<http://www.wired.com/news/privacy/0,1848,61014,00.html>
Software used by an electronic voting system manufactured by Sequoia Voting Systems has been left unprotected on a publicly available server, raising concerns about the possibility of vote tampering in future elections.
The software, made available at ftp.jaguar.net, is stored on an FTP server owned by Jaguar Computer Systems, a firm that provides election support to a California county. The software is used for placing ballots on voting kiosks and for storing and tabulating results for the Sequoia AVC Edge touch-screen system.
The security breach means that anyone with a minimal amount of technical knowledge could see how the code works and potentially exploit it. According to a computer programmer who discovered the unprotected server, the files also contain Visual Basic script and code for voting system databases that could allow someone to learn how to rig voting results. The programmer spoke on condition of anonymity.
Jaguar blocked public access to the FTP site late Wednesday. Representatives from Jaguar did not return calls for comment.
Sequoia said it was disturbed that the proprietary code had been accessed in an "inappropriate manner," and went on to blast Jaguar in an e-mail to Wired News about the security gaffe.
"While this breach of security is grossly negligent on the part of the county's contractor, the code that was retrieved is used to accumulate unofficial results on election night and does not compromise the integrity of the official electronic ballots themselves," wrote Sequoia spokesman Alfie Charles.
Peter Neumann, lead computer scientist at the Stanford Research Institute, said the exposed code could allow someone to plant a Trojan Horse in the system's compiler -- the program that translates the code for use by the computer -- that would be undetectable to anyone reading the code.
The files on the server also revealed that the Sequoia system relies heavily on Microsoft software components, a fact the company often has been coy about discussing since Microsoft software is a frequent target of hackers.
Jaguar, based in Riverside, California, left the data unencrypted and unprotected. The FTP server allowed anyone to access it anonymously.
Once a visitor gained access to the server, a small note stated that the server was meant for employees and clients of Jaguar. However, the company's own website directed visitors to the FTP server and noted that "our '/PUB' directory is stuffed with many of the files that we use." The website has since been changed by Jaguar.
Sequoia's AVC Edge voting machines were used in California's Riverside County for the 2000 presidential election and for last month's California gubernatorial recall election. The system also has been used in counties in Florida and Washington state.
It's the second time this year that voting machine code has been leaked on the Internet.
In January, source code for the AccuVote-TS system made by Diebold Election Systems was found on an unprotected FTP server belonging to the company.
Researchers at Johns Hopkins and Rice universities who read the Diebold code found numerous security flaws in the system and published a report (PDF) that prompted the state of Maryland to conduct its own audit of the software.
A key difference between the Diebold and Sequoia leaks has to do with the type of code used. The Diebold code was source code, a raw form of code that contains programmer notes and comments and allows anyone to quickly see how a system works.
The Sequoia code is binary code, which is already compiled with the comments and other information stripped away. It's working code, which means that the program must be reverse-engineered, or taken apart, in order to understand how it works. This is not hard to do, but it takes more time than working with source code. The Johns Hopkins researchers were able to write their report on the Diebold code in two weeks. The Sequoia code would take at least two months, the researchers said.
But even binary code reveals a lot of information about a program, said Avi Rubin, one of the Johns Hopkins researchers who wrote the report on the Diebold system.
"With binary code you can create most of the program and analyze it," he said. "All the information about what the program does is there. Maybe 60 percent of what you can get from the source code you can also get from the binary."
On its website, Sequoia makes a point of stating that its system is much more secure than the Diebold system, since it doesn't rely on Microsoft software. The website reads: "While Diebold relies on a Microsoft operating system that is well known and understood by computer hackers, Sequoia's AVC Edge runs on a proprietary operating system that is designed solely for the conduct of elections."
In fact, the system uses WinEDS, or Election Database System for Windows. WinEDS runs on top of the Microsoft Windows operating system. According to Sequoia, "WinEDS is used to administer all phases of the election cycle, create electronic ballots for the AVC Edge, and tally early voting, as well as official election and absentee votes."
The system also appears to use MDAC 2.1, or Microsoft Data Access Components, which was found in the WinEDS folder on the server. MDAC is code used to send information between a database and a program. According to the computer programmer who discovered the FTP server containing the Sequoia code, version 2.1 was found to be insecure. He said Microsoft currently distributes an upgraded version 2.8, which has been available since August, but the version on the Jaguar site doesn't include a patch to fix the security problems.
Also, because MDAC is off-the-shelf software, it's not subject to the same certification processes and audit that is standard for proprietary voting software.
Neumann, the security expert, said, "This means that anyone could install a Trojan Horse in the MDAC that won't show up in the source code." Jaguar employees, Sequoia employees or state election officials could insert code that wouldn't be detectable in a certification review of the code or in security testing of the system, he said.
Neumann said this points to the necessity for using only voting machines that provide a voter-verifiable paper trail.
"The idea of looking at source code to find problems is inherently unsatisfactory," he said. "You need to use a machine with accountability and an audit trail."
The source who discovered the unprotected server containing the Sequoia system code said the files include Visual Basic script, which is uncompiled script that can be changed very quickly and easily.
"You can swap out a file and plant a Trojan Horse in this," he said. "There's also SQL code in there that sets up a database. The SQL gives you details about the database that you can use to alter the contents of the database."
The companies making electronic voting systems long have said that their systems are proprietary and their code needs to remain secret in order for the systems to be secure.
Cindy Cohn, an attorney at the Electronic Frontier Foundation, said information gained from the discovery of the Diebold and Sequoia codes indicates the exact opposite.
"Our society and our democracy is better served by open voting systems," she said. "The way to create a more secure system is to open the source code and to have as many people as possible try to break into the system and figure out all the holes. The clearest way to have an insecure system is to lock it up and show it to only a few people."
Cohn said her organization is trying to convince election officials and companies to make their systems more secure. "That doesn't seem to be happening," she added. "So I have a lot of admiration for these people who are taking it upon themselves to try to figure out whether these machines are secure. I think we are all better off because of researchers who are taking the time to say the emperor doesn't have any clothes."
Rubin said the focus shouldn't be on keeping systems secret but on creating systems that are more secure so they can't be easily exploited or rigged for fraud.
"This argument that everything needs to be kept secret is not viable because the stuff does get out whether companies intend it or not," he said. "Now two out of the three top companies have leaked their system.
"Scientists are being made to feel afraid to look at these things, which in the end will be bad for our society. Why shouldn't everyone want scientists to look? If there's any feeling that there may actually be danger to our elections, how can we not be encouraging researchers to look at our systems?" Rubin said.