Dill: "software bugs, and malicious code" require voter verifiable audit t

[papau]

Voter Verification Newsletter -- Vol 1, Number 10

David L. Dill ([e-mail])
August 25, 2003 http://www.verifiedvoting.org

<snip>...slowing down the process of buying DRE voting systems
because Federal reimbursement funds are not currently available,
and because of security concerns about the machines (especially
those raised in the Johns Hopkins/Rice report;
see http://avirubin.com/vote). In response to security concerns, Ohio is having the machines reviewed by SAIC (who is also doing a review for the State of Maryland, as reported in the previous newsletter) and InfoSentry Services, Inc. ...Sequoia Voting Systems has obtained a court order delaying an announcement of the list of approved voting systems from which Ohio counties can choose, on the grounds that they were unfairly disqualified.

<snip>...I am worried that security evaluations proposed by Maryland and Ohio will focus on problems such as misuse of cryptography and smart cards (from the Johns Hopkins/Rice report), instead of the
essentially unfixable problems that have caused us to call for a
voter verifiable audit trail on all equipment: software bugs, and
malicious code inserted into software before it is distributed.

<snip>...I also met Glenn Newkirk of InfoSentry recently when we both gave presentations for the National Association of State Legislators. Unfortunately, he dismissed worries about voting machine security without responding to the specifics of what I said. Based on what I have seen, I'm skeptical that InfoSentry will look seriously at the most worrying vulnerabilities of DREs. <snip>

...I certainly don't think a clean bill of health should be accepted
without a PUBLIC description of the scope of the review, along with
the conclusions and justifications for those conclusions.

http://www.athensnewspapers.com/stories/082103/new_20030821054.shtml

ILLINOIS..paper trail bill...on the Governor's desk... He signed it!

DIEBOLD STRATEGY ...have hired at least one PR firm....The strategy so far seems to have been to confuse people about the technical issues, while attacking the authors rather than their results. A campaign like this can do some damage, not only to the targets, but to everyone else in the election process includingDiebold itself.
<snip>

ITAA PROPOSAL FOR A VOTING MACHINE VENDORS TRADE ORGANIZATION
http://www.scoop.co.nz/mason/stories/HL0308/S00173.htm

http://www.scoop.co.nz/mason/stories/HL0308/S00175.htm

<snip> A large fuss is being made about a semi-undisclosed connection between Prof. Avi Rubin of Johns Hopkins, who led the highly critical recent study of Diebold's voting machine security, and VoteHere, a company that has a cryptographic voter verification scheme. Rubin was on the "technical advisory board" of VoteHere. In the high-tech corporate world, technical advisory boards are groups of experts who provide technical advice to the company. Members usually receive stock options for a small fraction of a percent of the company's equity. I knew about Rubin's connection because it was on VoteHere's web page, and I thought it was generally well-known....According to Rubin's statement, he then remembered the long-dormant relationship, disclosed it, resigned, and returned the (currently worthless) stock options.

http://www.corporate-ir.net/ireye/ir_site.zhtml?ticker=DBD&script=410&layout=-6&item_id=442090

http://www.sunspot.net/features/bal-to.vote25aug25,0,5240559.story?coll=bal-features-headlines

<snip> The most important point is that, while the Johns Hopkins/Rice study contains opinions, it is based on facts that can be objectively evaluated. Although Diebold claims to have written a "rebuttal", many of the most serious problems discussed in the Hopkins/Rice report cannot be effectively refuted because they are obviously correct.

<snip> Will Diebold publicly disclose:

* Employment of former election officials or regulators as staff,
consultants, or lobbyists?
* Political contributions by executives?
* Financial relationships with or contributions to individuals or
organizations who may have expressed opinions about election
equipment?

[Rhiannon12866]

1. This is going to be a serious problem in the next election

I have heard Greg Palast discuss it at length. Thanks for all the links!:-)

[gristy]

2. I sure wish Dill would call for "paper ballots"

and stop using the term "paper audit trail". The implication with "paper audit trail" is that the paper is used only in an audit. By calling for paper ballots, the implication is that it is the paper ballots that you count in the first place. And recount if need be. Votes should NOT be counted using DRE (Direct Recording-Electronic), paper audit trail or not. We need to be able to suppress/prevent fraud in the very first counting of the ballots, not just in an audit re-count.

Touchscreen (or keyboard-entry) voting machines would be used simply to facilitate the generation of completed paper ballots.

[RedEagle]

3. Always, VOTER VERFIED PAPER BALLOTS deposited in ballot boxes

And, those ballots need to then be deposited, either by the voter or the machine, in a ballot box.

Yes, I agree, paper trail kind of sounds like VoteHere's solution, which might, according to them, allow individual verification, but here's the detail: You can't verify collective counts this way. You can't verify local, county, or state totals. Those are still done "inside" the box.

Uh, Uh, no way.

Folks, always watch the details. Dill doesn't seem to be taking care of the details here. Contact him and let him know how you feel and that if he is going to talk for you, that you want him to say, "Voter verified paper ballots, deposited in a ballot box."

And-

No solution that only invovles individual receipts. These still CANNOT be audited on an election scale. Elections require more than an individual audit, you have to be able to physically gather and count all the votes OUTSIDE of the machine.

Nothing else will do.

Dill has stated he did not want to necessarily limit solutions, but also that paper seemed to be the solution now.

VoteHere is poised to try and "present" an industry wide "solution." That solution ultimately gives us the same thing- a secret vote count.

Don't be fooled.

[Eloriel]

4. Right you are

And the more I am involved in this subject, the more convinced I am that Open Source Code is at least as important as well.

Eloriel

[Rhiannon12866]

5. Thanks for your informed explanation

With another presidential race on the horizon, this is something every voter must be aware of.