guaranteed in the voting machines which were the subject of the complaint since the checksums displayed and printed when the device was launched were calculated by the software installed in the voting machine itself, so that it was alleged not to be ruled out that the calculation of the checksums provided the expected chain of characters because of a prior deliberate manipulation of the software. The particular danger in computer-controlled voting machines was said to lie in the fact that elections could be much more effectively influenced via manipulation of the software by the device manufacturer than in ballot box elections. For instance, it was said to be possible for faulty software to allot a certain share of the votes cast to a certain party regardless of the election decision by the respective voter or for the total votes cast to be divided among the parties standing for election according to a set proportion. Manipulations were said to be possible both by politically or financially motivated “insiders”, in particular employees of the manufacturer, and by external third parties who gained access to the computers used by the manufacturer (for instance via viruses or trojans); they were said with regard to the complexity of the software used not always to be discovered even in careful quality control effected by the manufacturer. Although it was said to be necessary to prevent unauthorised access to the devices between the elections through suitable security measures, no such monitoring was said to take place in Germany; there were also said to be no suitable regulations in force that were able to guarantee protected storage of the voting machines. 38 It was said that the proceedings for the examination of the type sample by the Physikalisch-Technische Bundesanstalt and the approval of the type by the Federal Ministry of the Interior should be public as a part of the preparations for the elections. Any interests of the manufacturer in protecting its business secrets should be subordinate to the principle of democracy. For a lack of a possibility to check the device independently, the publication of the control documents and reports of the Physikalisch-Technische Bundesanstalt and of the source code of the voting machine software was said to be the only possibility in order to be able to judge the integrity of the elections. The non-publication of the control reports and documents and of the source code was hence said to constitute an electoral error. 39 It was said not to be compatible with the “principle of the official nature of the elections” that the functionality of the voting machines could only be examined by the manufacturer (§ 7.1 of the Federal Voting Machine Ordinance), and that there was no official control of freedom from manipulation of the voting machines. Over and above the declaration of identity, there was said to be no authentication of the software implemented on the individual voting machines, so that the election bodies had to rely on effective quality assurance by the manufacturer and on there being no manipulation after the examination had been carried out by the manufacturer. The tests carried out by the district returning officer in the context of preparation for the election and by the returning committee in the polling station were said not to be suited to recognise any manipulations. 40 10/37

Select target paragraph3