Florida spit shine

After the first few sentences of the New York Times article regarding the panel review of the disputed Congressional race in Sarasota County, Florida, I knew there was more to the story than the Times was reporting. Much more. Such is the state of our mainstream media today; they simply cannot be trusted to fully report ... anything. Especially when that anything is problems with the electoral system.

You'll recall that some 18,000 votes disappeared in the House election, many of them vanishing from precincts that were expected to favour the Democratic candidate, Christine Jennings. Republican Vern Buchanan was declared the winner by 369 votes.

The hollow review begins:

Florida election officials announced yesterday that an examination of voting software did not find any malfunctions that could have caused up to 18,000 votes to be lost in a disputed Congressional race in Sarasota County, and they suggested that voter confusion over a poor ballot design was mainly to blame.

Further reading imparts no greater understanding of the voting review at all and merely lays down cover fire for the official story.

[The report] said that all eight members of the investigative team, including some experts who have long been skeptical about the paperless machines, agreed that the basic programming “did not cause or contribute to” the loss of votes.

That sounds like a pretty firm statement and conveys certitude that the "basic programming" must surely have been examined for bugs and/or malicious code. The reality, of course, is much different.

Ed Felton, Professor of Computer Science and Public Affairs at Princeton University and listed as a "principal investigator" on the vote machine study team, says that he was not, in fact, part of the team at all. Jennings' lawsuit seeking an investigation, sought access to the voting machines and their code. This was denied in court with a circular order apparently implying that evidence of machine malfunction would be needed in order to investigate machine malfunction. In other words, if Jennings could not provide evidence that the machines behaved badly, even though they clearly did, an investigation seeking evidence of malfunction would not be authorized. That's a win-win for voting machine companies.

Felton further indicates that, once Jennings lawsuit was denied, the friendlies at the Florida Department of State (DOS) commissioned a study by outside experts. Felton says this study was likely going to be completely inadequate and he refused to participate:

I discussed with representatives of DOS the possibility of participating, but eventually it became clear that the study they wanted to commission was far from the complete, independent study I had initially thought they wanted.

Felton describes the fact that this "study" wasn't going to be much of a study at all, certainly not of the machines in question:

The biggest limitation on the study is that DOS is withholding information and resources needed for a complete study. Most notably, they are not providing access to voting machines. You don’t have to be a rocket scientist to realize that if you want to understand the behavior of voting machines, it helps to have a voting machine to examine. DOS could have provided or facilitated access to a machine, but it apparently chose not to do so.

Despite the New York Times wash,

the DOS study did find many instances of [exploitable buffer overflow bugs]. Misplaced trust in the election definition file can be found throughout the iVotronic software. We found a number of buffer overruns of this type. The software also contains array out-of-bounds errors, integer overflow vulnerabilities, and other security holes.

Felton simplifies this conclusion finding:

sloppy software + removable storage = virus vulnerability. We saw the same thing with the Diebold touchscreen voting system.

Furthermore,

Another example of poor security is in the passwords that protect crucial operations such as configuring the voting machine and modifying its software. There are separate passwords for different operations, but the system has a single backdoor that allows all of the passwords to be bypassed by an adversary who can learn or guess a one-byte secret, which is easily guessed since there are only 256 possibilities.

Felton further judges the study's conclusion that it was all voters' fault is not founded well:

The study claims to have ruled out reliability problems as a cause of the undervotes, but their evidence on this point is weak, and I think the jury is still out on whether voting machine malfunctions could be a significant cause of the undervotes.

In Felton's opinion, the undervotes in Sarasota indicate flaky behaviour rather than malicious code,

I agree with the study team that the undervotes were almost certainly not caused by a security attack. The reason is simple: only a brainless attacker would cause undervotes. An attack that switched votes from one candidate to another would be more effective and much harder to detect.

This displays a rationality that fails to take into account the fact that election officials will not only try to cover the tracks of voting machine malware, but have been doing so for sometime. But the New York Times, once again, varnishes the facts regarding the dreadful state of voting technology by hiding the larger story and delivers unto readers an incomplete picture about an obviously incomplete study.