Jim wrote:

If you fully review the paper you posted you would note some glaring
confessions to their "study"

"the CVS source code repository for Diebold's AccuVote-TS DRE voting
system recently appeared on the Internet."
"We only inspected unencrypted source code,"
"We did not have access to actual in use code"

The did not have access to the actual code used nor access to
the encrypted portions of the code. This "scientific" study relied upon
"warez" released unverified through the internet.
This alone invalidates the study to be used as a reference against
actual in use systems since they never studied the real thing.

As has been widely reported, the source for the software was a
Diebold FTP server. It was not "warez" picked out of thin air.

"SUMMARY OF RESULTS. We discovered significant and wide-reaching

vulnerabilities in the version
of the AccuVote-TS voting terminal found in [9] (see Table 1). Most

voters can easily program their
own smartcards to simulate the behavior of valid smartcards used in the
election."

They misrepresent the test bed, first they acknowledge not having access

the
encrypted source code nor verification of the unencrypted and only

real source code as being the terminal software.

How is fully disclosing what they tested "misrepresenting the test
bed"? As for "assuming" the source code was the terminal software,
they ran the damn program (called AccuVote-TS version 4) to test
it! What the hell else was it going to be?

didn't have access to, they state: "We did not have source code to
Diebold's GEMS back-end election management system."

Next portion above should
take aback anyone with even a cursory knowledge of smartcards.
Without knowing the encryption used, key codes or even the data layout
there is no "easy" way to program your own smartcards for anything.

Also this completely ignores that real world use cards are serialised
and encryption coded per polling station and the sequences are not known

the
polling personnel and are only verified and decoded to indicate a
valid access card via encryption algorithms within the specific
polling machines.

Which the Diebold program did not do, as described in the report.
P. 9 :"Upon reviewing the Diebold code, we observed that the smartcards
do not perform any cryptographic operations."

Let's further analyse their "report"
"the protocols used when the voting terminals
communicate with their home base, both to fetch election configuration
information
and to report final election results, do not use cryptographic

authenticate
either end of the connection nor do they check the integrity of the data

transit."

This is dubious reasoning at the very least and outright lying at the

Reasoning? They could see what the program did!

First they admit to not having the actual source code and further
do not know the encryption portions of the code they did acquire.

They said they examined unencrypted source code, which means
the source code itself wasn't encrypted, not that they couldn't look
at the portion of the code that delt with encryption! That is
described in detail in the report, for example, section
4.4.

The transmission protocols are the SAME protocols used at
hundreds of thousands of ATM's worldwide and they absolutely
DO use strong encryption.

Yes, in a sane world, Diebold's software would do that. However, they
RAN the program, examined the source code and saw that it didn't.
You, on the other hand, haven't seen it, or run it.

The remainder of this dubious report builds upon the assumptions
and invalid premises it started with.
It is not and should not be considered a valid evaluation
of current electronic voting systems.

Their results have been verified and validated. From p. 5:

"Following the release of our results, the state of Maryland hired
SAIC [27] and RABA [24] and the state of Ohio hired Compuware [7]
to perform independent analyses of Diebold's AccuVote-TS systems.
These analyses not only support our findings, but show that many of the
issues we raise and attacks we identify still apply to recent versions
of the AccuVote-TS system, and particularly to the machines recently
purchased by Maryland. These analyses also identified security problems
with the back-end GEMS server. Additionally, RABA's "red team"
implemented some of our attacks in a mock elec-tion setting; e.g.,
they modified smartcards so that a voter could vote more than once
(Section 3.2 and [24,page 16]) and they implemented our ballot
reordering attack, thereby tricking voters to vote for the wrong
candidates (Section 4.2 and [24, pages 18 and 21]). Jones discusses
these three reports in more detail [17]."

Richard

Jim wrote:

If you fully review the paper you posted you would note some glaring
confessions to their "study"

"the CVS source code repository for Diebold's AccuVote-TS DRE voting
system recently appeared on the Internet."
"We only inspected unencrypted source code,"
"We did not have access to actual in use code"

The did not have access to the actual code used nor access to
the encrypted portions of the code. This "scientific" study relied upon
"warez" released unverified through the internet.
This alone invalidates the study to be used as a reference against
actual in use systems since they never studied the real thing.

As has been widely reported, the source for the software was a
Diebold FTP server. It was not "warez" picked out of thin air.

"SUMMARY OF RESULTS. We discovered significant and wide-reaching

vulnerabilities in the version
of the AccuVote-TS voting terminal found in [9] (see Table 1). Most

voters can easily program their
own smartcards to simulate the behavior of valid smartcards used in the
election."

They misrepresent the test bed, first they acknowledge not having access

the
encrypted source code nor verification of the unencrypted and only

real source code as being the terminal software.

How is fully disclosing what they tested "misrepresenting the test
bed"? As for "assuming" the source code was the terminal software,
they ran the damn program (called AccuVote-TS version 4) to test
it! What the hell else was it going to be?

didn't have access to, they state: "We did not have source code to
Diebold's GEMS back-end election management system."

Next portion above should
take aback anyone with even a cursory knowledge of smartcards.
Without knowing the encryption used, key codes or even the data layout
there is no "easy" way to program your own smartcards for anything.

Also this completely ignores that real world use cards are serialised
and encryption coded per polling station and the sequences are not known

the
polling personnel and are only verified and decoded to indicate a
valid access card via encryption algorithms within the specific
polling machines.

Which the Diebold program did not do, as described in the report.
P. 9 :"Upon reviewing the Diebold code, we observed that the smartcards
do not perform any cryptographic operations."

Let's further analyse their "report"
"the protocols used when the voting terminals
communicate with their home base, both to fetch election configuration
information
and to report final election results, do not use cryptographic

authenticate
either end of the connection nor do they check the integrity of the data

transit."

This is dubious reasoning at the very least and outright lying at the

Reasoning? They could see what the program did!

First they admit to not having the actual source code and further
do not know the encryption portions of the code they did acquire.

They said they examined unencrypted source code, which means
the source code itself wasn't encrypted, not that they couldn't look
at the portion of the code that delt with encryption! That is
described in detail in the report, for example, section
4.4.

The transmission protocols are the SAME protocols used at
hundreds of thousands of ATM's worldwide and they absolutely
DO use strong encryption.

Yes, in a sane world, Diebold's software would do that. However, they
RAN the program, examined the source code and saw that it didn't.
You, on the other hand, haven't seen it, or run it.

The remainder of this dubious report builds upon the assumptions
and invalid premises it started with.
It is not and should not be considered a valid evaluation
of current electronic voting systems.

Their results have been verified and validated. From p. 5:

"Following the release of our results, the state of Maryland hired
SAIC [27] and RABA [24] and the state of Ohio hired Compuware [7]
to perform independent analyses of Diebold's AccuVote-TS systems.
These analyses not only support our findings, but show that many of the
issues we raise and attacks we identify still apply to recent versions
of the AccuVote-TS system, and particularly to the machines recently
purchased by Maryland. These analyses also identified security problems
with the back-end GEMS server. Additionally, RABA's "red team"
implemented some of our attacks in a mock elec-tion setting; e.g.,
they modified smartcards so that a voter could vote more than once
(Section 3.2 and [24,page 16]) and they implemented our ballot
reordering attack, thereby tricking voters to vote for the wrong
candidates (Section 4.2 and [24, pages 18 and 21]). Jones discusses
these three reports in more detail [17]."

Richard

"John Fraud Kerry" <JFK@DNC.com> wrote in message

John wrote:
Democrats realize Kerry is a fraud and has no demonstrable leadership
skills, but they also realize none of the other Nine Democrat Dwarves had
any demonstrable leadership skills either, so they are simply voting for
Kerry because he happens to be the tallest of the Nine Dwarves.

In other words, Kerry is the least dwarfish. Hardly a reason to elect him
in November, however.

The fact of the matter is that Repugs are a bunch of genocidal
FASCISTS, with no morals whatsoever, and that is the truth.

I've said this before, but it's worth repeating, Kerry never called
Veterans murderers. What Kerry did is he stood up to Nixon, Nixon is
the murderer. Nixon was a mass murderer of the worst kind, he used
chemical and biological weapons against innocent Vietnamese men, women
and children. Nixon actually used a Weapon of Mass Destruction, and he
gassed his own people, just like Saddam Hussein. Nixon used Agent
Orange, a Weapon of Mass Destruction, not only against innocent women
and children but also against American soldiers. Agent Orange was used
by Nixon, by his permission and the permission of other high level
Repuglicans, and Agent Orange was used in places where our own service
members operated, in places where Nixon knew would kill our own service
men as well as kill innocent Vietnamese people.

What this proves is that Repuglicans only pretend that they oppose WMDs,
but they are the biggest proliferators of WMDs, Repuglicans even have no
qualms about killing their own people, they have no qualms about killing
anyone, yet they continue to express their phony indignation over Saddam
Hussein killing his own people.

In one of his books, Nixon boasted about the Cambodian "extermination
bombings" which he launched. Nixon killed millions of people in Vietnam
and Cambodia, and then to top it off Nixon and his fellow Republicans
also supported and helped the genocidal Pol Pot government come to power
in Cambodia, and this led to the killing of million of more innocent
people. The whole Vietnam war was was built on nothing but lies upon
lies upon lies. It's incredible how Republicans have just dedicated all
their energies only for the spreading of lies and for the killing
millions of people. They don't seem to be doing anything else with
their time and energy, they are certainly not doing anything good for
our country or any other country.

What Sen. John Kerry did after he came back from Vietnam is he stood up
for the truth, and for that, Republicans hate him.

Think about it, under Republicans, millions of people thru out the world
die. But under Democrats, millions of people thru out the world get
their freedom. For example, it was under Democratic President Jimmy
Carter that the genocidal Pol Pot government was overthrown, he gave
Vietnam the green light to go into Cambodia and get rid of Pol Pot. The
Republicans support and create the genocidal Pol Pot government, but the
Democrats get rid of the genocidal Pol Pot government. This speaks
volumes about the difference between Democrats and Republicans.

The fact of the matter is that Repugs are a bunch of genocidal
FASCISTS, with no morals whatsoever, and that is the truth.

<><><><><><><><><><><><><><><><>

Educate yourself & go to these links:

http://www.moveon.org & http://www.salon.com & http://www.buzzflash.com
& http://www.democrats.org & http://www.commondreams.org &
http://www.bushwatch.com &
http://www.academycomputerservice.com/economics/charts.htm &
http://earth.prohosting.com/songofth/jobcreation.jpg