Page 2 of 2   <      

Officials Probing Possible Theft of Voting Software in Md.

In September, computer scientists at Princeton University who had obtained a Diebold voting machine demonstrated how a program they had created could secretly alter the votes cast on the machine. Diebold President Dave Byrd called the demonstration "unrealistic and inaccurate" and said it ignored the "physical security" measures used to safeguard voting machines.

The Washington Post obtained copies of the disks Wednesday and allowed Avi Rubin, a computer scientist at Johns Hopkins University, along with a colleague and a graduate student, to review the software on the condition that they make no copies of it.

"I would be stunned if it's not real," Rubin said.

Rubin, who has said that electronic voting systems that do not produce a paper record of each vote cannot be secured, led a team that produced an analysis that pointed out security vulnerabilities in the Diebold software found on the Internet in 2003.

Sam Small, the graduate student, said the version of Ballot Station "was consistent with what we've seen previously." Small could not gain access to the GEMS software because the material on two of the disks was protected by a password.

Radke, the Diebold spokesman, said the versions of Ballot Station released since the version identified on the disks have many new security features. The Diebold statement said "it would take years for a knowledgeable scientist" to break the encryption used on the software apparently contained on the disks delivered to Kagan. But Rubin said "the data and files were not encrypted" on the Ballot Station disk he reviewed.

The Office of Legislative Audits report also said the Maryland elections board has paid bills submitted by contractors without proper documentation and has not taken appropriate steps to safeguard its computer network and Web site.

Lamone said, "It seems inappropriate to base findings on a partially implemented system," referring to the new MDVOTERS database, which Maryland has established to comply with federal law.

She said it is appropriate for local election workers to have access to the database and said procedures are in place to verify changes. Lamone concurred with the auditors' criticism of her staff's accounting practices and said they had "obtained nearly all necessary documentation" for contractors' bills.

Providing the sort of local oversight envisioned by the auditors, she said, "simply cannot be conducted with existing resources."

Staff writer Eric Rich contributed to this report.


<       2

© 2006 The Washington Post Company