A team of computer security experts has reported a stunning array of potential vulnerabilities in the electronic voting machines used in California. Among the most alarming findings was the possibility that a voter could infect his or her machine with a virus that would alter the vote count statewide, then spread to other machines to alter the next election.
The scrutiny of the systems was welcome, even overdue. But Secretary of State Debra Bowen's eleventh-hour response on Friday -- banning the machines used by 39 counties, except as needed to accommodate disabled voters -- is likely to cause serious problems too. Ultimately, the Legislature may need to step in to depoliticize the process and protect counties and voters from being whipsawed by elected officials' shifting agendas.
At the root of the current problems is the misplaced confidence that the machines' manufacturers, many county election officials and Bowen's predecessors had in their electronic voting systems. The manufacturers -- Diebold Election Systems, Sequoia Voting Systems and Hart InterCivic -- continued their protests after Bowen's review, saying it was unrealistic to give the state's experts an insider's guide to the machines' software and ignore the safeguards in place at the polls. County officials echoed those complaints and asked why the new machines' risks weren't compared to those posed by mechanical voting machines and paper ballots. Both of these objections miss the point.
The shift to electronic voting poses new risks. Election officials have years of experience with paper ballots and are well aware of the mischief to guard against. They don't yet have that experience with electronic voting machines, yet the risks of tampering and vote manipulation are of an unprecedented scale. As the review showed, it's possible to gain access to the memory card where votes are stored on certain machines, insert a bit of malicious software and corrupt the results from multiple counties. Nevertheless, in some communities the machines are sent home with poll workers for safekeeping before an election.
Bowen banned the Diebold and Sequoia machines, but she said the Hart machines used by seven counties would be recertified if the manufacturer took specific steps to improve security. (She also decertified the machines used in Los Angeles County to scan paper ballots because they did not meet the deadline for testing, but a new round of tests is expected to reverse that ruling.) By putting Diebold and Sequoia at a competitive disadvantage here, she may finally persuade them to do what computer scientists have urged for several years: design their machines for security, rather than trying to bolt security features onto vulnerable platforms.
