A US government board has taken the first step toward requiring electronic voting machines to have independent audit mechanisms, a day after it rejected a different audit proposal.
The TGDC (Technical Guidelines Development Committee), an advisory board to the US EAC (Elections Assistance Commission), has unanimously passed a resolution calling on its Security and Transparency Subcommittee to draft requirements for independently verifiable voting records, such as voter-verified paper trail printouts, to be used with DRE (direct record electronic) machines.
The new proposal, offered by TGDC member Ronald Rivest, a computer science professor at the Massachusetts Institute of Technology, calls on the subcommittee to write requirements for the next generation of e-voting machines that make them "software independent" – to include an audit mechanism independent of the software inside the machines.
Rivest said he was happy the second proposal passed, even though the first failed. "I think it's very important for the safety of voting machines in this country," he said of the TGDC's vote.
The Association for Computing Machinery's Public Policy Committee, critics of e-voting, praised the move.
"We have long held the position that there needs to be a means of verification that voters recognise as the vote they cast," the group said in a statement. "The committee rightly acknowledges that further research in this field is needed to provide innovative solutions to the e-voting challenges remaining."
Critics of e-voting machines have called for paper-trail audits as a way for voters to ensure their votes are tallied correctly. In a November report, staff at the US National Institute of Standards and Technology advocated that the US government require e-voting machines to include independent audit mechanisms, saying DREs without audit mechanisms "cannot be made secure or highly reliable".
But during the TGDC meeting, H Stephen Berger, chairman of the voting systems standards committee for the IEEE (Institute of Electrical and Electronics Engineers), questioned how other industries could create software that has few errors, such as software on electronic equipment used on aeroplanes. The software on a typical DRE is less than a megabyte, and e-voting vendors should be able to find a way to make it secure and error-free without adding paper trail audits, he said during debate today.
"I have to believe we can verify and put very careful controls on that, so that we can get an accurate and verified record of what the voter does in the booth," Berger said.
But internet browsers have less code than the typical DRE and still have "tons of problems" with security, said Daniel Schutzer, executive director of the Financial Services Technology Consortium.
E-voting machine vendors could create software that was free of bugs and could be tested and verified "if money were no object and if time were no object", Schutzer said. "But considering what we're working with, that's still a pipe dream," he explained.
The failed proposal, also offered by Rivest, called on the US government to develop e-voting machine guidelines only for machines that included independent audit capabilities. It would be "unwise" to allow the use of DREs that do not include independent audits, it said.
The second proposal, which passed unanimously, took a slightly less restrictive approach. It called for future DREs to include audit mechanisms, and it said TGDC should "ensure that systems that produce independently verifiable voting records are reliable and provide adequate support for audits".
But the proposal that passed stopped short of requiring the current generation of e-voting machines to add on audit mechanisms. "Election officials and vendors have appropriately responded to the growing complexity of voting systems by adding more stringent access controls, encryption, testing, and physical security to election procedures and systems," the proposal said.
The new proposal addressed some TGDC concerns about accessibility for disabled people and what to do with existing e-voting machines, Rivest said by phone. "It's not a motion to encourage people to dump their machines in any way," he said.
The Election Assistance Commission will hear a report about the TGDC action at a meeting today, but the new audit standards are unlikely to go into effect until after 2010.