This is more of an editorial-type story than most of the breaking news stuff we normally report in the handler's diary, but I've been thinking about it for a while and wanted to see what our readers think.  My thanks to Pedro, for allowing me to post this on his day has handler on duty.

One week ago today was an off-year election here in the US.  It was the first time that my precinct (and county) used the new electronic touch screen voting machines.  In previous years, we used the infamous punched cards that garnered so much attention (and introduced most of us to the concept of hanging chads) in Florida in 2000. I have to admit that as a security professional it was somewhat disconcerting to be using a Windows-based machine to cast my vote on Black Tuesday (the second Tuesday of the month when Microsoft normally releases their patches and security vulnerabilities).  The machines that were used in my precinct were Diebold AccuVote-TSX.  This appears to be the latest incarnation of the system that Avi Rubin, et al, reviewed in their scathing report from July 2003 (also presented at the IEEE Symposium on Security and Privacy 2004). As a 'consumer', I have no way of telling whether many of the concerns raised in that report have been addressed because it doesn't appear that Diebold has been very forthcoming, but there appear to still be some serious problems with them which led to California banning the use of the Diebold machines this fall (see story here).  I suspect that the problems with forged smartcards probably still exist, too, for example.  I was very happy to see that at least one of the conclusions of the report was taken seriously.  The machines in my precinct did produce a paper ballot that I was asked to verify before my ballot was counted (or, at least, before the software claimed that ballot had been recorded).  I assume that those paper ballots would be used in the event a recount was called for, but as the California test demonstrated, if the printers jam or the machine freezes, the paper doesn't really help.  I also note that the Government Accounting Office (GAO) released another very critical report on the state of electronic voting just 2 weeks before the election.  So, what does all of this mean?  I'm not sure.  I believe that electronic voting in some form is the future, but as a security professional, I am keenly aware that there are many obstacles still to overcome.

Update: I've gotten some very thoughtful responses from some of our readers and I'd like to thank all of them.  In particular, I want to thank Gordon for telling me about the votehere.com link below which was one I was not previously aware of and which suggests that some of the problems may actually be nearer solution than I had previously been aware.  I guess I need to actually sit down and read through some theses/dissertations and patent applications to get a better feel for where the current research is.

A few useful links on electronic voting:

 http://www.avirubin.com/vote/
 http://lorrie.cranor.org/voting/hotlist.html (unfortunately, not updated recently)
 http://www.verifiedvoting.org/index.php
 http://www.notablesoftware.com/evote.html
 http://www.cpsr.org/issues/vote/evoteproject
 http://www.votehere.com/faq_toc.php

Bruce Schneier posted some thoughts in his monthly newsletter Crypto-Gram a year ago
 http://www.schneier.com/crypto-gram-0411.html#1
 http://www.schneier.com/crypto-gram-0411.html#2

-----------------------------
Jim Clausing, jclausing /at/ isc.sans.org