Monday, June 27, 2005

 

Legislating better e-Voting

Politicians are hoping to be able to claim the fame for improving today's inadequate voting systems.

http://www.computerworld.com/governmenttopics/government/policy/story/0,10801,102667,00.html
Unfortunately they do not have the best technical understanding of the real process issues that underpin digital-based voting.

Being able to implement a trusted voting process requires more than just a verified paper ballot audit. If the DRE is manipulating and controlling the whole process it can cheat extensively and taint the paper record at the same time. An example would be not showing all the proper candidates and options to all voters equally, and thus they would believe their paper ballot was correct, when it is in fact compromised.

Similarly, just because the process includes paper artifacts, does not exclude blind or partially sighted voters. Exactly the opposite can be the case, where audio prompting can direct the voting, and then bar-code style printing on the ballot can be touched and sensed and validated.

The Clinton/Boxer legislation is again well-intentioned, but places undue faith in paper trails implemented by vendors without the proper oversight and certification methods to ensure correct operational and process factors are included:
http://www.computerworld.com/governmenttopics/government/legislation/story/0,10801,100073,00.html?from=story_picks

Overall however, the addition of paper ballot records to voting system will improve them, but not as much as advocates hope for.

To achieve a more comprehensive result requires implementation of a robust process model along with a broad range of safeguards and checks built around the voting process itself, such as the TLV approach provides for.

Sunday, June 19, 2005

 

Touch screen devices Achilles Heel of DREs?

One consistent thread in the testing and certification of touch screen devices is their calibration and alignment.

Where the operator sees their finger touched the screen and the underlaying text should be the same as where the computer thinks they have also touched. The two should be corresponding.

Unfortunately this is a mechanical and electrical alignment. The computer has no way of knowing if its calibration is skewed. Any kind of physical shock damage or electrical field misalignment can cause the computer to get it wrong. Shipping devices to polling stations is of course exactly when this can occur.

Small misalignments can be very confusing to human operators - where they consistently re-try to get the computer to accept their choice - not realizing that they need to touch a slightly different area of the screen instead.

Pennsylvania has opted to de-certifed their Unilect Patriot voting machines for exactly this reason - lack of consistency and reliable operation. Instead the counties effected will rely on their paper-based ballot scanning systems.

http://pittsburghlive.com/x/tribune-review/trib/regional/s_327234.html

and

http://www.post-gazette.com/pg/05113/493123.stm

and

http://portland.indymedia.org/en/2005/04/316574.shtml

Once again we are seeing that the rush to adopt DREs as the solution to meet HAVA requirements is being blunted by practical considerations and a realization that the technology is not yet ready nor mature enough to meet the rigours of real-world operaton beyond the lab'.

Thursday, June 16, 2005

 

What price electronic voting? (Miami-Dade County makes a choice)

Miami-Dade County has decided to purchase optical scanners and use paper ballots and discard its DRE voting machines. Here's the link to a copy of the formal report:
http://reformcoalition.org/Ressources/Initial%20Report%20from%20Supervisor%20of%20Elections.pdf

and then discussion of the background prior to the decision can be found at these various links:
http://www.computerworld.com/governmenttopics/government/story/0,10801,101146,00.html
http://www.palmbeachpost.com/state/content/state/epaper/2005/06/06/m1a_voting_0606.html
http://www.miami.com/mld/miamiherald/news/local/11759284.htm

other States are also watching this decision too:
http://wvgazette.com/webtools/email/Editorials/Viewpoint/2005060139

Maryland currently has its DRE machines - and the cost of these per vote cast in 2004 was around $50 - ($80M in total). And this is not including ongoing support and upgrade costs nor backend County level costs. Clearly there are many more urgent uses for such funds than counting votes at $50+ each.

Given the trust weaknesses with DREs machines that NIST have documented as part of their HAVA work and their VVSG2 draft (see p96 here: http://vote.nist.gov/VVSG2%20final.doc) - it can be viewed as premature for anyone to make a longterm commitment to this technology prior to formal concrete specifications and certification being available that the EAC is now working on. Dade county is being very smart with their decision.

Just like other public works engineering projects that the United States has developed - this is something that the private sector has tried - but now needs to be underpinned by a collective solution now that a deeper understanding of the needs has emerged. There are many precedences in history to guide us here.

Indeed in the TLV approach we have anticipated this development (see the primer link to left) - where a publicly developed set of programs that conforms to the EAC requirements and uses internationally defined technology specifications and is certified and maintained as publically open source is built and made available to solution integrators. Those solution integrators can then work for a State to provide a low-cost implementation using off-the-shelf computers and scanners.

This is akin to the government building and servicing the roads, and then letting people buy and run the cars they need over them. It is undoubtably the software and computer solution model that just makes sense in todays marketplace.

Miami-Dade have made the right solution - saved their citizens a large amount of money, and positioned themselves for the future. The scanners are an integral part of upgrading to an advanced trusted voting solution in the future once the infrastructure for that is publically available.

To set the scene here - the Open Voting Consortium (OVC) is already developing the first phase of that open source solution base and during the remainder of 2005 and into 2006 that will mature and grow to encompass the requirements that EAC produce during their review process in the coming months.

Monday, June 13, 2005

 

Trouble brewing for HAVA implementors?

Can the TLV approach and an open source implementation provide the alternative needed here to reach broad and wide scale deployments in time for November 2006?

What are the issues currently effecting the voting systems implemented today?

The following article gives an excellent overview of the issues and the challenges that the election boards here in the USA face today.

http://www.countynews.org/CountyNewsTemplate.cfm?template=/ContentManagement/ContentDisplay.cfm&ContentID=16671

Meanwhile - more people - such as the analysts at the respected Input.com of Reston - are highlighting the uptake of open source by Federal and state government:

http://www.informationweek.com/story/showArticle.jhtml?articleID=164302017

An informal online poll by readers shows 56% are already using open source components in their production solutions.

At some point here - someone should be putting 1+1+1+1 together and making 4 -
peer reviewed process model + open source delivery + rapid deployment by solution providers + lower costs and realizing that the States have a significant opportunity that they are currently overlooking.

 

The NIST VVSG2 report to EAC and TLV advantages

NIST has sent their voting guidelines, version 2 (VVSG2), to the EAC for review.

http://vote.nist.gov/VVSG2%20final.doc

Page 98 in this report is in effect a glowing endorsement for the TLV approach - and points up the deficiencies in the current simple DRE's approach. They term independent verification systems as the "top level" of electronic voting systems - and describe the process they use as "a split process system". This definately applies to the Trusted Logic Voting processing using OASIS EML 4.0 formats.

Excellent to see that NIST appreciate the value and need for these mechanisms and detail the handling that they entail.

State election boards should now be able to determine why these are critical for meeting the needs of VVPAT systems, not just simply printing out paper records as some VVPAT designs assume as a minimum.

Clearly voters can now point to these assessments and be able to differentiate the product offerings that deliver poor or insufficient auditing and verification capabilities.

The only problem now is that there is no clear cut recommendations here, and that while the NIST report documents the differencies in the capabilities there is no reflection of that in the recommendations and needs associated with this. As previously noted - vendor interference in the process has limited the real potential benefits. Having to dig to page 98 of a report to find clear indications and understanding of the different implementation capabilities is less than helpful.

Here's the text from the VVSG2 page 98:

Independent Verification is the top-level categorization for electronic voting systems that produce multiple records of ballot choices whose contents are capable of being audited to high levels of precision. For this to happen, the records must be produced, verified by the voter, and subsequently handled according to the following protocol:

(a) At least two records of the voter's choices are produced and one of the records is then stored such that it cannot be modified by the voting system, e.g. the voting system creates a record of the voter’s choices and then copies it to some write-once media.

(b) The voter must verify that both records are correct, e.g., verify his or her choices on the voting system’s display and also verify the second record of choices stored on the write-once media.

(c) The verification processes for the two verifications must be independent of each other and (a) at least one of the records must be verified directly by the voter, or (b) it is acceptable for the voter to indirectly verify both records if they are stored on different systems produced by different vendors.

(d) The content of the two records can be checked later for consistency through the use of identifiers that allow the records to be linked.

Saturday, June 11, 2005

 

Serious issues with NIST / HAVA TGDC process and outcomes

The following statement has been submitted to NIST regarding proceedings at the April 20th and April 21st meetings.

http://vote.nist.gov/ecposstatements/Milunichcomment.doc

These occurances have indeed tainted the whole TGDC process and permeated not just these specific resolutions, but also the work and reports of the NIST researchers as well. Essentially the argument made by vendor representatives was that changes could not be made to fielded systems in time for 2006 election deadlines. Clearly this is tenous at best - and definately designed to prevent decisions that were adverse to vendors interests. These even extended to vendors representatives cellphoning their technical team leads from the back of the room to get instant verification, and then relaying these words to TGDC executive members.

Now these results are being presented to the EAC and that process too must now also be brought into question as an open representation of best practices. Rather it seems more akin to recommending restrictive practices intended to consolidate the position of existing vendors.
http://vote.nist.gov/Hratch%20EAC%20Briefing%20Boston1.pdf

Wednesday, June 08, 2005

 

New Report from the Election Center - Flawed Conclusions?

An initial examination of the report issued Tuesday shows that once again the vendors are potentially looking to advance their agenda for DRE-based solutions. While at the same time throwing up obstacles to other approaches (principally paper ballots with optical scan) with subtle interpretations around core issues in VVPAT and HAVA legislation pronouncements (or lack thereof). This does however focus in on much that has yet to be truly clearly defined.

The article here :
http://www.katu.com/stories/77600.html
gives an excerpt of the ideas around using "Motor Vehicle Admin'" style centers - for voting, instead of today's local small centers (school facility based). And then postal ballots for people who cannot reach those large centers.

While on the surface this seems appealing - there are a number of significant issues with this.

This probably heightens the need for verifiable paper ballots - because a lengthened period of time dramatically increases the opportunity to commit fraud, both from external threats and internal threats.

The key is access to the voting process. Once someone gains access - they are trusted and allowed to place a vote. Extending that windows offers scope for many more access based frauds (and if that worked on Monday, it can work Tuesday and so on). But also the potential for program based manipulations of voting records spread out over many days adds to the complexity of the task of reconciling votes and detecting those manipulations - especially in close elections.

The basic TLV process would need to be extended to include continuous daily reconcilation of voting records at an election center in order to provide safeguards for this.

Certainly the cost issues appear to make good sense - but securing postal ballots and the trusted process makes this MVA-style approach problematic - and definately not something a simple standalone DRE-only based approach is going to come close to safe guarding. And while the report mentions electronic electoral roll and voter registration, it fails to mention the need to separate such systems operationally completely from the DRE voting systems. One can imagine in a voting center this may not be the case, and thus opens up a Pandora's Box of issues in recording votes. Centralized voter record databases incur their own overheads and costs too. Just simply keeping up with peoples' change of address, and so on.

For examples issues with postal balloting - see the UK Government Commission report:
http://www.electoralcommission.co.uk/

Missing from the cost estimates is the protections and safeguards and staff time needed to ensure software and process is secure within a voting center itself.

On the other hand if the idea was to provide open source, collaboratively developed voting solutions that conform to international voting standards in these voting centers then that of course would be a different matter. Even these would need to be re-tested daily to ensure no tampering had occurred during the voting process. But using such open source based solutions would potentially net significant cost reductions.

Clearly the vendors sponsoring the Election Center work are not envisioning such an outcome!

It's a pretty large download file report - but an abridged copy of the text without the heading graphics is available here - for pages 6 to 66:
http://drrw.net/misc/Election-Center-Report-abridged.pdf

Overall this report appears to be generating as many issues as it seeks to solve. Some ideas may be of merit, but the full implications of these are yet to be fully examined.

Friday, June 03, 2005

 

The Merits of Optical Scan?

This is a very nicely done piece from someone who actually runs elections in Chicago, IL.

http://www.voterinfonet.com/sub/news_view.asp?NEWS_ID=125

However - its still not goof proof - this scanning system can still be interfered with and produce a phoney result (by tampering with the tallying count software) - but assuming the right safeguards in place - it would be possible to detect that post-election by hand counting enough of the scan cards.

So - overall - it offers better audit trail than a DRE, but still not TLV levels of trust - but I'd say better trust than the DRE approach alone.

Blind voters and disabled voters would still not like this as much - but given that this could provide a more reliable approach than DRE at a fraction of the cost - I'd say - better option - until a certified TLV-based system is available.

I think though in a really close election in a critical State - there would be challenges - and it would take time to sort that all out. That's one of the supposed benefits of using DRE's in the first place - but sadly the reverse has been the case.

The districting issues in Chicago certainly are a real challenge - to match the right voter to the right ballot, along with the huge number of items placed on referendum and marked for voters to decide. Including a computer in the process to print out the scan ballot could definately improve that matching process, along with making it easier for voters to know what they voted for. And would solve the blind / disabled voter part, and of course make multi-lingual balloting easier.

It is impressive that voters are able to cope with the complexity of this Chicago voting system today using a bubble style multi-choice optical scan form.

Then again - a State could happily adopt optical scanning right now - knowing that they could upgrade to a full TLV system later, once that had been fully developed and certified, and the scanner devices would be 100% re-usable as part of that.

The rush to DRE certainly is not justified by the current raft of issues with DREs from trust to reliability to high costs.

In Maryland alone the State is spending over $80M to date on DRE devices - with 3M registered voters, of whom about 1.5M vote regularly that is around $53 per vote for equipment - just to fill out a government form one day every two or three years!

If this was being spent for vehicle registration or similar, there would be an outcry about the wanton waste of public funds. Clearly the vendors getting this largess from the public purse have some friends in high places making it happen.

This page is powered by Blogger. Isn't yours?

- visitors: