The Security Mentor

You'd expect that Diebold, a company with decades of experience making ATMs, should be able to put together an acceptable electronic voting machine.

The state of Maryland doesn't accept them. Their House of Delegates voted to ban Diebold machines from state elecions, by a margin of 137 to 0. North Carolina passed an election integrity law which Diebold couldn't or wouldn't comply with, pulling out of bidding instead.

So what's the big deal? Is it just a few noisy cranks kicking up a fuss, or is it the growing pains of a new technology, or is there something going on that a normal citizen with a life outside of politics ought to care about?

Noisy cranks and corporate shills are going to hit the newspaper ahead of everyone else. But if you poke around the forums where everyday information technology people hang out, the more they know the more concerned they are. They object to the lack of crosschecks and to having no good way to do a recount. For example, one computer professional under the handle tkrotchko wrote in part

do computer stuff for a living and if analyst came forward with a business process to handle credit card authorizations that simply authorized it with no audit trail and no means to verify anything about that authorization, you'd reject the design out of hand. You wouldn't even need to see the program specs, or source code or anything to know it's a bad design. You don't even have to ask a lot of questions. It's just a bad design. ...and the more the programmer/analysts would defend it, the more it would make you suspicious about what they're trying to pull.

Normal citizens can use common sense and look at how well a voting machine company responds to problem reports. For example, if the company illegally installs uncertified machines and gets caught, do they make sure not to do it again, or do they prosecute the whistleblower? When an election official finds security problems that are independently confirmed, does the company thank him or retaliate? You don't need to be a computer expert to evaluate the answers to those questions.

Here are some questions you should demand that your elected officials answer:

• Has the proposed voting machine been independently tested?
• Are the inner workings available for inspection?
• Does the vendor respond promptly and responsibly to problem reports?
• Is there any way to double-check election results?