MR. FISCHER: Thank you, Mr. Chairman, Mr. DeGregorio, and members of the
subcommittee, for inviting me to speak with you today at this hearing on
computer security and transparency in voting systems. I see that on the
microphone, the ID tag says National Bureau of Standards; nevertheless,
it\'s probably newer than many of the voting systems used today.

Now, I understand that you are examining voting systems security and
transparency in a comparative and historical context with this panel,
and the lessons and principles that can be derived from this larger
context, as it applies to the mission of the Technical Guidelines
Development Committee to develop recommendations for the Election
Assistance Commission with respect to voluntary voting system standards.

Let me tell you a little bit about my involvement in these issues. I
serve as Senior Specialist in Science and Technology at the
Congressional Research Service, a legislative support agency for the
United States Congress. We perform nonpartisan, objective analysis and
research on legislative issues for members of the Congress, their
committees, and staff. In keeping with that mission, we do not take
positions or make recommendations or advocate on policy issues, and I
will not do so today.

My involvement with election reform began in November 2000, when we
anticipated that the 107th Congress might be interested in examining
strengths and weaknesses of different kinds of voting systems.
Subsequently, my colleagues and I provided extensive support to Congress
in deliberations that led to the enactment of the Help America Vote Act
of 2002, known as HAVA. We continue to provide support to Congress with
respect to HAVA implementation and oversight.

Most of the recent public debate about voting systems is focused on
electronic voting systems, which are usually known as DREs, or direct
recording electronic systems. However, more than two thirds of the
American electorate will use other voting systems in the coming
election. Roughly a third will vote with optical scan ballots, and
another third will use either punch cards or lever machines.

As with the November 2000, and many other elections, significant issues
may arise with respect to any voting system, especially in close
elections. With respect to security and transparency of voting systems,
there are several points in particular that I think the committee might
find useful to keep in mind. So I\'d like to make eight short points,
and then for the remainder of my time, elaborate on some of them.

Point No. 1: There are a wide variety of voting systems that are used in
the United States; optical scan, DRE, punch card, lever machine, and
hand-counted paper ballot systems. In each system, there are several
different models. Each system and model has different characteristics,
and each has different security vulnerabilities.

To the best of our knowledge at CRS, there has been no comparative risk
assessment done with respect to security for these various different
systems. Most of the focus has been on DREs, for which some assessments
have been performed and have received national attention.

Second point: Voting systems are expected to meet several goals, some of
which are potentially competing or conflicting with each other. Voting
systems are expected to be highly affordable, very reliable, accurate,
voter-friendly, secure, and accessible, and they are expected to produce
results very quickly. These different goals cannot always be met in
equal manner.

Third point: Elections are a connected set of complex systems and it is
useful to view security issues in that context. This means that factors
that are not themselves related to security may have significant
consequences for security. It also means that changes made in one part
of the complex may have unintended and even unpredictable effects on
other parts.

The fourth point I\'d like to make has to do with the evolution of
voting system security. The evolution of voting system security can be
viewed in part as a kind of arms race, with each security innovation
being answered with attempts to defeat it. That means that a completely
secure voting system, while a laudable goal, is not likely to be
achievable, or certainly not a completely secure voting system that can
actually be used in an election.

It\'s like the old saying --- the most secure computer can never be
turned on or off. It also means that attempts to defeat security should
be expected. There is a long and colorful history of vote tampering and
election fraud in the world, and we can expect that that will continue,
given the stakes in elections.

Point No. 5: Taken together, the previous two points --- about
complexity and the evolution of security --- these points strongly
suggest that security solutions focusing primarily on technology are
likely to fail. It is widely accepted that the best security solutions
use a layered defense that involves personnel and procedural controls,
as well as technology, and that is applied throughout the entire system
or process.

The TGDC may wish to consider such a life-cycle approach, an end-to-end
approach, with respect to its recommended guidelines.

Point 6: The voting system requirements in HAVA do not explicitly
address security, except for requiring an audit capacity for the voting
system. In light, especially, of the recent controversy about voting
system security, this may place a particular burden on the TGDC to
address security issues in the guidelines.

The seventh point: Just as no voting system is completely secure, no
voting system is completely transparent either. With current technology,
the need for secret ballots prevents the voter from knowing whether his
or her vote was counted accurately, no matter what voting technology is
used. However, some technologies in development may dramatically improve
transparency, and you may hear about those later, and the TGDC might
wish to consider such possibilities as it develops its recommended
guidelines.

And the eighth and final point that I\'d like to make here: The current
voting system standards address only computer-assisted voting. Now,
about 80 percent of voters are expected to use computer-based systems in
November, whether optical scan, punch card, or DRE, but no federal
guidelines exist for the systems used by the other 20 percent of voters,
namely, lever machines and hand-counted paper ballots.

While the use of such systems is likely to continue declining, they are
unlikely to disappear soon, I would say especially paper ballots in
rural areas, and guidelines for them might be appropriate.

In my remaining time, I\'d like to elaborate on some of the above
points. With respect to the question of the evolution of voting system
security, many of the innovations that have become familiar features of
modern elections originated, at least in part, as a way to reduce
election fraud, such as election tampering to change the vote count.
However, as each such innovation was introduced, miscreants began
looking for ways to defeat security features. That is why the evolution
of voting systems can be viewed, in part, as a kind of arms race with
each subsequent innovation being met with attempts to defeat it.

For example, after a series or scandals involving vote buying in the
1880s, calls for reform led to widespread adoption of the Australian
secret ballot. While providing improved security over the previous
ticket-ballot system, the Australian secret ballot did not eliminate
tampering. Ballots could still be removed, spoiled, or even substituted
or stuffed, although with greater difficulty than with ticket ballots.
The Australian ballot also did not eliminate the possibility of vote
buying or coercion, but it arguably made them more difficult. However,
the forms of tampering evolved in response to this technological
innovation, with miscreants finding new ways to add, subtract, or alter
ballots. But evidence of vote fraud, even to the present day, tends to
be anecdotal. There are occasional convictions and the like, but the
evidence tends, for the most part, to be anecdotal because of inherent
problems in detecting and prosecuting such fraud. It is difficult to
identify either the most prevalent type of vote fraud or where it is
most likely to occur. Our decentralized system of running elections may
prevent large-scale vote fraud, but it makes gathering information on
vote fraud a difficult task.

One means to eliminate ballot tampering is to eliminate document
ballots, and that became possible with the introduction of lever voting
machines in 1892. The lever machine eliminates the need to count ballots
manually. Instead, poll workers read the numbers recorded by counters
inside the machine. Because there is no document ballot, recounts and
audits are limited to review of totals recorded by each machine. And, of
course, tampering is still possible or is also possible with lever
machines. For example, the mechanisms could be adjusted so that the
counter does not always advance when a particular candidate is chosen.

Computer-assisted vote counting was introduced in the 1960s with punch
card systems. Direct recording electronic systems or DREs were first
used in the 1970s. Like lever machines, they do not use document
ballots. Optical scan systems debuted in the 1980s. With them and
others, machine counting made some kinds of tampering more difficult,
but it did not eliminate them, and it created new possibilities for
tampering with counting software and hardware.

So security requirements and measures vary among the technologies used.
Document ballots require security measures and controls from the initial
printing of the ballots through counting and storing them. However, the
ballots can serve as a basis for an audit trail. Such an audit trail of
individual ballots is not available for lever machines and DREs. DREs
record individual ballots, but they are not independent. They are
essentially the same events as recorded in the counting registers, but
in a different format.

Now, experts differ on the importance of such a paper audit trail for
insuring the integrity of the voting process. Special measures and
controls have also been developed for both hardware and software used in
computer-based system, and other kinds of audit trails are possible, in
addition to a ballot audit trail --- for example, records of individual
events that occurred during the course of use can be recorded by the
computer-assisted voting systems.

Ballot secrecy is widely considered a crucial mechanism for preventing
vote tampering and fraud. Two basic aspects of ballot secrecy are,
first: once the ballot is cast, it cannot be traced to the voter by a
second party. Second, a voter cannot demonstrate how he or she voted. To
ensure ballot secrecy, voter identification and ballot casting are
performed in two separate steps. Also, ballots are filled out and cast
in such a way that no one else can observe what choices the voter made,
except where assistance is requested. However, this is not necessarily
the case with absentee ballots.

Now, the impact of vote tampering depends on several factors. Two of the
most important are the scale of an attack and the competitiveness of the
contest. An attack would have to have sufficient impact to affect the
outcome of the election. For that to happen, scale is critical. If
tampering impacts only one ballot or one voting machine, the chances of
it affecting the election outcome would be small. But tampering that
affects many machines or the results from several precincts could have a
substantial impact, although it might also be more likely to be
detected. The scale of attack needed to affect the outcome of an
election depends on what proportion of voters favor each candidate. The
more closely contested an election is, the smaller degree of tampering
that would be necessary to affect the outcome. Similarly, it would
usually be easier to affect the election results for a local office than
a statewide office because fewer votes would need to be added or
subtracted from the total.

Now, while such attacks that added, subtracted, or changed individual
votes are of particular concern, other kinds of attacks also need to be
considered. And in the current situation, obviously, people are thinking
more about those kinds of attacks, particularly disruptive attacks. But
another attack that could affect the outcome of the election, for
example, is one where a candidate might gather information that could be
used to increase the chances of winning, that would not be considered
appropriate information to gather. For example, if vote totals from
particular precincts could secretly be made known to operatives for one
candidate before the polls closed, the results could be used to adjust
get out and vote efforts, giving that candidate an unfair advantage.

I\'d like to make a couple of points. One of them is, security and
reliability are related. In each election cycle, most voting systems
work properly and without incident, but every cycle also brings reports
of problems, whether they be malfunctioning machines or procedural
errors. And it is often said this election will be the most closely
scrutinized, this upcoming presidential election will be the most
closely scrutinized in history.

When you look at things closely, you are more likely to find problems;
however, they usually do not influence the outcome of the election. In
most cases, these kind of problems are treated, and no doubt
appropriately, as being unintentional mishaps rather than deliberate
attempts at tampering. However, the more common such problems are, the
easier it may be for a miscreant to mask an attempt at tampering as a
malfunction, just as if a home computer tends to crash a lot, a crash
caused by a virus might be treated as normal behavior. Consequently,
improvements in reliability may contribute significantly to security.

Let me just move for a second to the transparency issue. Now,
transparency, this long standing election principle, is based on the
notion that observation of the process by partisan representatives and
neutral third parties is the best way to insure that an election is fair
and accurate. This presence has taken on added importance given the
voting problems in the last presidential election, and changes required
by HAVA since then. It requires key points in the election process ---
from voter registration through certification of the results --- to be
open and transparent, while preserving critical features such as ballot
secrecy. For example, it is widely accepted that each ballot box should
always be in the joint possession of representatives of at least two
competing political parties from the time the boxes are first inspected,
before polls open, until when they are emptied after polls close.

Attempts to provide transparency can have a down side. Opening
procedures to observation can create distractions that might reduce
efficiency and increase errors, and it does provide a potential source
of security vulnerability. There\'s the whole issue of verifiability,
which can be thought of in terms of voter verifiability and results
verifiability. I have covered these to some extent in my written
comments, and in the interest of time, won\'t say anything about them
here.

In conclusion, it is widely agreed that transparency, verifiability, and
security, are worthy and necessary goals for an election system. It is
also clear from current debate that no voting system in use at present
achieves these goals to a sufficient degree to eliminate public concern
about then.

The guidelines being developed by the TGDC can make a major contribution
to the elimination of those concerns and the resolution of that debate.
I hope that the subcommittee found the evidence I have presented to the
useful and helpful, and I would be happy to answer any questions you
might have.

Thank you.

DR. RIVEST: Thank you, very much. Now, we have time for some questions
from the panel, if anybody has one. Paul?

MR. CRAFT: I don\'t actually have any questions. I would like to comment
that I think was a very nice presentation of the issues. And I, frankly,
agree with most of it. Thanks.

DR. RIVEST: Let me add, your written testimony is well worth reading
too. I\'d recommend it to everyone. The question I had, because in your
research for the Congressional Research Service, did you look at what
happens in other countries at all, or other countries that we can learn
from what\'s been happening in other countries, in terms of how we might
best proceed or not proceed with developing standards here? Or maybe
we\'re in the league, we should just forge ahead.

MR. FISCHER: Well, I\'ll have to say we looked a little bit at other
countries but we didn\'t look at them too closely. And I think one of
the main reasons for that is that the American election system is really
quite different from election systems, certainly, in most other
countries. For example, when one looks at \-- well, let\'s just take
Canada, for example, often times people will say, well, why don\'t we
move to paper ballots in the United States, just simply hand-counted
paper ballots? For example, it just seems to work just fine in Canada
and in England.

Well, as you may well have heard, I believe it is Conny McCormack, the
Registrar of Los Angeles County, who has said that you can vote in more
contests in a single election in Los Angeles than you may in your entire
lifetime in Great Britain because the ballots are much simpler in those
cases.

And Canada provides an interesting example. People sometimes point to
Canada and say, well, why don\'t we just adopt the Canadian system?
Well, it is true that the Canadian system for national elections uses
hand-counted paper ballots, and the ballot designs are established by
law, and it seems to work just fine, but that is, you know, relatively
simple elections. There are at most a couple of contests and ballots can
be relatively easily hand-counted by a group of people selected for that
purpose. But if you look at municipal elections, what happens in Toronto
is that the national election and municipal elections are held on
different days, and for the municipal elections, Toronto uses optical
scan ballots, I believe, now. So the municipal elections are more
complicated and use a different system, whereas we use consolidated
elections.

In terms of how different countries establish standards for voting, I
really, unfortunately, don\'t have any information on that,

DR. RIVEST: Thank you.

MR. GANNON: Question. Mr. Fischer. Patrick Gannon. In your points
you\'re making, No. 5, could you elaborate just a little more on the
life cycle approach to the guidelines on personnel procedures and
technology that you are suggesting.

MR. FISCHER: Well, yes. You know, as people often, and myself, very
often point out, elections are very complex. And if one looks at \--
part of the question becomes that I think the committee has to decide is
what are you going to be making guidelines on. So you could be \--
obviously, if you look at the way now HAVA doesn\'t really provide a lot
of guidance with respect to what the guidelines should be, although
there was a colloquy on the house floor between the main sponsors of the
bill that did try to elaborate on that. In one of my reports, I discuss
that to some extent, but HAVA doesn\'t say anything about it.

HAVA defines voting systems, for the purposes of the requirements, to
include the equipment; essentially, hardware, software, and the like,
that is used in elections and also the procedures that are used in
testing the equipment, so on and so forth, but it doesn\'t define the
whole election system as a voting system.

However, there, obviously, are many steps in an election, and there are
many points when one is thinking about security at which concerns could
be raised. These start with the initial development of a voting system
by a vendor or manufacturer. However, it is through the manufacturer,
the verification and testing of the system, its sale to state and local
election jurisdictions, its implementation by them, its use in
elections, and follow on after that.

So what I was referring to is that given and particularly with respect
to concerns about DREs, some observers, as we often say, some observers
basically have said that there is concern that some kind of malware or
some kind of software that would facilitate tampering in some way or
another could be inserted at some level, and perhaps even at the level
of manufacture by some miscreant, or at some level, and therefore, could
affect the outcome of an election.

In general, when one looks at security, it is widely recognized that the
best security is end to end, and it must involve, it should involve not
just technology, but also procedure or process and personnel. That
security, in depth, layered secured, that is basically focused not at
one particular point in the process but throughout the process is the
best way to go.

MR. GANNON: Thank you, very much.

DR. RIVEST: I guess this would be a personnel question, maybe forging on
the policy, but should voters take the recent disclosure of many
vulnerabilities in the system as any reason not to vote?

MR. FISCHER: Well, let me see, since I am here as a representative of
CRS \--

DR. RIVEST: Take that hat off. As an individual.

MR. FISCHER: Can\'t do it, sorry.

DR. RIVEST: If you want to pass.

MR. FISCHER: Well, I would say that it is an important question. And as
I said, so let me just see if I can say something that will shed some
light on the question.

I mean, certainly, I could not, as a citizen, recommend that people not
vote. That doesn\'t seem, well, appropriate. We don\'t make
recommendations for people to vote or not to vote, of course.

Nevertheless, I think that when a citizen makes a decision, what they
need to do is to take into account the various different factors that
may affect an election. Obviously, there\'s been a lot of public
attention paid to the security of DREs and whether or not votes that are
recorded with DREs will actually be counted appropriately during the
course of an election. Some people are choosing to try to vote with
paper because they are concerned about DREs.

At the same time, the reasons that DREs actually have become more
popular, one of the main reasons has to do with the fact that at this
stage, only computer-assisted voting machines, DREs, not paper ballots,
can be made or are available that are fully accessible.

Now, there are some technologies that are available that provide more
accessibility with machines that use paper, and there also is evidence
that DREs will help people who have certain problems to vote more
accurately. So in terms of whether or not people should vote, there are
many reasons why people should vote or not vote.

Generally speaking, there are also many checks and balances in the
system, and I would say that certainly most observers that I\'m aware of
believe that the election system is, you know, is very secure. There are
problems, there is no question that there are problems, concerns about
vulnerabilities, for example, with DREs, but most of the people, even
people that I have talked to who have great concerns that are active
advocates, who have great concerns about DREs, are not suggesting that
people not vote because of those concerns.

DR. RIVEST: Thank you. I thought that would be an easier question.

MR. FISCHER: Oscar Wilde, one of my favorite quotes from Oscar Wilde is,
\"To be intelligible is to be found out.\" So I don\'t know whether my
answer was intelligible or not.

DR. RIVEST: Thank you, very much. I\'d like to check to see if the
panelists on the phone have questions for Mr. Fischer.

MR. SCHUTZER: I don\'t.

MS. PURCELL: I have nothing at this time.

MS. CALDAS: Nothing.

DR. RIVEST: Okay. Do we have any further questions?

Eric, thank you for the wonderful testimony. We greatly appreciate your
coming here and testifying for us.