MR. RUBIN: Okay. Thank you. Good afternoon, name is Aviel Rubin. I am
computer science professor at Johns Hopkins University, been there for
about a year-and-a-half. Before that, I spent nine years in industry
labs, Belford, ATT labs, as a researcher in computer and network
security, and I did my PH.D also in the area of security.

We were asked to address several questions about audit. What voting
system risks should be mitigated by the use of audit trails, what audit
trails usage would be effective then providing guidance about the trade
offs between audit and other properties that we would like to have in an
election. Let me address those in turn. I believe the purpose of audit
trails, there\'s several purposes. One is to recover any errors or lost
votes, so if something goes wrong in the election, an audit has,
hopefully, the ability to let you recover from that, as well as an audit
can help keep an election honest, so it may overcome some fraud
attempts. Certain kinds of fraud may be detected and possibly even
corrected by good audit. In some cases, an audit can be used to resolve
disputes in close cases, and there could be the ability to replay an
election.

And finally, having strong audits that work well and people believe in
would provide confidence to the public, which is very important in
elections. So what are the desirable properties of an audit? Well, I
think the foremost important property of an audit of data or of anything
is that the audit itself be completely independent from what it is that
is being audited. So if it is data that\'s been audited, the audit
should not be derivable from the audited data. So an example of that is
where DREs have the ability to print out ballot images of the ballots
that are stored in the machine and that are kept, and those are
considered the audit trail. Well, since those are deprived from the
votes that are in the machine, those don\'t represent an independent
audit. An audit, independent audit, would be something that was somehow
separate from the data that it is auditing. An audit trail should
consist of voter-verified components, that is, if it\'s possible to have
the voters see the audit trail at the time that they are casting their
vote, then there is more reason to have confidence in that audit. I
think transparency is somewhat ideally, but a great property of an audit
would be for the entire audit to be publicly verifiable, that we could
put cameras in a room and members of the public observing the audit
process, and being able to verify that the audit is correct.

Another property we look for in an audit would be non-maleability, that
is, that the audit data cannot be easily changed, survivability, which
is the audit data can not be easily destroyed, and simplicity, it is
important for the audit process to be as simple as possible to not
complicate voting too much.

It is also important, for practical purposes, that the audit be cost
effective, the cost of audit should not be prohibitive, so as to not be
feasible to be deployed, and the audit process should not make voting
less accessible. In particular, blind voters and non-English speakers
should be able to participate in any voter participation that is part of
the audit.

The chain of custody of the audit should protect votes until the final
tabulation. And, finally, secrecy, the audit should not compromise
secrecy. An example of that is you often see people suggest a
voter-verifiable paper ballot be part of a roll of paper, and that if
that\'s the case, then the votes are stored sequential fashion on that
roll of paper, which could, if somebody observed the order in which
people voted, be used to compromise secrecy. So whatever audit comes
into play should be taken into consideration, that it not have adverse
effect on secrecy.

So what I would like to do is go through of the current technologies and
describe their audit capabilities. The lever machines have no real audit
capabilities. There is the ability to videotape somebody programing the
levers, and that is a process that is simple enough that people can
understand it, but that\'s not really an audit. That just shows you
possibly everything is okay, but not definitely. And the question comes
up very often, I have heard it today, why there was no outcry about no
voter verification in lever machines. And I think it\'s because lever
machines are not running on top of Windows operating systems. They
don\'t consist of 45,000 lines of code. When computer scientists started
with voting machines that were built on general purpose computers with
lots of lines of code, we became concerned that there would be the
capability for somebody to rig those machines. That was not a concern
that came up generally with lever machines. Still, lever machines do not
provide great audit, and I think they should be phased out.

Punch cards ballots, the audit trail is the actual ballot, but, of
course, modular chads, if there were problems with chads hanging or
dangling, or whatever they do, the audit and the ballots themselves are
subject to compromise. Optical scan, again, the audit is the actual
ballots. The paperless DREs provide what is often referred to as triple
redundancy, multiple locations where the data is stored. There\'s some
issues with that. One is that an audit does not cover the possible
corruption of the vote before it was triple stored, in which case, if
the vote has been corrupted or changed somehow, then for the vote to be
stored three times would be incorrect.

Another issue that has to be addressed in terms of audit is what happens
if two of them or all three of them have different results, which one
wins? That is something that has to be, was one of them auditing the
other, and the other is the official ballots. Policies must be in place
to resolve all of that. The audit is not voter-verified in the paperless
system, so it is not publicly verifiable in the way that I described,
and it is not independent in the way that I described.

A DRE with a voter-verifiable paper trail has the property of
non-malleability and is verifiable, but the voting is not as simple with
DREs without paper. So the question becomes, is it simple enough. The
paper must be verifiable to blind and foreign language speakers, and so
there issues with DREs with voter-verifiable paper.

And the final system that I will describe is fraud like system based on
the Cal Tech MIT Report where a machine can be used. One extension
station of that is machine can be used to mark a paper ballot, giving
all the advantages of DREs, in terms of accessibility and user
interface, over vote, under, so the protection, but in the end, produces
a paper ballot. In that case, the audit is the actual ballot. It has
simplicity advantages over a simple DRE with a verifiable paper trail.
And the variability may be cost, but I think it is a viable, long-term
solution.

One of the lessons, Venezuela was mentioned in the last panel. One of
the lessens from Venezuela is the audit trail should not be controlled
by one side. If there is an audit trail, whatever kind of audit trail
there is, it should be publicly viewable at all times and under control
of mutually disinterested parties. Eventually, in my opinion is an
example not to, how not to do a voter-verifiable paper trail. If we do
it, we have to have procedures in place for how the audit is controlled
but we can learn from Venezuela. I don\'t think that audit should be
compromised, based on other factors.

While I agree there is accessibility, sensibility, ease of use, are all
important, if not critical. Without proper independent audit, the entire
election result can come into question, so I think we have to have it.

My recommendations to this committee is that the audit mechanism be
truly independent from what is being audited, and that that be made a
requirement in the standard.

DR. RIVEST: Questions from the panel? Nothing. So let me ask one. Would
the vote meter proposal fit within your class? You didn\'t mention vote
meters, as we talked about earlier, as an audit mechanism.

MR. RUBIN: I would say this is a longer term solution, and that the door
needs to be left open for other kinds of solutions, cryptographic
solutions, etc..

DR. RIVEST: And I guess \-- do you have questions from the phone? Double
check. Do we have questions from anybody on the phone? Good. Thanks.