Transparency and access to source code in electronic voting

EVT 2006 - 2006 USENIX/ACCURATE Electronic Voting Technology Workshop

Volumn , Issue , 2006, Pages

  Hall, Joseph Lorenzo ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER PROGRAMMING LANGUAGES; ELECTRONIC VOTING; OPEN SOURCE SOFTWARE; PUBLIC RISKS; TRANSPARENCY; VOTING MACHINES;

MARKET BARRIERS; OPEN SOURCE BUSINESS MODELS; OPEN-SOURCE CODE; POTENTIAL RISKS; PUBLIC DISCLOSURES; TECHNICAL IMPROVEMENT; VOTING SYSTEMS; VOTING TECHNOLOGY;

OPEN SYSTEMS;

EID: 84871900561     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (73)

1. A note on terminology: There are three important distinctions to make in this discussion. The difference between open source development and releasing commercially developed code under an open source license is important as these are two modes that we see clearly in voting systems (see discussion of eVACs in §7.1).
2. Open source software is software that is usually developed by a team of volunteers and released under generous licensing terms that allow users to exercise a number of rights, such as copying, modification and distribution, which traditional software licenses withhold. (The Open Source Initiative (OSI) issues and Open Source certification mark to software licenses that follow their Open Source Definition: http://www.opensource. org/docs/definition.php.)
3. In contrast to both open source development and releasing software under an open source license, disclosed source code allows a much more limited use of source code, usually for evaluation purposes only and without permissions to make further copies, modify works or distribute. For example, see VoteHere's license agreement: http://www.votehere.net/VoteHere_ Source_Code_License_2.htm.
4. Keller, A. M., Mertz, D., Hall, J. L., And Urken, A. Privacy issues in an electronic voting machine. In Privacy and Technologies of Identity: A Cross-Disciplinary Conversation, Katherine J. Strandburg and Daniela Stan Raicu, Eds. Springer Science+Business Media:New York, 2006.
5. West Virginia allows “open voting” whereby a citizen may choose to show their marked ballot to whomever they choose (W.V. CONST. ART. IV, § 4, cl. 2.). Interestingly, West Virginia also makes it a crime to sell or buy votes.
6. For example, in Cuyahoga County, Ohio - which is not required to provide ballots in non-English languages - there were over 6,000 ballot styles provided to voters in the 2006 primary election. See: Candice Hoke, post to the Election Law listserv, available at: http://majordomo.lls.edu/cgi-bin/lwgate/ELECTION-LAW_GL/archives/election-law_ gl.archive.0605/date/article-63.html
7. Relevant authorities include the Voting Rights Act of 1965, Public Law 89-10 (VRA), The Americans with Disabilities Act of 1990, Public Law 101-336 (ADA), Voting Accessibility for the Elderly and Handicapped Act, Public Law 98-435 and The Help America Vote Act of 2002 Public Law 107-252 (HAVA).
8. Kohno, T., Stubblefield, A., Rubin, A. D., And Wallach, D. S. Analysis of an electronic voting system. In IEEE Symposium on Security and Privacy (2004), pp. 27.
9. The “enclosure” metaphor has also been extended by legal scholars to apply to recent efforts to reduce the amount of material in the public domain. Boyle, J. The Second Enclosure Movement and the Construction of the Public Domain, 66 Law and Contemporary Problems 33-74, Winter-Spring 2003, available at: http://ssrn.com/abstract=470983.
10. For a partial list of bug-finding tools, see: List of tools for static code analysis, http://en.wikipedia.org/w/index.php?title=List_of_tools_for_static_code_ analysis&oldid=58643351 (last visited June 14, 2006).
11. For an example of what can be done with automated source code analysis, see: Ashcraft, K., And Engler, D. Using programmer-written compiler extensions to catch security holes. In SP'02: Proceedings of the 2002 IEEE Symposium on Security and Privacy (Washington, DC, USA, 2002), IEEE Computer Society, p. 143.
12. For an example of work that has used binary analysis techniques to uncover vulnerabilities in executable applications, see: Desclaux Fabrice, Skype uncovered: Security study of Skype, EADS CCR/STI/C, November 2005, available at: http://www.ossir.org/windows/supports/2005/2005-11-07/EADS-CCR_Fabrice_Skype.pdf
13. For early work in this area, see: Beizer, B. Wiley, J. Black Box Testing: Techniques for Functional Testing of Software and Systems, IEEE Software, 13:5, 98- (1996), available at: http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=536464
14. See the discussion of the Hursti II findings in Hall, note 31.
15. Penetration testing (sometimes called “Red team” or “tiger team” attacks) involve a simulated attack on a system where the attack team may know everything (“white box” testing) or very little (“black box” testing) about a system and attempt to compromise it in the same manner as would a malicious actor. These types of exercises are common in the testing and implementation of high-integrity systems. For more on penetration testing rationales and methodologies, see: Open Source Security Testing Methodology Manual, available at: http://www.isecom.org/osstmm/.
16. Parallel monitoring, employed during each election now in the State of California, Washington and soon Maryland, involves randomly quarantining a subset of voting machines on election day and voting on them with fake voters and scripted votes to detect bugs, procedural flaws and evidence of possible malicious activity. For more, see: Douglas W. Jones, Testing Voting Systems: Parallel testing during an election, The University of Iowa, Department of Computer Science, available at: http://www.cs.uiowa.edu/~jones/voting/testing.shtml.
17. For example, Carnegie Mellon University's Computer Emergency Response Team (CERT) is a computer security incident tracking and response service, see: http://www.cert.org/. In response to a question asked by the author at the NIST Voting Systems Threats workshop, EAC commissioners Davisdson and DeGregorio expressed interest in setting up a similar service and process for computerized voting systems.
18. ACCURATE. Public comment on the 2005 voluntary voting system guidelines, 2005, available at: http://accurate-voting.org/accurate/docs/2005_vvsg_comment.pdf
19. More Than 4,500 North Carolina Votes Lost Because of Mistake in Voting Machine Capacity, Associated Press / USA Today, November 5, 2004, available at: http://tinyurl.com/3nhfw.
20. NASED letter, “Voting System Memory Card Issues”, March 22, 2006, available under “certification” at: http://www.nased.org/.
21. The set of federal standards that are in effect at the time of writing are the FEC's 2002 Voting System Standards (2002 VSS). The EAC's 2005 Voluntary Voting System Guidelines (2005 VVSG) have been approved by the EAC but will not go into effect until January 2008. See: http://guidelines.kennesaw.edu/vvsg/intro.asp.
22. Kim Zetter, E-Voting Tests Get Failing Grade, Wired News, November 1, 2004, (article notes that ITAs cannot discuss specific systems due to NDAs with vendors) available at: http://www.wired.com/news/evote/0,65535-2.html.
23. ITAA letter to Assemblymember Tom Umberg, “OPPOSE: AB 2097”, March 22, 2006, on file with author. Similar sentiments were expressed in written testimony to a California State Senate Committee on Elections hearing in February of 2006; see: http://tinyurl.com/rsk5e.
24. Mercuri, R. T. and Neumann, P. G. Security by obscurity, Communications of the ACM 46:11, 160 (2003) available at: http://doi.acm.org/10.1145/948383.948413;
25. One of the best discussions of the notion of “security through obscurity” is available on the Wikipedia page for the term. See: Security through obscurity: http://en.wikipedia.org/w/index.php?title=Security_through_obscurity&oldid=58172204 (last visited June 14, 2006). Full disclosure: the author is one of the many editors of this Wikipedia page.
26. Lipner, S. B. Security and source code access: Issues and realities. In SP 00: Proceedings of the 2000 IEEE Symposium on Security and Privacy (Washington, DC, USA, 2000), IEEE Computer Society, p. 124.
27. Joseph Lorenzo Hall, “Background on Recent Diebold Election Systems, Inc. (DESI) Vulnerabilities”, National Committee for Voting Integrity Briefing for Congressmembers and Staff (2006), available at: http://josephhall.org/papers/DESI_vulns_background_briefing-20060607.pdf.
28. Security Analysis of the Diebold AccuBasic Interpreter, Voting Systems Technology Assessment Advisory Board (VSTAAB), February 14, 2006, available at: http://ss.ca.gov/elections/voting_systems/security_analysis_of_ the_diebold_accubasic_interpreter.pdf;
29. Linda H. Lamone, Administrator for the Maryland State Board of Elections, letter to Diebold Election Systems, Inc. CEO, available at: http://truevotemd.org/images/stories//ll-diebold.pdf. (discussing official's concern and reserving the right to hire an independent expert of their choice to review source code)
30. There have also been movements to obviate the need for increased transparency, such as the move to require voter-verified paper records (VVPRs). At the time of writing, there are currently 26 states that have enacted legislation requiring Direct-Recording Electronic voting machines to produce a Voter Verified Paper Record to provide an independent check on the voting system's recording functions. See VerifiedVoting.org's Legislation Tracking page: http://verifiedvoting.org/article.php?list=type&type=13.
31. Other provisions relevant to public scrutiny and expert evaluation include: Vendors must establish a California County User Group and hold one annual meeting where the system's users are invited to review the system and give feedback and volume reliability testing of 100 individual voting machines under election-day conditions. See: California Secretary of State, “10 Voting System Certification Requirements”, available at: http://ss.ca.gov/elections/ voting_systems/vs_factsheet.pdf.
32. “[T]he Legislature hereby requests the Secretary of State to investigate and evaluate the use of open-source software in all voting machines in California and report his or her findings and recommendations to the Legislature.” See ACR 242, as chaptered, available here: http://www.leginfo.ca.gov/pub/03-04/bill/asm/ab_ 0201-0250/acr_242_bill_20040831_chaptered.html
33. Office of the California Secretary of State, “Open Source Software in Voting Systems”, 31 January 2006, available at: http://ss.ca.gov/elections/open_source_report.pdf.
34. See AB 2097, “An act to add Section 19213.5 to the Elections Code, relating to voting systems, and declaring the urgency thereof, to take effect immediately.”, available at: http://leginfo.ca.gov/pub/bill/asm/ab_2051-2100/ab_ 2097_bill_20060217_introduced.html.
35. See §163-165.7(c), available as passed by both houses of the NC Legislature here: http://www.ncga.state.nc.us/Sessions/2005/Bills/Senate/HTML/S223v7.html.
36. Diebold Election Systems, Inc. was concerned that, among other things, it didn't have the rights to provide access to the source code of third-party software components of its system. It sued the North Carolina Board of Elections to prevent this regulation from taking effect. The case was dismissed as the Court found that there was no dispute as to the language or interpretation of the statute. See: Diebold v. North Carolina Board of Elections, unpublished (NC. Super. November 30, 2005), available at: http://www.eff.org/Activism/E-voting/diebold_order_dismissal.pdf.
37. Wisconsin Assembly Bill 627, as introduced, available at: http://www.legis.state.wi.us/2005/data/AB-627.pdf.
38. Wisconsin Act 92, available at: http://www.legis.state.wi.us/2005/data/acts/05Act92.pdf. The author knows of at least eight states with escrow requirements in regulation or statute (CA, CO, IL, MN, NC, UT, WI and WA).
39. Unfortunately, it is unclear how many states actually escrow software; some states use the National Institute of Standards and Technology's (NIST) National Software Reference Library (NSRL) as a form of “escrow”. However, the NSRL stores binary versions of software products, not source code. See: http://www.nsrl.nist.gov/. The conditions for when escrowed software can be accessed and by whom vary but generally protect proprietary information from public disclosure.
40. There has been no federal electoral legislation since the passage of HAVA in 2002. At the time of writing, there are at least six bills - excluding companion bills - in the U.S. Congress that would substantially reform the conduct of elections on top of the reforms of HAVA. These six bills are: H.R. 550 (text is available at: http://thomas.loc.gov/cgi-bin/bdquery/z?d109:h.r.00550:)
41. H.R. 704/S. 330 (text is available at: http://thomas.loc.gov/cgi-bin/query/z?c109:H.R.704: and http://thomas.loc.gov/cgi-bin/query/z?c109:S.330: respectively)
42. H.R. 939/S. 450 (text is available at: http://thomas.loc.gov/cgi-bin/bdquery/z?d109:h.r.00939: and http://thomas.loc.gov/cgi-bin/bdquery/z?d109:s.00450: respectively;
43. note the two versions of these bills contain significant differences), H.R. 533/S. 17 (text is available at: http://thomas.loc.gov/cgi-bin/bdquery/z?d109:h.r.00533: and http://thomas.loc.gov/cgi-bin/query/z?c109:S.17: respectively; note the two versions of these bills contain significant differences)
44. H.R. 278 (text is available at: http://thomas.loc.gov/cgi-bin/query/z?c109:H.R.278:)
45. and H.R. 3910 (text is available at: http://thomas.loc.gov/cgi-bin/query/z?c109:H.R.3910:).
46. VerifiedVoting.org maintains a comprehensive list of these bills and their differences here: http://www.verifiedvoting.org/article.php?list=type&type=13.
47. Congressman Bob Ney, former chair of the Committee on House Administration - which has federal election law jurisdiction - has expressed the sentiment that possible election reform should wait for past legislative action to run its course. See: Speech by Congressman Bob Ney, given at Cleveland State University, Center for Election Integrity on November 30, 2005, available at: http://cha.house.gov/MediaPages/PRArticle.aspx?NewsID=1146. This sentiment appears to be the main cause behind why none of the six bills in Congress have gained much traction. While wise in some respects, this mindset neglects the fact that the time cycles involved in development of computerized voting equipment are much quicker than the timeframes included as deadlines in the statutes.
48. The relevant language in both bills is: “No voting system shall at any time contain or use any undisclosed software.” See: H.R. 550 §247(c)(1) and H.R. 939/S. 450 §101(c). The one-word difference is that H.R. 550 would allow the disclosure to any “person” while H.R. 939/S. 450 only allows disclosure to “citizens”.
49. H.R. 533 §329(a) and §299G.
50. For an appreciation of the variety in open source licensing regimes, browse the Open Source Initiative's (OSI) “Approved License” list http://www.opensource.org/licenses and the Free Software Foundation's web page “Various Licenses and Comments about Them” http://www.gnu.org/philosophy/license-list.html.
51. Open source licensing covers many licenses, some of which are incompatible with each other. Licenses span a spectrum of very simple - like the modified BSD license: http://www.opensource.org/licenses/bsd-license.php - to the very intricate and complex - like the GNU General Public License: http://www.gnu.org/copyleft/gpl.html.
52. Kevin Shelley, Secretary of State of the State of California. Position Paper and Directives of Secretary of State Kevin Shelley Regarding the Deployment of DRE Voting Systems in California (Nov. 21, 2003). See: http://www.ss.ca.gov/elections/ks_dre_papers/ks_ts_response_policy_paper.pdf.
53. Kevin Shelley, Secretary of State of the State of California. Standards For Accessible Voter Verified Paper Audit Trail Systems In Direct Recording Electronic (DRE) Voting Systems (Jun. 15, 2004). See: http://www.ss.ca.gov/elections/ks_dre_papers/avvpat_standards_6_15a_04.pdf.
54. David Jefferson, Chair of the California Secretary of State's Voting Technology Advisory Board, post to the Voting-Project mailing list. See: http://gnosis.python-hosting.com/voting-project/February.2004/0031.html.
55. California Secretary of State Elections Division, Proposed Changes to Accessible Voter Verified Paper Audit Trail (AVVPAT) Standards, January 14, 2005, available at: http://www.ss.ca.gov/elections/voting_systems/012005_1b_s.pdf.
56. See Lipner, note 30; “Fuzz testing” - where software products are bombarded with random input to test reliability - has found that source-available software utilizing open source development techniques is considerably more reliable than closed, proprietary products. See: B. Miller, D. Koski, C. Lee, V. Maganty, R. Murthy, A. Natarajan and J. Steidl. Fuzz revisited: A re-examination of the reliability of unix utilities and services. Technical report, Computer Sciences Department, University of Wisconsin (1995), available at http://citeseer.ist.psu.edu/miller95fuzz.html
57. Here are a few examples: In the Fall of 2004, Diebold sent cease- and-desist letters to a number of students who had published an internal email archive that exposed the fact that Diebold had been using uncertified software on their machines. OPG, Pavlosky & Smith v. Diebold, 72 U.S.P.Q.2d 1200 (N.D. Cal. Sept. 30, 2004) available at: http://www.eff.org/legal/ISP_liability/OPG_ v_Diebold/20040930_Diebold_SJ_Order.pdf. Diebold has also sent letters and a “product use advisory” to Florida election officials warning them of intellectual property limitations on the testing of their voting systems in conjunction with other vendors systems. See Id., note 23, at 21. In North Carolina, in response to the new legislation discussed in §4.3.2, Diebold sued the State Board of Elections arguing that it could not provide source code to third-party software for the evaluation demanded by the new statute (see note 40).
58. Swire develops a model of when disclosing security vulnerabilities will help or hinder system defenders: Swire, P. P. A model for when disclosure helps security: What is different about computer and network security? 2 Journal on Telecommunications and High Technology Law 163 (2004).
59. There are unanswered questions about whether or not Presidential elections can be postponed without amending the Constitution. See: Congressional Research Service, “Postponement and Rescheduling of Elections to Federal Office”, October 4, 2004: http://www.fas.org/sgp/crs/RL32623.pdf.
60. Ruckelshaus, Administrator, United States Environmental Protection Agency v. Monsanto Co. 467 U.S. 986 (1984).
61. The first quasi-open source software product to be used in U.S. elections was ChoicePlus by Voting Solutions. This software has been used to administer local-level ranked-ballot elections in Cambridge, MA since 1998 and Burlington, VT. It was planned to be released under the GNU GPL in November of 2003 but one small, proprietary piece of code has prohibited the full release of the software under the GNU GPL. Interview with Steve Willet of Voting Solutions, April 7, 2006, on file with author; Jay Lyman, Successful public election joins Diebold, free software, NewsForge, April 4, 2006, available at: http://trends.newsforge.com/article.pl?sid=06/03/23/2040258&tid=136&tid=132.
62. The following nations have either posted or claim to have posted voting system software in publicly-accessible forums or to select organizations: Argentina, Venezuela, Estonia and Kazakhstan. See: “Publicación de Software y Documentación”, available (in Spanish) here: http://www.buenosaires.gov.ar/dgelec/index.php?module=pruebaPiloto&file=publicacion
63. See: “Auditorías en Venezuela garantizan la integridad del voto”, available (in Spanish) at: http://www.smartmatic.com/noticias_077_2005-18.htm
64. See (in Estonian): http://www.vvk.ee/elektr/docs/Yldkirjeldus-eng.pdf and documentation/software at: http://www.vvk.ee/elektr/dokumendid.htm, Kazakhstan claims to allow review of the source code used to power their voting systems;
65. it is hard to find. The Kazakh elections website (in Cyrillic): http://election.kz/.
66. Clive Boughton and Carol Boughton, “Credible Election Software - eVACSTM”, white paper on file with author (2005).
67. For example, under §68(1) of Australia's Trade Practices Act of 1974, a disclaimer of warranty is void if it does not follow the particular conventions and wording of the Act. See: Fitzgerald, B., And Bassett, G. Legal issues relating to free and open source software. Essays in Technology Policy and Law (Queensland University of Technology School of Law) 1 (2003).
68. However, as this article goes to press, there are indications that Apple has closed pieces of its software in a strategy to prevent people from running their software on non-Apple hardware. See: Tom Yager, Apple closes down OS X, InfoWorld, May 17, 2006, available at: http://www.infoworld.com/article/06/05/17/78300_21OPcurve_1.html.
69. Coggins, C. Independent testing of voting systems. Communications of the ACM 47:10, 34-38 (2004).
70. The SAKAI project uses this “community source” model, where a consortium of higher educational institutions have started to develop their own course management software instead of paying vendors. See: http://sakaiproject.org/.
71. Molnar, D., Kohno, T., Sastry, N., And Wagner, D. Tamper-evident, history-independent, subliminal-free data structures on PROM storage -or - how to store ballots on a voting machine (extended abstract). In IEEE Symposium on Security and Privacy (2006).
72. Yee, K.-P., Wagner, D., Hearst, M., And Bellovin, S. Prerendered user interfaces for higher-assurance electronic voting. In USENIX/ACCURATE Electronic Voting Technology Workshop (2006).
73. Sastry, N., Kohno, T., And Wagner, D. Designing voting machines for verification. In Fifteenth USENIX Security Symposium (USENIX Security 2006) (August 2006).