Election Reform and Electronic Voting Systems (DREs): Analysis of Security Issues
Released: 2003-11-04T00:00:00

Background and History of the Issue

Many innovations that have become familiar features of modern elections originated at leastin part as a way to reduce election fraud such as tampering with ballots to change the vote count fora candidate or party. For example, in much of nineteenth century America, a voter typically wouldpick up a paper ballot preprinted with the names of candidates for one party and simply drop theform into the ballot box. There was no need to actively choose individual candidates. (3) This ticketor prox ballot was subject to fraud in at least two ways. First, the number and sequence of ballotsprinted was not controlled, so it could be difficult to determine if a ballot box had been stuffed withextra ballots or if ballots had been substituted after votes were cast. Second, an observer coulddetermine which party a voter had chosen by watching what ballot the voter picked up and depositedin the ballot box -- votes could therefore be bought or coerced with comparative ease.

Australian Secret Ballot. After a series of scandals involving vote-buying in the 1880s, calls for reform led to widespread adoption of theAustralian or mark-choice ballot. (4) Such ballots listthe names of all candidates, and the voter marksthe ballot to choose among them. The ballots are commonly printed with unique, consecutive serialnumbers, facilitating ballot control and thereby helping to prevent ballot stuffing and substitution. All printed ballots are otherwise identical, and voters typically fill them out in the privacy of a votingbooth. This ballot secrecy makes it difficult for anyone else to know with certainty what choices avoter has made. While providing improved security, the Australian secret ballot did not eliminatetampering. Ballots could still be removed, spoiled, or altered by corrupt pollworkers, or evensubstituted or stuffed, although with greater difficulty than with prox ballots. It also did noteliminate the possibility of vote-buying or coercion, but it made them more difficult. (5)

Mechanical Lever Machine. One way to eliminate some means of ballot tampering is to eliminate document ballots. That became possiblewith the introduction of the lever voting machine in 1892. With this system, a voter enters the votingbooth and sees a posted ballot with a small lever near the name of each candidate or other ballotchoice. The voter chooses a candidate by moving the appropriate lever. Mechanical interlocksprevent voters from choosing more candidates than permitted for an office (such as two candidatesfor President). After completing all choices, the voter pulls a large lever to cast the ballot, and thevotes are recorded by advances in mechanical counters in the machine. The lever machine thereforeeliminates the need to count ballots manually. Instead, pollworkers read the numbers recorded bythe counters. Because there is no document ballot, recounts and audits are limited to review of totalsrecorded by each machine. Of course, tampering is also possible with lever machines. For example,the mechanisms could be adjusted so that the counter does not always advance when a particularcandidate is chosen.

Computer-Assisted Counting (Punchcard and Optical Scan). Another major technological advance in voting -- the first use of computersto count votes -- came with the introduction of the punchcard system, first used in 1964. Theoptical-scan voting system, which also uses computers for vote-counting, was first used in the 1980s. In both kinds of voting system, document ballots are fed into an electronic reader and the talliesstored in computer memory and media. Tallying can be done at either the precinct or a centrallocation. Computer-assisted counting of document ballots can be done very rapidly, thus speedingthe reporting of election results. It is much more efficient for counting large numbers of ballots thanmanual tallying. It makes some kinds of tampering more difficult than with manual counting, butit does not eliminate them, and it creates possibilities for tampering with the counting software andhardware.

Electronic Voting Machine. DREs (direct recording electronic systems) are the first completely computerized voting systems. They wereintroduced in the 1970s. DREs are somewhat analogous to (although more sophisticated than) levermachines. The voter chooses candidates from a posted ballot. Depending on the equipment used, theballot may be printed and posted on the DRE, as it is with a lever machine, or it may be displayedon a computer screen. Voters make their choices by pushing buttons, touching the screen, or usingother devices. The voter submits the choices made before leaving the booth, for example by pushinga "vote" button, and the votes are then recorded electronically.

There is considerable variability in the design of DREs, but they can be classified into three basic types. The oldest design essentially mimics the interface of a lever machine. The entire postedballot is visible at once. Instead of moving levers to make choices, the voter pushes a button nextto a candidate's name, or pushes on the name itself, triggering an underlying electronic microswitchand turning on a small light next to the choice. With the second type, a ballot page is displayed ona computer screen, and the voter uses mechanical devices such as arrow keys and buttons to makechoices on a page and to change ballot pages. The third type is similar to the second except that ithas a touchscreen display, where the voter makes a choice by touching the name of the candidate onthe computer screen and casts the ballot by pressing a separate button after all choices have beenmade. In all kinds of DREs, when a ballot is cast, the votes are directly stored in a computer memorydevice such as a removable memory card or nonvolatile memory circuit. As with lever machines,there is no document ballot, although with a DRE each cast ballot may also be separately recorded.

Touchscreen and other DREs using computer-style displays are arguably the most versatile anduser-friendly of any current voting system. Each machine can easily be programmed to displayballots in different languages and for different offices, depending on voters' needs. It can also beprogrammed to display a voter's ballot choices on a single page for review before casting the vote. It can be made fully accessible for persons with disabilities, including visual impairment. (6) Like levermachines, it can prevent overvotes and ambiguous choices or spoilage of the ballot from extraneousmarks, since there is no document ballot; but it can also notify voters of undervotes. (7) No other kindof voting system possesses all of these features.

DREs and HAVA. The popularity of DREs, particularly the touchscreen variety, has grown in recent years, (8) and their use is expected to increasesubstantially under provisions of HAVA. Three provisions in the Act are likely to provide such animpetus. First, HAVA authorized $3.65 billion over four years for replacing punchcard and levermachines and for making other election administration improvements, including meeting therequirements of the Act. In FY2003, Congress appropriated $1.48 billion for these purposes ( P.L.108-7 ), and the Administration requested $500 million for FY2004. Second, beginning in 2006,HAVA requires that voting systems notify voters of overvotes and permit them to review theirballots and correct errors before casting their votes. (9) Third, the Act requires, also beginning in 2006,that each polling place used in a federal election have at least one voting machine that is fullyaccessible for persons with disabilities. DREs are the only machines at present that can fulfill theaccessibility requirement. They can also easily meet the requirements for error prevention andcorrection.

Security Concerns about DREs. One thing that distinguishes DREs from document ballot systems is that with DREs, the voter does not see theactual ballot, but rather a representation of it on the face of the machine. With few exceptions,current DREs do not provide a truly independent record of each individual ballot that can be usedin a recount to check for machine error or tampering. The ballot itself consists of redundantelectronic records in the machine's computer memory banks, which the voter cannot see. This isanalogous to the situation with mechanical lever voting machines, where casting the ballot movescounters that are out of view of the voter. In a lever machine, if the appropriate counters do notmove correctly when a voter casts the ballot, the voter will not know, nor would an observer. Similarly, with a DRE, if the machine recorded a result in its memory that was different from whatthe voter chose, neither the voter nor an observer would know. (10)

The same is true with a computerized counting system when it reads punchcards or optical scan ballots. Even if the ballot is tabulated in the precinct and fed into the reading device in the presenceof the voter, neither the voter nor the pollworker manning the reader can see what it is recording inits memory. However, with such a reader, the ballot documents could be counted on anothermachine or by hand if there were any question about the results.

Lever machines also do not have an independent document ballot. That has led some observers to distrust those machines, but most who use them appear confident that tests and other proceduralsafeguards render them sufficiently safe from tampering. Is the same true for DREs? Somecomputer experts think not, arguing that the software could be modified in ways that could alter theresults of an election and that would be very difficult to detect. This concern appears to stem largelyfrom three factors:

Malicious computer code, or malware, can often be written in such a way that it is very difficult to detect. (11)

DRE software is moderately complex, and it is generally accepted that the morecomplex a piece of software is, the more difficult it can be to detect unauthorized modifications. (12)

Most manufacturers of DREs treat their software code as proprietaryinformation and therefore not available for public scrutiny. Consequently, it is not possible forexperts not associated with the companies to determine how vulnerable the code is to tampering. (13)

Voting System Standards and Certification. Concerns such as those described above have been voiced by some experts at least since the 1980s. (14) Thedevelopment of the Voluntary Voting Systems Standards (VSS) by the Federal Election Commission(FEC) in 1990, and the subsequent adoption of those standards by many states, helped to reducethose concerns. The VSS were developed specifically for computer-assisted punchcard, optical scan,and DRE voting systems. They include a chapter on security, which was substantially expanded inthe updated version, released in 2002. (15) Alongwith the standards, a voluntary testing andcertification program was developed and administered through the National Association of StateElection Directors (NASED). In this program, an independent test authority (ITA) chosen byNASED tests voting systems and certifies those that comply with the VSS. (16) Testing is done of bothhardware and software, and the tested software and related documentation is kept in escrow by theITA. (17) If questions arise about whether thesoftware used in an election has been tampered with, thatcode can be compared to the escrowed version. Systems that receive NASED certification may alsoneed to go through state and local certification processes before being used by an electionjurisdiction.

HAVA creates a new mechanism for the development of voluntary voting system standards. It creates the Election Assistance Commission (EAC) to replace the FEC's Office of ElectionAdministration and establishes three bodies under the EAC: a 110-member Standards Boardconsisting of state and local election officials, a 37-member Board of Advisors representing relevantgovernment agencies and associations and fields of science and technology, and a 15-memberTechnical Guidelines Development Committee chaired by the Director of National Institute ofStandards and Technology (NIST). This last committee is charged with making recommendationsfor voluntary standards (called guidelines in the Act), to be reviewed by the two boards and theEAC. (18)

HAVA also requires the EAC to provide for testing, certification, and decertification of voting systems and for NIST to be involved in the selection and monitoring of testing laboratories. TheEAC is also required to perform a study of issues and challenges -- including the potential for fraud-- associated with electronic voting, and periodic studies to promote accurate, secure, andexpeditious voting and tabulation. HAVA also provides grants for research and development onsecurity and other aspects of voting systems. The voting system requirements in the Act do notspecifically mention security but do require that each voting system produce a permanent paper auditdocument for use as the official record for any recount. This requirement is for the system, not foreach ballot. For example, most DREs can print a tally of votes recorded and therefore can meet thisrequirement.

The Caltech/MIT Study. The problems identified after the November 2000 federal election prompted wide public concern about voting systems and led toseveral major studies (19) with recommendations,many of which were incorporated in HAVA. Themost extensive examination of security was performed by scientists at the California Institute ofTechnology and the Massachusetts Institute of Technology. Their report identified four mainsecurity strengths of the electoral process that has evolved in the United States: the openness of theelection process, which permits observation of counting and other aspects of election procedure; thedecentralization of elections and the division of labor among different levels of government anddifferent groups of people; equipment that produces "redundant trusted recordings" of votes; and thepublic nature and control of the election process. (20) The report expressed concern that current trendsin electronic voting are weakening those strengths and pose significant risks, but that properlydesigned and implemented electronic voting machines can improve, rather than diminish, security.

The California Task Force Report. The concernsexpressed by the Caltech/MIT study and others were partially addressed by HAVA, but as statesbegan to acquire DREs, and the appointment of EAC members was delayed, (21) some observers beganexpressing concerns that states were purchasing flawed machines with no federal mechanism inplace for addressing the problems. In response to such concerns, the California secretary of stateestablished a task force to examine the security of DREs and to consider improvements. The report (22) recommended changes to how voting systems are tested at the federal, state, and local levels, as wellas other changes in security for software and for vendor practices. It also recommended theimplementation of a voter-verified audit trail -- that is, a mechanism, whether paper-based orelectronic, that produces an independent record of a voter's choices that the voter can verify beforecasting the ballot and that can be used as a check against tampering or machine error. Until such asystem can be implemented, the task force recommended the use of "parallel monitoring," in whicha selection of machines are tested while in actual use on election day to determine if they arerecording votes accurately.

The Hopkins Study. Until recently, the concerns raised about DRE vulnerabilities were considered by many to be largely hypothetical. However, inearly 2003, some election-reform activists discovered (23) an open website containing large numbersof files relating to voting systems of Diebold Election Systems, a major voting system vendor whichhad recently won contracts with Georgia and Maryland to provide touchscreen DREs. Activistsdownloaded and posted many of those files on Internet sites, and the authors of the Hopkins studyused some of those files to analyze computer source code that "appear[ed] to correspond to a versionof Diebold's voting system." (24) Their analysisconcluded that the code had serious security flaws thatcould permit tampering by persons at various levels, including voters, election workers, Internet"hackers," and even software developers. Diebold quickly rebutted those claims, (25) arguing that theywere based on misunderstanding of election procedures and of the equipment within which thesoftware was used, and that the analysis was based on an "inadequate, incomplete sample" ofDiebold's software. Some computer scientists, while agreeing that the code contained security flaws,also criticized the study for not reflecting standard election procedures. (26)

Shortly after the Hopkins study was released, Maryland Governor Robert Ehrlich ordered that the contract with Diebold be suspended pending the outcome of an independent security analysis. That analysis, (27) while agreeing with several ofthe criticisms of the Hopkins study, found that theDiebold system, as implemented in the state, had serious security flaws. The report concludesoverall that this voting system, "as implemented in policy, procedure, and technology, is at high riskof compromise" and made many recommendations for improvements. (28) The Maryland State Boardof Elections has developed a plan to implement those recommendations. (29)

The extent to which the risks identified in the Maryland study may apply to other states or to other DREs may be worth examination by state officials. In Ohio, which has also been consideringthe purchase of Diebold DREs, secretary of state Kenneth Blackwell has also initiated a securityevaluation of electronic voting devices from four v endors. (30)

Analysis of the Problem

Elections are at the heart of the democratic form of government, and providing sufficientsecurity for them is therefore critical to the proper functioning of a democracy. There has been somedisagreement among experts about the seriousness of the potential security problems with DREs and,therefore, what is needed to ensure sufficient security. While it is generally accepted that tamperingis possible with any computer system given enough time and resources, some experts believe thatcurrent security practices are adequate. Others believe that substantial additional steps are needed. To determine the nature and extent of the problem and what solutions might be considered requiresan understanding of some general concepts in computer security, which are discussed in this section,along with their applicability to computer-assisted voting systems. The discussion is organized alongfour themes: threats, vulnerabilities, defense, and response and recovery after an incident occurs.

The term threat can be used in several different ways, but in this report it refers to a possible attack -- what could happen. Descriptions of threats often include both the nature of the possibleattack, those who might perpetrate it, and the possible consequences if the attack is successful. Vulnerability usually refers to a weakness that an attack might exploit -- how an attackcould beaccomplished. Analysis of threats and vulnerabilities, when combined, can lead to an assessmentof risk . Statements of risk often combine both the probability of a successful attack and somemeasure of its likely consequences. (31) Defense refers to how a system is protected from attack. Response and recovery refer to how, and how well, damage is mitigated and repaired andinformation and functionality are recovered in the event of a successful attack.

Threats

Kinds of Attacks and Attackers. The best known type of attack on a voting system is one that changes the vote totals from what voters actually cast. Historically, such tampering has been performed by corrupt officials or partisans, one of the mostfamous examples being Tammany Hall in New York City, of which Boss Tweed said, "the ballotsmade no result; the counters made the result." (32) Sometimes, others who stood to benefit from aparticular outcome would be involved, as was reportedly the case with respect to allegations ofvote-buying in Indiana with money from some of New York's "robber barons" in the presidentialelection of 1888. (33) The goal of such tamperingwould generally be to influence the final vote tallyso as to guarantee a particular result. That could be accomplished by several means, such as adding,dropping, or switching votes. Many of the features of modern voting systems -- such as secretballoting and the use of observers -- are designed to thwart such threats.

The impact of such vote tampering depends on several factors. Two of the most important are the scale of an attack and the competitiveness of the contest. An attack would have to have sufficientimpact to affect the outcome of the election. For that to happen, scale is critical. If tamperingimpacts only one ballot or one voting machine, the chances of that affecting the election outcomewould be small. But tampering that affects many machines or the results from several precinctscould have a substantial impact, although it might also be more likely to be detected. The scale ofattack needed to affect the outcome of an election depends on what proportion of voters favor eachcandidate. The more closely contested an election is, the smaller the degree of tampering that wouldbe necessary to affect the outcome. (34)

While attacks that added, subtracted, or changed individual votes are of particular concern, other kinds of attacks also need to be considered. One type of attack might gather information thata candidate could use to increase the chance of winning. For example, if vote totals from particularprecincts could secretly be made known to operatives for one candidate before the polls closed, (35) theresults could be used to adjust get-out-the-vote efforts, giving that candidate an unfair advantage. Another type of attack might be used to disrupt voting. For example, malware could be used tocause voting machines to malfunction frequently. The resulting delays could reduce turnout, perhapsto the benefit of one candidate, or could even cause voters to lose confidence in the integrity of theelection in general. The latter might be of more interest to terrorists or others with an interest inhaving a negative impact on the political system generally.

An Evolving Threat Environment. The kinds ofattacks described above are potential threats against any voting system. However, the growing useof information technology in elections has had unique impacts on the threat environment. It providesthe opportunity for new kinds of attacks, from new kinds of attackers. As information technologyhas advanced and cyberspace has grown, so too have the rate and sophistication of cyberattacks ingeneral: (36)

The number of reported computer-security violations has grown exponentially in the past decade, from about 100 in 1989 to more than 100,000 in the first three quarters of 2003. (37)

Potential threats may now come from many sources -- amateur or professionalhackers using the Internet, insiders in organizations, organized crime, terrorists, or even foreigngovernments. With respect to election tampering, some such attackers could benefit in traditionalways, but some, such as terrorists, might be interested instead in disrupting elections or reducing theconfidence of voters in the electoral process.

New and more ingenious kinds of malware are constantly being invented andused. There are now tens of thousands of known viruses, and the sophistication of tools used todevelop and use new ones has increased.

Malware in a voting system could be designed to operate in very subtle ways, for example,dropping or changing votes in a seemingly random way to make detection more difficult. Malwarecan also be designed to be adaptive -- changing what it does depending on the direction of the tally. It could also potentially be inserted at any of a number of different stages in the development andimplementation process -- from the precinct all the way back to initial manufacture -- and lie inwait for the appropriate moment.

Several other kinds of attack could also be attempted in addition to malware. Among them are electronic interception and theft or modification of information during transport or transmission,modifications or additions of hardware, and bypassing system controls or misuse of authority totamper with or collect information on software or election data. (38)

Vulnerabilities

The threats discussed above, and others, are of course only harmful potentially. Their mere existence does not in itself imply anything about the likelihood that they are a significant risk in agenuine election. To be such a risk, there must be vulnerabilities in the voting system that can beexploited. For the purposes of this report, discussion of vulnerabilities is divided into two categories-- technical and social.

Technical Vulnerabilities. This category includes weaknesses stemming from the computer code itself, connection to other computers, and the degreeof auditing transparency of the system.

Computer Code. In the recent public debate about the security of DREs, much of the attention has focused on the computer code. Two significant potentialvulnerabilities relate to the use of cryptography in the system and the way the code is designed. Cryptography (39) is oneof the most powerful tools available for protecting the integrity of data. Robust cryptographic protocols are well-developed and in common use, for example in onlinefinancial transactions. Cryptography is important not only in making it difficult for unauthorizedpersons to view critical information (security), but also in making sure that information is notchanged or substituted in the process of being transferred (verification). This could be a concern forDREs; both the Hopkins and Maryland studies found weaknesses in the way encryption was used.

The design of software can have a significant effect on its vulnerability to malware. Both the complexity of the code and the way it is designed can have an impact. It is a general principle ofcomputer security that the more complex a piece of software is, the more vulnerable it is to attack. That is because more complex code will have more places that malware can be hidden and morepotential vulnerabilities that could be exploited, and is more difficult to analyze for securityproblems. In fact, attackers often discover and exploit vulnerabilities that were unknown to thedeveloper, and many experts argue that it is impossible to anticipate all possible weaknesses andpoints of attack for complex software. With DREs, each machine requires relatively complex software, since it serves as a voter interface, records the ballot choices, and tallies the votes cast onthe machine. (40) The first function requires the mostcomplex software, especially if the machine isto be fully accessible to all voters. The code used in optical-scan and punchcard readers can besimpler, as it performs fewer functions.

Software code that is not well-designed from a security perspective is more likely than well-designed code to have points of attack and weaknesses that could be exploited, as well as placesfor malware to be hidden. However, code can be designed so as to minimize such vulnerabilities,and well-developed procedures have been established to accomplish this goal. (41) These procedurescan be applied to both new and legacy systems. Good design involves not only the code itself, butalso the process by which it is developed and evaluated. DRE code has been criticized with respectto its design, (42) although the proprietary nature ofthe software has precluded thorough publicassessment. The systems may also use commercial off-the-shelf software for functions such as theoperating system, and that software could also have vulnerabilities. However, the software in themajor systems in use today has been evaluated and certified as meeting VSS requirements,includingthose for security. (43)

Connection to Other Computers. This can be a vulnerability because it provides potential avenues for attack. The most well-known attack targetsare computers with direct Internet connections that hackers can exploit. Concerns about such attackshave made the adoption of Internet voting in public elections generally unattractive so far from asecurity perspective. (44) While a measure ofprotection can be provided by firewall programs andrelated technology, the safest approach is to ensure that the voting system computers, including notjust the voting machines themselves but also computers involved in ballot generation and votetallying, are not connected to the Internet or to any other computers that are themselves connectedto the Internet. This isolation is sometimes called "air-gapping." However, an effective air gap mustinclude sufficient security controls for removable media such as floppy disks, (45) CDs, and the memorycards that are often used to transport data from the precinct to the central election office. (46)

Vendors and election jurisdictions generally state that they do not transmit election results from precincts via the Internet, but they may transmit them via a direct modem connection. However,even this approach can be subject to attack via the Internet, especially if encryption and verificationare not sufficient. That is because telephone transmission systems are themselves increasinglyconnected to the Internet (as exemplified, for example, by the increasing use of Internet-basedtelephony), and computers to which the receiving server may be connected, such as through a localarea network (LAN), may have Internet connections. In fact, organizations may be unaware of theextent of such connections. (47) This can be evenmore of an issue if the system uses wirelessconnectivity.

The way that a voter interacts with the DRE may provide another possible source of connection. For example, with the Diebold DRE, a "smartcard" (48) is inserted into the voting machine to start thevoting process (some machines use other methods, such as a numerical code). The Hopkins studyclaims that voters or pollworkers could program their own smartcards and use them to voterepeatedly or to manipulate the voting machine. The Diebold rebuttal rejected this assertion. TheMaryland study, while not ruling out this vulnerability, states that software and physical controls,and the openness of the voting booth, (49) minimizethe likelihood of exploitation.

Auditing Transparency. In current DREs, the actionsthat occur between ballot screen and the final vote tally are not subject to human observation. Thevoter sees a visual representation of the ballot on the computer screen or face of the DRE. When thevoter pushes the button to cast the ballot, the machine records the votes electronically. That meansthat a voter cannot know if the machine recorded the choices the voter saw on the screen or someother choices, and an observer also cannot check to see if all ballots cast are counted correctly. Theformer vulnerability also exists with a mechanical lever machine, and the latter with an optical scanor punchcard ballot reader, but with a reader, there is a document ballot that can be checkedindependently. While DREs are generally designed to make a separate recording of each ballotcast, (50) this is not an independent record but rathera copy in a different format of the information sentto the tallying registers.

Social Vulnerabilities. A significant and increasingly sophisticated kind of attack -- dubbed "social engineering" by hackers -- involvesfinding and exploiting weaknesses in how people interact with computer systems. (51) Such socialvulnerabilities can include weaknesses relating to policy, procedures, and personnel. Of the 14specific risks identified in the Maryland study, most were of these types. (52)

Policy. A security policy lays out the overall goalsand requirements for a system and how it is implemented, including the technology itself,procedures, and personnel. (53) An absent or weakpolicy, or even a good one, if it is not implemented,is considered a substantial vulnerability. Security policies of election administrators, vendors,third-party suppliers, and the ITAs are all relevant. The Maryland study found that the Dieboldsystem as implemented did not comply with the state's information security policy and standards. The study did not examine the security policies of Diebold or other relevant entities.

Procedure. The security policy provides the basis from which procedures such as access controls are developed. Election administration is a complexeffort involving vendors, ITAs, state and local government, and pollworkers who are oftenvolunteers, as well as voters. Also, DREs are potentially targets of attack at virtually any point fromwhen they are initially developed and manufactured to when they are used in the polling place. Consequently, security procedures are especially important. Vulnerabilities can occur, for example,if the controls that the manufacturer uses to prevent insertion of malware are inadequate; if theanalyses performed by evaluators is not sufficient to detect security problems with the technology;if the chain of custody for software, including updates -- from when it is certified to when it is usedin an election -- is weak or poorly documented; or if auditing controls are insufficient. As withsecurity policy, absent or poor procedures, or even good ones if they are not properly implemented,can create serious vulnerabilities. The Maryland study did not examine vendor or ITA practices (54) but did raise several concerns with respect to the procedures used by the state.

Personnel. Perhaps the most important single factor in determining the vulnerability of a system is the people involved. It is they who must implementsecurity policies and procedures and defend against any attacks. If they are not adequately skilledand trained, they may be unable to prevent, detect, and react to security breaches, and they maythemselves be more vulnerable to a "social engineering" attack. In addition, it can be particularlydifficult to defend against attack by an insider, so background checks and other controls to minimizethat risk are especially important. The Maryland study pointed out that the state training programfor the Diebold system did not include a security component.

Defense

Goals of Defense. It can be useful to think of three goals of defense from an attack on a computer-based system: protection, detection, andreaction. (55) Protection involvesmaking a target difficult or unattractive to attack. For example, goodphysical security can prevent attackers from accessing voting machines in a warehouse. Use ofencryption and authentication technologies can help prevent attackers from viewing, altering, orsubstituting election data when it is transferred.

Currently, election jurisdictions and vendors appear to rely heavily on procedural mechanisms for protection. (56) These may include accesscontrols, certification procedures, pre-electionequipment-testing, and so forth. Such procedures are an essential element of an effective defense,although some observers dispute that they are sufficient to prevent tampering. Even if they are, theymust be implemented and followed properly if they are to ensure adequate protection. However, insome circumstances, the time and resources needed to follow such procedures may conflict withother important goals, such as the timely administration of an election, forcing election officials tochoose whether to risk bypassing or modifying security procedures. (57)

Detection involves identifying that an attack is being or was attempted. For example, election observers can serve as detectors of a potential attack. One of the criticisms of DREs has been thatit is a "black box" system, and observers cannot detect suspicious activity within the machine. (58) Oneapproach to addressing this issue is the use of auditing. That can include engineering the DRE sothat it creates a log of all actions performed, especially those that might indicate tampering. It canalso include the creation of an audit trail for votes. HAVA requires such a trail for the votingsystem, but some observers have proposed the use of voter-verified ballots for auditing (discussedbelow (59) ). Cryptographic protocols may also beuseful in detecting attempts at tampering. (60) However, any specific mechanisms that might be built into the technology itself are proprietary andtherefore not discussed in this report.

Reaction involves responding to a detected attack in a timely and decisive manner so as toprevent its success or mitigate its effects. For example, if an observer sees something suspiciousduring voting or tallying, the process can be stopped and the situation investigated. Also, a votingmachine may be programmed to shut down if certain kinds of problems are encountered. The systemmight have additional defense measures such as antivirus software.

To be most effective, the countermeasure must be implemented before the attacker can do significant damage. Effective reaction therefore requires early detection of an attack. Given the lackof transparency of DRE operations, heavy reliance may need to be placed on technologicalcountermeasures.

Elements of Defense. It is generally accepted thatdefense should involve a focus on three elements: personnel, technology, and operations. (61) The personnel component focuses on a clear commitment to security by an organization's leadership,assignment of appropriate roles and responsibilities, implementation of physical and personnelsecurity measures to control and monitor access, training that is appropriate for the level of accessand responsibility, and accountability. The technology component focuses on the development,acquisition, and implementation of hardware and software. The operations component focuses onpolicies and procedures, including such processes as certification, access controls, management, andassessments.

A focus that is not properly balanced among those elements creates vulnerabilities. Computer security experts have criticized computer-assisted voting in part because they believe that thesecurity focus has emphasized procedural safeguards too heavily. The use of older, "legacy"hardware and software technology, and weak technology defenses, as well as lack of training ofelection personnel in security, are among the concerns experts have cited. The validity of suchconcerns has been disputed by others. (62)

For applications where security considerations are a priority, techniques have been developed to engineer systems to the appropriate level of security corresponding to the specific needs for theapplication. Such systems are designed with carefully specified requirements and are thoroughlyreviewed and tested before implementation. (63) Some experts have proposed that such an approachbe used in the development of voting systems. (64)

Another general principal is that an effective defense cannot be focused only on one particular location but needs to operate at all relevant points in the entire enterprise. (65) For voting systems,these points would likely include development (both software and hardware) by the manufacturer,the certification process, acquisition of the voting system (including software and hardware updates)by the state, state and local implementation, and use during elections. Because of the proprietarynature of vendor practices, the defenses used by them could not be determined for this report. (66) Stateprocedures are more transparent in many cases but vary from state to state. (67)

Finally, an effective defense is based on the assumption that attackers will continuously attempt to breach the defenses (including devising new ways to attack) and that they will eventually find avulnerability to exploit. Therefore, a successful defense should be robust, so that security needs aremet even if an attack occurs. (68) One way toaccomplish this is through a layered defense, in whichmore than one defense mechanism is placed between the attacker and the target. (69) If the outer layeris breached, the next comes into play. Each layer should include both protection and detectioncapability. For example, a state will use a combination of physical security (e.g., lock and key),procedural controls (e.g., who is given access to the system and for what purpose) and auditing (arecord of what was done and by whom) to defend against tampering with voting systems. Georgiadoes additional validation testing on software installed on machines in a local election jurisdictionto ensure that it is the same as the certified software. (70) Other states may have similar procedures.

Trade-Offs. The combined use of goals and elements as discussed above is known as defense in depth . Such a strategy requires balancing"protection capability and cost, performance, and operational considerations." (71) This balancing caninvolve difficult questions, especially with regard to resource allocation. For example, how mucheffort should be expended in threats that may have a significant probability but a comparatively lowimpact versus addressing those with very low probability but very high impact? The need to weighsuch trade-offs occurs throughout the security arena. In the area of homeland security, the numberof casualties from a terror attack using the smallpox virus could be much higher than from an attackwith explosives, but the latter is widely considered much more likely. Furthermore, there are manyother factors that must be weighed, such as balancing protection against the threat, on the one hand,against the safety of countermeasures (such as vaccines) and disruption to daily life (such asscreening for explosives) on the other.

Setting priorities with respect to investment in defense in such cases is far from straightforward. This is true for election administration as well. Decisions about what kinds of security to provideand how to provide it must be made in complex circumstances. For example, with DREs, theprobability of successful tampering occurring may be very small, but the impact of a successfulattack could be very high. At the same time, current DREs arguably reduce the risks of certain kindsof tampering that can occur with paper ballots -- such as selectively spoiling certain ballots duringcounting. Many DREs also have other highly desirable features, as discussed earlier, (72) that cansubstantially reduce the number of votes lost because of voter error or other problems. Accordingto one study, over a million of such "lost votes" could have been prevented during the November2000 presidential election if better-designed voting technology had been used. (73)

Also, security measures may have unanticipated impacts. Measures that made voting much more difficult or complicated and thereby discouraged voters from participating or increased the rateof voter or pollworker error would probably not be worth implementing. Furthermore, votingmachines are only part of the election administration system, and security must be integral to thewhole system to be effective.

Response and Recovery

The idea that no defense is perfect and that attackers try to find the imperfections means that defenders need to assume that an attack will at some point be successful. Some damage will occurbefore the attack is detected and stopped (assuming that the attack is detected -- in the case of votetampering, an attacker would usually prefer that the attack not be discovered and will make effortsto hide it (74) ). For this reason, mechanisms forminimizing and recovering from damage that occursare considered desirable. They are also desirable in the event of damage that can result from sourcesother than an attack, such as power outages, malfunctioning voting machines, or administrativeproblems. For example, DREs store vote data in redundant memory locations, in the event that onememory fails. As the difficulties with spoiled ballots from the November 2000 Presidential electionindicated, (75) recovery from some kinds of damagemay not be possible, and reliance must be placedon strengthening preventive measures. Thus, HAVA requires that voters be notified of overvotesbefore a ballot is cast and be given the opportunity to correct errors. (76)

One criticism of DREs has been that if a problem is discovered during auditing, it is not clear what can be done to identify which votes were valid and which were not. For example, if a machineis suspected of harboring malware, should all votes from it be discarded, or would some be counted? How election officials answer such questions will depend on state law, regulations, and practices.

One mechanism for recovery from some kinds of problems is the recount, in which ballots are counted a second time to address concerns about the accuracy of the original count. DREs, like levermachines, simplify recounts and reduce chances for error in them because the recounts are based onthe vote tallies from the machines, rather than individual ballots. However, problems with themachines themselves, including tampering, would probably not be discovered through a recount.

Confidence in DREs

There appears to be an emerging consensus among computer scientists that current DREs, and to a lesser extent other computer-assisted voting systems, do not adhere sufficiently to currentlyaccepted security principles for computer systems, especially given the central importance of votingsystems to the functioning of democratic government. (77) However, election administrators and thosewith related expertise tend to express more confidence in the systems as they are currently realized. (78) Also, the fact that security concerns exist does not in itself mean that voting systems have beencompromised or are likely to be. It does, however, suggest that the issues raised need to beaddressed expeditiously, especially given the evolving threat environment and vulnerabilitiesdiscussed above.

The question of confidence in computer-assisted voting systems is important in general, since voters must have confidence in the integrity of the voting systems they use if they are to trust theoutcomes of elections and the legitimacy of governments formed as a result of them. If the concernsthat have been raised about DRE security become widespread, that confidence could be eroded,whether or not those concerns are well-founded. This potential problem could be exacerbated by twofactors. One is the likelihood, especially given the applicable provisions of HAVA, that the use ofDREs will increase. The other is the likelihood of increasing concentration of market share forvoting systems in a few companies. (79) Historically,election jurisdictions in the United States haveused a wide diversity of voting systems provided by a broad array of vendors. This diversity hasbeen considered an advantage by many, not only in meeting the diverse needs of electionjurisdictions, but also for security, especially in statewide and federal elections where more systemsmay be used. Some experts believe that it is much more difficult to successfully commit widespreadtampering with elections if many different systems need to be compromised than if only a few mustbe. In any case, as the usage of DREs increases, they and the companies that make and sell themmay be subjected to increased public scrutiny.

For these and other reasons, many experts and observers have proposed actions to resolve the controversy over DRE security. Several of these ideas are discussed below.

Proposals for Resolving the Issue

Use Current Procedures

Some observers have argued that existing security mechanisms are sufficient to resolve any problems and that no new solutions are necessary, although current procedures may need to beimproved, as recommended by the Maryland study. (80) These observers argue that the federal VotingSystem Standards (VSS); NASED, state, and local certification processes; and vendor and electionadministration procedures and controls, when properly implemented, provide sufficient security toprevent tampering. They also point to the lack of any proven case, despite many accusations, ofelection fraud involving computer tampering, (81) and that criminal penalties provide a deterrent toelection fraud. (82) Critics state, in contrast, thatthose processes and procedures are flawed, and thatrecommended or stated security procedures are not always followed. They also point out that theabsence of a proven case of tampering does not necessarily mean that it has not been attempted, andthat as the usage of DREs increases, the potential payoff for tampering, and hence the potentialthreat, will also increase. (83)

Improve Security Standards and Certification of Voting Systems

Some critics have stated that the security provisions in the VSS are insufficient, (84) and that theirdevelopment did not follow best practices in this area, as promulgated and practiced, for example,by national and international standards-setting organizations such as the American NationalStandards Institute (ANSI), the International Organization for Standardization (ISO), and NIST,which has been involved only marginally in the development and implementation of the VSS. (85) TheVSS have also been criticized for placing too many constraints on the development of newtechnology that can address security concerns. (86) Critics also point out that several of the problemsidentified by the Hopkins and Maryland studies occurred despite the certification by NASED thatthe Diebold system conforms to the VSS.

HAVA requires changes in the processes for developing standards for and certifying voting systems. It establishes a Technical Guidelines Development Committee under the new ElectionAssistance Commission to assist the EAC in the development of voluntary voting system guidelines. These guidelines will essentially replace the current Voluntary Voting System Standards (VSS), butthe Act also stipulates that the initial set of guidelines will be the most recently adopted version ofthe VSS. The new Committee established by HAVA will be chaired by the Director of NIST and willinclude, among others, representatives of ANSI, the Institute of Electrical and Electronics Engineers(IEEE), and NASED. IEEE has already begun developing new draft voting system standards. (87) These standards would presumably be used to help inform the guideline-development process oncethe EAC and its support bodies are established.

The importance of standards was reinforced with the initial adoption and implementation of the VSS, which led to significant improvements in computer-assisted voting systems. Standards areessential to security because they specify measurable attributes a system needs to be consideredtrustworthy, and they can reduce design flaws. (88) However, a particular challenge that arises withrespect to security standards is that it is not possible to anticipate all the ways a system might beattacked. In addition, standards can provide adversaries with information they can use in searchingfor vulnerabilities. (89) Therefore, security standardsneed to be continually reevaluated as new threatsand vulnerabilities are discovered. Also, it is considered risky to treat adherence to standards as anindication that a system is secure. (90) The federalgovernment requires that federal agencies adhereto a set of computer-security policies, standards, and practices, (91) but these do not apply to votingsystems, which are under the purview of state and local governments.

Standards can be difficult and time-consuming to develop, especially under the commonly used consensus approach, in which stakeholders reach agreement on provisions to be included. Strengthsof this approach, when properly implemented, are that the resulting standards are less likely tocontain substantial omissions, and they are more likely to be acceptable to users and otherstakeholders. Efforts to develop the VSS began in the 1970s, but the standards were not approveduntil 1990. (92) The Common Criteria forInformation Technology Security Evaluation (ISO/IEC15408), which is a set of requirements for evaluating the security of information technology, tookfive years to develop, efforts having been begun in 1993 and completed in 1998. (93) The IEEE votingstandards project began in 2001 and has proceeded amid some controversy, which apparently is notatypical for standards panels addressing difficult issues. (94) Given those considerations and the delaysin establishing the EAC, it is not clear whether new standards or guidelines will be in place beforethe HAVA voting system requirements go into effect in January 2006; however, HAVA requires theTechnical Guidelines Development Committee to submit its initial recommendations to the EACwithin nine months of the Committee's appointment. (95) In any case, even after new standards areapproved, there remain issues relating to testing and certification. For example, should all votingsystems be required to adhere to the new guidelines or should those certified under the VSS continueto be accepted?

The current process for testing and certification of voting systems was initiated by NASED in 1994. HAVA directs the EAC to provide for "testing, certification, decertification, andrecertification of voting system hardware and software by accredited laboratories" (Sec. 231(a)(1)). It gives NIST responsibility for recommending and reviewing testing laboratories.

While HAVA maintains the voluntary nature of adherence by states to federal voting system standards and use of certified systems, most states have adopted the VSS. (96) Consequently, if theEAC decertifies voting systems that do not meet the new guidelines, many states would likelyreplace those systems, provided that funding were available to do so. However, the more stringenta set of standards is with respect to security, the more time-consuming and expensive it may be totest and certify the system (some have criticized the Common Criteria for this reason, althoughothers have suggested that they be applied to voting systems (97) ). More secure systems may also bemore expensive to manufacture. Consequently, there may be economic disincentives for investmentin highly secure voting systems, although such disincentives would likely become less important ifpublic concern grows.

Under the current VSS, testing is performed under specific laboratory test conditions. Such tests are necessary to determine if the system meets the standards, but some experts have proposedthat they are not sufficient, that additional testing needs to be done under realistic conditions of use,involving actual voters, and that systems should be retested after use in the field. (98)

Even if new guidelines and certification procedures can be developed that include state-of-the-art security features, some observers believe that this will not be sufficient. They pointto three problems: (1) Given the time required to develop and implement new voting systemguidelines and to test and certify systems under them, systems reflecting such guidelines will not bein place for several years, whereas the threat from cyberattacks is present and growing. (2)Overreliance on any one line of defense, such as security standards, runs counter to therecommended use of defense in depth. (3) The use of standards does nothing about the reducedobservability and transparency that characterizes computerized voting systems (99) in contrast to moretraditional systems, and therefore cannot sufficiently address concerns about public confidence inthe integrity of computer-assisted voting. Some experts also believe that certification and proceduralcontrols, including auditing, can never guarantee security of a voting system. (100) This problem, theysay, is further complicated by the need for ballot secrecy, which is not an issue, for example, incomputerized financial transactions.

Use Open Source Software

Some experts have proposed the use of open source software code for at least some voting system software. (101) Such code would beavailable for public inspection and undergo thoroughsecurity review, and these experts argue that it would therefore be more secure because the opensource review process would be more thorough and identify more potential security flaws than ispossible with proprietary code. Advocates of proprietary or closed source code argue, in contrast,that this approach makes potential flaws more difficult to discover and therefore to exploit. Evenif open source code is superior with respect to security (which remains unproven), DREs often usecommercial off-the-shelf (COTS) software (such as Microsoft Windows) that is proprietary. (102)

Currently, the code for virtually all voting system software in the United States is closely heldby the vendors, who release it only to select parties, such as the ITAs, under nondisclosureagreements. The vendors argue that the use of proprietary software is important both to protect theirintellectual property rights and for security. While secrecy can be an important security tool(sometimes called "security through obscurity"), it has some weaknesses. First, it is fragile, in thatonce this defense is breached, the damage cannot be repaired -- the code cannot be made secretagain. Second, use of secrecy limits the number of people who can examine the code, therebylimiting the scrutiny it can receive for vulnerabilities. Both of these potential weaknesses weredemonstrated by the circumstances leading to the Hopkins study. Diebold code was posted (perhapsinadvertently) on an open Internet server; the authors analyzed this code and claimed to havediscovered several vulnerabilities (which Diebold disputed).

Some have proposed resolving this issue by using a modular approach that separates the voterinterface or ballot choice function (equivalent to marking an optical-scan ballot) from thevote-casting function (putting the ballot in the optical-scan reader). (103) The software for the latterwould be open source and standardized and for the former proprietary and more flexible. Thereasons are that vote casting is a straightforward, well-defined process that requires high security toensure that the voter's actual choices are recorded and counted, whereas the voter interface is whereinnovations can provide the greatest advances in usability and other benefits for voters, and thesecurity requirements are not as stringent. The code used for vote casting and counting can be muchsimpler than that needed for the voter interface, making security potentially much easier to achievethan is currently the case with DREs, where both functions are housed within a single unit.

Improve Verifiability and Transparency

Verifiability in elections can be thought of as consisting of two components. One involves thecapability of the voter to verify that his or her ballot was cast as intended. This is what is usuallymeant by voter verifiability . The other involves the capability to determine that the final tallyaccurately reflects all votes as cast by the voters and that it includes no additional votes -- in otherwords, that no votes were improperly changed, omitted, or added. This has been called resultsverifiability . (104) If all voters can obtainboth voter and results verifiability, that is known as universalverifiability . (105) Roll-call voting providesrobust universal verifiability -- voters publicly record theirvotes, which are counted in the presence of all voters. However, this approach sacrifices ballotsecrecy and can be used only for very small electorates. While ballot secrecy reduces the risk of voteselling and coercion, it complicates verifiability, since voters cannot know directly if their ballotswere counted as cast. Hand-counted paper ballot systems, which can provide ballot secrecy, mayprovide universal verifiability only under some very limited circumstances and only for very smallelectorates. Such systems can provide a kind of surrogate results verifiability, if observers closelywatch the counting of ballots, but even that can be difficult to achieve. Lever machines andcomputer-assisted voting systems arguably exhibit neither voter nor results verifiability, althoughdocument-based systems such as optical scan and punchcards do retain the capacity for surrogateresults verifiability if manual recounts are done in the presence of observers.

Some observers believe that the potential security problems associated with the lack of transparency and observability in vote casting and counting with DREs cannot be resolved throughthe use of security procedures, standards, certification, and testing. They assert that the only reliableapproach is to use ballots that voters can verify independently of the DRE and that these ballotsbecome the official record for any recounts. Others assert that voter verifiability is a highly desirablefeature but caution about some of the proposed ways of achieving it. Still others believe that thereare problems with the approach that make it undesirable.

HAVA requires that each voting system produce a paper audit record for the system and that this be the official record for recounts. It also requires that voters have the opportunity to correcttheir ballots before that record is produced. However, it does not stipulate that that record consistof individual ballots or that it be verifiable by the voter.

At least four different ways of achieving voter verifiability have been proposed. These are discussed below to illustrate the range of complexity and issues involved.

Voter-Verifiable Paper Ballot. In the most widelydiscussed method, the DRE would print a paper ballot with the voter's choices listed. The votercould then verify that the ballot accurately reflected the voter's choices as made on the DRE. Anydiscrepancies could then be called to the attention of a pollworker. Once the voter was satisfied withthe paper ballot, it would be deposited in a ballot box (106) and kept in the event of a recount. A sampleof these ballots could also be counted as part of a standard audit for comparison with the total count. Some observers also believe that any recount using these paper ballots should be performed by handrather than machine.

This approach has the following potential advantages: (1) Any recount would be based on an independent record that the voter had had an opportunity to verify. (2) Each election could beaudited, and any significant discrepancies between the electronic and paper tallies would trigger afull recount. (3) If the recount were performed by hand, that would take advantage of thetransparency and observability that can be associated with that approach. (4) The method could helpensure voter confidence in the legitimacy of election results, since voters would know that ballotsthey had verified would be available for recounts.

The approach has also been criticized, with critics asserting the following: (1) It makes voting more complicated and time-consuming by requiring extra steps by the voter. (2) The use of printerswould substantially increase both the cost of administering an election and the risk of mechanicalfailure of a voting machine. (3) It is generally accepted that paper ballot systems cannot be made toconform to the HAVA accessibility requirements. (107)

(4) Since the method is largely untested, it isnot clear to what extent it would improve security in practice and what impacts it might have onvoters. (108) (5) Hand counting of the paperballots would be time-consuming and arguably moreerror-prone than machine counting. (109)

Votemeter. There is an electronic version of the above method, in which an electronic device would be attached to the DRE. This votemeter wouldhave a display on which the voter could verify choices and it would record those choicesindependently of the DRE. Those records would be used in any recount and could also be talliedseparately by an independent agency -- to provide a check on possible collusion with respect to theDREs. Advantages to such a system over a paper trail would be that it would not have the problemsof manual paper recounts, it could provide a fast, independent, full audit of the DRE vote, and itcould be accessible to blind persons via an audio input. However, it would still be more complexfor the voter than current systems, and voters would need to trust that the attached unit was secure.

Modular Voting Architecture. A third way toprovide voter verifiability with DREs is analogous to optical scan or punchcard balloting withprecinct counting. (110) After a voter makeschoices on the voter interface (such as a touchscreen), themachine writes the ballot to a memory card or other device, called a frog, which the voter then takesto another machine that reads the ballot. This reader would be highly secure, as discussed above. (111) It would have a display so that the voter could verify choices before casting the ballot. A readercould even be provided with an audio program to allow blind voters to verify choices. (112) Theadvantages and disadvantages of this system are similar to those for the previous two, depending onits particular design.

Encrypted Votes. All three of the above approaches essentially provide a second, independent audit channel for the voting system. Anotherway of providing verifiability uses cryptographic methods to provide a kind of electronicverification. (113) Proponents argue that aproperly designed system using encrypted votes isconceptually different from the "electronic ballot box" exemplified by DRE technology and that itprovides for privacy, transparency, auditability, and security in a superior way to any currentapproach. This can be part of a more comprehensive system that uses cryptographic methodsthroughout the election process -- from election preparation through auditing of the results -- thatpurports essentially to mimic electronically or even improve upon the observability and transparencyassociated historically with manually counted paper ballot systems.

There are several different possible approaches using cryptographic protocols. (114) In one kindof system, the voter, before casting the vote in the voting booth, can see the ballot choices theencrypted information will correspond to. When the vote is cast, a receipt is generated withencrypted information, which could be in any of several different forms, such as a number or apattern printed on a piece of paper. (115) Afterthe election, each voter can also determine if his or hervote was counted as cast by comparing the receipt to posted information. (116) However, because theinformation on the receipt is encrypted, no one, including the voter, can prove what choices weremade. (117) The encryption is performed witha set of encryption keys that have been generatedindependently by different election trustees -- for example, an election administrator andrepresentatives of each of the major political parties. Votes, to be counted, must be decrypted, whichis accomplished by each trustee applying his or her key, and shuffling the votes before sending themto the next trustee. (118) Information related tothe encryption is also posted that makes it possible fora trustee or a member of the public to audit and authenticate the election. (119) If a trustee (or anyoneelse) attempts to change, omit, or add any ballot, that will be detected in the audit, because thechanges will show up as invalid, just as someone trying to modify an encrypted financial transactionwill be discovered. At least one proposed system also permits auditing by observers during thecourse of the election.

Proponents of this approach claim that the capabilities of checking the vote before and after casting the ballot while maintaining ballot secrecy, along with the high probability of detecting anytampering through public auditing, means that, unlike with DREs, it is not necessary for voters orelection or party officials to trust the voting machines to produce the correct tallies. In this sense,the encrypted-vote system is even more transparent than paper ballots that are hand-counted in thepresence of observers. It is much closer in transparency to a roll-call vote, but it retains ballotsecrecy. Proponents also believe that use of this approach could reduce the costs of elections byreducing the need for physical security, testing, and other activities. They also state that the integrityof the system is not dependent on the secrecy of the encryption keys, although privacy might becompromised if all keys were broken or stolen or all trustees colluded.

If successful, the approach could address many of the security issues with DREs that this report discusses. However, it does not yet appear to have been independently evaluated and therefore couldhave currently unknown disadvantages and vulnerabilities. Also, it is not clear that it would havethe same potential positive impact on voter confidence as paper-based voter verification might. Thatis because a voter who does not understand the technology behind the system -- and few voters arelikely to -- may have no greater basis for confidence in the correspondence between the encryptedreceipt and the choices the voter made than is currently the case with DREs. Some proponents,however, believe that those concepts are simple enough that they can be taught in secondaryschool. (120)

If the system relies on printers at each voting booth, that raises issues similar to those with respect to printers for voter-verifiable paper ballots. Similarly, the verifiability feature increases thecomplexity of the voting process for voters, with unknown consequences. In addition, it is not clearto what extent valid ballots could be recovered in the event that tampering was found or malfunctionoccurred. Finally, some critics question whether encrypted receipts are in fact unable to show avoter's choices. Proponents argue that these concerns are either unlikely to be a problem in practiceor are relatively easy to address.

Options That Might Be Considered

The several methods proposed to address the verifiability issue -- ranging from printing paperballots to new electronic ways of voting -- each have different strengths and weaknesses, makingit difficult to determine at present whether any of these approaches should be adopted. At the sametime, many observers would agree that finding ways to increase the verifiability and transparencyof electronic voting is desirable. DRE technology is clearly evolving fairly rapidly and has not yetbecome settled, as witnessed by the diversity of available devices and features in comparison to otherkinds of voting systems. (121) This environmentmay promote developing improved security and otherdesirable properties of the technology. At the same time, as jurisdictions continue to adopt DREsin response to HAVA and other factors, pressures to resolve security issues quickly may increase.

While a defense-in-depth approach would appear to be generally desirable for addressing security questions with DREs, as discussed above, any attempt to implement such an approach needsto take into account potential problems that can be associated with making substantial changes inthe way an election is administered. For example, when a voting system is replaced in a jurisdiction,the proportion of residual votes and problems administering the election may actually increaseinitially, at least in part because neither voters nor pollworkers are familiar with the new system. Inaddition, there are no proven cases of tampering with DREs or other computer-assisted votingsystems in public elections. (122) For these andother reasons, some observers argue that any changesto current technology and procedures should be incremental. Others, however, state that given theevolving threat environment and the concerns that have been identified, an incremental approach isnot sufficient to prevent undetected tampering that could change the outcome of an election. Policymakers will need to weigh such differences in determining what if any actions to take inresponse to this set of issues.

Three general approaches are discussed below for addressing the issues raised in this report. First, action could be left to state and local jurisdictions that administer elections. Second, the EACcould address the issues. Third, Congress could take any of several possible actions. Theseapproaches and options, which are not mutually exclusive, are discussed in turn below.

States. Elections are administered by state and local governments, with the federal government playing a circumscribed role. Although that rolewas substantially enhanced with the enactment of HAVA, the law stipulates that methods ofimplementation of its requirements are to be left to the discretion of the states (Sec. 305). States maytherefore address these issues individually, as, for example, California, Maryland, and Ohio havealready been doing. (123) The availability offederal funding under HAVA to improve electionadministration by state and local governments, as well as the creation of an independent federalagency whose purpose is to assist those governments in election administration, should improve theability of those governments to ensure the security of elections. Leaving action to the states wouldallow them to react to the issues in a timely fashion and in ways that are most responsive to theirindividual circumstances and could lead to a variety of options being tested by different states,making it easier to determine which approaches work best. However, this approach might also leadto a patchwork of responses, which could be challenging for vendors to meet and could lead to somestates being more vulnerable to tampering than others.

EAC. The Election Assistance Commission created by HAVA will have some responsibilities to provide guidance and to perform studies andresearch specifically relating to the security of voting systems. Its work in this area will involveNIST and others with experience in computer security. The EAC and its supporting boards andcommittees may provide an effective venue for addressing fundamental questions regarding votingsystem security and helping states meet their needs and responsibilities in this regard as well asissues relating to voter confidence in the security of DREs. One option would be that the EAC couldperform an independent security review of current DREs. This might be especially useful if it couldbe done in cooperation with a selection of states exhibiting a range of security policies andprocedures. However, to address the issue, the EAC must first form the relevant boards andcommittees, and any study would require a significant amount of time to complete. The EAC maynot, therefore, be able to resolve the controversy before states need to make decisions about whichkinds of voting systems to acquire.

Congress. Among the possible actions that Congress might consider are hearings, funding to address the controversy, and revisions to HAVA. Congress could choose to hold hearings on the issue for several purposes, such as clarifying issuesand options, providing guidance to the EAC, or exploring funding and legislative options. It couldalso use other means, such as legislative report language or direct communication from congressionalleaders, to encourage the EAC to address the controversy in an expedited manner.

Given the range of proposals for addressing DRE security issues, and the uncertainties associated with those proposals, Congress might also consider supporting research and development(R&D) in this area to identify the most appropriate solutions. In the past, economic incentives forprivate investment in such R&D have been weak, given the small, fragmented nature of the marketfor voting systems and the relatively low demand for sophisticated security for those systems. Withthe funding for new voting systems that HAVA provides, the evolving threat environment, and otherfactors, that situation may be changing. HAVA also authorized grants for R&D to improve securityand other aspects of voting technology (Sec. 271), but Congress has not appropriated fundsspecifically for that program. Presumably, the EAC could use some of its general operating fundsfor such work, or Congress could appropriate funds specifically for it.

Several options for revising HAVA might be considered for a legislative response to the controversy: (124)

A specific security provision could be added to the voting system requirements, stipulating, for example, that voting systems must adhere to security requirements for federalcomputer systems as required under current law, (125) or requirements or a mechanism to develop themthat is specified in the provision.

The voting system audit requirement in the Act could be revised to require avoter-verifiable paper ballot (126) or some othersystem of voter verifiability.

Voting systems could be required to use open-sourcesoftware.

The Act could specify a security review and certification process for all votingsystems.

The Act could specify that experts in security be represented on the TechnicalGuidelines Development Committee.

The EAC could be directed to provide security consultation services to stateand local jurisdictions.

The deadlines for meeting relevant requirements, such as for accessibility ofvoting systems, could be delayed pending resolution of the controversy.

Federal funding could be provided for upgrades or replacements for DREspurchased under HAVA if they are shown subsequently to have significant securitydefects.

Some of the above options would themselves be controversial, as discussed earlier in this report with respect to voter verifiability and use of open source software. In addition, creating additionalrequirements would further increase the federal role in election administration, which may beopposed by those who believe that it should be left to the states as much as possible. Options thatwould strengthen the ability of the EAC to help address this controversy may themselves be lesscontroversial but might not lead to a timely resolution of the issues. Delays in meeting HAVArequirements are also likely to be controversial, and, some would argue, may not be necessary if thecontroversy can be resolved before 2006. Finally, additional funding authorization andappropriations may be difficult to enact in a constrained budget environment.

Conclusions

The purpose of this report has been to explain the controversy about the security of DREs andto lay out the issues raised and options for addressing them. The report does not attempt to resolvethe controversy. However, some conclusions can be drawn with respect to the questions asked atthe beginning of the report.

Do DREs exhibit genuine security vulnerabilities? If so, could those vulnerabilities be exploited to influence an election?

Given the worsening threat environment for information technology and the findings of several studies and analyses discussed in this report, at least some current DREs clearly exhibit securityvulnerabilities. Those vulnerabilities pose potential but not demonstrated risks to the integrity ofelections, in that no proven cases exist involving tampering with DREs. Observers differ in theirviews about whether these potential risks are significant enough that they need to be addressedurgently or whether they can be addressed incrementally.

To what extent do current election administration procedures and other security measures protect against threats to and vulnerabilities of DRE systems?

The answer to this question is a central point of contention in the controversy, with vendors and election administrators generally claiming that current measures are sufficient and certain otherexperts, most notably many computer scientists, and some activists claiming that they are not. Thesedifferences of opinion appear to be based in part on differences in philosophical perspective. Proponents of approaches such as voter verifiability believe that elections should rely for securityon openness, transparency, and observability of the entire election process, and that currently toomuch trust is placed in the behavior and capabilities of vendors, election officials, and other involvedparties. Many election administrators and vendors, and some other observers, believe that the viewsof such proponents are based on misunderstandings of how voting systems work and how electionsare administered. They also believe that approaches such as a voter-verifiable paper ballot wouldnot be of net benefit to the proper functioning of elections. Resolution of such fundamentaldifferences may require -- if it is in fact achievable -- that those on both sides of this controversydevelop better understanding of the bases for the views of the other side. Finding an effectivesolution may be easier if concerned computer scientists understand in detail how elections are run(perhaps by working directly with administrators) and if election administrators understandcybersecurity more clearly (perhaps by working with computer scientists).

In any case, as indicated by some of the studies discussed in this report, significant improvements in the security of DREs may be found through careful analysis of current systems andhow they are implemented and administered, without requiring voter verifiability or other substantialchanges. However, such improvements in current systems are not likely to address the fundamentalconcerns raised by proponents of voter verifiability.

Do those threats and vulnerabilities apply to computer-assisted voting systems other than DREs?

The potential threats and vulnerabilities associated with DREs are substantially greater than those associated with punchcard or optical scan readers, both because DREs are more complex andbecause they have no independent records of the votes cast. However, document-ballot readers arepotentially subject to malware that could affect the count, to vulnerabilities associated withconnection to other computers, and some other kinds of tampering. Therefore, the security ofsystems using readers might also benefit from some of the same kinds of approaches that have beenproposed for DREs, such as improvements to current security policies and procedures, use of modernsoftware engineering techniques, and use of strong cryptographic protocols.

What are the options for addressing any threats and vulnerabilities that do exist, and what are the relative strengths and weaknesses of the different options?

The report discusses seven proposals for addressing the security issues raised about DREs. They include using current procedures and security mechanisms, with improvements as necessary;improving standards for the development and certification of voting systems; using open-sourcesoftware for voting systems; and several methods to improve the transparency and verifiability ofelections, including voter-verified paper ballots and an electronic version of that approach, use ofmodular electronic voting architecture that physically separates the voter interface from the castingand counting functions; and a system that uses cryptographic protocols to permit voters to verify thattheir ballots were cast as intended and that no votes were improperly changed, omitted, or added. These proposals vary in ease of implementation, the degree to which they have been tested inapplication, and the level of contention about both their ability to resolve the controversy and theiroverall desirability.

Most of the public debate has centered around whether to rely on current procedures and mechanisms or adopt voter-verifiable paper ballots. However, these are clearly not the only options,and the debate might benefit from fuller consideration of other possibilities such as those discussedabove. In addition, several of the proposals discussed are not mutually exclusive, and a resolutionof the controversy may involve elements of several proposals.

Three policy approaches, which are also not mutually exclusive, were discussed. The matter could be left to state and local governments, which administer elections; some states have alreadytaken action. The newly formed EAC could address the issues through its convening power andresponsibilities in the development of voluntary guidelines for and certification of voting systems. Congress could decide to use hearings or other mechanisms to provide guidance on the issues, or itmight decide that a legislative solution is necessary. Several legislative options exist, ranging fromfunding for research on the issue to adding requirements on DRE security to HAVA. The benefitsand disadvantages of these approaches depend on many factors, and a legislative solution maybecome more attractive if the controversy cannot be resolved through other means.