more on WaPo: Webb's name cut off from voting machines

[David Farber <dave () farber net>]

Begin forwarded message:

From: Joseph Lorenzo Hall <joehall () gmail com>
Date: October 24, 2006 1:38:33 PM EDT
To: dave () farber net
Cc: Serge Egelman <egelman () cs cmu edu>
Subject: Re: [IP] WaPo: Webb's name cut off from voting machines
Reply-To: joehall () pobox com

On 10/24/06, David Farber <dave () farber net> wrote:
> (Serge said)
>
> I'm not positive about this, but I'd wager that these are probably the
> strongest Democratic-leaning localities in Virginia.  This seems  
> pretty
> fishy.  What's even more outrageous is that knowing of the bug two  
> weeks
> before the election, they say it can't be fixed.

If they say it affects all candidates with long names, that doesn't
sound biased to any particular party.  What they should do is just
shorten the candidate's name on the ballot definitions (templates for
e-voting ballots) for candidates with long names.

The fact that they can't fix bugs close to an election may sound
outrageous, but it is actually a problem with how these machines are
vetted for use.  Most states -- and I believe Virginia is one --
require that voting systems they use have to be federally certified.
That means that an independent testing authority* -- an accredited
testing laboratory -- must certify each version of software, hardware
and the associated documentation before the system can be used.  When
a change needs to be made, the certification process *is* more simple,
but still involves a good deal of delta-testing and regression testing
and can be both expensive and time-consuming.  It would be very hard
for a change to the system's software to make it through that process
before election day.

I would be wary of a decision that required the manufacturer to make
the change and bypass certification... some sort of analysis by
independent experts of the patch and what bugs or vulnerabilities
might have been introduced must be done.

-Joe

* Note, many of us in the NSF ACCURATE center have serious concerns
with how the current certification process works (or doesn't work).

--
Joseph Lorenzo Hall
PhD Student, UC Berkeley, School of Information
<http://josephhall.org/>


-------------------------------------
You are subscribed as lists-ip () insecure org
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/