Md. to buy controversial Diebolds

Maryland officials have decided to buy electronic voting machines from Diebold Corp. despite concerns that the machines could be open to tampering or fraud.

Republican Gov. Robert Ehrlich decided this week to authorize the State Board of Elections to proceed with the installation of the Diebold AccuVote-TS machines, based on a report from Science Applications International Corp. Maryland commissioned the company to analyze the Diebold units before completing the purchase, after an earlier Johns Hopkins University analysis of Diebold code suggested the machines were vulnerable.

SAIC provided "a positive independent review indicating that the Diebold machine and source code, if operated properly, can contribute to one of the safest, most secure election systems available," Ehrlich said.

However, SAIC said it found "several high-risk vulnerabilities" that, if exploited, could have a "significant impact" on election results. Vote counts could be "released too soon, altered or destroyed," according to the written report.

The SAIC team emphasized that its assessment was based on the voting machine's being separate from any network. "If any of the AccuVote-TS system components, as presently configured and architected, were connected to a network, the risk rating would immediately be raised to 'high' for several of the identified vulnerabilities," SAIC researchers concluded.

SAIC included 17 specific recommendations and warned that the system is "at high risk of compromise" if they are not implemented. Some suggested measures include:

* Disconnecting the state Board of Elections' Global Election Management System server, the heart of the electronic voting system, from the intranet, which is connected to the Internet.

* Rebuilding data in the server from trusted media to ensure it has not been compromised.

* Changing default passwords immediately.

* Implementing a formal, documented process to detect and respond to unauthorized transaction attempts.

The report found weaknesses in the election board's practices as well, such as the lack of a formal system security plan, for example. The board does not require secure transmission of vote totals, and does not require the review of computer audit trails.

Diebold and Maryland officials took steps in light of the report's findings to make the machines more secure, according to a statement from the state. The state has agreed to implement 12 of SAIC's recommendations.

Diebold incorporated three security features in the Maryland machines in response to the SAIC review. The company implemented dynamic assignment of security keys to enable the state to determine the pass codes smart cards used to access the system; incorporated encryption into the electronic transmission of election results; and provided personal identification numbers for election officials to use when they access the system.

Featured

  • FCW PERSPECTIVES
    sensor network (agsandrew/Shutterstock.com)

    Are agencies really ready for EIS?

    The telecom contract has the potential to reinvent IT infrastructure, but finding the bandwidth to take full advantage could prove difficult.

  • People
    Dave Powner, GAO

    Dave Powner audits the state of federal IT

    The GAO director of information technology issues is leaving government after 16 years. On his way out the door, Dave Powner details how far govtech has come in the past two decades and flags the most critical issues he sees facing federal IT leaders.

  • FCW Illustration.  Original Images: Shutterstock, Airbnb

    Should federal contracting be more like Airbnb?

    Steve Kelman believes a lighter touch and a bit more trust could transform today's compliance culture.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.