Diebold Voting Machine hacked in four minutes flat

It's an old adage in politics that you need truckloads of money to get elected. Apparently you can now buy an election for what you'd spend in a few days on cups of coffee. Black Box Voting found that given $12 in tools, four minutes, and a little determination, you can access a Diebold voting machine's memory card, remove and replace it without a trace. This new development really isn't all that surprising given that it's been shown that these machines can be hacked in more than one way, even by monkeys. Concerned citizens, just switch to absentee paper ballots from now on -- it may be low-tech, but it's a hell of a lot more secure going the "old-fashioned" way.

[Via Slashdot]

[MF @ Oct 30th 2008 5:45PM]

check out TruVote.
It's a voting machine that works. We need to replace every Diebold machine with TruVote machines . . . ASAP.
Now get to work or suffer the consequences. We can make this change but it will take about 5 or 10 years. Better now than never.

MF

[RWD fan @ Sep 6th 2006 2:48PM]

I wouldn't count on the absentee ballots either, as they have a way of getting misplaced. One election a few years back saw more than a few big boxes of uncounted ballots floating around San Francisco bay.

http://www.berkeleydailyplanet.com/article.cfm?archiveDate=12-11-01&storyID=8869

Maybe we should be allowing an outside group to oversee our elections, but any UN group has alterior motives and wouldn't be trusted either.

I'd also love to see fingerprint recognition required to vote, but the ACLU wouldn't ever let that kind of thing prevent otherwise illegal participants from voting...
/phew, guess I'll take the tin-foil hat off now.

[Reality Check @ Sep 6th 2006 2:48PM]

Remember, the CEO of Diebold promised Bush that he would deliver him the election in 2004! That was the most truthful statement made by anyone during the campaign.

[Joe Alien @ Sep 6th 2006 3:00PM]

My solution is have a box for each candidate, and each voter is required to throw a penny into the box (or boxes) representing their vote. The heaviest box for that race wins if it's not obvious by looking at how high the pennies are. If too close, then count the pennies. When completed, the pennies go to charities.

[LukeA @ Sep 6th 2006 3:05PM]

"My solution is have a box for each candidate, and each voter is required to throw a penny into the box (or boxes) representing their vote. The heaviest box for that race wins if it's not obvious by looking at how high the pennies are. If too close, then count the pennies. When completed, the pennies go to charities."

That constitutes a poll tax and is therefore illegal in the U. S. And what would you do about box-stuffing, say with lead blanks?

[shmengie @ Sep 6th 2006 3:12PM]

i say we take the two candidates and put 'em in the octagon! no-holds-barred fight to the death. then, if the candidates were female, we could oil 'em up!

[crescentdave @ Sep 6th 2006 3:13PM]

It's obvious this government is not too terribly interested in engineering a more secure voting system. The question is: how interested are Americans in doing what it takes to FORCE these "elected" officials to do their job?

On balance, the evidence would seem to favor Diebold and complacency and a real love of sheep.

[gryphius @ Sep 6th 2006 3:17PM]

I don't get it... don't most of these hacks involve opening up the boxes to screw around with the guts of the ballot machine? is there no way to either lock or hide the actual hardware, and just give the user access to only the parts they need to access to do the ballot? i.e. the touchscreen and the card-reader slot? i mean jesus, a 10 dollar padlock, and a steel box around the guts of the machine should prevent anyone from getting in there in the time it takes to vote. or for that matter, weld it shut... that way you'd need a welding torch to get into the machine... There are plenty of low-tech ways to keep people from being able to hack their way in.

And for god's sake, hook up a printer to those damn machines and print out a backup copy of the voter's picks! Again, you can keep it locked up where no one can steal the resuts... it's really not that complicated.

[Halo2Master @ Sep 7th 2006 8:13AM]

It seems kind of superfluous to point out the fact that the machine can be compromised by opening it up and replacing components. I am sure the same thing can be done with any computer system, no matter how secure the software and communication protocols are.

After all that crap with hanging chads and re-counting, its hard to believe that there is anybody who can't see the benefits of an automated voting and counting system. No matter how many vulnerabilities may exist in a computer, infinitely more exist in a stack of papers in a lock box.

[LukeA @ Sep 6th 2006 3:43PM]

gryphius:

This hack doesn't actually require that the machine be opened. It only requires the removal of a single (knurled for easier removal) screw for all the machine's votes to be compromised.

[doubtful @ Sep 6th 2006 3:45PM]

$10 pad lock, gryphius? You must've missed the bump key article. No matter what they do, someone can and will find a way to break into, hack, or manipulate.

How can they let these people take these machines home? Can't we have some sembelence of a fair election?

[Bryan Siders @ Sep 6th 2006 4:11PM]

Couldn't someone open up the paper ballot box and replace all of the ballots with forgeries in four minutes as well? Granted, the memory card should probably be physically secured a bit more than what it is, but this doesn't make me think the digital ballot box is any less secure than the paper ones.

Well, unless they can do this tampering in the safety of the voting booth, since the paper ballots are usually carried out of the booth to a box in the middle of the room. If these paperless voting machines are storing each booth's numbers separately and the card can be accessed from *inside* the booth, someone needs to work on their hardware design.

[tubby17 @ Sep 6th 2006 4:17PM]

Possible solution:

1) Voter enters choices on computer screen.

2) Machine prints out HUMAN-READABLE ballot with voter's choices. Voter checks ballot to make sure choices are correct. If not, return to Step 1.

3) Voter puts this printed ballot in a ballot box, just like in the old days, and these ballots are later counted by humans (i.e., no barcode/scantron). The ballots are the final legal document, trumping any summary from the voting machine.

Why have voting machines in the first place?

1) The interface is easily changeable to accomodate different elections (i.e., different choices) and different electors (i.e., with physical handicaps or different language requirements).

2) Machine-printed ballot will be clean and relatively error-free, reducing the likelihood of butterfly-ballot-type debacles.

3) Least important but still potentially useful, machine results can be used to replace exit polls for quick, unofficial counts (with the assumption that these machine counts have the potential for inaccuracy, just like exit polls).

[Stutz @ Sep 6th 2006 4:20PM]

Here in brazil we have eletronic vote for a decade and we never had any problem with that (altough we do have pretty good hackers here). you americans just can´t do this simple task? well, buy OUR technology this time :)

[Zach Marshall @ Sep 6th 2006 4:18PM]

"My solution is have a box for each candidate, and each voter is required to throw a penny into the box (or boxes) representing their vote. The heaviest box for that race wins if it's not obvious by looking at how high the pennies are. If too close, then count the pennies. When completed, the pennies go to charities."

As stupid as it sounds - this idea is GENIOUS. There is about 300 million americans. How bout we say 220 million are over the age of 18.

Now, we have locations where you recieve a penny that you place into the box of the candidate. This way - its no longer considered a poll tax. If you wish not to spend your own penny, a penny can be provided for you, therefore its a not a required "tax". Each candidate would have a charity of his choosing.

This way, we've saved MILLIONS of dollars on stupid "hi-tech" voting machines that are exploitable and given millions to a worthy cause. Does anyone else not see the benefits of this

I wish this was digg.com I'd +digg you ;)

[Matt @ Sep 7th 2006 3:26PM]

The penny idea is genius? What's to stop ANYONE from dumping ten, a hundred, or a thousand pennies into the box of their choice? I can't really even begin to imagine a less secure, more corruptible system. Maybe they should just have a big chalkboard and you go behind a curtain and make a mark next to the candidate of your choice -- I'm sure everyone will be honest.

[Mike @ Sep 6th 2006 4:38PM]

Wouldn't any place with half a brain NOT put the machine that runs this in the box with the person? All you need is the screen in the box with the person and the rest can be kept outside...

[Robert Jung @ Sep 6th 2006 5:11PM]

"Here in brazil we have eletronic vote for a decade and we never had any problem with that (altough we do have pretty good hackers here). you americans just can´t do this simple task?"

Give us a break; we're infested with Republicans.

--R.J.

[kbiel @ Sep 6th 2006 5:28PM]

Thank engadget for yet another Diebold conspiracy generating post.

Of course the Diebold machine is hackable. Any computer is hackable. Leave me alone with your machine for a few minutes and I'll have it hacked too. But no one should be left alone with the Diebold machine. That is why you have election judges. They're there to make sure the vote is not tampered with.

The Diebold machine is no more or less hackable than the venerable ballot box. It is certainly a lot more fraud proof than the absentee/mail-in ballots advocated in this asinine post.

[The Wizard @ Sep 6th 2006 6:09PM]

TO JUNG lets not even start the republican / democrap thing... because we all know that democrats have major problems too... in 2000 gore " I want a recount", in 2004 Kerry "I was for it and now I am against it" - and now he is for it again (does not know what he wants) hey at least he could be a fair looser)...

To Others: hey look I glued my pennies together and I got to vote twice. So the penny thing won’t work because if some person put more than one in then how are you going to know how many he put in the whole lot of pennies would be invalid...

FYI - I tried counting my pennies and I learned that I had 2000 of them and according to their weight I only had 1896 of them...

[zig @ Sep 6th 2006 5:50PM]

Throw a penny in a box? When's the last time you voted? There are a lot more political races out there than the presidency. I can't imagine the number of boxes and pennies that would be needed.

Can you imagine if a box of pennies went missing? How many votes would that be lost? I guarantee they wouldn't be floating in the San Francisco Bay.

[tom @ Sep 6th 2006 6:21PM]

I was reading some very disturbing comments above but the MOST important FALLACY was that there are only TWO candidates per race.

VOTE THIRD party ONLY and scare the HELL out of the monopoly.

[merk @ Sep 6th 2006 6:30PM]

"that democrats have major problems too... in 2000 gore " I want a recount", in 2004 Kerry "I was for it and now I am against it" - and now he is for it again (does not know what he wants) hey at least he could be a fair looser)..."

last time I checked Gore won the popular vote, and lost the electorial college. So technically, gore was our president, but the supreme court put that little demon child into power.

[Greg @ Sep 6th 2006 8:13PM]

"last time I checked Gore won the popular vote, and lost the electorial college. So technically, gore was our president, but the supreme court put that little demon child into power."

Last time I checked, the founders of the country never intended for the winner of the popular vote to win the presidency. They set up the electoral college system for a reason. Put some time into reading history if you don't understand why. We're not a democracy, we're a Republic.

[DR BUZZ0 @ Sep 6th 2006 7:05PM]

DAMNIT! This is not complicated. It does not take that much effort to make a *secure* e-voting machine.

Ditch the PC. Ditch the Windows. Hell..even ditch the Linux. You can't software hack something that doesn't have software.

This is what you need: A microcontroler (PIC controler or similar). Some ROM chips (one time) 64 K or so. A simple LCD screen. A few buttons. A pen pad (like on creditcard machines. For "pencil-in).

The system is basic. No graphics. Records the votes onto a one-time use, encrypted, time-stamped memory card. The card is stored in a strong box. Incase there is any dispute about the validity of the votes, the machine also keeps a seperate record on a non-rewritable storage medium. (such as a CD-R). This is stored in a seperate area, which can only be opened by the electoral commission. It can stay in for years of voting (I mean it's only recording numbers). Put a tamper proof seal on it.

There ya go... you're good to go.

Also..put in a lot of "are you sure this is who you want to vote for" prompts, for the old...I mean...slower people.

Seriously...don't think "High End MCPC" think "Simple ATM."

I don't see what is so complicated about this. You can't network hack a system without a network adapter. You can't root a system that doesn't have a root account.

Doesn't ANYONE UNDERSTAND THIS??????

GODDAMNIT!

[tomtux @ Sep 6th 2006 7:01PM]

I am not very political, because politicians are usually scum or at least that is the general consensus. All this penny talk has reminded me of an idea I have. If any of you people know any one with roughly 1.5 billion dollars you should tell them to purchase all the pennies in U.S. circulation so that the lowest denomination is a nickel. This way when you shop for anything they will either have to round up or down to the nearest nickel ^_^ if i ever become a 1.5ish billionare I plan on doing this.

[Brenden D Chase @ Sep 6th 2006 10:21PM]

DR BUZZ0, i like where your head's at.

Dont worry everyone, in 20 years when every baby is being stamped with barcodes, it'll make voting that much easier.

[Modern Day Alchemist @ Sep 6th 2006 7:11PM]

This is just one more example of using technology for technology's sake. Why not just stick to paper ballots? Are electronic ballots that much more convenient? There's no need to go high tech for everything. We still have paper books after all.

[Justin @ Sep 6th 2006 7:18PM]

"Give us a break; we're infested with Republicans.

--R.J."

LOL, love it. In the U.S.A., we've replaced innovation with lobbyists.

[Jim Main @ Sep 6th 2006 8:04PM]

"last time I checked Gore won the popular vote, and lost the electorial college."
"Last time I checked, the founders of the country never intended for the winner of the popular vote to win the presidency."

Actually, Gore had the majority of votes in Florida, which means he would have won the electorate vote, had all the votes actually been properly counted in the state. Of course the recount he requested wouldn't have been sufficient to change the outcome, the state vote was basically a statistical tie, more important than who actually entered office was how everyone behaved. The courts really should have focused on getting as accurate a recount as possible.

The main problem with computers isn't that they're easier to hack than a paper ballot, but you can mess with millions of votes with the same ease that you can only mess with a handful of paper ballots. There is no such thing as an election that hasn't had 'some' level of cheating going on, you have to make it hard to, always a potential of uncovering it sometime in the future (and therefore an added deterrent of getting caught), and harder to do the larger the scale you cheat on. All of these are true with paper, and not with computer ballots.

[Paul @ Sep 6th 2006 10:32PM]

For the people saying you are not left alone with the machine for 4 minutes, you are wrong, and you probably have never voted, you ARE alone, sorta. True, you are in a room with other people, but you are given privacy, and a screened in area to vote, at least where I live, this gives more than enough time and privacy to conduct this hack.

My solution is this.

In the voting booth there is only a screen and a printer.

The person puts in their votes on the screen, when they are done voting, it displays your votes on the screen and asks you to confirm them.

After you confirm them the printer prints out your ballot, and you can look it over again, you then go and turn in the printed reciept, which has a barcode on it that can be scanned to bring up the electronic vote on the computer.

The actual computer that you vote on will be kept in a locked & sealed case with only the moniter and printer cables exiting it, and the serial cable going back into it.

This seems pretty common sense to me.. why is it not being done?

[CRH @ Sep 6th 2006 9:09PM]

"Actually, Gore had the majority of votes in Florida, which means he would have won the electorate vote, had all the votes actually been properly counted in the state."

Ummm...actually he never. Unless of course you mean that any vote that was not certain went to Gore. The Democrats actually insisted that the election rules be changed after the outcome was determined (and they lost). And saying he won the popular vote is the same as saying he has a bigger dick. Neither is relevent to the way Presidents are elected. Gore is to blame for the bitter partisanship we have today. If he would have been a gracious loser, he would have a shot at the White House in '08. If he wouldn't have adopted a pro abortion and anti gun idealogy (exactly opposite of his views as a Tenn. congressman) he would have won his "home" state and been elected in '00. Today he is just a crackpot who believes the sky is falling.
As for diebold voting machines, they are not any more or less secure than any other system. Diebold just makes a handy whipping boy for angry liberals.

[faircount @ Oct 10th 2008 3:12PM]

It is easy to blame one person for all these issues. It is also rediculous to blame one person or party when you sit down and use your brain leaving out anger and bias. This rediculous partisanship however has nothing to do with the Diabold voting machine problem. Of course they are less secure or more importantly less reliable than other systems. They have no back-up printout of votes and are not autitable. How can this not concern everyone?! It is very simple for either party to manipulate the vote. There is strong evidence that this has happened. Everyone, republican, democrat, and others should be concerned with this and write thier congressman and senator demanding machines that have a back up printout ballet that can be counted in cases where there is evidence of vote manipulation. It happens people, and it must be stopped!!!
Check out the movie, Uncounted: American Elections and truvote.com

[Fred Thompson @ Sep 6th 2006 10:33PM]

Another non-story to feed the conspiracy kooks.

Physical access and security are completely ignored to create the artificial conditions under which the boxes are compromised.

Think about it: 4 minutes when someone just "happens" to have unfettered, undetected access to a machine when it is being used and they just happen to have the right equipment to carry off the operation. Granted, it's possible an entire room full of observers from opposite political parties could all be in collusion. How probable is it? Not very. Statistically insignificant, actually.

[stephen @ Sep 6th 2006 10:53PM]

While I think the paper ballet is accurate enough.. I personally dont like having to wait at some out of the way place for hours with a bunch of stinky people on a hot day.

If we want to replace the system we should look to an existing system that can handle millions of transactions. The two big thing that come to mind is the ATM / credit card network, and the stock market.

Just go to any ATM to vote.. it has a receipt, video survelence if needed etc... If we had like a national ID card that could act as your ATM card.

The other option is the stock market. Like every voter gets $1 per position to vote for and they buy one share in the canidate they like. At the end of the day whose ever market value is the most wins :)

[Matt @ Sep 7th 2006 1:42AM]

Democracy is dead. Move out of America unless you own enough guns to protect you and your family in the coming years.

[Chris Meesseman @ Sep 7th 2006 4:25PM]

My brother's, who works for Diebold, after I sent this story to him:

Yeah, blah blah blah... its been said a thousand times by liberals that can't let it go that Bush won... and its also been proven that it can't be hacked, because there's nothing to hack. The way the machine works is that everything is firmware operated (meaning there's no software to change). The voter assistant codes a card to the next voter in line and inserts it into the unit. When the voter is done, the assistant takes the card out and inserts it into another machine that tallies the votes. Then, the same card is recoded for the next voter in line. So yes, it may be true that with $12 in tools the card can be removed and replaced, but it wouldn't do any good. The machine that tallies votes won't accept a card unless it issued one. So, basically, these liberals are bending the truth and trying to blame Bush's presidency on Diebold (or anyone else for that matter). Trust me, it wasn't possible in 2004 and it won't be possible in the future... and if you ever hear any stories about some ivy league students hacking the software of the voting machine, that's BS too... as I said, it's all firmware based. The software the students "hacked" was a demo that any joe schmo could download off Diebold's website. It wasn't designed for release and had no security features at all. It was there simply to sell the product.

[faircount @ Oct 10th 2008 3:38PM]

The hacking danger is not at the ballet box it is at Diebold and anyone who has access to the machines for maintenance before or after they are set up. The Diebold machines have been manipulated to flip votes between candidates. It was very easily done. A man named Clint Curtis accoplished this simple task years ago and testifies as to this fact in front of congress.
It is not just the republicans that can do this, the democrats can too and will if they get the chance. Anyone can and will manipulate these machines. They must be made accountable. Why not provide a printed ballot that can be counted just incase there is any evidence of tampering. Look it up people, your vote is not at all secure with these machines!

[Chris Meesseman @ Sep 7th 2006 4:34PM]

*My brother's reply, I mean...

[Matt @ Sep 8th 2006 11:28AM]

Do any liberals work for Diebold?

[dave @ Aug 21st 2008 12:26AM]

apparently, all the liberals are out of work, writing for CNN or campaigning for Obama. Except the ones in Palm Beach and Broward counties who count obviously fraudulent chads.

[Relic @ Sep 17th 2006 1:19PM]

"Another non-story to feed the conspiracy kooks."

There's to many questions to just ignore it either. With reports of faulty equipment at EVERY poll station, a database based off of Access (and not password protected), poll employees taking machines home prior to the voting day, seal stickers being easly removed and applied again without knowledge of tampering, no paper trail and my favorite the friggen company that produces them is a Right-Wing contributer and Bush loyalist.

[Rule Rattray @ Jul 30th 2007 2:18AM]

The key to fair elections is transparency, and computers are anything but transparent.

Anybody here remember counting? Four upright marks and a diagonal slash? Sure you do. Anybody who graduated from the seond grade does.

Paper ballots filled out by the individual voter and counted by hand at precinct level, in public, with representatives of all factions free to view the counting, worked well for decades and is till the most accurate way to count votes. It's also the hardest way by far to manipulate and the least expensive.

Once counted at precinct level, the totals are publicly posted at the precinct, sent to a central facility for adding up, (again, in public,) and announced to all, with both factions keeping an eye on the announcer to make sure he reads exactly what has been given him.

Machines are not needed for such a simple process.