Security, authentication, authorization

Those digital photo frames that are becoming popular hold more than pictures. Millions of them apparently come pre-loaded with a potent virus designed to thwart computer anti-virus programs. The virus is spread from the frame to a computer when the frame is plugged into a USB port.

The virus is difficult to remove, and the article recommends plugging a suspect picture frame into a Linux or Macintosh first to see what is stored in the frame memory (and then deleting it).

Following on the heels of Ohio, Colorado has de-certified the voting machines used in some of the most populous parts of the state. Diebold, Sequoia, and ES&S machines were among those found to have problems. The state found that the machines were easy to tamper with, and that the machines lacked any audit trail capabilities, meaning there would be no way to detect tampering if it happened.

New studies of electronic voting machines in Ohio has led a top official there to call for a ban on the machines. The Ohio Secretary of State noted "critical security failures" on the machines that made it easy to tamper with vote counts.

Legislators are finally getting the message about faulty electronic voting machines, and perhaps some of these machines will get auditable paper trails in time for the 2008 election. The House of Representatives is working on a bill that will require better accountability for the electronic ballot systems for all Federal elections, starting with the fall 2008 elections.

The state of California has put together an extensive plan to review every voting system in use in the state. The work will use several groups of indepedent scientists with excellent credentials who will review both electronic voting systems and other, older voting systems, including paper-based balloting.

Here is an interesting idea that could put an end to phishing. Everyone has received those emails claiming to be from some well known bank, urging you to log in immediately to update your bank information. The URLs look like legitimate Web sites, but belong to crooks who want to capture your account information so they can empty your bank account.

The state of Florida is ready to toss electronic voting machines in the trash and go back to paper. The state plans to use paper ballots, where the voter makes a mark in an oval next to the candidate's name. The ballot is then scanned optically, just like the aptitude tests that have used this system for decades. The paper/optical scanning approach provides an audit trail that can be read manually if necessary but also provides for rapid vote counting by automated equipment.

The 2006 elections seemed to have passed without major problems with the electronic voting machines, but here is the problem: We'll never know. Because these machines could be tampered with invisibly, there is simply no way to know if they were or not, because there is no audit trail. We simply have no way to check to see if vote counts were altered. We may have dodged a bullet this time, but these machines are problematic, and a threat to our country.

Just when you thought the problems with Diebold electronic voting machines could not get any worse, this Engadget story indicates that some Diebold machines have touchscreen problems--if you touch the touchscreen, the system panics and has to be restarted. Diebold is giving the State of Maryland more than 5000 mice to use with the voting machines so that no one touches the touchscreens.

Black Box Voting has a step by step explanation, with detailed pictures, of how to alter a Diebold electronic voting machine in four minutes flat, including defeating two "security" features. The process is undetectable, and you can easily alter vote counts in the machine, and it would be impossible to trace because the machine does not provide auditable paper records.

Your tax dollars at work. Hanging chads are starting to look pretty good, since you can at least see them.

Wikipedia, the online encyclopedia that anyone can create an entry for, now has a cousin: Citizendium. Citizendium (most easily pronounced 'City-zendium') differs from Wikipedia in the way that content will be developed.

Just when you thought it could not get any worse with the Diebold voting machines, new information has come out indicating that the electronic voting machines can be opened with a minibar key, or in fact, almost any kind of cheap key that is often supplied with office desks and other types of furniture.

Three researchers at Princeton have written a detailed analysis of the many security problems with Diebold voting machines, and have included a video demonstrating how simple it is to tamper with the machine. Meanwhile, voters get the short end of the stick with both the potential for utterly compromised elections and the need to replace hundreds of millions of dollars worth of these machines with new ones, using our tax dollars.

This video of how to change the vote count on a Diebold voting machine is somewhat tongue in cheek, but illustrates how the vote count on a machine could be altered from inside the voting booth in a few minutes--no longer than some people spend pondering their votes.

Any community that has Diebold machines should be talking to the their lawyer right now.

The Open Voting Foundation has found yet more flaws in Diebold voting machines. A single switch on the motherboard allows someone to boot the machine from external memory. This would allow someone to change the way the machine counts votes. The machine can then be flipped back to the original memory, and no one would know the machine had been tampered with.

Yet another report indicates the most common electronic voting machine is vulnerable to tampering. Get this:

"If Diebold had set out to build a system as insecure as they possibly could, this would be it," says Avi Rubin, a Johns Hopkins University computer-science professor and elections-security expert.

Following on the heels of New Mexico, which recently mandated that all voting systems in the state use an auditable paper ballot, Maryland has banned the faulty and insecure Diebold voting machines. The legislature has required that the company retro-fit the machines with a paper record of each vote, and also specified changes in security and machine set up to reduce the possibility of vote tampering by those with physical access to the machines.

New Mexico has enacted a new voting law that requires all counties in the state to use a single, uniform balloting system. You might think it involves buying a lot of the new electronic touch panel voting machines.

Instead, the entire state will use.....paper.

Voters will mark their choices on a paper ballot that will then be fed into an electronic vote counting machine. In the event of discrepancies or disputes, the paper ballots can be easily counted and verified.

The state of Wisconsin has passed a law requiring that all software used in voting machines be open and accessible to the public. This is the right thing to do. Voting is the bedrock of a democratic republic, and how votes are tallied cannot be held close by a private company.

Two counties in Florida have decided to dump electronic voting machines manufactured by Diebold after it was shown how easy it was to alter voting results.

County and city supervisors and elections officials across the country have failed miserably to do due diligence on this issue. Millions in taxpayer funds have been spent on faulty machines. It is a national disgrace.