October 21, 2005

GAO Report on Electronic Voting Security

"Federal Efforts to Improve Security and
Reliability of Electronic Voting Systems Are
Under Way, but Key Activities Need to Be Completed"

"While electronic voting systems hold promise for improving the election
process, numerous entities have raised concerns about their security and
reliability, citing instances of weak security controls, system design flaws,
inadequate system version control, inadequate security testing, incorrect
system configuration, poor security management, and vague or incomplete
voting system standards (see below for examples). It is important to note
that many of these concerns were based on specific system makes and
models or a specific jurisdiction's election, and there is no consensus among
election officials and other experts on their pervasiveness. Nevertheless,
some have caused problems in elections and therefore merit attention.

Federal organizations and nongovernmental groups have issued both
election-specific recommended practices for improving the voting process
and more general guidance intended to help organizations manage
information systems' security and reliability. These recommended practices
and guidelines (applicable throughout the voting system life cycle) include
having vendors build security controls and audit trails into their systems
during development, and having election officials specify security
requirements when acquiring systems. Other suggested practices include
testing and certifying systems against national voting system standards.

The federal government has begun efforts intended to improve life cycle
management of electronic voting systems and thereby improve their security
and reliability. Specifically, EAC has led efforts to (1) draft changes to
existing federal voluntary standards for voting systems, including provisions
addressing security and reliability; (2) develop a process for certifying voting
systems; (3) establish a program to accredit independent laboratories to test
electronic voting systems; and (4) develop a library and clearinghouse for
information on state and local elections and systems. However, these actions
are unlikely to have a significant effect in the 2006 federal election cycle
because important changes to the voting standards have not yet been
completed, the system certification and laboratory accreditation programs
are still in development, and a system software library has not been updated
or improved since the 2004 election. Further, EAC has not consistently
defined specific tasks, processes, and time frames for completing these
activities; as a result, it is unclear when their results will be available to
assist state and local election officials."

Posted by Randy Riddle at October 21, 2005 01:51 PM