Ohio EVEREST Voting Study

On December 14th, 2007, Ohio Secretary of State Jennifer Brunner released the results of a comprehensive review of her state's electronic voting technology. The study, called Project EVEREST, examined electronic voting systems – touch-screen and optical scan – from Elections Systems and Software (ES&S), Hart InterCivic, and Premier Election Systems (formerly Diebold). As part of that study, three teams of security researchers, based at Pennsylvania State University (State College, PA), the University of Pennsylvania (Philadelphia, PA), and WebWise Security, Inc. (Santa Barbara, CA), conducted the security reviews. The reviews began in September, 2007 and concluded on December 7, 2007 with the delivery of the final report. The teams had access to voting machines and software source code from the three vendors, and performed source code analysis and security penetration testing with the aim of identifying security problems that might affect the integrity of elections that use the equipment.

Our report is an extensive technical analysis of the security of these voting systems as they would be used under real-world election conditions. All of our findings are detailed in this public report. A confidential unredacted version of the report provides specific references to the vendors' proprietary source code, but offers no substantive additional technical insights. The full academic report can be found here. The team prepared the following statement about the report and its findings.

College Forums on the Voting System Review

In an effort to solicit further public feedback, Ohio Secretary of State Jennifer Brunner organized a series of forums on college campuses around the state of Ohio about the EVEREST review during the week of February 18th, 2008.

During this talk, EVEREST Academic team lead, Prof. Patrick McDaniel, will present the results of the study, and provide further insight on various vulnerabilities. Topics will include:

  • unsafe storage of the decryption key alongside encrypted data in the ES&S systems
  • casting an unlimited number of votes in the Premier systems
  • "ghost voting" in the Hart systems that allows legal ballots to be cast without the physical presence of a voter
Prof. McDaniel will also open the floor and respond to questions from the community.

Abstract

In the winter of 2007, the Ohio secretary of state, Jennifer Brunner, initiated the "Evaluation & Validation of Election-Related Equipment, Standards and Testing (EVEREST)" study. Largely in response to growing public concerns, the study participants were charged to analyze technical and procedural issues associated with electronic voting systems used in Ohio. In supporting the study, the secretary worked with equipment manufacturers to provide internationally-known security researchers with unprecedented access to electronic voting equipment. Released in December of 2007, the far-reaching report highlighted a number of critical security failures that could impact the integrity of elections held in Ohio. In this forum, the speakers will present the core findings of the EVEREST report and the Secretary's plans for ensuring the integrity of future elections.

In the first part of the forum, Professor McDaniel will present the independent academic report. A description of the physical and technical processes of running an election will be given. Summary findings will be overviewed and demonstrated via examples of security vulnerabilities present in the voting systems currently used in Ohio. Particular attention will be given to the ways that these vulnerabilities can be exploited to affect the integrity and voter privacy of Ohio elections. The speaker will conclude by presenting the research team's views on critical challenges facing election officials in Ohio.

The forum will conclude with an extended open microphone question and answer period. All members of the University community and public are encouraged to attend and participate in this public forum.

Talk Dates

Tuesday, Feb 19, 2008 10-11:30 a.m. Bowling Green State University

Bowen-Thompson Student Union
Bowling Green State University
Bowling, Green, Ohio 43402

Tuesday, Feb 19, 2008 7:30-9:30 p.m. Miami University

McGuffy Hall Auditorium
Miami University
501 E. High St.
Oxford, Ohio 45056

Wednesday, Feb 20, 2008 10 a.m.-12 p.m. Ohio University

Baker Center, Multi-Purpose Rm. 242
Ohio University
1 Park Place
Athens, Ohio 45701

Wednesday, Feb 20, 2008 7-9 p.m. The Ohio State University

Knowlton Hall Auditorium
The Ohio State University
275 W. Woodruff Ave.
Columbus, OH 43210

Thursday, Feb 21, 2008 5-7 p.m. Case Western Reserve University

Strosacker Auditorium
Case Western Reserve University
2125 Adelbert Rd.
Cleveland, Ohio 44106