Fernando Morales 

2231 Wakerobin Ln. 

Reston, VA 20191 

703-476-9878 

fermorales3@comcast.net

January 28, 2005 

Memo to: Election Assistance Commission (EAC), 

 EAC Technical Guidelines Development Committee (TDGC) 

 

From: Fernando Morales, Inventor of a new electoral process paradigm 

Re: Paul Craft’s questionable behavior 

On January 18 & 19, 2005 Dr. Rivest, professor at MIT Department of Electrical 

Engineering and Computer Science and Chairman of the TGDC/Subcommittee of 

Security and Transparency, presented Subcommittee Resolutions to the TGDC for their 

consideration and adoption. 

The language used by Dr. Rivest in his original Resolution # 14-05 clearly directed NIST 

to research and draft standards documents prohibiting the use of COTS software that 

doesn’t provide the source code and/or documentation for a security evaluation. During 

the discussion Mr. Paul Craft was able to steer the committee into replacing that language 

with “requiring that the use of COTS software within voting systems is not allowed 

unless it meets specific exceptional conditions and that these criteria for exceptions be 

drafted by the NIST”. 

The new wording did NOT address the issue brought to the table by Mr. Rivest (an 

authority in the fields of security and encryption), namely the security and verifiability of 

election software. Instead, Mr. Craft deferred the resolution and killed the original intent. 

It has now been reduced to “make-work” for the NIST as Mr. Craft jokingly manifested. 

Have you considered which Mr. Craft’s motives were when he steered the resolution into 

a different issue? What is it to him whether or not the vendors can use a particular 

software or not? Wouldn’t it be sufficient to say that if their providers want to 

incorporate the software into the vendor’s system the providers MUST provide the source 

code? No source code, no deal. End of story (just as Dr. Williams said). It is an issue of 

national security, for goodness sake. 

Is Mr. Craft defending the interests of the Florida Department of State, Voting Systems 

National Association of State Election Directors or the interests of all the American 

people? Mr. Craft said “what you propose here ultimately requires voting system vendors 

to go outside the scope of expertise they currently have” and later he goes on to say 
“there are ways of studying that and doing that without restricting the vendors to a 

survey ... process of betting their off-the-shelf software’. These words were spoken just 

several minutes after Commissioner Martinez’s opening remarks “we must not disappoint 

those who have place immense responsibility upon us, policymakers, election 

administrators, advocates and most important of all the American people”. 

Time and again, we saw and heard that all security and privacy related resolutions 

presented by Mr. Rivest were watered down to allow vendors to continue operating their 

current “leaky” systems, exposing the American people to breaches in security, privacy, 

and confidentiality. See for yourself before-and-after of Resolutions #15-05 (1:10:14 

Marker) and #35-05 (1:37:00 Marker). They were reworded from its original language of 

“prohibit” or “excluded from voting systems” to “extremely risky” or “severe risk”. In 

every instance, Mr. Craft, who is not an expert in matters of security rewords the 

resolutions and blatantly defends the vendors: “it allows existing systems to continue to 

be used and, it is very specifically aimed at allowing the vendors and system developers 

to continue research on how to appropriately and securely use wireless technology”; 

what a contradiction. First Mr. Craft claimed that the vendors have no expertise in 

writing software, now he claims they not only have the expertise to write software but 

also that for creating a secure hardware for wireless communications. Clearly, these two 

contradictory positions point towards allowing a government election official to 

manipulate the results of an election without being detected. 

Mr. Craft said: “The resolution as drafted and as amended would outlaw use of ES&S’s 

Ivotronic voting system, it would make illegal the voting system being used by 40% of the 

voters in Florida and it would jeopardize the nations ability to conduct the 06 elections.” 

That the State of Florida “unknowingly” purchased equipment that would open the doors 

to a government election official to manipulate the results of an election without being 

detected can be excusable, but to try to reduce the nation’s standards in defense of such a 

poor decision is traitorous, hence unthinkable.

I hope that NIST will pick up on the intentions presented by Dr. Rivest’s “original 

resolutions” and reinstate with clarity what the issue really is, not the vendors capacity or 

lack thereof to comply with the new voting guidelines. 

Holiness and sanctity can no longer be claimed by government election officials, as Mr. 

Craft’s behavior indicates. The stark reality is that governments alone can NOT 

guarantee the security and transparency that the electoral process requires (see my 

position on this matter by clicking HERE). 

Therefore, I respectfully request the EAC and the TGDC members to examine Paul 

Craft’s questionable behavior thoroughly. 

Cc Mr. Paul Craft 

 EAC Commissioners