MR. WALLACH: Thank you, very much, Mr. Chairman, members of the
committee. My name is Dan Wallach, assistant professor in the department
of computer science at Rice University in Houston, Texas. I have been
working on computer security in one form or another for about ten years.
My focus has always been on software engineering and how one goes about
building robust software in the face of, well, typically the threats
that will be faced by an independent Internet surfer or Internet web
browser, but voting really isn\'t all that different.

What makes voting interesting is that now the developers themselves are
potentially part of the threat model. It\'s not inconceivable to imagine
that a voting machine developer might have a partisan interest in an
election, or that an election official, not that I ever would impugn the
integrity of the fine election officials here, but it is entirely
possible that an election official might have a partisan interest. And
as best they can, they want to be able to produce incontrovertible
evidence that at the end of the day, the person who won, won, and more
importantly to convince the person who lost that they actually lost.
That is a higher burden of proof.

So rather than referring to audits since that\'s, as you pointed out, an
ambiguous phrase, I will refer to evidence, since I think that is a less
ambiguous phrase. So when we\'re talking about collecting evidence of
the voters intent, some of the speakers earlier today focused on
standards to which we might strive. Should we strive for perfect
evidence, should we strive for military grade evidence, or should we
invent some other standard. I think that one of the things that we have
to deal with, as an engineering matter, is we need to deal with the fact
that the software is going to be flawed. We can\'t assume that the
software is perfect, because we simply, as an engineering discipline,
don\'t know how to produce perfect software yet. There are people who
have dedicated their lives to it and they can produce tiny perfect
programs, but nothing of the scale we\'re talking about for election.

As a result as an engineering matter, we need to find a way to
compensate for software that is not perfect, and that\'s where the
voter-verifiable audit trail \-- maybe I should call it voter-verifiable
evidence trail \-- coined a new phrase today \-- where we need to have
some way of preserving evidence or of gaining evidence that might be
robust, even if the software itself is faulty, in some fashion. And
there are a number of different ways one might go about doing that.

I\'d like to briefly give some sense of the diversity of the space here.
The original, voter-verifiable evidentiary trail is the Australian
ballot. Every voter is given the same card, and in an anonymous booth,
they put an \"X\" next to the person they want to vote for, and drop it
in a box. Because it was done by the voter\'s hand, we know the voter
had some positive intent expressed on the card. Of course, there are
some known attacks against this. My favorite is people putting pencil
leads under their fingernails, and the people counting it might be able
to add extra marks. The policies and procedures to address this are, you
require everybody to wear white gloves which, hopefully, helps prevent
the pencil leads under the fingernails, but one of the realities of
elections today is we don\'t have one race, we have 50 of them. I live
in Texas, and we vote on 30 or 40 different judicial and assorted ballot
races, and then a number of constitutional amendments. It is a very long
ballot. You could never do it with \"Xs,\" you need something automated.
So the precinct-based optical scanning system is possibly one of the
better systems that are on the market today because the cost is low, the
transparency is high, and you have the direct indication of voter\'s
intent. And the present optical scanner can compute a tally, and as I
was mentioning earlier, you have this independent way to go back to the
paper, for whatever reason you question the accuracy of the computerized
scanner, the precinct-based scanner.

So now we have computers. Computers are supposed to solve all the
world\'s problems, except computers don\'t always work. There\'s several
different ways you might go about building it. One way you might do it
is to have the machine produce a printed record that the voter could
hold in their hand and read, and then deposit in a ballot box. That is
roughly what Venezuela did. One of the many flaws in the Venezuela
election, for whatever reason the voter felt the piece of paper wasn\'t
an accurate record of their intent, too bad, you still had to drop it in
the box. There was no way for the voter to repudiate a ballot. Clearly,
you need have a procedure for doing that if you used a system where the
voter held a record of their intent.

A second way, the ballot is held under a glass. The voter can\'t touch
the ballot and thus it is very difficult for them to accidentally walk
off with it. Furthermore, the ballot under the glass defeats chain
voting attacks, where a person outside hands you a previous voter\'s
ballot and says "casts this and bring me out the next one." That way,
the shadowy person can insure you vote for who you\'re supposed to,
thereby allow the attack. On the other hand, ballot under glass allows a
machine to perhaps figure out when nobody\'s looking and crank out a lot
of ballots. Likewise, a ballot under glass, if it is done in the way it
was done in Nevada where it is a continuous roll of paper could also
violate voter confidentiality.

Probably the most interesting and least talked about way of doing a
hybrid computer voting system is, for lack a better word, a
computer-assessed ballot marking device, where you get the existing
optical scan ballot, feed it into the computer, and you have a touch
screen computer to indicate your intent, and then it prints back onto
the original optical scan ballot. HAVA requires every precinct to have
at least one accessible machine, so for places that don\'t have a lot of
cash, they can buy one of these devices and have the rest of the voters
mark with pen and paper. They can satisfy HAVA requirements of having an
accessible device, but at the end, they have a system, a precinct-based
optical scanner. That is a way for local, high transparency, good
simplicity. That is something that we think needs to be \-- certainly
should not be ruled out by any standards that are promulgated by this
committee.

So those are a number of different techniques. We also heard from here
from Mr. Chaum, there are some other systems that might have promise in
the future, but I think the benefit of the voter-verifiable audit trail
system today is that they are more compatible with existing statutes and
laws. We can talk about handling ballots and we can talk about how
ballots should be maintained, how their custody should be preserved. And
existing procedures and policies and statutes already govern those, and
can make a system like that more compatible with the existing legal
framework that we have today.

In the future, I would just like to briefly agree with some of the
testimony earlier today about the need for openness. I think it\'s very
important to have an open process, in every sense of the word \"open.\"
I believe that the only thing that should be kept secret in an election
are how the voters actually voted. I believe that the source code should
be a matter of public record. It can still be protected by copyright. I
can\'t just go into business and grab ES&S source code, put it into my
machine and sell it. The source code should be published in the way
books are published, giving anybody who wants the ability to inspect it.
However, I believe that is necessary, but not sufficient. Likewise,
there should be a notion of so-called red team or tiger team analysis
where you have a group like RABA Consulting, hired by the State of
Maryland to perform an attack on the system. They are not constrained by
merely saying that the system meets FEC 2002 standards. Their job is
figure out a way to compromise the election carte blanche, and I think
that should be the standard to which any voting system, paperless,
computerized, anything, should be held.

I think that, more or less, covers what I would like to say. Thanks.

DR. RIVEST: Thank you. Questions.

MR. GREENE: Yes. Having spent part of my career in the nuclear industry,
I am used to how nuclear operators are trained, and the use of red teams
and tiger teams is clearly an excellent suggestion. But in many cases,
those who are actually involved have to be evaluated. They have to be
subject to upset conditions. They have to operate under stress. They
have to do a number of scenarios, and they have to do it within certain
margins of performance in order to verify and validate that they can
operate correctly. Do you have any suggestions along those lines?

MR. WALLACH: I think there are a number of ways we could talk about
doing these tiger exercises. I agree with you that not just anybody can
do this, and finding qualified people who have the right skill set is
\-- I don\'t have an easy answer for that.

I know that the RABA group that did the Maryland analysis were several
former NSA employees who were all very good at what they do. I don\'t
know how to write down a description that would match that group, but
would exclude people with less skill. Certainly, an interesting thing
for this committee to look into is how do other industries certify who
can do their Tiger exercises and specify what they do. I don\'t know
what the nuclear industry does, but I think that would be an interesting
thing to look at.

DR. RIVEST: Other questions? Do we have questions?

MS. PURCELL: If you will recall, you and I corresponded about the Auto
Mark which we\'ll be trying here on a trial basis in four of our
precincts in November.

DR. RIVEST: That\'s all.

MS. PURCELL: Yes.

DR. RIVEST: I was identifying you for the record. Did you have a
question for the panelist? I\'d like to thank the panel. Oh, my large
question, yes, why don\'t I \-- we put that question on the floor about
the larger advice for this committee and maybe just go in the original
order.

MR. CRAFT: Could you restate the question?

DR. RIVEST: The question was \-- we all tend to go down rabbit trails.
The question was regarding the voting systems larger perspective, what
steps this country could do or specifically this committee could do to
improve security of voting systems. Enlarging beyond the scope of the
focus questions we gave you which is only one mechanism for helping time
proof security.

MR. GREENE: First, I thought Dan did an excellent job of answering a lot
of that, and I will try to say things beside what he said. I think that
it would be a great idea to look at future voting systems from the point
of view, is software trustworthy, either the concern being that it was
designed with malicious intent or I think just as realistically, if not
more, that there was some bug or error in the software or that the
developers have interest there that they don\'t know about.

I don\'t think it\'s possible to build systems of the size that will
being built now. When you look at a system and say we don\'t trust the
software, I think there\'s still ways to design them so that the whole
system is trusted and that should be the challenge going forward.

I do like the idea of Tiger teams but I think it is important to realize
that there is one result possible from the Tiger team, and if that
result is not achieved, then you don\'t know anything. If the Tiger team
does not uncover anything, it is not a proof of security. It is just one
more layer that can give you some small amount of confidence perhaps in
the system. I personally believe that until the cryptographic techniques
are universally accepted, adopted and proven to people who don\'t have
PhDs in computer science and specialize in encryptography, that
voter-verifiable paper trails are the only way to insure that we can
overcome the mistrust that we have in the software. I will consistently
try to keep an open mind about proposals to do it without the paper, but
to date, I haven\'t heard one that convinced me.

DR. RIVEST: Paul.

MR. CRAFT: There were two parts to your question. One was what can this
committee did do, and one what this country can do, and I think they
have distinctly different answers. This committee needs to follow
through on its charge, which is to make recommendations to the EAC for
modifications to the voting system standards. I think it needs to
proceed without getting mired into the need for perfection. It needs to
very clearly understand that we\'re going to make improvements through
time, and as so many of us do when we set standards, we write standards
very clearly setting standards for those things that we had come to
understand, and those things that need further research are left for the
future and the next generation of standards writers. That is the task
for this committee. There is nothing in the standards that is going to
provide the public assurance that the voting systems are good. There is
nothing in the standards that will make elections be conducted properly.

There is another aspect of the ASA\'s work. There is another committee
that is doing Best Practices. Best Practices have to tie into use of the
systems. You can do some of that, if you take, as we do in Florida, a
wholistic can approach to voting system testing where you test the
system within it\'s intended environment based on reading its
documentation, based on the supplies that are specified for it, based on
the training of operators specified for it. Within that, you can have an
impact on the process and procedures. Other than that, the country needs
to take the responsibility. And by the country, I mean Congress,
election officials across the country, and the public, by getting
involved in elections and coming to understand them. We all have a lot
that we can do differently in increasing both participation in and
understanding of the elections process.

I think Election 2000 was a great wake-up call. This was \-- excuse me,
the inhibitor blood pressure medicine which causes a dry cough, also
makes it difficult for me to speak in public.

As I said when we had our meeting at Cal Tech, this has been a part of
Government which has been under-funded and given inadequate attention
for a very, very long time. We\'re not going to fix that quickly. We\'re
certainly not going to fix it cheaply and we all have much to do on it.
In terms of election administration, some of the basics that we have
talked about here, having a certified product which has been well
tested, acceptance testing, the system you buy to make sure that it was
certified, validation testing periodically as you use it, maintaining
physical security, logical security, distributing custody of the system,
training your operators, all these things are probably not being done as
well as they should be in all states.

In Florida, I have concerns about system validation, because there is
not funding to put my examiners out as often as I would like in the
counties. We don\'t have that much travel money. We\'re working with
NIST now to come up with a method that we use the national cell phone
reference library to allow local jurisdictions to validate their
software themselves. That\'s a step, but it\'s one of the many steps and
we need election officials and the public to understand the process and
start doing it better.

DR. RIVEST: Thanks, Paul.

MR. WALLACH: So I had a chance to put a lot of my blue sky comments at
the end of my testimony, so I\'ll just add a couple brief remarks. I was
impressed by your description of the process in Florida, because in
Texas, the meetings are held in secret. I am not allowed to go, even
though I would like to. It sounds like maybe I need to take a trip to
Florida.

MR. CRAFT: Come on down.

MR. WALLACH: I think that openness, the fact that you\'re willing to do
it sort of undercuts some of the arguments in some states that it needs
to be kept private. If it is good for you, it is good for us, and I
think that gives the committee something to think about, that every
state has radically different procedures for how they go about
certifying their own machines. I think some attention could be paid to
standardizing the standardization process, standardizing the
certification process for states. Maybe that is a Best Practices thing.
Maybe that is a technical issue or some combination thereof, because to
some extent, every state has their own ideas of what they think is
right. And to some extent, we\'re facing a national issue. So as much as
we can start promulgating better standards would help things.

MR. CRAFT: I\'d like to comment as to the issue and I agree with you on
dealing with individual state certifications, something that we never
really got going in the NASED program, and with the existing ITAs, I
don\'t know if this concept\'s unique to Florida or not but our voting
system standards list all the things a system has to do and then there
is one little sentence that includes in the performance standards, any
functionalities which the vendor holds out in marketing or advertising
his system become part of the standards. And if we maintain a model that
will allow vendors to be fairly free and flexible as to design, they can
design their systems for particular state needs.

And, basically, if you\'re going to market your system in Kansas,
you\'re going to have a Kansas rotation. Kansas rotation would never be
part of the standards but if it\'s part of the system design, then it is
evaluated within the certification program and must work as it is
designed.

DR. RIVEST: I\'d like to thank the panelists. I appreciate you all
coming here and giving us testimony here today. It\'s been very
informative.