MR. JONES: My name is Douglas Jones. I have been on the faculty of the
University of Iowa for 24 years where I serve as associate professor.
And the for the past ten years I have been a member of the Iowa Board of
Examiners for Voting Machines & Electronic Voting, from which I have
just resigned. I was chair for three consecutive terms, and I have also
consulted, for Miami-Dade County, recently looking at the pre election
testing and at security problems which were uncovered there.

I\'d like first to talk about voting system transparency, because I
believe, quite correctly, that security and transparency are coupled in
the responsibilities of this panel, and that transparency guidelines are
as important as security guidelines.

In the previous panel, Craig Burkhardt commented about the legal right
to observe elections, and he seemed to be fairly confident that that
legal right is, in fact, observed. I am not nearly as confident about
that. I think that Governor Lewelling\'s 1893 complaint that, \"As the
law stands, the judges of an election may utterly disregard the plain
provisions of the statute respecting the rights of candidates and of
electors to be present at the counting and canvassing of votes without
incurring any liability, either civil or criminal.\"

I think his complaint still holds. I have heard too many stories of
central, crucial aspects of voting which have been closed to an
observer. Just, for example, on August 6, 2002, in the Lincoln County,
Missouri primary, Gregory Allsberry, running as an upstart against an
incumbent in his party\'s primary, was refused the right to observe at
the canvass of the primary. Only the chairs of the Democratic and
Republican party and one member of the press were permitted to observe.
And since he was running against the party establishment, excluding him
left him, essentially, unrepresented by those who were permitted to
observe. He sued. The judge who heard the case was the victor in that
election. Strangely, he was turned down.

There is another example just a week ago in the Virgin Islands, an
attempt by a member of the press to observe the canvassing was rejected.
The situation is even worse with modern technology, where with paper
ballots an observer could easily determine what was being done. When
you\'re observing processing being done on a computer, it is not at all
clear what you\'re seeing. And the problem is compounded to the point
where even if you were fully conversant with the computer technology
being used, you may not have any idea what\'s going on.

There was a recent case in Riverside County where under court order, the
County permitted an observer to be present to observe making of a
back-up of the polling records onto a more permanent medium. The
observer was confined to a taped square on the floor at one side of the
room. The back-up activity was being done on the other side of the room,
and county employees consistently stood between the observer and the
screen which would permit the observer to see what was going on.

I think it\'s not unreasonable to list among best practices the idea
that wherever the canvassing of the votes involves a computer system,
the display screen of the computer should be put on a video projector
and put up on the wall above, so observers have clear views of
everything taking place on the computer, and not merely observe the
backs of people sitting in front of and obstructing the view of the
crucial activities of the election administration are taking place.

At the precinct, the situation is complicated also. The standard rule
for precinct manipulation of ballot box is that the ballot box is never
in the custody of a single person but constantly in the joint custody of
people representing opposing parties. This is an easy thing to say with
some large object like a ballot box, but particularly difficult with the
small electronic media used on today\'s computers. With the Election
Systems and Software iVotronic electronic records, a copy of the
electronic ballot box is the size of a large commemorative postage
stamp. How do you hold something the size of a postage stamp in the
joint custody of two people? In the seconds it takes one person to drop
it, it is very easy to imagine a sleight of hand substitution.

The largest electronic media in current use for voting systems, I think,
are about the size of two cigarette packs. Even that is small enough
that sleight of hand manipulation is perfectly reasonable. The right of
an observer is compromised when they cannot see the physical medium.

In the world of voting system software, things become even more obscure.
The simple requirement that we verify what software is running on a
computer is not an easy requirement to undertake. I dare Patrick Gannon
to prove to me what version of Microsoft Windows is running on his Dell
laptop. He can easily ask it by poking the button that says, tell me
about yourself, to display a little window saying I am running Version
6.5.4, but it is an entirely different matter to know that is an honest
declaration since it would be quite easy for me to, if I had access to
the source code of the system, to make it make any declaration I wanted.
In fact, without the source code, since it is probably just a text
screen, you could search the memory of the operating system, and
substitute in whatever text you wanted.

With voting systems where the code in the voting system is entirely in
read only memory, burned into read only memory at the manufacturer, it
is not impossible to extract the chips and independently verify that
their contents matches what is intended, but if the code is loaded in an
internal flash memory that can be reprogrammed through the external
ports of the machine, you\'re reduced to relying on chain of evidence,
and you\'re reduced to relying on sometimes very long and continuous
chains of evidence that are interrupted by long periods during which the
voting machines is sitting somewhere that is poorly guarded.

So I am very concerned about the observability, that the software is
what it claims to be. I believe chain of evidence is extremely important
here and we\'re frequently disregarding that by leaving machines in poll
workers\' houses for three days before the election, and sometimes for
two days after the election, or by leaving machines with no physical
seals over the ports through which the updates could be loaded. I think
we need to worry about that. And, of course, the current certification
process is a case study in non-observability. Nobody is allowed to even
ask questions to the current certifying authorities about what they are
doing. Of course, this is because it is a voluntary process and the
people you should be asking questions to are the states, but having sat
on a state certifying board for a decade, I know that my attempts to
seriously examine what was happening in the certification labs were
largely administratively blocked. There was no real access to the
process. This has to change.

I think that observability and transparency are so intertwined that we
could actually talk seriously about a metric for the evaluation of
voting systems that rests on how observation is required to insure the
integrity of the system. Because our observers are almost entirely
volunteers, because our observers are typically provided by the party, a
voting system which requires in a particular county a thousand man hours
of observation per election, that observation is not going to be
provided. And if the security relies upon observability of certain parts
of the process, it won\'t happen.

If another voting system only requires a hundred man hours of
observation to achieve the same net results, I think it is an extremely
desirable attribute, and this, I think, could be boiled down into
something that goes in a Consumer\'s Reports style, \"Rating Of
Different Voting Systems.\"

I want to talk now about threats to voting system security and emphasize
that I believe that much of the security evaluation that we\'ve seen
done at this point has been poorly done. We know that the voting system
certification process has been fooled. In a 1996 report from Wyle
Laboratories about the then I-Mark direct-recording electronic voting
system and its descendent is made by Diebold, that evaluator indicated
being considerably impressed with the security of that system and by its
use of DES.

We later learned from various authors that the security of that machine
was largely a sham, that there was a single DES key used throughout the
entire product line, that, in fact, the use of encryption was incorrect,
because what was encrypted was, in fact, public record, and you should
never encrypt public records. They should be electronically signed, not
encrypted. I think this is a black eye on the certifying laboratory
business, but I don\'t think we should say that is enough, because many
people now are demanding that all electronic records coming out of the
voting system be encrypted.

I have a copy here of the report from the European community, Ad Hoc
Working Group of Specialists, but these standards have considerable
parts of them where they talk about demanding that everything be
encrypted. That is, the ballot layout is public record. It is published
in the newspapers before the election, and anyone with the proper
documentation can figure out what the ballot layout should be in
electronic form. The vote totals are, in a well run precinct, they are
posted on the precinct wall as the polls are closed and then
electronically transmitted from the precinct to the central system.
Again, it is a public record being transmitted. This shouldn\'t be
encrypted. The cryptographic community takes the words signature and
fingerprint and checksum to have three different meanings, and I want a
generic term that doesn\'t imply a particular encryptographic
technology.

There are also problems in evaluation where people mis-assess the amount
of security required. In many voting applications, you have one chance
to try to slip a ringer into the system. If I have a one bit checksum
that is a cryptographic checksum, which is to say the question of
whether it is even parity or odd parity is secret, closely guarded. I
have a 50 percent chance of slipping my forged copy of the ballot box
into the county offices, in place of the copy from the polling place. I
don\'t think I would accept a 50 percent chance of getting caught for a
felony, and furthermore, inserting this invalid copy of the ballot box
into the county would immediately warn the county that it is under
attacks, and they would seek alternate copies of the data.

All modern electronic voting systems provide numerous alternative copies
of the electronic ballot box or of the total from the precincts.
Therefore, it doesn\'t take astronomically strong cryptography. Weak
cryptography, if correctly used, can give us a tremendous payback.

Another example of mis-assessment that is common is the question of
randomization. We ask that ballot secretly be preserved by randomizing
the order of the electronic images in the electronic ballot box of the
voting machines, and all of the vendors are doing this. Many are using
pseudorandom number generators that don\'t pass strong cryptographic
tests, and the fact is, if I have a weak pseudorandom number generator
and a box that is half full, if it has capacity of a thousand votes and
I have 500 votes, it should be very fairly easy to work backward and
find out how it was seeded and to determine who voted how, if my poll
watchers have been watching who went into which polling booth. We need
to ask for stronger randomization if we want to preserve public privacy.

Do we need public keys? Public key has been suggested as a cure-all for
all security problems by some people. I have a man in my county who is
currently saying \"I have read all about public key cryptography.\"
Well, maybe we can use public key systems, but voting systems are
managed from a central authority where you create ballot definitions at
the central, authority distribute them to the machines and then get
results back from the voting machines. The distribution of election
set-up information to the voting machine can also distribute private
keys, and that would allow symmetric key cryptography to be used.

I have seen people demand anti-virus tools when there is no good reason
to demand them. And these tools only apply to systems that are
vulnerable to viruses. We have known how to make invulnerable systems
from the beginning of the era of viruses.

And finally, there is defense in depth, properly used. The
recommendation which I made as result of my work in Miami, Dade County
is that Election Systems and Software should put provisions for a tamper
evident seal across the docking bay for the PEB, this is their
proprietary module that they use. If there were a tamper-evident seal
preventing insertion of the PEB, then encryption of the data path
between the PEB and voting machine would be a secondary line of defense.

Then the obscurity of the PEB, and the fact that it is propriety would
be a secondary line of defense. And the tamper-evident seal, which is a
simple, visible, easily audited, easily inspected layer of defense,
would be there on top of it all. I think that kind of defense in depth
philosophy is something we need to sell.

I think these stories show that security evaluation for a voting system
has been badly done across the board by county officials, by states, by
independent testing authorities, and by vendors internal developments
groups. Because of that, I would like to see a change to the way we do
security. I would like to see security models promulgated, and subject
to widespread public discussion, and then have voting systems certified
to correctly implement the security model.

Quite frankly, there are wide ranges of voting systems that should be
subject to the same basic security model. Whether you\'re using a
precinct-count mark-sense system or a DRE voting system, you have the
same election programming to ballot counting mechanism cycle. You have
the same electronic results reporting from the ballot counting back to
the county. A single security model could cover a large part of that
cycle from the county to the polling place back in the county. Having a
standard model and certification that the machine conforms to that
model, I think, would be a far stronger approach than merely having
standards that dictate very difficult to test and very difficult to
observe security characteristics of the voting systems.

That ends my remarks. Oh, yes. I do want to comment on the recount
issue. I also agree that the recount should be done, when possible, by
an independent system. If we had open standards for electronic ballot
box representations, then recount software developed by a different
vendor from the voting system software would be extremely valuable to
allow us to independently test that the voting system vendor software
that has produced the right result. Of course, if you got a wrong
result, you had better bring in a third opinion.

DR. RIVEST: Thank you, Doug. Excellent. Any questions?

MR. GANNON: Yes. Patrick Gannon. On the question of the models, in your
prepared text, you talk about the need for a reference model that deals
with both the data paths and the threats, etc.

Is there, today, published models or is this something that needs to be
developed?

MR. JONES: I think the work done by Compuware Corporation, I have very
mixed feels about the Compuware work done for the State of Ohio. It
particularly lays out, in a fairly competent style, some useful examples
of what such models might look like. And then I believe that it fails on
many occasions to correctly assess against these models, and this is why
I have such mixed feelings. No one before Compuware did a head-to-head
comparison of voting systems and published their rankings against
different issues, but when you look into details of that report, you
keep finding it could have been done better.

MR. RIVEST: Any questions from those on the phone?

\[a question posed by phone must be missing here!\]

MR. JONES: We need something that is very specific and talks about the
specifics of the voting system.

DR. RIVEST: Protection profiling.

MR. JONES: That\'s right. I haven\'t seen a good, complete view other
than what I thought were nice first steps for any current voting system,
and I would like to see these.

DR. RIVEST: Thanks. I\'d like to thank our panels for an excellent
morning of testimony. We have learned -- I have learned a lot, and this
is a good first time for the TGDC in its deliberations. We will meet
after lunch. We\'ll be taking a break until probably 1:00, be back at
1:15.

MR. SALTMAN: I wonder if I could make one more comment. There was an
editorial in the Washington Post this morning that referenced a
situation that occurred at a local fair, I believe it was in Takoma Park
where Senator Mikulski from Maryland was present, and she was invited to
use a DRE machine, the machine that is going to be used in Maryland in
November.

The situation was that, apparently, her arm brushed a location on the
screen which caused the screen to indicate that a vote had been cast,
which was not the vote that Ms. Mikulski intended, and she, therefore,
un-voted and then voted the way she wanted to vote. The Post claimed
that this was an indication that these machines are possibly not working
right. It seemed to me that if what was described was exactly what
happened, that the machines are working right, that is, if you make a
mistake, you can un-vote it and vote correctly, if you see what\'s been
done, and you should, because it\'s right there on the screen. If that
had happened in an optical scan system with, let\'s say, the voter was
holding a pencil or writing instrument and maybe a mistaken mark and
then tried to erase it or change it, that might not have resulted in the
correct result, unless the voter went then and asked for a different
card because the voter didn\'t recognize that the mark could not be
removed, then the voter might have had an over vote or something happen
incorrectly. So my interpretation of the situation described by the
Washington Post is totally in opposition to what the Post pointed out.

My conclusion is that there is such an enormous demand for this
postponed receipt, which I pointed out, if people aren\'t going to look
at it doesn\'t constitute anything that people are not thinking
rationally about this issue. And I am concerned about it, and I wish
there were a better way to discuss it and get people to recognize that
there are \-- certainly, the newspapers, particularly the New York Times
and Washington Post, to get them to realize there are opinions on
elections of integrity, and still disagrees with them.

DR. RIVEST: Thank you. Thanks again to all the panelists, to everyone.
Be here, again, at 1:15.