Bruce O'Dell: Pull the Plug on E-Voting (Part II)

See also… Bruce O'Dell: Pull the Plug on E-Voting (1)

Here's an indictment of the IT profession, and a fine irony: the degree of independent hand-auditing of paper ballot records sufficient to verify the corresponding computerized vote tallies is comparable to the effort required to more accurately count all the ballots by hand in the first place, dispensing with the machines. But until that day arrives, the programs that the voting vendors actually distribute - as opposed to the software they may say they distribute - will continue to determine who takes power after the votes are tallied.

How does Diebold or ES&S software wind up in my precinct?

Consider that while there are a relative handful of programmers at companies like Diebold or ES&S, there are hundreds of thousands of voting machines out in the field. After a programmer writes a piece of software, compiles it into binary form, and tests it well enough to say it's done and working properly, many additional people - dozens to hundreds of them, in fact - get involved in the long chain of events to get that software out to the polling station and election office, ready to be used.

This highly complex process includes the programmers who write the "application programs" that display ballots and counts votes electronically; the testers who install a copy of the application program as provided by the programmer, to run it for themselves to verify that the specified inputs correspond to the specified outputs; and the software deployment specialists who take a copy as provided by the tester to distribute to their customers (once they're told by management it's good enough to be used by the public).

Deployment specialists package the software so that it can be cloned thousands of times to be installed by vendor field representatives or election administrators on the vast number of precinct machines and central tabulators out in the field.

Vote counting application programs don't just run themselves: there's a vast array of supporting software modules, such as operating systems - rock-solid, dependable products like Windows; device drivers - software that hooks up to input-output devices such as wireless network cards and telephone modems (you did know that voting equipment can be accessed remotely) and firmware - the software that all other software depends on to interact with the physical world. Thousands upon thousands of software modules and hardware components from vendors all over the world all playing some supporting role in vote tallying.

If all this sounds complicated, well, it is. It's awesomely difficult to get this just right even within the relatively safe confines of a private network inside a bank. While Diebold, ES&S and other vendors certainly pay lip service to accepted professional standards of best practice for system development, testing and deployment, there are abundant indications that each link in the end-to-end software process has been compromised.

Software developers and other insiders pose the greatest risk Above and beyond the well-documented criminal records of some of the key programmers who wrote a large portion of our current voting systems (just start at http://www.bbvforums.org/forums/messages/1954/17305.html?1138394704 and go from there), there's ample room for insider misconduct in any organization. My profession has largely failed to adequately inform the public that the most severe security risks in any organization are from insiders. Quoting from Dan Verton's book "Identity Thieves:"' as excerpted at CSO Magazine Online:

The modern American bank has recognized the security risks associated with the new electronic frontier and, as a result, has deployed all the state-of-the-art electronic security devices that one would expect to find in a security conscious enterprise - firewalls, intrusion detection devices, password management systems, and powerful encryption technologies. Yet banks and financial institutions continue to lose millions of dollars every year to trusted insiders who understand where the weaknesses are in the system. In fact, insiders accounted for approximately 70%, or $2.4 billion, of the $3.4 billion that banks lost as a result of both internal and external fraud and hacker incidents in 2004."

Electoral systems grant regulatory power over a $12 trillion economy and access to the world's largest checkbook: the federal procurement budget. By the Willy Sutton rule, voting systems are truly "where the money's at".

Constant, ruthless and highly sophisticated attempts by insiders to subvert voting software should be assumed as a given. And yet a representative from Diebold can still say - with a straight face, and without being laughed out of the room: 'For there to be a problem here, you're basically assuming a premise where you have some evil and nefarious election officials who would sneak in and introduce a piece of software,' he said. 'I don't believe these evil elections people exist.' (New York Times, 5/12/2006)

Testing can't prove software is safe
The second link in the chain - testing - is no better. When it comes to computerized voting systems, internal and field software testers as well as external "certification labs" are one astonishingly lackadaisical and inattentive bunch, judging by the vast array of bugs in the public record (as tallied at http://www.votersunite.org/info/messupsbyvendor.asp and many other places). As a consultant to financial institutions I'd be fired - and then likely sued for gross professional misconduct - if I did my job so poorly and so publicly.

To be fair, of course, although bug reports show voting software testing is mind-bogglingly lax, all any software testing process can do is find problems that testers know to look for and report honestly. There are countless billions of internal states within all but the simplest of programs. Both practically and theoretically, it is impossible through testing to determine that any computer system has no flaws - much less, to rule out the existence of secret backdoor functions to be triggered on a future date. (This is no science fiction; see http://www.bbvdocs.org/reports/BBVreportIIunredacted.pdf ).

Software distribution: a shell game with an invisible pea
It will come as no surprise that the third link from programmer to voter, field deployment, is also wide open to covert manipulation. As soon as the programmer is done typing, software becomes invisible - it lives on as magnetic and electrical impulses on silicon chips, disk drives, memory cards, and CD-ROMs. Specialized software called a "configuration management system" is then used to control which of the many versions of which of the thousands of software components are sent to which device in the field.

This is not a magic process ordained by saints and administered by angels.

Voting software is software distributed through use of software, vouched for by other software, that itself vouches for other software. Surely nothing can possibly go wrong with such a system, even though the highly complex logistics of installing thousands of software modules on tens of thousands of precinct devices and country central tabulators is under the full control of ordinary people fully susceptible to blackmail, greed, or the pursuit of their own ideological agendas.

Did I mention this is done entirely outside public view?

To make things even more interesting, sometimes a lot of voting software is changed all at once with distribution of a brand new version with many new features, while other times, just a few software modules are updated (often called a "patch"). Patches occur especially frequently to poorly-written software; just ask any PC user who pays attention to the pitter-patter of incoming Microsoft security updates. The level of scrutiny that a patch receives is even less than the ordinary lax standard applied to voting software. That there were last-minute patches to voting software in Georgia and Minnesota immediately before the elections of 2002 is indisputable. That may have had nothing at all to do with the surprising outcomes of two US Senate races a few days later... but we can never know for sure.

Pre-Election Slumber Party

Sure, just one vendor insider with access to just one of the master copies of one of the software version or patch distributions can compromise thousands of devices long, before the equipment ever reaches the voter. But you'll be comforted even further to know that even after the devices are readied for an upcoming election, local election officials have a surprising degree of cozy hands-on access to voting equipment. In fact, all over the country -most notoriously in California Congressional District 50 this year - voting machines are commonly brought home by poll workers for "storage" prior to the election. Voting equipment vendors allege that their equipment has tamper-proof seals, while in reality, it takes only minutes using household tools to gain sufficient access to voting equipment to permanently and in practice undetectably alter the software (see http://www.bbvforums.org/forums/messages/1954/36510.html?1158778859 ).

An apology on behalf of the information technology profession
Here's the truth, and the truth hurts: my profession has enabled the development and deployment of voting systems which are obviously and patently unfit for use.

In fact, the whole system of computerized voting in America is so far removed from standard best practices for information technology that I can only conclude that - far from being the product of accidental defects or stupid sloppiness - the vast array of security vulnerabilities found in every type of electronic voting equipment that has ever been independently examined can quite plausibly be seen as deliberate features introduced to subvert the voting process itself.

And so I can only say: I apologize on behalf of my profession, to the American people. You have been so ill-served by those of us who bear the unique responsibility of ensuring that the computer systems upon which our civilization is now almost totally dependent operate in the public interest.

But even knowing what we do know, many of my IT colleagues continue to try to salvage some application of computer technology to voting. To them I say - just look at what we have done in the name of automation. We led the public into this predicament and we owe it to them to help lead the way out. We have an ethical duty to honestly advise the public when most appropriate choice is not to use computers.

Pull the Plug!

So let it be computer professionals who finally help he public to pull the plug on electronic voting.

The most urgent ethical duty facing the American information technology profession is for once to see past our technocentric arrogance and acknowledge that from a whole-systems perspective, computerized voting is surely one of the great blunders in the history of technology. Let us lend our full support to replacing computers as quickly as possible with the worst way of tallying votes - except, of course, for all the others: citizen-run elections using the most appropriate and secure vote tallying technology of all, hand counted paper ballots. While it may take a while to get there, let's start now. This is the least we can do to be worthy of all those who laid down their lives to win and defense our right to vote, the foundation of our freedom.

Don't throw good money after bad: ban computer technology in voting. Put ballots back on paper for everyone, using the VotePAD device for the visually impaired. My profession has talented user interface designers who can craft a paper ballot to meet the needs of the people who fill it out and count it - rather than dumbing it down to accommodate the pitiful limitations of an optical scan program, or making a paper ballot look like a 19th century newspaper to skimp on printing costs. Get serious about security for early and absentee ballots; treat them at least as well as if they were bearer bonds; their true value is, of course, priceless.

Let citizens take control of the election process to cast paper ballots by hand, and count them on election night in the polling place, in public. In the final analysis, we ourselves are the only people we can trust - or should ever trust - to safeguard the Republic.

We, the people, have the inalienable right to run our own elections. Pull the plug.

ENDS

© Scoop Media