More news on Broward County Election "Security Provisions"

On Friday, the Supervisor of Elections provided at least 170 of Broward County's voting system technicians with precinct technology packets that lacked the required security seals, according to a Voting Systems Technologist (VST) working for Broward.  Included in these packets are reprogrammable memory cards, taken home for sleepovers the weekend prior to the election.  Supervisor of Elections Brenda Snipes is running for reelection on a voting system wholly unsecured by these practices.   

Sophia Letourneau served as a VST for Broward in the last three elections, Nov. 2008 being her fourth.  She is a retired software programmer who worked at the Kennedy Space Center where she was in charge of the electronic security system.  She told OpEdNews, "In the past, when I picked up my supplies, all Communication Packs were sealed with a numbered plastic security strap, which was to be cut off on election day in front of the Precinct Clerk."  This provides chain of custody – a process familiar to anyone who understands basic security, and without which there can be no rational basis for confidence in reported results.   

While picking up the voting systems technology pack of Friday, Letourneau overheard another technician advise that his pack lacked any security seal. 

The election clerk distributing the materials advised, "Oh, yeah, about half of them came that way, mostly in the G precincts."  The clerk's supervisor, called over for an explanation, seemed surprised that the packets she was responsible for securely delivering to VSTs lacked security seals.  She advised the technicians to contact their direct supervisor or the Supervisor of Elections. 

The "G precincts" comprise the city of Margate, with a population of about 55,000, two-thirds of whom are white.  Two-thirds of the city went for Kerry in 2004, but only 23% of Margate is currently registered as Republican (as of Sept. 30th records). 

The technical supervisor, Anthony Mastrangelo, handles the northern part of Broward County.  Calls to Mastangelo by Letourneau and OpEdNews went unreturned.  Broward's voting system technicians undergo five hours of training before being entrusted with firmware that can throw the vote count for the entire county. 

Candidate for Supervisor of Elections, Ellen Brodsky, confirmed a similar experience when she worked as a VST in the September 2006 Broward County election.  She provided OpEdNews with a litany of worst management practices by the current Supervisor, including: 

• * Failing to run logic & accuracy tests on 2% of all machines ("They tested a few machines, not the 45 or 50 required by law.");
• * Opening the machines for voting days in advance of the start of early voting;
• * Refusing to allow public observation of the count of absentee ballots, which began five days ago; and
• * Noting party affiliation on the outside of the absentee ballot envelope, exposing the vote to insider shenanigans.

Brodsky is running under the No Party Affiliation platform, allowed in Florida.  

Although no voting system has been federally certified for use in the November 2008 election, Florida Secretary of State, Kurt Browning, certified ES&S touchscreen and optical scan systems in May of 2008, according to a letter from Florida's Manager of Voting Systems Certification, Danielle C. Scoggins.  SysTest Labs was testing the new DS200, but recently lost federal accreditation for shoddy lab practices and using unqualified personnel.  Documents leading up to this discreditation detail the issues. 

In a December 2007 study of ES&S Unity software, which runs the various voting systems manufactured by ES&S, computer security experts warned, "Voting data can be edited directly in the Unity Software without additional access controls."  Researchers characterized the threat risk as "high" impacting the "integrity" of vote results.  All that is needed is physical access to the system, which the unsecured memory cards provide.  They further reported:

"Attackers who gain access to the Unity Software can directly edit the results of the election without additional access controls.  An insider who gains access to this function and the system could change vote totals and influence election results.   

"While this functionality is logged to the database, an attacker with sufficient knowledge would likely be able to remove the log entries or create malware to remove the entries."

In the 2007 penetration test of ES&S Unity software, Microsolved, Inc. did not have access to the source code, but still noted:

"Given the various types of media in use in the ES&S system, the team identified that failures to secure the integrity of any of those media components could cascade into security issues for the Unity server.  If the PEB device, CF or PCMCIA memory cards or zip disks could be altered to deliver malware or illicit data to the Unity server, then the integrity of the Unity server could be affected. This situation is made all the more risky by the lack of proper antivirus and adequate security controls on the Unity server itself. (emphasis supplied) 

"Attackers who gain illicit access to one or more of the memory media, or who can introduce Trojan memory media into the elections cycle could pose a grave danger to the elections processes."  (emphasis supplied)

"Malware in a voting system could be designed to operate in very subtle ways, for example, dropping or changing votes in a seemingly random way to make detection more difficult.  Malware can also be designed to be adaptive – changing what it does depending on the direction of the tally."

As of Nov. 2, Broward County has 1,021,294 registered voters in 793 precincts, 541,268 of whom are Democrat, 234,661 Republican, and the rest comprising twenty different political parties, including the Surfers Party of Florida.