Md. to buy controversial Diebolds

Maryland officials have decided to buy electronic voting machines from Diebold Corp. despite concerns that the machines could be open to tampering or fraud.

Republican Gov. Robert Ehrlich decided this week to authorize the State Board of Elections to proceed with the installation of the Diebold AccuVote-TS machines, based on a report from Science Applications International Corp. Maryland commissioned the company to analyze the Diebold units before completing the purchase, after an earlier Johns Hopkins University analysis of Diebold code suggested the machines were vulnerable.

SAIC provided "a positive independent review indicating that the Diebold machine and source code, if operated properly, can contribute to one of the safest, most secure election systems available," Ehrlich said.

However, SAIC said it found "several high-risk vulnerabilities" that, if exploited, could have a "significant impact" on election results. Vote counts could be "released too soon, altered or destroyed," according to the written report.

The SAIC team emphasized that its assessment was based on the voting machine's being separate from any network. "If any of the AccuVote-TS system components, as presently configured and architected, were connected to a network, the risk rating would immediately be raised to 'high' for several of the identified vulnerabilities," SAIC researchers concluded.

SAIC included 17 specific recommendations and warned that the system is "at high risk of compromise" if they are not implemented. Some suggested measures include:

* Disconnecting the state Board of Elections' Global Election Management System server, the heart of the electronic voting system, from the intranet, which is connected to the Internet.

* Rebuilding data in the server from trusted media to ensure it has not been compromised.

* Changing default passwords immediately.

* Implementing a formal, documented process to detect and respond to unauthorized transaction attempts.

The report found weaknesses in the election board's practices as well, such as the lack of a formal system security plan, for example. The board does not require secure transmission of vote totals, and does not require the review of computer audit trails.

Diebold and Maryland officials took steps in light of the report's findings to make the machines more secure, according to a statement from the state. The state has agreed to implement 12 of SAIC's recommendations.

Diebold incorporated three security features in the Maryland machines in response to the SAIC review. The company implemented dynamic assignment of security keys to enable the state to determine the pass codes smart cards used to access the system; incorporated encryption into the electronic transmission of election results; and provided personal identification numbers for election officials to use when they access the system.