An Engineer's Guide: Why ATMs and Voting Machines Fail

Here's an interesting, recent story for those that seem to think that ATMs are inordinately secure and essentially bulletproof. It comes from renowned computer security expert Bruce Schneier. Anyone who even dabbles in cryptography should recognize that name.

The crux of the story is:

Last month, a man reprogrammed an automated teller machine at a gas station on Lynnhaven Parkway to spit out four times as much money as it should.

He then made off with an undisclosed amount of cash.

The whole story makes for quite an interesting read. It shows that ATMs are indeed vulnerable. In some ways it also hints or contributes to answering the question of why we don't hear so much about these stories: Many people here were recipients of extra cash, not just the perpetrator. The money was pouring out for nine days. Some honest soul finally reported the issue. Clearly she's not a Republican.

But back to the more interesting discussion unfolding here on DKos. How can touchscreen voting technology fail in a world where ATMs always at least seem to work? Notice that the above cited story only addresses the security aspect and not the reliability aspect. Several key factors emerge. I will highlight only a couple of those of which I have not heard much discussion thus far. Forgive me if I missed your verbose comment or diary on any of the following subjects.

1. System Integration & Requirements

We often say that a certain vendor makes both ATMs and voting machines (e.g. Diebold) and thus we wonder "how could they be so different?" What we fail to consider is that often the embedded system design is farmed out to a variety of competitive subcontractors. I've walked through offices of companies that design boards for both ATMs and voting machines (Diebold, ES&S, VoteHere, etc). I've handled the boards and looked at the various full-scale assemblies. They are often remarkably different because the customer (the system integrator) provides differing requirements.

So the voting machine design may not be geared toward the same robust target as the ATM, despite our common sense that it really should be. One customer may want Windows CE while another prefers Embedded Linux, etc. So the architectural differences can ultimately be significant. This can have a bearing on reliability. And let's not kid ourselves by the way: ATMs fail. I've seen far too many under troubleshooting with a logic analyzer or oscilloscope to believe otherwise.

2. ESD Protection

One of the key discussions going on behind the scenes between voting technology experts around the country regards the effects of Electro-Static Discharge. I have been personally shocked (no pun intended) by the lack of adequate ESD perimeter protection on many of the voting machine circuit boards I've seen. Typically you'll see a band of conductive material (copper, gold) around the perimeter of any circuit board that has human interfaces. This helps to prevent any discharge into the logic circuitry when a person inserts a USB cable or touches a touchscreen. It effectively captures and safely grounds any such ESD events. Without such protection, the circuit is not only subject to immediate faults (i.e. potential vote switches or system hangups), but also long-term occult degradation.

What's particularly troubling about ESD failures is that they are not necessarily distinctly repeatable. When troubleshooting an issue with any circuit design, an embedded systems developer will tell you that it helps tremendously if the failure can be easily repeated. An ESD event by its very nature often has a pseudo-random quality, making it extremely difficult to attribute.

So one voter may have a problem and another not on the same system. Sometimes it might be reflected in the summary screen while other times not. And in any case voting machines wouldn't necessarily appear generally "problematic" and thereby be removed from service by an assiduous election judge. It's just too complex and tricky to pin down, no matter how subtly trained your eye ostensibly may be.

The bottom line is that factors such as ESD could easily impact an election. And for a given board layout, what seems like a pseudo-random source could actually have a deterministic impact; that is, one candidate or set of candidates could be the benefactor to the detriment of others. I post this to open minds to this idea and shape the dialog accordingly.