OPINION: Voting System Testing and the Enclosure of Transparency

By Warren Stewart / VoteTrustUSA / November 1, 2006

For original article

Voting machine manufacturers keep their technology from public view using non-disclosure agreements and claims of trade secrecy. This posture is incompatible with the manufacturers' access to the public commons, and Congress and state legislatures should put an end to it.

In a recent paper, Joseph Lorenzo Hall of the University of California at Berkeley School of Information described the trend of "enclosure of transparency" in American elections.
Over the course of the nation's history, the mechanisms of the electoral process have become progressively more privatized and more opaque, culminating with the use of entirely electronic voting systems. As Hall writes:

When 'counting votes' consists of running proprietary software to process vote data, voters can no longer 'observe' the canvassing process. Nor can regulators or experts, with whom the public places its trust, easily gain access to and evaluate whether votes are being counted as they were intended to be cast.

The 2000 election was a wake up call that caused many Americans to pay attention to the administration of elections for the first time. Ironically, the public's increasing scrutiny of the election process comes at a time when that process has become increasingly hidden from view. Nowhere is this lack of transparency more evident than in the process through which voting systems are tested and certified for use in elections.

I. Background: The Existing System

Federal standards for voting equipment were first established in 1990.3 In 1994, the National Association of State Elections Directors (NASED) created the first national program to test and qualify voting systems to comply with the standards. Under this initial program, voting equipment manufacturers contract with private laboratories to test proposed voting systems. Those laboratories, referred to collectively as the Independent Testing Authority (ITA), submit reports to NASED. Having completed this process successfully, a given voting system is deemed NASED qualified.4 Most states have made the ITA process and/or NASED qualification a prerequisite of state certification as well.5

The ITA system has been widely criticized. At 2004 Congressional hearings, Carnegie Mellon Computer Science professor Michael I. Shamos testified that "the system we have for testing and certifying voting equipment in this country is not only broken, it is virtually nonexistent."6 He recommended that "[i]t . . . be re-created from scratch or we will never restore public confidence in elections."7 Among Dr. Shamos' first recommendations was that the manufacturers should not pay the laboratories that test their equipment. This arrangement riddles the existing system with conflicts of interest and raises legitimate questions concerning the laboratories' ability to safeguard the public interest. The credibility of the current process has been further damaged by the severe reliability, security, and accuracy problems revealed in a steady stream of academic and governmental studies and in hundreds of cases of malfunctions in electronic voting machinery.8 Most importantly for purposes of this essay, the existing system is governed by secrecy and self-interest rather than transparency and the public good.

II. A Flawed Proposal: Perpetuating Secrecy at the Public's Expense

Thus the community of individuals and organizations concerned about the accuracy and integrity of the election process welcomed the July 2006 announcement that the United States Election Assistance Commission (EAC) would propose a new program for testing and certifying voting systems for use in federal elections. The proposed program,9 released for public comment in October 2006, includes some significant improvements over the existing certification process. However, despite some advances, the EAC's proposed approach is far too deferential to the interests of voting equipment manufacturers and inadequately reflects the interests of the primary stakeholders in the election process - the voters. Most critically, on fundamental questions of transparency and public oversight, it is by and large a continuation of the unacceptable existing system.

The EAC's proposed program perpetuates the secrecy of the testing and certification process. Distrust of election machinery results from the lack of transparency of the software used to administer elections. How does this software convert screen touches or marks on paper to votes intended for a particular candidate? How does it tally those recorded votes? How does an election official know that the recorded behavior of the software reflects the actions of the voters? The answers to these and other questions are hidden behind contracts with rigorous non-disclosure clauses, as well as the manufacturers' assertions that such operational details are trade secrets.

Such claims of secrecy are fundamentally incompatible with the manufacturers' access to the public commons. Unlike patents, which require substantial disclosure, claims of trade secrecy obstruct meaningful oversight of voting systems. The manufacturers are asking the public to deploy private systems for use in the public sphere. The manufacturers granted such access gain the imprimatur of the federal government and substantial financial reward. They should not keep crucial information regarding voting systems from the public that bestows these privileges on them. Ultimately, the consequences of such secrecy include diminished accuracy in elections and reduced competition in the voting machine industry.

The manufacturers are not the only ones who take advantage of the federal imprimatur and prioritize secrecy. Election officials, many of whom have staked their careers on an embrace of unreliable, insecure voting technology, do so as well. NASED president Kevin Kennedy recently stated, "We know the equipment works because it's been qualified to federal standards."10 His conclusion is an empty one. Ample evidence demonstrates that meeting federal qualifications does not mean voting equipment works. The EAC's proposed system does nothing to ameliorate the secrecy problems.

III. Solutions: Legislation and Regulation

North Carolina already mandates public disclosure of voting system software.11 Three of the four major vendors (Election Systems and Software, Sequoia Voting Systems, and Hart Intercivic) have stated publicly that they would meet software disclosure requirements in legislation proposed in California, and a bill that would require voting system software disclosure nationwide enjoys the co-sponsorship of 220 Members of the United States House of Representatives.12 However, the EAC need not await new legislative action. The Help America Vote Act of 2002 (HAVA) grants the EAC authority to "provide for the testing, certification, decertification, and recertification of voting system hardware and software."13 Consistent with this authority, the EAC should require that manufacturers and testing laboratories agree to disclose all evidence supporting the merchantability or fitness for use of systems deployed to administer public elections. Similarly, the testing laboratories should be required to disclose their methods, work, and results to the EAC.

In addition to demanding transparency and public oversight of the vendor-lab arrangement, the EAC should open the testing program to interested, independent parties. While we will never know what defects have been uncovered by the current testing regime, there is an alarming list of security vulnerabilities in voting systems that have passed the current testing process and have been used in elections.14 A recent independent review was highly critical of the test plan of the laboratory that has done the bulk of all voting system software testing.15

Rather than minimal functional testing required for certification to standards, the EAC should sponsor expanded examination and testing by academics and other interested parties. This additional testing could serve to improve and refine the subsequent versions of the voting system standards. The more independent eyes that examine these machines, the more secure our democracy will be.

IV. Conclusion

The current crisis of confidence in the electoral process demands bold actions from the EAC; its current proposal is simply not sufficient. Even without legislative changes, the EAC can take significant steps towards restoring public confidence in the election process by requiring manufacturers to make their systems transparent; by requiring testing laboratories to make their methods, work, and results transparent; and by broadening the testing effort. The EAC should seize this opportunity to promote transparency and public oversight of the way votes are cast and counted in the United States.

* Warren Stewart is the Policy Director of VoteTrustUSA, a nonpartisan election integrity advocacy network. He would like to acknowledge the significant contributions of John Washburn in his preparation of this essay.

1 Joseph Lorenzo Hall, Transparency and Access to Source Code in E-Voting 1 (USENIX/ACCURATE Electronic Voting Technology Workshop, Working Paper, 2006), available at http://ssrn.com/abstract=909582.
2 Id. at 3.
3 FEDERAL ELECTION COMMISSION, PERFORMANCE AND TEST STANDARDS FOR PUNCHCARD, MARKSENSE, AND DIRECT RECORDING ELECTRONIC VOTING SYSTEMS (1990), available at
http://www.cs.duke.edu/~justin/voting/docs/FEC_1990_Voting_System_Standards.pdf.
4 See NATIONAL ASSOCIATION OF STATE ELECTION DIRECTORS, GENERAL OVERVIEW FOR GETTING A VOTING SYSTEM QUALIFIED (2006), available at
http://www.nased.org/ITA%20Information/NASEDITAProcess.pdf.
5 See UNITED STATES GENERAL ACCOUNTABILITY OFFICE, STATUS AND USE OF FEDERAL VOTING EQUIPMENT STANDARDS 7 (2001), available at
http://www.gao.gov/new.items/d0252.pdf.
6 Testing and Certification for Voting Equipment: How Can the Process Be Improved?: Hearing Before the H. Comm. on Science, Subcomm. on Env., Tech., and Standards, 108th Cong. (2004) (statement of Michael I. Shamos).
7 Id.
8 For a review of some of these findings, see Voting Machines: Will the New Standards and Guidelines Help Prevent Future Problems?: Hearing Before the H. Comm. on Science, 109th Cong. (2006) (statement of David Wagner), available at
http://www.house.gov/science/hearings/full06/July%2019/index.htm.
9 UNITED STATES ELECTION ASSISTANCE COMMISSION, DRAFT TESTING AND CERTIFICATION PROGRAM MANUAL (2006), available at
http://www.votetrustusa.org/pdfs/EAC/VSTCProgram Manual DRAFT.pdf.
10 Dan Balz & Zachary A. Goldfarb, Major Problems at Polls Feared, WASH. POST, Sep. 17, 2006, available at
http://www.washingtonpost.com/wp-dyn/content/article/2006/09/16/AR2006091600885.html.
11 See N.C. Gen. Stat § 163-165.7(a)(6) and N.C. Gen. Stat § 163-165.9A(a)(1), available at http://www.ncleg.net/Sessions/2005/Bills/Senate/HTML/S223v7.html.
12 H.R. 550, 109th Cong. (2005), available at
http://thomas.loc.gov/cgi-bin/query/z?c109:H.R.550.
13 42 U.S.C. § 15371(a)(1) (2002).
14 See, e.g., Harri Hursti, Critical Security Issues with Diebold Optical Scan Design, Black Box Voting, Inc. (July 4, 2005), available at http://www.elections.state.ny.us/NYSBOE/hava/
CIBERSecurityMasterTestPlanReview-Version1.pdf
15 New York State Technology Enterprise Corporation, Review of CIBER Master Test Plan and CIBER Security Master Test Plan (Sep. 27, 2006), available at
http://www.elections.state.ny.us/NYSBOE/hava/
CIBERSecurityMasterTestPlanReview-Version1.pdf

Preferred Citation: Warren Stewart, Voting System Testing and the Enclosure of Transparency, 1 HARV. L. & POL'Y REV. (Online) (Nov. 1, 2006),
http://www.hlpronline.com/2006/06/stewart_01.html.