- This presentation courtesy of Black Box Voting - Election Integrity

Size: px

Start display at page:

Download "- This presentation courtesy of Black Box Voting - Election Integrity"

Maurice Matthews
5 years ago
Views:

1 Election Integrity

2 40 years ago Voting Rights Act of 1965: Meant to reverse the disenfranchisement of minority voters. Key portions of this Act are set to expire in August Our brothers died for this

3 85 years ago Our mothers died for this June 4, 1919: 19 th Amendment passed, giving women the right to vote

4 In the 1800s Our soldiers died for this March 30, 1870: 15 th Amendment passed, giving men of color the right to vote - This presentation courtesy of Black Box Voting -

Between 1892 and 1924 over 22 million people came through

5 Throughout our history Our ancestors came for this Currently, approximately 13 percent of the U.S. population is Latino. Between 1892 and 1924 over 22 million people came through Ellis Island and the Port of New York, many of them seeking citizenship.

6 And in the beginning We had revolution over this

7 If this was simple - This presentation courtesy of Black Box Voting -

8 If this was simple people wouldn t keep dying Just to give our children the right to vote - This presentation courtesy of Black Box Voting -

9 Election Security Issues Are Real Incentives to manipulate elections: -Power -Money - Tradition How people persuaded to do it: M.I.C.E. Money, Intelligent reason, Courtesy, Emotion Money = Often under $10,000 Courtesy = Favors Source for bribery amounts: Black Box Voting news archives, monthly Bucket of Bribes articles. The under $10,000 figure refers to bribery of government officials of all kinds, not just elections-related bribery.

10 Election Security Issues Are Real When dealing with public officials: - Focus on REAL mechanics, not theories - Identify risks - Describe proven exploits - Expect vendor-driven rebuttals Remember that most election officials are dependent on their vendor for their upcoming elections. For more background on vendor dependency, see video in Black Box Voting document archives: Vendors are like family

Mechanics of Election Manipulation It s not about Bush BOTH PARTIES obstructing & denying It s not about being nonpartisan It s about defining problem accurately It s not about the presidential

11 Mechanics of Election Manipulation It s not about Bush BOTH PARTIES obstructing & denying It s not about being nonpartisan It s about defining problem accurately It s not about the presidential election It s supervisors, primaries, judges The mechanics are a patchwork: not uniform Traditional targets for election manipulation: County supervisors, commissioners, who allocate construction projects and approve land use; Sheriffs, who control contraband & also affect zoning decisions (traffic control study sign-off). These local races were probably the first beneficiaries of voting machine manipulation.

12 To analyze REAL mechanics, you start by building an ATTACK TREE Examine real systems and real elections procedures Follow the right approach, or officials will tune us out. (And there are those who want to tune this out.) - Identify attack categories - Map attack points - Identify specific attack vectors - Calculate risk value for each specific attack vector (# people, money, skill needed) - Do proof of concept testing Improving Election Integrity

13 Identify attack categories - People - Software - Hardware - Materials - Procedures - Laws & regulations Improving Election Integrity

14 Map attack points - District mapping - Ballot Access -Voter registration -Ballot design & printing - Vote suppression -Vote authentication - Vote casting - Data / ballot transfer -Data consolidation (central tabulation) - Results reporting - Final canvass Improving Election Integrity

15 Identify specific attack vectors: Here are just a few - District mapping --- Demographics --- Overlay voter registration party preference --- Split or consolidate ethnic areas - Ballot Access --- Change rules for what constitutes an official political party --- Require more signatures --- Omit undesired parties from debates -Voter registration --- Design VR software for arbitrary purging --- Overgenerous felon purges --- Register the same voter multiple times --- Selective purging of inactives -Ballot design, print --- Incorporate triggers into ballot ID code --- Overlay certain portions with Infra-red --- Use tampered op-scan calibration sheet --- Slight displacement of vote areas - Vote suppression --- Ditch absentee ballots at mail proc. center --- Switch polling places --- Under-assign voting machines - Vote authentication --- Create arbitrary automated signature comparison for absentee ballots --- Insert trigger into selected voter card activators --- Omit names from electronic pollbook - Vote casting --- Miscalibrate touch screens --- Place pens with organic ink in booths --- Pre-stuff the electronic ballot box with negative/positive votes - Data / ballot transfer --- Create report falsifying program inside the electronic ballot box --- Swap the early voting ballots when they are driven to HQ --- Man in the middle remote attack -Data consolidation (central tabulation) --- Insert trojan horse script in tabulator --- Manually change tabulator results --- Edit stored business logic in tabulator - Results reporting --- Falsify Web / Media interim reports (fix raw data later) - Final canvass --- Add or swap ballots Improving Election Integrity

16 Real life attack points Ballot design, print - Triggers in ballot ID code - Tampered op-scan calibration - Slight displacement of vote areas Vote suppression - Ditch absentee ballots at mail processing center Vote authentication - Arbitrary sig. comparison - Put trigger into voter card activators for touch-screens Vote casting - Miscalibrate touchscreens - Pre-stuff ballot box with negative/positive votes Data / ballot transfer - Create report falsifying program in memory card - Remote attack Data consolidation (central tabulation) - Insert trojan horse script in tabulator - Edit stored business logic Improving Election Integrity

17 Miscalibrate touch-screens Palm Beach County, FL (Sequoia touch-screens): - 4,313 Voting Machines - Recalibrated 1,475 times Nov. 2 - This presentation courtesy of Black Box Voting -

18 Real life attack points Ballot design, print - Triggers in ballot ID code - Tampered op-scan calibration - Slight displacement of vote areas Vote suppression - Ditch absentee ballots at mail processing center Vote authentication - Arbitrary sig. comparison - Put vote-flipping trigger into targeted voter card activators for touch-screens Vote casting - Miscalibrate touchscreens - Pre-stuff ballot box with negative/positive votes Data / ballot transfer - Create report falsifying program in memory card - Remote attack Data consolidation (central tabulation) - Insert trojan horse script in tabulator - Edit stored business logic Improving Election Integrity

19 How to Pre-Stuff the Ballot Box (Diebold precinct-based optical scan) Voting Machine Voting Machine Voting Machine Memory Cards GEMS - This presentation courtesy of Black Box Voting -

How to Pre-Stuff the Ballot Box Voting Machine Voting Machine Voting Machine Pre-stuff memory cards to roll over odometer GEMS Most people are familiar with the odometer in a car, which rolls over to

20 How to Pre-Stuff the Ballot Box Voting Machine Voting Machine Voting Machine Pre-stuff memory cards to roll over odometer GEMS Most people are familiar with the odometer in a car, which rolls over to zero after 99,999 miles. The rollover point in Diebold precinctbased optical scans is 65,535 votes. Proof of Concept: Harri Hursti on Diebold optical scan machine. May 26, Leon County, FL Don t look at me - This presentation courtesy of Black Box Voting -

21 Real life attack points Ballot design, print - Triggers in ballot ID code - Tampered op-scan calibration - Slight displacement of vote areas Vote suppression - Ditch absentee ballots at mail processing center Vote authentication - Arbitrary sig. comparison - Put vote-flipping trigger into targeted voter card activators for touch-screens Vote casting - Miscalibrate touchscreens - Pre-stuff ballot box with negative/positive votes Data / ballot transfer - Create report falsifying program in memory card - Remote attack Data consolidation (central tabulation) - Insert trojan horse script in tabulator - Edit stored business logic Improving Election Integrity

22 How to create a false poll tape Poll Tape Voting Machine Voting Machine Voting Machine Poll Tape Poll Tape Memory Cards Report commands Report commands Report commands GEMS Diebold memory cards contain report-making program Don t look at me - This presentation courtesy of Black Box Voting -

23 How to create a false poll tape Load false reporting program either from GEMS or by swapping cards Voting Machine Voting Machine Voting Machine AccuBasic files GEMS Don t look at me - This presentation courtesy of Black Box Voting -

24 Real and falsified poll tapes This Diebold voting machine was programmed to create false poll tapes Proof of Concept: Harri Hursti on Diebold optical scan machine. May 26, Leon County, FL Don t look at me - This presentation courtesy of Black Box Voting -

25 Real life attack points Ballot design, print - Triggers in ballot ID code - Tampered op-scan calibration - Slight displacement of vote areas Vote suppression - Ditch absentee ballots at mail processing center Vote authentication - Arbitrary sig. comparison - Put vote-flipping trigger into targeted voter card activators for touch-screens Vote casting - Miscalibrate touchscreens - Pre-stuff ballot box with negative/positive votes Data / ballot transfer - Create report falsifying program in memory card - Remote attack Data consolidation (central tabulation) - Insert trojan horse script in tabulator - Edit stored business logic Improving Election Integrity

26 Remote Attacks Attack vectors: - Telephone lines - RAS (Remote Access Server) on GEMS tabulator - Networks on Sequoia systems - San Diego: GEMS connected to Internet (July 2005 election) Proof of Concept: RABA Technologies Jan 2004, Maryland Other considerations: - Setup varies in each jurisdiction - Why wait until Election night? (Easier to do in advance; remote access attacks more likely if additional corrections needed after results coming in)

27 Real life attack points Ballot design, print - Triggers in ballot ID code - Tampered op-scan calibration - Slight displacement of vote areas Vote suppression - Ditch absentee ballots at mail processing center Vote authentication - Arbitrary sig. comparison - Put vote-flipping trigger into targeted voter card activators for touch-screens Vote casting - Miscalibrate touchscreens - Pre-stuff ballot box with negative/positive votes Data / ballot transfer - Create report falsifying program in memory card - Remote attack Data consolidation (central tabulation) - Insert trojan horse script in tabulator - Edit stored business logic Improving Election Integrity

28 Insert Trojan script into GEMS or WinEDS tabulator -Most GEMS (Diebold tabulator) versions in use are built on a Microsoft Access-compatible database. -Other tabulators, like Sequoia WinEDS, are built with SQL. - Both Visual Basic scripts and Java scripts worked when applied to GEMS Proof of Concept: Dr. Herbert Thompson Feb. 14, 2005, Leon County FL Windows inherently supports Visual Basic scripts. You simply type the commands into any text editor (like Notepad or even the DOS edit function) you never need to open the voting system program at all. The scripts works in the background and then you own the election. Scripts like this are often used to create viruses (programs running on your computer that you are unaware of). These kinds of scripts can be implanted months or years ahead of time, and can be set to trigger only when certain events take place. It took Dr. Thompson less than a minute to implant a script that controlled the GEMS tabulator.

29 Real life attack points Ballot design, print - Triggers in ballot ID code - Tampered op-scan calibration - Slight displacement of vote areas Vote suppression - Ditch absentee ballots at mail processing center Vote authentication - Arbitrary sig. comparison - Put vote-flipping trigger into targeted voter card activators for touch-screens Vote casting - Miscalibrate touchscreens - Pre-stuff ballot box with negative/positive votes Data / ballot transfer - Create report falsifying program in memory card - Remote attack Data consolidation (central tabulation) - Insert trojan horse script in tabulator - Edit stored business logic Improving Election Integrity

30 Edit stored business logic in central tabulator -Sequoia WinEDS tabulator makes the source code for its stored business logic available in menu items, so any user can edit the source code on the fly. - For example, Jeremiah Akin demonstrated editing the source code for the fonts on the WinEDS reports. Proof of Concept: Jeremiah Akin Riverside, CA This manipulation altered the functionality of the tabulator, and the manipulation later erased itself automatically. Source code consists of English-like commands which tell the computer what to do. It is unusual bizarre, in fact to create a program designed for security which allows modification of the source code simply by entering a menu. Menu items are designed to allow users to find functions easily. The WinEDS program, therefore, allows users to easily locate a way to re-write the commands that tell the tabulator what to do. Jeremiah rewrote a section about fonts so that when you change a font on a report, the tabulator would alter the way it counts the vote. - This presentation courtesy of Black Box Voting -

31 Real life attack points Ballot design, print - Triggers in ballot ID code - Tampered op-scan calibration - Slight displacement of vote areas Vote suppression - Ditch absentee ballots at mail processing center Vote authentication - Arbitrary sig. comparison - Put vote-flipping trigger into targeted voter card activators for touch-screens Vote casting - Miscalibrate touchscreens - Pre-stuff ballot box with negative/positive votes Data / ballot transfer - Create report falsifying program in memory card - Remote attack Data consolidation (central tabulation) - Insert trojan horse script in tabulator - Edit stored business logic Improving Election Integrity

32 Put triggers into the ballot codes -Each ballot contains code which tells the optical scan machine information like ballot style and precinct. Usually, this is benign. -Diebold ballots contain a series of dashes along the bottom which contain comments (commands for the computer) - ES&S and Sequoia have these on the side Proof of Concept: Harri Hursti Hursti s absentee ballot reader decodes the code - Hart Intercivic has three bar codes along the side - This presentation courtesy of Black Box Voting -

33 Put triggers into the ballot codes Diebold Hart Intercivic - This presentation courtesy of Black Box Voting -

34 Real life attack points Ballot design, print - Triggers in ballot ID code - Tampered op-scan calibration - Slight displacement of vote areas Vote suppression - Ditch absentee ballots at mail processing center Vote authentication - Arbitrary sig. comparison - Put vote-flipping trigger into targeted voter card activators for touch-screens Vote casting - Miscalibrate touchscreens - Pre-stuff ballot box with negative/positive votes Data / ballot transfer - Create report falsifying program in memory card - Remote attack Data consolidation (central tabulation) - Insert trojan horse script in tabulator - Edit stored business logic Improving Election Integrity

35 Tamper with Optical Scan Calibration - Diebold optical scan calibration tells the machine how dark a mark must be in order to read it - You can increase undervotes or overvotes by miscalibrating them -Calibrations are done simply by running a calibrator page through the machine. -Diebold high speed digital scanners also have an autocorrect setting that should NOT be on - This presentation courtesy of Black Box Voting -

36 Real life attack points Ballot design, print - Triggers in ballot ID code - Tampered op-scan calibration - Slight displacement of vote areas Vote suppression - Ditch absentee ballots at mail processing center Vote authentication - Arbitrary sig. comparison - Put vote-flipping trigger into targeted voter card activators for touch-screens Vote casting - Miscalibrate touchscreens - Pre-stuff ballot box with negative/positive votes Data / ballot transfer - Create report falsifying program in memory card - Remote attack Data consolidation (central tabulation) - Insert trojan horse script in tabulator - Edit stored business logic Improving Election Integrity

37 Slight displacement of vote area - Diebold digital scanners have a skew built into the scan hardware. Certain locations on the ballot may under-report the votes. - Old Diebold optical scanners do not register the whole image, just a few lines through the image (as few as two). Thus, slight offsets on certain races can produce higher undervotes -Old ES&S and Sequoia scanners have similar vulnerabilities. - This presentation courtesy of Black Box Voting -

38 Real life attack points Ballot design, print - Triggers in ballot ID code - Tampered op-scan calibration - Slight displacement of vote areas Vote suppression - Ditch absentee ballots at mail processing center Vote authentication - Arbitrary sig. comparison - Put vote-flipping trigger into targeted voter card activators for touch-screens Vote casting - Miscalibrate touchscreens - Pre-stuff ballot box with negative/positive votes Data / ballot transfer - Create report falsifying program in memory card - Remote attack Data consolidation (central tabulation) - Insert trojan horse script in tabulator - Edit stored business logic Improving Election Integrity

39 Ditch Absentee Ballots at the Mail Processing Center Many locations use PSI Group to do ballot mailing. Some also have PSI process incoming ballots. PSI sorts the incoming absentee ballots and gives them to the elections division. PSI routinely hires felons and immigrants. PSI payroll registers obtained by Black Box Voting include people with no last names: Jack Jack and simply Joe. PSI upper management includes Neil Dean, brother of voting machine programmer Jeffrey Dean -- Jeff was in prison for four years on 23 counts of embezzlement involving criminal computer programming. Jeff Dean s first job, upon leaving prison, was PSI.

40 Real life attack points Ballot design, print - Triggers in ballot ID code - Tampered op-scan calibration - Slight displacement of vote areas Vote suppression - Ditch absentee ballots at mail processing center Vote authentication - Arbitrary sig. comparison - Put vote-flipping trigger into targeted voter card activators for touch-screens Vote casting - Miscalibrate touchscreens - Pre-stuff ballot box with negative/positive votes Data / ballot transfer - Create report falsifying program in memory card - Remote attack Data consolidation (central tabulation) - Insert trojan horse script in tabulator - Edit stored business logic Improving Election Integrity

Ability to perform arbitrary, mechanized signature authentication for mail-in ballots Diebold Vote Remote This program allows you to arbritrarily set the

41 Ability to perform arbitrary, mechanized signature authentication for mail-in ballots Diebold Vote Remote This program allows you to arbritrarily set the rate at which the signature comparison rejects voters. You can set it higher for some areas than for others. - This presentation courtesy of Black Box Voting -

42 Real life attack points Ballot design, print - Triggers in ballot ID code - Tampered op-scan calibration - Slight displacement of vote areas Vote suppression - Ditch absentee ballots at mail processing center Vote authentication - Arbitrary sig. comparison - Put vote-flipping trigger into targeted voter card activators for touch-screens Vote casting - Miscalibrate touchscreens - Pre-stuff ballot box with negative/positive votes Data / ballot transfer - Create report falsifying program in memory card - Remote attack Data consolidation (central tabulation) - Insert trojan horse script in tabulator - Edit stored business logic Improving Election Integrity

43 (Speculative) Put vote-flipping trigger into voter activation card These are actual election logs from Sequoia touch-screens Card authenticated Election activated Cast vote Card authenticated Election activated Cast vote Card authenticated Election activated Voter card removed Card authenticated Cast vote Card authenticated Election activated Cast vote Election activated Voter card removed Card authenticated Cast vote We have ascertained that voter cards were NOT removed L&A test: error did not occur Election Day: error occurred on 99 percent of all 900 machines What about the 1% with no error? These were the ONLY machines with the same voter card activator used for the L&A tests. - This presentation courtesy of Black Box Voting -

44 Election integrity varies from place to place Presenting a patchwork of opportunities for tampering.

45 Methods will vary from place to place because of different voting systems & procedures. Human factors also differ from place to place

46 Susceptibility to Cash $ $ $ Improving Election Integrity

47 Business influences Improving Election Integrity

48 How much control vendor has over local elections Mechanics of vote-rigging

49 Local yokels & traditions Improving Election Integrity

50 Butt-covering, worries about job security Don t look at me Improving Election Integrity

51 Bungling & Incompetence Don t look at me Improving Election Integrity

52 To manipulate federal elections Skilled operatives would have to cobble together local opportunities - This presentation courtesy of Black Box Voting -

53 More uniformity will make federal election manipulation easier - Uniform statewide systems - Remove / prohibit use of audit trails - Consolidate training, talking points

54 There is little will among elected officials to shine light on anything that could cast doubt on how they got into office. Therefore, improving election integrity must come from citizens, like you. There is no magic solution that will solve everything. Right now, it s plugging holes in the dike. One small plug: Count-it-yourself software for digital image optical scanners, developed by Harri Hursti, underwritten by Black Box Voting. Open source code, available for FREE, right now. More:

55 Do something. Do anything. But don t wait for someone else to do it for you. It s your freedom: Use it or lose it.

56 They stood up for your rights

57 Now it s your turn - This presentation courtesy of Black Box Voting -

Election System and Software

Election System and Software Examination Report January 2007 Tom Watson Examiner The following systems were examined in Austin on January 18 and 19, 2007: AutoMARK Voter Assist Terminal (VAT) 1.1.2258