New E-Voting Paper by Doug Jones, Rips Vendors, State Officials

As a prefatory remark, I should note that I initially hesitated to present this paper because it names vendors and describes long-standing problems with some of their products. But there is no way around this. If we cannot speak about real systems and real threats here, where can we speak about them? In any event, while products made by Diebold feature prominently here, they are not the only vendor I mention, and my intent is to focus on the larger system that allowed these problems to persist years after they were first uncovered, not to focus on the particular vendors that were responsible for these problems in the first place.

-snip-

This leaves us little choice but to lean hard on the voting system vendors, on the federal government, and on the states, demanding effective voting system regulation. The Election Assistance Commission or their successor agency must have enforcement powers in the area of voting system security comparable to those of the Consumer Product Safety Commission with regard to product safety. This demand will almost certainly be more effective if we follow through on allegations of security vulnerabilities by actually demonstrating them.

There is a risk here. Currently, there are very few contexts where it is legal for a security researcher to demonstrate a security vulnerability on current voting systems. Where occasional rare election officials such as Ion Sancho in Leon County Florida or Bruce Funk of Emery County Utah have allowed security experts to examine systems, they have been subject to threats of lawsuits and they have faced significant disciplinary actions. We must create a legal way for security experts to demonstrate voting system vulnerabilities without fear of retribution.