|
Given that other great thread you have going, I want to share with you aspects of the interview I did Wednesday. It is not done by half, not polished, and whatever wasn't covered yet is waiting for me on the tape.
These people knew their stuff.
---
WP = me
BS = Barbara S.
DD = David D.
RM = Rebecca M.
WP: The document, ‘Who Gets To Count Your Vote?’ says, “The ideal voting technology would have five attributes: anonymity, scalability, speed, audit and accuracy. Explain the importance of these five attributes.
BS: Voting has to be anonymous; that’s how we do voting in this country. Scalability means that when you build the system, you have to be able to use it for however many people who come to vote. It might work well for a small number of people, but not work for a large number of people. Speed is pretty clear-cut; it has to be fast and convenient, so there are no long lines of people waiting to vote. Audit means you must be able to know what happened after you vote. You must be able to prove the votes.
DD: Let me clarify here. The basic idea of audits in banks, for example, is that you can reconstruct the results from the original records. In voting that means being able, even if your election system fails, or if you question it, being able to figure out what the vote totals are for an individual candidate from the original records. The original records were the paper ballots.
BS: Accuracy simply means we want to be sure the votes are accurately reported and counted.
WP: How does this Direct Recording Electronic Voting Machine (DRE’s) abrogate any of these five requirements?
BS: We are particularly concerned about auditability…
(snip)
DD: If you look at this auditing problem, there’s an audit gap between the voter’s finger on the touch screen and the record that is made inside the machine. With DRE’s as they currently work, the voter cannot tell what is being recorded inside the machine. What you really need to have is a workable audit trail, when you’ve got this funny anonymous system, is that the voter, before they leave the voting booth, has to be able to check that their vote has been properly recorded.
There’s another company that has a fancy cryptographic scheme called VoteHere. The way they explain some of what we’ve said is that there are two phases to voting where you want two guarantees. One of them is making sure the voter’s vote is correctly recorded. The way they say it is, “Cast As Intended.” The second phase is adding up all the votes from all the precincts, which they call “Counted As Cast.” These fancy schemes deal with the “Counted As Cast” problem very well, and they have various ways to deal with the “Cast as Intended” problem. The more primitive solution that is talked about – what is available now that we can do – is either use a paper ballot system like an optical scan system, where you’re filling out a paper ballot and you just put that in the ballot box, and that’s the voter verified audit record. Or, and this was Rebecca’s idea, is to take the touch screen machines and put a printer on it – in fact, they already have printers – and it will print the ballot, and the voter can look at that to make sure it has the right stuff on it. That then goes into the ballot box.
WP: It strikes me – and you can correct me if I’m wrong about this – but it seems like these things you are describing with the verified voting records technologies are pretty profoundly revolutionary, over and above whatever is going on with these DRE’s. I’ve been voting for a while now. My precinct in Boston uses those old-school monster voting machines where you yank the big lever and the curtain comes across behind you in the booth, and you throw all the vote switches, and you yank the handle back. I don’t have a clue if the machine recorded my vote. I get no verification. I just haul the handle, make the sign of the cross, and hope it got recorded. You are talking about not only making sure that the technology within these systems functions in such a way that the votes are actually recorded, but you’re adding the extra layer – giving the voters verification that their vote has been counted and recorded. Given what happened in Florida, that strikes me as one of the better ideas I’ve heard in a very long time.
BS: I don’t think it is all that revolutionary. I voted on those old handle machines when I lived in New York, and of course there was no way to verify. But there are other systems people use to vote, like optical scans, which have been around for a while. With those, you do see your vote, and you do get a piece of paper. There is no additional technology needed. In the old days, people used paper to vote. Actually, in some sense, the lever machines you use are a step backwards. They took away the ability of the voter to make sure that the vote was at least cast the way they intended.
WP: In Massachusetts, we had an interesting little mini-scandal with these old handle machines after the 2000 election. They realized that the machines, the interior works, hadn’t been cleaned in something like thirty years, and this led to substantial vote loss.
RM: Those traditional lever machines were actually invented by Thomas Edison. They came up with those machines because there was so much vote fraud going on – ballot stuffing and so forth – but the traditional lever machine is fully mechanical. The great thing about them is that you can crack open the back and see how it works. If there is a question whether one specific machine is working correctly, you can open up and look at the gears and the odometers like they have in cars, and you see the gears connected to the levers. It is like looking into a piano – you can watch the hammer strike the string and make the tone.
The problem, and the difference between those lever machines and these new DRE’s, is that the DRE’s are basically using electrons. I actually have a lot more faith in the old lever machines. I can’t open the DRE and look inside and see that the button I pushed on the touch screen is being recorded inside the device. It’s invisible. You can see in the old machines if a lever is connecting to the wrong place, or if there was some foul play.
The other issue is that if someone were going to do some foul play and throw an election, they’d have to go around and mess up an incredible number of those old machines, one machine at a time and one lever at a time. With these DRE’s, if there’s some mistake in the programming – even if it is not intentional, just some bad code – it could affect all of them, the whole quantity of the DRE’s. It might not just be your city. It might be your state. It might be all the DRE’s in all the counties in all the states that were provided by the manufacturer who let the bad code get by them.
WP: Come on, that never happens. Microsoft never has to throw warnings about tens of thousands of flawed programs, about huge gaping security holes in Outlook and so forth.
DD: No, they just distribute 34 megabyte patch files because they never make any mistakes.
(Laughter)
WP: Explain to me what kind of non-malicious errors can manifest themselves in these DRE’s.
BS: Your readers will recall when our spaceship crashed into Mars because one group involved was using feet to measure things and another was using meters. That’s one example, but you might say that this was not a software error. The point is that the code was written such that it didn’t work.
RM: Some of these problems are very simple. The addition of a semi-colon or an equals sign in the wrong place in a line of code can completely change the programming. This would be someone who just slipped up. There are plenty of examples of this happening. In the midterm elections down in Dallas, Texas, people tried to vote on the new touch-screen machines. They found that, no matter where they touched on the Democratic side, it would vote for the Republican candidate. These people were pretty upset, and it just kept happening and happening. In Texas they have early voting, and this problem showed up in the early voting. If this had happened on Election Day, who knows what would have transpired? They might have had to shut down voting in all of Dallas.
The Democratic Party went to court over this. They had affidavits demonstrating that there were machines making this error. Ultimately it was decided that seventeen of the machines were somehow misaligned. I don’t know how that could happen, but it was decided that they were misaligned, and those machines were taken out of service.
WP: What are the names of the companies making these DRE’s?
RM: Diebold, Sequoia and ES&S. Those are the big three.
WP: What kind of testing are these three main companies doing to ensure that the misplaced equals sign, the misplaced semi-colon, the misaligned machine, is not happening?
DD: I’ve tried to find out. What kind of testing that goes on in these companies is something we don’t know. They won’t tell us a thing about their code or what they do to test it.
WP: In ‘Who Gets To Count Your Vote,’ there is a statement that, even when these machines get brought to court, you can’t even see the code.
RM: That was the Sequoia case. I was involved in that. I was the expert witness on that case down in Florida. They would not allow us to see the code.
DD: There is a general theme of secrecy, which is frustrating to me. I understand some of the reasons for secrecy. It is frustrating to be because claims are made about these systems, how they are designed, how they work, that frankly I don’t believe. In some cases, I don’t believe it because the claims they are making are impossible. I am limited in my ability to refute these impossible claims because all the data is hidden behind a veil of secrecy.
What testing do the manufacturers do? Who the hell knows? Once it gets out of the manufacturers, we are reassured by everyone about the qualification process. There is something called the NASED Qualification Process. NASED is an organization called the National Organization of State Election Directors which has affiliated with it something called the Election Center, which I believe is a private organization. The Election Center oversees the NASED qualification process. There are Independent Testing Authorities, though their level of independence is unknown. There are three of them, called SYSTEST, CYBER and WYLE. The conventional wisdom about WYLE is that they deal with hardware and firmware. Some vendors have found out the hard way that they actually deal with all of the software that goes into the voting machine. They are the ones dealing with the software that I am most concerned about.
If you go to their web pages, it says, “If you’d like to know something about us, please go to hell” in the nicest possible way. They refer you to the Election Center, which will carefully explain to you that they scrutinize every line of code. When I was on the California Task Force dealing with all this, along with another computer scientist named David Jefferson, we wanted to know what these Independent Testing Authorities (ITA’s) do. They were all invited. Everybody else on the Task Force, which included some election officials at both the state and local level, and a few people of various political affiliations, wanted to know what these Test Authorities do. So we invited them to speak to us.
SYSTEST came and spoke to us. It turns out that they are one of the small ones. They don’t deal with the big stuff, and they don’t deal with the software inside the voting machines. The other two, which are apparently very close, are CYBER and WYLE. They refused to come visit us. They were also too busy to join us in a phone conference. Finally, out of frustration, I wrote up ten or fifteen questions and sent it to them via the Secretary of State’s office. They didn’t feel like answering those questions, either.
These Test Authorities use the word ‘Certified’ as if it were some magical holy blessing. It’s been ‘Certified.’ Well, what does that mean? We didn’t get any answers. My friend David Jefferson has been involved in internet voting and some other election-related issues for a while now. A couple of years ago, he got the right passwords to call up WYLE and ask them what they do, and he got a description. The basic description, according to David, is that they bake the machines to see if they die. The drop them to see if they break.
And then what they do is run scripts over the computer program to check for bugs. A script is just another computer program to check for superficial things. There is no human involved. They don’t want functions that are too long, and they don’t want functions with multiple exit points. They actually say ‘Modules,’ but they are basically talking about chunks of code. It is basically nothing more than a style-checker, like running a spell-check. The problem with running a spell-check…
WP: …is that you miss the homonyms.
DD: Right. The concept of running one of these style-checkers on a program is, at the end of the day, you know the functions are short and they don’t have multiple exit points. You don’t have any clue if they are doing the right thing at security holes or anywhere else. After this process, there are several other steps. There is something called an ‘Acceptance Test.’ When the machines get delivered to either the state or county government, they power them up and put them through the paces to make sure they work. Basically, they sign a form that says they got the thing and it’s not busted. Before each election, and sometimes after each election, they have something called a Logic and Accuracy Test where, to one degree or another, they will try casting some votes on the machine to make sure they come out right. That’s basically all there is to it.
As a computer scientist, I know that the worst problem that could happen is that you have someone at the company, such as a programmer who knows all the details of the code, or a mysteriously overqualified janitor, who could basically insert something malicious into the code. Given the fat that they are using the ‘C’ programming language, we know that such an act can be concealed. They wouldn’t even have to change the program. They could just change some of the results of the program. Malicious code could be concealed in ways that are practically impossible to detect by any means, and certainly wouldn’t be detectable given what we understand to be the detection and inspection process.
The computer scientist who oversees elections in Georgia told us yesterday that, by Black Box Testing, this logic and accuracy testing, he could catch any malicious code. It is completely ridiculous. If you go to the Microsoft Excel spreadsheet program, and go to row 2000, column 2000 and type a specific thing, you will get something like a flight simulator. The Microsoft programmers, even though it is a firing offense, can slip this stuff into the programming code so none of the testing people can discover it. They are called ‘Easter Eggs.’ If you type ‘Easter Eggs’ into a Google.com search, you’ll get instructions on how to find all these things in Microsoft software programs.
Without even knowing very much about how these systems work, computer scientists know that you can put malicious code into a program, you can change the results of an election, and it can’t be detected by inspection or testing. Period.
RM: You have to give at least some credit to this computer scientist from Georgia. He at least tests these machines. Some states just take the things out of the box from the manufacturer, plug it in and run their hands over it a few times, and then send it off for the voters to use. He, at least, takes the trouble to try and test them out.
DD: Yes. This man does the best testing of anybody in the country. But there is just no way to test for the problems we are worried about. He is doing the best job he can.
|
Printer-friendly format
Email this thread to a friend
Bookmark this thread
(1000+ posts)
Send PM |
Profile |
Ignore
