Information & Resources
Research
Ohio EVEREST Voting Study
On December 14th, 2007, Ohio Secretary of State Jennifer Brunner released the results of a comprehensive review of her state’s electronic voting technology. The study, called Project EVEREST, examined electronic voting systems – touch-screen and optical scan – from Elections Systems and Software (ES&S), Hart InterCivic, and Premier Election Systems (formerly Diebold). As part of that study, three teams of security researchers, based at Pennsylvania State University (State College, PA), the University of Pennsylvania (Philadelphia, PA), and WebWise Security, Inc. (Santa Barbara, CA), conducted the security reviews. The reviews began in September, 2007 and concluded on December 7, 2007 with the delivery of the final report. The teams had access to voting machines and software source code from the three vendors, and performed source code analysis and security penetration testing with the aim of identifying security problems that might affect the integrity of elections that use the equipment.
Our report is an extensive technical analysis of the security of these voting systems as they would be used under real-world election conditions. All of our findings are detailed in this public report. A confidential unredacted version of the report provides specific references to the vendors’ proprietary source code, but offers no substantive additional technical insights. All public reports, including the academic report can be downloaded from the EVEREST website. The team prepared the following statement about the report and its findings.
College Forums on the Voting System Review
In an effort to solicit further public feedback, Ohio Secretary of State Jennifer Brunner organized a series of forums on college campuses around the state of Ohio about the EVEREST review during the week of February 18th, 2008.
During this talk, EVEREST Academic team lead, Prof. Patrick McDaniel, will present the results of the study, and provide further insight on various vulnerabilities. Topics will include:
- unsafe storage of the decryption key alongside encrypted data in the ES&S systems
- casting an unlimited number of votes in the Premier systems
- "ghost voting" in the Hart systems that allows legal ballots to be cast without the physical presence of a voter
Abstract
In the winter of 2007, the Ohio secretary of state, Jennifer Brunner, initiated the "Evaluation & Validation of Election-Related Equipment, Standards and Testing (EVEREST)" study. Largely in response to growing public concerns, the study participants were charged to analyze technical and procedural issues associated with electronic voting systems used in Ohio. In supporting the study, the secretary worked with equipment manufacturers to provide internationally-known security researchers with unprecedented access to electronic voting equipment. Released in December of 2007, the far-reaching report highlighted a number of critical security failures that could impact the integrity of elections held in Ohio. In this forum, the speakers will present the core findings of the EVEREST report and the Secretary's plans for ensuring the integrity of future elections.
In the first part of the forum, Professor McDaniel will present the independent academic report. A description of the physical and technical processes of running an election will be given. Summary findings will be overviewed and demonstrated via examples of security vulnerabilities present in the voting systems currently used in Ohio. Particular attention will be given to the ways that these vulnerabilities can be exploited to affect the integrity and voter privacy of Ohio elections. The speaker will conclude by presenting the research team's views on critical challenges facing election officials in Ohio.
The forum will conclude with an extended open microphone question and answer period. All members of the University community and public are encouraged to attend and participate in this public forum.
Talk Dates
| Tuesday, Feb 19, 2008 | 10-11:30 a.m. | Bowling Green State University
Bowen-Thompson Student Union |
| Tuesday, Feb 19, 2008 | 7:30-9:30 p.m. | Miami University
McGuffy Hall Auditorium |
| Wednesday, Feb 20, 2008 | 10 a.m.-12 p.m. | Ohio University
Baker Center, Multi-Purpose Rm. 242 |
| Wednesday, Feb 20, 2008 | 7-9 p.m. | The Ohio State University
Knowlton Hall Auditorium |
| Thursday, Feb 21, 2008 | 5-7 p.m. | Case Western Reserve University
Strosacker Auditorium |
NSRC | CSE | Penn State | Contact Us | Copyright 2008 SIIS Lab