Editorials: Volkswagen and the Era of Cheating Software | The New York Times

For the past six years, Volkswagen has been advertising a lie: “top-notch clean diesel” cars — fuel efficient, powerful and compliant with emissions standards for pollutants. It turns out the cars weren’t so clean. They were cheating. The vehicles used software that cleverly put a lid on emissions during testing, but only then. The rest of the time, the cars spewed up to 40 times the legal limit of nitrogen oxide emissions. The federal government even paid up to $51 million in tax subsidies to some car owners on the false assumption of environmental friendliness. … Computational devices that are vulnerable to cheating are not limited to cars. Consider, for example, voting machines. Just a few months ago, the Virginia State Board of Elections finally decertified the use of a touch-screen voting machine called “AVS WinVote.” It turned out that the password was hard-wired to “admin” — a default password so common that it would be among the first three terms any hacker would try. There were no controls on changes that could be made to the database tallying the votes. If the software fraudulently altered election results, there would be virtually no way of detecting the fraud since everything, including the evidence of the tampering, could be erased.

National: Hack the vote: Cyber experts say ballot machines easy targets | Fox News

The recent cyber theft of millions of personnel records from the federal government was sophisticated and potentially crippling, but hackers with just rudimentary skills could easily do even more damage by targeting voting machines, according to security experts. Voter fraud is nearly as old as elections themselves, and different states and precincts use different voting systems and machines. But in many cases, even the electronic ballots could be manipulated remotely, according to a new report by the Commonwealth Security and Risk Management for the Virginia Information Technologies Agency. That report found that the AVS WINVote machines Virginia has used since 2002 have such flimsy security that an amateur hacker could change votes from outside a polling location.

Virginia: Voting machine replacement squeezes local budgets |The News & Advance

Facing a new state mandate, Appomattox County is preparing to replace its voting machines, but hopes to spread out the cost and minimize the unexpected hit to its budget. Appomattox and 29 other localities — including Lynchburg and Nelson County — have to replace their touchscreen voting machines this year after the model was decertified by the State Board of Elections. The decertification decision, made last month amid growing concerns about security flaws in the wireless machines, caught local election officials by surprise. But after meeting with state officials for more detailed briefings on the concerns, local officials said they understand and support the decision. “I feel like the State Board of Elections answered the questions we had, and they chose the right path,” said Mary Turner, secretary of the Appomattox County Electoral Board.

Editorials: Is online voting a security risk? | ESET

The world is moving online and so too now is politics. But as online, electronic voting (e-voting) increasingly becomes a reality, are we opening ourselves up to vote rigging by power-hungry politicians or fame-seeking hackers? Voting has traditionally been a pen and paper exercise; a slip filled-in and placed into a sealed ballot, with results counted and recorded by independent volunteers. Of course, this doesn’t mean that the result can’t be swayed, unintentionally or otherwise. There have been some notorious examples of foul play – Slobodan Milošević was accused of rigging elections in 1996 and 2000 in Yugoslavia – while errors can also occur, as best illustrated by the 2000 US presidential election, when a fault with Florida’s ballot paper led some people to vote for the wrong candidate. … These risks are only magnified when voting systems are pushed online. Brazil, Belgium and Estonia are just a few examples of the countries to have taken to e-voting, and while they have seen the benefits from the improved speed, accessibility and legibility (no more illegible ticks or crosses), they are arguably more open to attack.

Virginia: Roanoke County, Botetourt County, Montgomery County to replace banned voting machines by June | Richmond Times-Dispatch

The decision by the State Board of Elections to scrap thousands of touchscreen voting machines used in 20 percent of the state’s precincts sent shock waves through Virginia’s community of voter registrars, forcing them to scramble and replace the faulty equipment less than two months ahead of the June 9 primaries. The board on Tuesday imposed a ban on all touchscreen direct recording electronic voting machines of the WinVote model, because the continuing use of the aging devices “creates an unacceptable risk to the integrity of the election process in the commonwealth,” said Edgardo Cortés, commissioner of the state Department of Elections. A review by the Virginia Information Technologies Agency after the Nov. 4 elections had confirmed what computer experts had feared for years — that the WinVote machines may be vulnerable to cyberattacks. Virginia is the only state where WinVote devices are still in use.

Editorials: AVS WinVote: The Worst Voting Machine in America | Jeremy Epstein/Slate

On April 14, the Virginia State Board of Elections voted to immediately decertify use of the AVS WinVote touch-screen Direct Recording Electronic voting machine. That means that the machine, which the Washington Post says was used by “dozens of local governments” in Virginia, can’t be used any more, though the commonwealth is holding primaries in just two months. The move comes in light of a report that shows just how shoddy and insecure voting machines can be. As one of my colleagues taught me, BLUF—bottom line up front: If an election was held using the AVS WinVote, and it wasn’t hacked, it was only because no one tried. The vulnerabilities were so severe, and so trivial to exploit, that anyone with even a modicum of training could have succeeded. A hacker wouldn’t have needed to be in the polling place—he could have been within a few hundred feet (say, in the parking lot) and or within a half-mile if he used a rudimentary antenna built using a Pringles can. Further, there are no logs or other records that would indicate if such a thing ever happened, so if an election was hacked any time in the past, we will never know.

Virginia: Board of Elections votes to decertify AVS WINVote | The Washington Post

The Virginia Board of Elections on Tuesday voted to scrap a type of voting machine used by dozens of local governments, including Fairfax City and Arlington County, after identifying security concerns. The move leaves 30 counties and cities scrambling to replace hundreds of voting machines. Ten of those local governments have primary elections scheduled for June 9. During a public meeting, the Board of Elections voted 2 to 0, with one member absent, to decertify WINVote touchscreen voting machines. Edgardo Cortés, commissioner of the state Department of Elections, said continuing to use the aging machines “creates an unacceptable risk to the integrity of the election process in the commonwealth.”

Editorials: Decertifying the worst voting machine in the US | Jeremy Epstein/Freedom to Tinker

On Apr 14 2015, the Virginia State Board of Elections immediately decertified use of the AVS WinVote touchscreen Direct Recording Electronic (DRE) voting machine. This seems pretty minor, but it received a tremendous amount of pushback from some local election officials. In this post, I’ll explain how we got to that point, and what the problems were. As one of my colleagues taught me, BLUF – Bottom Line Up Front. If an election was held using the AVS WinVote, and it wasn’t hacked, it was only because no one tried. The vulnerabilities were so severe, and so trivial to exploit, that anyone with even a modicum of training could have succeeded. They didn’t need to be in the polling place – within a few hundred feet (e.g., in the parking lot) is easy, and within a half mile with a rudimentary antenna built using a Pringles can. Further, there are no logs or other records that would indicate if such a thing ever happened, so if an election was hacked any time in the past, we will never know.

Verified Voting in the News: Voting machine password hacks as easy as ‘abcde’, details Virginia state report | Guardian

Touchscreen voting machines used in numerous elections between 2002 and 2014 used “abcde” and “admin” as passwords and could easily have been hacked from the parking lot outside the polling place, according to a state report. The AVS WinVote machines, used in three presidential elections in Virginia, “would get an F-minus” in security, according to a computer scientist at tech research group SRI International who had pushed for a formal inquiry by the state of Virginia for close to a decade. In a damning study published Tuesday, the Virginia Information Technology Agency and outside contractor Pro V&V found numerous flaws in the system, which had also been used in Mississippi and Pennsylvania. Jeremy Epstein, of the Menlo Park, California, nonprofit SRI International, served on a Virginia state legislative commission investigating the voting machines in 2008. He has been trying to get them decertified ever since.

Verified Voting in the News: Hacked Touchscreen Voting Machine Raises Questions About Election Security | NPR

Computer security experts have warned for years that some voting machines are vulnerable to attack. And this week, in Virginia, the state Board of Elections decided to impose an immediate ban on touchscreen voting machines used in 20 percent of the state’s precincts, because of newly discovered security concerns. The problems emerged on Election Day last November in Spotsylvania County. The AVS WINVote touchscreen machines used in precinct 302 began to shut down. “One machine would go and crash. They’d bring it back up. Another one would crash,” said Edgardo Cortes, the state’s elections commissioner. “Starting in the early afternoon, they brought in a piece of replacement equipment that experienced the same issues when they set it up in the precinct.” Cortes added that elections workers had a theory about what had caused the problem. “There was some interference,” he said, “potentially from a wireless signal from an election officer [who] was streaming music on their phone.”

Verified Voting in the News: Meet the e-voting machine so easy to hack, it will take your breath away | Ars Technica

Virginia election officials have decertified an electronic voting system after determining that it was possible for even unskilled people to surreptitiously hack into it and tamper with vote counts. The AVS WINVote, made by Advanced Voting Solutions, passed necessary voting systems standards and has been used in Virginia and, until recently, in Pennsylvania and Mississippi. It used the easy-to-crack passwords of “admin,” “abcde,” and “shoup” to lock down its Windows administrator account, Wi-Fi network, and voting results database respectively, according to a scathing security review published Tuesday by the Virginia Information Technologies Agency. The agency conducted the audit after one Virginia precinct reported that some of the devices displayed errors that interfered with vote counting during last November’s elections.

Virginia: Arlington to Re-Introduce Paper Ballot Voting | ARLnow

Voting in Arlington will go back to the future this year when the county introduces paper balloting to replace the touch-screen boxes it has been using for years. The paper ballots will be digitally scanned and allow more voters to vote faster, and provide a hard copy of ballots in case of technical malfunctions, Arlington County said in a press release. It’s the first time the county has used paper ballots since 1950, county General Registrar Linda Lindberg told ARLnow.com. The county was forced to make the purchases by a ruling by the Commissioner of Elections recommending the electronic WinVote machines be decertified and prohibited.

Virginia: Lynchburg-area election officials ‘very concerned’ over report critical of touchscreen system | News & Advance

Local election officials were taken aback by a new report that could lead to the elimination of a touchscreen voting system used in nearly 30 Virginia localities — including Appomattox County, Nelson County and Lynchburg. “We are very concerned,” said Mary Turner, secretary of the local electoral board in Appomattox. “… We’ve been using these machines for many years, and we’ve not had any problems with them.” The report, released last week by the Virginia Department of Elections, questioned the security and reliability of the WinVote touchscreen voting machine. It specifically found that a WinVote’s wireless network — a feature unique to this model — may make it prone to crashing and vulnerable to cyberattack.

Virginia: Faced with WINVote voting machine concerns, Botetourt plans to count votes by hand | Roanoke Times: Virginia

In response to concerns about glitches with some voting machines in Virginia, election officials in Botetourt County will be counting votes by hand for the June 9 Republican primary. The decision to go old-school, made Friday by the county’s electoral board, comes amid growing concerns about WinVote touch-screen voting machines, which are used in about 20 percent of Virginia’s precincts, including those in Botetourt. A vote to decertify the machines statewide could be taken as early as next week at a Virginia Board of Elections meeting in Richmond. In anticipation of not being able to use the WinVote machines for the June primary, the electoral board accepted a recommendation from Registrar Phyllis Booze: Borrow three voting machines from a vendor with whom the county is negotiating the purchase of all the equipment that it will need for the November elections.

Virginia: Study Examines Problems with Virginia’s Voting Machines | WVTF

n interim study by the Virginia Department of Elections indicates that numerous localities have voting machines that are wearing out—and some have potential security problems. The investigation was prompted by reports of irregularities during last November’s election. The result could be a new and costly requirement to replace some widely used touch-screen voting machines. Last fall, a few voters recorded videos to prove that when they touched one candidate’s name, their machines marked a different name. Elections Commissioner Edgardo Cortés says those machines were properly maintained. “And most of it does appear to be related to old equipment. It’s just past the end of its useful life, so they’re having issues with calibration, battery life—just all sorts of things that you see in older technology.”

Voting Blogs: Virginia DOE releases report critical of WinVote system | electionlineWeekly

On April 1, the Virginia Department of Elections released an interim report citing critical, potential security concerns with the WinVote DREs, in particular with the wireless capability of the system. Despite the date, this was no joke. Following scattered reports of problems with voting systems in the state during the November 2014 election, Gov. Terry McAuliffe (D) called for an investigation into the irregularities. The State Board of Elections began its review in late 2014, but it wasn’t until early 2015 that the extent of the problem became obvious. “We really didn’t know until early February that there was a potential security issue with the WinVotes,” said Edgardo Cortes, commissioner of elections for the Commonwealth. “At that point we moved quickly to conduct additional testing, but it wasn’t until the preliminary test results were provided on March 26 that we knew how serious a vulnerability we were facing.”  Twenty-nine localities — about 20 percent of the precincts in the Commonwealth — use the WinVote DREs and of those, 10 are facing June primaries.

Virginia: Report questions security, accuracy of some Virginia voting machines | The Washington Post

Dozens of local governments — including Fairfax City and Arlington — could be left scrambling to replace all of their voting machines after a state report called into question the accuracy and security of one-fifth of Virginia’s aging equipment. The state Board of Elections will decide at a public hearing on April 14 whether to scrap the touch-screen voting machines used in 30 counties and cities. The board will accept public comment through April 12. Gov. Terry McAuliffe’s administration is eager to settle the issue in time for the November election, when all General Assembly seats will be on the ballot — but also before the 2016 presidential contest. … The latest voting machines flap was prompted by complaints from voters who had trouble casting ballots in November. McAuliffe, who said he grappled with a malfunctioning machine at a Richmond precinct, called for an investigation into machine irregularities.

Virginia: Touchscreen problems worry Virginia election officials | Daily Press

Looking into what went wrong when Virginia Beach supporters of Rep. Scott Rigell couldn’t get voting machines to register their choice last November, the state Department of Elections found problems with some touchscreen machines — but not the kind that frustrated Rigell’s backers. Instead, it found such serious problems with another, aging touchscreen device — AVS WinVote — that it thinks the State Board of Elections should consider stopping its use altogether. … In November, dozens of Virginia Beach voters reported that machines were recording their votes for Rigell as votes for his opponent, Suzanne Patrick. The city used 820 touchscreen machines — unlike localities on the Peninsula, it relied on them as its primary means of voting. In Newport News, the two voters who reported problems on Election Day said their votes for Sen. Mark Warner were shown as votes for his GOP opponent, Ed Gillespie. The more serious problems emerged when the consultant audited the WINVote machines in Henrico and Spotsylvania counties, which are different from the machines Virginia Beach and Newport News use.

Virginia: Report cites security issues with some AVS WinVote voting machines | Associated Press

An investigation into voting irregularities during the November general election has raised serious security concerns about equipment used in about one-fifth of Virginia’s precincts, a new report says. The report issued late Wednesday says the state Board of Elections should consider decertifying the WinVote touchscreen system and barring its use in future elections. The board is expected to conduct a public hearing on this and other options in the next few days. Link: Full DOE report on Virginia voting equipment

Virginia: Dept. of Elections: ‘serious security concerns’ with wireless voting machines | WAVY

A Virginia Department of Elections (DOE) report cites “serious security concerns” with certain voting equipment used during the November 2014 General Election. On Wednesday, the DOE released it’s “Interim Report on Voting Equipment Performance, Usage and Certification” that it said was conducted in response to the widespread report of voting machine irregularities during the November election. On election day, Gov. Terry McAuliffe told only 10 On Your Side that the voting machine irregularities were “unacceptable” and that he wanted an investigation. This was after the DOE confirmed technical difficulties with a number of touchscreen voting machines in Virginia Beach and Newport News. Other areas reported irregularities, including Spotsylvania and Henrico counties.

Link: Full DOE report on Virginia voting equipment

Virginia: Arlington bar codes examined for vote problems in Virginia | Washington Times

“That’s what a recount is all about,” Mr. McDonald said. “Make sure all the i’s are dotted, all the t’s are absolutely crossed, and there’s no possibility there’s anything else out there we don’t know about. It’s going to be close from this point right here.” When a recount is called, the State Board of Elections first sets the standards for the handling, security and accuracy of the tally. A three-member “recount court” is formed in Richmond and is headed by the chief judge of the Richmond Circuit Court. Two additional circuit court judges are appointed to the board by the chief justice of the Virginia Supreme Court. The recount court sets the standards for determining the accuracy of the votes and certifies the election results. Its ruling is final and cannot be appealed, according to Virginia law.

Virginia: Caroline County approves new voting machines | The News Desk

The Caroline County Board of Supervisors Tuesday night approved the purchase of 11 new voting machines that will likely be installed before the November election. Members of the electoral board and the county’s voter registrar asked the board for $50,763 to purchase optical scan voting machines. The county currently uses touchscreen voting machines. John Nunnally, vice-chair of the electoral board, told the supervisors that all localities are facing an unfunded mandate from the state that they replace their machines with optical scan machines by 2016. That means that instead of touchscreen machines, voters would use a paper ballot and feed it into the optical scan machine. Nunnally said the change could cut down the time it takes to vote and reduce lines. The machines the county has now are about 10 years old and have problems that require more immediate replacement, according to a staff memo. Additionally, the memo says that if the county purchases the machines now, the county will get a better deal than waiting until 2016, when there is more competition and more localities are in the market for the machines.

Virginia: AVS WINVote Voting Machines Have Vulnerability to Wireless Sabotage | Wall Street Journal

In this November’s presidential election, Virginia voters will cast ballots on machines that use wireless technology state lawmakers barred five years ago to protect voting machines from hackers. Continued reliability and security concerns over electronic voting are not unique to Virginia, or to machines that use wireless technology, but the case illustrates the credibility issues that have plagued electronic voting machines in use across the country in the aftermath of the messy 2000 presidential election, when the federal government mandated changes to election systems and processes. Virginia’s election workers in some precincts use the wireless technology to upload ballots and tally vote totals from multiple machines at a polling station. The wireless electronic tallying is an effort to avoid the human error possible in a manual count. Fears that wireless transmission capabilities could present an opening to hackers led Virginia lawmakers to ban the use of the technology in voting machines in 2007. “It makes it easier to hack systems when you have an open interface that can be accessed remotely from outside the polling place, like in a parking lot,” said Jeremy Epstein, a computer researcher who helped draft the state’s legislation to bar wireless from polling stations. “It magnifies any other vulnerability in the voting system.”

Mississippi: Secretary of State Looks To Fix Election Problems | WAPT Jackson

Election officials said Tyrone Lewis avoided a runoff against Sheriff Malcolm McMillin by a slim margin. Lewis received 50.79 percent of the vote to McMillin’s 45.15 percent. Lewis will become Hinds County’s new sheriff, defeating the long-time incumbent in the primary. There are no Republicans running in the general election.

It wasn’t until late Sunday evening that Hinds County election officials released the final numbers from last week’s election. Secretary of State Delbert Hosemann said the Democratic and Republican parties run the primary elections, but he wants to fix some other polling problems before the November general election.

Mississippi: Malfunction of machines puzzling | The Clarion-Ledger

A day after some electronic voting machines malfunctioned in Hinds County, the mystery remains. “Everyone I’ve talked to is baffled,” Hinds County Democratic Executive Committee Chairman Claude McInnis said Wednesday.

At Wynndale Presbyterian Church, the electronic ballot failed to include races for governor or lieutenant governor. The precinct switched to paper ballots that included all the races.

This is the first time McInnis said he has seen the problem with these machines. “On a scale of 1 to 10, I’d give the machines a 7.5 to 8,” said McInnis, who also is executive vice chairman of the Mississippi Democratic Party. Hinds County’s voting machines, which are about 10 years, are no longer manufactured. The company that made them, Advanced Voting Solutions, is out of business. Hinds County is the only county in Mississippi to use the system.