Md. to buy controversial Diebolds

Maryland officials have decided to buy electronic voting machines from Diebold Corp. despite concerns that the machines could be open to tampering or fraud.

Republican Gov. Robert Ehrlich decided this week to authorize the State Board of Elections to proceed with the installation of the Diebold AccuVote-TS machines, based on a report from Science Applications International Corp. Maryland commissioned the company to analyze the Diebold units before completing the purchase, after an earlier Johns Hopkins University analysis of Diebold code suggested the machines were vulnerable.

SAIC provided "a positive independent review indicating that the Diebold machine and source code, if operated properly, can contribute to one of the safest, most secure election systems available," Ehrlich said.

However, SAIC said it found "several high-risk vulnerabilities" that, if exploited, could have a "significant impact" on election results. Vote counts could be "released too soon, altered or destroyed," according to the written report.

The SAIC team emphasized that its assessment was based on the voting machine's being separate from any network. "If any of the AccuVote-TS system components, as presently configured and architected, were connected to a network, the risk rating would immediately be raised to 'high' for several of the identified vulnerabilities," SAIC researchers concluded.

SAIC included 17 specific recommendations and warned that the system is "at high risk of compromise" if they are not implemented. Some suggested measures include:

* Disconnecting the state Board of Elections' Global Election Management System server, the heart of the electronic voting system, from the intranet, which is connected to the Internet.

* Rebuilding data in the server from trusted media to ensure it has not been compromised.

* Changing default passwords immediately.

* Implementing a formal, documented process to detect and respond to unauthorized transaction attempts.

The report found weaknesses in the election board's practices as well, such as the lack of a formal system security plan, for example. The board does not require secure transmission of vote totals, and does not require the review of computer audit trails.

Diebold and Maryland officials took steps in light of the report's findings to make the machines more secure, according to a statement from the state. The state has agreed to implement 12 of SAIC's recommendations.

Diebold incorporated three security features in the Maryland machines in response to the SAIC review. The company implemented dynamic assignment of security keys to enable the state to determine the pass codes smart cards used to access the system; incorporated encryption into the electronic transmission of election results; and provided personal identification numbers for election officials to use when they access the system.

Featured

  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.