EAC - Voluntary Voting System Guidelines

Name : | Rebecca Mercuri
Organization : | Notable Software, Inc.
Post Date : | 9/30/2005
Section Comments
Section : | 6
Page no. : |
Line no.: |
Comment : | Failure to adequately mitigate insider risks Elections exist in an inherently adversarial environment where insiders have both opportunity and motive. One need only look to the history of the United States to find considerable and ongoing evidence of election-related corruption, as illustrated just this week with the indictment of the House Majority Leader under suspicion of campaign finance violations. Yet the VVSG takes the approach of focusing its entire set of risks assessment and mitigation controls (as described in Volume 1, Section 6) on processes that primarily fall under the auspices of potentially partisan vendors and election officials, without providing sufficient outside assurances that these processes are free from corruption. Take, for example, the distribution requirements, whose goal “is to ensure that the correct voting system software has been distributed without modification.” Within the dozens of these requirements in Section 6.6.4 are none that allow a voter to confirm that the software deployed at the polling place is equivalent to that which was certified, nor any that enable a court to independently determine whether a voting system used during the time of the election had been configured inappropriately (since the configuration management requirements of Section 8 are similarly flawed). The certification process continues to be conducted at an insider level, with no requirements for open review of program code and system architectures, and no abolishment of the trade secrecy practices that allow vendors to shroud their products from scrutiny if litigation over election results ensues.