MR. DEUTSCH: I am Herb Deutsch, product development manager for Election
Systems and Software, and also chair of the IEEE working group for
development of the voting system standard. I was asked to give a
self-bio as part of introducing myself, so here goes. I am a graduate
electronics engineer, and I have been with the ES&S or its predecessor
companies for 28 years. I have been working in election product
development for 30 years, have been involved in development of virtually
every type of voting and tabulation system as well as every facet of the
associated peripheral software. This includes almost all of the ES&S
tabulators and software in use today, as well as all the BRC products of
the predecessor company that was acquired. It includes punch card
systems, both precinct-based and central count, optical scan tabulators,
both precinct based and central count and direct recording electronic
systems, both full faced and page based systems. The page-based system
includes such screens as well as what was probably the first, called the
video voter. More about that later.

The associated hardware that I have worked in development of includes
front end software such as election definition and database setup,
including ballot style creation software, ballot layout software for
producing camera ready artwork for optical scan ballots , tabulator
preparation software for converting election definition to various
tabulator formats and transferring it to be tabulator media. It also
includes back end software for reading tabulator media or accepting
transmitted results from the tabulator or regional sites, storing and
aggregating these results, and printing reports and exporting data. I
have even developed a voter registration for small to immediate sized
counties using an assembler-based program, running on a microprocessor
system that preceded the existence of the IBM PC.

My career has spanned over 43 years and includes eight years at IBM, six
years at Terminal Communications Inc, an IBM spin-off, in addition to
the 28 years in my current position. During this time, I received 11
patents, including several on voting systems, and an IBM outstanding
invention award.

Security in voting systems is based on many things; the type of system,
the hardware design of the system, the software used in the system, and
its structure, and how the system itself is prepared, used and deployed.
This latter point includes not only the Election Day use but the pre and
post Election Day process as well. With security considerations, you
virtually have to view the entire process like a detective would if
investigating allegations of voter fraud and wrongdoing. Handling of
these considerations requires the dovetailing of security considerations
in the equipment design and the processes and procedures followed by the
election jurisdiction using the equipment. There must be a chain of
custody that shows that the equipment and all associated data is secure
from the time the equipment is deemed ready for an election and the time
results of the election are officially certified.

Even after the certification of results, a lot of the materials
associated with the conduction of the election must be kept secure for a
period of 22 months after a federal election, although this period is
shorter after local elections and varies state by state. These materials
include ballots, whether paper or electronic, all official results
reports from both the precinct as well as the central site in the
results aggregation process, all audit logs, both from the precinct in
the use of the equipment as well as those from the central site process.
Also required are all electronic files used in setting up the tabulators
for voting and the central site system for accumulating and reporting
these results, as well as results themselves and the associated unit
event logs where they exist. These event logs should not only include
machine created ones, but all the human created records in this process.
This encompasses the warehouse process and any serial numbers from seals
put on machines, and the delivery schedule of units to polling places,
including serial numbers of units delivered. It includes activity at the
polling place from logging and counting voters who have appeared at the
polling place, and whether there was any exceptions, such as challenges
to the provisional ballots. It includes all forms created from this
process, as well as all signed zero and results reports from the
tabulators, and any affidavits that may have been created from any
anomaly, if one was noted. If the precinct uses paper ballots, it would
also include reconciliation forms of ballots received, ballots spoiled,
and ballots voted. The machine tabulation of ballots should reconcile
with the ballots voted and all unused and spoiled ballots are returned
with the election materials. All transported materials need to be sealed
with numbered seals, and the seal number recorded and independently
communicated to the central site. All of these measures are done in
keeping with the concept of chain of custody to ensure that there was no
tampering along the way, and all information balances.

As you can see, security is a process concern, and not just the concern
of the voting system tabulation and voting units and voting system
software, but of the users of the software as well. There are things the
system must do since they can\'t be done by the users of the system.
There are things that the users of the system must do since they can\'t
be done by the equipment or the software, and there are things that
either of the users or the system can do. If possible, the latter is
best done by the system since one would assume there would be less
subject to error.

The evolution of technology and the migration of computers into the home
have had a major impact on voting system security, both in actuality and
as perceived by the general public.

The first voting system I was heavily involved with designing of was
something called the Video Voter. It was probably the first DRE being
first used in an official election in 1975, having a rear projection
screen, and filmstrip projector for the candidates and contest displayed
with buttons and LEDs for candidate selection and display. This was at a
time the microprocessor was first being utilized in the equipment
design, but the low function device, the Intel 4004, was inadequate for
the job. Since I saw the power of programmability, I created by own
instruction set geared to the systems data flow design and even created
a symbolic language so that the hand program listings could be manually
interpreted into binary sequences for manually burning the programmable,
read-only memory. The entire program was stored in less than a thousand
bytes, which was the capacity. Looking at it in today\'s world, the idea
that a virus just could be implanted or there could be back doors
implanted in the code is unrealistic.

The first and second generation of electronic voting machines, both DREs
and paper ballot tabulators, I would consider the Video Voter generation
zero, were built with embedded microprocessors, many using the Zilog
Z80. These units are limited to 64k bytes for all program, election
definition and results storage use. They have no operating system and
programs are written in Z80 assembler. It is not very likely that these
would be subject to viruses or back doors in the sense of today\'s
implications.

The units have today are in a different category. Many contain Pentium
class or above microprocessors that are more powerful than the
mainframes of 20 years ago, as well as the same commercial operating
systems used in our desktop and laptop PCs that we have in our home and
offices. Now, from a theoretical standpoint, the potential is there for
these issues to come into play. The question is whether the equipment
design, methodology of use and physical access permit these security
issues to come into play.

As far as public perception, this technology has made virtually everyone
an expert on security. The cost of computers and the power of these
computers has put into a major percentage of households computers that
are more powerful than the racks and racks of mainframe computer
hardware that were used in commerce and industry in the l960s and \'70s
that cost hundreds of millions of dollars. The explosive development of
the Internet exacerbated the situation. These powerful computers sitting
in our homes and offices and being on-line exposed them not multitude of
viruses and worms that evildoers anywhere in the world can and have
unleashed. Since many of us have actually been exposed to these and
virtually everyone has read or heard about these attacks in the media,
it is assumed that voting systems are subject to the same conditions.
The notion of tampering with the voting machine software is re-enforced
by the fact these computers owners and users have installed and modified
software, and know how easy it is to do so. They have also had computer
crashes, and the numerous reboots that are required and translated that
into equivalent happenings on voting systems. Therefore, many people
equate the use of their computers at home and in the office to the use
of voting machines in the polling place, and that voting machines
contain a program downloaded into each machine for each election.

There are several things that are not commonly understood about voting
units. They are not general purpose PCs, and do not connect to the
Internet. Any modems that may be used are only for transmission of
unofficial results to the jurisdiction central site computer, are only
active after the polls are closed and the programs that support them can
only perform this function. The programs used in tabulation and voting
equipment are not election specific. They are unit specific, and as part
of the independent test authority certification testing by an approved
ITA, have their source code reviewed for structure, both for
maintainability and for improper execution, and for the existence of
surreptitious code. The compilation of this reviewed code, which is
version identified, is witnessed by the ITA and both source code and the
compiled executable code is archived. In many cases, this code is sent
directly to the State, who must also certify the equipment, by the ITA
where it is achived for purposes of auditing against what is installed
in the units shipped by the vendor.

To make this generic tabulator or voting machine work for a specific
election requires election definition data to be loaded into the
tabulator via some storage media such as PCMIA card, compact flash, or
vendor proprietary memory devices. This is true whether the unit is a
scanner for voted paper ballots or a DRE for actually voting as well as
tabulation. The program or firmware does not have any special
recognition of any one voting position over another or knows in advance
what party or candidate the voting position will be used for. All
knowledge and association is derived from the election definition tables
or data structures that are contained in the memory device, whether
downloaded to the unit or directly used by it. Therefore, the idea that
the certified program can favor one candidate over another is not
palatable.

This favoritism can only occur if the program is changed for the
specific election, is changed in each unit used in the jurisdiction and
goes undetected. This possibility requires a unit that is of a later
technology which has the power and memory capacity to afford these
surreptitious modifications. Changing the program for a specific
election requires access to the source code, knowledge about how the
program works so the change will work as intended, access to the
machines and implementation in such a fashion that it will go
undetected. When considering the normal machine preparation, and when
using recommended procedures, it would be difficult, if not impossible,
to achieve, unless there are flaws in the machine design which should be
caught during the security evaluation of the ITA certification testing.
Normal unit preparation involves transferring the election definition to
the tabulator media, placing the media in the tabulator permanently, or
until the information is transferred, performing the public logic and
accuracy test of the tabulator or voting device by voting a specific
ballot set and verifying the results, zeroing or clearly the test
results, and then sealing the unit and/or the memory device so that any
tempering would be detectable. It should also be voted that the
firmware/software versions used in the test is auditable to ensure that
it is the same as the version that was certified for use in the state.

When considering all of these elements, it is hard to fathom how the
firmware/software can be surreptitiously modified without detection. I
do recognize how the software audit becomes more complex when COTS
operating systems and/or application software is involved although I
believe it can be achieved.

To me, voting security boils down to insuring that the voting system has
maximum protection against failure, maximum protection against misuse,
either intentionally, most likely by a voter with intentions to disrupt,
or unintentionally, by the poll worker or the election administrator,
and the methodology to recover from any of the above situations, if they
do occur. It should also be noted that all election issues that I have
seen that make the paper are virtually always caused by a chain of
events involving improper human procedures that may or may not include
an issue that resulted in erroneous results being initially published
election night.

It should also not noted that in general the public is not aware that
election night results are unofficial and may not include absentee and
overseas ballots, depending upon state rules. Official results must be
released by an authorized canvassing board from the jurisdiction after
authenticating them using methods such as verifying the central site
results reports against the tapes or report printed at the polling place
by the tabulators, as well as verifying the number of persons voting
against ballots tabulated.

Every voting system type has its advantages and disadvantages. In my
eyes, there is no ideal voting system. Paper-based systems have the
advantages that the ballots are easily human auditable. They have the
disadvantages that votes can be erroneously cast and even though to
satify HAVA compliance, the tabulator is required to screen the ballot
and give the voter the option to correct the error or accept the ballot
as is, correction is a complex process. Correction involves voiding the
ballot, placing it into a spoiled ballot container, and issuing the
voter a new ballot to vote on. These units also have the disadvantage
that the ballot can be incorrectly voted in a manner that the scanner
cannot detect, such as inadequately marking the target area, circling
the names that instead of marking the target are, or crossing out an
unintended vote on an optical scan ballot. If a ballot like this is
accepted, it takes human review to interpret voter intent and correct
the tabulated results.

DREs, on the other hand, prevent the voter from selecting an invalid
result show on the screen or panel, candidates that are selected,
provide a summary of selections so the voter can see what\'s not
selected, and under HAVA, requires a voting method accessible without
assistance by unsighted voters which is usually achieved by an audio
ballot capability. The perceived disadvantage of these machines is that
this doesn\'t directly provide a human auditable ballot. In my opinion,
adding a paper ballot printout to the units adds a dimension of
complexity and potential of conflict that defeats the advantages of the
DRE in the first place. DREs of today redundantly store ballot records
in nonvolatile memories in at least triplicate. It should be noted that
the old lever machines and the early full phase DREs did not store any
ballot records at all. All that existed were the totals from the ballot
selections. Even the Video Voter that I discussed early on added
independent ballot recording after the records were initially deployed.

DR. RIVEST: Your 15 minutes it up. You have got several page there.

MR. DEUTSCH: I have got one page and a little bit.

DR. RIVEST: Catch the important points, please.

MR. DEUTSCH: Numerous devices now appearing on the scene that bridges
the DRE vote selection advantage, both for the sighted and unsighted
voter, but produces a paper record of ballot selections, either from
scratch or by marking the same ballot that is printed for voting without
benefit of the device, that is then tabulated by a separate optical scan
tabulator. The impact of this type of configuration on voting system
deployment is yet to be seen.

I went on in this description talking about the media and key locks and
seals and how the design, depending upon your situation, whether it is
commercial memory devices or proprietary devices influences the degree
of other protection means that are needed.

Obviously, I could go on discussing this for a long, long time but since
we\'re out of time, thank you.

DR. RIVEST: Thank you. We\'ll have the complete, written transcript.

MR. DEUTSCH: I can send that to you. I noticed some typos.

DR. RIVEST: We have some type typos. Some questions from the panel?

MR. GANNON: Inspector, given your experience with dealing with voting
systems, in earlier panels, we had recommendations about the testing
processes should allow for a rating rather than pass/fail. From your
experience, do you think that is a valid goal that we should consider?

MR. DEUTSCH: I think, definitely, that is something that ought to be
considered, because different units, whether it is the same vendor or a
different vendor, have different characteristics. And by having a rating
system by category, I don\'t think you can talk about one through ten
overall. I think you have got to do it by function analysis, if you
will, that would give some comparison method to determine price
performance, benefit, cost and that kind of thing.

MR. GANNON: Okay. Thank you.

DR. RIVEST: Any questions from those on the phone?

I had a question. In terms of the certification process, could you
comment on the importance or lack of it in terms of documentation of the
software development process, in terms of vulnerability study, just
documentation on how the code got to be the way it is.

MR. DEUTSCH: I think \-- well, I think the current FEC 2002 standards
requires that information to be documented as part of the TDP. I think
the methodology done in creating the software is important, as well as
authentication of the developers themselves, as to whether they would
pass a secure muster.

DR. RIVEST: Thank you. Any other questions from the panel?