Testimony Regarding NASED FVSS ITA FEC VSSB NIST EAC TGDC

[Wilms]

TESTIMONY OF THOMAS R. WILKEY
FORMER EXECUTIVE DIRECTOR NEW YORK STATE BOARD OF ELECTIONS
CHAIR, NASED VOTING SYSTEMS BOARD

BEFORE THE
COMMITTEE ON SCIENCE AND TECHNOLOGY
UNITED STATE HOUSE OF REPRESENTATIVE

JUNE 24,2004

Mr. Chairman and Members of the Committee;

I am pleased to have the opportunity to appear before you today to discuss the work that has been done by the National Association of State Election Directors ( NASED) with regards to the selection of Independent Test Authorities (ITA) and it's program to encourage states to adopt Federal Voting System Standards and utilize test reports which have been issued by these ITA's.

My involvement in the development of the Federal Voting System Standards began several years before NASED became an official organization. Several of my collegues worked with me on an Advisory panel in assisting the FEC in the development of the first set of voluntary Standards in 1990.

These standards were developed over a 5 year period( 1985-1990) and the initial drafts were contracted to the late Robert Naegele of Granite Creek Technology who had for many years, worked in the area of voting system testing for the State of California.

snip

At the outset, a handbook was developed by Bob Naegele which was utilized as a check list for prospective laboratories, outlining the necessary personnel and equipment to do the work. The handbook was revised several years ago and a copy has been provided to the committee. Mr. Steve Freeman, who joins me on the panel today is here to briefly outline the steps taken to qualify a test laboratory as he has been involved in this task for NASED and has received training under the National Institute of Standards and Technology (NIST) to do so in future evaluations.

snip

NASED's involvement in the development of the 2002 standards was twofold:
In the late 1990's NASED requested that the FEC provide funding for the revisions that NASED thought were needed, based on the testing and evaluation that had been done over the past several years and the fact that the standards were now nearly ten years old. New technology and issues, not considered in the original standards needed to be addressed.

The FEC acted on our request and authorized a contract with Mantec Inc to conduct a needs assessment and evaluation to determine if the project indeed needed to be done and if so, the scope of the work to be done.

As a result of the needs assessment, the FEC awarded a contract to AMS Consulting to draft the revised standards and prepare them for a series of public comment periods required by federal law. NASED's contribution to the project included the involvement of NASED's Voting System Standards Board as members of an ad hoc advisory group to review the document and make suggestions for improvement. The 2002 Standards were released in the fall of that year.

snip

First, there is a misconception that NASED "certifies" voting systems. NASED's role is solely to review and qualify prospective ITA"s and provide for the review of reports by it's technical sub-committee, before they are sent to the vendors and ultimately to state ITA's and others designated by the states to receive and review same.

NASED, through it's secretariat, who for many years has been the Election Center, has placed on its websites, information regarding systems which had been qualified under the standards, so that states and local jurisdictions, particularly those who had no formal certification process, can know that a system has met the voluntary federal voting system requirements. This secretariat role was turned over to the Election Assistance Commission in November 2003.

snip

NASED has worked closely since January of 2003 with NIST on the transition of this program to the Technical Guidelines Development Committee under the Election Assistance Commission. Regular meetings will hopefully provided for a smooth transition, and the eventual reevaluation of ITA's by the EAC and NIST, and the consideration of other issues which we have dealt with as part of our program.

snip

http://www.house.gov/science/hearings/ets04/jun24/wilkey.htm

[Wilms]

1. Secretive testing firms certify nation's vote count machines

Secretive testing firms certify nation's vote count machines

BILL POOVEY, Associated Press Writer

Sunday, August 22, 2004

snip

Despite concerns over whether the so-called touchscreen machines can be trusted, the testing companies won't say publicly if they have encountered shoddy workmanship.

snip

The testing firms -- CIBER and Wyle Laboratories in Huntsville and SysTest Labs in Denver -- are also inadequately equipped, some critics contend.

snip

The election directors' voting systems board chairman, former New York State elections director Thomas Wilkey, said the testers' secrecy stems from the FEC's refusal to take the lead in choosing them and the government's unwillingness to pay for it.

He said that left election officials no choice but to find technology companies willing to pay.

"When we first started this program it took us over a year to find a company that was interested, then along came Wyle, then CIBER and then SysTest," Wilkey said of he standards developed over five years and adopted in 1990.

"Companies that do testing in this country have not flocked to the prospect of testing voting machines," said U.S. Election Assistance Commission chairman DeForest Soaries Jr., now the top federal overseer of voting technology.

snip

Wilkey, meanwhile, predicted "big changes" in the testing process after the November election.

snip

http://www.sfgate.com/cgi-bin/article.cgi?f=/news/archive/2004/08/22/national1322EDT0461.DTL

[onthebench]

10. One other point about the test labs

I will always blame the states for the testing problems. Each state has to certify the voting machines. The ITA testing is just one data point. It should never be the end all. I can not believe each state can not come up with a test program that is rigorous and includes all of their specific testing needs. Don't waste time on the test labs. Each state house should be told to come up with a test plan. Don't let them rely on ambigious test requirements. Make them do field tests at the vendor's expense. Look at Connecticut, they at least used four vendors in 2003 to run real elections in several towns in order to have real people voting and giving feedback. CT even required the local election officials to learn the software so that they could provide feedback.

[Wilms]

2. kick

[garybeck]

3. this is so confusing. may I ask....

>Hey Wilms,
>
>Is there a difference between
>
>NASED 2002 voluntary voting system standards
>
>and
>
>2002 Voting Systems Standards
>(as developed by the Federal Election Commission)
>
>
>
>I asked my SoS if we are compliant with 4.2.2 of the latter
>and she responded that she's not sure if we're compliant with
>the former. are they the same thing?
>
>Either way, I can't believe she's not sure
>
>thanks

[Wilms]

4. NASED uses the standards, has a hand in making them, but the names are...

The 2002 Voting Systems Standards

These were developed by the Federal Election Commission. They remain in effect through 2007. Note that the FEC doesn't deal with these issues any longer, the Election Assistance Commission (EAC) does. That's a HAVA thing.
http://www.eac.gov/election_resources/vss.html


2005 Voluntary Voting System Guidelines

The EAC recently introduced these standards. It takes effect in December 2007.
http://www.eac.gov/vvsg_intro.htm


By "4.2.2" I have a feeling you're talking about this phrase from the 2002 VSS:

"Self-modifying, dynamically loaded, or interpreted code is prohibited, except under the security provisions outlined in section 6.4.e."

There is no 6.4.e!

It's some form of a typo or who knows what.

If it read something like "e. whatever Diebold says." the argument they offered Ion Sancho may have had more weight.

Michael Shamos, consulting Pennsylvania, somehow decided it's not OK for Diebold OpScan, but OK for their TouchScream® machines to have the dreaded interpreted code.

That led Bob Kibrick and David Dill to address the issue in this article where they seem to say both OpScan and the TS are in violation.
http://www.verifiedvotingfoundation.org/article.php?id=6324

In CA, SoS McPherson seems to think it's a problem, too. That or he's afraid a mob will chase him down the street. He sent the software back to the ITA that certified and probably mumbled something like, "You deal with it, heh, heh". A number of jurisdictions are holding off buying Diebold equipment because of this.

At one point McPherson predicted we'd hear from the ITA by the Jan. 31. Crickets.

How good or bad that is actually isn't obvious. How about if some county decides against getting a Diebold OpScan and settle for an ES&S Touch Screen with no VVPAT?

Rather than CA rehashing what was done in Leon County, as some argue for, I wish they'd try a Hursti Hack on ES&S and Sequoia.

But wait! There's more.

The 2005 VVSG allows exceptions in V1 Sec. 7.4. I don't know the tech, so I can't evaluate it.

But if it was going to be argued that it provided cover for interpreted code, my guess is they haven't figured out how to make it. The alternate, is the decertification of the involved Diebold equipment, NATIONALLY. They must be frantic. And what about the other vendors?

[onthebench]

5. Wilkey is on the side of no good

He was on the secret conference call with the voting machine vendors and the ITAA in 2003. He thought it was great that the voting machine vendors got together with the lobbyists.

The 2002 standards came from Peggy's group at FEC. The FEC was the collection point for comments on it. It was edited before HAVA ever got funded. The HAVA law meant to use the Voting System Standards by using generic phrases like voting machines should meet the current standards plus a few other minor features.

Too bad Bob Naegle's health got worse just before the standards were revised. He was the one of the few state level testers that actually touched the machines. He actually stood up to vendors and told them when their methods were crap. He was just ignored by the higher ups.

Wilkey is considered a folk hero among the election community because he was there for the 2001 primary that was postponed due to it occuring on 9/11/01. The ironic side bar is that there is a voting machine in the NYC board of election that survived ground zero. It is an old lever machine that was being used that day at ground zero.

[Wilms]

6. What secret conference call?

And who is Peggy?

I got from the two articles I cited that NASED was a major force with the standards, both in 1990 and 2002.

Any idea how the IEEE came to recommend/stand by a pretty shoddy Reliability standard in 1990, 2002, and 2005?

An election day survey in MD and the CA Volume Testing showed pretty poor performance of Diebold touch screens. But I'm not sure they showed them to be out of spec. That or the ITA didn't catch that, either.

[onthebench]

7. Some answers from my foggy brain

Peggy (Margaret Sims) was the person in charge of voting machine stuff at the FEC. She had a couple of boughts with breast cancer and was still kicking when I last saw her a couple of years ago. I think she is still there.

NASED is the guiding hand. The FEC coordinated the efforts to update the standards in 2002. There were plenty of chances to have public comment - in writing and at meetings. Of course not many people cared to read the entire document. I personally read all of the drafts of all of the standards and made many comments.

The IEEE was full of competing egos in my opinion. It was full of so many "experts" that I bet had never actaully run an election. The MITs and Berkelys and JHUs all tried to argue over the little tiny details about encryption and other stuff. They all cancelled each other out and the few voting machine guys that were on the committee got their way in making the document pretty ambiguous.


The problem with the current test structure is that you can technically pass the tests with as little as four machines. Plus a large system like a voting machine can not be fully tested until it has been in the field for many real world tests. It took a few years for Global Elections (precurser to Diebold) to change how easy it was to jam a smartcard in the gap between the reader and the case.

If you are going to make 10,000 machines two years after the certification date, how is testing 6 (two years prior) of them good enough? The Georgia roll out was silly in its testing of each machine. With that many machines and so few people setting them up, the testing was bare minimal at best. The best computer makers in the world still put out machines that do not work. Even military grade computers that go through 30 times more testing than voting machines break down.

I am on a tangent. Sorry. Forgot the conference call...

In August of 2003, the ITAA a lobbyist for technology companies was asked by a couple of voting machine vendors to work for the collective industry of voting machines. I listened to the first call. Doug Lewis and Tom Wilkey were two on the call. That is completely unethical. It is like Underwriters Lab having a meeting with GE's lobbyists to discuss strategies because light bulbs are popping too often. Bev Harris broke the story and the lobbyists ended up excluding most of the new vendors from further work with the lobbyist.

[Wilms]

12. Thanks for all the help, btd.

[Kelvin Mace]

16. Bev broke the story?

That's curious, I thought I did on my web sites. I attend the meeting, I take the notes, I write up the story, and Bev gets the credit.

How typical.

[SpaghettiGirl]

8. This secret conference call perhaps?

http://64.233.179.104/search?q=cache:QqtxApdlPAMJ:globalfreepress.com/article.pl%3Fsid%3D03/08/24/0451212+roxanne+jekot+election+center+voting+machine+companies&hl=en&gl=us&ct=clnk&cd=38

Our very own Boredtodeath attended the meeting! :toast:

[onthebench]

9. i looked at the link and

It is not the meeting I refer to. I only know of one other that would post on DU that listened in on the call and he has since passed away.

This was just after the first Johns Hopkins report in 2003. The owner of Hart set up the meeting. It was the major vendors plus a few minor ones and Doug Lewis and Tom Wilkey and the lobbyist.

[Kelvin Mace]

15. Are you by chance referring to the

secret meeting between the BBV industry and ITAA in August of 2003?

[Bill Bored]

13. Welcome to DU SpaghettiGirl!

[SpaghettiGirl]

14. Thank you!

I wish I could visit more often, but my 5 kids take up too much of my time.

[kster]

11. kick.nt