Principal Investigator ’ s Statement on Protection of Security - Sensitive Information

We present an independent security evaluation of the AccuVote Optical Scan voting terminal (AV-OS).We identify a number of new vulnerabilities of this system which, if exploited maliciously, can invalidatethe results of an election process utilizing the terminal. Furthermore, based on our findings an AV-OScan be compromised with off-the-shelf equipment in a matter of minutes even if the machine has itsremovable memory card sealed in place. The basic attack can be applied to effect a variety of results,including entirely neutralizing one candidate so that their votes are not counted, swapping the votes oftwo candidates, or biasing the results by shifting some votes from one candidate to another. Such votetabulation corruptions can lay dormant until the election day, thus avoiding detection through pre-electiontests.Based on these findings, we describe new safe-use recommendations for the AV-OS terminal. Specifi-cally, we recommend installation of tamper-resistant seals for (i) removable memory cards, (ii) serial port,(iii) telephone jacks, as well as (iv) screws that allow access into the terminal’s interior; failure to seal anysingle one of these components renders the terminal susceptible to the attack outlined above. An alterna-tive is to seal the entire Optical Scan system (sans ballot box) into a tamper-resistant container at all timesother than preparation for election and deployment in an election. An unbroken chain of custody must beenforced at all times. Post-election audits are also strongly advised. The Diebold AccuVote Optical Scan voting terminals described in this report are going to be used inNovember 2006 election in several precincts in the State of Connecticut. The terminals are provided bythe LHS Associates of Massachusetts. VoTeR Center personnel assisted the Office of the ConnecticutSecretary of the State in developing safe use procedures for the Optical Scan terminals for this elec-tion. The procedures in place for the election includes strict physical custody policy, tamper-resistantprotection of the equipment, and random post-election audits. 1Election Security ProjectThese documents were reprinted with permission of authors242 of 283 UConn VoTeR CenterSecurity Assessment of the Diebold Optical Scan Voting Terminal2