National | CTVotersCount.org

Barbara Simons: The Internet and Voting: Worth Doing Right

Recently we were dissapointed when the Huffington Post ran a PR piece from Everyone Counts touting their risky election technology used in a Honolulu election. Now, Huffington Post has provided a platform for an expert technologist’s view.

Recently we were dissapointed when the Huffington Post ran a PR piece from Everyone Counts touting their risky election technology used in a Honolulu election: Did Hawaii and Honolulu Defy Own Laws, Science, and Common Sense?. Now, Huffington Post has provided a platform for an expert technologist’s view.

Barbara Simons is the only technologist on the Board of Advisors of the U.S. Election Assistance Commission. She is a recognized expert on voting integrity and security. She was also President of the Association for Computing Machinery.

She refutes the contention that technologists are intimidated by technology:

In response to multiple efforts to allow voting over the Internet in major elections, many of our nation’s prominent technology experts have signed a statement cautioning against adopting Internet-based voting systems without first understanding and guarding against the numerous and well-documented dangers. This is not because, as Mr. Contorer suggests, those opposing Internet voting find “[t]he introduction of technology to any process … scary”. The signatories to this statement are not at all intimidated by technology; in fact many are established experts in voting systems who are most certainly aware of the major risks associated with Internet voting.

Simons then explains that ATM Banking and voting are different:

The article asserts that since we are able to conduct banking and commerce over the Internet, we should also be able to vote over the Internet. This is a common misconception (or misrepresentation) that is often made when attempting to support Internet-based voting. Banks spend considerable time and money to ensure the security of our assets, yet there are still risks. Identity theft and fraud affect millions of Americans and cost billions of dollars each year. When we can detect such fraud it is because we are able to track our money through each transaction from start to finish, including the people associated with those transactions.

However, elections by their very definition disallow this type of explicit end-to-end auditing. Voters must cast their ballot in secret and not be able to prove to others how they voted. Election officials must not be able to tie votes to citizens except in very narrow circumstances as carved out by law. The lack of these basic protections make Internet-based voting a dangerous idea and place it so far from the realm of Internet banking or commerce as to make the author’s point moot.

There are significant security issues that any vendor must address before declaring such a system fit for public elections. Yet the author glosses over these security issues raised by Internet voting, referring several times to “military-grade encryption.” It is a well-known marketing technique of voting system vendors to tout the strength of their encryption because it sounds impressive. But the fact is that encryption is only a secondary part of any electronic security.

Technology can help in elections:

Americans deserve the best electoral system available. There are many options for making elections more accessible, secure, and efficient, and the Internet will have a role to play. Current possibilities that show promise include the easier maintenance of voter registration records and the distribution of blank absentee ballots. But we should not subject our democracy to the costs or risks of current Internet-based voting schemes.

We recommend reading the entire post <read>

Internet Voting: One of the Most Serious Threats to Democracy in the 21st Century

Now, President Obama has formally recognized the risks and insecurity of the internet. Given that recognition, the incidents we see reported almost daily, and those viruses that occasionally hit our computers, on what basis can anyone support internet voting?

Our headline parapharases and logically extends the concerns expressed yesterday by President Obama as quoted in a Hartford Courant article:

Calling the protection of government and private information and communications networks “one of the most serious … security challenges of the 21st century,” President Barack Obama plans to appoint a new adviser to oversee an effort at improving “cybersecurity” throughout the United States.

Private companies with revenue to gain, state legislators, and Federal committees have been touting the benefits of internet, fax, email, and even voting by phone. We along with other voting integrity advocates, security experts, CIA experts, and computer scientists have been warning of the risks to democracy.

Now, President Obama has formally recognized the risks and insecurity of the internet. Given that recognition, the incidents we see reported almost daily, and those viruses that occasionally hit our computers, on what basis can anyone support internet voting?

A second piece of postitive news is that the military internet voting bill in Connecticut, if it passes, will likely be in a version that precludes votes being returned electronically. In that form we support it along with other cost effective and secure methods which have been proposed in the U.S. Senate and House to help our soldiers vote.

Update 10/27/2009: Northrop Grumman report on the Capability of the People’s Republic of China to Conduct Cyber Warfare and Computer Network Exploitation <read>

This strategy, which relies on a simultaneous application of electronic warfare and computer network operations against an adversary’s command, control, communications, computers, intelligence, surveillance, and reconnaissance (C4ISR) networks and other essential information systems, appears to be the foundation for Chinese offensive IW. Analysis of this strategy suggests that CNO tools will be widely employed in the earliest phases of a conflict, and possibly preemptively against an enemy’s information systems and C4ISR systems.

The PLA is training and equipping its force to use a variety of IW tools for intelligence gathering and to establish information dominance over its adversaries during a conflict. PLA campaign doctrine identifies the early establishment of information dominance over an enemy as one of the highest operational priorities in a conflict; INEW appears designed to support this objective.

Its not just China that could do this, and its not just warfare. Similar attacks could change election results and disclose votes. This is why internet, email, and fax voting should be a concern.

Did Hawaii and Honolulu Defy Own Laws, Science, and Common Sense?

Honolulu: Everyone Counts, a vendor, generates publicity for election conducted via internet and telephone.

But wait, there are more problems: Hawaii used Hart Interactive voting machines in 2008, yet they also violate Hawaii law in several ways, including apparently a prohibition on transmitting votes over the internet or phone lines. Now a judge has agreed with a citizen suit and has issued an injunction against their use in 2010.

Update: Voting Drops 83 Percent In All-Digital Election
Update: Look who is behind Everyone Counts

Update 09/15: Maui judge formalizes ruling that bans electronic voting <read>

Update 05/28: [Former] U.S. EAC Chair Cashes In to Head Company Running ‘All-Digital’ Elections <read>

Update 05/26: Voting Drops 83 Percent In All-Digital Election <read>

Perhaps there is more to it than the PR Releases disguised as news stories:

About 7,300 people voted this year, compared to 44,000 people who voted in the last neighborhood board race in 2007.

*****************

Honolulu: Everyone Counts, a vendor, generates publicity for election conducted via internet and telephone: <press release> Somehow this same organization convinced the Huffington Post to publish a similar puff piece written by an Everyone Counts executive: <read post>

For too long we have tolerated the idea that elections should be difficult. If you think voting is inconvenient, too bad for you, say pundits. And if elections are expensive and a logistical nightmare to run, oh well, at least there aren’t too many of them.

America’s newest state, our southernmost state, has a different idea. Right now, as you read this article on the Internet, citizens of Honolulu are voting in America’s first all-digital online and telephone election. Residents of neighborhoods with contested board seats received pass-codes in the mail, along with a Web address and a phone number allowing them to vote at any time, day or night, from anywhere in the world.

Recall that the telephone and internet are less than secure. We have convered the risks of internet voting several times <read>. We are amazed that anyone would trust the phone system, realizing that any phone can be tapped, the phone companies and the NSA have demonstrated their ability to ignore law and listen in to any and all phone calls.

1. The use of electronic voting machines was not adopted through lawful rulemaking in accordance with the Hawai’i Administrative Procedure Act (HAPA).

2. The use of the Internet and/or telephone lines to transmit vote counts was not adopted through lawful rulemaking (HAPA).

3. The use of the Internet and/or telephone lines to transmit vote counts is not allowed under current state law.

Last year Ellen Theisen of VotersUnite.org wrote an extensive report on the perils of outsourcing elections. Hawaii was one of the highlighted jurisdictions in the study. The index entry summarizes the situation:

Hawaii. State officials have handed elections to voting system vendors. Now the state cannot run elections without a vendor.

Safe Ways To Protect And Speed Military Votes

Protecting the Military Vote. High security, high privacy, low cost. Bills by Republicans in the U.S. Senate and a Democrat in the U.S. House.

Senator Schumer(D) is holding hearings on military voting delays and lost votes. Senators Inhof(R) and Chrnyn(R) are offering legislation to get the job done, without risking security and privacy <American Chronicle Story>

The legislation attempts to reduce delays in the current absentee voting process for our overseas troops by allowing the U.S. Postal Service to express-ship their completed absentee ballots to local election offices. The bill amends the Uniformed and Overseas Citizens Absentee Voting Act of 1986 (UOCAVA) and ensures that the ballots are delivered to the appropriate state election officials by the jurisdiction´s statutory deadline, while safeguarding voter privacy and ballot secrecy.

And from Representative Rush Holt(D): <H.R.2082>

To amend the Uniformed and Overseas Citizens Absentee Voting Act to require States to accept absentee ballots of overseas military and civilian voters which are submitted by the voter to a provider of express mail services not later than the day before the date of the election involved for transmission to the appropriate State election official, to require the Secretary of Defense to reimburse overseas military voters for the costs of using a provider of express mail services to transmit the ballot to the official, and for other purposes.

These are the right ways to do it. No need to compromise security. No need for Connecticut’s Secretary of the State to develop methods that Computer Scientists and the Department of Defense are unable to develop. No need to spend upwards of $500 per vote. Earlier coverage <here>

McCain, Obama Counsels Agree: Start With The Facts

It may be news to many readers that reforms are still needed. The media widely reported a smooth election, and in some places, those reports were accurate.

An article in RollCall by Obama and McCain campaign general counsels: Next Phase of Election Reform: Start With Facts <read>

we share a deep commitment to fair and well-run elections in which all qualified voters have the opportunity to vote, and all the votes that they cast are accurately counted.

Looking back on the 2008 elections, we have no doubt that reforms in the administration of elections in this country are needed if we are to meet these standards. We also believe such reforms can be achieved, with potentially transformative success for the American voter.

It may be news to many readers that reforms are still needed. The media widely reported a smooth election, and in some places, those reports were accurate. The problems — and there were many, scattered across the country — received comparatively little attention because the outcome of the voting was clear…

Understandably, Americans seem to care about these problems most when, and sometimes only when, elections are close. Even when these problems receive the attention that they deserve, there remains a major obstacle to rational dialogue and effective reform: the absence of reliable, comparative data on how our election system is performing.

If these debates are to move forward in the face of much partisan mistrust and reflexive disagreement, we need some factually grounded agreement on where we are now. Only then will we have some sense of what kind of solutions are likely to succeed.

We agree with the thrust of the article. Facts are required. Just because we had an election that produced a clear winner is no reason to be complacent. We would add that post-election audits are an important piece of the facts that are needed. All states need paper ballots followed by sufficient and reliable post-election audits, producing facts, that lead to actions, that result in confidence in our election process, including a system where any problems will be surfaced and addressed.

Diebold: Revenue way down. $25,000,000 settlement proposed

Results included a $25 million charge for a deal Diebold reached with the Securities and Exchange Commission to settle civil charges related to a pending enforcement inquiry. The proposed settlement still needs final SEC approval.

The New York Times reports the story <read>

Results included a $25 million charge for a deal Diebold reached with the Securities and Exchange Commission to settle civil charges related to a pending enforcement inquiry. The proposed settlement still needs final SEC approval.

Diebold spun off its election system business after a failed attempt to sell it. The settlement is related to accounting tricks presumably intended to puff up voting system results to produce a sale.

It Pays To Complain – Election Officials Complain, Diebold Makes Public Pay

Humboldt County, CA found problems with the Dieblod GEMS system which it intended to replace, while it intended to continue to use its Diebold voter registration system. Now it is left with 90 days to find another solution as Dieblod executes its option to terminate its support of the county. Hard to interpret this as anyting but retribution and intimidation of the other juristictions, Brad Blog has the story <read>

As if you complained to GM that your fully paid for Humvee was a lemon and they said they would reposses it and your GTO next week.

It is interesting that the letter concerning the voter registration system, known as DIMS — in which no problems were either discovered or reported — is dated March 17, the day before the GEMS letter. The county’s DIMS voter registration database system is entirely separate from the GEMS vote counting system, and the county had hoped to continue using it. In fact, the county IT department was in the middle of performing a software upgrade to the DIMS system when the letters were received…

Back on April 6, Premier’s unfortunately-named spokesman Chris Riggall commented on the contract terminations to the Times-Standard: “We just believed it prudent to kind of make a, well, to essentially provide a clean break, or a fresh start, for however the county would like to proceed going forward. We thought it would provide the county an opportunity to make a fresh start.”

Another cautionary tale of they type of company we trust with our democracy and the dangers of dependence on vendors who supply proprietary technology.

John Gideon, 1947-2009

Voting integrity has lost a great friend, John Gideon. John had a huge impact and leaves us all with a large gap to fill.

I share the deep sense of sadness of everyone in the voting integrity community at the untimely loss of this giant of a man – Rep Rush Holt

Update 05/07/2009: TalkNationRadio Clips of John Gideon and Interviews his collaborators

Update 05/07/2009: TalkNationRadio Clips of John Gideon and Interviews his collaborators <read/listen>

******************

Voting integrity has lost a great friend, John Gideon. John had a huge impact and leaves us all with a large gap to fill.

John was the co-founder of VotersUnite.org and the producer of the Daily Voting News. John scanned the news daily to provide us all with news from all corners of the Nation and Globe. We found many of the stories relevant to Connecticut at the Daily Voting News. They frequently became the basis of some of our posts. We benefited from his insight and correspondence. John also kindly ran many of our posts. I met John twice and we corresponded frequently. I last saw him three weeks ago when he served as a local host of a conference in Seattle, as always, warm, friendly, and full of life, a friend to everyone.

Photos and more from about John from <Brad Friedman>

Update: Statement By NJ Rep Rush Holt <read>

I share the deep sense of sadness of everyone in the voting integrity community at the untimely loss of this giant of a man whom we all relied on for the most up-to-date information on issues related to electronic voting security through his Daily Voting News and the endless research and reports on the VotersUnite.org website. My thoughts and prayers are with his family and friends. He will be missed greatly. whom we all relied on for the most up-to-date information on issues related to electronic voting security through his Daily Voting News and the endless research and reports on the VotersUnite.org website. My thoughts and prayers are with his family and friends. He will be missed greatly.

Update: A collection of tributes to John Gideon <read>

NYT: Gov. Siegleman overdue for same as Sen. Stevens

Mr. Siegelman was convicted in 2006 on dubious corruption charges. He spent nine months in prison before being released on appeal, and he faces years more behind bars. He has long insisted that the case against him was politically motivated and that prosecutors engaged in an array of professional and ethical violations

Update 10/15: Obama Justice Department Hangs Siegelman Whistleblower Out to Dry <read>

It’s hard to imagine a more clearcut case of unlawful retaliation. But the Obama Justice Department now is trying to ensure that Grimes does not receive unemployment benefits, and she has been denied health-care insurance–and she has a special-needs child!

Update 09/16: Siegelman Prosecutors Received Extensive Perks From Their “Recused” Boss <read>

Update 06/11: Lawyer articulates flawed prosecution: Memo to Holder: Siegelman Prosecution Was Riddled With Misconduct <read>

Update 05/24: Siegelman’s First Trial Judge Blasts U.S. Prosecutors, Seeks Probe of ‘Unfounded’ Charges <read>

Update 05/14: It gets worse, where is our Constitutional Law Professor Obama on this? <Brad Friedman>

Incredibly, the Bush-appointed prosecutors in the Siegelman case (who are, inexplicably, still on the job!) have now requested an even longer sentence for the former Democratic Gov. of Alabama who was railroaded as part of a Rove-led political prosecution.

Sign the letter to Attorney General Holder <read and sign>

************
We have talked about Gov. Don Siegleman’s stolen election and subsequent political inprisonment before. As a New York Times Editorial points out its high time justice was done. Justice would start with his exoneration and the investigation of the actual potential criminals in Alabam and the Justice Department <read>

Attorney General Eric Holder’s recent decision to drop all of the charges against Ted Stevens, the former Republican senator from Alaska, because of prosecutorial misconduct raises an important question: What about Don Siegelman? A bipartisan group of 75 former state attorneys general has written to Mr. Holder asking him to take a fresh look at the former Alabama governor’s case. He should do so right away.

Mr. Siegelman was convicted in 2006 on dubious corruption charges. He spent nine months in prison before being released on appeal, and he faces years more behind bars. He has long insisted that the case against him was politically motivated and that prosecutors engaged in an array of professional and ethical violations…

In the case of Mr. Stevens, who was convicted of felony charges for failing to disclose gifts and services, Mr. Holder was so troubled by the way the prosecution was carried out that he decided to drop the case entirely.

According to the Siegelman camp, at least three of the same officials who have been accused of prosecutorial misconduct in the Stevens case were involved in Mr. Siegelman’s prosecution. If true, this alone would seem to justify a thorough investigation of the case.

Vendors Attack Open Source with Obfuscation, Inaccuracy, Doubt

The Election Technology Council released a white paper: Open Source: Understanding Its Application In The Voting Industry. Professor Dan Wallach explains the flaws in their arguments and understanding of open source.

The Election Technology Council released a white paper: Open Source: Understanding Its Application In The Voting Industry <read>

Professor Dan Wallach explains the flaws in their arguments and understanding of open source: On open source vs. disclosed source voting systems <read>

As Dan suggests we need to rely on experts to understand complex issues. But not just any expert. Transparency provides access to all experts.

Nobody has ever suggested that election transparency requires the layperson to be able to understand the source code. Rather, it requires the layperson to be able to trust their newspaper, or political party, or Consumer Reports, or the League of Women Voters, to be able to retain their own experts and reach their own conclusions.

I would suggest that the indsstry paper is aimed at laypersons, especially election officials and legislators.

Here is an example of a strawman from the industry paper, refuted by Wallach:

… taking a software product that was once proprietary and disclosing its full source code to the general public will result in a complete forfeiture of the software’s security … Although computer scientists chafe at the thought of “security through obscurity,” there remains some underlying truths to the idea that software does maintain a level of security through the lack of available public knowledge of the inner workings of a software program.

Really? No. Disclosing the source code only results in a complete forfeiture of the software’s security if there was never any security there in the first place. If the product is well-engineered, then disclosing the software will cause no additional security problems. If the product is poorly-engineered, then the lack of disclosure only serves the purpose of delaying the inevitable.

In general the industry completely turns everything around. In Wallach’s words:

As to the “principles of intellectual property”, the ETC paper conflates and confuses copyright, patent, and trade secrets. Any sober analysis must consider these distinctly. As to the “viability of the current marketplace”, the market demands products that are meaningfully secure, usable, reliable, and affordable. So long as the present vendors fail on one or more of these counts, their markets will suffer.

This is just a taste. There are many more details refuted and a great case made for open source in Wallach’s post <read>

Finally, we point out that CTVotersCount is made possible and more robust by open source software, WordPress. WordPress has proven quite secure, with a community of developers ready to quickly address security flaws. It is also much more robust than proprietary alternatives due to a huge community of developers competing to create valuable add-one features at the rate of several a day.