Vote on e-Voting Machines
  by Thomas M. Stockwell

Beyond the hype of the election, IT is on the line with e-voting.

Published November 2004
  

Tomorrow, November 2, 2004, we'll see the culmination of the e-voting efforts that have preoccupied state election officials across the United States for the last four years. It has been an IT effort of unparalleled sensitivity, garnering national media attention. Yet, on the eve of the 2004 Presidential election, it is still unclear if the various voting systems employed by the states and municipalities will prove to be a boon to the cause of democracy or one more contentious element in a very close and highly contentious election. Tomorrow, we will all find out.
Election Officials and Machine Vendors Sensitized

Voter advocacy groups and security experts have become highly sensitized to the issue of e-voting. These groups' highly publicized criticisms of e-voting machine manufacturers have likewise sensitized election officials and have spawned legal challenges to the use of the machines across the nation. Central to their concern is the security of networks and the proprietary software that runs on the e-voting machines.

Three months ago, the U.S. Election Assistance Commission called upon vendors of e-voting machines to submit their code to the National Software Reference Library (NSRL). The commission wants to have a record of the actual versions of software code that are being used in the election so that possible questions about the integrity of the e-voting process can be adjudicated.

But the vendors of the various versions did not want this to happen. Their code is proprietary, and they don't want it released to anyone. Nonetheless, last week, five of the e-voting machine vendors finally acquiesced and announced they would cooperate by providing their proprietary source code to the reference library. These vendors were Diebold Inc., Election Systems and Software Inc., Hart InterCivic, Sequoia Voting Systems, and VoteHere.
Security Still a Question

However, a number of security experts and voter advocacy groups still remain skeptical. Avi Rubin, a professor at Johns Hopkins University and a leading critic of the e-voting security controls, calls the NSRL reference library "smoke and mirrors." The real threat to the election, he said, is that if "the code is already rigged, storing the hashes only guarantees the malicious code will be there if the hashes match." In other words, the fact that the NSRL has a copy of the source code will not guarantee that the code itself isn't malicious, flawed, or insecure. By the time the code might be analyzed in a post-election challenge, the results of the electionwhether legitimate or notwill already have become a fact.

Whether such flaws exist in e-voting machines is less a concern than the potential for challenging any results that come out of the process. If election officials cannot vouchsafe that the results are accurate, a major blow will have been struck at the heart of a free election system.
Will the Hardware Stand Up?

Beyond these underlying security issues are unresolved questions about the e-voting equipment itself. Thirty-two states have been allowing citizens to vote at the polls early (since October 18), and a variety of mechanical problems have surfaced. These problems range from machines "hanging" to inaccuracies in how the touch-screen ballots were calibrated to the votes that were recorded. Moreover, in Florida, Colorado, Tennessee, and Texas, as well as two-thirds of the counties in Georgia, election offices have already reported telecommunications connection problems between their early voting sites and the central server where the voter registration databases reside. How these connection problems were resolvedor even if they were resolvedis still unclear. There is not even a standard reporting process to report such problems on a national level. What is clear is that some voters were turned away or gave up as long voting lines grew longer while the e-voting machines were rebooted and/or repaired.
Early e-Voting Beta?

In one respect, we in IT are very familiar with the problems that can crop up when such a massive electronic network of machines is first implemented. Some IT professionals liken the early voting process to putting the entire system of democracy out for a beta test. They see early voting as a way for election officials to try to wring out the potential technical problems with the systems before tomorrow's election crush. Yet no one seems to have asked the early voters themselves how they felt about being in a beta test to elect their national and local governmental leaders.

For those of us in other areas of IT, the idea of beta testing with live voter data seems like a dangerous trend. It's something that the CFOs of our companies would never knowingly permit. Imagine taking orders for manufactured goods with a system that's largely untested and contains known and unknown security flaws. Imagine trying to get the results of this kind of system past an auditor's critical eye.
Vote Value vs. e-Voting Coupons

But the nation has a curious attitude toward the value of an individual vote. On the one hand, politicians and political parties have spent millions of dollars this election cycle to convince, cajole, and convert voters. From that perspective, the value of an individual vote has never been highera new record in campaign spending.

On the other hand, election officials are being trained by the current equipment and software to cavalierly discount the need for security in the systems that record each voter's decision. The process itself has reduced a citizen's franchise to a digitized piece of information. What's of prime importance is delivering a cost-effective means of meeting the requirements of the democratic process. The election itself is the most labor-intensive part of that process and, from management's perspective, the part that matters least.

In fact, in some states, even the idea of permitting the citizen to keep a physical receipt for a ballot that has been cast has been ridiculed. Consequently, this featurean established tradition and a guaranteed audit trail for the voterhas been eliminated as "too costly" to implement in some e-voting systems.
Is Voter Apathy a System Problem?

It's no wonder that many non-voting citizens complain that "it makes no difference who I vote for!" The observation is more than just a condemnation of the politicians who run for office. It's also a condemnation of the election information systems themselves.

As a nation, e-voting machines are teaching our election officials to treat ballots like ad coupons delivered in the Sunday newspaper: valuable only if a politician can round them up and get them counted by the machines. From this perspective, it would seem that the voter's franchisethe basis of our democracyis worthless piece of 1s and 0s unless it's redeemed by this equipment that is untested and untrustworthy. Such a perspective runs counter to what we have been taught in schools. Certainly, it's not what we hope democracy has become.
18th Century Values on 21st Century Machines

Ultimately, our experiences casting ballots tomorrow will be a reflection of a 21st century technology that is trying to capture 18th century values, the values that declare that all individuals are created equal and that each of us has an inalienable right to have a voice in choosing our leaders. Consequently, how we in the IT industry have automated that voice will be on trial tomorrow, for better or worse. Many of us are worried.
MC Mag Online Poll and Forum Posting

Regardless of your views of the process or the political candidates who are on the ballot, we at MC Press encourage you to experience this new e-voting system firsthand. Get out there tomorrow and test that system out! Punch the buttons, touch the screen, and put our democracy through its paces. Then, come back here and tell us what you've found out.

We invite you to return to this article tomorrow, after you cast your ballot to vote on e-voting. Tell us how it went. Was e-voting a success? What else needs to be done? Did you see security issues that concerned you? Were you satisfied that this is the system that we need for electing our leaders? Post your comments in the forum space below. We at MC Press Online think you, the IT professional, ought to have your say as well.