Kim Zetter
Security

CA to Conduct Unprecedented $1.8 Million Review of Voting Systems with UC

California will become the first state to launch a $1.8 million top-to-bottom study of all voting machines used by its counties, Secretary of State Debra Bowen announced today (pdf). Working with the University of California UC Berkeley, the state is putting together three teams composed of academics from the university and professionals from the private […]

Vote_2California will become the first state to launch a $1.8 million top-to-bottom study of all voting machines used by its counties, Secretary of State Debra Bowen announced today (pdf). Working with the University of California UC Berkeley, the state is putting together three teams composed of academics from the university and professionals from the private sector to examine the source code and conduct hacking attacks on all systems used in the state. The evaluations, to begin May 14 and conclude in July, will consist of four components:

A document review will examine manufacturer documentation, testing reports from federal
Independent Testing Authorities (ITAs), reports from prior state certification testing, and reports of independent examinations and testing of voting systems.

A source code review will examine the human-readable instructions that are converted into machine-readable code to run the voting systems. The primary focus will be to identify any security vulnerabilities that could be exploited to alter vote recording, vote results, critical election data such as audit logs, or to conduct a “denial of service” attack that prevents people from voting.

Red team penetration testing will involve open-ended, hands-on efforts to identify and document any potential for tampering or error in any part of the voting system’s hardware, storage devices or software. The red team testers and source code review teams will coordinate their efforts, so potential vulnerabilities identified in red team testing can be further explored in the source code review, and vice versa.

The accessibility of the voting systems will be assessed and will include test voting on each of the voting systems by volunteer voters representing a broad range of disabilities.

The source code review team so far will include computer scientists Matt Blaze from the University of Pennsylvania and Ed Felten of Princeton University and Eric Rescorla, chief scientist at Network Resonance.

Anyone interested in participating should contact the secretary of state's office and see the FAQ here.