RE: Rock and a hard place

["Paul Tiger" <tigerp@xxxxxxxxxxxx>]

Excellent Alan,

You have really got a grasp on this. I'd bet that you've been an election
judge.

Avante stated during the first presentation that the could print a bar code
on the paper ballot that they produce. If they can do that, then they are my
choice.

As for WinTel OS, the only one that I would entrust to this application
would be W2K. However, we have the issue of MS dumping W2K in the near
future and thus leaving us with whatever OS they choose in the future.
I personally find W2K to be extremely stable, as long as it is kept from
connection to the internet. All of the arguments that I have heard
disfavoring WinTel OS is based on what happens when they are internet
connected. Exploits for WinTel abound, but most are introduced to it when
internet connected. This is extremely unlikely to happen with DREs. There is
no reason for them to be found on the internet, and our goal is to keep them
off the internet.

I have to say that Linux/UNIX can be exploited as well. There are many open
OS exploits that have been used to attack servers. Remember that most of the
servers on the internet are UNIX based boxes. Even proprietary embedded OSes
like what can be found in Cisco switches have been exploited. Lots of people
tell me that X just can't happen on UNIX. It's a load of bull. Exploits
happen everywhere on everything.

Let's assume that the DREs will not be susceptible to exploits introduced
from a network (private or public) and concern ourselves with the DREs
themselves.

Paul Tiger

-----Original Message-----
From: Alan Crandall [mailto:ipix@xxxxxxxxxxxxx]
Sent: Tuesday, October 21, 2003 8:17 AM
To: Boulder Computer Voting
Subject: RE: Rock and a hard place


I am not sold on the bar code process as it was presented by
Heart/Inercivic.  I did like the idea that the barcodes were printed
randomly so as the voters identity is better obscured but form a programmers
perspective I feel the process they described is open to deception.

The first point is that you will have to be aware that you can verify your
vote as a normal part of the voting process.  The idea and system that
Hart/Inercivic presented involves an entirely different station that a voter
has to go to and then "request" that their barcode be printed so that the
voter can then manually scan the barcode and in reading the resulting
display verify that their intentions were recorded.  This is wholly
inadequate.  First off instead of just introducing a DRE that the voter has
to learn how to vote on ( you thought the elderly had trouble with Punch
Cards....) but now they have to learn 2 different technology stations which
in its own concept will have many voters saying that they don't need to
verify their intentions.  A couple of signs in the voting place or even
mention by a election official is not good enough for at least 25% of the
voters (in my opinion) to follow through with verifying their vote.

The other concern with this system is that if as a programmer if I were
wanting to subvert the "voter verifiable" process I would program the
machines to "print the barcodes on a delay system"  that will allow a line
of code in the software to change the voters intentions only if they did not
want a printed verification in a timely fashion.  In other words if it
delays and randomizes the barcode printing the program would only have to
print the altered voter ballot barcode after the amount of time that would
ensure that the voter had already left the polling place.  I am guessing
that 20 to 30 minutes would suffice.  This is unacceptable.

The voter has to see their intentions reflected in the voting process at the
time of placing their vote!  Avante is the only system before Boulder County
that embraced this process.  Some have expressed concern with the windows
2000 platform of the Avante system.  Linda Salas said that the county would
not have the wireless network option with that system and all of the voting
management decisions have to be carried out by 2 election judges so my
feeling is that the only way to take advantage of the win 2000 operating
system weaknesses is to physically have access to a system that is locked
down whenever the election is not being set up or held.  Of all the systems
I viewed Avante is the best.

I still prefer not making the huge leap from punch cards to DRE's.  I prefer
a paper ballot that is then fed into the ballot scanner that will display
the voters intentions and also warn of under or over votes.  Once the voter
sees that there vote has been electronically accurately counted then the
paper ballot is dropped into the ballot box.


Alan Crandall

-----Original Message-----
From: Christian Rudolph [mailto:reindeer@xxxxxxxxxx]
Sent: Monday, October 20, 2003 11:25 PM
To: Bollinger; Boulder County Voting Email List
Subject: Re: Rock and a hard place


JC,

I agree with your comments here.
I also wonder, along with others, why it is that optical scanning has
not been pursued more vigorously, as it is a well known and more secure
technology that could easily be made handicapped/disabled accessible.

Hart/Intercivic's presentation displayed a reasonable way of doing this,
using bar codes to show proof of the vote, with a paper ballot that
could be easily, accurately and quickly machine counted if a recount
were required.
The fear of an electronic recount freaks us all out, I think.
A paper recount, even if done by machine, would be more secure and
reliable, in my opinion.
Optical bar code readers could be easily made to also have
text-to-speech capability such that a vote could be independently
verified by the voter.
This would allow off the shelf bar code scanners to be modified for use
in voting, which would prevent vote tampering on a wide scale.
I also think that it would reduce the cost to Boulder County.

My guess is that certain companies have lobbied for DREs, and therefore
have convinced legislators that DREs are the way to go.
Legislators are not technologists, so not much convincing is required.
I suspect that the cost to Boulder County will be high for any of the
DREs that we saw presented.
Does anyone know what price tags are attached to them?
Does anyone have verification of this idea, or is this just my
suspicion?

-Christian Rudolph

On Sun, 2003-10-19 at 21:54, Bollinger wrote:
> 1.  I concur with Kellen & others that we MUST have a voter verifiable
> paper ballot.  The Diebold machine controversy in the Georgia governor
> election recently should amply exemplify the problem of not being able
> to truly verify a contested close election.    (Reference,for example,
> which you've probably already seen:
> http://www.wired.com/news/politics/0,1283,60563,00.html   )
> As mentioned earlier, some machines, such as Hart Interactive, can
> provide a printed receipt of each voter's ballot, which the voter can
> verify thru a window, (where a 2D barcode code also be added adjacent
> to the ballot receipt). This might be quite sufficient.
>
> 2.  If we go with scanners (or DRE), then there must be guarantees by
> the manufacturer that the machine can handle all main types of future
> applications, such as Ranked Voting, for an agreed-upon & affordable
> price, where it could be installed in the future.  Thus the scanners
> would have to produce a digital Ballot Image of each voter's record, I
> believe.
>
> 3.  Can these Scanners give warning about under-votes and prevent
> over-votes?