Conformity Magazine - October 2008 - (Page 27)

recognize that, in voting systems, there are two very different situations. The first situation is when the voter’s identity can be linked to the ballot. A second situation exists once the ballot is anonymous and cannot be linked to the voter. When a voter is voting, a lot of protections cannot be employed out of a need to protect voter privacy. Max Etschmaier, in a paper prepared for NIST, called this the “Voter Privacy Domain” (see Note 1). Figure 3 illustrates where privacy must be maintained, but also the limited functionality required within that domain. Once the ballot is in the ballot box and separated from the identity of the voter, a different situation exists. At the point the ballot is separated from the identity of the voter, all the audit and tracking tools that are used in banking and for electronic commerce can be used. A ballot can be uniquely identified and tracked all the way to the final total. There is no reason not to have a traceable link between every ballot in the final total all the way back to the ballot box. Techniques exist and are well developed that would assure every ballot is included in the final total, and, equally, that no ballots from unknown locations have been added. There is no reason not to have this kind of solid audit data to link ballots from the ballot box to the final total. North Carolina Director of Elections, Gary Bartlett, and Keith Long, that state’s Voting Systems Director, have introduced an innovative new reporting system for the 2008 primary elections that illustrates both new innovations and this fundamental difference that takes place in the election process. In the North Carolina system, election results are reported through the North Carolina State Board of Elections website. Voters are able to monitor results as they are reported to the state, and the results in the total can be traced back to individual precincts. A very different situation exists when the voter is in the voting booth and the ballot and voter’s identify can be connected. In this situation, a lot of security measures cannot be used because they would violate the privacy of the voter. However, the voting situation is much simpler than that facing the total voting system. In the voting booth, the following actions must be accomplished: • The ballot must be presented to the voter; • The voter’s choices must be recorded; • The voter must be given a chance to confirm the ballot choices and cast the ballot. Considering the relative simplicity of the task, a number of measures can be conceived that would secure this situation. One of the interesting features of voting systems is the relative lack of using write-once media. There is little reason for not having one piece of software present the ballot to the voter and record the voter’s choices on a write-once CD or other media. A second software package, potentially provided by a trusted 3rd party, could then read the recorded ballot and have the voter confirm the choice. If the voter confirms the ballot, the second software would sign the ballot on the media. If the voter chooses to recast the vote the process would be restarted and the validation software would spoil the ballot instead of signing it. Such a system essentially puts two independent witnesses into the voting booth, and creates an indelible record of the ballot. Crafting security requirements that are situation sensitive would greatly increase the total security of the election system. Today, powerful security practices are being denied the election system because they would violate voter privacy. There is no reason to deny these practices to the entire system. They only need to be denied in the voter privacy domain, where the voter’s identity and ballot can be linked. Conversely, other techniques are currently not used in the voter privacy domain because they would be too complex to use in the entire voting system. However, the situation when the voter is in the voting booth is a much simpler situation. A great deal can be done to protect the voting booth situation that would be impractical to do in the entire voting system. Model Driven Architecture One of the primary problems facing those trying to improve voting system certification is that, while voting systems are enormously important as a business, it is a small, niche oCtober 2008 Conformity 27 http://www.pseinc.com http://www.pseinc.com

Table of Contents Feed for the Digital Edition of Conformity Magazine - October 2008

Conformity Magazine - October 2008 Contents Editor's Note FCC Releases Annual Report on National Do-Not-Call Registry Commission Cracks Down (for the Fourth Time!) On Junk Fax Marketer FCC Releases Quarterly Reports on Consumer Inquiries and Complaints Greenpeace Ranks Electronics Manufacturers Standards List For The EU’s Energy Consumption Directive Published EU Commission Publishes Standards List for Directives on Pressure Equipment, Pressure Vessels Standards List for the EU’s Medical Devices Directive Available The IEEE Product Safety Engineering Society: The First Five Years ESD Open Forum Improving Election Security and Accuracy: The Future of Voting System Certification Conformity Assessment and Accreditation: Their Role in the Global Market Design Issues in Extreme EMC Environment Focus On... Test Equipment Buyers Guide Product News Updated Standards List for EU Directive on Active Implantable Medical Devices FDA Warns of Effects from CT Scans on Electronic Medical Devices FDA Provides Report Card on Its PMA Review Process CPSC Releases Import Safety Strategy Other CPSC Actions in the News IEC Standards Update Product Reviews UL Standards Update Telcordia Standards Update From Our “You Can’t Make This Stuff Up” Department Looking Back: Items from Past Issues of Conformity Advertisers

Conformity Magazine - October 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.