|
i'd not realized that the advocacy piece i'd found at the election center was actually Lewis' testimony to the CA Cmte on Voter Verified Paper Ballots. he really wants it! but i found a point-by-point response to Lewis' advocacy from a member of the National Science Foundation Panel on Internet Voting that everyone should read. it is quite long so i'll only present a few paragraphs and URGE you to read the entire thing (see quote below). understand that The Election Center is billed: The Election Center is a nonprofit 501(c)(3) tax-exempt organization under the regulations of the Internal Revenue Service. The Election Center's purpose is to promote, preserve, and improve democracy. Its members are government employees whose profession is to serve in voter registration and elections administration, i.e., voter registrars, elections supervisors, elections directors, city clerk/city secretary, county clerk, county recorder, state election director and Secretary of State for each of the individual states, territories, and the District of Columbia. well, back to that refutation by David Jefferson, Response to "DRE's and the election process". the excerpt i've done here presents Lewis' testimony quote nested with respect to Jefferson's refutation. The following document is alternating black and red text. The red is mine; the black is a widely-circulated document from the Election Center that attempts to defend the security and reliability of DRE voting systems (Direct Recording Electronic, often referred to as touchscreen systems), and implicitly argues against any need for them to be upgraded to include a voter verification feature. Since the original document contains a very large amount of misleading and/or completely incorrect information, I feel that it is necessary to circulate a critiqued version.
Unfortunately, the arguments contained in the original show considerable misunderstanding of the software development and security issues for DREs, and of the range of security and failure threats inherent in them. In particular, without presenting any realistic threat model, the author argues that certain attacks he outlines are unlikely to be successful; but he takes no account of much simpler and more dangerous attacks than those he discusses. I don't have space here to present the full range of security vulnerabilities in DRE systems without voter verification, so I will confine myself to refuting the arguments here. However, if you would like further information, feel free to contact me by email.
David Jefferson
CA Electronic Voting Task Force Member
CA Internet Voting Task Force Technical Committee Chair
National Science Foundation Panel on Internet Voting
d_jefferson at yahoo.com
Doug Lewis testimony before the California Secretary of State's Ad Hoc Committee on Voter Verified Paper Ballots
The Election Center an international association of voter registration and election officials
12543 Westella, Suite 100 Houston, TX 77077 Phone: 281-293-0101 Fax: 281-293-0453
Email: electioncent@pdq.net Website: www.electioncenter.org
Now that Direct Recording Equipment (DRE) voting systems are growing in acceptance and use in American elections, it is almost inevitable that some groups, individuals and organizations will claim that such systems are not safe enough to use in elections.
People are entitled to doubt the security and reliability of voting machines. The burden of proof that any particular voting system is secure rests squarely on the voting system vendors. If they are unwilling or unable to provide that proof, then the public is entitled to -- and in fact must -- reject the system in question, or demand improvement.
And this argument is not new. When lever machines were first introduced into the elections process, all those favored paper used the same kinds of arguments. When IBM first started computer counted punch card voting, many of the same kinds of arguments were made.
When new technologies are introduced and experts point out security or reliability problems with them, it is also not new for many people to argue that those security problems are exaggerated: that the attacks hypothesized are extremely unlikely, or would not succeed, or would be detected early, or could not happen because no one has the access, resources, knowledge, or motivation to conduct them. Often those arguments are naive, ill-informed, and based on limited understanding of software or security.
When remote Internet voting was first introduced in the U.S. in 2000, many of those same arguments were made. Fortunately, with enough time and opportunity to present the case, the expert opinion that remote Internet voting, as understood then, introduces potentially catastrophic security vulnerabilities was finally accepted, and possible disaster was averted (for the time being). Many of those same experts are now concerned about DRE security.
Because DRE's represent another shift in the kinds of technology used for elections, we see the renewed fears of introducing the newer technology. It is entirely normal for these arguments to arise as we shift to a generational change in the types of voting systems used.
No one argues that DRE's are in principle a bad idea; indeed they have real advantages to ordinary voters, to the disabled, and to voters who read another language, or are illiterate.
But it is irresponsible to force voters to use systems whose security has not been proven.
From what I have been able to learn, it is almost certainly true that, as currently designed, DREs have fatal security flaws so dangerous that they could allow people with access to the software to modify election results on a national level, and without detection.
It is a matter of national security that we fix these flaws. Fortunately they can all be fixed with a single feature, voter verification, which simply allows voters to verify that their votes are cast as intended, and at a time in the voting transaction when the vote cannot be overwritten by software without detection. What we argue for is not the elimination of DRE's, but the immediate requirement that they be augmented with vote verification technology.
Many of us arguing for voter verification are computer scientists, and hardly harbor any general "fears of introducing ... newer technology". We spend our professional lives creating new technology and helping to introduce it. So when the computer science community -- usually technology boosters -- is nearly unanimous in warning that DREs without voter verification have huge and glaring vulnerabilities, you can be sure it is not based on simple fear.
The problem is that well intentioned people, some of them even highly educated and respected, scare voters and public officials with claims that the voting equipment and/or its software can be manipulated to change the outcome of elections. And, the claim is, it can do so without anyone discovering the theft of votes. Since so many people tend to distrust technology they have limited knowledge about, it only makes the situation worse.
Yes, I do claim that voting software can be manipulated to change the outcome of elections, and do so almost certainly without detection.
No one is specifically trying to scare anyone. But when we carefully explain the dangers of introducing DREs without voter verification, the implications are indeed scary.
Let's confront the problem directly: it is highly probable that any machine devised by humans can be broken by humans. So ANY technological argument to the contrary seems to be doomed from the very beginning. We can take precautions, we can make it more difficult, but the end analysis is that you cannot build a totally secure voting device.
No one argues that with voter verification DREs become "totally secure voting devices". But one has to recognize that some bugs and attack threats are much more serious than others, and we are concerned about the most serious ones.
The most dangerous potential vulnerabilities (1) can affect hundreds of elections simultaneously, rather than just one; (2) are easily hidden and unlikely to be detected; (3) can be perpetrated by a single person without requiring a larger conspiracy; or (4) are particularly easy to perpetrate. DRE software, and the associated development and distribution processes, should be designed so that attacks like these are virtually impossible; but sadly, they are not. Fortunately, all of the most serious bug and attack scenarios can be prevented with the addition of one mechanism, voter verification, which is why we advocate it.
The real question is, can you gain access to the software, change it, have it manipulate the results for one or more races, have it not be evident when you do the pre-election test, erase itself before the post election test, and get away with it totally undetected?
The short answer is simply "Yes".
As this question is phrased, however, it shows a serious misunderstanding: It is not necessary for the malicious software to "erase itself before the post election test", since it is no harder to pass undetected through the post election tests than to pass all of the other tests. And even if it were for some reason deemed necessary or desirable for the malicious software to erase itself, in the most common programming languages that step is so easy that it hardly merits mentioning as a hurdle at the same level as the others here.
<snip> lots more
We appreciate and respect those who question the process and we understand their fears. And we do not take their concerns lightly. While conducting elections is likely to be an imperfect process, it is a process built upon more than 200 years of experience in how to provide appropriate safeguards. Like most situations in the electoral process, it rarely boils down to a technological issue. It almost always comes down to policies, procedures and people doing what they are supposed to do.
While it may be "rare" that electoral problems "boil down to a technological issue", this is one of those times. When the computer scientists and computer security experts who have examined the issues are nearly unanimous (which they are) in warning of the security danger of DREs that do not include a voter verification feature, I would hope the election officials and vendor groups would try to help solve the problem instead of denying its reality.
much, much more @ http://verify.stanford.edu/EVOTE/ECresponse.html |
Printer-friendly format
Email this thread to a friend
Bookmark this thread
(1000+ posts)
Send PM |
Profile |
Ignore
