Electronic Voting Debate Enters Realm of Global Warming

August 20, 2008-Recently I ran across an interesting comment from the California Secretary of State, Debra Bowen, that was too good to pass up.  In an article for The Register out of the United Kingdom titled "Dr. Strangevote Saves Mankind with Luddite Voting Recipe", Ms. Bowen is quoted during her keynote address to the assembled computer scientists for the Usenix/ACCURATE conference in San Jose.  

The headline alone is entertaining, but what was especially enlightening was Secretary Bowen's comments to her critics after embarking upon her Top-to-Bottom Review of Voting Systems.  "I sometimes wonder if those who continue to deny the stunning insecurities of the electronic voting systems that are on the market are the soul mates of those who persist in denying the evidence of global warming," she said.  Let us all agree that voting integrity is an important issue just as much as global warming, setting aside the arguments over whether it is caused as a result of the human population. 

Since computer scientists acknowledge that no voting system is 100% secure, let us use this as our central tenet.  If no voting system, paper or electronic, is 100% foolproof by itself, then the integrity of any election must come down to the procedures used by election officials to encapsulate the process.  If we bring this discussion back to the issue of global warming, the fundamental difference of opinion is not the perceived problem, it is the solution.  Choosing paper ballots is simply trading off perceived weaknesses of one platform for the known weaknesses of another.

So, Secretary's Bowen comparison of this issue to global warming is a good illustration of just how murky the waters have become as we continue to be confounded by the solutions and an ever-changing threat model.

NY Times Details Difficulties of EAC Certification Program's Responsiveness

August 17, 2008- On August 16th, the NY Times published an article titled, "Officials Say Flaws at Polls Will Remain in November."  Although the characterization of flaws within current voting systems is certainly overstated by Mr. Urbina, the point is clear.  In order for the industry to achieve some level of responsiveness, there must be a mechanism for efficiently and effectively deploying product upgrades.  Regardless of whether a single jurisdiction chooses a paper or electronic voting option, the current delays within the certification program affect all of those states that are dependent upon EAC efforts.  Currently 35 states are subject to some level of EAC certification involvement.

All voting systems are going to be subject to the forces of product evolution and customer demand.  In the last eight years, the industry has been responsive to the demands of the marketplace.  Examples of this responsiveness include the development of voter verifiable paper audit trails, the deposit of election software with the National Software Resource Library and the deposit of election software in escrow with state election officials as required under state law. In addition, many of the software packages that are under consideration at the EAC have components which add a series of additional security features.

The fact is that the current voting systems are being considered for certification to the 2002 Voting System Standards.  All of the systems currently in use (through ETC members) are already certified to the 2002 Voting System Standards.  The only difference is the certifying agency.  Rather than the National Association of State Election Directors (NASED), it is now the United States Election Assistance Commission.  Unfortunately, the transition from the NASED process to the current efforts by the EAC has resulted in a period of two years in which no product upgrades have been deployed into the marketplace.  While there is a general need for product improvements, the overall accuracy and confidence in the systems expressed by election officials shouldn't be discounted.  After all, it is the local election official that must initially certify the election results.

In early spring of 2008, it was made clear to the participating manufacturers that no voting system should be expected to achieve certification in time for use in the November 2008 Election.  Based on this development and the enormous costs associated with submitting a system for certification, a few providers may have opted to add components in for system certification.  This was not done in an effort to delay certification efforts, rather it was an acknowledgement of the need to ensure that system, once certified, reflects the latest product enhancements.

With pressure mounting on the EAC to improve its certification program, it is important for the ETC to once again reiterate its support for an effective federal certification program.  We do not wish to see "quality sacrificed for expediency" in the certification process, but after two years without product upgrades, the current EAC certification program is quickly reaching a breaking point.

David Beirne

Executive Director

dbeirne@electiontech.org

The Election Assistance Commission:  Redefining Customer Relationships

July 29, 2008- The United States Election Assistance Commission (EAC) held its most recent public hearing in Phoenix, Arizona in conjunction with the annual conference for the International Association of Clerks, Recorders, Election Officials and Treasurers (IACREOT). As part of its agenda, the EAC officially adopted its new Voting System Test Laboratory Accreditation Manual. This manual will have immediate effect after it is published in the Federal Register and will govern the parameters for Voting System Test Laboratories as an accredited laboratory. 

Prior to its meeting the ETC transmitted its concerns over a particular section of the manual entitled "Laboratory Independence."  This section, as drafted and adopted by the EAC, prevents the participation of voting system providers in the actual testing process.  This is understandable.  What is not understandable is the fact that "participation" is defined as public observation.  This prohibition of public observation appears to conflict with Section 4.7.1 of the NIST Handbook 150:2006 which outlines the general procedures for accredited laboratories while working with their customers.  Within Section 4.7.1 of the NIST manual, it is recommended that the laboratory cooperate with the customer.  This cooperation may include the "witnessing of the tests being conducted" by the test laboratory.

During the public hearing for the EAC, the Director of the Federal Certification Program stated, "the EAC is just as much a customer as the manufacturer." This means that as a sole financier of the current certification program, each registered manufacturer has only attained equal footing with the EAC. Although the certification of voting systems is a unique process, the consistent disregard of industry providers as key stakeholders and the lack of recognition for their investments is now reaching epic proportions.  

Although the Commission did take up our concerns formally during the meeting, it is simply beyond the pale for someone to claim that the registered manufacturer is not a customer, or at the very minimum, the primary customer.  Even if the EAC desired an approach immersed in transparency, a better alternative would be to make it entirely transparent rather than shut everyone out of the observation process.  Perhaps a better balance would be achieved if the EAC audited the performance of each VSTL.  Simply removing a provider from the testing observation process only eliminates a layer of accountability from the process.

NACRC Annual Conference Session Highlights Computer Forensic Analysis As An Innovative Tool for Election Integrity

July 16, 2008- The National Association of County Recorders, Election Officials, and Clerks (NACRC) recently completed their annual conference in Kansas City.  One of the more interesting workshops delved into the practices in Cook County, Illinois and the use of forensic analysis to document the integrity of software used in an electronic voting system.  Cook County currently contracts with a provider who reviews the software used during an election and tracks the sequence of events used to setup an election and analyzes the series of file changes between those events that are expected and those that are not. Any anomalies documented would be further reviewed as potential indicators of fraud or errors.

Cook County is the latest example of a jurisdiction that is applying an innovative technique to document and establish a high confidence level when it comes to the use of voting technologies.  Time and time again we consistently hear from computer scientists that no computer system is 100% foolproof.

If this is the consensus, it shouldn't be that difficult to use a series of procedures to document and establish a high level of confidence in the accuracy of the results.  After all, a recount or audit only establishes that the equipment performed as it should.  It does not reveal or document the integrity of the election from the standpoint of voter eligibility.  That is typically only revealed in an election contest proceeding.

Over the last eight years, the entire elections community has been subjected to the impossible challenge of disproving negatives.  This is unfortunate because it negates the innovative work that we continue to see from election officials in Cook County, Illinois and the well-publicized successes out of Travis County, Texas.

David Beirne, Executive Director

dbeirne@electiontech.org

Texas House Committee on Elections Hearing on Voting Technology Reveals Rice University is a Microcosm for the Nation

July 8, 2008- Just two weeks ago, the Texas House Committee on Elections sponsored a hearing on voting technology.  One of the more striking observations from this hearing was the differing remarks from two academics from Rice University, Dr. Bob Stein from the Rice University Political Science Department and Dr. Dan Wallach from the Computer Science Department.  The resulting remarks from these two professors illustrated perfectly the ongoing difficulty for election administrators and industry providers when it comes to voting technology and balancing usability with voter confidence and greater security. 

Dr. Stein's remarks focused on his recent article for the Election Law Journal entitled "Voting Technology, Election Administration and Voter Performance". Dr. Stein and others from Rice University (including Dr. Wallach) conducted a survey of voters in Jefferson County, Texas during the 2006 General Election to gauge their response to voting technology. During this election, Jefferson County voters were free to choose a paper ballot or an electronic ballot.  Over 82% of the randomly selected respondents indicated that they chose the DRE voting system over the paper ballot.  Not only did these voters select the DRE, but they benefited from their selection.   "A significantly larger proportion of voters using the touch screen voting machine (84%) reported taking less than five minutes to vote than was reported by voters who voted on a paper ballot (78%)." Dr. Stein's article also goes on to document the statistically significant relationship between voting technology chosen and time spent voting.  Voters selecting a DRE spent less time voting than voters voting on a paper ballot.  When it came to usability, again the DRE system performed better than a paper ballot. "Voters' confidence that their ballots were accurately recorded does not vary by ballot technology used".

The most interesting portion from Dr. Wallach's written remarks was the acknowledgement of the academic model for reviewing threats to voting systems, "Only through careful experimental studies, outside of real elections, can we ever learn what works and what fails." Reviewing voting systems in an operational vacuum and "outside" a real-world elections environment is exactly the type of academic approach that only attempts to subvert voter confidence without adding real value.

David Beirne, Executive Director

dbeirne@electiontech.org

NASED Meeting Details Frustrations with Current Voting System Certification Efforts-EAC Announces Intention to Adjust 2005 VVSG with Portions from Latest Draft

June 26-27, 2008- The National Association of State Election Directors (NASED) convened in Jackson Hole, Wyoming for their Summer meeting.  Highlights on the agenda included a panel discussion on the current challenges for the EAC-administered certification process and an update on the activities of the Technical Guidelines Development Committee activities.

As the ETC Executive Director, I was fortunate enough to be invited and share the the industry's perspective on the fundamental problems associated with the current regulatory environment.  One of the central tenets of our "Broken" policy brief is the position that the EAC is a rulemaking agency when it comes to the administration of the certification program.  Although the EAC contends that it is not a rulemaking agency, it is hard to reconcile this belief with Section 231 of the Help America Vote Act.  Section 231 states that the EAC "shall provide for the testing, certification, decertification, and recertification of voting system hardware and software by accredited laboratories."  Clearly this provides authority for the EAC to adopt policies and procedures (i.e., rules) associated with the certification program.  The EAC will need to continue to digest our report and potentially adjust their procedures to meet the requirements under the Administrative Procedure Act.

The main objective from the ETC's recent efforts in exposing the current certification challenges is to present the EAC with an opportunity to revisit its procedures and recognize the industry as a key stakeholder.  A growing consensus has formulated over the need for having the voting system industry as a direct participant in the voting systems standards development process.  Currently, the EAC is administering a series of federal advisory committees which all lack industry representation.  During the NASED meeting, two members from the Technical Guidelines Development Committee (TGDC) spoke out on the need to include industry representation in the standards setting process.  Interestingly, the National Institute of Standards and Technology (NIST) finds itself mired in a standards setting process that is contrary to past efforts.  NIST and the American National Standards Institute (ANSI) entered into a Memorandum of Understanding which encourages the use of consensus when developing standards.  Under the current definitions for an American National Standard, the Voluntary Voting System Guidelines (VVSG) (both the 2005 version and the most recent draft) would not meet the threshold for classification as such.  In order to qualify as an American National Standard, ANSI insists that the "minimum acceptable due process requirements for the development of consensus" be met.

Another point that seems to be recognized by all of the participants in the certification process is the fact that it is currently undergoing a period of evolution.  Unfortunately, this evolution is currently in-progress and is being financed on the backs of those voting system providers currently pursuing certification.  For an industry that operates for a finite customer base, the financial risks for funding a work-in-progress is not the ideal model and will continue to represent one of the most significant challenges for staving off future market failures. 

A significant development from the NASED meeting was the announcement from EAC staff that portions of the new VVSG will be reviewed for possible inclusion into a revised version of the 2005 VVSG.   It is possible the EAC will be considering adoption of a revised version of the 2005 VVSG within the year.  This represents a significant policy change for the EAC and will represent another challenge for the industry as it may require industry providers to revisit their current compliance projections for either pursuing full 2005 VVSG certification or choose to wait to pursue full certification under the latest draft.

David Beirne, Executive Director, dbeirne@electiontech.org

EAC Commissioner Responds to Industry Policy Brief

June 19, 2008- As the dust settled yesterday from the release of the ETC's policy brief on the state of the regulatory process, EAC Commissioner and Chairwoman Rodriguez responded "the EAC will not sacrifice the integrity of the certification process for expediency."  Of course, nowhere in our assessment of the EAC process does the industry ask for the expedition of the certification process.  The ETC is simply documenting the following facts:

No voting system has achieved federal certification since the EAC certification process began (the systems currently in operation have been certified under the old process and have recorded over 200 million votes since 2004);

Certification costs have risen 300% since the EAC process began (these costs will have to be passed on to someone and what makes the EAC think that market failure isn't a potential byproduct of its efforts?);

The EAC may be jeopardizing the VVSG as a work product by not taking steps to include industry representation on the Technical Guidelines Development Committee (the Federal Advisory Committee Act (FACA) requires fair balance for committee membership and the courts have recognized the importance of "fairness");

The EAC is a rulemaking agency when it comes to its certification program and must adhere to certain due process requirements (without full notice and comment, the EAC is positioning itself as agency above administrative law and the protections afforded to groups under the U.S. Constitution);

The EAC is completely shut off from the industry it intends to regulate and has positioned itself as an adversary in a voluntary framework for state compliance.

"Broken" is a policy brief that represents an opportunity for the EAC to examine the issues discussed from a factual and administrative law background.  Calls for a review of its communication policies and representation on the TGDC are grounded in federal law and based on other agency precedents.  Hopefully, the EAC leadership will take some time to actually read the policy briefing and recognize the important opportunity it represents.

David Beirne, Executive Director, dbeirne@electiontech.org

Download a copy of "Broken:  The Regulatory Process For the Voting Industry"

Election Assistance Commission Updates Election Officials on Status of Certification Program

June 17, 2008- In light of a growing frustration on the part of state and local election officials, the EAC recently issued a letter attempting to stave off fears that the EAC will be unable to certify any equipment in time for the November 2008 General Election.  The Election Technology Council expressed concerns over the timeliness of the certification process back in 2007.  At that time various states were already asking for software enhancements for use during the 2008 election cycle.

For a copy of the Council's original letter to the EAC, click here.  Here is the original response from the EAC.

Our letter was intended to alert the EAC to the issue as we recognized it at the time.  The EAC continues to cite three letters of noncompliance that were issued to registered manufacturers as a reflection of the unwillingness of providers to meet certification requirements.  These letters of noncompliance all reflect a general need to clarify policy decisions made by the EAC or reflect an area that had not been previously addressed, not an unwillingness to comply with EAC edicts.

Now that we are past June 1st, state and local election officials are recognizing that the window to deploy new software upgrades in time for the November election is quickly closing.  This is leading to a growing trend for states to consider opting out of the voluntary certification framework altogether or the need to develop an alternative means to permit the use of software that may not be certified in time at the federal level.  The industry supports an effective federal certification and standards program rather than the use of 50 different standards, but we recognize that elections do not stop and our state and local election officials need solutions.

David Beirne

Executive Director

dbeirne@electiontech.org