Our 2019 Year in Review
We’ve posted our 2019 Annual Review. We hope you agree that this summary of key accomplishments and developments shows the impactful importance of our work to defend democracy.
By Gregory Miller
2018 OSET Institute Year-End Review
Wow, what a year, right? Tonight on the eve of 2019, we post our Annual Review. We hope you agree that the key accomplishments and developments this year demonstrate the impactful importance of our work to defend democracy. Most of all, we thank you for your continued support!
Yet Another Report About Voter Fears & Voting System Integrity
Today, we learned of yet another blog post and a White Paper about voter “concerns” and sentiments regarding the trustworthiness of our existing election infrastructure. This was led by a bit of a sensational headline:
.
“Democracy at Risk: More Than 15 Million Voters May Stay Home on Election Day Over Cyber-Security Doubts”
.
The sum and substance of their article is that the State of PA is the most vulnerable for an election hack. Or as one respected Media outlet asked of us today, “Would you agree that Pennsylvania — given any number of aspects, in
cluding non-paper ballots — is among the most vulnerable states to cyber-focused attacks?“
cluding non-paper ballots — is among the most vulnerable states to cyber-focused attacks?“ .
No. Not so much. Not even close, actually.
.
FACT: “PA is no more vulnerable to cyber-focused attacks than any other state relying heavily if not completely on digital voting machinery, namely DREs,” says John Sebes, CTO at the OSET Institute. “Notwithstanding reports such as the CarbonBlack white paper, PA’s voting machines share the same technical security vulnerabilities as in other states, no more and no less.”
.
Let’s put a fine point on this: If one believes there are State actors seeking to alter an election result by exploiting voting machine vulnerabilities — despite the fact there are lower-cost higher-impact attack opportunities on U.S. elections in general, including some already underway — then PA might be a more attractive target. In other words, PA is not more vulnerable but potentially more attractive insofar as attempts on voting machines. While we’re at it, a few more points worth making:
.
- Its really not just about PA. Actually, FL, and VA, are also among potential swing states that have paperless voting machine vulnerabilities, and have potential Federal election margins that might be narrow enough for an undetected exploit to have a chance of being effective.
- Although elections are at some risk from State sponsored adversaries, concern over possible “voting machine hacks” should not be the major concern of voters, and certainly not a reason to not vote.
- The best way to make sure your ballot isn’t counted correctly, is to not cast one in the first place.
- Voters with concerns over paperless DREs should consider their alternatives for voting on paper ballots in absentee, by-mail, early, and election-day voting.
.
Honestly, we’re not impressed with the nearly sensational approach Ben Johnson’s blog post presents. And while the paper makes some interesting observations (and is a slick presentation to be sure), we don’t believe CarbonBlack is a subject matter expert in elections technology and infrastructure. But if they are, then they’re not being particularly intellectually honest in their assessment by singling out PA for convenience of making their point.
.
We take Ben’s point about the potential for people to stay at home; we’ve seen some similar numbers from equally unscientific polls regarding voter sentiment we’ve been involved with, but chose not to publish. We’re working with some folks deeply experienced at polling, who believe more thorough polling would be required to vet this potential. However, we agree that there does seem to be a rising sentiment.
.
This is one of the reasons election integrity professionals are walking a fine line publicly discussing it.
.
All that observed, the most important value in CarbonBlack’s blog post or any discussion about voter fears should be a wake-up call that more messaging is required to inform voters of the importance to get out and vote (and disregard the hype about rigging, legitimacy, or hacking concerns.) That is, lest we experience a BREXIT of our own.
.
We note Mr. Johnson obtained his Masters in CS from Johns Hopkins in 2006, and he has some impressive credentials with some good experience (e.g., computer scientist for certain 3-letter Agencies). We’d welcome a professional like Ben into the election integrity community. For starters, our CTO has a professional colleague who is a Professor at Johns Hopkins, and truly one of the top election technology integrity experts in the nation if not globally. Actually, we’d be surprised if Ben doesn’t know this Professor already. Maybe we should (re)connect them. Then perhaps, once embedded in the election integrity community, Ben’s writing will be a bit more conditioned on some internal realities. For sure, we’d welcome CarbonBlack acquiring the domain expertise to contribute to the integrity and security mandates of this critical democracy infrastructure. We’re just not sure this blog post or the accompanying White Paper serves the best interest of election integrity goals, where intellectual honesty, a lack of hyperbole, and straight talk are essential.
.
But then, if media coverage is the goal and publishing bait too delicious for the Media to pass on, then there is one more note of clarity deserving here. CarbonBlack has just quietly filed for an IPO (Initial Public Offering), so brand awareness raising activity like this White Paper is normal.
.
Think about it from their PoV: “Let’s leverage all the “FUD” about this year’s election integrity and tie it together with our need for lots of media coverage to support our impending IPO road show.” Sorry, a bit self-serving IOHO. Apologies if this reads strongly, but add grains of salt accordingly.
.
BTW: we offered to chat with CarbonBlack about their paper. Had that happened, we might have been able to help boost their credibility without this work looking so self-serving. There response to us on Twitter? “Sure, send eMail to [email protected].” Really? Directing us to your Media Relations team? That flagged us to look into CarbonBlack a bit more, and that’s when we discovered the IPO filing news breaking today.
.
Look, even we are feeling trepidation about recent interviews and demos we’ve put together with NBC Nightly News, due to air soon. Its such a fine line between scaring off the vote, and yet having a vital conversation about how election integrity can be increased, while costs are decreased, and usability is improved. To wit, we recently launched this video to start that delicate conversation, striking the right chord.
.
And no, we don’t single out any jurisdiction, let alone PA, a State doing the best it can (and a good job at that) to be as ready as possible.
.
Back to work here.
Announcing: Our Story in a New 2-Minute Video
Its amazing what can happen when you bring in real talent. Last year we brought in a new team member in social media, who proved her capabilities so fast that we promoted her to Director of Citizen Outreach. We’ve known for over a year that the time was drawing near to figure out how to tell the TrustTheVote Project story to the public. Specifically, sharing our mission with those other than elections professionals and government. Meegan Gregg did it. And it appears (to use a baseball term) to be a “Walk-off Home Run” or maybe a “drop the mic” result.
Today we’re launching our story, in a 2-minute video developed by a team led by Meegan. It involved an enormously generous grant from XPLANE, the visual story-telling firm, and implemented by the talented production work of several supporting firms including, PingPongPop and Marmoset for voice-over and music; TalkBack for sound & video integration, and RoboToro for web engineering.
So, what’s the point; why the video, and why now?
Candidly, we need to engage the public’s interest and support for our Project. Our operation needs the support of the people, because the TrustTheVote Project is by the people and for the people. We’re building a 21st century “democracy operating system,” ElectOS to increase integrity, lower cost, improve voter experience, and maybe help turn-out.
The video is the best way to tell a story of a complex Silicon Valley project underway by some of the same folks who helped bring you products from Apple and the web browser from Netscape. It connects citizens to a real and pressing problem that is consuming lots of media attention right now in this election cycle: our crumbling voting systems infrastructure.
Now, there is no need to panic: what’s in production now will make it through this election—despite one candidate suggesting there will be “rigging.” But 43 States have to replace their machinery by 2020, which will be here before we know it. And their choice is to replace their existing stuff with more of the same. And that stuff is mostly built on 90’s personal computers.
But the time to address this problem and engage the public is now because this election cycle is upon us, and while we’ll make it through (although we fear there will be challenges and recounts), we the people can improve our own voting experience, increase confidence in elections and their outcomes, and trust the vote. Our civic duty and civil right to free and fair elections is the single most important liberty we have as American citizens. This video explains how we, the people can with your support ensure that liberty is preserved in a time where election technology has become an under-funded disregarded backwater of government I.T.
So please have a look at our new story and tell us what you think!
A Response to POLITICO: Election Infrastructure as Critical Infrastructure
Below is a letter prepared by co-founders Gregory Miller and John Sebes sent to Tim Starks and Cory Bennett of POLITICO, who cover cyber-security issues. A formatted version is here. The signal-to-noise ratio on this subject is rapidly decreasing. There seems to be some fundamental misunderstandings of the challenges local election officials (LEOs) face; the process by which the equipment is qualified for deployment (albeit decrepit archaic technology by today’s standards); what the vulnerabilities are (and are not); and why a designation of “critical infrastructure” is an important consideration. We attempt to address some of those points in this response to Tim’s otherwise really good coverage.
Tim Starks
[email protected]
Morning Cybersecurity Column
POLITICO
1000 Wilson Blvd, 8th Floor,
Arlington, VA, 22209
RE: 11.August Article on Whether to Designate Election Infrastructure as Critical Infrastructure
Greetings Tim–
I am a co-founder of the OSET Foundation, a 501.c.3 nonprofit election technology research institute in the Silicon Valley. I’m writing in response to your article this week in Morning Cybersecurity:
ANOTHER VIEW ON ELECTIONS AS “CRITICAL INFRASTRUCTURE” –
Maybe classifying the election system as part of the nation’s “critical infrastructure” isn’t so wise.
We’ve been on a public benefit mission to innovate electoral technology since 2006. We’re a group of tech-sector social entrepreneurs bringing years of experience from our former employers like Apple, Facebook, Mozilla, Netscape, and elsewhere to bear on innovating America’s “critical democracy infrastructure” —a term we coined nearly a decade ago.
We’re working with elections officials across the country to develop a publicly owned democracy operating system called ElectOS™ in order to update and upgrade America’s voting systems with innovations that will increase integrity and improve participation for 1/3rd the cost of today’s aging systems. ElectOS will innovate voting machinery the way Android® has innovated smart phones and mobile devices. Both are freely available (or “open source”), and like Android, we believe ElectOS will one day enjoy a flourishing commercial market to sustain its continued innovation, deployment, and support.
We’ve been studying the challenges of election administration infrastructure for a decade. So, we read with great interest your article regarding another viewpoint about making a critical infrastructure designation for our nation’s deteriorating, obsolete, and vulnerable voting infrastructure. There are elements of your article we agree with (and more specifically comments of Cris Thomas), and there are points that we disagree with because they reveal some misunderstanding of the realities of election administration and the processes of managing the machinery today. Thus, we were compelled to write you and share these clarifications.
We hope our comments are helpful going forward as you continue to cover this important topic, especially in light of the current election season and the delicate issues being raised by at least one candidate and other media. Good on you for covering this. Below please find our (hopefully helpful) contributions to your effort. Relevant portions of your article appear indented in blue.
In recent days, a growing chorus of experts and policy makers have backed a proposal to give elections the same level of federal security protections that the government already grants other so-called critical infrastructure, such as the power grid or financial industry.
First, we believe it’s important to be very clear on what elections infrastructure are we talking about? We should be discussing voting technology operated by Local Election Officials (“LEOs”), and not web sites and eMail servers run by political NGOs.
Sure, the recent attacks on NGOs are a wake-up call for a variety of potential attacks on real Election Infrastructure (“EI”) and peripheral targets. But the Critical Infrastructure (“CI”) designation should be for core EI; that is, voting machines and the election administration software and systems that manage voting machinery.
But an old school hacker who was part of the L0pht collective says such a change might do more harm than good. “Classifying voting computers as critical infrastructure is going to cause a lot of headaches at the local level,” Cris Thomas, aka “Space Rogue,” tells MC [MC = “POLITICO Morning Cybersecurity”].
Critical Election Infrastructure (“CEI”) is not very different than other locally managed CI. Not all CI is big corporate IT like financial transaction processing systems, or government-operated systems like the ATC, or quasi-public technology like the power grid operated by a variety organizations, but subject to many government regulations. By contrast, we already have CI that is local, including local government operated. For example, there are small local water utilities and municipal water treatment organizations. Local first responders’ infrastructure is CI as well. So, there is plenty of precedent for giving a CI designation to locally managed assets.
Because elections, even national elections, have been historically treated as a local event; having a federal designation as critical infrastructure will fundamentally change how we have handled our elections for the last 240 years.
CEI designation will not cause a fundamental change in the current situation where U.S. elections are a local matter. Mr. Thomas is mistaken on this one point. Local election organizations will have the same responsibilities, plus some new ones for managing CI. But a county election administrator will still manage elections the day after or even the year after a critical infrastructure designation. That cannot, should not, and will not change.
Thomas, now a strategist at Tenable Network Security, says the idea misses the point: We need to remain focused on the security concerns of the current system, which fall into two areas. First, many manufacturers are not testing the systems well enough before selling them to municipalities, often using off-the-shelf hardware and software with minimal security and using things like default, hard-coded passwords.
Of course, the existing voting machines have technical security issues—and at the risk of reading like we’re overly defending vendors, what computing system has none? And of course, it’s also true that a CI designation won’t change these products’ default security posture.
…at the same time, the local government certification agencies seldom have the time, resources and knowledge to properly test these computers for vulnerabilities, …
The same is true regarding certification process, although Mr. Thomas is mistaken about that process itself. There are not “local certification agencies,” but rather Federal and State organizations that certify the systems local (county) election jurisdictions are authorized to use. Nevertheless a CI designation will not increase the rigor of the certification process, and it won’t increase the capability of LEOs to do technical scrutiny of their own.
…and often just accept a manufacturer’s claims of security.
We must also take exception on Mr. Thomas’s last comment. The idea of certification sometimes amounts to “just accepting vendor security claims” —cannot be, and is not the case. Although the current certification process isn’t as strong as we’d like, and though nearly all stakeholders want improvement, there are already clear requirements for vendors to demonstrate compliance with security related requirements. On the other hand, misleading vendor claims about security can sway LEOs when selecting a certified system (and the choices are down to three vendors).
…[T]he result is a system that our entire democracy depends on, which is run with minimal, easily bypassed security.
Sure, but its a mistake to focus solely on technical security problems of voting machines, particularly since these systems are not going to be replaced with better technology immediately upon a CI designation. In the near term, the impact of CEI will be more on people and process, and less on technology itself. LEOs will need help to build organizational capacity and expertise to manage physical assets as critical infrastructure, with physical security, personnel security, increased operational security processes, and the ability to demonstrate that a variety of kinds of people and process controls are actually being followed rather than merely mandated.
So, improvements in the human aspects and processes are the immediate value of a Critical Election Infrastructure designation. Such a designation would need to clearly state that our local election officials (LEOs) are custodians of not just critical infrastructure, but infrastructure that is critical to our national security.
That’s never been a responsibility for LEOs, and many LEOs will be dismayed that they will be called upon to operate in ways that they never imagined would be important. It will require long-term capacity building. In the short term, there are many improvements in people and process that are possible, although unlikely unless there is a high sense of urgency and importance. The designation of election infrastructure and critical infrastructure, however, can help create and maintain that urgency.
A better approach, Thomas says, is to increase funding for the National Voluntary Laboratory Accreditation Program run by NIST and the U.S. Election Assistance Commission.
We agree in principle, but this is not mutually exclusive with Critical Infrastructure. Clearly, there is room for improvement, and NIST and EAC have important roles. With Critical Election Infrastructure, their roles would need to enlarge, but reasonably so.
We also agree that more funding for these organizations’ election integrity efforts are necessary, but doing so is not an either / or decision in consideration of other aspects of CEI. If Election Infrastructure is truly “critical” then several things must occur, including, but not limited to the additional support for NIST and EAC that Mr. Thomas is encouraging.
Here are three examples of improvement that a Critical Election Infrastructure designation would enable —though additional funding and expertise would be required.
- Do not connect anything relating to ballots, counting, voter check-in, etc. to the Internet, ever—and in many cases no local wireless networking should be allowed. With CEI, using an Internet connection is no longer a convenience or shortcut in the grey area of safety—it’s a possible vulnerability with national security implications.
- Physically secure the election back-office systems. The typical election management system (EMS) is a nearly decade old Microsoft Windows based application running on Personal Computers no longer manufactured, that are as easy to break into (“black hack”) as any ordinary PC. Yet, they are the brains of the voting system, and “program” the voting machines for each election. So put them in locked rooms, with physical access controls to ensure that only authorized people every touch them, and never one person alone.
- Perform physical chain of custody really well (i.e., for machines, paper ballots, poll books, precinct operations logs, —everything), with measurable compliance, and transparency on those measurements. It’s just not reasonable to expect LEO Operations to do excellent physical chain of custody routinely everywhere, if these physical assets are not classed as CI. They’re not funded or trained to operate physical security at a CI level. So, there is plenty of room for improvement here, including new responsibility, resources, training, and accountability. All of this may be low hanging fruit for improvement (not perfection) in the near term, but only if the mandate of CEI is made.
We hope this is helpful. We’re glad to discuss issues of election integrity, security, and innovation whenever you want. The co-founders have been in the technology sector for three decades. Both have worked on critical infrastructure initiatives for the government. The OSET CTO, John Sebes has been in digital security for over 30-years and is deeply experienced with the policy, protocols, and tools of systems and facilities security. Our Advisory Board includes former US CTO Aneesh Chopra, digital security expert and CSO of Salesforce.com, Dr. Taher Elgamal, global expert on elections systems integrity, Dr. Joe Kiniry, DHS Cyber-Security Directorate Dr. Douglas Maughan, and several former state election officials.
Respectfully,
Gregory A. Miller
Co-Founder & Chief Development Officer
Showtime: OSET/TrustTheVote Project Appearing at DNC Convention Strategic Forum Event
(This is a x-post from Ms. Voting Matters’ announcement on the OSET Institute’s corporate site.)
We are totally excited about an amazing opportunity tomorrow, Tuesday July 26th, to appear at an event as part of the Democrat National Convention.
The only thing that would make this truly complete is if the Republican National Convention had also invited us (we asked, and although we’re pleased to be working with several in the RNC infrastructure, making something happen was not possible.)
But the New Democrat Network (NDN) and the New Policy Institute did reach out to us and invited us to their premier Strategy Forum now being held at its 4th Democrat National Convention. So, we’re focused on presenting to an audience estimated to exceed 1,000 per latest projections based on RSVPs as of yesterday (over 900). This is truly an amazing opportunity for us to spread the story of our work and we’re deeply appreciative of the NDN’s invitation.
The event, “Looking Ahead: Talks on the Future of America and American Politics” is bringing together a collection of amazing thought-leaders on the future and innovation of democracy including experts such as Ari Berman, Alec Ross, Joel Gamble, Jose Antonio Vargas, and others.
The title of our presentation is: “Modernizing Our Election Technology Can Make Our Democracy Better.”
This will not be telecast, although we’re still waiting word about a webcast, video stream, or recording of the sessions. We’ll update this as soon as we know.
However, part of our presentation will be the launch of a new 2 minute video vignette about the looming problem of obsolete voting machinery and our approach to help bring about innovation which will increase integrity, lower costs, improve participation, and rejuvenate a flagging industry with new technology to innovate the business of delivering finished voting systems. That video will be available on YouTube tomorrow afternoon, and we will add a comment to this post and update it accordingly.
OSET’s Director Citizen Outreach, Meegan Gregg, and the Foundation’s Co-Founder, Gregory Miller will deliver this “Ted-Talk” -like presentation at 12:20pm EDT at the Convention Center in Philadelphia. It should be a great time and a huge (oops) opportunity.
Another Laudable Online Voting Architecture Concept But…
Recently, we were asked about a concept authored by a former technology executive at Citrix (yes, those folks) back in 2012 regarding a potential end to end secure voting system. But that was actually part of a larger question: whether and to what extent digital security must now live beneath the operating system software layer rather than on top of it. The author’s ideas for an online voting system are laudable and his credentials are credible. His follow-on article last year (2015) is interesting, and more to the point of hardware-level security alluded to in the first article. I offer a couple of comments below including some points by our CTO on this approach because it is something baked into ElectOS.
First, we agree that a hardware root of trust is an essential ingredient for any trustworthy computing device running mission critical software. The author, Ahmed Sallam (now CEO at DeepSAFE Technology) rightly points that out, but we doubt that Citrix has an existing product that can safely run an Internet Voting client. We’d love to be proven wrong on that, but it does not change the fact that the core problem is one of successfully combining many ingredients. This is one of the well known ingredients.
There is, from my perspective a well-developed and detailed technical white paper providing a worked example of a hardware root of trust from Apple for its iOS mobile operating system. This hardware rooted security layer has allowed Apple to develop Apple Pay and their biometric authentication management system (you can see a very good overview video here (may require Safari Browser to watch) of how it works). For those wishing to dive deeper, here is the NIST Draft Guidelines for Hardware Rooted Security in Mobile Devices.
At a deeper level of detail, our CTO (John Sebes) agrees with the technical architecture for the server side, but he believes that for the client side, Ahmed’s approach is a bit of overkill. As John observes, “If I understand it right, the Sallam model seeks to allow trusted and un-trusted code to run on a device, with a full operating system and all.”
So, the client architecture that John and the TrustTheVote Project have been advocating from the beginning, starts with a consumer device that has a hardware root of trust and a hypervisor that can validate a boot image as coming from a trustworthy source. John reports that we nearly have that today. And it has to have the ability to do both:
- a normal local boot into a full service mobile device OS to work as a phone browser, etc.; and
- a boot from an external physical device with the boot image for something else.
One such “something else” will probably be a banking App, but the one we’re interested in is a Voting (ballot casting) App — with a single purpose: it runs only that one App and the SW stack under it, immune to malware, etc. That’s not even that hard, but there are interesting PKI (Public Key Infrastructure) issues for ensuring that a given voting App is the real {authentic | authorized} voting App, and performing strong authentication of the user-voter, etc.
Now for the “But…” part of this. Fundamentally, we agree with Ahmed’s vision and concept; however, Citrix will be a potential player in the iVoting technology arena if and only if it is a major player in the mobile computing technology computing ecosystem. From what we can tell, Citrix is moving in that direction.
So to summarize, at the end of the day,
- Do we believe Citrix has a solution for iVoting? No.
- Do we believe the author of both articles referenced here, Ahmed Sallam (now since departed from Citrix and CEO of DeepSAFE) has a credible vision and concept for online voting? Yes.
- Do we believe that concept is complete and in terms of what we understand about the totality of the problem? No.
- Will the hardware root of trust (hardware layer security below the operating system), such as the elegant model embodied in iOS and articulated by the NIST Guidelines be a key ingredient going forward? Yes.
- Are we (anyone) there yet for a voting App/system? No.
Announcing the Launch of VoteStream Beta
Over the past three years we have used this space to document our efforts to create a truly open source, standards based election reporting solution: VoteStream. At each step we have been guided by the needs of election professional and the ideals of the OSET Foundation: that a critical democracy infrastructure should be verifiable, accurate, secure, and transparent (in process).
Today we are excited to take the next step in that process. In partnership with the Knight Foundation, the TrustTheVote project is launching a round of beta testing for the next version of VoteStream. This round will continue to focus on the requirements of local election officials and solicit feedback from academics, journalists, and other stakeholders.
In past tests we demonstrated the ability of VoteStream to publish election results in an easily accessible format. This round will demonstrate the process of converting raw election data to the standard format published by the National Institute of Standards and Technology.
The beta round will be lead by Iain Padley, our new Director of Election Professional Stakeholder Engagement. Iain comes to OSET with experience in community and political organizing with a special emphasis on education issues. He has spent much of the past three years working with local and state election officials to leverage public data to drive increased civic engagement among educators.
If you would like to apply for a spot in this beta round please fill out an application form or email Iain directly at [email protected]
Biting the Bitcoin; Reflections on the Latest “Bitvote” Buzz
In those continuing efforts to route around the abysmal state of voting in America, we’re starting to hear an increasing drumbeat about Bitcoin as a basis for reinventing elections. We’ve been watching this discussion or evangelism unfold in the past few weeks. We even fielded questions from politicos in the Beltway last week about it (seriously).
As technocrats at heart around here, how can we not have our tails in a slow wag over the potential of Bitcoin technology (specifically the Block Chain)? Well, a slow wag maybe; getting our tails in a twist over it for voting? Not so much. And here’s why.
I’m going to use one particular article that dropped this week as a vehicle for discussion. Not because we’re picking on this author or his publication by any stretch (besides, publishing technicality, it was only a “contributed piece”). But rather, this article provides a typical, and as good as any, evangelistic essay on the topic.
To start with, the author makes a fundamental assumption that is wholly inappropriate for U.S. elections administration. Then, several other observations on his part unfortunately reveal a complete lack of understanding of U.S. election law and practices (not that we think he should be an expert in such things, but he probably should have some basic understanding before assuming how Bitcoin might or might not innovate the process of elections). Author Odell leads with:
The primary problem with the antiquated methods come down to a single fundamental issue, centralization.
Well, actually, that centralization is necessary and it isn’t central, but local — the machinery of U.S. elections are required to be in the control of U.S. local election officials. It’s a feature not a bug. His next assertion:
Current voting methods require a large amount of human involvement, from poll workers, to vote counters, to the companies and engineers that design the voting machines.
Yes, yes they do. And the effort is worth it, for the proper operation of critical democracy infrastructure. You see, the integrity of the process depends on local control of ballots, transparency of the local operations, and a critical dual approach to counting ballots that prevents both sole reliance on people and sole reliance on technology. Both people and software have fundamental limits in trustworthiness, so it is important to use both, in order to solely trust neither. Odell continues:
Then you have the oversight groups who employ individuals to oversee the election workers.
Actually, that’s a feature, not a bug. Election workers’ work should be transparent, but the accountability benefits of transparency only accrue if members of the public and good-government groups are actually watching. Then the author continues with some assertions that I’ll take list-wise in response.
“Current voting methods are …
- “inefficient and expensive”
Well, expensive is a fixable feature of a dysfunctional market for election technology; inefficient is a value judgement not shared by local elections officials, who seek the most efficient way of performing their duties, given the rules, regulations, and resources they have. - “susceptible to fraud and manipulation”
Yes, by definition, and they always will be, hence the VAST mandate (elections must be delivered that are Verifiable, Accurate, Secure, and Transparent), and hence the model for ballot-count integrity I referred to above. - “need to be vastly improved”
We agree on this point to the extent there is always room for innovation, but it has to fit with local elections officials’ legally mandated responsibilities.
Odell continues…
Bitcoin technology can provide us with a new and improved voting system built from the ground up, a decentralized and secure alternative.
“Decentralized” in this context would mean non-localized. But that would mean local elections officials relying on a trust management system that they cannot and do not control. That doesn’t fit current election law and regulations in the vast majority of the jurisdictions in this country. “Secure” in this context means “local elections officials should trust this decentralized system because its proponents say it is trustworthy.” At the risk of thinking too practically: that’s just not likely to happen anytime soon.
Odell adds…
Bitcoin is a decentralized and robust ledger secured by computers around the world that run the Bitcoin software.
Indeed it is. We’re not disputing that characterization, but no local election official in this country is going to swallow a story of, “This crypto is so good it will never break and you can trust it so much that you can outsource to a nebulous global network all the responsibility you have for demonstrating the accuracy of election results.” Not going to happen, not any time soon. I’ll pass on even attempting to address “robust” in the author’s assertion about the ledger, as it would apply to voting in America.
Then consider that there is an entire generation of post-Snowden voters coming up who are crypto-luddites, and who believe that any system’s fundamental reliance on crypto is an invitation for central governments’ national security establishments to sneak in. The most recent example is the Tor Network, which supposedly protects the anonymity of people using the web. In fact, about 80% of its infrastructure has been compromised, and if someone is unlucky enough to use that 80% while being targeted by national security apparatus, their anonymity will be breached. Unfortunately perhaps, there’s no reason to suppose that the foreseeable future of Bitcoin is any brighter, and not just because Mark Cuban says so.
I’ll toss in one final thought about the near-term practicality of Bitcoin being the pathway to secure and fraud-free elections. Bitcoin usage requires at least a basic appreciation of the concept of public-key encryption (“PKI”); specifically the use of public and private keys (as straight forward as some may believe it to be). We learned long ago from our prior ventures that the public was nowhere near ready (and still not today) for widespread use of technology like digital signatures or public key cryptography. While Bitcoin transactions are simple enough and do not require a computer scientist to mine bitcoins or make purchases, in order to use Bitcoin technology as a basis for casting and counting ballots, one would need considerably more Bitcoin knowledge.
I’ll leave this critique by observing that at least for the article I chose, the title did state, “How Bitcoin Could Make Voter Fraud and Stolen Elections Impossible.” The operative word there is “Could.” And if we simply want to consider the potential of a technology (verses its practicality) then the potential of Bitcoin to provide for a more secure means of voting is acknowledged. However, I remain convinced it is impractical for American elections as they are conducted and regulated today, and skeptical about the term “Impossible” for anything related to voting security.
How Bitcoin Fits Into Our Innovation Envelope
Now, let me shift from a critique of the current Bitcoin evangelists to a comparison with our charge. We have had some people complain that as a non-profit election technology R&D organization, we should be spending more time looking over the horizon at everything from the block chain to smartphone Internet-based voting. We are spending all of our time looking at innovations, with one major important difference: we are an “applied research” organization and not a “basic research” organization.
What that means is we are funded to have an emphasis on discovering, determining, and developing innovations that are likely to find their way into adoption, adaptation and deployment in the foreseeable future, in order to begin shifting elections administration and voting into the 21st century, while respecting laws and regulations as they stand, and process and politics as they exist.
So, where does this leave us with regard to Odell’s (and others’) vision of the Bitcoin blockchain serving as the basis for reinventing how (at least) America votes? Let’s put it this way:
- We are focused on election technology innovations that meet the current requirements of U.S. election officials (not necessarily those abroad).
- That includes voting system technology that requires the typical use of standard encryption for data integrity.
- Current requirements for voting systems don’t require any further use of crypto, including block chains.
- We are also working on innovations in election technology that exceed the requirements of U.S. election officials, and improve their ability to deliver on the “VAST” mandate (that elections are Verifiable, Accurate, Secure, and Transparent).
- In the arena of voting systems, “E2E” (End-To-End) is the crypto-based innovation that is most likely to fit within existing election administration practice (always a requirement) and deliver improvements that election officials can support, and that the public (citizen-voters) can benefit from.
- E2E ballot verification is technically well known. In the TrustTheVote Project, we rely on the applied crypto experts that are part of our technical stakeholder community, who are well versed in the application of E2E techniques to voting systems.
The bottom line here is that we didn’t say that there is no room for Bitcoin blockchain technology in future innovations, only that it doesn’t even remotely fit into something that local elections officials can use in the foreseeable future.
Bracing for Inevitable Manipulation
We really haven’t been hiding under a rock, its just the stack of reading all of us have to catch up on while so much is going on has become an archeological project here — well, OK, namely for myself. And so my comments below about news from earlier this summer regarding Facebook’s manipulating people’s news feeds and some commentary about Facebook’s “I Voted!” button might seem like I’m really behind, but actually it dawned on me this past weekend that an important piece of our work backed by the Knight Foundation has a role in this… where “this” is actually about big data.
Facebook’s use of happy and sad words to research how they affect the mood of people’s news feeds was well covered in the news a couple of months ago. This “emotional contagion experiment,” raised all sorts of ethical questions about research on subjects who don’t know they’re being tested.
But in the tech and political worlds, people have been equally disturbed about another kind of possible Facebook manipulation—its use, or non-use, of what it calls the “Voter Megaphone.”
What’s the Facebook Voter Megaphone?
The megaphone is the “I Voted!” button that Facebook placed on the top of News Feeds for all U.S. users over age 18 on Election Day in 2010 and 2012. Users could click the button to show their friends they voted and subsequently see which of their friends clicked the button as well.
A study, commissioned by Facebook researchers and published in the journal Nature in September 2012, determined that the “I Voted” button may have boosted 2010 turnout at least by 60,000 voters and as much as 340,000 voters because of the social-media ripple effect. People who saw that their “close” friends had voted were more likely themselves to go out and vote, the study showed.
Across a very big country, 340,000 people may not seem that much, but for campaign consultants, micro-targeters, and turnout specialists, that’s a very big number indeed, especially for 2010, a mid-term election when turnout is always lower.
Facebook did another experiment with an “I Voted!” graphic on the 2012 Election Day. Those results have not been published yet.
So who is upset about this?
Let’s walk through why people are upset at this and why it is important for the TrustTheVote Project.
Micah L. Sifry is a co-founder and the executive editor of the Personal Democracy Forum, an organization that covers the ways technology is changing politics. He’s a pro-Democrat progressive. In a July 3 blog post he spoke to one of the Facebook researchers and pressed him as to whether the Facebook experiments with the Voter Megaphone could have actually helped President Obama in the 2012 election. The researcher’s and Sifry’s conclusion is that it could have.
Here’s how: Facebook users tend to be more female, more urban, and younger. Those are all demographic groups that skew Democratic. If Facebook used its “I Voted” experiment on a random sample of Facebook’s users, and it increased turnout, it could have benefited Barack Obama.
But Sifry wasn’t cheering for his Democratic side. He pointed out that Facebook could just as easily not have offered the “I Voted” button to certain people, or to certain people in certain states and voting districts. That could just as easily lessen turnout for one party or the other. The point is that Facebook could manipulate an election and it would be very hard to tell by outsiders. It’s stealthy manipulation.
Jonathan Zittrain, a professor of law and computer science at Harvard University calls it “digital gerrymandering” and denounced it in a post in NewRepublic.com in June: “Consider a hypothetical, hotly contested future election,” Zittrain wrote. “Suppose that Mark Zuckerberg personally favors whichever candidate you don’t like. He arranges for a voting prompt to appear within the news feeds of tens of millions of active Facebook users—but unlike in the 2010 experiment, the group that will not receive the message is not chosen at random. Rather, Zuckerberg makes use of the fact that Facebook ‘likes’ can predict political views and party affiliation, even beyond the many users who proudly advertise those affiliations directly. With that knowledge, our hypothetical Zuck chooses not to spice the feeds of users unsympathetic to his views. Such machinations then flip the outcome of our hypothetical election.”
What does this have to do with the TrustTheVote Project?
Here’s why this is relevant to the TrustTheVote Project. Presidential and congressional campaigns today are high-stakes, high-tech efforts with lots of money and sophistication behind them. They have the advantage of “big data” collected from all of their outreach and social media efforts. Facebook, Twitter, other social media platforms, also have that “big data” advantage.
Election administrators, on the other hand, don’t. Well, actually they do, but they don’t have the sophistication and money to do a lot with it. Election administrators have lots of data, historical and recent, on turnout by state, congressional district, county, even down to precinct level, and they have demographic data and vote results data going back a long time.
That’s where TrustTheVote Project’s VoteStream initiative comes in. We are developing, in our Election Results Reporting System, software that local election administrators can use that will give top level and deep granular-level data about how the vote went, indexed by many different variables, down to the precinct level. The general public, not to mention reporters and campaign consultants, could immediately spot anomalies that might be worth looking at closer to see whether there was manipulation, or perhaps just brilliant targeting.
What else will VoteStream do?
VoteStream will help local election officials have a more level playing field with the wealthy “big data” players who can use voting and voter registration data for manipulative purposes. Elections officials can use the big data, instead, to inform.
Here’s another way that VoteStream, and in particular the TrustTheVote Project’s open-source election technologies, can help combat manipulation. Most election administrators are smart enough to predict that Democrats will want to increase turnout in Democratic precincts, and the same for Republican campaigns in Republican precincts. But campaigns have become way more sophisticated in their targeting than that. And these campaigns do not warn election administrators in advance about who or where they are targeting.
A campaign today, or even an outside SuperPac, using social media and other sophisticated get-out-the-vote campaigns, could greatly increase turnout suddenly in a way that local elections officials aren’t prepared for. Election workers at a few targeted precincts could suddenly be greeted out of nowhere with a huge turnout and have inadequate vote casting and counting machines to cope. Or, a breakdown in the old voting machines combined with an unexpected spike in turnout could suddenly make for a three-hour wait to vote. This is not far-fetched. This is in part what happened in Florida in 2012 in key districts, unexpectedly high turnout which made for long lines.
So, during my archeological content dig this weekend, this connect-the-dots exercise seemed worth sharing if only to point out that lots of our work here has some real potential to help in ways we might not immediately recognize. File it under the doctrine of unintended windfall benefit.