http://www.sos.state.oh.us/News/Read.aspx?ID=233
Jennifer Brunner, Ohio Secretary of State
Press Release
December 14, 2007
For Immediate Release
COLUMBUS, Ohio – Ohio’s electronic voting systems have
“critical security failures” which could impact the integrity of elections in
the Buckeye State, according to a review of the systems commissioned by
Secretary of State Jennifer Brunner.
“The results underscore the need for a fundamental change in
the structure of Ohio’s election system to ensure ballot and voting system
security while still making voting convenient and accessible to all Ohio
voters, “ Secretary Brunner said Friday in unveiling the report.
“In an era of computer-based voting systems, voters have a
right to expect that their voting system is at least as secure as the systems
they use for banking and communication,” she said.
THE REPORT
The Evaluation & Validation of Election-Related Equipment,
Standards & Testing report, known
as EVEREST, is a comprehensive review of voting systems revealing startling
findings on voting machines and systems used in Ohio and throughout the
country. The Ohio study tested the
systems for:
- risks to vote
security,
- system
performance, including load capacity,
- configuration to
currently certified systems specifications, and
- operations and
internal controls that could mitigate risk.
The $1.9 million study, paid for using federal funds, was
structured to allow two teams of scientists, corporate and academic, to conduct
parallel assessment of the security of the state’s three voting systems -
Election Systems & Software (ES&S), Hart Intercivic and Premier
Election Solutions (formerly Diebold) - in both voting and board of elections
environments. Separate research was
conducted on each voting system’s performance, configuration and operations and
internal controls management. A
bipartisan team of 12 election board directors and deputy directors advised the
study and evaluated all reports, participating with the secretary in making
recommendations for change.
While some tests to compromise voting systems took higher
levels of sophistication, fairly simple techniques were often successfully
deployed.
“To put it in every-day terms, the tools needed to
compromise an accurate vote count could be as simple as tampering with the
paper audit trail connector or using a magnet and a personal digital
assistant,” Brunner said.
The researchers in the Ohio study didn’t address the issue
of probability of attack, leaving that to the determination of state and local
officials. The researchers commented
that with the lack of technical measures in voting system design, its integrity
“is provided purely by the integrity and honesty of election officials.” (p. 20, Final Report of Academic
Researchers.)
“It’s a testament to our state’s boards of elections
officials that elections on the new HAVA mandated voting systems have gone as
smoothly as they have in light of these findings,” Brunner said.
Testers looking at the performance of the voting systems
used in Ohio and in many locales throughout the country, identified numerous
risks to election integrity ranging from minor to severe, according to the
review.
Also, those examining how voting systems were configured in
the field found risks such as the use of materials like memory storage and
printer paper that had not been certified by the voting system manufacturers; a
lack of standardized equipment testing and that revisions to voting system
software for all systems and counties were not documented or tracked, the
review said.
RECOMMENDATIONS
Secretary Brunner has presented recommendations and options
to address these findings to Gov. Ted Strickland and legislative leaders for
their consideration. Among the top recommendations are:
* Eliminating
points of entry creating unnecessary voting system risk by moving to Central
Counting of Ballots
* Eliminating Use
of Direct Recording Electronic (DREs) and Precinct-based Optical Scan Voting
Machines that tabulate votes at polling locations
* Utilizing the
AutoMark voting machine for voters with disabilities (This machine “reads” the
bar code on a blank ballot and acts solely as a ballot marking device, allowing
voters, especially those with disabilities, to mark ballots with little or no
assistance, preserving the secrecy of their ballot selections.)
* Requiring all
ballots be Optical Scan Ballots for central tabulation and effective voter
verification
* Maintaining “no
fault” absentee voting while establishing Early (15 days prior to the election)
and Election Day Vote Centers (of the size of 5 to 10 precincts), eliminating
voting at individual precincts or polling places of less than 5 precincts
* Requiring all Special Elections (issues
only) held in August 2008 to be voted by mail (no in-person voting, except at
the board of elections, for issue-only elections held in August 2008)
CUYAHOGA COUNTY PRIMARY ELECTION REMEDY
With a swift indication for state funding assistance,
Cuyahoga County could move to a central-count optical scan voting system in
time for the March 2008 primary election by using leased DREs for precinct-
based voting by persons with disabilities and purchasing high-speed optical
scanners (with compatible server and software and voting booths) for
optical-scan voting.
This option has been estimated to cost between $2 million
and $2.5 million. All purchased equipment could transfer to a vote center
voting system for use in November 2008, and extra voting booths not needed for
vote centers could be redistributed to other counties migrating from DRE to
optical scan central count vote centers.
The county would be responsible for printing a sufficient number of
ballots for the March primary election.
If this option were approved, purchases would need to be made
immediately, with reimbursement applied for by the secretary of state to the
Ohio General Assembly to reimburse the Cuyahoga County commissioners for
equipment purchases.
CONCLUSION
The EVEREST study builds upon previous studies conducted
around the country on voting systems, the Ohio secretary of state’s office
said. The study of the ES&S systems, however, is the first of its kind,
officials said.
The Ohio study used testing done by both researchers from
academic institutions including the University of Pennsylvania, Pennsylvania
State University and University of California at Santa Barbara, as well as
corporate security personnel from firms such as Systest Labs of Denver and
MicroSolved, Inc. of Columbus, Ohio. The Battelle Memorial Institute of
Columbus served as project manager.
Researchers in the Ohio study had access to the computer
source code provided by voting machine manufacturers as well as access to much
of the equipment and documentation, the secretary of state’s office said.
-30-
(Editor’s Note: Copies of the EVEREST study and possible
options are available online at www.sos.state.oh.us).
___
Media Contacts:
Patrick Gallaway, Director of Communications, (614) 752-2450
Jeff Ortega, Assistant Director of Communications, Media, (614) 466-0473.