All of California's Voting Machines Lose Test To Hackers

SFgate.com reports:

State-sanctioned teams of computer hackers were able to break through the security of virtually every model of California's voting machines and change results or take control of some of the systems' electronic functions, according to a University of California study released Friday.

The researchers "were able to bypass physical and software security in every machine they tested,'' said Secretary of State Debra Bowen, who authorized the "top to bottom review" of every voting system certified by the state.

Neither Bowen nor the investigators were willing to say exactly how vulnerable California elections are to computer hackers, especially because the team of computer experts from the UC system had top-of-the-line security information plus more time and better access to the voting machines than would-be vote thieves likely would have.

"All information available to the secretary of state was made available to the testers,'' including operating manuals, software and source codes usually kept secret by the voting machine companies, said Matt Bishop, UC Davis computer science professor who led the "red team" hacking effort, said in his summary of the results.

The review included voting equipment from every company approved for use in the state, including Sequoia, whose systems are used in Alameda, Napa and Santa Clara counties; Hart InterCivic, used in San Mateo and Sonoma Counties; and Diebold, used in Marin County.

Election Systems and Software, which supplied equipment to San Francisco, Contra Costa, Solano and Los Angeles counties in last November's election, missed the deadline for submitting the equipment, Bowen said. While their equipment will be reviewed, Bowen warned that she has "the legal authority to impose any condition'' on its use.

Bowen said in a telephone news conference Friday that the report is only one piece of information she will use to decide which voting systems are secure enough to use in next February's presidential primary election.

If she is going to decertify any of the machines, she must do it by Friday, six months before the Feb. 5 vote.

A day-long hearing in Sacramento on Monday will give the UC investigators a chance to present their finding and allow the various voting machine companies to present a response. The hearing also will be open for comments from the public.

The study was designed to discover vulnerabilities in the technology of voting systems used in the state. It did not deal with any physical security measures that counties might take and "made no assumptions about constraints on the attackers,'' Bishop said.

"The testers did not evaluate the likelihood of any attack being feasible,'' he added.

Some county elections officials in the state were among the most critical of the study, saying they worry that they could be forced to junk millions of dollars in voting machines if Bowen decertifies them for the February election.

Letting the hackers have the source codes, operating manuals and unlimited access to the voting machines "is like giving a burglar the keys to your house,'' said Steve Weir, clerk-recorder of Contra Costa County and head of the state Association of Clerks and Election Officials.

The study also determined that many voting systems have flaws that make it difficult for blind voters and those with other disabilities to cast ballots.

During her election campaign last year, Bowen made it clear she had little confidence in the security of electronic voting machines and vowed to review their use in the state.

"Voting systems are tools of our democracy,'' she said Friday. "We want to ensure that the voting systems used in the state are secure, accurate, reliable and accessible to all. This (study result) is not a big deal to me. It's a big deal for everyone in the country.''

Vendors and other advocates of electronic voting machines have suggested that because of Bowen's well-publicized concerns, she has her thumb on the scale when it comes to reviewing the systems. But the secretary of state said she purposely avoided the scientists doing the study.

Bowen admitted that she's "enough of a geek" that she would have enjoyed working closely with the study, but "I've stayed out of the way ... It's not my review,'' she said. "I didn't want (the researchers) to be influenced by my questions.''

Weir said the UC study "is only a hologram of what could be done technically without considering the real-world mitigation,'' the locks, access cards and other physical security measures typically used.

The study found "absolutely no evidence of any malicious source code anywhere,'' he added. "They found nothing that could cast doubt on the results of elections.''

Bishop, however, said he was surprised by the weakness of the security measures, both physical and electronic, protecting the voting systems. His team of hackers found ways to get into the systems not only through the high-tech equipment in election headquarters but also through the machines in the polling places.

If the testers had had more time, they would have found more flaws, he added.
"The vendors appeared to have designed systems that were not high assurance (of security)," said Bishop, a recognized expert on computer security. "The security seems like it was added on.''

Karl Rove's Big Election Fraud Hoax

At Salon.com, Garrett Epps writes:
By evil chance, I spent the Saturday night before Election Day 2000 at a jolly dinner for high-level Republicans. Most of the talk over the entrees concerned why then-candidate George W. Bush had been too pusillanimous to tell the voters that Al Gore was not just a liberal, but a Soviet-style Marxist-Leninist. But as the desserts circulated, so too did a piece of comic relief -- an anonymous leaflet explaining to voters that because of heavy voter registration, the rules had been changed: Republicans would vote on Tuesday, Democrats and independents on Wednesday.

I think of that dinner whenever I read about the widening scandal of the U.S. attorneys and the politicization of the Justice Department under Attorney General Alberto Gonzales. Gonzo is probably the most endangered man since William Tell's son Walter. The pattern behind the scandal, however, transcends Gonzales' fate or that of his underlings.

At least part of the U.S. attorneys plot seems to derive from the "election fraud" hoax that Republicans are trying to perpetrate in order to gain control of the country's voter lists. So nailing this inept crew of thugs won't be good enough. We need laws protecting the right to vote from the kind of phony, partisan prosecutors that Gonzales, Rove and Co. were trying to put in place, and from the punitive, restrictive voter-ID laws that are a prominent part of the far-right political agenda.

Republicans do cherish their little practical jokes -- the leaflets in African-American neighborhoods warning that voters must pay outstanding traffic tickets before voting; the calls in Virginia in 2006 from the mythical "Virginia Election Commission" warning voters they would be arrested if they showed up at the polls. The best way to steal an election is the old-fashioned way: control who shows up. It's widely known that Republicans do better when the turnout is lighter, whiter, older and richer; minorities, young people and the poor are easy game for hoaxes and intimidation.

The latest and most elaborate of these jokes is the urban legend that American elections are rife with voter fraud, particularly in the kinds of poor and minority neighborhoods inhabited by Democrats. In 2002, Attorney General John Ashcroft announced that fraudulent voting would be a major target of the Department of Justice. As the New York Times reported last month, the main result of this massive effort was such coups as the deportation of a legal immigrant who mistakenly filled out a voter-registration card while waiting in line at the department of motor vehicles.

But the administration has remained ferociously committed to suppressing voter fraud -- as soon as it can find some. In April of last year, Karl Rove warned a Republican lawyers' group that "we have, as you know, an enormous and growing problem with elections in certain parts of America today. We are, in some parts of the country, I'm afraid to say, beginning to look like we have elections like those run in countries where the guys in charge are, you know, colonels in mirrored sunglasses. I mean, it's a real problem.

"I appreciate that all that you're doing in those hot spots around the country to ensure that the ballot -- the integrity of the ballot is protected, because it's important to our democracy."

One of the aims of the abortive purge of U.S. attorneys was to punish those who refused to toe the line on the new emphasis on alleged voter fraud. A few fired prosecutors would serve as examples to the rest –- either move to criminalize the election process or face dismissal.

But the assault on voter fraud was a solution looking for a problem. As part of the Help America Vote Act, Republicans insisted on creating the Election Assistance Commission, which commissioned studies of the asserted problem. When the studies failed to turn up evidence of fraud nationwide, appointed Republican officials on the EAC insisted that the language say only that "there is a great deal of debate on the pervasiveness of fraud in elections" -- the same approach to inconvenient evidence that's made the Bush global-warming policy the envy of the world.

The legend of massive voter fraud forms the backdrop to enactment of harsh voter-ID laws. As previously recounted in Salon, a state voter-ID law in Missouri nearly prevented the Democrats from retaking the U.S. Senate -- a prime example of how the voter fraud narrative was used to sell a law intended to keep Democrats from the polls.

In November 2000, Missouri Republican John Ashcroft lost his Senate seat in a close election in which the votes of African-Americans from St. Louis were crucial. Ashcroft's next job was U.S. attorney general. The Department of Justice and Missouri's two U.S. attorneys soon undertook multiple voter fraud investigations. They probed the 2000 election, the 2001 mayoral primary in St. Louis, and the 2004 election, convicting a total of four people. The resulting specter of fraud was used to float a voter-ID law in the Republican-dominated state Legislature, which was finally passed in May 2006.

By then, President Bush had already used a Patriot Act loophole to dispatch Bradley Schlozman, who had supervised the voting section of the DOJ's Civil Rights Division, to Kansas City as the Western District of Missouri's new U.S. attorney. Less than a week before Election Day 2006, Schlozman indicted four people for voter fraud. Schlozman's endeavors were first spotlighted by Salon in a report on March 21, helping to make him the target of increasing blogger and media scrutiny. As one former senior Justice official told Salon then, Schlozman's appointment had senior Justice Department officials "scratching their heads" because Schlozman "was not a very well-regarded trial attorney."

In the end, the voter-fraud scare didn't help Missouri Republicans. Schlozman may have been filing indictments, but the state Supreme Court had struck down Missouri's new voter-ID law a month before the election, finding that it contravened the state constitution. On Nov. 7, Democrat Claire McCaskill defeated incumbent Republican Jim Talent by fewer than 50,000 votes out of more than 2 million cast. The voter-ID law would've required about 170,000 registered voters to apply for a new ID just to be allowed to vote again.

We can't count on the U.S. Constitution to protect the election process. The Constitution does not explicitly protect the right to vote, and the conservative majority on the Rehnquist and Roberts courts has proved friendly to anti-turnout measures. As Mark Graber of the University of Maryland pointed out recently, the court echoed right-wing rhetoric about voter fraud in a little-noticed 2006 opinion allowing Arizona to implement its restrictive voter-ID law. "Voters who fear their legitimate votes will be outweighed by fraudulent ones will feel disenfranchised," the court's per curiam opinion stated. This is the argument that voter-restrictionists have fallen back on. There may be no voter fraud, but if people think there is, then we should tighten up anyway. That's the argument used in Missouri (with support from the White House), where studies showed elections were mostly clean. As Graber noted, to restrictionists, "such a 'feeling' offsets the interests of voters who are disenfranchised by voter-ID laws by actually driving honest citizens out of the democratic process!"

So we can't count on federal courts; and not every state constitution contains a guarantee as specific as Missouri's provision guaranteeing the vote to "all citizens of the United States." In 2007, the right to vote is a little like the swimmers in the film "Open Water" -- still afloat, but encircled by hungry sharks who sooner or later will move in for the kill.

The answer is in the hands of the new Democratic majority in Congress. Though most Americans believe that the states are in sole charge of voting and elections, the framers at Philadelphia recognized that state officials might abuse their authority over voting. That's why Article I, Section 4 of the Constitution gives states the initial power to supervise federal elections -- but adds that "Congress may at any time by Law make or alter such Regulations." This provision was hotly debated during ratification; but federalists insisted that Congress needed this backstop power to protect the republican character of the new government against state meddling.

The new Congress so far has considered only a few measures to protect the right to vote: Rep. Rush Holt, D-N.J., has proposed a bill to require voting machines to keep paper trails; Sen. Barack Obama, D-Ill., wants to outlaw certain deceptive practices aimed at voter suppression.

But such defensive measures amount to little more than swatting sharks' noses. We're going to need a bigger boat. In the 1970 case of Oregon v. Mitchell, a fractured court approved a statute lowering the voting age to 18 in federal elections, even if states insisted on keeping it at 21 for state voting. (The 26th Amendment subsequently lowered the age to 18 for all elections.) How about a bill making clear that every American who is not under active sentence for felony has a right to vote for those who will govern the country? The bill could go on to say that states could require reasonable identification for new registrants, but outlaw onerous provisions like Missouri's, which would, for example, have required that married women produce legal documentation of their name change. (I reviewed the Missouri law with my mother, who has voted in every election since 1944. We determined that, had she lived in Missouri, she would have been barred from the polls in 2006.)

For that matter, why not just move the entire country to the vote-by-mail system we use in my home state of Oregon? It's quick, it's convenient, it leaves a paper trail, and we have had no credible accusations of voter fraud since it was adopted during the 1990s -- and a stunning 86 percent of registered voters cast ballots in the 2004 presidential election.

Voter fraud is a phony issue, and if restrictionists shape the dialogue, sooner or later our right to vote will become property of the Karl Roves, who will use the machinery of the criminal law to recreate the electorate in their own image.

The real issue is the right of every American citizen to vote, the right of the people to choose their rulers, rather than the reverse. Who can really oppose that, if asked about it in the light of day?

You Have No Right To Vote

In Salon.com, Garrett Epps writes:
Last week, a Missouri judge reminded the state Legislature that citizens of the state have a right to vote. And because it is a right, not a privilege granted by the powerful, Missourians can cast their ballots this November without having to meet identification requirements that seemed designed to make it harder for certain people -- the poor, the elderly, minorities and women -- to exercise that right.

That's the good news. The bad news is that this right comes from the Missouri state Constitution. The U.S. Constitution does not explicitly guarantee a right to vote, and our federal courts currently read the document not to include it.

The Missouri case should spark some national discussion about why it is that our country, almost alone among advanced democratic nations, does not find this right worth including in its Constitution. It should also inspire closer scrutiny of a kind of a electoral gamesmanship that is going on around the country, as Republicans seek to exploit this gap in our democratic guarantees.

The Republican majority of the Missouri Legislature has been haunted by a fear that is widespread in red America: a fear that the wrong kinds of people are voting. As a result, they passed a "Voter Protection Act," which required a state-issued photo ID for any voter who shows up at the polls. A state driver's license would do. But those who didn't already have a license -- even if they had been voting at the same address for the past half-century -- would be required to get a state-issued ID. To get one of those IDs, they would need to produce proof of citizenship, like a birth certificate or a passport, as well as documents showing that they were lawfully present at their current addresses. If they had ever changed their names -- if, for example, they were women voting under their married names -- they would be required to produce documents legitimizing the name change as well.

At first glance, this might seem like a minor thing. The bill's sponsor, Republican state Sen. Delbert Scott, noted that "you have to use [photo ID] to get on an airplane, to buy cigarettes." And, after all, the requirement would impact a small group of citizens -- a mere 170,000. That's only about 4 percent of the electorate, hardly a significant number. It is only, for example, eight times the margin of victory by which Sen. Jim Talent (coincidentally running for re-election this fall) defeated Democratic incumbent Jean Carnahan in 2002.

Most people don't really have to show ID to buy cigarettes. Beyond that, to state the obvious, neither air travel nor cigarette smoking is a fundamental component of democratic self-government. Voting is. A law that increases the cost and difficulty of voting will predictably reduce the number of people who vote, and a democracy that excludes large numbers of its citizens from the franchise isn't worthy of the name.

Many middle-class whites don't realize that for the poor and minorities, voting can be a difficult and even scary proposition. I first learned this as a poll-watcher in 1976, when I saw a white registrar in Virginia solicitously asking a black voter whether he was sure his registration form had been properly filled out. "You know fraudulent voting is a federal crime, don't you?" she purred, smiling sweetly. Southern Republicans often blanket poor black neighborhoods warning would-be voters that they might be arrested at the polls if they have unpaid traffic tickets.

Intriguingly, the Republican sponsors of the Missouri bill weren't really able to argue that it was needed to prevent fraud as such. Despite their best efforts, they couldn't find much evidence of fraudulent voting. So they argued instead that the law was needed because without it, solid Missouri citizens -- the kind of people who vote Republican, for example -- might be tempted to think there was fraud at the polls. Gov. Matt Blunt explained that the bill would "restore Missourians' confidence in state elections." (Blunt's margin of victory in 2004 -- certified by himself as secretary of state -- was 3 percent of the vote.) The Springfield News Leader, which supported the bill, said it would provide "peace of mind for voters who want to know that cheaters aren't improperly influencing an election."

But on Sept. 14, Cole County Circuit Judge Richard Callahan blocked the law from taking effect. Callahan pointed out that Article VII of Missouri's Constitution says that "All citizens of the United States ... who are residents of this state ... are entitled to vote at all elections by the people." The ID rule, he reasoned, would allow the Legislature to add an onerous qualification to those spelled out in the Constitution.

The judge's decision squares with common sense, as well as with the text. And it highlights the lack of a similar provision in the U.S. Constitution. As a result of this lack, other states -- mostly those in which Republicans currently run the legislature -- are adding such requirements. Former Bush campaign officials last year launched a new conservative advocacy group, the oxymoronically titled American Center for Voting Rights, designed to push such legislation at both the state and federal levels. So far, Arizona, Georgia, Indiana, Florida and Ohio have passed or tightened photo ID laws. Democratic governors in Wisconsin and Pennsylvania vetoed such laws earlier this year, and state and federal courts have both blocked the Georgia law.

Throughout our history, Americans have been profoundly ambivalent about the vote. The Constitution of 1787 left the issue of federal voting rights entirely to the states, which could disenfranchise their voters more or less as they chose. Today, even though "the right to vote" is by now mentioned five times in the amended Constitution, the federal courts continue to insist that voting is mostly a state matter. The Supreme Court restated the point in 2000, in Bush v. Gore. "The individual citizen has no federal constitutional right to vote for electors for the President of the United States," said the Court, rather breezily, "unless and until the state legislature chooses a statewide election as the means to implement its power to appoint members of the Electoral College."

Meanwhile, virtually every other advanced democracy already has an explicit guarantee of the right to vote. Ironically, whenever the United States imposes a constitution on another (conquered) nation, we tend to insist that they include in those documents a right we do not ourselves possess. Afghans have "the right to elect and be elected," Iraqis have "the right ... to vote, to elect, and to nominate," and the Japanese enjoy "universal adult suffrage."

Since the fiasco in Florida, a number of scholars and activists have been working to generate a constitutional fix for this problem. American University law professor Jamie Raskin (who was elected last week to the Maryland state Senate) in 2001 proposed an amendment that would say, in part, "Citizens of the United States have the right to vote in primary and general elections ... and such right shall not be denied or abridged by the United States or any State." At the time, Raskin noted that "only Azerbaijan, Chechnya, Indonesia, Iran, Iraq, Jordan, Libya, Pakistan, Singapore, and, of course, the United Kingdom ... still leave voting rights out of their constitutions." Raskin's call has been echoed by other scholars. Rep. Jesse Jackson Jr., D-Ill., has championed such an amendment, and FairVote.org, an advocacy group, is fighting for national and local reforms that would make clear that it is the government's responsibility to ensure that all eligible voters have a chance to cast a ballot.

But with Republicans in charge in many state capitals and Washington, the momentum in practical terms is moving the other way. On Sept. 14, the U.S. House Administration Committee approved by a straight party vote a proposed bill that would require all voters nationwide to obtain IDs by producing a birth certificate or passport.

This argument is too crucial to democracy, and too easy to win, for progressives to let it slide. Voting is not a privilege for which citizens must qualify by showing their ability to dodge bureaucratic hurdles. If fraud really is a concern, state elections officials could be authorized to update voter lists and follow up on changes of address. That's what happens in most other democratic countries.

Real democratic values in this country are currently under assault. Day after day, we must justify concepts that were once accepted as givens. We are forced to discuss whether a free country really needs the rule of law, or freedom of speech, or an executive subject to legislative oversight. It would be nice to begin campaigning for measures that would do more than just get democracy out of its defensive crouch -- that would actually make democracy stronger. A right to vote might be one of them. When the argument is truly joined, who can be against it?

GOP Challenging Voter Registrations

The Washington Post reports:

Republicans yesterday continued to challenge the validity of tens of thousands of voter registrations in Ohio and other key states in the presidential election while a coalition of civil rights and labor groups sued the GOP, contending the Republican efforts were aimed at removing eligible minority voters from the rolls.After initially saying he would not contest a Wednesday ruling halting the challenges, Secretary of State J. Kenneth Blackwell (R) worked with other election officials who asked the U.S. Court of Appeals for the 6th Circuit in Cincinnati to allow GOP challenges to 35,000 voters from mostly urban and minority areas to proceed before the election. As of late last night, the court had not ruled.

Also yesterday, Republicans in Wisconsin attempted to challenge the registrations of 5,600 voters in Milwaukee but were turned down in a unanimous decision by the city's bipartisan election board.

The Republican challenges in Ohio, Wisconsin and other battleground states prompted civil rights and labor unions to sue in U.S. District Court in Newark, saying the GOP is violating a consent decree, issued in the 1980s by Judge Dickinson R. Debevoise and still in effect, that prevents the Republicans from starting "ballot security" programs to prevent voter fraud that target minorities.

Judith A. Browne, acting co-director of the Advancement Project, which filed the lawsuit along with the Leadership Conference on Civil Rights, said the Republican "challenges were, and currently are, used to disenfranchise minority voters."

But Republicans denied that they were targeting black voters. Bobby Burchfield, an attorney for the Republican National Committee, told Debevoise that "troubling reports" of fictitious names such as Mary Poppins appearing on Ohio's rolls prompted the challenges.

Debevoise, who scheduled a hearing for Monday, expressed concern that widespread challenges on the fear of fraud could unnecessarily disrupt polling places.

The legal maneuvering is a testament to the legalization of presidential politics that resulted from the bitterly disputed presidential contest in 2000 between George W. Bush and Al Gore, which deadlocked in Florida. Both parties have embarked on litigation over voting rules in many states and have thousands of lawyers poised for Election Day.

The move in Milwaukee, a heavily minority and Democratic stronghold, is part of a national effort by Republicans in many battleground states to challenge voter registrations.

A similar effort by a former Nevada GOP operative to question 17,000 Democratic voters in Las Vegas was rejected earlier this month by election officials there. Republicans have also filed plans in Florida and Colorado to place watchers who can challenge voters in those key states on Election Day.

Challenge rules vary by state. In general, challengers must supply evidence that the voter may not be eligible. Grounds can include that a voter is not a U.S. citizen, is not a resident of the state or county where he or she is registered, or is younger than 18. The complaints are settled by election board members or precinct judges.

Republicans argue that their program -- the most robust in recent history -- is necessary because unprecedented voter registration drives by Democratic-leaning interest groups have produced thousands of phony registrations. But Democrats say that the GOP's Milwaukee challenges are a perfect example of the party trying to imply fraud where none exists. Lawyers for John F. Kerry's campaign successfully argued before the election board there that the analysis the GOP used to challenge voters was riddled with mistakes.

Courts in the past found that Republicans used tactics that were aimed at intimidating minority voters and suppressing their votes. The consent decrees in New Jersey stemmed from several incidents in the 1980s.

In 1981, the Republican National Committee sent letters to predominantly black neighborhoods in New Jersey, and when 45,000 letters were returned as undeliverable, the committee compiled a challenge list to remove those voters from the rolls. The RNC sent off-duty law enforcement officials to the polls and hung posters in heavily black neighborhoods warning that violating election laws is a crime.

In 1986, the RNC tried to have 31,000 voters, most of them black, removed from the rolls in Louisiana when a party mailer was returned. The consent decrees that resulted prohibited the party from engaging in anti-fraud initiatives that target minorities or conduct mail campaigns to "compile voter challenge lists."

Undeliverable mail is the basis for this year's challenges in Ohio. Republicans also sent mail to about 130,000 voters in Philadelphia, another heavily black and Democratic stronghold.

The civil rights groups and labor unions, which are backed by the Democratic Party, also charged that GOP plans to put challengers in thousands of precincts nationwide on Election Day are race-based. In several Florida counties, for instance, GOP challengers will disproportionately be based in black precincts.

Republicans said their plans involve putting challengers in precincts won handily by either Bush or Gore and has nothing to do with race.