ACCURATE

As we described earlier this week, the Election Assistance Commission is developing a new voting systems testing and certification regime geared towards pilot voting systems–that is, experimental voting systems intended for limited use in designated pilot program elections, with specific standards, testing and certification. (On Monday, ACCURATE submitted comments on the administrative infrastructure for this new regime.)

Today, ACCURATE submitted comments on the first such pilot program under the new system, geared towards UOCAVA voters. This pilot program is a joint collaboration between FVAP, NIST and EAC, under the MOVE Act, that seeks to provide “kiosk” voting systems for a federal election for UOCAVA voters.

It’s an ambitious undertaking, and the draft standard reflects a great deal of work towards setting requirements to which voting systems can be tested and certified to provide UOCAVA voting capacity. ACCURATE’s comments break down like so:

• The focus on controlled, supervised voting system architectures is appropriate. Many of the fundamental problems with forms of Internet voting are associated with uncontrolled platforms–users PCs, mobile devices, etc.–in unsupervised environments–i.e., at home instead of a dedicated polling place-like environment. The requirements restrict voting systems to dedicated platforms in supervised environments, short-circuiting this concern with broader efforts at Internet voting.
• The requirement for a Voter-Verified Paper Record (VVPR) is warranted. ACCURATE strongly believes that auditability achieved through an independent, indelible audit trail that the voter has an opportunity to correct is an essential part of computerized voting system integrity. The Draft calls for such a record, in the form of a paper record. However, we feel the need to point out that VVPRs are not terribly useful unless audits are conducted using these records to provide regular checks on the correct functioning of the voting system.
• The usability and accessibility requirements need work. ACCURATE noted that there are no accessibility requirements in the Draft and the usability requirements seem hastily assembled from a previous standards effort. In our comments, we discuss how attention to usability and accessibility is key during the development stages of new technology and go on to recommend that some additional usability testing and requirements be added to the draft.
• There have been significant improvements in security specification and testing. The Draft does a good job at improving upon some of the security specifications and testing that we have seen in the past. We are encouraged to see threat modeling and penetration testing adopted in the draft requirements and we recommend a few changes that would make them even stronger.

Voting systems are certified at the national level to a set of standards–the VVSG–by the U.S. Election Assistance Commission (EAC). The EAC recently adopted a second avenue for certifying voting systems for use in pilot programs, called the Voting System Pilot Program Testing and Certification (VSPPTC) program. A critical piece of the VSPPTC program is the adoption of the VSPPTC manual, a manual and set of policies that will govern how, when and what voting system manufacturers can submit for pilot voting system testing and certification.

The EAC made this manual available for a 15-day public comment period that ended today and we submitted comments (In 2006, ACCURATE submitted public comments on the original manual for the larger testing and certification program).

From our comment submitted today:

The Draft Manual does an admirable job of incorporating some of the features of a feedback-rich pilot testing process, but we believe that it can and should go further. Our recommendations fall into four categories. First, the EAC should amend the Draft Manual to provide more details about what separates pilot certification from certification under the current, VVSG-based certification program. Specifically, the EAC should clarify what qualifies as a voting system pilot program, how it will decide whether to allow a manufacturer to pursue pilot certification for a given system, and what conditions are attached to pilot certification. Second, the pilot certification program should accept feedback from, and establish a systematic process for responding to, voters. Third, the EAC should strengthen the Draft Manual’s provisions for engaging with manufacturers at the system design stage and feeding data from pilot elections back to the design stage. Finally, the EAC should address the question of balance between piloting relatively mature systems and permitting pilots to force potentially major changes in pilot system design. This involves questions of the time and expense involved in pilot certification.

Our comment goes into detail about what we think could be improved in the VSPPTC Manual and how the unique nature of pilot voting systems provide opportunities and pose risks different from more mature voting technology.

The Program Chairs of the 2010 Electronic Voting Technology Workshop / Workshop on Trustworthy Elections (EVT/WOTE’10), Doug Jones (University of Iowa), Jean-Jacques Quisquater (Université Catholique de Louvain) and Eric Rescorla (RTFM, Inc.) have released the Call For Papers for this year’s conference.

The due date is April 16, 2010, 11:59 p.m. PDT… send in your best work!

Takoma Park, Maryland, for its local election today, is embarking on something of a radical experiment. They’re using Scantegrity‘s verifiable voting technology. The “normal” voter’s experience is that they get what looks like a standard optical-scan bubble ballot, but the bubbles have invisible ink in them that reveal a code when the voter selects the bubble with the proper pen. Voters can optionally write down these codes and use them later to verify their ballot appears on a public web site, yet without being able to prove how they’ve voted to anybody else. MIT Tech Review has nice summary of how it works.

Cryptographer Ben Adida, who is unaffiliated with the Scantegrity project or any other party in the election, has agreed to act as an independent auditor of the election. Working from nothing but the public specifications of how the system works, he’s independently verifying that the results are correct.

It’s important to note that, for this particular election technology, the votes are being cast on traditional paper ballots that could always be counted, recounted, or otherwise inspected manually. That’s not strictly necessary for election security — our own VoteBox system works more like a paperless electronic voting system and has the same security guarantees as Scantegrity — but it’s essential when rolling out a new technology where a real election with real politicians’ careers is at stake. We need to know that real elections can be really verified, and we need a fallback position if the crypto somehow goes wrong.

Of course, for these technologies to truly get out of the lab and into the field, we can’t expect Ben Adida to personally verify every election, worldwide, nor should we trust him to. What we can expect is that tools that Adida and others like him build will be picked up and used by local election watchers, party officials, news outlets, and the like. We’re not there yet, but we’re on our way.

(Note: Truly, the first ever binding e2e election was a web-based election for the president of a Belgian university, based on Adida’s Helios system (full paper). This used similar cryptographic mechanisms, but no web-based election system can ever have the coercion resistance or privacy guarantees of voting in a classical voting booth.

Edit: The University of Ottawa Graduate Students Association had a binding e2e election in 2007 using PunchScan, a predecessor to Scantegrity.)

A Center for Correct, Usable, Reliable, Auditable and Transparent Elections (ACCURATE) submitted public comment today to the U.S. Election Assistance Commission on their draft Voluntary Voting System Guidelines, version 1.1 (VVSG v1.1). The VVSG provides national certification requirements and testing protocols for voting systems against which many states require their voting systems to be certified.

Read the rest of this entry »

As part of the 2009 Electronic Voting Tech Workshop/Workshop on Trustworthy Elections (EVT/WOTE 2009), we would like to hold a system demonstration session. We envisage this session as an opportunity for workshop participants to examine and “play with” voting system implementations (or functioning prototypes). The format will be similar to a poster session, with space allocated for each system and participants walking between the different demonstrations. The demo session is mainly aimed at new or non-traditional voting systems (such as implementations of end-to-end verifiable systems), but if space allows we may also include demonstrations of existing systems.

If you would like to demonstrate a system, please email the following details to the EVT/WOTE chairs (evtwote09chairs@usenix.org):

Read the rest of this entry »

Join us in Montreal, Canada, August 10–11, 2009, for the 2009 Electronic Voting Technology Workshop/Workshop on Trustworthy Elections (EVT/WOTE ’09).

This year, the organizers of the USENIX/ACCURATE Electronic Voting Technology Workshop (EVT) have merged EVT with the IAVoSS Workshop on Trustworthy Elections (WOTE) to create a joint two-day workshop (EVT/WOTE ’09). EVT/WOTE seeks to bring together researchers from a variety of disciplines, ranging from computer science and human-computer interaction experts through political scientists, legal experts, election administrators, and voting equipment vendors.

The program features a keynote address by Lawrence Norden, Brennan Center for Justice at NYU School of Law; system demonstrations; and sessions on usability, security, trustworthy elections, forensics, and more.

The full program can be found at http://www.usenix.org/events/evtwote09/tech/

Read the rest of this entry »

The call for papers is now available for EVT/WOTE ’09 (August 10–11, 2009; submissions due April 17, 2009).

This year, the USENIX/ACCURATE Electronic Voting Technology (EVT) workshop and the IAVoSS Workshop on Trustworthy Elections (WOTE) have merged into a single two-day workshop, co-located with USENIX Security ’09 in Montreal. The combined Workshop will feature distinct EVT and WOTE sessions; accepted papers will appear in a joint Proceedings (grouped by session). Please see the EVT/WOTE ’09 page for more information.

Our 2008 Annual Report is available. The report highlights the Center’s major accomplishments and activities from 2008.

In the news, we’re seeing a number of reports concerning “vote flipping.” The story, as typically reported, is that voters are attempting to vote for one candidate but observe that the machine “flipped” their vote to the other candidate. For touch-screen voting machines, the most likely cause of this issue is miscalibration of the screens (or, perhaps, a voter who is significantly taller or shorter than the person who did the calibration, since different angles of view require different calibrations). I wrote a detailed explanation of this issue two years ago.

UPDATE: Barbara Ballard, a usability expert with Little Spring Designs offers some excellent advice about how to configure touch screen button layouts to minimize or eliminate the parallax issues that seem to induce or exacerbate vote flipping.

UPDATE 2: Matt Blaze writes how miscalibration of touch-screen voting machines could be used as a mechanism to disenfranchise voters.

A related issue concerns reports of vote flipping on the Hart InterCivic eSlate voting machine. These machines do not have touch-sensitive screens, so therefore poor calibration cannot explain the voter confusion. Since my home county uses eSlates, I went to vote early, this morning, and paid careful attention to how the user interface works. For those unfamiliar with eSlates, the voter’s primary interface to the machine is a dial-wheel and an “Enter” button, which operates in a manner that would be quite familiar to users of Apple’s iPod. You turn the wheel and it highlights successive entries. You press the Enter button and it indicates your selection graphically. Using some HTML tables, I’ve attempted to recreate the salient details below.

Read the rest of this entry »