Pondering (HR811)

Proposed federal election reform legislation (HR811) from Lawrence Norden of NYU Law School Brennan Center Think Tank and from the Electronic Frontier Foundation, both debunk some of the disinformation which has been unfortunately
ubiquitously been spread on the Internet by opponents of HR811.

1.
HR 811: Separating Truth From Fiction in E-voting Reform June 13, 2007
http://www.eff.org/deeplinks/archives/005308.php#005308

[Comments by David Dill re. the EFF article: This is generally a good
essay, but the legal analysis, especially on NDA , deserves special
attention. EFF is run by world class intellectual property lawyers,
and has been involved in providing legal backup on NDAs for various
source-code reviews. They know trade secret law. This article should
put to rest the arguments that HR 811 somehow creates new trade
secrets or otherwise makes voting machine software less accessible (of
course, I know those claims will continue to be repeated incessantly
as though they were established fact, but I hope that some of the
people who see them will also see the EFF post).]

HR 811: Separating Truth From Fiction in E-voting Reform
June 13, 2007

After years of painstaking lobbying, e-mail and phone campaigns,
congressional hearings, and committee markups and amendments, Rep.
Rush Holt's Voter Confidence and Increased Accessibility Act finally
appears poised for a floor vote in the House of Representatives. With
an impressive 216 bipartisan co-sponsors, the bill has a real chance
of passing. If signed into law, HR 811 would dramatically improve the
electoral process in both the short and long term. While it would not
solve the immense shortcomings in the current system, HR 811 would
take a giant step towards returning much-needed transparency and
accountability to the process.

Not unexpectedly, now that the bill has gained traction in the 110th
Congress, critics have descended onto the bill with a fury,
complaining that it is too weak or too strong, that its deadlines are
too ambitious or too distant, that it takes too much autonomy away
from the states or not enough.

HR 811 is not perfect. Few bills are. And honest debate about a matter
as important as election integrity is always helpful to the process.
However, much of the ostensibly pro-transparency criticism of HR 811
has sadly taken a detour away from being useful and descended into
hyperbole, fear-mongering, and uninformed posturing. Returning to the
substance of the bill and its actual consequences is long overdue.

What would HR 811 do? Among other things:

* Raise the floor, not a create a ceiling. The higher standards
required by HR 811 would provide the beginning, not the end, of
serious election reform. States wishing to, say, ban all electronic
voting machines, impose stricter audit requirements, or force vendors
to publicly disclose all of their source code will remain free to do
so, as they are today. If HR 811 becomes law, however, states would
not be permitted to lag behind in many important areas as so many do
today.

* Require the generation of a voter-verified paper ballot. HR 811
would forbid in federal elections the use of direct recording
electronic voting machines (DREs) that do not generate voter-verified
paper ballots (VVPBs). See proposed Sec. 301(a)(2)(A)(i): "The voting
system shall require the use of or produce an individual, durable,
voter-verified paper ballot of the voter's vote that shall be created
by or made available for inspection and verification by the voter
before the voter's vote is cast and counted." States wishing to impose
additional requirements regarding what to do with VVPBs, such as a
mandatory hand-count of all paper ballots, would be able to do so.

* Require manual audits of every federal election. HR 811 would not
mandate (or forbid) the counting of VVPBs in all circumstances.
Instead, HR 811 would require, for the first time in American history,
across-the-board manual audits of federal elections. See proposed Sec.
321(a)(1): "[E]ach State shall administer, without advance notice to
the precincts selected, audits of the results of elections for Federal
office held in the State (and, at the option of the State or
jurisdiction involved, of elections for State and local office held at
the same time as such election) consisting of random hand counts of
the voter-verified paper ballots ..." Specifically, HR 811 would
require audits of 3-10% of all precincts in every federal election
(see proposed Sec. 322), depending on the apparent margin of victory
and except in the case of landslide victories. This would be a
breathtaking and unprecedented achievement. By contrast, federal law
currently contains no audit requirement at all. States believing that
initialhand counts or more robust audit protocols are more appropriate
for their voters would have every right to impose such requirements.

* Require the disclosure of voting system source code in limited
circumstances. HR 811 would, for the first time under federal law,
explicitly mandate the disclosure of voting system source code to
certain "qualified persons," identified as (among others) parties to
litigation and individuals who "review[], analyze[], or report[] on
the technology solely for an academic, scientific, technological, or
other investigation or inquiry concerning the accuracy or integrity of
the technology." See proposed Sec. 301(a)(8)(C). Individuals seeking
such access would, in some circumstances, be required to sign a
non-disclosure agreement. Just as now, however, individuals who
lawfully acquire voting system source code independent of the
(non-exclusive) procedures set forth by HR 811 (see, for example, Avi
Rubin's groundbreaking analysis of Diebold source code that was leaked
onto the Internet) would be free to analyze the code accordingly.
States wanting even greater transparency could mandate broader
disclosure requirements (see proposed Sec. 301(a)(8)(B)(ii)(II)),
including disposing of any non-disclosure requirement or even
mandating the use of open source software. Moreover, vendors
themselves could dispense with the non-disclosure agreement
requirement, either by explicitly granting permission to share
otherwise secret source code or by utilizing open source systems.

What would HR 811 not do? The misconceptions and misrepresentations
are, unfortunately, widespread.

* "HR 811 doesn't ban all DREs." True, but misleading. DREs, paperless
or otherwise, are already permitted under federal law. HR 811 would
ban the use of paperless DREs in federal elections unless they are
retrofitted with printers that generate voter-verifiable paper
ballots. An outright ban on DREs may or may not be possible with this
Congress, but it is irrelevant to whether or not this bill should
pass. Rep. Holt's strategy -- to convince Congress of the need to
improve transparency in U.S. elections, regardless of technology -- is
a sound one, one that many volunteers have expended extraordinary
efforts to bring to fruition and one that could be on the verge of
succeeding. Nothing has prevented or currently prevents now-vocal
critics who are calling for an outright DRE ban from going through the
process of drafting the appropriate legislative proposal and then
soliciting the necessary support for it. But attempting to derail or
hijack HR 811 as a vehicle to ram through an unlikely-to-pass DRE ban
unnecessarily risks the passage of other important substantive
requirements. And once again, nothing in HR 811 prohibits states from
limiting the use of DREs of any kind or banning them altogether.

* "HR 811 reinforces secret vote counting." False. On the contrary, HR
811, if passed, would begin to open up the process. Federal law
already permits the use of paperless DREs. Only 27 states currently
require the use of voter-verified paper ballots (or voter-verified
audit trails), and only 13 of those require audits. The lack of robust
federal requirements, and the failure of straggler states to implement
restrictions of their own, has led to the widespread use of suspect
voting equipment like DREs. If enacted, HR 811 would, for the first
time, place real restrictions on the use of electronic voting
equipment. Again, if states think that HR 811's requirements aren't
robust enough, they can pass legislation of their own.

* "HR 811 prohibits the disclosure of voting system software." False.
HR 811 would for the first time federally mandate the disclosure of
election-specific source code. The disclosure provision that emerged
from committee is certainly not as broad as it could be. Public
disclosure is not required, as the original language of HR 811
demanded. Yet as discussed above, HR 811 would explicitly protect the
right of access for certain reviewers who currently have no such such
guaranteed right and who have been routinely denied access to any
software in some of the many battles that EFF has fought in the courts
and elsewhere since 2003. The software industry fought long and hard
behind the scenes to scuttle any disclosure requirement. That the
current disclosure language emerged from committee at all is a
testament to the many individuals, organizations, and lawmakers
dedicated to election integrity who stood up in support of the bill
instead of trying to tear it down. Make no mistake: this disclosure
requirement is simply one of many initial steps in a long struggle
towards full transparency of elections. But it is a critically
important step, nonetheless. And once again, states may mandate any
kind of additional disclosure, including an open source requirement,
that they wish.

* "HR 811 makes voting system source code a trade secret." False, and
demonstrates a profound misunderstanding of trade secrecy law. HR 811
does not, in any way, "create" trade secrets or transform voting
system source code into a trade secret. Information either meets trade
secret criteria -- created by each individual state, and not the
federal government -- or it doesn't. As EFF and others have repeatedly
experienced, the lack of guaranteed access to this code due to trade
secrecy claims has been a major impediment to litigation over voting
system failures, like the ongoing litigation brought by voters in
Sarasota County, Florida, for which EFF serves as co-counsel. Far from
"creating" trade secrets, HR 811 actually limits the protections
offered by state trade secrecy laws to voting system source code. For
example, the bill identifies "trade secrets" as one of the categories
of information, protected in some circumstances by a mandatory
non-disclosure agreement, that must be disclosed to qualified
individuals who would have the newly-created right to review the
software. Absent HR 811, litigants (such as those involved in the
ongoing Sarasota County litigation) and computer science experts
interesting in testing system integrity would have no guarantee of
obtaining access to the source code at all. Individuals who do not
enter into the non-disclosure agreements discussed in HR 811 would not
be affected, and efforts to obtain access to code by other means would
proceed as they always have. Critics may desire greater access to this
code, as would EFF, but assertions that the bill would somehow "make
the source code a government-recognized trade secret" are
disingenuous. And here too, states can decide to step in and limit or
even rescind the protections offered by their own trade secrecy laws.

* "Source code reviewers could be sued if they make false claims about
source code obtained via the disclosure requirements of HR 811." True,
but misleading. Individuals who make damaging false claims about any
product, voting system-related or otherwise, subject themselves to
potential liability but also enjoy the protections of the First
Amendment which generally allows for honestly mistaken claims but does
not protect malicious intentional lying. HR 811 would not, and should
not, protect individuals who knowingly lie. On the other hand, HR 811
would explicitly permit code reviewers to publicly report their
findings: the NDA signed by code reviewers must "allow[] the signatory
to perform analyses on the technology (including by executing the
technology), disclose reports and analyses that describe operational
issues pertaining to the technology (including vulnerabilities to
tampering, errors, risks associated with use, failures as a result of
use, and other problems), and describe or explain why or how a voting
system failed or otherwise did not perform as intended." See proposed
Sec. 301(a)(8)(D)(viii). HR 811 wouldn't change the First Amendment,
nor could it. But the First Amendment doesn't ordinarily protect
knowing misrepresentations and neither would HR 811.

* "Experts who sign NDAs will be prohibited from reviewing other
voting technology in the future." False. HR 811 would specifically
require otherwise: a legal NDA "does not prohibit a signatory from
entering into other nondisclosure agreements to review other
technologies under this paragraph ..." See proposed Sec.
301(a)(8)(D)(ii).

I could, unfortunately, go on.

Attempts by certain vendors and election officials to derail
meaningful reform that would implicate their existing technology, or
underscore the potentially high cost of replacing it, are
understandable and expected. However, advocates of more open and
transparent elections do themselves and the voters of this country a
disservice by attempting to undermine, with claims about the bill that
are plainly wrong, the passage of important legislation that would
make real and important gains.

EFF strongly supports the passage of HR 811 and hopes that you will as
well. Don't just take my word for it: read the bill for yourself and
then make your own decision. If you don't think that HR 811 goes far
enough, then push for passage of complementary legislation, either in
Congress or with your own state legislatures. EFF will continue to
support sensible legislative proposals that can build on the
foundation of HR 811. But whatever you do, don't fall for the false
choice offered in the breathless rhetoric of the "all or nothing"
contingent. Don't let the perfect be the enemy of the good. And HR 811
is good.


2.
The Campaign for Secure Elections June 13, 2007
http://www.huffingtonpost.com/lawrence-norden/the-campaign-for-secure-e_b_51986.html

Lawrence Norden, counsel in the Brennan Center for Justice Democracy
Program and was the Chair of the Brennan Center Task Force on Voting
System Security, writes in support of passing Rush Holt's bill.

Please read the legislation yourself if you have any questions about it.
http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=110_cong_bills&docid=f:h811rh.txt.pdf

As the presidential candidates' ramp up their campaigns, it's hard to
resist asking, 'can't give us a break?' Didn't the last federal
election cycle just end? Isn't November 2008 awfully far away?

Perhaps. But there is one campaign for all future federal elections
that must begin in earnest immediately. And that is the campaign to
make elections as secure and accurate as possible. After Florida's
hanging chad debacle in 2000, voting irregularities in Ohio in 2004,
and the mysterious loss of 18,000 votes in a House race in Sarasota in
2006, there is little room for another divisive national election
marred by voting machine glitches.

The good news is that experts agree on what steps must be taken to
make voting systems more secure and more reliable. In fact, the House
of Representatives is about to vote on a bill introduced by
Congressmen Rush Holt (D-NJ) and Tom Davis (R-VA) that would mandate
many of these steps.

Most dramatically, the Holt-Davis bill would ban all paperless
electronic voting in federal elections. By November 2008, all states
would have to use voting systems that produce a voter verifiable paper
record. In other words, voters would vote on systems that give them an
opportunity to review or fill out a piece of paper that contains a
record of their votes. Currently, voters in 18 states are denied that
opportunity.

Just as importantly, Holt-Davis mandates random manual counts
comparing the voter verified paper to the electronic tallies, in order
to "check" the electronic count and ensure that programming errors,
software bugs or other corrupt software did not cause the electronic
voting machine to miscount federal election results. Only 13 states
require this important security measure today.

The bill also bans the use of most wireless components on voting
machines. Security experts have warned that wireless components can be
particularly dangerous, because they can allow a member of the general
public to send or receive signals from the voting machines from a
distance -- potentially triggering attacks against the voting systems
with a hand held device such as a Palm Pilot or other personal digital
assistant. Only two states ban such components for all machines.

Finally, the bill would immediately end the practice whereby vendors
pay and choose the testing labs that certify their machines. Voting
integrity experts have long decried this system, which creates a
serious conflict of interest for testing lab: pass a system or risk
the loss of future business? Not surprisingly, this system has
produced terrible results. The testing labs have certified many
machines that had serious security defects, violated federal
guidelines, and broke down on Election Day, losing thousands of votes.
Under Rep. Holt's bill, the Election Assistance Commission will hold
money for testing labs in escrow, and assign testing labs for machine
certification at random.

None of these proposed changes should be controversial. Nevertheless,
opposition to the bill has built in recent weeks.

Many election officials have complained that the bill's deadlines are
unrealistic. They also fear that they may not receive adequate funding
to make the needed changes. Fortunately, the most recent version of
the Holt-Davis bill moves many of the deadlines to more realistic time
frames (while still mandating an end to paperless electronic voting by
November 2008). It also significantly increases federal funds to local
jurisdictions to make equipment changes. Ultimately, the objections of
some election officials are not reasons to oppose this critical bill.
If need be, deadlines can be adjusted as the legislation moves
forward, and appropriators can be held accountable if they fail to
provide sufficient funds to get the job done.

Some have used these objections as an excuse to make sure Congress
does not do anything to make voting systems more secure and accurate.
Last week, Congressman Vernon Ehlers (R-MI) introduced the so-called
"Voter Enhancement and Security Act of 2007," urging his fellow
Republicans to vote for it instead of the bipartisan Holt-Davis bill.
Unfortunately, Congressman Ehlers' bill does nothing to address the
serious voting system security vulnerabilities experts have
identified.

We cannot allow election integrity and security to become a partisan
issue addressed with public relations messages instead of honest
analysis of the risks and serious implementation of the solutions.
Congress has an opportunity to act now. Voting system fiascos in each
of the last several federal elections suggest that if it fails to do
so, we will see more divisive Election Day debacles -- all too soon.

Lawrence Norden is the author of the just published The Machinery of
Democracy: Protecting Elections in an Electronic World (Academy
Chicago Press). He is a counsel in the Brennan Center for Justice
Democracy Program and was the Chair of the Brennan Center Task Force
on Voting System Security.