Trusted Logic Voting (TLV)

EML white paper on importance of standards and interoperability in voting systems

2007-02-02T12:11:00.000-05:00

The OASIS Elections services committee have produced a white paper that discusses the importance of the use of standards for election systems.

NYTimes: Existing voting systems marketplace practices continue to unravel

2007-01-04T11:02:00.000-05:00

The NYTimes revealed in its article that Ciber - one of the two certified testing organizations - had actually been de-certified in the summer of 2006. This conflicts with Ciber's actions in that they had continued with New York state and other testing assignments without publically revealing this.

Furthermore the NYTimes article shows voting machines in use where voter privacy is clearly able to be compromised - a key legal requirement for NY elections.

All this raises serious questions about the level of testing performed and the nature of the testing required by the US EAC and how those tests are included into the procedures recommended.

Once again underscoring the need for open public solutions that can be scrutinized other than in closed private processes.

Independent Verification: Essential Action to Assure Integrity in the Voting Process

2006-08-28T09:55:00.000-04:00

The latest paper from Roy G. Saltman and funded by a grant from NIST provides an excellent round-up of election process and technology in America.

Roy confirms what the voting advocacy community already knew - but does so in an authoritative and clearly reasoned way.

Also - he details some of the in-place balances and checks - that often sound so reasonable and sound - for example Maryland has a way to check that the certified software is installed on their voting systems that is crossed checked by NIST. Unfortunately this check woefully fails to verify if that explicit version of the software is actually running on voting machines during the ballot casting itself! Subtle details - but of course vital to integrity of elections.

Anyway - there is much instructive information in this latest paper - and certainly an excellent introduction for those seeking an overview also of digital voting and the election process in America.

You can also compare this latest paper with the one originally published back in October 1988 for the ACM.

Presentation on e-Voting Trust Mechanisms WOTE - Cambridge University 2006

2006-06-30T10:11:00.000-04:00

Presentation by John Borras, Chair of the OASIS Election Markup Language (EML) TC, with contributions from David Webber, to the Cambridge University sponsored Workshop On Trustworthy Elections (WOTE) and e-Voting techniques

The presentation discusses the work on OASIS EML and then looks at the key factors needed to use with EML XML components to deliver particularly trusted counting mechanisms.

In addition there are two papers submitted to WOTE -

1) Trusted voting mechanisms - here

2) Framework for accreditation of voting systems - here

Abstract from "Trusted Voting Mechanisms" -

Voting is one of the most critical features in our democratic process. In addition to providing for the orderly transfer of power, it also cements the citizen’s trust and confidence in an organization or government when it operates efficiently. Society is becoming more and more web oriented and citizens, used to the high degree of flexibility in the services provided by the private sector and in the Internet in particular, are now beginning to set demanding standards for the delivery of services by governments using modern electronic delivery methods.

The implementation of electronic voting would allow increased access to the voting process for millions of potential voters. Higher levels of voter participation will lend greater legitimacy to the electoral process and should help to reverse the trend towards voter apathy that is fast becoming a feature of many democracies. It is also recognized that more traditional voting methods will exist for some time to come, so a means is needed to make these more efficient and integrate them with the newer electronic methods.

In the election industry today, there are a number of different services vendors around the world, all integrating different levels of automation, operating on different platforms and employing different architectures. With the global focus on e-voting systems and initiatives, the need for a consistent, open, auditable, automated election system has never been greater.
This paper focuses on reviewing the aspects of the OASIS EML standard and shows how it can provide the facilitation for trusted electronic voting systems. Included is an assessment of the minimum functional mechanisms that ensure audit trail and crosschecking that allow verification of voting to be implemented.

USAToday - Analysis finds e-voting machines vulnerable

2006-06-29T13:22:00.000-04:00

The USA Today article notes —> Most of the electronic voting machines widely adopted since the disputed 2000 presidential election "pose a real danger to the integrity of national, state and local elections," a report out Tuesday concludes.

There are more than 120 security threats to the three most commonly purchased electronic voting systems, the study by the Brennan Center for Justice says. For what it calls the most comprehensive review of its kind, the New York City-based non-partisan think tank convened a task force of election officials, computer scientists and security experts to study e-voting vulnerabilities.

The study, which took more than a year to complete, examined optical scanners and touch-screen machines with and without paper trails. Together, the three systems account for 80% of the voting machines that will be used in this November's election.
<-- And then Rep. Rush Holt, D-N.J., a chief sponsor of a bill to improve electronic-voting security is quoted as saying - "A voting system that is not auditable contains the seeds of destruction for a democracy". For more information see the article online.

Click on the following links to review the Brennan Center Press Release and the Report Summary - "THE MACHINERY OF DEMOCRACY: PROTECTING ELECTIONS IN AN ELECTRONIC WORLD "

Trust - what is it anyway - and why should voters care?

2006-06-28T18:22:00.000-04:00

While the US Government has been tasked through HAVA to spend $B+s of dollars helping states acquiring voting systems to "focus on assuring Americans that their vote was being recorded" there has been too little focus on the key issue of "how do you trust and know that your voting is being counted?" Clearly with the paper-based mechanical voting systems this had become an issue - but are we any further forward today? What exactly is trust in the context of casting an election ballot?

What we do know is that since democracy was invented - people have sought to influence the result of a vote. Some of this is judged fair and some of this as cheating - example : I can say that bad things will happen if you vote for 'X'; but I cannot say I will do bad things to you if you vote for 'X'!

Giving people confidence that their vote was accurately recorded and counted is but one piece of the overall picture. Allied to that is that other people were not able to somehow make votes and change the count so as to negate the legitimate ballots cast!

Most importantly people should be able to transparently understand how the computer is handling their vote and have the means to independently verify that and hence be confident in and embrace the process. Unfortunately today that does not appear to be the case - and the report produced by Forbes on the flaws in current e-Voting systems highlights that.

The report notes "The most widely used electronic-voting systems all have flaws that can be addressed relatively easily, but few states and counties have actually implemented recommended security measures, researchers concluded Tuesday". The report, based on interviews with elections officials and analyses of voting systems, came from the Task Force on Voting System Security convened by New York University's Brennan Center for Justice.

So there are legitimate ways of influencing elections that we all are familiar with - and then there are ways that clearly seek to undermine a fair and open process.

Our goal with developing trusted balloting mechanisms is to reduce the risk that people will use the computer technology introduced into the process to cheat in new and interesting ways that were previously not available.

Also - computer technology should remove old ways of cheating - such as ballot stuffing - and therefore minimize the risks that were previously there.

Other challenges that the report notes are addressed in the trusted logic approach - notably - "Researchers acknowledged that audits won't uncover attacks that change both the electronic and paper records, something possible because many voters don't bother to check the paper trail before leaving the voting booth" - because in the TLV approach the voter has to physically use the paper record to make the ballot themselves - in contrast to the computer printing out its own paper record behind a screen away from the voter.

Larry Norden, the task force's chairman noted - "We're not talking about dramatic restructuring of the architecture," but "We're talking about straightforward things, most of which could be in place for the 2006 elections."

While Larry is undoubtedly correct - we have seen that the vendors of the voting systems have been extremely reluctant to do so - and demanded excessive fees and re-tooling costs in order to provide these changes - as is happening right now in Maryland for example.

Until these fundamental issues have been addressed and voting systems that truely provide trusted mechanisms from the core of their operational approach - then we will continue to fail to deliver on this fundamental foundation for the future of democracy.

Voters do care - and instinctively can understand this when presented this in a clear fashion. The problem is today that very few understand their own crucial role in ensuring that computer systems really are counting their vote correctly because they are being deliberately excluded from the fundamentals of the voting process itself and relegated to a spectator role.

Why do we need 100% auditablility support for voting counts?

2006-02-16T16:38:00.000-05:00

Why should Americans care about possible 2004 vote miscounts? The 2004 election is over. It’s old news. The only reason for rehashing prior elections is to ensure that our votes are counted the way voters intend in the future. Should Americans trust that our votes are counted accurately; or is wholesale electronic election tampering occurring? How could the evidence of vote tampering be hidden? Are the future of
democracy and U.S. elections at stake? The U.S. press has dismissed exit polls as surprisingly inaccurate in the 2004 presidential election when exit polls conflicted with official vote counts. Were exit polls wrong or were vote counts altered?

On February 14, 2006, the National Election Data Archive, a group of volunteer mathematicians and statisticians, released a report asking that new measures be taken immediately in order to assure the integrity of future U.S. election results. Their new report discusses why current measures to ensure vote count accuracy, such as testing and certification, are inadequate; discusses how evidence of vote miscounts are hidden by current election reporting procedures; and recommends independent vote count audits, public detailed election data monitoring, and public exit poll data.

Two documents provide deep insights into the lessons learned from Ohio, 2004.
http://www.prweb.com/releases/2006/2/prweb346936.htm

http://electionarchive.org/ucvAnalysis/US/exit-polls/Ohio2004-US-future.pdf

OASIS approves EML 4.0 as standard

2006-02-14T16:46:00.000-05:00

OASIS, the international standards consortium, today announced that its members have approved the Election Markup Language (EML) version 4.0 as an OASIS Standard, a status that signifies the highest level of ratification. Developed through an open process by the OASIS Election and Voter Services Technical Committee, EML enables the secure interchange of information between electronic voting systems, software, and services.

This marks a significant step forward in the development of open standards for voting systems.

It's still too easy to steal elections by vote rigging in the US

2006-01-05T08:11:00.000-05:00

A new article sets the current scene for e-Voting in the US. And in case people need reminding - literally billions of $ dollars are at stake, particularly in Presidential elections - where the winners take all and are able to direct Federal programs, subsidies, research, development programs and more.

The size of the US Government is now double what is was a decade ago.

Clearly these are non-trivial issues and a major set of challenges for the worlds richest democracy.

More details from the article show the level of the challenges faced.

Clearly there is not just one quick fix technology solution here. And the fact that 50 States and thousands of election counties and districts are involved unscores the size of the logistical challenge here.

What had been tacit in a paper based manual system for over hundred years is now being laid bare and tough procedural questions and answers sought.

UMD - Testimony to Maryland State House Ways and Means committee

2005-11-19T12:45:00.000-05:00

Quick link here to the PDF positioning the work that Don Norris's team is doing at the University of Maryland and the focus and scope of their study on electronic voting systems being considered by Maryland.

The GAO produces 107 page report on security of voting systems

2005-10-23T20:04:00.000-04:00

The GAO has released a 107 page on the security of voting systems today.

What the GAO found -

"While electronic voting systems hold promise for improving the election
process, numerous entities have raised concerns about their security and
reliability, citing instances of weak security controls, system design flaws,
inadequate system version control, inadequate security testing, incorrect
system configuration, poor security management, and vague or incomplete
voting system standards."

Examples of Voting System Vulnerabilities and Problems:

• Cast ballots, ballot definition files, and audit logs could be modified.
• Supervisor functions were protected with weak or easily guessed passwords.
• Systems had easily picked locks and power switches that were exposed and unprotected.
• Local jurisdictions misconfigured their electronic voting systems, leading to election day problems.
• Voting systems experienced operational failures during elections.
• Vendors installed uncertified electronic voting systems.

The full 107 report is here.

Comments to the EAC on the VVSG

2005-10-01T15:32:00.000-04:00

Comprehensive comments submitted to EAC on their VVSG outlining required improvements and changes in approach.

Panel on Open Voting radio broadcast

2005-09-18T21:04:00.000-04:00

Several luminaries participated in a one hour radio broadcast on the Paul Berenson radio program yesterday (17th September, 2005).

This is a direct URL for the audio file:
http://www.paulb.com/voice/show/09-17-05-elect.mp3

The Santa Barbara County Registrar of Voters helped explain Open Voting to listeners. Other highlights include the host asking Mr. Holland to explain about how open source software could be used in elections.

Debra Bowen, California State Senator and 2006 candidate for Secretary of State, did a great job answering all the questions and, again, voiced support for “open source” and “publicly owned” software for elections.

Mimi Kennedy, provided much light and clarity. Jim March was his usual entertaining and informative self. Also mentioned was the importance of the report that the California Secretary of State will produce on the feasibility of using open source software.

Voter Registration Systems and Voting - ensuring separation

2005-08-10T22:35:00.000-04:00

Some vendors appear to be taking steps to integrate their voting solutions with voter registration systems. This was almost an inevitable development after the Carter/Baker Commission focused attention on the flaws in voter registration process today. So of course everyone is stepping forward now with their "but we can fix that!" offerings, including the use of server systems connected to the polling stations.

Whatever the intentions and motivations to this there are some fundamental principles being broken here that need to be clarified and protected by at minimum the EAC VVSG requirements and architecture, and probably beyond that to legal clarifications in voting law.

These can be summarized as:

There has to be a complete physical separation between the voter registration system and the voting system. No direct realtime electronic connection can be permitted, nor can the voting system know in anyway who voters are, nor store lists of voters.

The only connection between the two systems is the voter themselves and the physical act of voting. That is a fundamental principle here that needs to be a requirement of voting system architectures.

So when a voter is acknowledged in the registration system and is provided access to the voting system, they carry a physical access token of some kind that denotes their entitlement to vote. Their voting event then corresponds to the event in the registration system.

Because voting is private this process has to be anonymous and a voting system can have no knowledge of voters demographic information of any kind, even and especially including total numbers of voters registered or other metrics.

Use of cast paper ballot audit trail to verify the total number of electronic votes counted is still essential. Even more so, in a centralized server based tabulation system.

Centralized server systems introduced into the voting process, while it potentially solves some issues, introduces many more concerns around vote tabulation and declaration of result totals.

101 Ways to Cheat an Election

2005-08-10T16:11:00.000-04:00

Many people may question why the old paper based voting systems cannot continue to work. The catalogue here of fair and foul events show that, as with some many others in life, the internet, communications and computers are changing the landscape and effecting outcomes in ways that paper voting systems were never meant to prevent.

And even more today than ever before the stakes are so enormous the temptation to manipulate, even a little, is too large. So we need to build new mechanisms that can provide robusted and trusted election processes. Now read on!

http://prorev.com/votecount2.htm

Diebold voting systems fail California certification testing

2005-07-31T14:37:00.000-04:00

After possibly the most extensive testing ever on a voting system, California has rejected Diebold's flagship electronic voting machine because of printer jams and screen freezes, sending local elections officials scrambling for other means of voting.

"There was a failure rate of about 10 percent, and that's not good enough for the voters of California and not good enough for me," Secretary of State Bruce McPherson said.

http://www.insidebayarea.com/localnews/ci_2898234

Mr. McPherson is to be applauded for his stance here and insistence on reliable and fullscale testing. This also shows that the vendors own industry certification testing is fundamentally weak and questionable.

And it further highlights the need to use reliable off-the-shelf equipment that can be readily replenished, and not expensive proprietary kit that has to be warehoused for years and subsequently develops unacceptably high failure rates.

Voting needs: open source, or public open source projects?

2005-07-16T11:48:00.000-04:00

An interview with Avi Rubin and David Dill available on SourceForge news:
http://software.newsforge.com/article.pl?sid=05/07/06/182210
explores the key needs in developing trusted software for voting.

There is still a huge difference between a vendor publishing open source, which by most informed analysis is almost worthless since it can still be mostly opaque, and public open source projects, which are the real deal.

There are two public open source projects working at the moment developing core components for use by voting system solutions - one is the OVC (Open Voting Consortium), and the other is OASIS EML - http://emlvoting.org that basically are following the same principles of creating baseline benchmarks as reference implementations.

Once we have these foundation peices available that vendors can then implement solutions around - then we will have crossed another very significant bridge to transparent election solutions that are trustworthy.

See the slides in the TLV primer link for more in depth analysis of what such public open source delivers and why.

Until then calls for open source for vendor solutions are nobly intended, but unlikely to achieve very much in terms of better transparency in voting software.

New Jersey enacts requirement for VVPAT

2005-07-16T11:42:00.000-04:00

In the shadow of a lawsuit demanding that New Jersey update state laws to reflect its increasing use of electronic voting machines, New Jersey's acting governor recently signed into law legislation that will require all voting machines to produce a voter-verified paper record by 2008.

http://i-newswire.com/pr36358.html

Next up - figuring out what base functional operational characteristics are really enbodied in the notion of VVPAT, and which are explicitly excluded?!?

DNC Voting Systems Analysis Report

2005-07-15T18:47:00.000-04:00

Following on from an extensive five-month investigation by the VRI's (Voting Research Institute) research and investigative team grave problems in the administration of Ohio's voting system during the November 2004 election have been identified. More than 1 in 4 voters in Ohio faced problems at the polls, including illegal requests for identification, long lines, poorly trained election officials, and more. There were also dramatic disparities in voting conditions among different races; African Americans waited nearly three times as long on average as whites to vote.

The report is also very critical of DRE voting systems (section VII) while offering viable alternatives and making good suggestions for more openness in the the voting process, including internet posting of election tallying (section VIII).

The idea of using blogs to track and report precinct voting is attractive. Posts can be made secure, and javascripting can automatically locate totals and produce results. The whole then becones distributed via RSS automatically.

For the full report see: http://www.democrats.org/a/2005/06/democracy_at_ri.php

Unilect DREs get failing vote from Carteret County, N. Carolina

2005-07-15T12:04:00.000-04:00

"It's the election board's opinion that the citizens have suffered a grievous wrong as a result of the use of this (UniLect Patriot) equipment," Board of Elections Chairman Ed Pond states in the letter, July 12th, to the State Board of Elections.

The UniLect system has been in question in Carteret County since the November 2004 election, when 4,438 votes were permanently lost because of a mishap over the storage capacity of a control unit used during the early voting period.

"We don't want the citizens of Carteret County to face another election with the uncertainty of their vote not being counted," Pond said.

Carteret County is asking for help in additional funding to remedy the situation by renting voting equipment. Under consideration are paper ballots with optical scanning equipment, and alternate DRE rental.

See: http://www.jdnews.com/SiteProcessor.cfm?Template=/GlobalTemplates/Details.cfm&StoryID=33486&Section=News

for more details.

US EAC ask for comments on their VVSG1

2005-07-01T16:09:00.000-04:00

The Voluntary Voting System Guidelines were developed under the Help America Vote Act of 2002 (HAVA) Section 202 mandate that the U.S. Election Assistance Commission (EAC) update the 2002 Voting System Standards to address increasingly complex voting system technology. They were designed for state and local election officials to help ensure that new voting systems function accurately and reliably.

More details can be found at:
http://www.glynn.com/eac_vvsg/intro.asp

There is a 90 day review period.

New TLV presentation addresses secure computing needs

2005-07-01T12:41:00.000-04:00

So far the TLV has focused on the software process particularly. Thanks to the work being done by the Open Voting Consortium on countermeasures for protecting against software based attack methods directly, the TLV work now recognizes the need for a secure computing system.

Essentially the TLV has worked at providing protection through verification and auditing. Now by including secure computing this allows proactive defenses during the voting process itself that can potential identify attacks as they occur. In addition by using open scripts, the opportunity for attacks is reduced by minimizing the window of opportunity for attackers.

Using a master control agent allows execution thread control and tracing of the execution path during the voting process. This is very similar to anti-virus technology where monitoring prevents rogue process takeover, and monitors the execution signature of processes to detect changes.

The new TLV primer presentation contains details and updates to reflect this enhanced set of protections.

http://drrw.net/backup/Trusted-Logic-Voting-Systems-with-EML40.pdf

Testimony from Carter / Baker Commission Hearings

2005-07-01T12:37:00.000-04:00

The webcast from Rice University yesterday was excellent and most informative.

The individual testimony can be found here: http://www.american.edu/ia/cfer/hearings.htm

The emphasis on getting voters better information on polling places, and better registration processing is instructive. Far more votes were lost to this cause than any other in the 2000 and 2004 elections.

Creating a mature voter registration system remains a challenge in today's highly mobile world. Possiblity of using OASIS ebXML Registry technology, along with OASIS EML voter registration records is of interest.

Legislating better e-Voting

2005-06-27T23:01:00.000-04:00

Politicians are hoping to be able to claim the fame for improving today's inadequate voting systems.

http://www.computerworld.com/governmenttopics/government/policy/story/0,10801,102667,00.html
Unfortunately they do not have the best technical understanding of the real process issues that underpin digital-based voting.

Being able to implement a trusted voting process requires more than just a verified paper ballot audit. If the DRE is manipulating and controlling the whole process it can cheat extensively and taint the paper record at the same time. An example would be not showing all the proper candidates and options to all voters equally, and thus they would believe their paper ballot was correct, when it is in fact compromised.

Similarly, just because the process includes paper artifacts, does not exclude blind or partially sighted voters. Exactly the opposite can be the case, where audio prompting can direct the voting, and then bar-code style printing on the ballot can be touched and sensed and validated.

The Clinton/Boxer legislation is again well-intentioned, but places undue faith in paper trails implemented by vendors without the proper oversight and certification methods to ensure correct operational and process factors are included:
http://www.computerworld.com/governmenttopics/government/legislation/story/0,10801,100073,00.html?from=story_picks

Overall however, the addition of paper ballot records to voting system will improve them, but not as much as advocates hope for.

To achieve a more comprehensive result requires implementation of a robust process model along with a broad range of safeguards and checks built around the voting process itself, such as the TLV approach provides for.

Touch screen devices Achilles Heel of DREs?

2005-06-19T15:24:00.000-04:00

One consistent thread in the testing and certification of touch screen devices is their calibration and alignment.

Where the operator sees their finger touched the screen and the underlaying text should be the same as where the computer thinks they have also touched. The two should be corresponding.

Unfortunately this is a mechanical and electrical alignment. The computer has no way of knowing if its calibration is skewed. Any kind of physical shock damage or electrical field misalignment can cause the computer to get it wrong. Shipping devices to polling stations is of course exactly when this can occur.

Small misalignments can be very confusing to human operators - where they consistently re-try to get the computer to accept their choice - not realizing that they need to touch a slightly different area of the screen instead.

Pennsylvania has opted to de-certifed their Unilect Patriot voting machines for exactly this reason - lack of consistency and reliable operation. Instead the counties effected will rely on their paper-based ballot scanning systems.

http://pittsburghlive.com/x/tribune-review/trib/regional/s_327234.html

and

http://www.post-gazette.com/pg/05113/493123.stm

and

http://portland.indymedia.org/en/2005/04/316574.shtml

Once again we are seeing that the rush to adopt DREs as the solution to meet HAVA requirements is being blunted by practical considerations and a realization that the technology is not yet ready nor mature enough to meet the rigours of real-world operaton beyond the lab'.

What price electronic voting? (Miami-Dade County makes a choice)

2005-06-16T12:27:00.000-04:00

Miami-Dade County has decided to purchase optical scanners and use paper ballots and discard its DRE voting machines. Here's the link to a copy of the formal report:
http://reformcoalition.org/Ressources/Initial%20Report%20from%20Supervisor%20of%20Elections.pdf

and then discussion of the background prior to the decision can be found at these various links:
http://www.computerworld.com/governmenttopics/government/story/0,10801,101146,00.html
http://www.palmbeachpost.com/state/content/state/epaper/2005/06/06/m1a_voting_0606.html
http://www.miami.com/mld/miamiherald/news/local/11759284.htm

other States are also watching this decision too:
http://wvgazette.com/webtools/email/Editorials/Viewpoint/2005060139

Maryland currently has its DRE machines - and the cost of these per vote cast in 2004 was around $50 - ($80M in total). And this is not including ongoing support and upgrade costs nor backend County level costs. Clearly there are many more urgent uses for such funds than counting votes at $50+ each.

Given the trust weaknesses with DREs machines that NIST have documented as part of their HAVA work and their VVSG2 draft (see p96 here: http://vote.nist.gov/VVSG2%20final.doc) - it can be viewed as premature for anyone to make a longterm commitment to this technology prior to formal concrete specifications and certification being available that the EAC is now working on. Dade county is being very smart with their decision.

Just like other public works engineering projects that the United States has developed - this is something that the private sector has tried - but now needs to be underpinned by a collective solution now that a deeper understanding of the needs has emerged. There are many precedences in history to guide us here.

Indeed in the TLV approach we have anticipated this development (see the primer link to left) - where a publicly developed set of programs that conforms to the EAC requirements and uses internationally defined technology specifications and is certified and maintained as publically open source is built and made available to solution integrators. Those solution integrators can then work for a State to provide a low-cost implementation using off-the-shelf computers and scanners.

This is akin to the government building and servicing the roads, and then letting people buy and run the cars they need over them. It is undoubtably the software and computer solution model that just makes sense in todays marketplace.

Miami-Dade have made the right solution - saved their citizens a large amount of money, and positioned themselves for the future. The scanners are an integral part of upgrading to an advanced trusted voting solution in the future once the infrastructure for that is publically available.

To set the scene here - the Open Voting Consortium (OVC) is already developing the first phase of that open source solution base and during the remainder of 2005 and into 2006 that will mature and grow to encompass the requirements that EAC produce during their review process in the coming months.

Trouble brewing for HAVA implementors?

2005-06-13T23:41:00.000-04:00

Can the TLV approach and an open source implementation provide the alternative needed here to reach broad and wide scale deployments in time for November 2006?

What are the issues currently effecting the voting systems implemented today?

The following article gives an excellent overview of the issues and the challenges that the election boards here in the USA face today.

http://www.countynews.org/CountyNewsTemplate.cfm?template=/ContentManagement/ContentDisplay.cfm&ContentID=16671

Meanwhile - more people - such as the analysts at the respected Input.com of Reston - are highlighting the uptake of open source by Federal and state government:

http://www.informationweek.com/story/showArticle.jhtml?articleID=164302017

An informal online poll by readers shows 56% are already using open source components in their production solutions.

At some point here - someone should be putting 1+1+1+1 together and making 4 -
peer reviewed process model + open source delivery + rapid deployment by solution providers + lower costs and realizing that the States have a significant opportunity that they are currently overlooking.

The NIST VVSG2 report to EAC and TLV advantages

2005-06-13T22:52:00.000-04:00

NIST has sent their voting guidelines, version 2 (VVSG2), to the EAC for review.

http://vote.nist.gov/VVSG2%20final.doc

Page 98 in this report is in effect a glowing endorsement for the TLV approach - and points up the deficiencies in the current simple DRE's approach. They term independent verification systems as the "top level" of electronic voting systems - and describe the process they use as "a split process system". This definately applies to the Trusted Logic Voting processing using OASIS EML 4.0 formats.

Excellent to see that NIST appreciate the value and need for these mechanisms and detail the handling that they entail.

State election boards should now be able to determine why these are critical for meeting the needs of VVPAT systems, not just simply printing out paper records as some VVPAT designs assume as a minimum.

Clearly voters can now point to these assessments and be able to differentiate the product offerings that deliver poor or insufficient auditing and verification capabilities.

The only problem now is that there is no clear cut recommendations here, and that while the NIST report documents the differencies in the capabilities there is no reflection of that in the recommendations and needs associated with this. As previously noted - vendor interference in the process has limited the real potential benefits. Having to dig to page 98 of a report to find clear indications and understanding of the different implementation capabilities is less than helpful.

Here's the text from the VVSG2 page 98:

Independent Verification is the top-level categorization for electronic voting systems that produce multiple records of ballot choices whose contents are capable of being audited to high levels of precision. For this to happen, the records must be produced, verified by the voter, and subsequently handled according to the following protocol:

(a) At least two records of the voter's choices are produced and one of the records is then stored such that it cannot be modified by the voting system, e.g. the voting system creates a record of the voter’s choices and then copies it to some write-once media.

(b) The voter must verify that both records are correct, e.g., verify his or her choices on the voting system’s display and also verify the second record of choices stored on the write-once media.

(c) The verification processes for the two verifications must be independent of each other and (a) at least one of the records must be verified directly by the voter, or (b) it is acceptable for the voter to indirectly verify both records if they are stored on different systems produced by different vendors.

(d) The content of the two records can be checked later for consistency through the use of identifiers that allow the records to be linked.

Serious issues with NIST / HAVA TGDC process and outcomes

2005-06-11T16:20:00.000-04:00

The following statement has been submitted to NIST regarding proceedings at the April 20th and April 21st meetings.

http://vote.nist.gov/ecposstatements/Milunichcomment.doc

These occurances have indeed tainted the whole TGDC process and permeated not just these specific resolutions, but also the work and reports of the NIST researchers as well. Essentially the argument made by vendor representatives was that changes could not be made to fielded systems in time for 2006 election deadlines. Clearly this is tenous at best - and definately designed to prevent decisions that were adverse to vendors interests. These even extended to vendors representatives cellphoning their technical team leads from the back of the room to get instant verification, and then relaying these words to TGDC executive members.

Now these results are being presented to the EAC and that process too must now also be brought into question as an open representation of best practices. Rather it seems more akin to recommending restrictive practices intended to consolidate the position of existing vendors.
http://vote.nist.gov/Hratch%20EAC%20Briefing%20Boston1.pdf

New Report from the Election Center - Flawed Conclusions?

2005-06-08T23:44:00.000-04:00

An initial examination of the report issued Tuesday shows that once again the vendors are potentially looking to advance their agenda for DRE-based solutions. While at the same time throwing up obstacles to other approaches (principally paper ballots with optical scan) with subtle interpretations around core issues in VVPAT and HAVA legislation pronouncements (or lack thereof). This does however focus in on much that has yet to be truly clearly defined.

The article here :
http://www.katu.com/stories/77600.html
gives an excerpt of the ideas around using "Motor Vehicle Admin'" style centers - for voting, instead of today's local small centers (school facility based). And then postal ballots for people who cannot reach those large centers.

While on the surface this seems appealing - there are a number of significant issues with this.

This probably heightens the need for verifiable paper ballots - because a lengthened period of time dramatically increases the opportunity to commit fraud, both from external threats and internal threats.

The key is access to the voting process. Once someone gains access - they are trusted and allowed to place a vote. Extending that windows offers scope for many more access based frauds (and if that worked on Monday, it can work Tuesday and so on). But also the potential for program based manipulations of voting records spread out over many days adds to the complexity of the task of reconciling votes and detecting those manipulations - especially in close elections.

The basic TLV process would need to be extended to include continuous daily reconcilation of voting records at an election center in order to provide safeguards for this.

Certainly the cost issues appear to make good sense - but securing postal ballots and the trusted process makes this MVA-style approach problematic - and definately not something a simple standalone DRE-only based approach is going to come close to safe guarding. And while the report mentions electronic electoral roll and voter registration, it fails to mention the need to separate such systems operationally completely from the DRE voting systems. One can imagine in a voting center this may not be the case, and thus opens up a Pandora's Box of issues in recording votes. Centralized voter record databases incur their own overheads and costs too. Just simply keeping up with peoples' change of address, and so on.

For examples issues with postal balloting - see the UK Government Commission report:
http://www.electoralcommission.co.uk/

Missing from the cost estimates is the protections and safeguards and staff time needed to ensure software and process is secure within a voting center itself.

On the other hand if the idea was to provide open source, collaboratively developed voting solutions that conform to international voting standards in these voting centers then that of course would be a different matter. Even these would need to be re-tested daily to ensure no tampering had occurred during the voting process. But using such open source based solutions would potentially net significant cost reductions.

Clearly the vendors sponsoring the Election Center work are not envisioning such an outcome!

It's a pretty large download file report - but an abridged copy of the text without the heading graphics is available here - for pages 6 to 66:
http://drrw.net/misc/Election-Center-Report-abridged.pdf

Overall this report appears to be generating as many issues as it seeks to solve. Some ideas may be of merit, but the full implications of these are yet to be fully examined.

The Merits of Optical Scan?

2005-06-03T21:55:00.000-04:00

This is a very nicely done piece from someone who actually runs elections in Chicago, IL.

http://www.voterinfonet.com/sub/news_view.asp?NEWS_ID=125

However - its still not goof proof - this scanning system can still be interfered with and produce a phoney result (by tampering with the tallying count software) - but assuming the right safeguards in place - it would be possible to detect that post-election by hand counting enough of the scan cards.

So - overall - it offers better audit trail than a DRE, but still not TLV levels of trust - but I'd say better trust than the DRE approach alone.

Blind voters and disabled voters would still not like this as much - but given that this could provide a more reliable approach than DRE at a fraction of the cost - I'd say - better option - until a certified TLV-based system is available.

I think though in a really close election in a critical State - there would be challenges - and it would take time to sort that all out. That's one of the supposed benefits of using DRE's in the first place - but sadly the reverse has been the case.

The districting issues in Chicago certainly are a real challenge - to match the right voter to the right ballot, along with the huge number of items placed on referendum and marked for voters to decide. Including a computer in the process to print out the scan ballot could definately improve that matching process, along with making it easier for voters to know what they voted for. And would solve the blind / disabled voter part, and of course make multi-lingual balloting easier.

It is impressive that voters are able to cope with the complexity of this Chicago voting system today using a bubble style multi-choice optical scan form.

Then again - a State could happily adopt optical scanning right now - knowing that they could upgrade to a full TLV system later, once that had been fully developed and certified, and the scanner devices would be 100% re-usable as part of that.

The rush to DRE certainly is not justified by the current raft of issues with DREs from trust to reliability to high costs.

In Maryland alone the State is spending over $80M to date on DRE devices - with 3M registered voters, of whom about 1.5M vote regularly that is around $53 per vote for equipment - just to fill out a government form one day every two or three years!

If this was being spent for vehicle registration or similar, there would be an outcry about the wanton waste of public funds. Clearly the vendors getting this largess from the public purse have some friends in high places making it happen.

Confirming the need for trusted voting information formats (XML)

2005-05-30T16:14:00.000-04:00

Douglas W. Jones asserts - "If the data formats used for election data reporting and election setup are sufficiently transparent and are disclosed to the public, third-party tools can be developed that allow observers to independently verify election results. If we require the publication of all of the relevant election data, including the election configuration files and the raw precinct-level data, then we will extend, to election observers, considerable rights that they have not had since the dawn of computerized vote tabulation."

http://www.cs.uiowa.edu/~jones/voting/nas-cstb2004a.shtml

Of course this is precisely what the OASIS EML 4.0 specifications bring to the table, and one of the reasons why they have been endorsed by the EU Council of Ministers for European election best-practice.

More evidence of the need for 100% audit and TLV

2005-05-30T10:55:00.000-04:00

Here's a short piece of analysis looking at the US election scene and what influence small, difficult to detect % shifting of votes has (vote manipulation where the vote is recorded differently to what was actually cast).

http://www.schneier.com/crypto-gram-0404.html#4

To protect against this you need visibility across the entire election - otherwise such small pertubations can be dismissed as local anomalies - rather than seen as a systematic manipulation and repeating pattern.

Negotiating the vendor minefield - ES&S an example

2005-05-27T10:28:00.000-04:00

State Board of Elections (BOE) officials have enough to worry about with interpreting legislation, understanding technology, and wrestling with budgets. Now they also have to grapple with vendor politics and certification angst.

http://www.dissidentvoice.org/May05/Gideon0525.htm

Yet more evidence of the need to have election systems based on open public specifications and open source foundation components so that decision makers can rest assured that teh technology has been peer reviewed and developed by the community.

Unfortunately the BOE staff have not yet realized that for a fraction of the effort they are spending on traversing the vendor minefield - they could fund an open source initiative that will deliver a better product vastly less costly and based on open standards.

The OVC (Open Voting Consortium) has one such project already in progress and the OASIS EML team is looking to jump start another too.

Comparing VVPAT and VVAATT to trusted voting

2005-05-23T15:28:00.000-04:00

Unfortunately VVPAT by itself does no provide a trusted voting process. True it holds out the promise of providing a more verifiable election than standalone computer voting terminals (DRE) with no paper trail records, however VVPAT is very much in the eye of the implementer.

Naturally existing vendors want to implement VVPAT in ways that stack the deck in their favour and leave their existing processes untouched in place.

What this means is that they are conforming to the letter of VVPAT without conforming to the spirit and intent. Worse - they want to deflect focus on this by promoting alternatives - such as audio verification and audit trails - (VVAATT) - by sponsoring heavily biased and distorted research - and attempting to hold that up as authorative independent work.

To understand this more - see the analysis here:
http://drrw.net/backup/Understanding%20VVPAT%20v%20VVAATT.pdf

DW

e-Voting systems analysis from the ACM

2005-05-21T17:47:00.000-04:00

If you had any doubts that this is a classic case of right question, wrong answer - and the need to continue the battle to get this done right - then read the following!

http://www.acm.org/usacm/weblog/index.php?p=73

and the article from the ACM archives on how just one vote changed per voting machine could change a close election result with almost zero ability to detect the fraud due to the normal levels of statastical varience in election voting casting.

There are also many good articles from the same issue of the ACM Communications October issue. Clearly this reinforces the need to have open source software, developed with government resources if necessary, to ensure that we can always verify the actual foundation software process being used and the mechanisms it is supposed to be utilizing for managing the election.

Voting Machines and Software

2005-05-21T17:08:00.000-04:00

The latest edition of Scientific American has an excellent article.

Also - the resource site here is very instructive: http://www.vote.caltech.edu/

This is roughly in alignment with my own ideas for breaking the empasse that currently exists - and this is just a microcosm of what ails the software industry generally.

I have been trying to get peoples attention to the notion of using open-source voting software as the means to drive transparency in e-Voting processes. My thoughts are that having an open e-Voting software code-based that is community developed and maintained achieves several things.
Produces an open public specification for the software process, the hardware interfaces, and the results auditing and authentication steps that can be independently verified.
prevents reliance on proprietary vendor software - and therefore allows a wide range of hardware vendors to deliver solutions that are capatible - thus removing reliance on single supplier.
Ensures that software being used has underwent an open validation process.
allows verification of the software used to obtain and compile the results using open testing procedures
Allows use of a double-blind check - where output from one set of hardware being used by the voter - is feed into two independant solutions - and then both must tally at close of voting.
Verification that the actual software used is the same as the open standard, (ensure what is loaded onto the machine at open of polling - and verify it is still there during and after).

The Open Voting Consortium, in collaboration with the IEEE-1162 and OASIS EML technical committees is currently implementing such a solution set. Governments decision makers are finally starting to take heed. The realization that such an approach can save the public purse $100M in costs, while providing better trusted solutions is a compelling argument, particularly in the USA where States are faced with budget constraints yet demands on them require that they met new legislative voting standards.

Clearly more debate and research on this is all excellent and signs are that this is occurring. The Carter / Boxer Commission is the next pivot point here around which endorsement of open standards could occur.

DW

NIST presentations to HAVA / TGDC

2005-05-21T15:47:00.000-04:00

The presentations from the March HAVA/TGDC meeting are now online here: http://vote.nist.gov/March9Presentations.html

Of interest is the presentation by John Wack on VVPAT and the useful NIST glossary of voting terminology:

http://www.nist.gov/votingglossary

Enjoy, DW

Trusted Logic Voting and OASIS EML 4.0

2005-05-21T15:45:00.000-04:00

Have finished my first overview analysis of EML 4.0, the EU CoE process requirements and trusted logic.

This all appears to fit together very well. I have produced a draft PPT overview (and PDF) here: http://drrw.net/backup/Trusted-Logic-Voting-Systems-with-EML40.pdf

I've tried to keep this at a reasonable level of understanding - keeping above the XML-level / UML activity diagram view of things for now.

I'm seeing this can provide a formal basis for supporting VVPAT and how vendors should be implementing voting - backed up by rigorous international process requirements - rather than the flimsy ad hoc approach of today.

The EU CoE requirements are particularly comprehensive - as noted before - and the OASIS EML work supports adherence to those.

Being able to inform legislators that there is a clear and minimum set of voting process requirements they should be insisting on I believe will dramatically improve the state of voting systems from today's vendor anarchy.

More importantly - moving to a point where we can have confidence in the reliability of voting systems is essential in order to maintain high levels of democracy worldwide.

There is still much technical work to be done, but the foundations appear to be coming into focus.

Enjoy, DW

More thoughts on why a Trusted Logic Voting Process is vital

2005-05-21T15:44:00.000-04:00

Following the OASIS EML conference call this week I realized that the work I had been doing on a trusted logic process can be integrated with the existing EML 4.0 XML formats, procedures and requirements. This includes work by the EU Council of Ministers on voting best-practicehere:
http://www.coe.int/T/e/integrated%5Fprojects/democracy/02%5FActivities/02%5Fe%2Dvoting/01%5FRecommendation/

I'm now working on producing that harmonized set of materials injunction with the OASIS EML team - to have a "how to" workbook.

In the process of reviewing these materials I also came across this paper from Douglas Jones at Iowa University:
http://www.cs.uiowa.edu/~jones/voting/nas-cstb2004a.shtml

that is very complimentary to the underlying assertions in the overall "Nutshell" slides on trusted logic voting: http://drrw.net/backup/Trusted-Ballot-Processing-Nutshell.pdf

Enjoy, DW

Why is a trusted voting process needed?

2005-05-21T15:42:00.000-04:00

The alternative is to allow vendors to develop sole-source solutions - as is happening today. The robustness of these is then centered around the vendors own rationalization of the various risk areas and the level of effort they feel needed to remediate that. Once this is exposed to external review - you see the type of analysis as occurred here for the Diebold Accuvote system: http://drrw.net/backup/ACCUVOTE-TS_sheet.pdf

The pages toward the end of the document that detail specific attacks are especially telling, as is how quickly these were developed with minimal efforts. The vendor then has to play catch-up to fix these. This is not a method for developing a systematic solution - its band-aiding based on discovery. That is why a trusted process founded on secure principles - such as the MIT "Frog Principle" -is absolutely a pre-requisite.

The trusted process executive overview allows youto see how the types of attack noted above can be easily remediated by having a robust voting process model: http://drrw.net/backup/Trusted-Ballot-Processing-Nutshell.pdf

Enjoy,DW

Why 100% audit count and TLV is essential

2005-05-21T15:38:00.000-04:00

I just saw this body of research analysis on the 2004 Presidential Election.

When you run through all this analysis and numbers it is apparent that while this is impressive mathematical work - the real answer is to provide for 100% secure and reliable totalling and counting.

Since the Trusted Logic Voting process retains three separate counts - it removes the guess work.

With the computer technology we have available today - this should not even be an issue - its straightforward to implement - and TLV is clearly the gold standard that should be required to avoid all future such questions hanging over elections.

DW

Analysis of the 2004 Presidential Election Exit Poll Discrepancies http://electionarchive.org/ucvAnalysis/US/Exit_Polls_2004_Mitofsky-Edison.pdf

Response to the Edison/Mitofsky Election System 2004 Report
http://exit-poll.net/election-night/EvaluationJan192005.pdf

and presentation slides and overview
http://listman.sonic.net/pipermail/ovc-discuss/attachments/20050516/b72f3cb0/Scheuren050514.pdf

The eVoting landscape - Chairman of Voting Reform Panel Resigns

2005-05-21T15:32:00.000-04:00

Just a quick note to capture this event in time and space, and why developing the Trusted Logic Voting (TLV) approach is a necessity to ensure a solid foundation around which to build all the other procedural and human factors that go into a successfully run election - technology by itself is never enough.

The OASIS EML work - aligned with the EU Council of Ministers efforts on determining factors for fair voting and having methods that encourage those - clearly resonate here.http://www.truthout.org/docs_2005/042305Y.shtmlDW