Diebold source code leaked again Another breach on the e-voting front as elections near Robert McMillan
October 21, 2006 (IDG News Service) -- Source code to Diebold Election Systems Inc. voting machines has been leaked once again.
On Wednesday, former Maryland state legislator Cheryl C. Kagan was anonymously given disks containing source code to Diebold's BallotStation and GEMS (Global Election Management System) tabulation software used in the 2004 elections. Kagan, a well-known critic of electronic voting, is Executive Director of the Carl M. Freeman Foundation, a philanthropic organization based in Olney, Maryland.
The disks were created and distributed by two federal voting machine testing labs run by Ciber Inc. and Wyle Laboratories Inc. They had been testing systems on behalf of the state of Maryland, Diebold said in a statement.
This is not the first time that Diebold source code has been leaked. In early 2003, Diebold critic Bev Harris uncovered similar source code while conducting research using Google Inc.'s search engine.
Soon after, researchers at Johns Hopkins University and Rice University published a damning critique of Diebold's products, based on an analysis of the software.
They found, for example, that it would be easy to program a counterfeit voting card to work with the machines and then use it to cast multiple votes inside the voting booth.
Diebold says it has since introduced security enhancements to its products, but the fact that the company's sensitive source code has again leaked out is not a good sign, according to Avi Rubin, a computer science professor with Johns Hopkins and one of the authors of the 2003 report.
The first leak should have taught Diebold a lesson on securing its source code, he said. "You would think that given the amount of embarrassment that caused them, they would do a better job of protecting it."
Rubin, who was shown the latest source code by a reporter at the Washington Post, said that it appeared to be "just another version" of the code that was published in 2003.
The disks came with a letter that was highly critical of Maryland State Administrator of Elections Linda Lamone, Rubin said on his blog. "It read like it was from somebody with a very, very serious axe to grind," he said. "It was one of the more outlandish things I've read."
Rubin believes the disks were given to Kagan because of her past criticism of electronic voting machines. "I guess whoever did this knew she would pursue it doggedly, which she did."
Diebold said the source code was for BallotStation 4.3.15C, which is no longer being used in the U.S., and for GEMS 1.18.19, which is being used in a "limited number of jurisdictions."
The FBI is investigating the leak, Diebold said.
The leak comes with just three weeks before elections in the U.S., but Maryland Board of Elections Deputy Administrator Ross Goldstein expressed confidence in the Diebold voting machines. The leaked code was "not software that's in use in this election," he said. "The software now is different and has many more security features."
Diebold echoed Goldstein's comments. "Voters and election officials can be confident that on Election Day, votes and vote totals will be safe, secure and accurate," the company said.
Kagan, however, wasn't so sure, saying that the security of the source code raised concerns. "The idea that it could be that readily available and could be delivered to me and who-knows-who-else around the state [is disturbing]," she said. "Who know what any other people may be doing with it?"