Kim Zetter's recent 'Wired' article

["Pete Klammer" <pklammer@xxxxxxxxxxx>]

Wired News

Techies Praised for E-Vote Work  By Kim Zetter 
Story location: http://www.wired.com/news/business/0,1367,64644,00.html

02:00 AM Aug. 20, 2004 PT

The new national elections chairman this week praised computer scientists
for calling attention to security problems with e-voting machines and for
helping develop new standards for building machines that will be more secure
in the future. 

"The country owes you a debt of thanks to have taken this challenge of
voting systems seriously," DeForest B. Soaries Jr., chairman of the newly
formed federal Election Assistance Commission, said to members of the
Institute of Electrical and Electronics Engineers, or IEEE, who are in the
process of drafting new standards for electronic voting systems. 

Computer scientists interpreted the comments as a hopeful sign that the
contentious relationship developed over the last year between them and
election officials could be on the mend. After four computer science reports
revealed that e-voting machines are vulnerable to manipulation, some
election officials accused the scientists of courting media attention and
undermining the public's confidence in elections and election officials. 

"I have personally tried to impress upon election officials not to fear
scientists," Soaries told the IEEE group by phone Wednesday during their
meeting in Piscataway, New Jersey. "And I've tried to impress upon
scientists not to assume that all election officials will slam the door in
their face." 

IEEE is one of the leading professional organizations for engineers
worldwide. Members have developed nearly 900 standards for various
technologies. In 2001, the organization decided to tackle revamping the
current technical standards for electronic voting machines, which many
experts feel are insufficient. 

More than 55 million U.S. voters in November will cast ballots on
optical-scan machines that use a paper ballot and an electronic scanning
device, and 50 million more will use e-voting machines that don't produce a
paper audit trail to verify votes. The machines were certified under
standards established in 1990 and 2002, which failed to adequately address
security concerns, critics say. The standards focus primarily on the
functionality and resilience of the hardware and software rather than on
preventing someone from installing malicious code on the machines to change
the votes. 

Soaries agreed that the current standards are flawed. 

"There are some things (in the standards) that just beg for attention and
beg for some immediacy.... It's very unfortunate when you have to build a
corral around a barn when the horses have already dispersed," he said,
referring to the difficulty of trying to secure technology after it is
already in the market. 

The new standards would likely require modern security-testing techniques
and would incorporate human usability studies to ensure that designers have
thought through mistakes or difficulties voters might encounter with the
machines. Soaries said the commission is hoping to have new standards ready
for public discussion by next summer. 

"I'd rather move slower and be inclusive and transparent than to move
quickly ... with a product that has precision but is perceived to have been
done behind closed doors," Soaries said. 

Congress created the Election Assistance Commission in 2002 under the Help
America Vote Act in an effort to reform elections after the 2000
presidential race scandal in Florida. It's the first time a federal agency
was established to focus exclusively on voting. The act also allocated $3.9
billion to states for purchasing new electronic voting machines and
modernizing the election process. 

The commission is now charged with overseeing the certification of voting
systems, a task that was previously handled by the National Association of
State Election Directors, which chose three testing labs to verify the
integrity of the voting equipment. Last December, President Bush named
Soaries, a Republican and former New Jersey secretary of state, to head the
four-member commission, which includes another Republican and two Democrats.


"We're not taking orders from above, from the Republican or the Democratic
side," Soaries said. "We have not hired anyone related to any political
influence." He added that the commission was aiming for "a broad,
transparent process" and that the commissioners, who have no technical
expertise, could not do their work without the scientists' help. 

"States are willing to accept guidance if they believe that guidance has
integrity," he said. "Our relationship with you speaks to the potential for
integrity in a way that I believe is unmatched by any other partnerships
that we have." 

Some complaints, however, have surfaced over the influence voting-machine
makers may have on the IEEE committee and the next generation of standards.
The head of the committee, Herb Deutsch, works for top voting-machine maker
Election Systems & Software. Some other members of the committee also work
for voting-machine companies. 

The committee has, in the past, been dominated by people who oppose adding a
paper trail to e-voting machines and by people who oppose examining
commercial off-the-shelf software used in voting machines. The current
voting standards contain a loophole that allows any commercial software,
like Windows, to be exempt from examination by testers. Touch-screen voting
machines made by Diebold Election Systems, which scientists have found to be
insecure, use the Windows operating system. 

"I believe there are a lot of concerns coming through the committee that are
driven by the concerns of the voting machine companies," said Stanford
computer scientist David Dill, a member of the committee and a longtime
proponent of adding paper trails to e-voting systems. "In the standards
process there is certainly a need for getting input from the people making
these products. However they do have a very large role on the committee. I
think the committee has not embraced input from people like me as
enthusiastically as they could have." 

Dill said, however, that he was happy that security is finally being
addressed. "There have been many disputes over how to make the machines more
secure (but) it's getting a lot more attention than it previously got in
voting standards," he said. 

In addition to establishing new standards, the commission will have to
create a process for upgrading the standards as technologies evolve.
Commissioners also will look at the viability of putting in place national
standards for election procedures. This could include protocol for handling
machines that malfunction during an election and physically securing
machines and voting data. Soaries said it would likely take three to five
years to produce the first generation of such standards. 

"This is not a sprint, this is a long-distance race," Soaries said. 

----------------------------------------------------------------------------
----