Debunking Pre-Election Testing Myths

-- California Voting Systems Technology Assessment Advisory Board (VSTAAB), Security Analysis of the Diebold AccuBasic Interpreter, February 14, 2006  

7.  "[W]hile 'logic-and-accuracy testing' can sometimes detect flaws, it will never be comprehensive; important flaws will always escape any amount of testing." 

-- Wallach, Dan S. Testimony to National Institute of Standards and Technology and Election Assistance Commission Technical Guidelines Development Committee, September 20, 2004.  

8. "The current certification process may have been appropriate when a 900 lb lever voting machine was deployed. The machine could be tested every which way, and if it met the criteria, it could be certified because it was not likely to change. But software is different. The software lifecycle is dynamic...[Y]ou cannot certify an electronic voting machine the way you certify a lever machine.... [W]e absolutely expect that vulnerabilities will be discovered all the time.... 

"Software is designed to be upgraded, and patch management systems are the norm. A certification system that requires freezing a version in stone is doomed to failure because of the inherent nature of software." 

-- Rubin, Avi (Professor of Computer Science at Johns Hopkins University). Secretary Bowen's Clever Insight. Avi Rubin's Blog, August 7, 2007.     

9. "Flaws in the Optical Scan software enable an unofficial memory card to be inserted into an active terminal. Such a card can be preprogrammed to swap the electronically tabulated votes for two candidates, reroute all of a candidate's votes to a different candidate, or tabulate votes for several candidates of choice toward a different candidate. 

-- Gardner, Ryan, Alec Yasinsac, Matt Bishop, Tadayoshi Kohno, Zachary Hartley, John Kerski, David Gainey, Ryan Waalega, Evan Hollander, and Michael Gerke. Software Review and Security Analysis of the Diebold Voting Machine Software. Florida Dept. of State: Florida State University, Security and Assurance in Information Technology Laboratory, July 27, 2007. 

10. When discussing its study of ES&S systems (the iVotronic touch screen, and the M100 and the M650 optical scan systems), Project EVEREST researchers reported: 

"The second key finding of the review was the apparent vulnerability of the system to malware infection and manipulation. If a properly skilled and resourced attacker can gain access to any of several components in the system at any time during their life-cycle, there exists a large possibility that they could implement malicious programming (malware) into the system with little chance of detection. Once the malware was in place on the system, it could perform a variety of tampering and could likely spread from component to component throughout the system.  

"The ability of malware to affect the integrity and availability of the elections process is profound and disturbing, but the lack of capability to detect and report potential malware attacks against the system makes it the single largest threat." 

-- Ohio Secretary of State. Project EVEREST: ES&S System MicroSolved, Inc. Executive Summary Report. n.d. (December 2007).  

Assertions that no vote switching has ever been shown to have occurred on an ES&S system or any other computerized voting system is explained by the fact that malware can be self-erasing.  That's why computer experts are calling for "software independence" – we cannot rely on results reported by easily mutable software and must count the ballots by other means. 

11. "Of course, numerous studies have shown that currently deployed voting systems are susceptible to undetectable malicious attacks....