SAIC Report On MD. Diebold Voting Machines

SAIC Report On MD. Diebold Voting Machines

EXECUTIVE SUMMARY

This report presents the results of a risk assessment of the AccuVote-TS voting system as currently implemented in Maryland by the State Board of Elections (SBE) and the Local Boards of Elections (LBEs). This Risk Assessment report includes evaluations of threats, vulnerabilities, security controls, and risks associated with the AccuVote-TS system and possible impacts to the State and the integrity of its elections process from successful exploitation of identified weaknesses.

This Risk Assessment was performed using the methodology documented in National Institute of Science and Technology (NIST) SP 800-30, Risk Management Guide for Information Technology Systems, and in the State of Maryland’s Certification and Accreditation Guidelines. This assessment consists of agency-directed, independent verification of systems, software, and processes associated with the system. This assessment provides an in-depth analysis of security controls, including comprehensive personnel interviews, documentation reviews, site surveys, and evaluation of the system’s hardware and software. Overall, this assessment measures the level of assurance that the security controls for the system are fully formed and documented, correctly implemented, and effective in their application.

Findings & Recommendations

In the course of this Risk Assessment, we reviewed the statements that were made by Aviel. D. Rubin, professor at Johns Hopkins University, in his report dated July 23, 2003. In general, SAIC made many of the same observations, when considering only the source code. While many of the statements made by Mr. Rubin were technically correct, it is clear that Mr. Rubin did not have a complete understanding of the State of Maryland’s implementation of the AccuVote-TS voting system, and the election process controls or environment. It must be noted that Mr. Rubin states this fact several times in his report and he further identifies the assumptions that he used to reach his conclusions. The State of Maryland procedural controls and general voting environment reduce or eliminate many of the vulnerabilities identified in the Rubin report. However, these controls, while sufficient to help mitigate the weaknesses identified in the July 23 report, do not, in many cases meet the standard of best practice or the State of Maryland Security Policy.

This Risk Assessment has identified several high-risk vulnerabilities in the implementation of the managerial, operational, and technical controls for AccuVote-TS voting system. If these vulnerabilities are exploited, significant impact could occur on the accuracy, integrity, and availability of election results. In addition, successful exploitation of these vulnerabilities could also damage the reputation and interests of the SBE and the LBEs. This Risk Assessment also identified numerous vulnerabilities with a risk rating of medium and low that may have an impact upon AccuVote-TS voting if exploited.

This assessment of the current security controls within the AccuVote-TS voting system is dependent upon the system being isolated from any network connections. If any of the AccuVote-TS voting system components, as presently configured and architected, were connected to a network, the risk rating would immediately be raised to high for several of the identified vulnerabilities. SAIC recommends that a new risk assessment be performed prior to the implementation of a major change to the AccuVote-TS voting system. Additionally, SAIC recommends a similar assessment to be performed at least every three years, regardless of system modification.

We recommend that SBE immediately implement the following mitigation strategies to address the identified risks with a rating of high:

1. Bring the AccuVote-TS voting system into compliance with the State of Maryland Information Security Policy and Standards.
2. Consider the creation of a Chief Information Systems Security Officer (CISSO) position at SBE. This individual would be responsible for the secure operations of the AccuVote-TS voting system.
3. Develop a formal, documented, complete, and integrated set of standard policies and procedures. Apply these standard policies and procedures consistently through the LBEs in all jurisdictions.
4. Create a formal, System Security Plan. The plan should be consistent with the State of Maryland Information Security Policy and Standards, Code of Maryland Regulations (COMAR), Federal Election Commission (FEC) standards, and industry best practices.
5. Apply cryptographic protocols to protect transmission of vote tallies.
6. Require 100 percent verification of results transmitted to the media through separate count of PCMCIA cards containing the original votes cast.
7. Establish a formal process requiring the review of audit trails at both the application and operating system levels.
8. Provide formal information security awareness, training, and education program appropriate to each user’s level of access.
9. Review any system modifications through a formal, documented, risk assessment process to ensure that changes do not negate existing security controls. Perform a formal risk assessment following any major system modifications, or at least every three years.
10. Implement a formal, documented process to detect and respond to unauthorized transaction attempts by authorized and/or unauthorized users.
11. Establish a formal, documented set of procedures describing how the general support system identifies access to the system.
12. Change default passwords and passwords printed in documentation immediately.
13. Verify through established procedures that the ITA-certified version of software and firmware is loaded prior to product implementation.
14. Remove the SBE GEMS server immediately from any network connections. Rebuild the server from trusted media to assure and validate that the system has not been compromised. Remove all extraneous software not required for AccuVote-TS operation. Move the server to a secure location.
15. Modify procedures for the Logic and Accuracy (L&A) testing to include testing of time-oriented exploits (e.g., Trojans).
16. Discontinue the use of an FTP server to distribute the approved ballots.
17. Implement an iterative process to ensure that the integrity of the AccuVote-TS voting system is maintained throughout the lifecycle process.

The system, as implemented in policy, procedure, and technology, is at high risk of compromise. Application of the listed mitigations will reduce the risk to the system. Any computerized voting system implemented using the present set of policies and procedures would require these same mitigations.

ENDS

© Scoop Media