The Irish have rejected e-voting. A "Commission on Electronic Voting" found that:
"...experts retained by the Commission found it very easy to bypass electronic security measures and gain complete control of the “hardened” PC, overwrite the software, and thereby in theory to gain complete control over the count in a given constituency,"
And:
"the system does not have a voter-verifiable audit trail (VVAT), argued by many to:
- reassure voters that their vote has been correctly recorded,
- create a disincentive to the manipulation of the system by providing an external check on accuracy,
- enable recovery from a serious system failure;"
The system they were evaluating is the European made Nedap/Powervote but the weaknesses identified sound awfully familiar. The 28 page report shows the standards and procedures that were applied in arriving at the decision to reject e-voting (at least for now). One of their concerns was:
"there has been no parallel testing of the system in a real election, either against the traditional manual system of voting or against an alternative electronic means; such parallel testing is very important for such a critical system as voting at elections: although the system was deployed on a pilot basis in 2002, these elections were not run in parallel with a paper ballot, and the software has been modified many times since then"
Nice idea but parallel testing won't protect you from election day hacking. They talk about access to source code which would be useful but again no guarantee that the code run on election day is the same as tested. If the machines are remotely accessible by modem, cell-phone modem or the internet all the testing in the world is meaningless.
The report is here:
http://www.cev.ie/htm/report/V02.pdfAnd some related articles here:
http://www.ireland.com/newspaper/front/2004/0501/213310571HM1EVOTE.htmlhttp://www.theregister.co.uk/2004/04/30/ireland_evote/