In a recent Rolling Stone article by Robert F. Kennedy, Jr. a second whistleblower from Diebold supports an earlier claim that unauthorized patches were applied to over 5,000 of the company's voting machines just before the 2002 Georgia election. The patches were allegedly distributed personally by the president of Diebold's election unit Bob Urosevich and were not certified at either the state or national level. Although Georgia state law requires that any changes to the electronic voting system be certified by the state, Diebold was allowed to certify their own changes due to a contract between Georgia Secretary of State Cathy Cox and Diebold, which effectively privatized Georgia's voting process. The whistleblower goes on to claim that similar patches have been applied prior to other elections, even at the national level, also without recertification of the machines.
If even some of these claims are true then what good does any public vetting or certification really do? Security gurus like Avi Rubin and David Wagner have worked with voters' rights advocates to make real progress towards requirements on public vetting and transparency into electronic voting machines. In particular, source code analysis and code review have been leveraged with great effectiveness to find and eliminate security vulnerabilities in the code that runs electronic voting machines.
But when the adversary controls the machines, the code and much of the election process itself (as was the case in Georgia in 2002), such processes provide sparse guarantees. It's time to demand that our votes be counted. Local, state and federal governments must be held accountable for defending our right to participate in fair, unbiased elections and verifying the security and correctness of the code that is actually used to run the election is paramount to these guarantees.
