Re: Shamos: Why e-voting paper trails are a bad idea

[David Farber <dave () farber net>]

________________________________________
From: Eugene H. Spafford [spaf () mac com]
Sent: Wednesday, April 23, 2008 9:58 PM
To: David Farber
Cc: ip
Subject: Re: [IP] Shamos: Why e-voting paper trails are a bad idea

Without going into the discussion, let me simply point out that the ACM position does not mandate paper.

The official ACM position is (in part)  "Voting systems should also enable each voter to inspect a physical (e.g., 
paper) record to verify that his or her vote has been accurately cast and to serve as an independent check on the 
result produced and stored by the system. Making those records permanent (i.e., not based solely in computer memory) 
provides a means by which an accurate recount may be conducted."

If you will note, the ACM position advocates a physical record that can be independently checked and that may be 
accurately recounted.   Paper is given as one example.  We would certainly welcome workable, trustable alternatives 
that use some other physical record.

It is possible to build a flawed system using any technology, including paper.  It is also possible to hack any system 
given the time, resources, and access.   The goal of good security is to apply sufficient resources to gain trust 
appropriate to the given risk.  Our statement is based on the belief that a permanent, verifiable record is a way to do 
that in the context of voting; paper is one technology that can be used, given appropriate procedures and technologies, 
to achieve a high -- although not perfect -- level of trust with reasonable cost.

Prof. Shamos's criticisms of paper have already been discussed here -- he is not evenhanded in that he is criticizing 
some systems with known flaws rather than what can actually be engineered.  Some vendors have provided sub-standard 
paper  mechanisms and these should not be used as exemplars of what is possible.  Many critics of paper do that, 
exactly as some critics of computers focus only on the most defective examples of DRE machines.  Neither is fully fair, 
nor do they advance us towards workable solutions.

Voting has many challenging constraints to be met for privacy, reliability, accuracy, and security.   The ACM position 
is that good design and testing are needed, and that a durable, independently-verifiable ballot is also needed.   Would 
anyone informed and reasonable really argue to the contrary?


-------------------------------------------
Archives: http://www.listbox.com/member/archive/247/=now
RSS Feed: http://www.listbox.com/member/archive/rss/247/
Powered by Listbox: http://www.listbox.com