Mostly as a result of the contested vote count in Florida during the 2000 presidential election, Congress enacted the Help America Vote Act (HAVA), which requires states to have electronic systems in place by the 2006 election and provides some financial assistance in replacing punch card systems (like the ones heavily used throughout Utah) and other mechanical ballot systems. Some states are rushing to select and install these new systems in time for the upcoming 2004 election. At the same time, other states that have already implemented electronic voting systems are reevaluating or reconsidering their positions, as a result of a series of mistakes, blunders and other questionable electronic voting results. One of these, California, just recently decertified certain systems built by Diebold Election Systems, and even went so far as to suggest possible civil and criminal charges against that company might be forthcoming. Apparently the company installed unapproved software on the machines just prior to the March 2 primary election, which is a violation of California state law and brings into question the validity of the results. Other states, like Ohio and Nevada, are also reconsidering previously installed electronic systems.

Utah is one of only five remaining states that uses the punch-card ballot as its primary voting system. So we can’t be accused of being on the bleeding edge of this new technology. However, Lieutenant Governor McKeachnie has said that the state’s goal is to have the system selected in time to place at least one electronic machine in each polling place by November 2004 and full implementation, consisting of 3,000 machines statewide, by November 2006. So the selection committee is running out of time.

Perhaps to save some time, Utah’s selection committee has chosen not to write up a request for proposal (RFP) from scratch; rather, they will modify the existing RFP from a state that has already gone through this process and selected a vendor. The state chosen is Georgia. The committee has already invited the Georgia bureaucrat who oversaw their electronic voting system project out to brief them on lessons learned. That meeting took place on April 15.

This concerns me because Georgia is at the center of a firestorm regarding Diebold Election Systems (the vendor they ultimately chose) and the healthy-sized controversy concerning the results of Georgia’s 2002 state election, in which Republican challengers came from nowhere to upset the heavily-favored Democratic incumbents for both Governor and Senator (the challengers had been trailing in the polls by up to 11 points the week before the election). In and of itself, not grounds to suspect a conspiracy. But read on.

Georgia did not insist that the Diebold system include a paper trail. Georgia also agreed to protect the proprietary rights of the Diebold software from the people of Georgia…in other words, there was no review of the software source code. In the words of one technologist, Georgia’s electronic voting system was “faith based”. It gets worse.

Georgia officials thought their system’s software went through three levels of testing: at the Federal Election Commission, by an independent testing laboratory, and by a college professor. They were wrong. The FEC does not test, the laboratory only tested the hardware (for example, environmental tests like shaking and vibration), and the professor only did a limited functional test (a mock election). Nobody ever validated the software. Wait, there’s more.

Months prior to the 2002 election, Diebold set up a file transfer protocol (FTP) website so that software patches and upgrades could be accessed by technicians in the field. Unfortunately, they did not secure the site, and so the actual source code to the machines used in Georgia were made publicly available. When election activists examined the source code, they learned that the company violated basic good- programming practices by hard-coding sensitive information like administrative passwords into the source code.

The result? Any competent programmer with $100 worth of tools could program his own Diebold voting machine “smartcard” and vote as many times as s/he wanted. Entire elections could be jeopardized. There is no evidence to suggest that actually occurred in Georgia, or anywhere else. But it reinforces the notion that a paper trail audit is really, really important. And it really points out the vulnerability of electronic systems…not just the software, but the social engineering aspects.

It’s not just Georgia and Diebold that should concern us. There is the case of Nebraska and a company called Election Systems and Software (ES&S). A gentleman named Chuck Hagel was chairman of ES&S until 1995 when he left the company to run for the Senate. Coincidentally, ES&S was selected to provide the electronic voting machines for the 1996 Nebraska election. In both the primary and general elections, Hagel came from behind to win. In the general election he trailed the popular Democratic former governor 65 percent to 18 percent in the polls at one time, but finished with 56 percent of the vote. ES&S machines counted 85 percent of the votes in that election (the rest were by hand).

Other states that have had “questionable” election results after installing Diebold and ES&S systems include Louisiana, Maryland, Texas, Florida, Alabama, North Carolina, Illinois, Kansas…and the list is growing. Together, the two companies count nearly 80 percent of the votes cast in the United States. Hopefully you get the picture.

One last alarming note. One Diebold director has already raised over $100,000 for the 2004 Bush/Cheney campaign. Diebold CEO Walton O’Dell raised over $600,000 at just one fund-raising party. Then there is the infamous 2003 letter O’Dell wrote to Republican supporters in which he said “I am committed to helping Ohio deliver its electoral votes to the president next year.” Taken in the overall context of his company’s questionable performance during the 2002 elections, that one really gets your attention, doesn’t it?

I wish the Utah selection committee had chosen a better example than Georgia. Let’s at least hope we do a better job.