The Chaos Computer Club highlights severe risks accompanying the use of software-aided barcode counting systems at the Bavarian local elections. During the elections on March 2nd 2008 more than 8000 barcode reading pens and PCs will be used to count the ballots on polling day.
The barcode-aided count, test-run in bavaria six years ago, is a system consisting of a computer, barcode scanner, USB-stick and a software made by the "Anstalt für Kommunale Datenverarbeitung in Bayern (AKDB)", which translates to "institution for communal data processing in Bavaria". The single components are easily manipulated, despite their certification by the Bavarian Ministry of the Interior; together they constitute a high risk to the integrity of the local elections on March 2nd.
By using this system, it is not possible for the election officers, their assistants and the voters to inspect the tallied votes at any time during the count; this is only possible in complicated procedures at the counting stations. The speaker of the CCC, Frank Rieger, said: Realistically, no assistant has a continuous overview during the count, over which candidate or which party received how many votes. A manipulation in the background through an invisble malicious programme is inconspicious and easily feasible. The software, as well as the final result are saved on a portable USB-stick – hence manipulation is easy with a low risk of discovery.
According to an instructor for the system, the assistants can turn off their brains using the new system, the software will finish all the counting tasks, an attitude inappropriate for the oversight of the democratic process.
CCC research in the communities showed, that general guidelines for the handling of the new, computerized count do not exist. Communities make up their own rules about the operation of the count with the barcode system. For example, one community stores the windows-computers in the polling stations unattended over night. Another even asks its election assistants to bring their own computer from home, on which the counting software then should run.
The barcode pens themselves can be reconfigured in the simplest manner through special barcodes – this can not be turned off during the count. A single, manipulated ballot in the box can reprogram the barcode used for the count.
Of course it is understandable, that the communities are trying to use technological aids to speed up the count of the ballots. But this may not be a charter for the uncontrolled use of poorly conceived risky technologies, CCC speaker Frank Rieger said, explaining the CCC's opposition to the technologies.
Due to the flawed design of the system it seems impossible to guarantee a transparent count of the vote that can be inspected by everybody involved in the electoral process.
The communities in Bavaria are clearly nervous about the introduction of the new technology, as the software and hardware brings new security risks to previously risk-free areas. A technically interested member of the CCC was fired as an election assistant, after he had made information from his training publicly available on the internet.
Apparently the people who are in charge in Bavaria want to establish security through concealment and obscuring the design weaknesses in the system and process. But this is deceptive and such a conduct is definitely not democratic or transparent. The CCC calls on the communities not to use the barcode aided counting procedure due to the, now well publicised, risks and count the vote manually.
In contrast to the NEDAP voting computers, there the process still remains with a manually countable ballot. The ballot paper is the final expression of the voter's will. If the communities use this insecure system, the CCC calls on all voters to explicitly demand a manual re-count.