This year, the U.S. will pick a new president using electronic voting machines that can be hacked, security experts said Thursday at the RSA Conference in San Francisco.

As the November election approaches, the question before officials is not how to fix known bugs in their e-voting systems, but rather, how best to check them for fraud, said David Wagner, an associate professor with the University of California, Berkeley's computer science department.

Wagner was part of the team that audited California's voting systems during the state's review of electronic voting, and the problems his team found affect counties across the U.S. "The three systems we looked at are three of the most widely used around the nation," he said during an e-voting panel discussion at the show. "They're going to be using them in the 2008 elections; they're still going to have the same vulnerabilities we found."

With images of Florida's laborious 2000 presidential recount in their minds, county officials have spent billions over the past eight years on electronic voting systems. These systems are supposed to take the guesswork out of vote-counting. The problem is that they are insecure, and now states are being forced to make do with buggy equipment, panel members agreed. "We have spent billions of dollars on equipment," Wagner said. "We don't have another several billion dollars."

The California audit examined systems from Diebold Elections Systems, Hart InterCivic and Sequoia Voting Systems, ultimately permitting their use in 2008, but only under certain conditions. In testing, Wagner and his team found that they could introduce a computer virus to any of the three systems, which would then spread throughout the county and ultimately skew the vote count.

This year most California voters will use paper ballots, which give officials a way to audit their machine-counted tallies for irregularities, but not all states have that option. About a quarter of the votes cast in the upcoming election will be on electronic voting equipment with no paper trail, Wagner said. And even the states that keep paper records are not necessarily checking their results. Only about a third of all states have records that are regularly audited.

That's too bad, he said, because the ability to check whether your voting system has been hacked is of paramount importance. "Security is not the most important thing," he said. "What's more important for elections is auditability."

The IDG News Service is a Network World affiliate.

Whitepapers

• Getting in Compliance With Government Data Regulations By Leveraging Online Security Technology
• How to Offer the Strongest SSL Encryption
• Maximizing Site Visitor Trust Using Extended Validation SSL
• Seven Steps to Reducing your Security Risk
• The Latest Advancements in SSL Technology
• Vulnerability Management For Dummies

View more SECURITY whitepapers

Webcasts

• Mobile Data Security
• Best Practices for Deploying WAN Optimization for Disaster Recovery
• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• The self-managed network

View more SECURITY special reports