From: \"David A. Wheeler\" \<dwheeler@dwheeler.com\>\
To: Multiple recipients of list \<voting@nist.gov\>\
Subject: Position Statement on electronic voting systems\
X-Sender: 258406\
X-To: voting@nist.gov

Dear NIST,

Thank you for permitting public comment on the very

critical issue of standards for electronic voting systems.

Our democracy depends on election results we can trust,

yet most systems sold today appear designed primarily to

permit easy, untraceable fraud.  Ten thousand election

officials could not stop the single malicious programmer

who sets the election results to whatever he/she wants.

I am an expert in computer security, and I\'m appalled by

the complete lack of standards and processes to protect

our nation. This must change, immediately, and I\'m glad you\'re

investigating standards to build trust and confidence.

At a bare minimum, all electronic voting systems must

implement \"Verified Voting\", as described at:

 [http://www.verifiedvoting.org](http://www.verifiedvoting.org/)

This means that, at a bare minimum:

\* voter-verified paper ballots (VVPBs) must be used

  for all elections (so voters can inspect individual

  permanent records of their ballots before they

  are cast and so meaningful recounts may be conducted).

  Simple \"direct recording equipment\" is completely

  inappropriate for elections, because a programmer could

  display one thing to a voter, and yet report completely

  different information to the rest of the world.

\* electronic voting equipment and all software must be open

  to public scrutiny.  Openness is the only way to

  truly ensure public confidence.  In the short term,

  as a practical matter an exception could be made for

  commercially-available operating systems.  In the long term

  it\'s not clear that this exception is appropriate; there\'s no

  requirement to use unexaminable systems, and voting systems

  are a special case where openness is unusually important.

\* random, surprise recounts should be conducted on a regular basis.

I would add two additional requirements:

1\. There must be separate voting stations and ballot readers,

  where the ballot reader totals are the only official votes.

  This prevents a collusion by the voting station.

  If the unofficial counts of the voting stations and the

  official counts of the ballot readers differ substantially,

  that will be an immediate tip-off that there is a problem

  that can then be investigated.

2\. There should a standard paper ballot format.

  This makes it possible to have truly independent recounts

  using equipment from different manufacturers, as

  well as making it possible to mix-and-match vendor equipment.

  This ability to mix-and-match will allow competition between

  vendors, lowering costs for users, and greatly increasing

  security (because collusion between vendors would be much more

  difficult to pull off).

I would like to see any systems that fail to meet

these minimum standards decommissioned by 2005.

Vendors who fail to quickly improve their systems to meet

these standards should be required to refund at least part

of the money paid, since their products were clearly

inappropriate for the purpose they were sold for.

Thank you very much for your time.

\-\-- David A. Wheeler