Rick Hasen's web log
November 20, 2003
Important Report on Security of Electronic (DRE) Voting Machines
The Congressional Research Services has published this report, "Election Reform and Electronic Voting Systems (DREs): Analysis of Security Issues." (Link via Electionline.org.) From the executive summary:
- With DREs, unlike document-ballot systems, the voter sees only a representation of the ballot; votes are registered electronically. Some computer security experts believe that this and other features of DREs make them more vulnerable to tampering than other kinds of voting systems, especially through the use of malicious computer code. While there are some differences of opinion among experts about the extent and seriousness of those security concerns, there appears to be an emerging consensus that in general, current DREs do not adhere sufficiently to currently accepted security principles for computer systems, especially given the central importance of voting systems to the functioning of democratic government.
Others caution, however, that there are no demonstrated cases of computer tampering in public elections, and any major changes that might be made to improve security could have unanticipated negative effects of their own. Several proposals have been made to improve the security of DREs and other computer-assisted voting systems. They include (1) ensuring that accepted security protocols are followed appropriately, (2) improving security standards and certification of voting systems, (3) use of opensource computer code, and (4) improvements in verifiability and transparency. Much of the current debate has focused on which such proposals should be implemented and through what means — in particular, whether federal involvement is necessary. Some states are already addressing these issues. The Election Assistance Commission established by HAVA will have some responsibilities relating to voting system security and could address this controversy directly. Some observers have also proposed federal funding for research and development in this area, while others have proposed legislative solutions including enhancement of the audit requirements under HAVA. (My emphasis)