Reply #12: Possibly Helpful Cliff Notes [View All]

Interpreter Code = a translation program. There are Federal Election Commission ("FEC") standards set for the Independent Testing Authorities ("ITAs") dated 1990 and 2002. In 2002 the standards forbid "interpreter code" because it is not transparent--it's very difficult to see what is going on when you have two complex languages and something mediating the two. The other reason why it is forbidden is that it is easier to modify from the field. A memory card with malicious code can't perform its function without its partner--the interpreter code--lying in wait within the computers. All the CA Diebold equipment has interpreter code, including the precinct scanners--EXCEPT for the absentee ballot scanners.

Yes, Diebold is most certainly using interpreter code on their CA equipment (except the absentee voting scanners) . In fact Steve Freeman (our primary CA SoS sanctioned tech) even said so in November 2005. Scroll to end for his "Executive Summary."

What's Up In California with the Diebold equipment: Whether McPherson did it out of intelligence OR , more likely, it was just dumb luck--the fact that he sent the Diebold equipment back to the ITA's actually was, according to BBV, a stroke of genius. During the recent Voting Summit (that CEPN were persona non grata) all the experts more or less scape goated the ITAs for all the implications of negligence of due diligence (which is incorrect, because there's plenty of blame to go around). BUT we have long known that the ITAs are a "house of cards" that don't check for vulnerabilities brought to their attention by activists, which is a likely because they are partially funded by, and essentially work for, the e-vendors.

As a result the ITAs are being watched like never before and so now that McPherson has asked them to again review the Diebold equipment specifically with an eye for the possibility of interpreter code, then they will have a difficult time avoiding looking for it. If they claim it's not there, then they are liable. Alternatively, if they do reveal it is present, then Diebold will have to pull out of California, which would send shockwaves across the nation--at least 35 states would have to pull their Diebold certifications.

FEC Guidelines are Tantamount to Law in CA (and approx. 35 other states): The FEC standards (guidelines) are much more than mere recommendations for California, because we've agreed to meet federal testing standards as a condition of certification. Presently our equipment must have a NASED number. To accomplish this the ITAs must follow the federal guidelines. There are about 35 states that have this requirement. Some notable states that do NOT require a NASED number are Ohio and Alaska.

35 states have this requirement! Again, to appreciate this, we must realize that now that McPherson has sent the Diebold equipment, which we know full well has FEC illegal "interpreter code" back to the ITAs for examination does mean that their confirmation of this fact will be devastating for Diebold. (Seemingly the only way out will be if the ITAs claim the interpreter code is not there.)

The Federal Qualification "NASED Number" Soon to be an "EAC Number" : NASED, the federal qualification authority is in the throes of being turned over to the EAC. Soon all equipment will require a EAC number (instead of a NASED number).

Who Runs NASED Federal Qualification Authority?

R. Doug Lewis: If you do some investigations you'll see that all roads seem to lead back to this guy. He started out as a computer salesman in TX and is an avid supporter of paperless voting.

Tom Wilke: He is the man charge of overseeing the NASED testing labs.

Who Will Run the EAC Federal Authority? What is interesting is that Wilke will now be moving from NASED to the EAC. Additionally, while the NASED was transparently beholden to evendors to move the federal guidelines authority to GOP political appointees, will it really be any less corrupt?

Steve Freeman Executive Summary

Page 7, number 13

13. ABasic Files. AccuBasic report files are used to configure AccuVote-OS and AccuVoteTS report contents and printing in precinct count mode. They are actually loaded into the memory cards for the AV-OS and AV-TS where their logic is executed. There are 24 report files supporting modifications to the reports for different states and jurisdictions. A few of these may provide options that are attractive to local jurisdictions as they provide variations on what summary reports are printed optionally or automatically and the order they are prepared. At the current time, the Federal testing only uses one of these files and does no source code review, leaving this to the states to verify. Within our state testing, we only verified the reports for the same file, 194US.abo, revision 1.15, and have checked the source files. Since the source file is not reviewed in the Federal testing, we have no absolute verification that the installed file found in the witnessed build (forwarded by Ciber) was created from these source files but signature information in the .abo file matches what would be expected from the source file.

The source code I was given clearly does not directly affect stored votes or even the voting result content of the reports. It just sets up the report options that will be available to the operator and some operator display information that sets up the options. The .abo file given is without risk to the election results.

The actual file used is selected in the AV-OS Options window of GEMS from the pulldown list in the Report field so the local user could potentially select any of these files or a modification of that file. The risk occurs in the opportunity to replace the verified file with some other .abo file (prior version, one the other existing versions installed in the GEMS/ABASIC directory, or by replacing the current code with rewritten code performing other operations.) In a certification report last year, we recommended that the unverified report files be deleted from the GEMS directory leaving only the verified files. The California Use Procedures should specify which files are approved for use and provide information so that the approved files may be verified. The risk involved with these files suggests that jurisdictions using this system should safeguard these files, as well as the election definition media that is used load these files to the voting machines.