EAC To Assume Oversight Of Voting System Testing And Certification

[Wilms]

EAC To Assume Oversight Of Voting System Testing And Certification

By Warren Stewart, VoteTrustUSA

July 10, 2006

According to Section 231 of the Help America Vote Act, the Election Assistance Commission (EAC) is mandated to provide for the testing, certification, decertification, and recertification of voting systems. As the first step in the process the EAC is required to first develop a program for accrediting independent, non-Federal testing laboratories. Responding to a staff recommendation released at a public meeting in Denver, CO last August, the EAC adopted a Voting System Certification & Laboratory Accreditation Program. Under this program the accreditation and oversight of the “Independent Testing Authority” would pass from the National Association of State Election Directors (NASED) to the EAC. That transition is expected to be announced later this month.

Accreditation of laboratories will be undertaken by the National Voluntary Laboratory Accreditation Program (NVLAP). NVLAP was established by the National Institute of Standards and Technology in 1976 to accredit laboratories that are found competent to perform specific tests or calibrations and to foster and promote a uniformly acceptable base of professional and technical competence in the laboratory community. According to Tom Wilkey, executive director of the EAC, seven laboratories have applied for accreditation along with the three currently accredited by NASED. The accreditation is expected by this Fall.

The current testing and certification procedures originated in a March 1975 report, Effective Use of Computing Technology in Vote-Tallying, which highlighted 'the lack of appropriate technical skills at the State and local level for developing or implementing written standards, against which voting system hardware and software could be evaluated.' It was nine years before another report, Voting System Standards: A Report on the Feasibility of Developing Voluntary Standards for Voting Equipment appeared. In 1984 Congress funded the Federal Election Commission to begin what ended up being a six year process of creating the first national performance and test standards for punchcard, optical scan, and direct recording electronic voting systems. The resulting body of work was the first set of Voluntary Voting System Standards issued in 1990.

snip

While standards had finally been established, there was no mechanism for testing and certifying voting systems to those standards. Under considerable influence from R. Doug Lewis and his Election Center, a testing and certification process was undertaken by NASED, a private organization with no government oversight. There are currently three certified laboratories that collectively constitute the “Independent Testing Authority” or ITA: Ciber, Wyle Labs, and Systest. Arguably this designation is a triple oxymoron. Their “independence” is compromised by the fact that the testing that takes place is paid for by the vendors, in effect making them the ITA’s “clients”. The testing process that does take place and the standards to which voting machines are tested are considerably weaker than other accepted standards for the security of computer-based products. The testing is done in secret and detailed results of the testing are not released for public scrutiny. As for the ITA being “authoritative” there’s little to support such a designation. While the testing of voting system software has been done by several different companies over the past decade the one consistent element is that the testing has always been done by an individual named Shawn Southworth (pictured at right), operating out of Huntsville, Alabama and currently employed by Wyle Labs. Who is Shawn Southworth and what are his qualifications? We are not allowed to know. Like the rest of the process, Mr. Southworth’s credentials are shrouded in secrecy.

Computer scientist Avi Rubin of Johns Hopkins University had this to say about the Independent Testing Authority:

snip

http://www.votetrustusa.org/index.php?option=com_content&task=view&id=1489&Itemid=26

[lindisfarne]

1. ITA would pass a system even if a serious flaw was found (Avi Rubin)

"…hey are fraught with conflict of interest and incompetence. In fact, had they shown up, they would have been raked over the coals by some of the voting system examiners that attended the summit. For instance, an examiner from Pennsylvania wanted to know how come so many systems that passed the ITA testing still had serious security and even operational flaws. The Systest representative, who had the misfortune of representing his entire industry alone, replied that they were only required to test against the standard. When pressed about whether or not the ITAs would fail a system if a serious flaw was found, the reply was that a memo would be written, but that the system would still pass. I couldn't believe it. The company that was tasked with certifying machines for elections in the United States would still pass them, even if a serious flaw was found, as long as the machine did not violate any aspects of the standard. Unbelievable."

[Wilms]

2. .