Hopkins's own Aviel Rubin, a professor in the computer science department, is very active in the area of electronic voting. He is best known for his analysis in 2003 of the weaknesses in the software on Diebold electronic voting machines and the first successful "hack" of the iPhone in 2007 by Independent Security Evaluators, a consulting firm which Rubin co-founded and currently serves as the president for.
Rubin, the technical director of the Information Security Institute, came to Hopkins in 2003 after working in the AT&T Labs' Security Research Department.
This week, he took time off from his work with the upcoming election to discuss electronic voting with the News-Letter (N-L).
N-L: Your analysis of Diebold's electronic voting systems has been widely cited and has served to question the security of these systems. What were some of the major faults you found with its systems?
AR: What we looked at in my lab was the source code for the software on the voting machine.
The process was to simply look at the code and see how well the code was written, seeing how it implemented security. We found that they didn't use very good software engineering methodology.
We were able to easily change ballot definition file, which means we could change a vote. We found the admin pin for smart card to cancel votes was 1111. Wherever they used cryptography or encryption, they used it incorrectly. There were also some other more technical issues with their systems.
N-L: What are some of the practical consequences of these software problems?
AR: First, poorly written code affects even the simple operation of the machine. The machines are more likely to have bugs or simply crash on Election Day. There is also the possibility that poorly written code could result in intentionally changed votes.
Secondly, the problems we found with the admin pin meant that it would be easy to tamper with the machine. Anyone who gained access to a smart card along with a weak pin would be able to enter the machine, change votes and overall, tamper with the election.
N-L: Since your analysis in 2003, what reforms have Diebold and other electronic voting companies engaged in?
AR: Not much, to be honest. There are a number of other companies besides Diebold, such as Sequoia and Hart Inter-Civic, but they aren't much better.
N-L: Given all these issues, why did we begin using electronic voting machines in the first place?
AR: After the Florida 2000 recount, Congress passed the Help America Vote Act, which gave money to electronic voting. Congress was trying to avoid the 'hanging chads' debacle that occured there. People began buying these [electronic voting] machines before they understood the security risks.
Given all the issues, states that don't use [electronic voting] machines are no longer trying to buy in and many that are using machines are trying to move away from it...Maryland is currently a hundred percent electronic voting, but by 2010, we should have shifted.
N-L: What do you see as the future of electronic voting?
AR: Efforts to improve electronic voting haven't been very successful so far. The attempts to have ballot printouts weren't successful because it was difficult to verify if the actual recorded vote matched the print out.
It's been difficult streamlining these machines so that they are user-friendly, so that voters really understand what they're doing along the way.
In 2004, 37 states used electronic voting systems. In 2006, and again this year, that number is declining. This year, about a third of voters will use electronic voting machines.
N-L: So what voting techniques do you recommend?
AR: Right now, I'm working with Maryland to help shift to a hand ballot that optically scans ... similar to a Scantron type system.
N-L: Since 2003, what have you done in the electronic voting community?
AR: After our initial analysis, I applied to the National Science Foundation for a grant to study voting systems in general and potentially to develop new techniques. We received $7.5 million for a center, and I also founded a group called Accurate.
Accurate is a group of professors from across the country. We're from six different institutions. We study system feasibility, cryptography, potential future voting systems and security mechanisms for voting.
In addition, a big part of what we do is education and community outreach. We try to incorporate these practical problems in courses that we teach. We also try to get involved with our local communities. I'll be working on Election Day this year as a voting system examiner.
N-L: What drew you to Hopkins, and how do the resources here help you with your work?
AR: The biggest things here are the Information Security Institute and the fact that it has a lot of support from the deans and the faculty.
In January 2003, when I was leaving AT&T, I had a number of offers, but I ultimately chose Hopkins because of the commitment and focus on security that I felt the University provided.
