS GUI, but it was mostly useless.
Windows 3.0 was quite popular.
Windows 3.1 is 3.0 with networking capability.

[Ellipsis]

35. The Windows GUI makes the DOS friendly yes?

Mac guy.

[insane_cratic_gal]

44. yes

It makes it user friendly to some extent.

I'm just saying the 3.1 was the first GUI that's it.

The machine either has 3.1 or 95 running on it.

Or Foxpro.. forgot about that one. (dos)

[jmknapp]

20. Right you are insane_cratic_girl

These machines ran DOS.

[chorti]

23. DOS foxpro

Triad uses VFP. The tabulating software was running using foxpro, most likely DOS-based. The central Triad tabulators using the newest VFP can still interact with the DOS-based Foxpro on all the individual counting machines. Foxpro is built that way.

[mdb]

30. 2. CMOS Memory is what *holds* date/time,

And for when the computer is off. The computer was not off.

[gulogulo]

31. if the battery dies, CMOS memory is wiped out

that is what seems to have happened. And what do you mean "computer was not off" - from what I have read, it was. The technician came, turned it on to do his recalibration for the recount, and could not boot it.

[mdb]

36. My mistake. I was going on his instructions to not turn off the computer.

It looks like the computer was off when he first got there. The date and time could have been wiped out with a failed CMOS.

[roseBudd]

43. The Hocking County woman (Eaton?) was told by Triad rep not to

turn off PC. That indicates to me that after he entered setup (CMOS) and manually set the time and either autodetected HD or manually added it, he did not want her to shut down because the whole entering setup/CMOS procedure would need to be repeated. Do not turn off means CMOS battery still dead. Otherwise she could have shut down, no problem.

[mdb]

45. But then if you continue reading, he does say turn it off and back on.

[rman]

13. "CMOS" is not "battery"

It probably refers to some kind of memory card that employs CMOS technology (quite common) which needs a battery to retain the information that is stored on the memory card.

[roseBudd]

14. I had CMOS problems with a very old PC

Replacing the battery did not help because the clip that holds the battery in place was loose. So I just entered CMOS every time I rebooted. So it is really no big deal, you really don't have to ever replace the battery, if you enter setup (CMOS) during bootup and manually reset the time and then autodetect the HD. The fact that he told them not to turn off the PC suggests he did not replace the battery. As long as the PC stays on the CMOS battery is moot.

[Doctor O]

41. For those of us who were around in 1990

Autodetect did not come into being until 1995. If this computer was built in 1990, and the BIOS was not upgraded, when a battery loses memory. the BIOS had to be reconfigured to indicate the parameters of the hard drive.
Leaving a machine up does not recharge the battery. These batteries were independent of the power system so the BIOS and startup information could be retained.
There is a possibiity that the patch he did was an upgraded BIOS for that system board.

[Must_B_Free]

50. no reason to patch a system that was working properly

[roseBudd]

51. I agree, I find it hard to believe he flashed the bios

This was not a system administrator that just happened to "pop in"

[november3rd]

21. Arenbeck raises the same question in the contest

He suggests the codes need to be audited because of time-expiration tabulation software.

[CantGetFooledAgain]

24. Their actions seem to have focused on the recount

The "TRIAD Technician" could have done anything, changed anything, swapped anything, run any code, and we will probably never know. The steps that were taken, were taken to make the recounts "check out".

Apparently these were successful since no large discrepancies have come out of the recount. We had to expect this. They controlled every aspect of that recount. It was a rigged game from the start.

A recount is not an audit. A full audit has yet to be done, and would entail getting ALL of the ballots, ALL of the poll books, AND impounding the machines. The audit has to be done on the assumption that a crime may have been committed. Were Enron and Arthur Anderson able to say "you can only see 3% of our records"? Of course not. A crime was committed, and those records were turned over, in full, to the investigating authorities.

Unfortunately, the game is still rigged. Because we may never get full and unfettered access to the records that could be used to conclusively prove what happened.

[chorti]

25. full recount in Coshocton

Only one Ohio County has done a full hand recount. In this county Bush lost 13 votes and Kerry won 34 votes. A full recount was necessary after the recount in two precincts showed Kerry getting 7 to 8 percent more votes in the recount than he was credited with in the certified vote count given to the state. How could the machines be off by that much - that would be 10 to 15 votes in one precinct? If Kerry lost that same proportion of votes statewide, the recount would net him 13,500 more votes statewide and Bush would lose 4,000 votes statewide.

From the Greens:
<http://www.votecobb.org/recount/ohio_reports/counties/coshocton.php>

"At the initiation of the count, the ballots were not sealed or secured in any manner beyond the safekeeping offered by the BOE office itself. The ballots were distributed to the counting stations prior to the presence of the witnesses.

"Witness, Patricia Stout, stated that "one of the precincts I observed was already separated into Republicans, Democrats and Other. It was clear that this pile had been counted." The count was completed and totals reflected a net loss of 13 votes for George W. Bush, and a net gain of 34 votes for John Kerry. The hand count totals were compared to totals furnished by the BOE dated/generated 12/10/04."

[chorti]

26. 1 in 5000 chance Coshocton result random

Let's look at that Coschocton result that Kerry was robbed of 47 votes (net) in the certified result. What are the chances that that was random machine error? Let's say that at most 1 percent of the ballots could have been misread by the machine (highly unlikely as well.) This would mean that about 167 of the Coshocton ballots were misread.

What are the chances that at least 107 were originally misread in Bush's favor and that at most 60 were originally misread in Kerry's favor? (Resulting in the 47 vote swing toward Bush.) Using the binomial distribution, this would be a 0.02% chance or about 1 in 5000.

So, in the only county that was fully re-counted in Ohio, we get a result that favored Bush to the extent that it was randomly possible only in about a 1 in 5000 chance. And we don't want to do a full recount of the entire state? Why not? All the evidence suggests that this should be done. If you don't want a full recount, then do a full, hand recount in Mercer, Van Wert, Greene, or Brown Counties. If you get an accurate result in any of those four counties, then I will believe that there was no election fraud in Ohio.

[Igel]

46. If this is punch card territory, think about how the

misreading actually occurs. I don't know enough about the numbers to assess whether your assumptions are valid. If the revised canvas figures report the number of ballots, undervotes, overvotes, and candidate votes, it's doable.

It's probably not a case of the machine not sensing a hole in the card; there are only so many ways (assuming that there wasn't a machine error, say a chad blocking the sensor) to not count a vote. One involves incompletely removed chads.

There are also only so many ways of *overcounting* votes. I doubt that the machine "sensed" a hole in the card when there was none. The most likely error was again, a incompletely removed chad, this time for a *second* candidate.

The lost Bush votes become overvotes and some undervotes become Kerry votes. Depending on the voting booth, it may be the case that Bush and Kerry both picked up and lost votes. Or it may be that just the Kerry "hole" position wasn't letting the voter punch things out correctly (which still is odd, because it means at least 16 people punched for both ... but the ballot layout may explain that ... Cochocton had a lot of candidates).

[roseBudd]

52. There are braces under certain hole positions in both models of punch card

machines. Candidate position assignment does come into play. See Doug Jones article on chads and punch cards for exact positions of braces. Brace positions fill up with chad pretty quickly.

[Igel]

53. True.

But I was taking issue to a large extent with the statistics. I doubt his assumptions. It's easy to plug numbers into Excel or SAS or whatever, but the results are frequently meaningless. (It's not like I'm not speaking from experience or anything ;-)

[libertypirate]

27. Easy to hide code in third party dll's

[gulogulo]

28. There are no DLLs

This is DOS code, Fox Pro.

[Ellipsis]

29. me thinks though doth protest too much! ...What about this.

Somethings fishy in Ohio and it ain't the Cayuga river. Let's go back to the original computers, people. Have the high-school kids count the votes. Get a 1000 kids from each county, set them up in a gymnasium, and let them have at it. ... of course after they check for fingerprints. The kids have no dog in this fight. No astigmatisms or glaucoma either. It's for there future anyway Right? Perhaps they can teach their parents something.

What do think kids?

and a tip of the hat to the insane_democratic_girl

k

[merh]

32. Wonderful question! Post the link to the 1988 report so the

techies can read it themselves!

[Ellipsis]

34. agreed!

Your quite adept on research.

k

[merh]

38. 1988 Report

Accuracy, Integrity, and Security in
Computerized Vote-Tallying

Roy G. Saltman

Institute for Computer Sciences and Technology
National Bureau of Standards
Gaithersburg, MD 20899

Sponsored by:
John and Mary R. Markle Foundation
75 Rockefeller Plaza, Suite 1800
New York, NY 10019-6908
August 1988


http://www.itl.nist.gov/lab/specpubs/500-158.htm

[Ellipsis]

40. Thanks...skimmed it. A guideline for Honesty and Deception, eh?

Heady long read, can't do it right now.

Ya think,This deserve it's own thread?


k

[Lerkfish]

42. sorry, mistake on my part: replied to wrong poster

delete

[Alizaryn]

37. Once again I only wish I were of a criminal mindset

and could "borrow" a few machines and have real, objective experts investigate them.

[thanatonautos]

49. `CMOS' on the PC/AT was a region of battery-backed RAM 64/128 bytes wide.

It was mapped to memory outside the normal address space
and it would not normally contain executable code. It doesn't
execute any code itself: it's just a kind of special storage
space.

I suppose it might be theoretically possible to
store some special, very short code, in part of CMOS
memory which was unused, and to load it and run it
using some normal executable program, once the OS was
booted.

But this would require the use of some other program
which would have to be stored either in BIOS memory,
or on the hard disk. On the whole, modifying CMOS
seems like a very unlikely way to try to hack the
system in order to fix an election. I would expect
that to be done at a higher level.

The battery keeps the CMOS refreshed, when the system
is turned off, so that the information about the system
typically stored there, such as date and time, and various
low-level parameters describing the system will not be lost.

The CMOS was, I think, physically located on the clock
chip, naturally enough, so that the time and date, stored
in CMOS, could be updated while the system power was off.

If the battery fails, all data in CMOS is lost.
On an old PC, this often means you have to
re-enter all the information contained in CMOS
before the system can be booted. I had a pre-1990
PC/AT, whose battery repeatedly failed, and I
eventually learned the right info for the hard disk,
so that I could easily enter it, until I could get
a replacement battery.

The major issue I have with the description we were
given about what happened with this technician is that
we don't really have any idea what he actually did
to the system. We're told he took two whole machines
apart, the main system and a backup. So he might have
done many things. How do we know he didn't replace
the entire hard drive with one he had in his pocket?

At the very least it creates a great deal of room for
suspicion. Anything he did should have been monitored
by qualified observers from all interested parties.