RE: New NIST draft on VVPATs and DRE audits; Holt bill

["AlKolwicz" <alkolwicz@xxxxxxxxx>]

Neal,

I disagree with your evaluation, and have just published a response at
http://coloradovoter.blogspot.com/2005/03/say-no-to-nists-voter-verification
.html 

Cheers

Al


Al Kolwicz
2867 Tincup Circle
Boulder, CO 80305
303-494-1540
AlKolwicz@xxxxxxxxx



-----Original Message-----
From: Neal McBurnett [mailto:neal@xxxxxxxxxxxxxxxxx] 
Sent: Monday, March 07, 2005 8:31 PM
To: cvv-discuss@xxxxxxxxxxxxxxxxx
Subject: New NIST draft on VVPATs and DRE audits; Holt bill

A major step forward from NIST - good input for Colorado legislation.

The National Institute for Standards and Technology (NIST) just
released a draft of their input on VVPATs and DRE audits as requested
by the Technical Guidelines Development Committee (TGDC) of the
Election Assistance Commission.

 Preliminary Report: NIST Approach to VVPAT Requirements for the VSS
 2002 Addendum (John Wack)
  http://vote.nist.gov/TGDC/VVPAT%20Addendum%20-%20jpw%20-%203-2-051.pdf

I think it is a very significant step forward.  Although it is a
draft, subject to who-knows-what from the TGDC and the EAC, I think it
encapsulates the major requirements necessary to have a verifiable,
auditable, DRE, and does so in a way that will be more likely to
be passed by legislatures both here and in other states.

Legislators, clerks and vendors are all concerned that if we have
legislation that is overly unique in Colorado, everyone's life will be
more complicated.  So I'm working on a national level also, and have
asked EFF and CPSR for input.

Here are the major requirements:

 R1. The DRE-VVPAT shall show the voter a paper record of the voter's
electronic ballot choices which constitutes a distinct record of the voter's
ballot choices. 

 R2. The DRE-VVPAT shall permit the voter to compare the paper and
electronic records with maximum ease according to established accessibility
and usability guidelines. 

 R3. The method for voter verification shall be accessible to all voters. 

 R4. The DRE-VVPAT shall permit the voter to accept or reject the paper
record and reenter ballot choices at the DRE-VVPAT. 

 R5. The voter's privacy and anonymity shall be preserved during the process
of recording, verifying, and auditing ballot choices. 

 R6. The DRE-VVPAT shall permit robust auditing, forensics analysis, and
full recount capability of its electronic and paper records. 

 R7. The DRE-VVPAT equipment shall be secure and resistant to failures, and
shall be usable in its administration. 

 R8. Trained personnel, procedures, and consumables shall be in place during
elections to handle all aspects of VVPAT capability.

It requires a paper trail suitable for hand counting.
It requires export of the memory card info in a well-documented
format, so we can write our own software to count it and audit it.

It requires the ability to do "surprise audits" in the middle
of the day in the polling places.

It includes barcodes, but they must be in a standard barcode format,
in a published format, with no encryption.  So again, standard
off-the-shelf hand scanners can be used to validate that the barcode
is the same as the printed text.

It allows for machine scanning of barcodes, but only if a sample of
the barcodes are checked by hand against the printed text.

 3.3.6.9.1 If paper records include encoded representations of the human
readable content on the record, at least 1% percent of the paper ballots per
individual DRE-VVPAT under audit shall be manually audited to ensure that
the human readable content is identical to the encoded representation. The
manual auditing may use common industry-standard handheld scanning equipment
to read and display the encoded information.

 3.3.6.9.2 High-speed optical scanning equipment may be used to machine read
paper records so as to reduce the time necessary to compare electronic
records with their corresponding paper records.


I think the Holt bill in the US House, along with this NIST proposal,
should form the basis for Colorado legislation.  They have the same
general intent as the Mitchell/Madden bill, but I think they say it
more clearly and with much more input from folks around the nation
that care about this stuff.  There are things to be improved, but this
is a good solid place to start.

Of course we do have to have Colorado specific input requiring the
counting of the paper trail for all recounts, etc.

I've pointed before to Holt's bill (the "gold standard" according to
verifiedvoting.org) before, but here it is again, HR-500:

 http://www.govtrack.us/congress/bill.xpd?bill=h109-550

I'll be meeting with Senate Majority Leader Gordon and other groups on
Wednesday, and CFVI folks are meeting tomorrow in Denver to talk about
this.  The Blue Ribbon Election Panel meets on Friday at 2pm, so this
is the time to read, listen, learn, and act!  Let me know what you
think!  Come to the Blue Ribbon Election Panel

 http://www.sos.state.co.us/pubs/elections/blue_ribbon.htm

Cheers,

Neal McBurnett                 http://bcn.boulder.co.us/~neal/
Signed and/or sealed mail encouraged.  GPG/PGP Keyid: 2C9EBA60