Sequoia Voting Systems Threatens Princeton Computer

BLOGGED BY Brad Friedman ON 3/17/2008 6:36PM

EXCLUSIVE: Sequoia Voting Systems Threatens Princeton Computer Scientists with Legal Action if they Carry Out NJ Commissioned Analysis of the Company's Touch-Screen Voting Machines

VP Edwin Smith Warns Scientists, in Email Obtained by The BRAD BLOG, of Plans to Take 'Appropriate Steps to Protect Against Publication of Software, Its Behavior or Reports Regarding Same'

ALSO: Company Website of One of Nation's Largest Voting Machine Vendors Refers to 'Democrat' [sic] Party in Explanation for Recent Primary Election Failure...

-- Brad Friedman

Sequoia Voting Systems has sent a legal threat to Princeton University computer science professors Ed Felten and Andrew Appel warning them of legal action should they proceed with an analysis of New Jersey's touch-screen voting machines as unanimously recommended last week by an association representing election clerks across the state.

In a terse email sent last Friday, obtained today by The BRAD BLOG, Sequoia's Edwin Smith, Vice-President of Compliance/Quality/Certification, warns the university academics that the company has "retained counsel to stop any infringement of our intellectual properties, including any non-compliant analysis."

"We will also take appropriate steps to protect against any publication of Sequoia software, its behavior, reports regarding same or any other infringement of our intellectual property," Smith threatens.

The email from Smith to Felten and Appel is posted in full at the end of this article. Felten has confirmed its authenticity late this afternoon.

The call by state election officials for the independent study of Sequoia's AVC Advantage touch-screen machines comes in the wake of a recent finding that the systems mistallied voter turnout totals across at least six different counties in New Jersey's February 5th Presidential Primary Election. During a post-election canvass, it was found that the number of voters for each party, as reported by the internal printouts on the electronic voting machines, failed to match totals on the internal memory cards inside the same systems in a number of instances across the state.

Sequoia's explanation for the problem, essentially blaming voters and poll workers for pushing a complicated series of buttons, was found lacking by the state election clerks.

The discovery of mistallies followed on previous embarrassment for Sequoia and New Jersey when several machines failed to boot up at all on the morning of the Super Tuesday Election, causing a 45-minute delay before NJ's Governor John Corzine before he was finally able to cast a vote at his polling place in Hoboken.

Sequoia has good reason to be concerned about what may come of an analysis by professors Felten and/or Appel. Both of them have previously detailed major voting machine security flaws, and the ability to easily hack into such systems made by both Sequoia and Diebold Election Systems...

Hacking "Advantage" Goes to Computer Scientists

Sequoia's AVC Advantage system --- previously described on the company's website as "tamperproof" --- is not likely to withstand independent scrutiny by skilled computer scientists such as Felten or Appel. Though it wouldn't be the first time the company's products, or those by the other voting machine companies, failed miserable when they were finally allowed to be probed by independent parties.

In the Summer of 2006, Felten led the team at Princeton which famously implanted a vote-flipping virus on a Diebold touch-screen voting system. The team received the machine after a Diebold-insider source of The BRAD BLOG's gave us the machine to be passed along by the organization we co-founded, VelvetRevolution.us, to Princeton University for their analysis. The Diebold viral hack was subsequently reported widely, as live demonstrations were performed on Fox "News", CNN's Lou Dobbs Tonight and elsewhere.

The same team at Princeton detailed how all Diebold touch-screen systems used the same physical key --- one commonly available at office supply stores, and used for filing cabinets and hotel minibars --- to access any of its thousands of voting machines in use around the country.

The company was further embarrassed when working copies of the key were found to have been created by duplicating the keys from an actual photo of it which Diebold had posted on its own website.

For his part, Princeton's Appel made headlines himself when he purchased a number of the same Sequoia AVC Advantage touch-screen systems as used in New Jersey off of the Internet for $86 a piece in February of 2007. He found he was then easily able to hack the systems with vote-flipping code in just minutes time.

Prior to Appel's online purchase, the state of New Jersey had paid some $8000 a piece for the flawed systems.

At the time, Appel wrote of being "surprised at how simple it was...to access the ROM memory chips containing the firmware that controls the vote-counting." He went on to describe Sequoia's misleading claims that there were security seals in place to protect the chips inside the machines.

"Contrary to Sequoia's assertions in their promotional literature," Appel wrote, "there were no security seals protecting the ROMs. Indeed, I found that certain information in the 'AVC Advantage Security Overview' (from Sequoia Voting Systems, Inc., 2004) was untrue with respect to my machine."

He went on to charge that "the AVC Advantage can be easily manipulated to throw an election" by simply removing and replacing the system's vote-counting firmware without detection, and replacing it with fraudulent chips.

Appel's findings followed a similar, perhaps even more embarrassing situation in Pennsylvania just prior to the 2006 Election when longtime e-voting supporter Dr. Michael Shamos, a Carnegie Mellon University professor, accidentally hacked a Sequoia voting system while in the process of demonstrating to onlookers how the systems couldn't be hacked. Shamos was able to instantly "transform a handful of votes into thousands," as it was reported at the time. The vulnerability inadvertently discovered by Shamos derailed Pennsylvania's plan to quick certify the systems for use in the state's Primaries that year.

Later, in a remarkable finding, as reported exclusively by The BRAD BLOG just days prior to the 2006 general election, it was learned that a yellow button, found on the back of every Sequoia Edge touch-screen machine, could be pressed in such a way as to allow a voter to vote as many times as he or she liked "until physically restrained from doing so."

New Jersey, Sequoia and the "Democrat" Party

New Jersey has been on the precipice of spending some $16 million to purchase add-on "paper trail" printers for the Sequoia touch-screen machines. The cost would reportedly be $2000 to retrofit each of the state's 8000 Advantage systems. That purchase may be delayed or forestalled entirely depending on the outcome of the ongoing investigation into the voting system failures on February 5th.

In a detailed and confusing explanation posted on the company's website, Sequoia has found a complicated way in which they say poll workers and voters were to blame for the problems discovered on their voting machines during the recent New Jersey election.

NOTE TO SEQUOIA: You are one of the largest voting machine companies in America. You should know well by now that the major American political party which is not the Republican Party is named the Democratic Party, not the "Democrat party" as you have insultingly described them on your web page, as in where you wrote: "Let’s assume the Democrat party is assigned option switch 6 while the Republican Party is assigned option switch 12."

The letter from Sequoia's VP Edwin Smith to Princeton professors Andrew Appel and Ed Felten follows in full below...
Subject: Sequoia Advantage voting machines from New Jersey
Date: Fri, 14 Mar 2008 16:16:21 -0600
From: Smith, Ed
To: Ed Felten; Andrew Appel]

Dear Professors Felten and Appel:

As you have likely read in the news media, certain New Jersey election officials have stated that they plan to send to you one or more Sequoia Advantage voting machines for analysis. I want to make you aware that if the County does so, it violates their established Sequoia licensing Agreement for use of the voting system. Sequoia has also retained counsel to stop any infringement of our intellectual properties, including any non-compliant analysis. We will also take appropriate steps to protect against any publication of Sequoia software, its behavior, reports regarding same or any other infringement of our intellectual property.

Very truly yours,
Edwin Smith
VP, Compliance/Quality/Certification
Sequoia Voting Systems

720-746-2592 office
[###-###-####] cellular


UPDATE: Livermore National Laboratory's computer science expert David Jefferson, who has worked on a number of state e-voting studies, jumps into comments below, to point out that the decision about whether or not to commission the study of the Advantage machines in NJ will be up to AG Ann Milgram. He goes on to note:
She has not ordered any investigation and seems disinclined to. She is apparently satisfied with Sequoia's explanation. If BradBlog readers want to help, they could write Ms. Milgram and politely impress upon her the seriousness of the problem (almost certainly a simple bug in the Advantage firmware) and ask her to support the Princeton review or commission her own independent technical review.

Milgram can be contacted via phone, email, fax, snail mail etc. via this webpage.

http://www.bradblog.com/?p=5814