Posted on Friday, May 5, 2006 - 8:10 pm:

Diebold TSx warning An Open Letter To The Administrators Of The Emery County Government.doc (35.3 k)

---

quote:

To: Gary Herbert, Lt. Governor of the state of Utah
Cc: David Blackwell, Emery County Attorney
Bruce Funk, Emery County Elections
Emery County Commissioners
Michael Cragun, Utah State Elections Director

Mar. 24, 2006

Dear Sirs,

This is a formal notification that a security defect was found in the Diebold TSx system in Emery County, Utah by professional security experts from Security Innovation, Inc. and Mr. Harri Hursti. Because of the severity of the defects, the formal reports are being prepared with sufficient precision to garner the attention of the appropriate authorities with jurisdiction over this matter. These authorities, of course, include each of you who are receiving this notice, in addition to federal authorities in the general area of computer security.

...

The security problems found in Emery County present potentially catastrophic security defects for upcoming elections. The issue extends outside of Emery County to additional states. The identified security vulnerability appears to be:

1) Persistent, with the ability to survive through multiple elections;

2) Difficult to detect, not only for elections official but also for security experts and even for Diebold technicians;

3) Flexible, in that the exploit can selectively affect any particular election, candidate or ballot question;

4) Accessible, in that no password, supervisor access or special equipment is needed to invoke the exploit;

5) Difficult to eradicate with any patch, reinstallation, or cleaning procedure;

6) Likely to be exploited, because the skills needed to exploit the hole are possessed by many programmers and the information needed to conduct the exploit is generally available to the public. The time needed to exploit the security hole is in the range of a week’s planning time and 60 seconds for execution.

---