Barbara Simons

770 Homer Ave.

Palo Alto, CA 94301

650-328-8730

<simons@acm.org>

January 1, 2005

Memo To: Election Assistance Commission (EAC),

> EAC Technical Guidelines Development Committee (TGDC),
>
> IEEE P1583

From: Barbara Simons, Ph.D., IEEE P1583 committee member; Former
President, Association for Computing Machinery (ACM); IBM Research
(Retired); Fellow: ACM and the American Association for the Advancement
of Science (AAAS)

Re**:** IEEE standards project P1583 Standards for Voting Equipment

The citizens of the United States deserve voting systems that are
secure, accurate, reliable, accessible, confidential, and transparent.
The way to determine standards for voting systems that meet those
conditions is to conduct a "top-down" analysis. This means starting with
the conditions that must hold and then decide what lower level
conditions must hold until you finally get to the details. It's a bit
like building a house -- you start with a high level scheme and then
work down until finally you get to really small details, such as what
kind of faucets to get for the bathrooms.

The IEEE P1583 process, which never took a top-down approach, is mired
in details. There is no overall effort to guarantee the obvious
requirements listed above. In fact, the shockingly flawed draft even
includes conditions that might facilitate the writing of malicious
software to steal elections.

A specific example is the requirement that all voting systems must
contain a real time clock. If I were going to write malicious software,
I would want to distinguish between a real election and a test. If there
is a real time clock, then my software could examine that clock to see
whether or not today is Election Day. If it is not Election Day, then my
software should function accurately and honestly; if it is Election Day,
then it's time to cheat.

Amazingly, the P1583 draft standards say nothing about ways to make the
above scenario difficult to impossible. That is because there is no
global effort to develop standards that will result in secure voting
systems.

Another major problem with the P1583 process is that employees of voting
machine vendors have played key roles in the committee. While it fairly
common for vendor employees to be heavily involved with drafting
standards in other areas, it is completely inappropriate for vendor
representatives to be drafting standards for voting machines. They have
an obvious conflict of interest, namely representing their employers'
interests, which can include minimizing costs and the impact that design
modifications will have on current systems.

The current P1583 draft should be rejected, and the P1583 committee
should be reconstituted to eliminate vendor conflicts of interest. This
means that vendor employees should be allowed to participate only as
observers.

In addition, all software related to voting systems must be made public.
To quote Prof. Michael Shamos, "The manufacturers of voting equipment
claim that their software is a trade secret and go to extraordinary
lengths to preserve that myth. The author has been looking at the source
codes of voting systems for over 20 years and has yet to find any
significant differences in their design except possibly for the number
of bugs they contain. They all do the same thing, albeit in somewhat
different ways. No vendor's software is a significant selling point
providing any competitive advantage over other systems - jurisdictions
focus on the hardware. All the software has facilities for setting up
elections, storing the candidate and party names in a database,
presenting ballot choices to the voter, tabulating and storing the
results and possibly transmitting them after the election. The systems
vary in ease of use and capacity, but they do not contain trade secrets
for the simple reason that every aspect of election setup and balloting
is well-known to all."

Finally, it must be possible to convince the losers that they have
really lost. Only by conducting a meaningful recount, using an audit
trail as would be done by any reputable business, can people be
convinced of the accuracy and honest of the vote count. It is
inexcusable that the notion of voter verified paper ballots is buried as
an option in Annex i in the P1583 draft. Without an audit trail or some
mathematical equivalent, our elections run the risk of becoming a sham.