Liveblogging Joint House Science and Administration Committee Hearing on Voting Systems Standards

Background

The House Science Committee and House Administration Committee are holding a joint hearing today called, "Voting Machines: Will the New Standards and Guidelines Help Prevent Future Problems?". (You can find the PDF of the charter for the hearing, drafted by Olwen Huxley, here: Voting Hearing Charter (PDF). Here is a link to a Real webcast.)

The witness list includes:

• Ms. Donetta Davidson - Commissioner, Election Assistance Commission (EAC);
• Dr. William Jeffrey - Director, National Institute of Standards and Technology (NIST);
• Ms. Mary Kiffmeyer - Secretary of State for Minnesota;
• Ms. Linda Lamone - Administrator of Elections, Maryland State Board of Elections;
• Mr. John Groh - Chairman, Election Technology Council, Information Technology Association of America (ITAA); and
• Dr. David Wagner - Professor of Computer Science, University of California at Berkeley.

Notes

[2006-07-19T11:13:13] Chairman of the House Administration Committee (Ehlers) just acknowledged that he is working to organize a separate hearing on paper trail issues.

Follow up:

[2006-07-19T11:15:01] Congressmember Millender-McDonald expressed enthusiasm for a paper record hearing in September and said that she heard from an "overwhelming number of constituents" about the paper trial issues.

[2006-07-19T11:19:11] Chairman of the Science Cmte., Boehlert, just said that "we have the entire congressional physics caucus on the dais." Boehlert said he's disappointed that the new standards won't go into effect until 2008 and that they couldn't get that kind of language into HAVA.

[2006-07-19T11:30:29] Donnetta Davidson starts to speak. She generally seems to be responding to the criticisms that the 2005 VVSG aren't going to take effect until 2008. Ms. Davidson emphasizes that it is not just about the machines, but human processes. The EAC will be issuing a number of guidelines on a number of election administration issues.

[2006-07-19T11:34:59] Dr. Jeffrey of NIST begins speaking. NIST believes that they have met or are on track to meet their three responsibilities under HAVA. The VVSG 2005 were delivered on time to the EAC in May of 2005. Touts that the VVSG has the first federal guidelines on VVPAT. NIST and the EAC began work on the 2007 VVSG immediately after 2005 VVSG. NIST will be developing an open test suite to go with the 2007 standards.

[2006-07-19T11:39:54] Kiffmeyer begins to speak. (Wow, she sounds like she's speaking almost as fast as she possibly can to stay under the five minute rule.) Minnesota is apparently already using the 2005 VVSG. Minnesota decided, due to security concerns raised during the adoption period of the 2005 VVSG, so they required paper records. "No, the 2005 VVSG are not sufficient to ensure the security of our elections." She talked about concerns with wireless. She thinks that a VVPAT should be required in the VVSG. "VVPAT is essential for the purposes of a recount and audit." Damn, ran out of time.

[2006-07-19T11:45:17] Lamone speaks. "We tend to loose focus on the huge number of absolutely wonderful people that we have working in our elections." She emphasized that the discussion is undermining voter confidence. She is not confident they could fund an upgrade if they're required to meet new sets of standards. VVPT is going to 1) stifle development of other Independent Verification Technologies (IVS) 2) impact disabled (especially non-sighted) voters because they have no way to verify the contents of the VVPT.

[2006-07-19T11:50:00] Wagner speaks. The Federal standards process is not working. Talks about how California found serious reliability and security problems. Testing labs aren't getting the job done. Standards are not sufficiently grounded in the state of the art. We know computers can fail and make mistakes. VVPAT helps protect against this. This is not a minority opinion.

[2006-07-19T11:54:55] Groh speaks. TGDC and EAC should be commended in doing such a large task in such short time. Much respect to the dynamic standards process. Several realities in laying groundwork for successful 2005 VVSG rollout: 1) the need to consider fiscal and operational feasibility (pushing the envelope of voting technology has to respond to what the market is willing to pay) 2) impact of certification and testing (new certification process will need to be in place by the end of this year to be operational in late 2007, and some 2005 VVSG reqs. have no test associated with them to date. This might require modification to the guidelines.) He couldn't do 3 and 4 due to time limits.

[2006-07-19T12:01:09] Ehlers gets five minutes of questions. First, agrees with Lamone on respect of poll workers. "You have to design systems so that they are intuitive and their operation is self-evident." Asks Jeffreys about the NIST human factors report and what parts made it into 2005 VVSG. Half have made it into them, the other five will make it into 2007 version. Ehlers: "Are there other guidelines that you're preparing for 2007?" Yes, they will be performance based. To the ITAA rep: how has the human factors report affected the industry and to what extent are you incorporating them into your systems? Vendors weren't able to pinpoint the reqs. for the 2005 VVSG until their adoption in Dec. 2005.

[2006-07-19T12:06:59] Millender-McDonald gets five minutes. Asks for a clarification about the relation in the lateness of standards to R&D. Asks about the tension between Wanger saying the state of voting security is not good and Jeffrey's comment about how hard they're working. How can we ensure that security is foremost in our system? That's why they want a paper trail.

[2006-07-19T12:11:13] Jeffrey starts. NIST is brand new to this process. The accreditation is completely different. States some differences. Under NVLAP, they are accredited annually for the first three years and then biannually afterwards. Accreditors are international experts on the subject and process. (Wagner doesn't get to answer)

[2006-07-19T12:13:47] Boehlert gets five minutes. How can voluntary guidlines assure anything? Lamone: most vendors will test their equipment to fed. standards. Boehlert claims that vendors are not selling compliant equipment now (I don't know where he gets this). Groh says (for ES&S) that they won't be able to sell. Wagner: even the 2005 standards have shortcomings, and they have considerable delays built in. Boehlert: Mandate VVPAT and mandate audits? Sounds good to me. MS SoS: you're exactly right. Boehlert: we don't need paper trails necessarily, we need auditable technology!!! MS SoS: Well, that's why they required paper. They also do source code audits. However, the standards are the reality. To Davidson: VVPAT, yes or no? Davidson: I was SoS in CO when we passed that law. Boehlert: Jeffrey? Jeffrey: We don't make policy recommendations. Boehlert: As a citizen? (Time expired.)

[2006-07-19T12:21:28] Ms. Hooley gets five minutes, most to Davidson. Do you collect information on failure rates? How does this get factored into the process? When flaws are uncovered, what is the process to ensure that these don't happen again? Did the EAC ever investigate why certain problems had not been identified in certification? If CS types are so concerned and recommended VVPAT, why hasn't the EAC taken that advice? Davidson: The process begins monday morning. We will be taking over the process from NASED. Yes, we do intend to review any type of problem in the field (mechanical, software, or human error). We don't have a method for capturing and reporting that process. We also have a decertification process... we've never had that before. It will be very important. We can notify all the states that have certain equipment that it's faulty. Hooley: Will the EAC take a stronger position on a VVPAT requirement? "The EAC didn't feel that we had that type of authority to take a strong position on VVPAT because we're only an advisory body." (Well, who does?) Hooley: I don't think we're talking about one technology or vendor when we talk about paper verification. Davidson: We support verification, what form of verification is up to the state. Hooley: verification is possible with the type of equipment that is out there. Davidson: That's right. 26 states have paper verification and have audits.

[2006-07-19T12:29:10] Ney has five minutes. to Wagner: You found things that didn't get noticed, right? Wagner: yes, I can provide that to you. Ney to Davidson: You'd be able to take a study from Dr. Wanger to a lab and say, why did this happen? Davidson: We will be able to do that. Ney: Do you think that the 2005 guidelines are an improvement over previous standards? Wagner: They are an improvement. They were drafted over a period of three months so they don't really do the substantive issues. "There wasn't a lot of discussion about paper trails [during HAVA drafting]." We'll try to get the 900 million out there to the locals left in HAVA.

[2006-07-19T12:35:06] Lofgren gets five minutes. The most important thing we can do is to make sure the public knows that elections are on the up and up. Glad that we're going to have a hearing on the paper trail issue. to Wagner: With higher level of testing in CA, we've find a high failure rate. Failures are unbiased where as hacks will manipulate. Do you have concerns about hacking? Wagner: I have concerns about both. I have high praise for CA. Even with unintentional failures, they can cause biases. There are serious issues with hacking. Lofgren: Do you believe that even the CA systems are vulnerable, what would you do? Wagner: none of the voting systems are perfect and they never will be. CA has gone the distance in providing use procedures for voting systems. It does place a heavy burden on election administrators. Lofgren: The ITAs are not public, would you suggest that a system similar to CA be suggested or mandated for localities and the results made public? Wagner: CA is great on reliability. For security, much is still up in the air. We have to work that out. Lofgren to Skall: do you agree? Skall: You never have a 100% assurance that computerized systems will work correctly. You can work to improve your assurance and this is what we're doing.

[2006-07-19T12:41:27] Mr. Gutneck has five minutes. Supports the concept of paper trails. We vote with a little card with an embedded computer chip. It knows that its me (or someone using my card). Concerned more with only people that are elligible to vote vote. (My hands hurt and this part is boring to me, sorry.) Kiffmeyer: "Voting are transactions like no other where the voter is separated from the vote."

[2006-07-19T12:48:07] Bard gets five minutes. A common-sense bill that would require a paper trail has not been brought to a vote. Why has the majority not brought this up? If there is an emergency, we would have to elect members to the House in 49 days... is this practical? Kiffmeyer: what can we do in 49 days? Wellstone in Minnesota was a somewhat better situation (already election happening). However, we also need to be able to use backup systems as primary systems to solve problems like this. Bard: "You mean to say that if a nuclear weapon was detonated in some of our major cities that we could have an election within 49 days of that event?" Kiffmeyer: it's hard to say but she's optomistic. Bard: I've heard that we have a 9.2% failure rate? Is this so? Skall: This is true and we're updating that. Bard: considering that many of us have been elected on a percent or less.

[2006-07-19T12:54:39] Ehlers talks about how VVPATs can be intentionally or erroneously marked. He's concerned about voter eligibility too.

[2006-07-19T12:55:27] Mr. Diaz-[something] gets five minues. Says Bush was legitimately elected in 2000. We've had issues in the past with paper trails. They wouldn't make things perfect. Does anyone have issues with not having paper trails? Does anyone have heartburn about software and hardware companies being owned by foreign investors? Davidson: each vendor and manufacturer would have to register who is doing business with them. They'll have to identify people that can't do business with the U.S. Groh: thinks that with good enough standards, ownership shouldn't matter.

[2006-07-19T13:01:43] Bells ring for House vote.

[2006-07-19T13:03:11] Brady gets brief question. Thanks Lamone for poll worker comment. It's not a human problem, it's a mechanical problem that we need to fix (seems to be a misstatement). We do need a failsafe. I look forward to a paper trail hearing.

[2006-07-19T13:05:28] It's not enough for things to be right, they must look right. To most Americans, they need an auditable record. They believe you should get some tangible evidence of your vote that is deposited and auditable. Do we have the will to abide by the will of the American people. We cannot continue to have unverifiable elections. "In this country, we honor paper."

[2006-07-19T13:07:48] Udall. Wants to submit questions and a longer introduction for Davidson.

[2006-07-19T13:08:45] Many of these issues will continue through other hearings. More questions submitted and answers from the panel. Closes hearing.