Vendors Attack Open Source with Obfuscation, Inaccuracy, Doubt

The Election Technology Council released a white paper: Open Source: Understanding Its Application In The Voting Industry. Professor Dan Wallach explains the flaws in their arguments and understanding of open source.

The Election Technology Council released a white paper: Open Source: Understanding Its Application In The Voting Industry <read>

Professor Dan Wallach explains the flaws in their arguments and understanding of open source: On open source vs. disclosed source voting systems <read>

As Dan suggests we need to rely on experts to understand complex issues.  But not just any expert.  Transparency provides access to all experts.

Nobody has ever suggested that election transparency requires the layperson to be able to understand the source code. Rather, it requires the layperson to be able to trust their newspaper, or political party, or Consumer Reports, or the League of Women Voters, to be able to retain their own experts and reach their own conclusions.

I would suggest that the indsstry paper is aimed at  laypersons, especially election officials and legislators.

Here is an example of a strawman from the industry paper, refuted by Wallach:

… taking a software product that was once proprietary and disclosing its full source code to the general public will result in a complete forfeiture of the software’s security … Although computer scientists chafe at the thought of “security through obscurity,” there remains some underlying truths to the idea that software does maintain a level of security through the lack of available public knowledge of the inner workings of a software program.

Really? No. Disclosing the source code only results in a complete forfeiture of the software’s security if there was never any security there in the first place. If the product is well-engineered, then disclosing the software will cause no additional security problems. If the product is poorly-engineered, then the lack of disclosure only serves the purpose of delaying the inevitable.

In general the industry completely turns everything around.  In Wallach’s words:

As to the “principles of intellectual property”, the ETC paper conflates and confuses copyright, patent, and trade secrets. Any sober analysis must consider these distinctly. As to the “viability of the current marketplace”, the market demands products that are meaningfully secure, usable, reliable, and affordable. So long as the present vendors fail on one or more of these counts, their markets will suffer.

This is just a taste.  There are many more details refuted and a great case made for open source in Wallach’s post <read>

Finally, we point out that CTVotersCount is made possible and more robust by open source software, WordPress.  WordPress has proven quite secure, with a community of  developers ready to quickly address security flaws.  It is also much more robust than proprietary alternatives due to a huge community of developers competing to create valuable add-one features at the rate of several a day.

FL: Internet Voting Skepticism Has Promise

Opponents of Internet voting argue that security risks are too plentiful and blatant to ignore. They point to the threat of hackers and other forms of fraud, as well as glitches that could prevent votes from being counted or result in a miscount.

Those are legitimate concerns. Any efforts to expand the role of Internet voting must be vetted in the most public way possible, open to examination by the nation’s top computer experts.

Editorial, Internet voting has promise, discusses their wish for Internet voting, but in the end correctly points out that it should be subject to “open to examination by the nation’s top computer experts.”

That is all that is asked by the Technologists’ Statement On Internet Voting.

But in the Connecticut Legislature is full speed ahead for Internet voting despite the opposition of CTVotersCount, TrueVoteCT, and the Secretary of the State, Susan Bysiewicz. See HB-5903. Hopefully, the Office of Fiscal Analysis will point out the expense of whatever process is used for Internet voting for each of our 169 municipalities. Our earlier coverage.

Fort Meyers News-Press Editorial <read>

Opponents of Internet voting argue that security risks are too plentiful and blatant to ignore. They point to the threat of hackers and other forms of fraud, as well as glitches that could prevent votes from being counted or result in a miscount.

Those are legitimate concerns. Any efforts to expand the role of Internet voting must be vetted in the most public way possible, open to examination by the nation’s top computer experts.

But it doesn’t make sense that citizens can perform so many other vital transactions online, using Web sites that are trusted to be secure, yet can’t have a secure option for voting online – or at least registering to vote.

We agree that registration and even sending ballots to the Military can be accomplished.  We are less sure of the journalists’ predictions:

Finding a way to incorporate one of the world’s greatest technological advances – the Internet – should only be a matter of time.

Sometimes technology evolves as we wish and sometimes it does not — remember Nuclear Fusion, Toxic Waste Storage…I remember a childhood friend that just kept smoking assuming “scientists will come up with a cure before I get lung cancer”.  I hope he changed his mind and quit.  Unfortunately, when we risk Democracy on  an unproven technology the cure may also be too late.



CT: Courant: “How Stupid Is This?”

Update 1/27/2008:  Courant cartoon incorrectly characterizes Editorial Board view as geek view <view> *****************Original Post******************* Courant Editorial: Three Registrars Is Too Many, Unfunded Mandate  Dumb law sticks it to Hartford <read> How stupid is this? Hartford is in such dire fiscal straits that it has had to lay off or retire scores of workers this … Continue reading “CT: Courant: “How Stupid Is This?””

Update 1/27/2008:  Courant cartoon incorrectly characterizes Editorial Board view as geek view <view>

*****************Original Post*******************
Courant Editorial: Three Registrars Is Too Many, Unfunded Mandate  Dumb law sticks it to Hartford <read>

How stupid is this? Hartford is in such dire fiscal straits that it has had to lay off or retire scores of workers this fall, with more personnel cuts likely to come next year. But because of a quirk in state law, the city will have to shell out $200,000 for a needless third registrar of voters.

The Courant continues its editorial against the checks and balances of having two elected registrars, the idea of three really irks them:

The legislature should change the law as soon as possible so a city can end up with no more than two registrars. We have questioned whether two is too many; three certainly is.

To summarize our earlier posts <here> and <here> we have three areas of disagreement with the Courant:

  • We need checks, balances, and oversight in elections, a fundamental basis of democracy. Other states have proven that other systems can work well (and poorly), but a single elected registrar in each of 169 towns is an open invitation to partisan elections and risks skulduggery.
  • There is some wisdom in the current law. Having a registrar elected from a third party may, as in Hartford, reflect the wishes and the political aspirations of the town. In this case, providing representation and oversight to a large block of progressives, who feel they are left out of the Democratic and democratic process. Yet, also the rest of the state deserves oversight by each of the dominant parties to assure accurate vote totals in regional and statewide elections. A dominant party in a town could launch a scheme to elect two insiders from the same party in order to sideline the other dominant party.
  • Most towns have part time registrars, paid at a rate much below the $80,000 a year in Hartford. Other towns size the job to the responsibility. Two registrars may each work 1/2 or 1/3 time, or less depending on the town’s determination of a balance between costs, the work required, and citizen service. Just the type of creative thinking missing in the Courant and in Hartford. Perhaps that need for creative thinking is exactly what inspires a third party and alternatives to a single dominant newspaper

Times Editorial: Critics Should Not Be Dismissed.

The New York Times in an editorial, That’s a Pretty Big Glitch, nails the issue again <read>

In the early days of electronic voting, critics who warned that it was unreliable were dismissed as alarmist. Now it seems that hardly an election goes by without reports of serious vulnerabilities or malfunctions.

Unfortunately, for the most part, we are still being dismissed by many.

Computer scientists have shown that electronic voting machines are easy to hack. And voters report errors like vote flipping, in which the vote they cast for one candidate is recorded for another. Ohio’s secretary of state, Jennifer Brunner, is suing Diebold over the vote-dropping and noted that its machines crashed repeatedly during last year’s voting in Cuyahoga County.

There is no time left between now and Election Day for states and localities to upgrade their machines or even to fix the vote-dropping software. All they can do is double-check their vote totals, audit their paper trails and be on the lookout for the next, as-yet-undiscovered computer glitch. After that, Congress must require that all states adopt voting systems that include voter-verifiable paper records for every electronic vote cast.

Downsizing Newspaper Recommends Downsizing Registrars

Most of us would agree that Central Connecticut needs more than one daily newspaper. If there was any doubt it certainly was erased this week. On Monday the “New” Hartford Courant came out with its latest and most drastic downsizing. On Tuesday an editorial suggesting among other things that we should have a single elected registrar per municipality. However, downsizing to a single registrar will serve democracy no better than the continuous downsizing of the Courant. <read>

In Connecticut we have two elected registrars, a Democrat and a Republican in each of our one-hundred and sixty-nine towns. When a non-Democrat, non-Republican is elected registrar the law then calls for three registrars. The challenges, the potential problems, and the potential solutions all play differently in large cities, medium cities, and small towns. In large cities the elected registrars can be full time and professional with a professional staff – they can also be political hacks using excessive staffing to reward friends. In small towns they are in effect volunteers, often very part time, underpaid, overworked and often over their head in managing a system that has changed drastically, yet almost uniformly of high integrity and committed to Democracy. We and many others have concerns with this system, but any significant change must be complete and well thought out.

Case in point, Hartford and the Courant’s editorial:

Community activist Urania Petit has petitioned her way onto the Hartford ballot in November as a registrar of voters candidate for the Working Families Party. The party at last count had seven registered voters in the city. But due to a quirk in state law, if Ms. Petit finishes second, the city will have to have three registrars of voters, instead of the normal two, at an additional cost of about $200,000.

This is daft. No city in Connecticut needs three registrars. We don’t even see why they need two.

First, we disagree that the three registrars is a ‘quirk’ in the state law. Its the result of a two party system and two party thinking. Like the Courant we don’t agree with that part of the law, but we disagree with their solution.

Second, the editorial’s lack of imagination is daft. For a city the size of Hartford there should be no problem having three registrars and the costs should be minimal. Each city sets the budget, salary, hours, benefits, and staffing of their Registrars Of Voters Office. Hartford could simply cut staffing and perhaps cut registrars’ hours or salary when three are elected to do the job of two. Just cutting a full time staff position would go a long way toward reducing most of the $200,000.

For ages, municipalities have elected two registrars, virtually always one Democrat and one Republican. Apparently the idea was that they would serve as a check on each other, being from different parties, even though they are supposed to serve in a nonpartisan manner — “nonpartisan before 5 o’clock,” as one registrar put it. The wrinkle comes when a third-party candidate enters the field.

The Courant example demonstrates why two elected registrars are needed. One elected, political registrar by definition is not nonpartisan, would often be prone to partisanship, and would always be suspect. It would create a strong potential for the local equivalents of Ohio’s Ken Blackwell or Florida’s Katherine Harris to arise.

State law says the registrar candidates with the highest and second highest number of votes win the posts. But if a major-party candidate is not among the top two, that candidate is also named a registrar. So, if Ms. Petit outpolls either Democrat Olga Iris Vazquez or Republican Salvatore Bramante, all three must be named registrars.

Secretary of the State Susan Bysiewicz said she could not recall a time when a third-party candidate was seated, but acknowledged that in Hartford “it is very possible.” The overwhelming number of registered Democrats, nearly 33,000, means Ms. Vazquez is a shoo-in. The GOP registration, under 2,000, is still greater than the Working Families’ seven. But the Working Families defeated five of six Republicans in last year’s council elections, electing two candidates to the GOP’s one, in large part by appealing to the nearly 10,000 unaffiliated voters in the city.

Other ‘quirks’ in the election law make it expedient for many voters to register as Democrats in Hartford to vote in primaries, but vote Working Families in the election to actually have their interests represented and keep the dominant party in check.

Here we have the crux of the problem and can see the obvious consequences of a simple solution. Change the law to have two registrars – the two highest vote getters of different parties. In Harford if the Working Families’ candidate wins we would still have the two leading parties represented. As we said earlier it would not be a big deal for Hartford to have three registrars, but for a small town three would seem especially cumbersome.

While we’re at it, why not create one registrar per town?

The post is vitally important, because it involves access to the ballot and voting rights, but in the past was not very complicated. In many small towns, retired people serve as part-time registrars. The level of professionalism varies.

But the job has gotten more complex. There have been numerous changes in election laws in recent years, plus increasing use of technology. Would it not make sense — and save money — to have one highly professional, nonpartisan registrar per town?

I agree with some of the arguments here. Elections could benefit from highly professional, non-partisan management, however, that is incompatible with having a single elected political registrar. Under a different, well thought out system of oversight with checks and balances a better system for Connecticut may well be possible.

Most states outside of New England have county election management by civil service officials. That can and does work. We hear about problems in Ohio, Florida, and California when that system breaks down. We don’t hear about success in those same states and many other states when things go reasonably well. Many of the problems have been under single partisan, elected state and county officials.

In Connecticut, perhaps electing two official registrars paid a small stipend to provide a check and balance over a professional civil service chief election official would provide the best of both worlds and would work for large cities. This would not work for small towns – a single chief election official and staff would need to serve several small towns – a change that would not easily be accepted in New England.

What clearly won’t work is half baked solutions.

Times: Blames the Messinger

We have been complementary of late of the New York Times Editorials that have gotten it right: Nailed Problems With Federal Bill, Three Lessons Learned, and Strongly Favoring Post-Election Audits.

However a story on Saturday gets it wrong and blames the Election Assistance Commission for being slow in approving voting machines – but the problem is that the vendors are not supplying products that are acceptable <read>

Flaws in voting machines used by millions of people will not be fixed in time for the presidential election because of a government backlog in testing the machines’ hardware and software, officials say.

The flaws, which have cast doubt on the ability of some machines to provide a consistent and reliable vote count, were supposed to be addressed by the Election Assistance Commission, the federal agency that oversees voting. But commission officials say they will not be able to certify that flawed machines are repaired by the November election, or provide software fixes or upgrades, because of a backlog at the testing laboratories the commission uses.

“We simply are not going to sacrifice the integrity of the certification process for expediency,” said Rosemary E. Rodriguez, the chairwoman of the commission.

Thanks to John Gideon for articulating the details in the flawed products and the flawed article: <read>

The New York Times has again given a platform to the voting machine vendors to voice their displeasure with a system that is forcing them to actually provide voting systems that are fully tested and certified. The vendors, and some election officials, seem to want to continue the old system of poorly tested and rubber-stamped voting systems counting our votes…

If Diebold/Premier had not presented a voting system that had 79 flaws found during testing and 2 of those being fatal flaws, they might have one of their newer systems certified right now. All of the vendors seem to be having the same issues. Product certification testing is not supposed to be a system of doing alpha and beta testing for the vendors, yet that is what is clearly happening…

The fact is, as Urbina reports, the Government Accountability Office (GAO) has “said the current system left states on their own to discover voting machine problems. The report calls for Congress to revise the Help America Vote Act and provide the commission with the authority and resources it needs to resolve problems with machines that were certified before the commission took over the process.”

Too High A Barrier?

(Without editorial comment, see Editor’s Note)

Hartford Advocate article on the petitioning effort required to get on the presidential ballot: <read>

In a rare show of third party unity, the campaigns of Nader, Libertarian Bob Barr and the Green Party’s Cynthia McKinney, the last two former Congress members, are joining forces across state lines to overcome ballot access rules designed to keep minor party candidates out. The camps are sharing workers, swapping petitions and urging voters to sign up for another third party candidate along with their own. They’ve joined forces in Maine, West Virginia, Hawaii, Pennsylvania and now Connecticut, where Barr submitted 13,000 signatures and McKinney turned in “close to the necessary number,” a Green Party boss says…

Sidewalk petitioning can be thankless work: Campaigns pay workers $1 to $1.50 per signature to stand on baking asphalt, asking irritated grocery shoppers to sign in support of a candidate they’ve often never heard of, or might consider a “spoiler.” Nader’s national ballot coordinator, Christina Tobin of Illinois, arrived in Hartford last week to turn in the fruits of their labor…

…petitioners must carry a form for every town—Andover to Woodstock—which the state then mails to those towns. Another law says petitioners must be state residents, which poses a problem because the most reliable workers are the few paid national staffers who travel from state to state, not local volunteers. Beyond that, requiring 7,500 valid signatures when other New England states require a fraction as many (1,000 in Rhode Island, 3,000 in New Hampshire) disadvantages small-dollar grassroots campaigns, Tobin says.

Secretary of the State Susan Bysiewicz, the state’s top election official, is unsympathetic. She says town officials must validate petition signatures because only they have the original signed voter cards. If something looks suspicious—say, several signatures in the same handwriting—officials need to check the source documents.

Read the entire article for more details and opinion.

WaPo: Fear Mongers (Scare Voters From Registering)

(Without editorial comment, see Editor’s Note)

WaPo Editorial, Fear Mongers, Virginia’s GOP tries to scare new voters away from the polls: <read>

Republicans are increasingly anxious about retaining their hold on a state that GOP presidential candidates have carried since 1968. What is surprising is their utterly baseless charge of “coordinated and widespread voter fraud . . . throughout Virginia.”

That rhetorical hand grenade, lobbed the other day by the state Republican Party chairman, Del. Jeffrey M. Frederick of Prince William County, bears little relationship to the facts. Nor do Mr. Frederick’s attempts to frighten prospective voters by warning that they could be victims of identity theft if they sign up to vote in registration drives by “a whole lot of groups out there that nobody has ever heard of.” In fact, there is not even a whiff of evidence that identity theft is taking place in Virginia under the guise of registration campaigns. Mr. Frederick’s message amounts to a classic attempt to suppress votes.

Times: Feinstein Bill is Bad – First, do no harm!

Update: Senator Feinstein replies to The Times with letter to the editor – that is, with excuses to counter the substance of objections to the bill <read>

Another right on editorial from the New York Times, A Bad Electronic Voting Bill <read>

Some have faith in the “‘hearings” held last week, that were packed with those who may well have written the bill. At least one paper agrees with us and VerifiedVoting.org. From the Times:

Congress has stood idly by while states have done the hard work of trying to make electronic voting more reliable. Now the Senate is taking up a dangerous bill introduced by Senators Dianne Feinstein, Democrat of California, and Robert Bennett, Republican of Utah, that would make things worse in the name of reform. If Congress will not pass a strong bill, it should apply the medical maxim: first, do no harm.

Voters cannot trust the totals reported by electronic voting machines; they are too prone to glitches and too easy to hack. In the last few years, concerned citizens have persuaded states to pass bills requiring electronic voting machines to use paper ballots or produce voter-verifiable paper records of every vote. More than half of the states now have such laws.

There is still a need for a federal law, so voting is reliable in every state. A good law would require that every vote in a federal election produce a voter-verifiable paper record, and it would mandate that the paper records be the official ballots. It would impose careful standards for how these paper ballots must be “audited,” to verify that the tallies on the electronic machines are correct.

The Feinstein-Bennett bill does none of these. It would permit states to verify electronic voting machines’ results using electronic records rather than paper. Verifying by electronic records — having one piece of software attest that another piece of software is honest — is not verifying at all. The bill is also vague about rules for audits, leaving considerable room for mischief. The timeline also is unacceptable. States might be able to use unreliable machines through 2014 or longer.

This bill goes out of its way to placate voting machine manufacturers and local election officials, two groups that have consistently been on the wrong side of electronic voting integrity. Reform groups like Verified Voting, which have done critical work in the states, say they were not allowed to provide input.

The bill would do some good things, including reducing the conflicts of interest that plague the process for certifying voting machines. But the damage it would do is much greater.

Ms. Feinstein introduced a better bill last year, which would have required a paper record of every vote, but she could not get enough support to pass it. If Congress cannot pass a good bill, it should let the states continue to do the hard work — and be prepared to explain to voters why it cannot muster the will to protect the integrity of American elections.

There is still time to call and e-mail our senators. Remember Dodd is on the Committee <e-mail action>

Lou Dobbs Gets It – Deseret News Does Not

We don’t always agree with Lou Dobbs, but he has nailed it on electronic voting and the Feinstein/Bennett bill. Amazingly the Senator goes against her state and also claims she really cannot do anything but this “compromise” bill. She could do nothing, it would be much much better than this bill.

Video: <watch>

Meanwhile in a story we should expect more of by Deseret News <read>

Civil rights groups, state voting officials and computer experts all praised Wednesday a bill

This is hand-picked computer experts out of the mainstream and some advocates accepting large donations from voting machine vendors. Watch Lou Dobbs for a summary that fits more with what mainstream computer experts would all say, if any were invited to the hearing.

“The legislation allows for innovation and experimentation. The legislation sets objectives but does not dictate how the objective is to be achieved,” he said.

This is a star-wars like program of technology that does not exist being funded, aiming cash at vendors, destined to destroy democracy. Be skeptical very skeptical.

More details in our recent post.