Lax controls over e-voting test labs

By Elise Ackerman, San Jose Mercury News, May 30, 2004



Excerpts:



California Secretary of State Kevin Shelley had a simple question: Had a new electronic voting machine been approved by an independent testing lab?



State law requires such approval before the device could be used by California voters. It guaranteed the machines counted votes accurately and would work reliably during an election. As the state's top election official, Shelley figured he could get a quick answer.



He figured wrong.



Wyle Laboratories of El Segundo refused to discuss the status of its testing of the AccuVote-TSx machine made by its client, Diebold Election Systems. The information was proprietary, Wyle said, and could be revealed only to Diebold.



And so the secretary of state was introduced to the looking-glass world of voting-machine regulation. Over the years, repeated references to ``federal testing'' by election officials have given the impression that the government oversees the certification of touch-screen voting systems. While there are guidelines for the machines, no federal agency has legal authority to enforce them.



Instead, state officials rely on what amounts to a privately operated testing system -- a small group of for-profit companies overseen by a private elections group to ensure the integrity of elections increasingly dependent on electronic voting machines.



Neither the testing procedures nor the testing results are considered to be public information, and these testing laboratories have not traditionally been subject to direct oversight by election officials. For years, the testing system was managed by a private center that also accepted donations from voting-equipment manufacturers.



``I was shocked,'' Shelley recalled. ``Everyone seemed to be in bed with everyone else. You had these so-called independent testing authorities floating out there in an undefined pseudo-public, pseudo-private status whose source of income is the vendors themselves.''



Recent testing by states and university scientists has shown that these labs, called independent testing authorities, or ITAs, are signing off on some software with serious flaws.



------



Forty-two states, including California, rely on three independent testing labs to safeguard elections. By holding voting-equipment manufacturers accountable to national standards and keeping copies of software programs in escrow, the independent labs are supposed to help stop defective computer code from reaching the polling place.



But critics contend that the labs are too close to the elections industry to serve as effective watchdogs. ``The only thing they are independent from is state and federal regulators,'' Shelley told the U.S. Election Assistance Commission this month.



Dan Reeder, a spokesman for Wyle, which functioned as the nation's sole testing lab from 1994 to 1997, said the company's policy is to provide information to the manufacturers who are its customers.



``We would not even acknowledge who we have done business with because of the proprietary nature of the relationship,'' Reeder said. ``It's much like a lawyer-client relationship.''



-----



Only two independent labs test voting software: CIBER of Greenwood Village, Colo., and SysTest Labs of Denver. And only one, Wyle, tests the physical machinery.



SysTest Labs President Brian Phillips said the security risks identified by the outside scientists were not covered by standards published by the Federal Election Commission. ``So long as a system does not violate the requirements of the standards, it is OK,'' Phillips said.