Trusting Software with Money

Hard Facts
about Diebold ATM
Soft Voting
“Reduce risk exposure with
enhanced automated teller
machine (ATM) modules
David E. ‘Dave’ incorporating the latest in fraud-
preventive solutions.”
University of Virginia
Department of
Computer Science

Trusting Software with Money Trusting Software with Life

“Fly-by-wire”
Avionics
Software Slot
Software-guided
Machines
Surgery

Why not trust software with votes?

Accountability and
Auditability
 Why Voting Is Hard
m
ste
Sy Accountability
Serious Regulation

Transparency Privacy
Gradual Deployment
and Close Monitoring

s
al
Non-provability

du
Trained Operators

vi
di
In
1952 Election

How did we get here?

Univac predicts big win for Eisenhower

Florida 2000 HAVA 2002

• $3.8B for states to replace punch card
and lever machines
– To receive money, state must produce a
plan to replace machines by first 2006
election
• Replacement machines must:
– Notify voters of overvotes
– Be accessible to disabled (including
blind) voters (at least one per precinct)
 HAVA Paper Trail? Software Voting (DRE)
SEC. 301. VOTING SYSTEMS STANDARDS.

(a) Requirements.--Each voting system used in an election for • Direct-Recording Electronic voting
Federal office shall meet the following requirements: machine
(2) Audit capacity.--
(A) In general.--The voting system shall produce a record with • Records votes as bits in memory
an audit capacity for such system.
(B) Manual audit capacity.-- • Prints out paper at end of election
(i) The voting system shall produce a permanent paper
record with a manual audit capacity for such system. (vendors claim this satisfies HAVA)
(ii) The voting system shall provide the voter with an
opportunity to change the ballot or correct any error Good things:
before the permanent paper record is produced.
(iii) The paper record produced under subparagraph (A) • Unambiguous record
shall be available as an official record for any recount • Prevents overvotes
conducted with respect to any election in which the
system is used.
• Audio interface for blind

Hopkins/Rice Report
• July 2003: Tadayoshi Kohno, Adam
Stubblefield, Avi Rubin, Dan Wallach
• Analyzed code for Diebold AccuVote-TS
DRE voting machine
– Many security vulnerabilities
– Ridiculously poor software quality
– 50,000 lines of code
• Maryland hires SAIC to analyze machines
(concludes: “high risk of compromise”)

US Voting Laws Virginia 2006

• 17 different types of equipment used
statewide
– Albemarle: Sequoia AVC, EDGE
– Lynchburg: Diebold AcuVote
– Montgomery, Roanoke: WinVote
• No paper trail
• “Recount” means print out the totals
again
Paper ballot required (27) Legislation Proposed (12)

http://verifiedvoting.org/article.php?list=type&type=13
 Virginia 2006
Voting machines in Alexandria,
Falls Church and Charlottesville
cut off Jim Webb’s last name
(“James H. ‘Jim’”)

“We do have people complain and say they don't get it,
I completely understand what they're saying, but it's not
something I can control.” – Sheri Iachetta,
Charlottesville general registrar
“If I have to personally get on a plane and bring Hart
InterCivic people here myself, it’ll be corrected.” –
Jean Jensen, Secretary of Virginia State Board of
Elections (promising to have it fixed by 2007)

Sarasota, FL 2006 Pennsylvania 2006

• Christine Jennings (D) lost by 373 • Polling hours extended due to
votes out of 237,861 machine problems
• 18,000 voters no vote (13% • Santorum (R) lost senate election
compared to 2% in other counties) • Republican State Committee claims
• Hundreds of voters claim to have 27 counties had voting equipment
selected Jennings, but nothing malfunctions
selected on review page – Changing votes from Santorum to Casey
• “Recount” underway

How do I know my voting equipment is accurate?

Under the Code of Virginia, the State Board of Elections
must approve any mechanical or electronic voting
“Independent” Testing
system or equipment before it can be used by any
locality. • Done by ITAs paid by vendors
Each system must successfully complete three distinct • No vulnerability analysis
levels of testing:
1. Qualification testing (testing of hardware and
• No source code analysis
software that may be conducted by Independent
Testing Authority);
2. Certification testing (to ensure it meets all applicable “Program testing can be used to show the
requirements of the Code of Virginia); and, presence of bugs, but never to show their
3. Acceptance testing (conducted by the locality to absence!” - Edsger W. Dijkstra
assure it meets their needs and is identical to the
certified system). (Note: the machine in the video passed all the tests just fine…)
www.sbe.virginia.gov/cms/Election_Information/Election_Procedures/Index.html
 Joint Subcommittee Studying
Virginia Bills
Voting Equipment
• SB424 (Devolites-Davis), HB1243
• Initiated in 2004 (Tim Hugo):
• Bill to add 2 citizen members with – Requires voter-verifiable paper record
“computer security expertise” (Feb – Random audits
2005) – Disclosure of machine source code
• 5 Meetings (through Jan 2006) – No wireless capability
– Remarkable citizen participation • Proposed in January 2006, held over
– Testimony from Justin Moore, Paco Hope to 2007 legislative session

The core of our American democracy, members, is the right to vote.

And implicit in that right is the notion that that vote be private, that
vote be secure, and that vote be counted as it was intended when it
Questions
was cast by the voter. I think what we're encountering is a pivotal
moment in our democracy where all that is being called into
question - the privacy of the vote, the security of the vote, and the
accuracy of the vote. It troubles me, and it should trouble you.
…
You know it’s very interesting that, recently when I made the
decision to require a paper audit trail, a number of county officials
very respectfully denounced them and a number of vendors, many
of whom are represented behind me, said it wasn't necessary, said
their machinery was secure. At the same time, a number of those
within the community, the voter advocacy community, have oft
times alleged Armageddon if we don't make immediate changes.
Well you know, I don’t know who’s right. I'm like the average voter.
I don’t know. And because I don’t know, I want the confidence David Evans
that a paper trail provides. evans@virginia.edu
Kevin Shelley http://www.cs.virginia.edu/evans
(then Secretary of State of California)