Article: EAC scandal grows--Sarasota's "undervote" voting machine model certified by banned lab, Ciber, before untested upgrades

Ciber, Inc. is the nation's largest independent testing authority of electronic voting machines certifying machines used by 68.5% of registered voters in 2006. However, last year the Election Assistance Commission secretly pulled Ciber's interim accreditation for failure to perform quality assurance testing and documentation of security testing.

Included in the long list of improperly tested or untested electronic voting machine models were the ES&S machines used in Sarasota, Florida, where a staggering 18,000 votes in a Congressional race were reported as "undervotes". Florida, which does not require federal certification, boasts, "Florida's voting systems standards and certification program are recognized as the most stringent in the nation."

Because Florida has its own certification program and because the Sarasota voting machines had upgrades that apparently lack federal approval, Ciber did not have the last word on the accuracy of the "undervote" machines.

However, in a March 3, 2006 "technical advisory" to county election officials Dawn Roberts, Director of Elections, relied on "Ciber Laboratory's Source Code Review and Functional Testing reports" to warn against "potential system vulnerabilities".

The Division of Elections "ongoing internal examination of security procedures" makes use of the non-accredited Ciber reports to maintain its supposed "stringent" security standards. In a directive that "applies to all voting systems deployed in Florida," Roberts warned of "knowledge based" attacks against electronic memory media by insiders.

Roberts further warned of a "malicious entity" gaining access to the voting machine memory. "This could occur at any time prior to opening the polls and with the election media in any state (i.e. pre-election, set for election, or post-election.)"

Ciber, which lost its interim accreditation over inadequate security testing, had long been identified for its sloppy work before the EAC secretly pulled its permit. Although many election officials, such as Dawn Roberts in Florida, may not have been aware of Ciber's shortcomings because of the EAC secrecy, problems with the Greenwood Village, Colorado, firm were known by the Wisconsin State Board of Elections in 2005 when Ciber failed to produce required reports.

The EAC's oversight of the so-called independent testing authorities, which are funded by the voting machine vendors, has been lax since taking over the responsibilities from the National Association of State Election Directors. The Help America Vote Act, which flooded states with money to buy new electronic voting machines like those in Sarasota, transferred the accreditation to the EAC at a time when the fledgling bureaucracy was ill-equipped for its responsibility.

Now, in light of the secret non-accreditation of Ciber, controversy over the very future of the agency is erupting in the halls of Congress. Chair of the Senate Rules Committee, Senator Diane Feinstein has sent a stern letter to the EAC "about the failure of the Election Assistance Commission to provide timely information to election officials and the public about your Commission's decision to withhold accreditation to Ciber Labs."

Feinstein asked the agency to provide information on its efforts to investigate the lab as well as detailed information on the extent of Ciber's failures. The Senator also called for a detailed list of jurisdictions using voting equipment tested by Ciber. In conclusion, Senator Feinstein warned, "I expect this will be a significant issue in upcoming Rules and Administration Committee oversight hearings about electronic voting and the role of the Election Assistance Commission in helping to ensure that every vote is accurately counted."

[Permission granted to reprint]