Techies Praised for E-Vote Work 

By Kim Zetter in Wired News

Aug. 20, 2004 PT

The new national elections chairman this week praised computer scientists for calling attention to security problems with e-voting machines and for helping develop new standards for building machines that will be more secure in the future.

"The country owes you a debt of thanks to have taken this challenge of voting systems seriously," DeForest B. Soaries Jr., chairman of the newly formed federal Election Assistance Commission, said to members of the Institute of Electrical and Electronics Engineers, or IEEE, who are in the process of drafting new standards for electronic voting systems.

Computer scientists interpreted the comments as a hopeful sign that the contentious relationship developed over the last year between them and election officials could be on the mend. After four computer science reports revealed that e-voting machines are vulnerable to manipulation, some election officials accused the scientists of courting media attention and undermining the public's confidence in elections and election officials.

"I have personally tried to impress upon election officials not to fear scientists," Soaries told the IEEE group by phone Wednesday during their meeting in Piscataway, New Jersey. "And I've tried to impress upon scientists not to assume that all election officials will slam the door in their face."

IEEE is one of the leading professional organizations for engineers worldwide. Members have developed nearly 900 standards for various technologies. In 2001, the organization decided to tackle revamping the current technical standards for electronic voting machines, which many experts feel are insufficient.

More than 55 million U.S. voters in November will cast ballots on optical-scan machines that use a paper ballot and an electronic scanning device, and 50 million more will use e-voting machines that don't produce a paper audit trail to verify votes. The machines were certified under standards established in 1990 and 2002, which failed to adequately address security concerns, critics say. The standards focus primarily on the functionality and resilience of the hardware and software rather than on preventing someone from installing malicious code on the machines to change the votes.

Soaries agreed that the current standards are flawed.

"There are some things (in the standards) that just beg for attention and beg for some immediacy.... It's very unfortunate when you have to build a corral around a barn when the horses have already dispersed," he said, referring to the difficulty of trying to secure technology after it is already in the market.

The new standards would likely require modern security-testing techniques and would incorporate human usability studies to ensure that designers have thought through mistakes or difficulties voters might encounter with the machines. Soaries said the commission is hoping to have new standards ready for public discussion by next summer.

"I'd rather move slower and be inclusive and transparent than to move quickly ... with a product that has precision but is perceived to have been done behind closed doors," Soaries said.

Congress created the Election Assistance Commission in 2002 under the Help America Vote Act in an effort to reform elections after the 2000 presidential race scandal in Florida. It's the first time a federal agency was established to focus exclusively on voting. The act also allocated $3.9 billion to states for purchasing new electronic voting machines and modernizing the election process.

The commission is now charged with overseeing the certification of voting systems, a task that was previously handled by the National Association of State Election Directors, which chose three testing labs to verify the integrity of the voting equipment. Last December, President Bush named Soaries, a Republican and former New Jersey secretary of state, to head the four-member commission, which includes another Republican and two Democrats.

"We're not taking orders from above, from the Republican or the Democratic side," Soaries said. "We have not hired anyone related to any political influence." He added that the commission was aiming for "a broad, transparent process" and that the commissioners, who have no technical expertise, could not do their work without the scientists' help.

"States are willing to accept guidance if they believe that guidance has integrity," he said. "Our relationship with you speaks to the potential for integrity in a way that I believe is unmatched by any other partnerships that we have."

Some complaints, however, have surfaced over the influence voting-machine makers may have on the IEEE committee and the next generation of standards. The head of the committee, Herb Deutsch, works for top voting-machine maker Election Systems & Software. Some other members of the committee also work for voting-machine companies.

The committee has, in the past, been dominated by people who oppose adding a paper trail to e-voting machines and by people who oppose examining commercial off-the-shelf software used in voting machines. The current voting standards contain a loophole that allows any commercial software, like Windows, to be exempt from examination by testers. Touch-screen voting machines made by Diebold Election Systems, which scientists have found to be insecure, use the Windows operating system.

"I believe there are a lot of concerns coming through the committee that are driven by the concerns of the voting machine companies," said Stanford computer scientist David Dill, a member of the committee and a longtime proponent of adding paper trails to e-voting systems. "In the standards process there is certainly a need for getting input from the people making these products. However they do have a very large role on the committee. I think the committee has not embraced input from people like me as enthusiastically as they could have."

Dill said, however, that he was happy that security is finally being addressed. "There have been many disputes over how to make the machines more secure (but) it's getting a lot more attention than it previously got in voting standards," he said.

In addition to establishing new standards, the commission will have to create a process for upgrading the standards as technologies evolve. Commissioners also will look at the viability of putting in place national standards for election procedures. This could include protocol for handling machines that malfunction during an election and physically securing machines and voting data. Soaries said it would likely take three to five years to produce the first generation of such standards.

"This is not a sprint, this is a long-distance race," Soaries said.