Sequoia warns Princeton professors over e-voting analysis
Ed Felten is a Princeton University computer scientist who became well-known in technology circles for a paper he co-authored that showed flaws in digital audio watermarks. More precisely, Felten became well-known for the legal threats he received at the time from the Recording Industry Association of America.
Now Sequoia Voting Systems, which is one of the largest e-voting machine manufacturers in the United States, is threatening Felten too.
On Tuesday, Felten posted e-mail he and fellow Princeton professor Andrew Appel received from Sequoia saying:
As you have likely read in the news media, certain New Jersey election officials have stated that they plan to send to you one or more Sequoia Advantage voting machines for analysis. I want to make you aware that if the County does so, it violates their established Sequoia licensing Agreement for use of the voting system. Sequoia has also retained counsel to stop any infringement of our intellectual properties, including any non-compliant analysis. We will also take appropriate steps to protect against any publication of Sequoia software, its behavior, reports regarding same or any other infringement of our intellectual property.
Sequoia also has threatened to sue New Jersey's Union County. County officials backed away from the idea after Sequoia sent them a stiff letter calling the software a "trade secret," according to The Star-Ledger.
The reason the county became concerned in the first place is that mysterious errors showed up in the February presidential primary election. In at least five counties, the paper-tape totals showing how many Democrats and Republicans voted didn't match Sequoia machine's cartridge printouts. Here's more, and here's Sequoia's explanation.
Sequoia may have something to worry about. Felten and his graduate students were able to hack into a Diebold machine, and Appel bought some 1997-vintage Sequoia machines online and concluded they "can be easily manipulated to throw an election."
Is Sequoia on solid ground, legally speaking? Until the details of the licensing agreements become public, it's impossible to know for sure. But it may have a better legal argument than the RIAA and SDMI folks did back in 2001; any lawsuit they brought would likely have been thrown out of court.
But just because Sequoia may have grounds to threaten a suit (and, remember, we don't know) doesn't mean it should. Felten and Appel are careful and diligent researchers. Instead of threatening them, it would make far more sense to hire them to conduct a security evaluation--one presumes that Sequoia would actually want to know if serious vulnerabilities exist. Legal bluster signals that Sequoia has something to hide.
For its part, Sequoia responded on Tuesday with a statement that says in part:
Sequoia's products - and those of all election equipment manufacturers - go through a complete and independent review as part of the Election Assistance Commission's (EAC's) federal voting system certification process including rigorous testing and a line-by-line review of the voting system's source code by EAC accredited Voting System Test Labs (VSTLs)...
In addition to the federal certification program, individual states have their own state certification programs which vary state-by-state but most often entail additional testing and review by qualified third party experts. Many states also require voting system manufacturers to submit their source code to be kept in escrow, should there be a need to access this code by the state in the case of some type of unanticipated situation or problem...
Additional independent reviews of Sequoia products have most recently taken place in the State of California (Secretary Bowen's Top to Bottom Review of Voting Systems), the State of Colorado and The City of Chicago/ Cook County, Illinois. In addition, the New Jersey Institute of Technology is also completing a review of the Voter Verified Paper Audit Trail (VVPAT) adaptation for Sequoia's AVC Advantage at the request of the state of New Jersey.
Sequoia does not support any and all unauthorized activities that violate or circumvent our product licensing agreements. Licensing agreements are standard practice in the technology industry, including the elections industry and have been for decades. Sequoia will vigorously protect and defend its intellectual property and enforcement of established licensing agreements...
Again, Sequoia may have the legal ability to shut down any Princeton research. But the better question is: why would it want to?
Declan McCullagh, CNET News' chief political correspondent, chronicles the intersection of politics and technology. He has covered politics, technology, and Washington, D.C., for more than a decade, which has turned him into an iconoclast and a skeptic of anyone who says, "We oughta have a new federal law against this." E-mail Declan.
Because y'know what? The paper machines were just fine. Keep your e-vote machines, and keep your payroll, your unsold inventory, and your rising debt.
Let the market forces collude to make the changes happen.
-R
"In addition to the federal certification program, individual states have their own state certification programs which vary state-by-state but most often entail additional testing and review by qualified third party experts."
Now they should have to live up to that statement and allow NJ to hire third party experts (in this case the Princeton people) to independently certify that the systems work properly.
Until we can independently verify the code and that the code we verified is what is running on the machine, the system cannot be trusted.
Our elections process should not be subject to trade secret protection.
If I was New Jersey, I would send the machine to Princeton anyway and just DARE Sequoia to take the state to court, asking them, as you did, "What do you have to hide?"
forcing us to spend millions on inadequate machines that are not
reliable and not giving us time to review and improve the faulty
manchines, and they call this a democracy, dumnmockracy is more
like it.
Since perfect security is impossible, electronic voting machines need to have "hardcopy" redundancy in order verify the electronic vote counts. The solution is to provide two paper reports to the voter after they have voted. One is left with the voting center and processed independently to confirm the electronic vote. The other is for the voter to keep as a record of their vote. Also, if the one they keep has a common format, such a record could be scanned by news organizations as a kind of exit poll. This would serve to keep the powers in charge of voting honest.
One thing is very clear to me. Electronic voting, if done without proper safe guards like I have outlined above, has an extreme risk of being exploited and manipulated. And if it 'can' be done, it 'will' be done.
People need to take this very seriously!!
Mark
Being able to use e-voting to fix election results is their 'best' feature. having paper trail or any form of verification / security defeats the purpose of those machines. The only way to defeat those machines is to expose what and why. That's exactly what researchers are trying to prove, and why they,re threatened with lawsuits.
BTW, I still have no answer to a question I've had for years about Diebold e-voting machines. Why the hell do they need an infrared IRDA port ?
http://www.votetrustusa.org/index.php?option=com_content&task=view&id=960&Itemid=51
Everyone should have their vote counted, and that vote should be verifiable and trackable.
E-voting is obsolete as a service. Once you've voted with Oregon's vote-by-mail, you'll ask yourself, "Why do I have to stand in a line for hours to vote?"
If I write code that makes an ATM work, nobody else can use my code without permission to make their brand of ATM work. They can, however write their own unique code that makes their ATMs work the way my ATMs work (unless I patent a particular aspect of my ATM's function that is unique to all other ATMs on the market). The same concept is true for voting boxes -- nobody "owns" the rights to make voting boxes and they all pretty much work the same way (even non-electronic ones) -- therefore, the company can't claim IPR on the concept of voting machines, only the copyright to the code that makes their particular brand work and possibly any patents that make their brand unique from other brands -- and the copyright laws and patent laws protect the company even if the code is made public.
If it really couldn't be tampered with, they would tell the professors to do their worst.
However, any "intellectual property" here is of minimal value, except, perhaps, to the vendor. These machines are embedded systems which display a list of candidates, accept inputs from a touchscreen and write the results to a memory card. Nothing novel here. If there is, it's probably protected by patents. Any hacker worth his reputation could probably write better code than you'll find by examining what's currently in the machine.
In short, nobody's going to learn any earth-shattering coding secrets by examining the voting machine code. The vendor's most likely just afraid that an objective evaluation of the code will reveal defects, which might affect their future sales. I believe that concern, valid as it is from the vendor's point of view, is overridden by the public's right to know that their votes are being accurately tabulated.
The founders of the country probably would have prohibited Congress from passing a law allowing any state from entering into a contract reasonably calculated to increase the risk of voting fraud. But they probably thought nobody would be insane enough to actually ink an agreement like that, leading to another entirely different tirade questioning why any state agreed to this.
There will still be plenty of money to be made selling and servicing the integrated system, even if the source-code is entirely open source. In fact, the software probably should be open-source: let's allow the hackers to do their magic in public before some sleazy politician does it in private. The fees these companies could charge to patch their open-source systems would probably more than outweigh any lost revenue of what's really just a basic counting program.
Sequoia's products - and those of all election equipment manufacturers - go through a complete and independent review as part of the Election Assistance Commission's (EAC's) federal voting system certification process including rigorous testing and a line-by-line review of the voting system's source code by EAC accredited Voting System Test Labs (VSTLs)...
There is NO system on the market which has gone through the EAC testing and certification process.
ALL systems currently on the market were qualified using the flawed vendor-funded, ITA system sponsored by the National Associatiation of State Election Directors (NASED).
In fact for Sequoia to claim their systems have passed the EAC certification procedure is a violation of the manufacture's registration agreement Sequoia signed with the EAC.
Read section 2.3.2 of the EAC Testing and Certification program manual found at:
http://www.eac.gov/voting%20systems/docs/testingandcertmanual.pdf/attachment_download/file
-
by jypeterson
August 1, 2008 6:08 AM PDT
- What disturbs me is that the NJ county was performing its due diligence to protect its citizens and yet they were not protected as a government entity for doing what they thought was right, by ensuring that the voting process could not be circumvented. I wish that they would have proceeded and Sequoia sued. Then, the courts would have heard the arguments against e-voting and a public record and case law would have been established on the subject.
-
Reply to this comment
-
(22 Comments)Sure, hacking and changing votes could occur, but what is more frightening is that an error in the code could persist and an individual's suffrage would not be upheld.