Adios iPhone

I was flying back from California last week, watching a video on my iPhone, and next to me was this guy who kept glancing at me and smirking. "Is that an iPhone?", he finally asked. I nodded. "Humph," he grunted and assumed an air of superiority. I was a bit taken aback so I asked him why he didn't like iPhones. "Oh," he said, "they're okay, I guess," and then he mumbled under his breath "if you are into that sort of thing." I couldn't just let that go, so I asked him if he had ever actually used an iPhone.

He looked around as if to see if anyone else was looking, and gave me a conspiratorial smile. "I've got something to show you," he said. And he proceeded to pull out a tiny gadget that looked like an earpiece for a phone. "Check out my device," he said. "It's an integrated PDA, phone, GPS and HD multimedia station." I asked him how he dialed the phone, and he said that it uses a built-in address book with voice recognition. You just say a name , and it looks it up in your address book and dials. What about names that aren't in the address book? He says that since the device is always online, it does a directory search over the Internet and tries to find a match that way. But, how do you know what number it found? There's no display! Before I understood what was going on, he removed a contact lens from his eye and asked me to put it in. I thought this was crazy. But, he had a liquid that he sprayed on it to clean it. Still skeptical, I popped it into my eye, and I was completely blown away. As if floating in air was a transparent view of a screen with a phone style interface. "Now," he said, "use your pupil to navigate the cursor, and crunch your jaw to click. Right side of the mouth for right click, left side for regular click, and bite your tongue to scroll." It took me a little practice, but I was soon able to move things around the screen with ease. I could see as if I was looking at a computer screen. It was like nothing I've ever seen before. And then he played a movie for me. Unbelievable resolution, and hi fidelity sound. The growing pain in my tongue was the only downside I could see to this device.

The "phone" had a full fledged PDA interface. It had video watching mode, an Internet browser, visual voicemail, and many other features that I had never even heard of. I asked my new friend where he got this, and he said that it is a prototype of a new product he invented that he is calling the EyePhone. He had a few glitches to work out, and then he was going to try to commercialize it. I volunteered on the spot to be a beta tester for him, and he agreed. I now have a room full of these test devices, and a year's supply of Hi Definition contact lenses. Needless to say, I am dumping my iPhone.

So, if you ever see me staring off into space with a blank look, it's not that I'm ignoring you; I'm probably just reading email or looking something up in my calendar, perhaps checking to see what happened on April 1.

Lunar Eclipse

Last night, there was a lunar eclipse - the last one until December, 2010. Since it was very cold and had just snowed, instead of setting up my tripod outside like I should have, I took some pictures and hand held the camera. Still, they came out okay. If you want to see the pictures, click here. My daughter was pretty excited about it, and was even willing (eager!) to extricate herself away from American Idol to look at it several times.

An article about Internet voting

David Dill and Barbara Simons have written an excellent essay about some of the risks of Internet voting and a system that is being deployed for the Democratic primary. While the dangers of electronic voting with paperless DREs have been covered in great detail in this blog and in other places, the risks of voting on home computers over the Internet are significantly greater. It seems only fitting that Dill & Simons published this article on Groundhog Day. If you saw the Bill Murray movie where every day repeats as though for the first time, you'll appreciate the way Internet voting seems to appear again in every election in a similar fashion. Dill and Simons refer to Internet voting "experiments" as a whack-a-mole.

My cool Mom

My Mom leads the Israeli dance group in Nashville, TN, where I grew up. They dance at Vanderbilt where she is Professor of Mechanical Engineering. They recently produced a short video about the group, which is narrated by my Mom who also stars in it with her dance group. Check it out.

ACCURATE annual report available

ACCURATE is A Center for Correct, Usable, Reliable, Auditable, and Transparent Elections. We are funded by the National Science Foundation, and I am the center director. Our 2007 annual report is now available here. It highlghts the Center’s major accomplishments and activities in 2007. This coming election year promises to be our most interesting and productive, as members of ACCURATE engage in all aspects of the election, as well as in researching technologies for improving future elections.

2008 Election Judge Training

I attended my Maryland election judge training session today. It was a 3 hours class for returning judges. There was really nothing new for me. I've already worked 4 elections using the Diebold Accuvote machines, and we will be using them again this year. I did, however, notice a change in the tone of the class.

Right up front, the instructor told us that the three most important factors for us to consider are "Security, Integrity, and Accuracy". These three things were stressed throughout the day. The instructor talked about the 20/20 segment where a hacker was able to change tallies on the machine (I think it was Harri Hursti), and told us of a new tamper tape that was placed on the corner of the machine where there is a screw for opening up the casing. As before, I had a good look at this tamper tape and determined that it would be extremely difficult to tell if the tape had been voided or not. I think these tamper tapes are emperor's clothes designed to make administrators feel good. One of the trainers referred to it as the "Lou Dobbs seal", in reference to Lou Dobbs' coverage of e-voting problems leading up to the 2006 election.

We spent more time training on the poll books than I had in previous elections. These are those machines that failed miserably in the 2006 primary. The instructor told us that the books would not work properly if they were turned on at the same time, so each poll book had to be turned on and enabled before the next one. I remember hearing this as one of the explanations of why so many stations failed in 2006. I hope that she is mistaken, and that the machines will still work even if powered up in arbitrary order. Otherwise, Maryland will have problems again in 2008, because I'm certain that not all judges will remember to follow these instructions. The poll books have a new feature this year that the instructor was very proud of. The chief judges can reverse a voter's check-in and reissue them a voter authority card. This feature is a bit scary, although I can see how it would be useful under certain circumstances. This is enabled via a 4 digit PIN that is supposed to be known only to the chief judges.

It struck me as ironic that we were required to fill out a survey about our experience as a judge, as well as an evaluation of our instructors. We were given the surveys on paper, with round ovals to fill in so that the survey and evaluation results could be optically scanned and tabulated. It struck me that the survey and evaluation of our election judge training was more auditable, secure, reliable and transparent than the machines that will be used in the actual election.

I hope that when I train for the 2010 election in Maryland, that we will be working on how to collect paper ballots, to avoid residual votes, and to work with precinct count scanners of paper ballots. If the state does not fund this change, then the measure to move to paper ballots that passed in the legislature last year and was signed by the governor will be thrown out.

Here are some pictures that I took at training today.

Ohio report is available

Ohio's secretary of state, Jennifer Brunner has commissioned a study that appears to be on the same order as California's top to bottom review of their voting systems. There are several reports available on the SoS web site. The most remarkable report is that of the academic team who analyzed the ES&S, Premier Elections Solutions, and Hart InterCivic voting systems. The academic report, produced by some of the leading computer security experts such a Matt Blaze, Harri Hursti, and Giovannie Vigna, and led by Patrick McDaniel of Penn State, is available here, on the SoS web site.

Quoting from the executive summary:

"All of the studied systems possess critical security failures that render their technical controls insufficient to guarantee a trustworthy election. While each system possessed unique limitations, they shared critical failures in design and implementation that lead to this conclusion:

• Insufficient Security - The systems uniformly failed to adequately address important threats against election data and processes. Central among these is a failure to adequately defend an election from insiders, to prevent virally infected software from compromising entire precincts and counties, and to ensure cast votes are appropriately protected and accurately counted.
  
• Improper Use or Implementation of Security Technology - A root cause of the failures present in the studied systems is the pervasive mis-application of security technology. Failure to follow standard and well-known practices for the use of cryptography, key and password management, and security hardware seriously undermine the protections provided. In several important cases, the misapplication of commonly accepted principles renders the security technology of no use whatsoever.
  
• Auditing - All of the systems exhibited a visible lack of trustworthy auditing capability. In all systems, the logs of election practices were commonly forgeable or erasable by the principals who they were intended to be monitoring. The impact of the lack of secure auditing is that it is difficult to know when an attack occurs, or to know how to isolate or recover from it when it is detected.
  
• Software Maintenance - The software maintenance practices of the studied systems are deeply flawed. This has led to fragile software in which exploitable crashes, lockups, and failures are com- mon in normal use. Such software instability is likely to increase over time, and may lead to highly insecure and unreliable elections."
  

and later in the executive summary:

"The review teams were able to subvert every voting system we were provided in ways that would often lead to undetectable manipulation of election results. We were able to develop this knowledge within a few weeks. However, most of the problems that we found could have been identified with only limited access to voting equipment. Thus, it is safe to assume that motivated attackers will quickly identify – or already have – these and many other issues in these systems. Any argument that suggests that the attacker will somehow be less capable or knowledgeable than the reviewer teams, or that they will not be able to reverse engineer the systems to expose security flaws is not grounded in fact."

The report is an incredible read. This group, in only a couple of months, managed to completely subvert these system and to expose them as woefully insecure and inadequate for the real world. Secretary Brunner, to her credit, has now recommended the elimination of DREs in polling places in her state. Now if only other states will follow her lead and that of Debra Bowen, SoS of California.

Does your home address begin with a '5'?

Tuesday was not a national election, and there was no election in Baltimore County, where I live, but there were local elections in many places across the country. This Washington Post story describes some problems in a local election in Maryland.

"Rockville's voting was complicated by a glitch. Thousands of residents who had not yet voted were mistakenly listed as having already cast absentee ballots because of a state database problem ... The state's [voter registration] list inadvertently marked as absentee the names of voters with a home address that begins with the number 5."

My home street address is actually 5, so I might have been affected by this, if we had had an election this week.

While this is an inexcusable occurrence, it is not really that surprising. The greater the complexity in a system, the more likely it is that unexpected glitches such as this will occur. I don't know if this was a software error, a programming error, a configuration error, human error, or something else. And the point is that it does not really matter. Complex software-based systems, especially ones developed the way voting machines today are built and tested, are likely to result in unforeseen problems. In the 2006 primary in Rockville, there were even worse problems with the electronic poll books. In 2008, the problem will probably be something new.

What worries me are not only the problems that we can observe, such as the ones last year and this week. I'm worried about the problems that might result in the wrong votes being totaled, without us ever knowing it. It is foolish to think that only really obvious errors will occur. Maryland's voting system, using only DREs statewide, is vulnerable to catastrophic error but also undetectable errors. And, although the state passed a measure to move to optical scanners in 2010, it now appears that the funding for this move may not be available.

A case of the wrong technology applied incorrectly

In this week's Economist magazine, an article describes how the Swiss general election that was held on October 21 was to use quantum cryptography to protect the transmission of votes from the polling stations to the central tabulation centers. Quoting from the article:

The authorities will use quantum cryptography—a way to transmit information that detects eavesdroppers and errors almost immediately—to ensure not only that votes are kept secret but also that they are all counted.

I first became aware of this project when a New Scientist reporter sent me a note about it and asked for my opinion. I assumed that it was a joke or that the reporter had heard wrong. After all, protecting electronic transmissions is the one problem I can think of in all of this that is not really hard. Here are some of the problems in electronic voting that are hard:

• Ensuring that the software on the voting machines is the correct software. The proposed solution of having a library of hash values of the correct binaries of voting machine software and checking the voting machines does not work. There is no way to perform the check of the hash of the code that is running in the machines. In fact, any attempt to check that hash value would provide an opportunity for an attacker to change the code then and there.
  
  
• Ensuring that the software on the voting machines is not malicious.Even if the "correct" code is running on the voting machine, there is no deterministic way to determine that the code was not designed with a back door in it that could affect the outcome of the election.
  
  
• Ensuring that no unknown bugs in the voting machines can affect the outcome.Even if the "correct" code is running on the voting machine and even if there is no intentional malicious code in the machine, there is no way to ensure that the code does not contain inadvertent bugs or unexpected failure modes that could disrupt an election or cause the wrong result to be computed.
  

Quantum cryptography is a novel and very interesting topic. There are potentially many applications that could benefit from this technology, and I have always been a big fan. But, quantum cryptography does not address the problems in electronic voting that are actually difficult to solve. Transmitting the votes from the polls to the central tabulation center can be done with traditional cryptography. Authentication functions can provide tamper resistance and encryption can provide secrecy, assuming that secrecy is actually desirable here. I believe it is not, as every aspect of the process should be transparent, and I see no reason to keep the precinct results secret. Just the opposite is true - it is important for observers to see princinct level results.

I applaud the Swiss for pursuing innovation, but in this case, they are using the wrong tool to solve the wrong problem in an inappropriate way.

Holt's H.R. 811 is finally coming up for a vote

Congressman Rush Holt's bill requiring a voter verified paper trail is scheduled to come up for a vote tomorrow. I've been traveling out of town, and I just returned home this evening (to an overflowing inbox about this issue). I was planning on writing up my thoughts about H.R. 811, but I just noticed that Ed Felten did a great job of writing his up on his blog. I pretty much agree with everything he said, so no need to repeat it here.

I support Holt's bill. I know that many activists, including several who have contacted me today, are opposed to this bill because it does not entirely ban DREs. However, at the moment, I believe that we need this bill to pass. It would outlaw the voting systems used in places like Maryland and Georgia and, I believe, 13 other states that have entirely paperless voting.

What's sorely lacking right now are paper trails and mandatory audits. Holt provides these. I do hold out hope that some day we will be able to utilize the added benefits of end to end cryptographic systems. But right now, the Holt bill is the best measure I can foresee to have a realistic chance of eliminating the paperless DREs that I may have to vote on next November 4th.

Avi