Sequoia Threatens Over Voting Machine Evaluation

enodo writes "Voting machine manufacturer Sequoia has sent well-known Princeton professor Ed Felten and his colleague Andrew Appel a letter threatening to sue if New Jersey sends them a machine to evaluate. It's not clear from the letter Sequoia sent whether they intend to sue the professors or the state — presumably that ambiguity was deliberate on Sequoia's part. Put another clipping in your scrapbook of cases of companies invoking 'intellectual property rights' for bogus reasons." Sequoia seems to be claiming that no one can make a "report" regarding their "software" without their permission.

Comments

Speechless.

[zifferent]

Just speechless.

Re:Speechless.

[The Ancients]

Just speechless.

That's often the results with certain voting machines.

Re:Speechless.

[garcia]

Just speechless.

You are speechless for the right reasons but the majority of the American public will be speechless for another and far more unfortunate reason :(

Re:Speechless.

[gnick]

the majority of the American public will be speechless for another and far more unfortunate reason So - Let's let them be heard. Let's put the decision on whether or not to use the machines to a vote. It can be a trial run for Sequoia's machines. If Sequoia tells us that we voted in favor of using their machines, we know they're lying and ditch 'em.

Re:Speechless.

[KillerCow]

Easy evaluation: "Epic fail."

Reasons: "The system was incapable of operating within the evaluation environment."

Re:Speechless.

[PurpleZebra]

That was my reaction as well, are these people seriously pulling this? I don't know whats more pathetic ... them pulling it or the fact that the courts will most likely uphold it.

Re:Speechless.

[TheMCP]

Why? This is a common tactic in the software industry. Just try announcing that you're going to publish an objective speed benchmark comparison of MS SQL Server vs Oracle vs MySQL, and see how long it takes for you to get several cease & desist letters.

The state, on the other hand, has a strong interest in testing voting machines. So, if the voting machine manufacturer wants to prohibit testing, the state should just respond "Ok, no problem, we will never buy another voting machine from you as long as you have this policy, and if you assert that we may not test machines that we have lawfully purchased from you, we demand a full refund or we will institute legal action to recover the full value of the machines."

Let the company dig its own grave.

No permission should be needed

[Midnight Thunder]

I am sure the state of New Jersey can tell Sequoia to accept this investigation or say good-bye to any certification. Sequoia is just making themselves look bad and like they have something to hide.

Re:No permission should be needed

[falconwolf]

I am sure the state of New Jersey can tell Sequoia to accept this investigation or say good-bye to any certification. Sequoia is just making themselves look bad and like they have something to hide.

I agree however New Jersey probably has already paid for the machines. I can't see Sequoia telling the state they can't test them, have them tested scientifically, if they haven't already been paid for. This case can however be used to show other potential buyers just how the company operates.

Falcon

Re:No permission should be needed

[moderatorrater]

With the company threatening legal action, why even consider going forward with the investigation? Threats usually come from feeling that what you're threatening is dangerous in some way, so it's highly likely there are security problems to be found. Additionally, the state shouldn't even consider using a company that opposes a comprehensive security evaluation.

Re:No permission should be needed

[justsomecomputerguy]

I am sure New Jersey could and say "No review, no contract". But WILL they?
There are so many times when people COULD do the right thing, but they don't.

Spend ten bucks on a box of envelopes and some stamps and start writing those letters.

Put YOUR representative's office phone number on YOUR speed dial and CALL every week until we hear sense from them.

Do it. Do it. Do it.

It doesn't get much simpler or fundamental than this.

Re:No permission should be needed

[Bogtha]

I am sure the state of New Jersey can tell Sequoia to accept this investigation or say good-bye to any certification.

Tell them to accept the investigation? As far as I'm concerned, the fact that they are threatening to sue to avoid having their software examined for flaws automatically disqualifies them from consideration. Why bother with the investigation now? They are practically admitting that their software isn't good enough and that they will do anything possible to avoid fixing it.

Re:No permission should be needed

[TubeSteak]

I can't see Sequoia telling the state they can't test them, have them tested scientifically, if they haven't already been paid for. Sequoia may have sold New Jersey the machine, but leased the software, or not.
Who knows?

It really depends on what the contract is between Sequoia and the State.
None of us know the details, so really, this whole thread is going to be just speculation.

Re:No permission should be needed

[Rick17JJ]

If they do not have enough confidence in their system's security or accuracy to allow it to be tested, then it is not good enough to be used for e-voting. They have just demonstrated that their system can not be trusted.

Re:No permission should be needed

[mstahl]

None of us know the details, so really, this whole thread is going to be just speculation.

Aw now it's not going to be as fun to read. Thanks for ruining slashdot! :(

Re:No permission should be needed

[Anonymous Coward]

Although you can buy hardware & software, the software is not yours to do with whatever you like (unless the ownership of the software is transferred allso).

Disassembling software and/or circumvent measures that should make it impossible to do so is forbidden by the DMCA and others.

And now the gouverment gets the same treatment we, mere users, have been getting for years. :-|

On the other hand, the companies threat could be regarded as a willfull interference with the due process of the Law, in which case they could be in dangerous waters ...

Re:No permission should be needed

[Anonymous Coward]

This case can however be used to show other potential buyers just how the company operates.

These are very old tactics. Oracle has licensing language that forbids benchmarking and publication of results for comparative use, except by their permission.

It is my understanding that MS has, as part of its Word EULA, that the product cannot be used to produce material disparaging MS or its products.

Enforceable? Who knows? You feelin' lucky, punk? Got the bux to go up against MS?

A lot of this crap may be no more than "in terrorem" (Latin: for the purpose of instilling fear) clauses, which are legally unenforceable, but dissuade people from asserting their true rights. Probably a lot of the "contract" on a parking garage ticket stub qualifies as such. Since you can't read it before you've entered the premises and paid to pull a stub from the machine, I suspect you could have fun insisting that you did not accept the contract which you could not read pre-purchase, then demanding to exit the facility after having your money returned.

I once worked with a woman who parked in an attended "leave your keys" lot. Somehow, you were supposed to park in the morning, then wait to leave in the evening after all the cars the attendant had parked around you had left. I guess it worked because the earliest cars were parked around the edges of the lot, so they had street access.

In any case, the woman got a call one day to pick up her sick kid from school. Since she came to work late, the attendant told her she'd just have to wait until the others left at quitting time. (This was long before cell phones, so she had to return to work to get to a phone.) So she called a cop who arrived, heard her story and told the attendant, "Start moving cars. Right now." I wonder if she could have nailed the parking company's ass if the foolishness had caused a delay in getting treatment for her kid's illness.

Another place where in terrorem clauses were common was at dry cleaners and laundries. They usually displayed a prominent sign asserting they could sell your clothes for cleaning costs if they were not picked up within 30 days. CA state law specified a minimum of something like 60 or 90 days. Who knows how many people came in after six weeks and were told the clothes had legally been sold two weeks earlier? If it had been true, the cleaners would have been entitled to sell a $500 suit for $15, the cost of cleaning. As when a house is sold to recover delinquent taxes, there is no obligation on the seller to get the best price and return the excess to the original owner -- they can make the sale for just enough to recover their "loss".

Sweet.

[Jaysyn]

Yes, that is *exactly* what we want Sequoia to do. Sue a Priceton professor & *security* researcher.

Bullet. Meet foot.

Re:Sweet.

[l2718]

Actually, threatening Felten with a lawsuit is quite effective. Now actual lawsuit needs to be filed. Since this would be consulting work, not research, he would not be covered by Princeton's Lawyers and will have to fend for himself, which is quite expensive -- so the threat of litigation might be enough to deter him. New Jersey, being a state, cannot be sued without its consent.

Re:Sweet.

[Silent Commentator]

Bullet. Meet foot. ...but only if they've already inserted foot into mouth.

Re:Sweet.

[rnturn]

But... New Jersey might file a countersuit against Sequoia claiming that they interfering with New Jersey's ability to verify that the machines are suitable for use in actual elections (before the elections are held and found to be invalid). Imagine GM suing a customer because they took their car to a non-GM mechanic to verify that some work had been done properly. I doubt the courts would look kindly on that.

If I were a New Jersey state elections employee, I'd be looking seriously at returning the equipment, informing Sequoia that it was unsuitable for use, and demanding my money back.

Finally, I'm guessing that Sequoia isn't all that interested in staying in the electronic voting machine business. This act will pretty much have everyone who's still considering even using electronic voting equipment making a mental note to cross Sequoia off their short list of vendors.

The ambiguity is a dead giveaway.

[TripMaster Monkey]

It's not clear from the letter Sequoia sent whether they intend to sue the professors or the state -- presumably that ambiguity was deliberate on Sequoia's part.

In other words, this is a scare tactic with nothing to back it up, pure and simple. If Sequoia thought the would have had actual grounds to sue, you can bet that they would have been chillingly specific in their letter.

When people resort to these sort of tactics to attempt to dissuade you, you can be assured you're doing something right.

Re:The ambiguity is a dead giveaway.

[FreetoGoodhome]

I would like to add that Sequoia didn't cite any portion of the "license ageement" that is supposed to be specifically violated. I'll bet there are a bunch of legal types who would take the defense of this case pro-bono. I would bet that, like any other government body, there are some statutes that limit what limitations Sequoia can impose. This can only get more interesting. November is a-coming.

Re:The ambiguity is a dead giveaway.

[SleptThroughClass]

At first I thought the /. headline was too ambiguous. But it happens to be properly ambiguous.

Re:The ambiguity is a dead giveaway.

[sm62704]

In other words, this is a scare tactic with nothing to back it up, pure and simple.

I'm wondering "how thay can threaten their customer?" Who do they think they are, the RIAA and that New Jersey is a mom on food stamps?

But perhaps they can. This cynical old man thinks there's a lot more here than meets the eye - Sequoia may surreptuously funnel cash to the campaigns of some of the high ranking New Jersey goons, er, excuse me, lawmakers/bureaucrats.

But then I'm in Illinois where the last Democrat Governor went to prison, and the last Republican Governor then went to prison. I'm thinking if a Republican wins the next Governor election, Blago will join Ryan in a cell.

Rich powerful people don't play nice. You don't get to be a rich, powerful man by giving a rat's ass about anyone or anything except your money and power.

-mcgrew

(background on Illinois Politics):

Politics in the state, particularly Chicago machine politics, have been famous for highly visible corruption cases, as well as for crusading reformers such as governors Adlai Stevenson (D) and James Thompson (R). In 2006, former Governor George Ryan (R) was convicted of racketeering and bribery. In the late 20th century Congressman Dan Rostenkowski (Dem) was imprisoned for mail fraud; former governor and federal judge Otto Kerner, Jr. (D) was imprisoned for bribery; and State Auditor of Public Accounts (Comptroller) Orville Hodge (R) was imprisoned for embezzlement. In 1912 William Lorimer, the GOP boss of Chicago, was expelled from the U.S. Senate for bribery, and in 1921 Governor Len Small (R) was found to have defrauded the state of a million dollars.[58][27][15]

Re:The ambiguity is a dead giveaway.

[91degrees]

It is a scare tactic. But don't think they have nothing to back it up. Now, harassment suing isn't really much of a threat. The state has competent lawyers and legal expenses can easily be sold to the voters as an unavoidable cost, and Felton can probably find a dozen lawyers with IP expertise who'd be delighted to represent him pro-bono, but there is still the possibility that they would actually win, depending on the licensing agreement.

Re:The ambiguity is a dead giveaway.

[Mongoose Disciple]

My thought is, if the defense handles the case correctly, Sequoia can't win. Force enough dirty laundry up through discovery and make it a loud enough case that even if they win the lawsuit, the bad publicity is irreparable damage.

Of course, that assumes that governments will choose their voting machines in a somewhat reasonable manner in the future, which is not a good assumption.

Re:The ambiguity is a dead giveaway.

[Mr. Slippery]

where the last Democrat Governor...

DemocratIC. "Democrat" is a noun. "Democratic" is an adjective or adverb.

Re:The ambiguity is a dead giveaway.

[crucini]

On the contrary; it's generally a bad idea to be specific in these kinds of letters. Off hand:

• The letter should be designed for its impact on a jury. If it contains legal technicalities, it looks scheming and calculated. Rather, it should emphasize the unfairness of the defendant's action.
  
• It's hard to be accurately comprehensive. If someone infringes two of your rights, and you only complain about one, it looks like you're waiving the other.
  

Check, Meet Balance

[CheeseburgerBrown]

A voting apparatus without a clear path for auditing of every system and sub-system is an invitation to corruption. Comparable mechanisms in governance have checks and balances to ensure fidelity.

Why do these shifty porkchops think they ought to be exempt? Because it may make their investors nervous?

This is definitely a situation where the bottom line should be drawn by logic, not by dollars.

Re:Check, Meet Balance

[markov_chain]

Maybe that's how this happened. Some clueless board member demands something to be done, slamming his first on the table. The task gets assigned to the CEO, who assigns it to the lawyers, who do "something" that will appease the chain of command all the while knowing how useless it is.

Re:Check, Meet Balance

[CastrTroy]

Any voting system should be verifiable by any member of the voting populous. Having a PhD in computer science should not be prerequisite for understanding the voting system. You also shouldn't have to take somebody else's word for it either. Pen and paper hand counted ballots make sense, because anybody can see exactly what's going on, and fully understand the process. If voters don't understand the voting system, then they might as well not even be voting.

Re:Check, Meet Balance

[ivan256]

The problem is the lack of even a single impartial ballot counter. Whereas an expertly designed and reviewed machine can be reasonably guaranteed to be bias-free.

Fixing elections is not something that has been enabled by new technology. The problem here is that the technology was supposed to reduce the fraud and inaccuracies, but it turns out it's just as hackable as the old pen & paper or punchcard systems despite the higher cost.

Re:Check, Meet Balance

[CastrTroy]

That's why the ballots can be counted, or viewed by multiple parties, who should all agree on the final counts. Anybody should be allowed to stand around and watch the counting. I'm not saying that no fraud would happen, because it's happened in the past, and it will happen in the future. I'm just saying that it should be obvious to the voting public when fraud is happening. The problem with machines, is that even if they are verified, it's impossible to know what code is running on it when you walk up to it on election day. Think of game consoles. They try to make it so you can only run licensed content. But people always find a way to run homebrew/pirated games. You can verify the machine all you want. There's no guaranteeing that the same machine will actually be used on election day. You could probably even put a completely different machine in front of people on election day, possibly in the same casing, although that's not even necessary, and people wouldn't even know they were using the wrong machine, because each polling district uses different machines.

Re:Check, Meet Balance

[Dutch Gun]

What exactly could I, as a member of the voting populous, do to ensure that a pen and paper system hasn't been somehow gamed? Count up every ballot myself? The idea that a single citizen can oversee the process seems a bit far-fetched, either for paper ballots or an electronic system.

The world's finances and markets are governed by computers. There are ways to ensure someone simply doesn't add or delete arbitrary amounts of money to accounts. Tell me how this problem can be solved, yet tallying votes can't somehow be secured. I have a hard time believe that just because politics are involved, somehow the rules of security suddenly don't apply.

Please understand, I'm neither disagreeing with your assertion that oversight and accountability is critical nor am I defending the manufacturer of any current voting systems. I just think that, at a fundamental level, it *is* possible to create a secure electronic voting system. Keep in mind that, as with any complex system, the human side of the equation (such as operating and oversight procedures) are just as important as the technical side.

Re:Check, Meet Balance

[perlchild]

Can't the state just sue them for misrepresenting their software as "suitable"?

Something tells me that not just accepting, but passing an independant audit should be a requirement for just bidding on the contract, let alone winning it.

But the supplier is saying an independant audit(due diligence on the part of the elected officials, IMHO) is against the terms of the contract? WTF?

Re:Check, Meet Balance

[MightyMartian]

I don't know of any paper ballot counting system that works the way you appear to be saying they do. Here in Canada, there are scrutineers from every party present at the polling station during both the casting of ballots and during the counting. There are rules for recounts where the winning candidate and the candidate coming in second are very close (I believe it's within 100 votes, at least for Federal elections), and ultimately, if necessary a judicial recount.

Re:Check, Meet Balance

[ivan256]

That's why the ballots can be counted, or viewed by multiple parties, who should all agree on the final counts. That's why a fraudster could simply swap ballot boxes before the counting began. Or stuff ballots. Or... Well, you get the idea.

Just as you can't guarantee the machine hasn't been tampered with, you can't verify the ballot box hasn't been tampered with. It is the exact same problem.

Re:Check, Meet Balance

[Anonymous Coward]

You saw that on BSG!

Re:Check, Meet Balance

[norkakn]

One valid advantage of computerized voting is that it is much easier to support different languages and disabled persons.

Re:Check, Meet Balance

[FailedTheTuringTest]

No, it's not the same problem. It's easy for people to watch the movements of pieces of paper, make sure they end up where they belong, and count them. It's much harder to do the same with electrons.

The solution for paper ballots is based on four principles: transparency, adversarial conditions, counting everything in a way that, if done right, makes double-entry accounting look like a random number generator, and decentralization.

Transparency means that every step of the process is done in the open, with multiple people watching. Adversarial conditions means that the people watching include representatives (i.e. campaign workers) of all candidates, who are highly motivated to ensure that the others don't cheat. In Scotland, for example, each candidate can even apply their own seal to the ballot boxes in addition to the electoral commission's seals, so they can verify for themselves that boxes haven't been swapped, opened, or lost. A fraudster would have to be able to duplicate the seals of every political party in addition to the electoral commission.

As for counting, every ballot paper must be accounted for. Polling stations start with a known number of blank ballots (verified by all candidates) and they must count the number of ballot papers issued, used, spoiled, and not used, as well as the number of ballots that end up in the ballot box, and if the numbers don't add up right then one can deduce that funny business is going on.

Finally, decentralization is important. With safeguards in place, it may still be possible to cheat in a few locations (although you'd have to get campaign workers from all sides to look the other way), but widespread fraud serious enough to steal a whole election becomes extremely difficult. It is difficult to compromise the process in many locations at once. And even though the central counting facility receives the counts from each polling station and adds them up, it can be made to echo the numbers back and discrepancies can be spotted. A centralized electronic system, though, can be compromised at the center, you don't have to take over every polling station.

Re:Check, Meet Balance

[moeinvt]

"It is the exact same problem."

Hardly.

Think of the issues in logistical terms. In a paper-ballot system, tampering with a ballot box in such a way as to make any appreciable difference in the vote result would require tools, materials, physical access and a certain amount of time and effort within a relatively small window of opportunity.

With an electronic system, if the state isn't allowed to run simulated elections or do detailed inspection of the voting machine and software, the window of opportunity for tampering is huge, the potential for altering the result is high, and the risk of detection is minimal.

Re:Check, Meet Balance

[Dr_Barnowl]

What exactly could I, as a member of the voting populous, do to ensure that a pen and paper system hasn't been somehow gamed?

Keep in mind that, as with any complex system, the human side of the equation (such as operating and oversight procedures) are just as important as the technical side. Yes, it is possible to create a secure voting system, but the problem is it would involve strong crypto and as such it would be understood by only a few people. Oversight would be difficult even for those experts because even experts have trouble counting electron pulses bouncing around a slip of silicon every few nanoseconds.

A paper ballot system has the advantage of being comprehensible to even those of average intelligence, visible, and simple. And thus it's much harder to subvert if you have transparency about your procedures and access to all participants. It scales easily with the task (the same small fraction of the population should serve any size of election), and compared to the importance of the data being counted, the additional wait for a manual count is of limited importance.

Electronic financial systems work well because both parties have an interest in the transaction being kocher. Electoral systems have no such balance ; if the system in your area has been bought, the interest is all with the buyer. With a paper system, for each person involved in the process, you have another chance that subversion will be both detected and reported. With a computer system, the pool of people able to even detect fraud is minimal, and well known (and thus much easier to target for bribes, threats, whatever).

I love computers. I get to tinker with them for a living. But they have no place in a transparent democratic electoral process.

Re:Check, Meet Balance

[pla]

If voters don't understand the voting system, then they might as well not even be voting.

Why do you think we have the electoral college and a representational democracy in the first place?

The vast majority of idiots out there shouldn't vote. Anyone who can't articulate the "other" candidate's position as well as their favorite's, shouldn't vote. Anyone who can't explain their own candidate's position on most issues, shouldn't vote. Anyone who pulls the "party" lever, should not vote.

So does it bother me that people don't understand the nasty complex computers that count their votes?

It bothers me that, as someone who does understand technology, current electronic voting machines fail miserably both on accuracy and auditability. But that most people don't understand the underlying technology?

No. Not in the least.

Re:Check, Meet Balance

[kraut]

Finally someone who sees sense:

Voting machines make a very simple, nicely parallelisable problem unnecessarily complicated.

Sealed ballot boxes and observers from all parties, as well as fairly neutral officials present at the count works fine in Europe.

And if you have more voters, you'll likely have more volunteers, too.

Voting machines are a bad solution in search of a problem.

Re:Check, Meet Balance

[CastrTroy]

Financial systems rely on the fact that the transactions aren't anonymous. Money always goes from one account to another. In the voting process, it's (supposed to be) completely anonymous. A bunch of people come in, and bunch of votes are cast, but nobody should be able to tell who voted for who. Imagine the same with a bank, where deposits have to be made to the correct accounts, but you can't verify which account they are coming from.

Re:Check, Meet Balance

[CastrTroy]

Well then the computer should simply print out a human readable paper which would then be hand counted.

Re:Check, Meet Balance

[gnasher719]

Yes, it is possible to create a secure voting system, but the problem is it would involve strong crypto and as such it would be understood by only a few people. That is wrong. It doesn't involve strong crypto at all. It does, however, involve a strong crytographer :-) There have been several systems published that allow anonymous verification + proof of tampering without giving up anonymity of voting.

Re:Check, Meet Balance

[Mr. Slippery]

The problem is the lack of even a single impartial ballot counter. Whereas an expertly designed and reviewed machine can be reasonably guaranteed to be bias-free.

If impartial ballot counter can't be found, how do you expect to find impartial software/hardware designers and reviewers?

At least ballot counters and monitors can be relatively unskilled. You can get a bunch of them with different biases and divide them up into teams to provide checks and balances. Harder to find a whole bunch of designers and reviewers and have them check on each other.

Re:Check, Meet Balance

[Mr. Slippery]

Why do you think we have the electoral college and a representational democracy in the first place?

To protect the privileged classes.

The vast majority of idiots out there shouldn't vote.

Anyone who thinks they - or anyone - can reliably and unbiasedly tell who the idiots are who shouldn't be allowed to vote, is exactly the sort of idiot who shouldn't be allowed to vote.

Wait. Shoot. That doesn't work. Ok, votes for everybody.

Re:Check, Meet Balance

[ivan256]

With an electronic system, if the state isn't allowed to run simulated elections or do detailed inspection of the voting machine and software, the window of opportunity for tampering is huge, the potential for altering the result is high, and the risk of detection is minimal. Honestly, that's an unfair assumption have in this debate. Yes, the current electronic machines have this problem. However, that is a problem with the current machines and manufacturers, not with electronic voting in general. If you assumed the same restrictions on traditional ballot boxes you wouldn't know, for example, if there were already a bunch of ballots in the box before the election started.

Re:Check, Meet Balance

[ivan256]

If impartial ballot counter can't be found, how do you expect to find impartial software/hardware designers and reviewers?

Presumably you design the equipment well before you know what it will be used to tally. You should be able to find plenty of qualified designers and reviewers for a device before any particular candidate or issue is associates with it; thus making bias irrelevant. Additionally, while you can work around bias, it's easier to do it for a handful of designs than for tens of millions of ballots.

Re:Check, Meet Balance

[Mr. Slippery]

Presumably you design the equipment well before you know what it will be used to tally.

I don't understand. How you you propose to make a voting machine without those involved knowing that they're going to be tallying votes for Republicans, Democrats, Libertarians, and Greens?

it's easier to do it for a handful of designs than for tens of millions of ballots.

But not just the design, but the implementation, distribution, installation, and configuration of the systems would have to be protected. Every line of code must be scrutinized by experts, and every installed voting machine must be check by a different sort of expert. But pretty much any doofus can monitor the collection of ballot boxes or look over the shoulder of someone counting physical ballots. That makes it easier to verify the use of paper ballots than electronic ones.

Re:Check, Meet Balance

[ivan256]

But not just the design, but the implementation, distribution, installation, and configuration of the systems would have to be protected. Every line of code must be scrutinized by experts, and every installed voting machine must be check by a different sort of expert. But pretty much any doofus can monitor the collection of ballot boxes or look over the shoulder of someone counting physical ballots. That makes it easier to verify the use of paper ballots than electronic ones.

Your assessment of the situation remains clouded by the current batch of really shitty voting machines. Machines *can* be designed in such a way that tampering is obvious, and that code updates are either impossible, or impossible to do with out breaking the same types of protections that are used on traditional ballot boxes. Look at some of the hacks that have occurred on the Diebold machines... Same key for all the boxes... Security seals on one screw, but not the other, etc...

The code should not have to be expertly reviewed for every machine for every election. It should be trivial (given an open system and process, which is impossible with the current vendor(s)) to verify that all the systems are running the same code that they were running at certification time by non-skilled or even generally oblivious people. It should be unnecessary to ever update the code on these boxes after certification/manufacturing (could be done at the same time), so there's no reason for it to even be possible. The devices shouldn't be networked. Etc..

Re:Check, Meet Balance

[Qzukk]

That's why a fraudster could simply swap ballot boxes before the counting began. Or stuff ballots. Or... Well, you get the idea.

Issue (randomly, to prevent identification) numbered ballots to the voters. Any numbers left over at the end of the day are copied down and invalidated. If these ballot numbers turn up in the result, Something Is Wrong.

Voters pick one of N boxes to put their ballots. If the same number appears in two different boxes, Something Is Wrong.

If after counting all the votes, not all of the numbers are accounted for, Something Is Wrong.

This will identify any cases of ballot-stuffing, box swapping and "misplaced" boxes. Got any more problems that need solving?

Re:Check, Meet Balance

[ivan256]

Yeah. What do you do when "something is wrong"? If the answer is "re-vote", how do you fix the people who claim they are disenfranchised because they can't get back to the polls a second time for whatever reason. How do you compare the numbers on the paper ballots to the master list in a timely fashion?

Knowing there was fraud isn't enough. The idea is to prevent the problem.

Your post is yet another that assumes electronic voting was a solution searching for a problem. It was a solution to real problems with manual voting.

Re:Check, Meet Balance

[vuo]

You just came up with the best single-sentence slogan against electronic voting. "If voters don't understand the voting system, then they might as well not even be voting." When you look at the recent events this way, it's like watching them with X-ray glasses. "They might as well not even be voting" is the whole point. Making people not understand the process is actually more important (for the stability of an oligocratic system) than outright changing the totals.

Personally, I don't like this stupid shenaniganary to circumvent the democratic process. Back in the 19th century, the King or Czar, or people directly commissioned by him, told you what to do. Legally, the King was directly authorized by God. There was no B.S. like this involved. No one today would support the absolutist system, but the absolutist system was at least simple and unambiguous. Today, pseudo-democracies are only more complex for no good reason. Elect a King and be done with it!

Re:Check, Meet Balance

[Mr. Slippery]

Machines *can* be designed in such a way that tampering is obvious, and that code updates are either impossible, or impossible to do with out breaking the same types of protections that are used on traditional ballot boxes.

But detecting tampering after the fact doesn't help detect problems built-in at the factory.

It should be trivial (given an open system and process, which is impossible with the current vendor(s)) to verify that all the systems are running the same code that they were running at certification time by non-skilled or even generally oblivious people.

If you don't have significant computer security skills, I don't see how it could possibly be trivial to perform such a verification. And, perhaps more importantly, how can "non-skilled or even generally oblivious people" understand or trust someone else's verification?

It's very easy to understand, and thus trust, a system of inventory and access control of paper ballots. Until everbody's grandmother is a Perl hacker, that will never be the case for electronic voting.

Re:Check, Meet Balance

[ivan256]

You've missed my point. You get experts to verify every aspect of the engineering "at the factory". The tampering controls are to make it trivial for the average person to verify that the box is still compromised.

It is not easy to understand a system of paper ballots. It's easy to think you understand. There are tens of millions of voters in this country. The task of counting all the ballots in a reasonable timeframe is unfathomable to the majority of people. I actually wonder if you comprehend how complex it is. Have you already forgotten the recent botched elections? Have you not heard of how the "simple" system has been subverted in our own country in the past?

Lastly, it will be no difficult for the average person to understand and trust electronic voting than it was for them to understand and trust mechanical voting (which is a huge step up from paper), and many states have been using that for decades.

Re:Check, Meet Balance

[ivan256]

Duh. Clearly that should have said "still uncompromised".

Re:Check, Meet Balance

[Mr. Slippery]

You get experts to verify every aspect of the engineering "at the factory".

Whose experts? Getting back to the start of this thread, if we can't find "even a single impartial ballot counter", where do impartial experts come from???

There are tens of millions of voters in this country. The task of counting all the ballots in a reasonable timeframe is unfathomable to the majority of people.

There are tens of millions of voters nationwide, but not in any one county. So long as we keep the Electoral College, we don't have any national races, it's all state level at most. If Canada can manage hand-counted paper ballots, so could we - Ontario has twelve million people, California is only three times that.

(And I'm not saying we couldn't use touch screen machines to print the marked ballots and give a preliminary count, though that preliminary count shouldn't be reported or considered official - it's just a check.)

Other nations manage quite well with paper ballots largely because they understand that "a reasonable timeframe" doesn't mean that you have to have instant results. (It was the "instant" results that got people mistakenly believing that Bush won the popular vote in Florida in 2000, after all.)

Check your ballot count twice, check it against a preliminary count from the machines, ask every single election official if they witnessed any oddities, resolve and discrepancies, check the count one more time, then release the results.

Lastly, it will be no difficult for the average person to understand and trust electronic voting than it was for them to understand and trust mechanical voting

I don't think so. The average person is hit weekly with news of insecurity in computer systems; it's then natural to wonder about insecurity in the computer systems used for voting. How many stories about insecurity of mechanical tallying systems (adding machines, old school cash registers) did one hear back in their heyday? You could only hack lever machines one at a time, whereas one software backdoor could effect all electronic machines by a manufacturer. And mechanical hacking skills were never widespread, whereas everyone who reads the papers knows that there are just hoards of computer hackers out there.

Re:Check, Meet Balance

[ivan256]

This argument is going in circles. As I said earlier, you can find impartial experts to review impartial software. There is no such thing, however, as an impartial ballot, since somebody has already used it to vote one way or the other. Regardless, you could have checks from all the interested parties to at least get consensus. Hypothetical situation: you have two candidates, and representatives for one side raise objections on a ballot that the other side thinks should count as a vote for them... That's way harder to resolve than the similar dispute over a voting machine. You can reject any machine both sides don't approve of before the voting has started, and design the machine to produce clearly discrete results, but you can't reject the ballot without disenfranchising the voter. Mine is a much easier problem to solve.

Regarding your counting of ballots, keep in mind that recounts rarely return the same numbers. Multiple recounts typically return an array of unique values. That is a fundamental flaw in distributed human counting. If you have a solution to it that is actually workable, yours will be the first.

The average person doesn't even consider the typical embedded system to be a "computer", much less actually read those stories about holes, so that seems like a non-issue to me. They trust ATMs and Credit Card processing machines, and that's despite the fact that most people have clearly demonstrated the find their credit card more valuable than their vote. The majority consensus already seems to be that electronic voting is more secure even with these current, broken machines. They keep voting for their localities to buy them after all...

As for a "back-door that effects all electronic machines by a manufacturer" I have two things to say. First, that is still exactly equivalent to a mechanical voting machine. Second, something like that should be caught in the independent review of the code (which should be in ROM on the machines. Unchangeable. Ever. Period. It shouldn't even be copied to RAM to execute. It should run in place).

You are taking the traditional luddite position, because you seem to be incapable of understanding how electronic voting could work securely. Yet you're willing to fool yourself that manual vote tallying doesn't have equivalent or worse problems. Why is that?

You cite the Florida 2000 election in an interesting way as well, even though it seems to back my position. Florida used paper ballots. You say people "mistakenly" believe that Bush won the popular vote, yet no full count was ever done that put Gore ahead in the popular vote, so how can you say "mistakenly"? (Yes, this takes into account the Florida Ballot Project review which only counted rejected ballots, even though there were discrepancies in the recounts of the accepted ballots. It is estimated that thousands of people voted for the wrong candidate, even though they had the paper ballot in front of them to review. The ballot is static, whereas an interactive system could have validated the voter's choice... "Are you sure you want to vote for Candidate Joe?"... The whole situation exhibits exactly the types of problems with paper voting that we would want to move to secure electronic voting to avoid in the future.

I state my position again: The problem with the machines isn't that they're electronic or computerized. The problem with the machines is that they aren't open to examination by experts and interested parties before being certified; and that said experts and interested parties can't block the certification when they find problems.

Re:Check, Meet Balance

[Mr. Slippery]

As I said earlier, you can find impartial experts to review impartial software. There is no such thing, however, as an impartial ballot, since somebody has already used it to vote one way or the other.

"Impartial software?" "Impartial ballot?" That doesn't make sense. The issue is the partiality of people, not of inanimate objects.

If impartial people (or teams of people with balanced biases) can be found to review software, then impartial people (or teams of people) can be found to review ballots.

you have two candidates, and representatives for one side raise objections on a ballot that the other side thinks should count as a vote for them... That's way harder to resolve than the similar dispute over a voting machine.

You need three reviewers for contested ballots. One from Party A, one from Party B, one from a pool of people approved by both parties (unaffiliated voters, or community leaders of unimpeccable honesty).

Regardless, you could have checks from all the interested parties to at least get consensus [on voting machines]

You can also get consensus on methods and rules for counting paper ballots ahead of time.

Multiple recounts typically return an array of unique values.

Only if there's ambiguity in the ballot marking, or errors in counting. The latter can be eliminated by multiple rounds and by improved methodology - if Las Vegas casinos can count all that cash, we can find ways to count unambiguous ballots. The former problem should be very very rare in machine-printed voter receipts, or indeed in any sensible ballot design.

They trust ATMs and Credit Card processing machines...

Which give paper receipts, and whose results I can review and challenge. I've had erroneous or fraudulent charges against ATM cards and credit cards, but I could catch them because the bank sends me statements. I don't get a paper from Baltimore County saying "Here's how we recorded your vote. Call 1-800-SCREWUP if you wish to contest it."

a "back-door that effects all electronic machines by a manufacturer"...is still exactly equivalent to a mechanical voting machine.

Not at all. A mechanical voting machine can't do logic like "if (candidate.party == 'GREEN') then (candidate.votes += 100)". (Not unless your mechanical voting machine was designed by Charles Babbage...)

something like that should be caught in the independent review of the code

Bugs get through reviewed code. Deliberately obfuscated backdoors could too. Then there's the problem of trusting trust. If Ken Thompson says "You can't trust code that you did not totally create yourself...No amount of source-level verification or scrutiny will protect you from using untrusted code," maybe we ought to listen to him, instead of call him a Luddite.

Writing trusted systems is much harder than you seem to understand it to be.

You are taking the traditional luddite position, because you seem to be incapable of understanding how electronic voting could work securely.

My position is pretty much that of the ACM: "voting systems should enable each voter to inspect a physical (e.g., paper) record to verify that his or her vote has been accurately cast, and to serve as an independent check on the result produced and stored by the system." It's also pretty much the position of computer security experts like Avi Rubin and

Re:Check, Meet Balance

[ivan256]

I think we're going to have to agree to disagree on this. But what the hell, I'll give it one more try:

"Impartial software?" "Impartial ballot?" That doesn't make sense. The issue is the partiality of people, not of inanimate objects. As long as one or both are impartial the result is the same. You can have biased people judging a neutral thing, or you can have neutral people judging a differentiated thing, or you can have neutral people judging neutral things. In any of those cases you should get an output that in unaffected by human bias. You solution of one from each interested party and one from a pool just doesn't work, because you won't be guaranteed a unanimous decision.

Not at all. A mechanical voting machine can't do logic like "if (candidate.party == 'GREEN') then (candidate.votes += 100)". (Not unless your mechanical voting machine was designed by Charles Babbage...) OK, so you don't know what a backdoor is. Fair enough. What I was talking about was a real *backdoor* a secret way to modify the tally through the normal interface. Both unreviewed mechanical devices, and unreviewed electronic devices are susceptible to this. Reviewed electronic machines are not. Reviewed electronic machines are also not susceptible to the problem you described.

My position is pretty much that of the ACM: "voting systems should enable each voter to inspect a physical (e.g., paper) record to verify that his or her vote has been accurately cast, and to serve as an independent check on the result produced and stored by the system." It's also pretty much the position of computer security experts like Avi Rubin and Bruce Schneier.

On the other hand, I'm not aware of any independent authority or expert who thinks that paperless DREs, even peer-reviewed open-sourced ones, should be trusted.

Of course an argument from authority doesn't make right; but to dismiss the view of experts, backed up by a majority of the membership of the premiere professional associate for software, as "the traditional luddite position" is ludicrous. Nowhere in my comments will you find me saying that an electronic voting machine shouldn't produce a paper verification, or that said verification shouldn't be used as a backup. Nowhere in any of the articles that you linked will you find somebody advocating that said paper ballots be tallied by hand to obtain the certified result. You are advocating hand counted paper ballots. This is what I'm arguing against with you. The position you have presented so far is not in line with the ACM proposal that you linked. I believe, however, that mine is.

Re:Check, Meet Balance

[Mr. Slippery]

You solution of one from each interested party and one from a pool just doesn't work, because you won't be guaranteed a unanimous decision.

If you need a unanimous decision, then nothing can be trusted. Do you think code design, development, and review proceeds in a unanimous manner? If so, then perhaps you've never worked on a software project of significant size?

Split decisions on counting would only affect a small fraction of ballots. On the other hand, split decisions regarding the design and implementation of voting machines would affect every ballot cast by such machines.

OK, so you don't know what a backdoor is...Reviewed electronic machines are not. Reviewed electronic machines are also not susceptible to the problem you described.

No sir, I'm afraid that if you believe that code review is 100% proof against backdoors, then you don't know what a backdoor is. Did you read Thompson's paper? You oughta, it's a classic.

Reviews are good but are hardly the last word in security. I've worked on trusted system development, a project targeted at the B3 TCSEC level. (This was before the adoption of the Common Criteria.) I've had my code and design reviewed by security experts, as well as in less formal situations. I'm a fan of reviews, but they are not 100% proof against problems, both deliberate compromises and more mundane bugs. (They'll get you up to about EAL 4. There are seven EALs, the highest an operating system has gotten to date is EAL 5. More secure systems need formal proofs, which have not had much success to date.)

Nowhere in my comments will you find me saying that an electronic voting machine shouldn't produce a paper verification.

Nor have you suggested such verification, despite ample opportunity to do so.

Nowhere in any of the articles that you linked will you find somebody advocating that said paper ballots be tallied by hand to obtain the certified result.

It's implicit in the notion of a paper audit trail. What do you expect to do with the paper records - put them in bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying "Beware of the Leopard"? No. You've got to count them.

If you're arguing against hand counted paper ballots, you're arguing against paper verification - you have to count the paper verification, or else it's not a verification!

You are advocating hand counted paper ballots. This is what I'm arguing against with you.

If we're going to count the paper ballots, then it would be better to have paper without machines than machines without paper. Though I repeat, "I'm not saying we couldn't use touch screen machines to print the marked ballots and give a preliminary count", and I also said "The former problem [ambiguity in the ballot marking] should be very very rare in machine-printed voter receipts". It should be clear that I would prefer paper printed by machine. So, yes, electronic machines with a paper trail fit neatly into my position.

But paper receipts do not fit into your argument against hand counting. If you're in favor of them, your position is inconsistent and I suggest you consider it further.

Re:Check, Meet Balance

[ivan256]

Are you just trolling?

If you're arguing against hand counted paper ballots, you're arguing against paper verification - you have to count the paper verification, or else it's not a verification! The verification would be used to show the voter that they selected the option they thought they did on the machine. They could also be counted if it was thought there was a problem with the election. Otherwise there's no point to having the machines at all.

Nor have you suggested such verification, despite ample opportunity to do so. That's just rediculous.

No sir, I'm afraid that if you believe that code review is 100% proof against backdoors [...] I said "reviewed machine", not "reviewed code". I have far too much experience with software development to think you could catch everything with a code review. Yes, a code review should be done, but tests should be run too. Mock elections to verify tallies, configurations, etc.

If you need a unanimous decision, then nothing can be trusted. Do you think code design, development, and review proceeds in a unanimous manner? If so, then perhaps you've never worked on a software project of significant size?

Split decisions on counting would only affect a small fraction of ballots. On the other hand, split decisions regarding the design and implementation of voting machines would affect every ballot cast by such machines. Again, just ridiculous. I've worked on many software projects with a wide range of importance. Sometimes it is important to get a unanimous decision, and sometimes it isn't. If you don't think it's possible, you're just wrong. Inarguably.

If you don't think a small fraction of ballots matters, you should go re-read your own posts about the Florida 2000 election.

I for one...

[Jumphard]

...don't think that Sequoias should be voting in the first place.

Re:I for one...

[sjames]

...don't think that Sequoias should be voting in the first place.

I'm not so sure. Perhaps they would have known enough to tell Bush to try again when he grows up. I'm pretty sure they would have given Ficus a landslide victory.

Re:I for one...

[whitehatlurker]

Why not? Many of them are old enough, and they're likely smarter than the average voter ...

... foliage suffrage now.

Re:I for one...

[SEWilco]

I'm sure they prefer this technology to dead tree technologies.

Let's call a spade a spade:

[jockeys]

and see that the only reason Sequoia is pissed off is that they either
a. are afraid that there are gaping security holes in their machines
b. KNOW that there are gaping security holes in their machines

all the privacy zealots will no doubt say that my "if you have nothing to hide you have nothing to be afraid of" mentality is misguided, but let's take a step back and see what is on the line here. this is NOT about personal data, this is about objectively evaluating the security of a device that is going to be used in a VERY public fashion. do lamp makers threaten Underwriters Laboratories for wanting to make sure their device works as intended?

Re:Let's call a spade a spade:

[orclevegam]

I for one say we need to amend the patent and copyright acts to make devices used to voting unpatentable, and exempt from copyright, or barring that, that the certification process requires all rights to be signed over to the government. These machines by their very nature should be open to the most detailed scrutiny imaginable by anyone who feels so inclined. If the companies want to make money on them sell maintenance and manufacturing contracts, but there should be no way to claim trade secrets on anything used for voting.

Re:Let's call a spade a spade:

[zrq]

Yep. I agree.

If Sequoia have nothing to hide ... what are they afraid of ?

Re:Let's call a spade a spade:

[Migraineman]

Lamp manufacturers pay UL for the privelege of being certified. UL doesn't randomly grab equipment and force a cert upon it. The voting machine manufacturers should be more than interested in having third-party audits of their equipment ... unless they are either crap or corrupt. I suspect the former, but the latter isn't too far behind.

Regardless, I don't see how the manufacturer could impose restrictions on the equipment if it has been sold. Leased? Yeah, that'd come with a use restriction because title never was transferred.

Re:Let's call a spade a spade:

[NeutronCowboy]

Someone mod this guy up. I find it unconscionable that it is possible to patent or copyright something that is absolutely critical to the fundamental processes of democracy. Sequoia might as well demand that they be made Emperors of America.

Re:Let's call a spade a spade:

[bmw]

I for one say we need to amend the patent and copyright acts to make devices used to voting unpatentable, and exempt from copyright, or barring that, that the certification process requires all rights to be signed over to the government. These machines by their very nature should be open to the most detailed scrutiny imaginable by anyone who feels so inclined. If the companies want to make money on them sell maintenance and manufacturing contracts, but there should be no way to claim trade secrets on anything used for voting.
 
/signed

I wish I could use my last mod point to bump this past +5 :)

Re:Let's call a spade a spade:

[RobBebop]

I find it unconscionable that it is possible to patent or copyright something that is absolutely critical to the fundamental processes of democracy.

Also unconscionable is the notion that the underlaying software algorithm would essencially boil down to a very simple statement that looks something like the following:

vote++;

You could argue that there is some finesse involved in getting that data from the machine it was cast at to the central tallying point where it is counted and tabulated, but NOTHING in that process is any more complicated than the Automated Teller Machines which function in a similar way to take data from client nodes and send it up to the hub... so "prior art" in the realm of basic concepts of networking makes those patents unattainable.

Re:Let's call a spade a spade:

[NeutronCowboy]

Also unconscionable is the notion that the underlaying software algorithm would essencially boil down to a very simple statement that looks something like the following:

vote++;

Agreed. Though I admit that after Lessig gave up his fight for copyright reform and instead went after the more fundamental problem of corruption, I gave up hope for seeing this addressed in my life time.

Re:Let's call a spade a spade:

[RobBebop]

Well, Lessig's current crusade is trying to fix a different algorithm:

corruptCampaignContribs == TRUE ? vote += 2 : vote++;

In theory, if uncorrupted legislatures were in Congress, they could actually make rules that are based on what is best for the population and NOT based on how much Industry XYZ's lobbyist gave to their re-election fund.

Re:Let's call a spade a spade:

[davidsyes]

There's "Vista Ready" and "Vista Capable". Why is there not a "UL-Equivalent"? Because it keeps the barrier to entry high against not only fraudulent manufacturers but also legit manufacturers who have to pay a very very high price to get a UL Cert. Restaurant machinery can be very expensive because of that "coveted" UL designation. City healthy or inspection departments can pretty much compel (and almost all do compel) restaurant operators to use ONLY UL-marked equipment. Many won't even TELL entrepreneurs what equipment IS permitted and not for given scenarios, and that leads some inexperienced operators to waste money on equipment and on inspection fees.

i once asked a city inspection department why they don't post the approvals and fails of given equipment for given restaurant scenarios and they wouldn't give a clear answer. It was almost as if they WANT entrepreneurs to exactly spend time and waste money on inspections, equipment, and procedures.

If a European coffee grinder or espresso machine manufacturer of great repute simply has no UL certs, but thousands of their products sell with no history (known or covered up) of involvement in electrocution, fire, or injury, then why cannot the less expensive products be used in the work place? It can mean the difference between moms and pops saving or wasting TENS of thousands of dollars. Seems like a kickback/racket, to me.

Re:Let's call a spade a spade:

[Bishop Ebonhand]

Is this possibly an area where Emminent Domain might be used?

Re:Let's call a spade a spade:

[Anonymous Coward]

Noone's patented pen and paper yet I dont think...

Re:Let's call a spade a spade:

[jonaskoelker]

corruptCampaignContribs == TRUE ? vote += 2 : vote++;

Let's do a quick code review here.

• You're using TRUE, despite the fact that c++ and c99 both define "true".
  
• You're comparing a boolean-valued variable to TRUE, instead of doing the inverse comparison (!=) with false (or zero). Or just testing the boolean.
  
• You're using an assignment as a subexpression, which is potentialy confusing.
  
• You're post-incrementing vote, potentially introducing a new temporary object (if this is C++). Always preincrement.
  
• the name corruptCampaignContribs is highly misleading; this is true if the vote counters, not the campaign contributors, are corrupt (and have been bought).
  

So there, even that simple algorithm is easy to get wrong. The right way to write it is of course:

vote += 2;

Re:Let's call a spade a spade:

[PMW]

"I find it unconscionable that it is possible to patent or copyright something that is absolutely critical to the fundamental processes of democracy."

Paper ballots, secret ballots, & counting aren't patented so we already have what is critical to democracy.

The problems that New Jersey is having with Sequoia don't seem to be related to patent law. Anything patented in the U.S. is automatically made public knowledge and the basic implementation details are part of the patent itself. The problem here involves Non-Disclosure Agreements, Trade Secrets, and general bad contract writing on New Jersey's part. That is what is making it hard for them to verify the voting machines.

This incident confirms that one of the biggest problems the states are having is a general lack of competence on how to properly purchase this kind of equipment. The business people at Sequoia/Diebold/etc are screwing the states to the wall on these ridiculous contracts.

Princeton?

[networkconsultant]

Don't they have a really good law school?

Re:Princeton?

[Anonymous Coward]

Don't they have a really good law school? Princeton? Oh, yeah. Absolutely. One of the best in the country, and they produce my personal favorite kind of lawyer. In fact, the law school there is so good, no one who got a law degree there has ever lost a case. EVER !

Yes but...

[Bryansix]

Sequoia seems to be claiming that no one can make a "report" regarding their "software" without their permission

Yes, but nothing is stopping Sequoia from being hung in the court of public opinion.

Re:Yes but...

[garcia]

Yes, but nothing is stopping Sequoia from being hung in the court of public opinion.

Sure there is, apathy.

Re:Yes but...

[orclevegam]

Yes, but nothing is stopping Sequoia from being hung in the court of public opinion. And I hereby find the defendant guilty. Lets go hang them off the same tree we dumped Diebold on. Failure to present for inspection is an automatic failure on voter confidence, and a major red flag for corruption.

Please sue! Please sue!

[Reality Master 201]

Please, please, Sequoia - suing over this is exactly the right course of action for you.

I also suggest that you try to get a judge to order ISPs to remove the DNS records for Princeton and the state of New Jersey, while you're at it.

Ok, I RTFA, but still...

[The Ancients]

...have I got this straight?

Their voting machines are paid for by public dollars, used by the majority of the members of the public, to elect public officials, and they claim evaluation of their software cannot occur without their "permission"?

(Even my 9 year old nephew read this and thought it was "dumb")

Re:Ok, I RTFA, but still...

[bhima]

Your 9 Year Old Nephew is Correct.

Re:Ok, I RTFA, but still...

[jd]

The DMCA cripples reverse-engineering and software analysis. There was another "unified copyright" bill around the same time that forbid the review, or publication of any review, of software without the permission of the company selling it. Never heard if that made it into law. If it did, then yes, Felton's review would be illegal. If it didn't, but the review process would necessarily violate the DMCA, then it is also illegal.

Is this stupid? Yes. Is this hostile to the interests of Americans? Yes. Was it voted for by a Congressman you have re-elected since? That I don't know, obviously, but it's something you may want to check on before this election. If you're not planning onvoting for whoever is currently elected, you might also want to find out the views of the opponents, particularly if the region is tech-savvy enough (or even tech-phobic enough) to be suspicious of voting machines. The candidate you're looking at might enjoy playing around with Sequoia's attitude problem as a (minor, to them) campaign issue.

Re:Ok, I RTFA, but still...

[Sir.Cracked]

The DMCA was passed in the House by voice vote, and the Senate by Unanimous Concent.

See the "Major Actions" section of this address
http://thomas.loc.gov/cgi-bin/bdquery/z?d105:HR02281:@@@L&summ2=m&

So, if your congresscritter was in office in 1998, you really have to assume he/she voted for it. I suppose you could troll the attendence logs for the day in question and see if they were absent, but I don't know how much that washes their hands. And potentialy, House reps may have voice voted against it, but it's unlikley.

So, Pretty much any Senator/Rep who's been in office for more than 10 years is responsible.

Re:Ok, I RTFA, but still...

[sconeu]

You're thinking of UCITA, which would have allowed the more execrable terms of EULAs to be enforced.

Currently UCITA has been enacted only in VA and MD.

Re:Ok, I RTFA, but still...

[CastrTroy]

Or maybe they let somebody else vote for them.

Re:Ok, I RTFA, but still...

[Ungrounded Lightning]

...have I got this straight?

Their voting machines are paid for by public dollars, used by the majority of the members of the public, to elect public officials, and they claim evaluation of their software cannot occur without their "permission"?

Their voting machines are SOLD (or maybe leased) to the government agencies that operate elections and have a contract specifying terms of use. They're claiming the contract forbids the sort of investigation that is proposed.

Now perhaps there are indeed such terms in the contract. In which case the New Jersey secretary of state (or a past one) made an unwise decision. Nevertheless, the state has a duty to insure that the system is not defective. Inspecting its operation, including that of the software if there is any question about its functionality (or even if there isn't, just to check), is obviously a part of that duty, and being inspected is obviously part of what it is to be a voting machine. So such contract terms, if present and interpreted as Sequoia claims, are clearly unconscionable. On that basis the state should be free to ignore the clause.

Alternatively, if the clause were to stand the resulting terms of use would make the machines "unsuitable for the intended use", violating the implied warranty of fitness. So the state could return them for a full refund. B-)

It would be interesting to see what would happen if Sequoia actually sued. If the contract specified interpretation under the laws of New Jersey (or didn't specify jurisdiction) the state might just refuse to be sued. B-) If it specifies another state (or they sue in their own) it would still be a funny show.

As for suing the professor, either he's acting as an agent of the state (in which case they're suing the state) or he's not (in which case he has no contract with them to enforce.) In the latter they'd have to go after him for something like DMCA violations or some part of contract law I'm unaware of.

Of course IANAL - and especially not a contract lawyer. So take the above with a suitable quantity of salt. B-)

Re:Ok, I RTFA, but still...

[Ungrounded Lightning]

Also: If there is a suspicion or legitimate accusation of vote fraud (or other violation of the state's election laws) committed with the aid of some aspect of the operation of the machine or its software, the state could perform the same inspections as part of a case investigating and prosecuting the fraud. That would let them do it under their own criminal law and procedures - even demanding the source code to examine (under court seal). B-)

Re:Ok, I RTFA, but still...

[jd]

So, at least in those two States, we can be certain that even the State government ordering a test of voting machines is likely to be declared illegal under the laws as they stand. If I ever move to either, I'm most certainly not voting on unaudited computers. Hell, I'd prefer an honest dictatorship over what would essentially be a dishonest de-facto dictatorship. That's probably why the British who've stayed in Britain are fine with the draconian system there. However perverse it gets, it's honest and open about it. Honest, sincere depravity.

History lesson

[i.r.id10t]

Mebbe they need a history lesson...

Anyone care to guess when the last armed revolt against government was here in the US and the reasons behind it?

Answer - Battle of Athens, Tenn. 1946. And it was over voting issues...

http://en.wikipedia.org/wiki/Battle_of_Athens

Re:History lesson

[notthepainter]

The wiki page is pretty short on details.

See http://www.constitution.org/mil/tn/batathen.htminstead.

Re:History lesson

[falconwolf]

Anyone care to guess when the last armed revolt against government was here in the US and the reasons behind it?

The Weatherman movement, being active in the late '60s and early '70s, is more recent. People know some about the militias that have cropped up however the Weathermen were more violent. Then there was the SLA, Symbionese Liberation Army, which operated between '73 and '75.

Falcon

Re:History lesson

[R2.0]

I think he was referring to EFFECTIVE armed revolt.

Re:History lesson

[ragerover]

Or another, as some folks in New Mexico would point out: http://en.wikipedia.org/wiki/Tierra_Amarilla%2C_New_Mexico

Re:History lesson

[Ungrounded Lightning]

I question the "last". (For instance: Wounded Knee...) But it is the last well known one by the bulk of ordinary citizens, and a great example of your point that voting corruption can lead to armed citizen uprisings.

Only one answer

[dpilot]

There is only one answer to such a statement. Nothing else need be said. No negotiations.

No sale without a purchaser's complete and thorough evaluation.

"Really"?

[truthsearch]

Sequoia seems to be claiming that no one can make a "report" regarding their "software" without their permission.

I "beg" to "differ".

"non compliant analysis"?

[apodyopsis]

"non compliant analysis"? whats the betting that the only compliant analysis gives it an A-OK rating.

thats like car salesperson attempting to sell you a car but only if you agree to take his word that it works and he'll sue anybody that you bring in to check the engine. if ever there was a warning bell not to buy their equipment that was it.

whats next? DMCA action against /. for this thread? absolute cobblers.

Re:"non compliant analysis"?

[memorycardfull]

Agreed! It begs the questions: What would it take to make the analysis more compliant? What constitutes non-compliance? I am sure there are many manufacturers that would like to prohibit negative (non-compliant) reviews of their products. This doesn't seem to work in the real world though for some reason...maybe too many tubes disseminating non-compliant analysis world wide.

What a brilliant business model!

[garnetlion]

That's a great idea, making a product no one is allowed to look too carefully at. I'm going to sell diamond rings and sue anyone who tries to find out or inform others that they're really cubic zirconia.

Reverse engineering

[drakyri]

The only problem I see here is that Sequoia could theoretically sue New Jersey over violating their agreement. Reverse engineering is legal so long as the item that's being analyzed was obtained legally ... so the professor should be fine.

IANAL, but, I think - regardless of the terms of the agreement, the voting machine was legally obtained - if they violated the agreement then that's a civil dispute, not a criminal one.

Re:Reverse engineering

[flaming error]

If anybody thinks this issue is about EULAs, they need to pull their head out of the sand.

This is about the future of democracy. These voting machine vendors are stripping transparency, security, and auditability out of our elections. None of us should give a damn what licensing agreement Sequoia wrote.

Voting versus Gambling

[spazoid12]

It's really sad when the software controlling slot machines at the casino have (quite strict) legislated inspection and auditing than far exceeds what the software controlling voting machines is subjected to. :(

Let's be sure that nobody can steal a dollar; but if they can help a democrat steal an election... so be it.

Re:Voting versus Gambling

[c0y]

Last I looked it seems like the republicans are the ones stealing the elections.

Re:Voting versus Gambling

[Facegarden]

Though i disagree with your theory on democrats "stealing" an election, this is otherwise a really good point. I never realized how much those two parallel eachother, but gambling machines are absolutely the best example you could bring up on an important established system that is regulated to ensure accuracy and all that. Most people care more about their money than they do about their vote (sadly), so brining up that point might help people see why we so badly need regulation on these, as well as demonstrate that it is entirely reasonable and plausible to expect that kind of auditing on such machines.

How could we have gotten so screwed up?
-Taylor

Re:Voting versus Gambling

[dpilot]

> but if they can help a democrat steal an election...

And what's your opinion if it's helping a republican steal an election?

Whatever response you give me, the words "a democrat" did not need to be in your post. Stealing an election is WRONG, whether it's a democrat or a republican. You took a very good post and diminished it with a bit of partisanship. I notice that you said "democrat" where usually the party affiliation is capitalized, so maybe you're scooting by on a technicality. But at that point we're parsing to the degree that we criticize politicians for.

Re:Voting versus Gambling

[blhack]

Let's be sure that nobody can steal a dollar; but if they can help a democrat steal an election... so be it. The sad thing is that very few people care.
I've actually had a friend tell me that he thought it was okay that people vote without knowing anything about any of the candidates because "its not THAT many votes, man"....

Voting seems like such an abstract, far-away thing to most people that it doesn't feel like it matters.

Slot machines, however, offer instant gratification (or loss of money). Its a more DIRECT, this-is-happening-to-me-right-now feeling.

Its a double-edged sword that it has become fashionable to hate the [current] government. While you've got more people out there talking about politics, very VERY few of them actually KNOW what they're talking about. All thats happened is somebody turned up the gain; now we have to deal with way more noise than signal. So while you would hope that this current trend would increase public awareness of this sort of thing, it doesn't.

Re:Voting versus Gambling

[raymansean]

At least in SC where we have electronic voting machines, we are still allowed to vote on any piece of paper. I did not take the time to look the story up but in Horry County during the primary someone voted by writing their vote on a matchbook and putting it in a ballot box. No matter how the vote is cast you have to assume that it is objectively counted by some third party. i guess the problem is that with machines coming from just a handful of companies that it is a lot easier for a few individuals to change the results of the election where with hand counting it takes a much larger group of individuals to change the results.

Re:Voting versus Gambling

[spazoid12]

Dude, this is Slashdot... we're supposed to see if we can flamebait or troll without getting moderated as such.

YES, it's wrong for anyone, regardless of party, to screw with an election ("steal" it, etc). In fact, I feel the same way about trivial "elections" like American Idol. On one hand it was kinda funny, sure, when Howard Stern tried to get his listening audience to keep Sanjaya in the running, but I'd rather it be honest. I'm not a conspiracy theorist, but I think that the show's producers manipulate the results; probably routinely.

As for actual elections that matter- no, I don't believe that the replublicans (small 'r') stole the election; regardless of any websites you might link to. I think that both parties attempt screwing with as much as they think they can get away with. As someone who used to work as a volunteer at my local poll center I can say that I've seen quite a bit and from my own experience I'd say that democrats push the limits more than republicans as a matter or routine. But they are all jerks.

Re:Voting versus Gambling

[Anonymous Coward]

I'd rather no one steal an election, but if it has to be one or the other, the Democrats don't push their religion on me, and invade sovereign nations. They also favor strict gun control, instead of throwing a pistol in the hands of every Tom, Dick and Harry. So if an election must be stolen, I'd much rather a Democrat do the stealing.

Re:Please sue! Please sue!

[jonaskoelker]

Please, please, Sequoia - suing over this is exactly the right course of action for you. Nice. I see you want to invoke the Streisand effect of Sequoia. However, I don't think it will be effective, and here's why: it will give Sequoia negative publicity, but only here on slashdot. Also, even if it did spread to the masses, what do you think the masses would do? Anything? Heck, in the US, only half[1] of the eligible voters actually vote! If they don't care about presidency, why should one believe they would care about which company the state buys voting machines from?

However, I think Felten and Appel could influence some decision-makers by going to them personally and explain why third party review is a good thing and why they shouldn't put the engine of democracy into the hands of someone who prevents the governed people from understanding what is done with it. In particular, I believe that Felten would be well-equipped to do so, as he's got an understanding of both technology and public policy; also, he's a good speaker[2].

[1] http://www.infoplease.com/ipa/A0781453.html
[2] http://www.usenix.org/events/sec06/tech/mp3/felten.mp3

Update and more details on this

[MrAtoz]

It was Union County, NJ that was planning to send sample machines to Dr. Felten. They were threatened by Sequoia and have backed down from their plan as a result. The whole thing happened because several counties in NJ reported errors with the Sequoia machines in the February primary election. Sequoia reviewed these and just said that it was "user error" and not a problem. The counties understandably didn't find this an acceptable response, and Union County wanted to get an outside opinion. All the details can be found in this NJ Star-Ledger story.

Re:Update and more details on this

[hritcu]

Even more details on this: Sequoia Voting Systems site was defaced and subsequently taken down. Sweet :)

In other news...

[Bullfish]

Four mob families in conjunction with a number of street gangs is suing the US Department of Justice for restriction of trade.

Black (Ballot) Box Voting = Genius

[DingerX]

Anyone have a copy of the Licensing Agreement? How much do you want to bet that the Customer agrees not to hold Sequoia liable for any shortcomings in the product's performance, such as failing to tabulate votes correctly, or being vulnerable to manipulation?

handy though

[rucs_hack]

If this gets thrown out, it will really dent future attempts to use methods like this to shield shoddy products.

If you ask me, Sequoia has been given some very bad legal advice. Didn't anyone stop to think about the public relations nightmare this would cause? Not to mention damage to their business.

Re:handy though

[rograndom]

Didn't anyone stop to think about the public relations nightmare this would cause? Not to mention damage to their business.

Yes, and that's why Sequoia's threatening to sue. They obviously don't want the machine inspected.

Re:handy though

[Firehed]

If this gets thrown out? Surely no court could be so stupid to think that a third party's opinions of an available product can be stifled on the grounds of intellectual property laws. I can't think of anything even reasonably close to a valid excuse to allow it to go through. Perhaps they expect that it will come across as libelous (meaning a completely valid and accurate assessment that portrays them in a negative light - which just means that your company/product sucks), but the review would have to be out there first. I don't think a gag order can be issued in this kind of situation, and an NDA violation (assuming they ever held up in court, which is very rarely the case) hardly applies here.

I don't think a PR nightmare really applies. This kind of stuff rarely if ever hits mainstream media, and us geeks of Slashdot aren't really the type to buy into proprietary tools in general, let alone ones used for voting.

Re:handy though

[MightyMartian]

There is an alternative to all of this. New Jersey can simple remove Sequoia from the list of companies they're considering for voting machines. I mean, if they don't have it already, they can simply pass law stating that all those submitting bids for supplying the state with voting machines must make a machine available for independent review by an organization or institution of the state's choice. If Sequoia doesn't like those terms, they don't have to bid.

It's true, however, that IP claims are getting out of hand when a government and/or institution doing some work for the government is threatened with a lawsuit over testing hardware. These events are only going to get more egregious and ludicrous until Washington and the courts start handing these abusers their proverbial balls on a platter.

Re:handy though

[Darinbob]

If this gets thrown out? Surely no court could be so stupid to think that a third party's opinions of an available product can be stifled on the grounds of intellectual property laws. I can't think of anything even reasonably close to a valid excuse to allow it to go through. That's where "intellectual property" becomes such a vague and dubious notion. Consider if this were a medical device. If health risks were involved, could a company forbid the FDA from investigating the device because someone signed a licensing agreement? Or if the FDA has no interest, what about restriction a state board of health from investigating the device?

In the past, less than one hundred years ago, it was extremely difficult to investigate dangerous products or workplaces. The government just didn't feel it was important enough to get involved in. There had to be major media effort to bring these problems to the public eye before there was enough pressure on the government to put pressure on companies. Such as hair products that could cause blindness and disfigurement, sometimes death (the reason that we have animal testing for cosmetics today). Companies didn't care if customer's were hurt, as long as they got their money first; but bad publicity made them at least pretend to care.

Or the use of radium on watch dials; a company where the chemists would use lead shields to deal with radium would suggest to the factory workers that they could lick the brushes used to pain the dials. That took a media campaign to publicize slow painful deaths of young women before the public demanded change. It's interesting here that US Radium threatened to sue to prevent publication of a damning report, since the author had signed a confidentiality agreement (deja vu).

But in this case, the danger is to elections, not someone's health. The question is whether this rises to the same level of concern. In the health cases, people had to die or become disfigured before the government and the public took any action. Do we have to wait for a stolen or hacked election before the people decide that the public's interests in this matter overrides intellection property? ("intellectual", hah, there's nothing so special about the technology here; shoddy hardware, shoddy software, slick marketting)

I don't think a PR nightmare really applies. This kind of stuff rarely if ever hits mainstream media, and us geeks of Slashdot aren't really the type to buy into proprietary tools in general, let alone ones used for voting. But this needs to hid the mainstream media. Otherwise companies just go on with business as usual. Governments will never take any action unless they detect some sort of public outcry, especially in the modern climate where pro-active governments are frowned upon.

Re:handy though

[kesuki]

Ironically, the US radium paint was toxic for 2 reasons. 1. radium 2. phosphorus most of the women died from the phosphorus poisoning that degraded away their bones, not from the radium poisoning. and you know what?
in france, where radium was discovered, they used 'cotton swabs' to apply the paint rather than horsehair brushes. cotton swabs had no need to be licked (the horsehair brushes had to be licked ever 2-3 strokes)

analysis of public voting machines will turn up ugly bugs like being able to report 100% of the district voting for one candidate, while 67% voted for the other. there are so many things that can go wrong with voting machine software, not to mention a lot of the machines are shipped by companies with strong political ties, who some argue 'rig' the firmwares results for specific elections. the latter is why I'd bet they don't want random voting machine testing. people finding 'bugs' for you will just cost a little programming work to debug it, the only reason i can see for them to sue, is if they really are rigging the elections for a price.

Re:handy though

[Darinbob]

Ironically, the US radium paint was toxic for 2 reasons. 1. radium 2. phosphorus most of the women died from the phosphorus poisoning that degraded away their bones, not from the radium poisoning. Yes and no. US Radium had claimed the women had phosphorus jaw; which wouldn't actually have absolved them of blame, but at least it wouldn't have destroyed the entire radium business. Initial diagnoses were of phosphorus jaw, but there were additional bone lesions, bone tumors, anemia, and infection that prompted a separate diagnosis.

there are so many things that can go wrong with voting machine software, not to mention a lot of the machines are shipped by companies with strong political ties, who some argue 'rig' the firmwares results for specific elections. the latter is why I'd bet they don't want random voting machine testing. No, I think it's just typical "cover your ass" thinking. They know someone will find some "flaw" and they don't want to lose a valuable contract, and future contracts, because of "anti-voting machine activists" gumming up the works. Like most manufacturers they're willing to work with a few flaws and lose a few customers now and then. They want to create and sell a consumer grade device, something with inexpensive consumer grade quality where "good enough" is the standard.

Re:handy though

[pheonix321]

Of course they had bad advice, the RIGHT thing to do would have been to declare the professor unpatriotic (never mind the irony of this situation) and thus a terrorist. Then, he would lose the right to defend himself. A proven strategy these days in the US!

Re:handy though

[tuxgeek]

Yes, and that's why Sequoia's threatening to sue. They obviously don't want the machine inspected.

Maybe Sequoia should take their voting machines and shove them up their ass.
The last 2 elections have shown the value of electronic voting machines.
What ever happened to the good 'ol reliable paper ballot with the bubble you color in next to the person you want to cast your vote for.
Simplicity at it finest.

Re:handy though

[Hotawa Hawk-eye]

That's where "intellectual property" becomes such a vague and dubious notion. Consider if this were a medical device. If health risks were involved, could a company forbid the FDA from investigating the device because someone signed a licensing agreement? Or if the FDA has no interest, what about restriction a state board of health from investigating the device?

IANAL, but I believe that if a company were to try to forbid the FDA from investigating their device, the FDA would have a few courses of action they could follow.

Re:handy though

[buravirgil]

Sequoia is frightened that the contracts they've secured for the next few years will become worthless if what happened to Diebold happens to them.

They're unconcerned with public relations because their contracts were secured with congressional reps and senators.

The only damage that can be done is if some geeks discover what's been discovered in Diebold machines, making the contracts worthless and making some VC's very, very unhappy.

Sequoia doesn't know which end of the Ace is up and that's why they're sending out ambiguous, legal threats to a university AND any state with which they have a contract-- arrogant rich men playing by old school rules in an industry they don't understand

Re:handy though

[Pictish Prince]

You obviously don't understand the way New Jersey organized crime operates.

Re:handy though

[fpgaprogrammer]

companies that make voting machines don't deserve to be in business.

i'd like to see someone prove that there is ROI in purchasing a souped up 74LS163 for huge amounts of money when I'm pretty sure you can get protein machines to volunteer to count paper ballots redundantly in a way that is transparent, fair and verifiable by mere mortals.

voting machines are expressions of Skynet trying to put a computer where it doesn't need to be, just to take humans out of the loop.

Re:handy though

[profplump]

Yes, they can. States are free to run their elections by any means they see fit -- some states voluntarily choose to follow guidelines set by federal bodies, but they are under no obligation to do so. For one thing, most elections are not federal in nature, and therefore the federal government has no legitimate interest in how they are run. That includes the presidential election, as there is no requirement for a popular vote. Even for Representatives and Senators, for which the federal government does have some control over elections, there still aren't rules about which particular voting machines you can use, nor any requirement that a machine be used at all.

Trivial Workaround

[sunderland56]

The State of New Jersey just needs to hire Professors Felten and Appel as consultants. Nothing in the so-called "established Sequoia licensing Agreement for use of the voting system" can prevent a State employee from accessing a State machine.

Re:Trivial Workaround

[Ioldanach]

Honestly that's actually a rather brilliant solution. Perhaps you should contact the county and mention it.

ok,

[superwiz]

Just in case you did bother to read the article, here's the contact information for NJ's legislative branch. If you happen to think that the state should welcome transprency and cease dealing with vendors that seek to suppress it, you may want to mention it to your representative. http://www.njleg.state.nj.us/legislativepub/contact.asp

Intimidation?

[Icarium]

It seems telling that the letter was sent to the third party and not to the state - do they really expect the third party to care about the licencing agreement to which they are not bound?

Add in the vague wording and this looks purely like an attempt to intimidate the 'softer' of thier two targets, since they realise they probably can't take any meaningfull action against the state.

threat of suit

[belmolis]

IANAL but I am reasonably confident that Sequoia cannot successfully sue Felten. They may be able to sue New Jersey for breach of contract if in fact they have a contract with New Jersey that forbids such reviews. That may be the case - I believe that the license for MS Windows Server forbids reviews not approved by Microsoft. If there is such a contract, it would be interesting to see if it holds up in court. The "no review" provision is arguably void as being contrary to public policy.

Felten, however, has no contractual relationship with Sequoia and therefore cannot be in breach of contract. Sequoia therefore cannot sue him unless they can come up with another cause of action. Maybe, just maybe, they could sue him for disclosing trade secrets, if New Jersey has really nasty trade secret laws.

Re:threat of suit

[Mox-Dragon]

It seems like the significant thing here is that Sequoia can threaten to sue and not get laughed out of town. That the case has no merit should be patently obvious to any observer, legally competent or not. The real issue is, how did things get so fucked up that companies feel entitled to operating in such secrecy?

Re:threat of suit

[ScrewMaster]

The real issue is, how did things get so fucked up that companies feel entitled to operating in such secrecy?

Yes indeed, and this behavior on the part of private corporations is hardly limited to the voting industry. It's happening all over the place. The Taser is another excellent example: medical examiners being threatened and sued by the manufacturer of that device if they put "death by Tasing" in their official reports. Doesn't matter one bit if the person who was killed did die from a tasing. The company doesn't want the publicity and will send their lawyers after anyone that makes a complaint, legitimate or otherwise.

Now, this is serious shit, because it is giving corporations the power to intimidate and influence public servants who are simply doing their jobs, jobs that We the People pay them to do. That's just WRONG and needs to be addressed at some point. Really, what we're seeing here is what happens when a society becomes fundamentally amoral: America operated on what was essentially an honor system for centuries. People didn't do this kind of thing because, well ... good people just didn't do this kind of thing. Even corporate leaders had some respect for the system.

Now that we've become very much a cutthroat capitalist society, nothing matters so long as you have your way, no matter who is hurt in the process. That's not the America I grew up in, let me tell you.

Re:threat of suit

[Mox-Dragon]

I think we're in agreement as to where we've gotten, but I don't know if I accept your analysis of how we got here:

Really, what we're seeing here is what happens when a society becomes fundamentally amoral: America operated on what was essentially an honor system for centuries. People didn't do this kind of thing because, well ... good people just didn't do this kind of thing. Even corporate leaders had some respect for the system.

I don't know that large corporations ever had respect for anything other than profit. Truck systems are a good example of ways that corporations used to screw people over that are (thankfully) dead and gone now, at least where I happen to be. Maybe this style of rampant lawyer-use is just more of the same for the 21st century; maybe it's some sort of implicit recognition of information being the new currency and trying to control that. What I don't think is that corporations used to be warmer and fuzzier than they are today - and this may be pure opinion - but it seems like capitalism has been and always will be inherently cutthroat. It's just manifesting itself differently now.

Re:threat of suit

[ScrewMaster]

Oh, sure ... some corporations have always been cutthroat, and it has largely been government's role to counterbalance that to one degree or another, to correct the really egregious excesses. Overall though, the United States' business community generally was not cutthroat to the degree that we're seeing now. Corporations have always done bad things in the name of profit, but we're seeing a new set of extremes nowadays. Hell, if you want to see what unbridled corporate nastiness looks like, China is a much better example than the U.S. at its worst. I really don't think we want to go there, but we are.

In any event, I am noticing that there are things that simply were not done in the past that are now commonplace, such as threatening public servants with impunity. I'm generally against the government (any government) here in the U.S. coming up with more law, but it does seem like corporations like Sequoia and the Taser outfit need to get slapped back. Maybe the Justice Department or the FBI could lay off the media-driven "piracy" bandwagon for a couple years, and put some of these corporate assholes in their place.

Re:Please sue! Please sue!

[Miseph]

"I think Felten and Appel could influence some decision-makers by going to them personally and explain why third party review is a good thing and why they shouldn't put the engine of democracy into the hands of someone who prevents the governed people from understanding what is done with it."

Nice. I see you want to invoke the obvious solution effect of common decency. However, I don't think it will be effective, and here's why: the decision makers are the ones who directly benefit from Sequoia being a bunch of corrupt hacks. It would be a wonderful thing if our political system were to actually operate in an open, fair manner, devoid of cronyism or corruption, but we've been complacent for so long that they've actually managed to enshrine such bad behaviors into law.

Open Source Secure Voting Application

[hattig]

Well it has been several years of voting machine shenanigans, with each Slashdot topic resulting in posts saying that an open source solution is required.

So, has it been done yet?

Or is the problem one of it being rather impossible to create a completely secure voting application, however great the code is, however many security specialists have reviewed it?

Re:Open Source Secure Voting Application

[david_thornley]

I wouldn't trust one. Even if I had something that purported to be the source, how am I to know that that's exactly what was loaded into the machine? How am I to know that the combination of software and machine does something the software alone doesn't?

The only solution is a paper trail. The voting machines used around here have paper ballots that are scanned for counting. Quick returns, and actually verifiable.

Hey, Sequoia, watch my hand...

[dwiget001]

... as it moves gracefully, turning, transforming, into one big middle finger!

My interpretation

[jonaskoelker]

Disclaimer: I have not studied law. I'm not a lawyer. In particular I'm not your lawyer. This is not legal advice.

Let's have a look at what Sequoia is saying:

As you have likely read in the news media, certain New Jersey election officials have stated that they plan to send to you one or more Sequoia Advantage voting machines for analysis. At least they got that one right :p

I want to make you aware that if the County does so, it violates their established Sequoia licensing Agreement for use of the voting system. Emphasis added. It NJ who's bound by (and is or is not in breach of) the license, not Felten and Appel.

Sequoia has also retained counsel to stop any infringement of our intellectual properties, including any non-compliant analysis. Presumably Felten and Appel have not agreed to the Sequoia licensing agreement, so they wouldn't be in breach of contract by analysing any software. Also, I predict they will have strong case arguing that their use of Sequoia software is Fair Use, of either the scholar or research variety.

We will also take appropriate steps to protect against any publication of Sequoia software, its behavior, reports regarding same or any other infringement of our intellectual property. Any reports written by Sequoia will have the copyright belonging to Sequoia. Any report written by anyone else is copyrighted by that someone else. The only thing I can imagine that would change this is if the license agreement of the software stated that the copyrights of any such report written by not-Sequoia is automatically turned over to Sequoia.

Nice to see they are so confident...

[Kazoo the Clown]

in the quality of their product...

No more reviews

[computrius]

There it is. No-one is allowed to review software/hardware anymore unless its a good review and they have gotten permission from the software/hardware developer.

Disappointing

[bobdehnhardt]

This is just disappointing. I had Sequoia pegged as one of the good guys. When we selected them here in Nevada, they willingly submitted to every test, including review by the gaming board (who know a thing or two about fairness and anti-tampering in electronic devices - they have to certify all slot and video gaming machines). Sequoia passed the tests, including having a paper trail. That's not to say they're perfect or infallible, but they sure seemed cooperative and focused in the right direction.

This just doesn't fit with their actions back then. Has there been a change in management?

Re:Disappointing

[KnightNavro]

As long as Nevada hasn't changed the voting machines since I moved in 2004, they still have the best electronic voting system in the nation. Damned by faint praise, I know, but at least there's a verifiable paper trail.

Re:Disappointing

[FailedTheTuringTest]

You have an interesting point there. We should let the Nevada Gaming Commission run elections! Sounds dumb but maybe there's a public interest ad campaign in there somewhere. If people knew that slot machines were more rigorously certified than voting machines....

Re:Disappointing

[Anonymous Coward]

at least there's a verifiable paper trail.

One of the points the article makes is that the "paper trail" doesn't add up. Literally.

your self-righteous optimism

[Essron]

is premature. what do you think scalia and thomas would think about this? the legal system is a red tape delay at best. legislation has to come from the states, because the fed level, both dem and repub, are complicit in letting these machines be shady in an uncountable number of ways. im sure the manufacturer would love to go to court to make this seem even more complicated and unnecessary to the layman, and they also wouldn't mind getting to a federal level bush appointee a la gonzo.

i wish i was an optimist, instead i am merely self-righteous.

I Agree with Sequoia on this

[Shivetya]

and you too.

If their contract declares as such then they are in the right.

However, it should be a requirement at the state level, if not federal, to require this sort of outside verification and study. If a manufacturer does not agree to it then they should be considered for the application. Fair is fair.

Don't want to be hold accountable then don't expect our money.

I am quite sure some other company will step forward if there is money to be made and their intellectual property rights are protected. I am all for testing and certification by outside groups but I also realize that there is investment here and that needs protected first. What must come first is OUR rights, our rights to know that outside experts have certified a solution and future implementations will protect our vote. Surely some company will step up to this for the money. Maybe it will be the kick in the pants for some group already in place to do so.

Re:I Agree with Sequoia on this

[Darinbob]

If their contract declares as such then they are in the right.
Not necessarily. A contract is not the totality of the law. Contracts can be found to be null and void.

In this case, I'd say just basic consumer protection laws would apply. The consumer has the right to determine if the product they purchased does what it claims to do. No "contract" can forbid that. That'd be like an auto maker forbidding the customer in a signed sales agreement from looking under the hood to see if there's an engine present.

I suspect the contract doesn't forbid verifying that the device performs as claimed, but that they disallow giving the device to a third party. Thus they may be relying on the elections board themselves, without the help of consultants, having enough technical knowledge to tell if the device meets their needs.

But I do agree with you on the point that New Jersey should just ship the product back and say "this does not meet our needs at this time". Or if they want the money back, say "since we are forbidden from determining if the device is the same one as described in the contract, we have to declare the contract void, so kindly send us back our citizens' money."

Re:I Agree with Sequoia on this

[Dhalka226]

I'm not a lawyer, so maybe I'm completely wrong about all of this. But...

It seems to me that if I sign a contract that says "I will steal the next car I see" and do not steal a car, I can't be sued for breech of contract. Put more generally, a contract can't force me not to comply with the law.

In this situation, the state (and thus county) has a legal obligation to ensure the validity of elections and access to voting for anybody who's eligible, arising both from the US Constitution and almost certainly from their state constitution and state laws as well. As such, it seems to me that if they decide they need to open up the machine to perform that legal duty, either because they suspect some sort of tampering or even just because they feel the machines are somehow malfunctioning and depriving some users of their votes (clearly they believe this or we wouldn't be talking right now!), they can do so. Even if the contract says "you can't open up our machines" if that's what they need to do to comply with the law, I don't think that contract term is valid.

Besides, it would basically be a license; if Sequoia wants all of their machines back, I'm sure the county would be happy to accommodate them at this point. Accompanied with a permanent decertification.

Re:I Agree with Sequoia on this

[Anonymous Coward]

You're okay with a company declaring what you can and cannot do with software you have legally purchased? You're okay with companies using contracts to subvert copyright law and steal away your rights?

Re:I Agree with Sequoia on this

[HerbanLegend]

I can't help but find some of your comments odd. What sort of "intellectual property investment" are you suggesting that Sequoia might have in this machine? It's a machine to count votes electronically. There may be some novelty here and there, but certainly nothing that is going to inflict any damage on the company if an expert is permitted to review it. What I find odd about your post:

1) You seem to think that honoring a business investment "comes first" in this case. It doesn't. The entire success or failure of Sequoia's product depends on the reliability and security of their system, and our most fundamental civil protection from the government depends on it, too. There is no conflict of interest here, unless Sequoia is afraid of something.

2) I'm not sure that the traditional model of capitalism works well in this case. I'm not sure you can say "if company X doesn't want to comply, then company Y will!" because both companies are potentially under enormous pressure to deceive the states and subvert the vote. I'm not sure that voting machines are a great commodity to be outsourcing. One would think that the GAO or the Elections dept. would build these things and then hold public contests at universities to try to crack them, like DARPA sometimes does with emerging military technology.

Re:I Agree with Sequoia on this

[Anonymous Coward]

Thou shall create NO contract/agreement that violates the LAW and in any contract with the State, it has an implicit right to ensure the contract does comply with the LAW (that would require testing the devices, in this case). Any contract/agreement that does violate the LAW is invalid (and if money changed hands on invalid pretense, then this becomes an issue of Fraud.) Case closed.

Parsing this out

[KnightNavro]

Sequoia isn't saying they think the professors will be stealing intellectual property. They are saying that if New Jersey lets the professors test the software, NJ is breaking the terms of the software license. In short, NJ signed the license agreement, which presumably says that NJ can't give the voting machines to outside testers for evaluation and reporting. It's software as a licensed service and not as property, which is also a heap of bovine excrement. What should be happening is states putting a line in the request for proposals saying something along the lines of "All proposed systems that prohibit independent testing and evaluation will not be considered by STATE," only in legalese.

Re:Parsing this out

[BardBollocks]

if the machines are in decent shape why are they threatening to sue independent experts who can check for themselves? What we REALLY have going on here is an attempt to prevent discovery of the mechanisms used to rig elections.

Deeper background

[whitehatlurker]

I'm not familiar with the situation, but Brad came to the rescue. Apparently, these machines screwed up during another vote. As you read the rest, it seems to be a total train wreck ... perhaps the state can sue?

Re:Deeper background

[whitehatlurker]

I see that another state (Ohio) has seized machines to prevent (further?) tempering in an investigation into voting "irregularities". (Okay - they were ES&S,not Sequoia, but still.)

Here is Sequoia's response from their website...

[HotNeedleOfInquiry]

3/18/2008
Sequoia Voting Systems supports third party reviews and testing of its election equipment

In response to some recent media reports, Sequoia is has issued a statement found at . Through this statement, we hope to educate individuals on the third party review mechanisms already in place in the election industry as well as our company's business practices regarding third party reviews and testing of its election equipment.

An independent review of a voting system is a complex and interdisciplinary process involving a broad knowledge of election law, public administration and technical matters. Many independent reviews have been successfully conducted within the framework of Sequoia's license rights pursuant to appropriate and mutually agreeable arrangements between Sequoia and governmental agencies charged by law with the authority to conduct such reviews. Sequoia welcomes all such responsibly executed review activities.

Please see the Election Technology Council's "Guidelines for States conducting Top-to-Bottom Reviews" found on the organization's website at for additional information.

- Michelle Shafer, VP of Communications

Intellectual property more valuable than physical?

[mlwmohawk]

Government bodies can take land by eminent domain when it is for the public good. Why can't they do that with IP?
This whole thing stinks. Our democracy is a joke.

Why not just breach the license agreement?

[harryHenderson]

If this is really just a contract matter... why can't NJ just breach the contract?
I seem to remember that there is a breach of contract defense available when the contract violates public policy. Does NJ recognize this defense? Do the terms of this license agreement rise to the level of a public policy violation as recognized in the courts?

IMHO the clause is void.

[Ungrounded Lightning]

In short, NJ signed the license agreement, which presumably says that NJ can't give the voting machines to outside testers for evaluation and reporting.

And such a clause should be void on its face, because being inspected for proper function is a necessary part of being a voting machine. See the Doctrine of Unconscionability

Re:Intellectual property more valuable than physic

[Ungrounded Lightning]

Government bodies can take land by eminent domain when it is for the public good. Why can't they do that with IP?

They can't just TAKE it. They have to BUY it for a fair value. (Though they can force the sale.) See the Fifth Amendment.

In this case the fair value could be the discounted current value of all the potential future revenue for the product line - which the company could claim would be lost if their code was leaked to a competitor.

Yes. And why does UL do it?

[Kupfernigk]

Because if you don't get your equipment certified, and somebody's house burns down as a result, the insurance company will see you in court. UL is the Underwriters' Laboratories - they are, basically, there to tell insurance companies what is safe and what is not.

Who is the equivalent agent in this case? Perhaps what is needed is a Federal Bureau of Electoral Fraud - which has the power to prosecute any supplier of voting machines which turn out to have backdoors, obvious security risks, or other means for perpetrating electoral fraud. Then you would see the voting machine manufacturers to get their equipment certified to give them a defense in court.

In Europe we rely more on compliance with Euronorms - it's a cultural, Roman law versus common law thing, I think, but the effect is the same. Write a standard for voting machines, get it adopted by ISO, embed it in Federal law, and then provide a route for certification.

People do seem (perhaps rightly) to be more afraid of fire than of the end of democracy. But it does seem right to hold voting machine manufacturers to the standard that must be met by, say, a coffee machine or a computer power brick.

Re:Yes. And why does UL do it?

[dbc]

Neveda Gaming Commission

I hear they are pretty good a doing hardware/software system audits and design reviews.

Re:Here is Sequoia's response from their website..

[ScrewMaster]

Sequoia welcomes all such responsibly executed review activities.

Obviously they don't. Anyone claiming that Ed Felten is unable to responsibly execute such a review should have her head examined. More to the point however, it is equally obvious that they are very much aware of Professor Felten's reputation, and would very much rather he didn't execute a responsible review of their equipment.

Hey ... if they've nothing to hide ...

Re:Intellectual property more valuable than physic

[superwiz]

Actually, if the IP is given the same protection as tangible property, then it is very much more valuable than the tangible property. It can be reproduced at virtually no cost for profit. To make more copies of tangible property requires (ultimately limited) real-world resources. That's pretty much the argument for why IP rights must only be granted for a limited time.

Good -It shows they NEED to do this.

[moxley]

If I were the state of NJ and the professors I would take this as a welcome sign that not only are they on the right track here - but that they are going to find something when they check these machines out.

I say they should re-double their efforts and try to get several machines, source code, whistleblower employees and everything else they can and really nail these fucks.

As every other impartial examination of 'black box voting' (especially in relation to Diebold, ES&S, and Sequoia) has shown - these are basically set up to be manipulated.

Here's my report

[SpaceLifeForm]

It sucks.

Buy, don't license

[Sloppy]

New Jersey backed down. They had to. They signed a contract where, amazingly, they agreed to not check whether or not the machines work ("non-compliant analysis").

If they had bought the machines, all Sequoia would have are ridiculous trade secret threats. (Just imagine someone trying to explain they spent millions of dollars to come up with a competitive advantage in the field of counting button presses.) But they licensed, and if they attempt to diagnose the machines, they're in violation. What a silly situation to get yourself into.

What do you license?

Nobody cares

[rainer_d]

Well, as hardly more than 50% go to the ballot anyway, and of those who do go, the vote is pretty much evenly devided between the two almost identically streamlined candidates, one could argue that elections are merely a charade anyway. Entertainment for the masses, if you want.
As industry-lobbyists, pressure groups and political activity committees have most parties and politicians in most countries of the world literally by the balls (hi Eliot...), elections become less and less important every day.

Too bad for those, who died for our "freedom" today.
It will be interesting to see what emerges from the current political, ethical and socio-economic statement of bankruptcy of our society that is so overtly delivered to us via TV/web every day.
Unfortunately, we are all part of it, not just mere by-standers who can watch the events as they unfold.

Re:Yes but... Sequoia was being interviewed by

[davidsyes]

Ms Barbara Walters...

BW: You oughtta be HUNG!

Seq: You DAMNED RIGHT me hung... Like a BUFFALO!

For details:

http://www.anvari.org/shortjoke/Best_Jokes/950_barbara-walters-was-doing-a-documentary-on-the-customs-of-the-american-indians.html

I wonder if "Sequoia" "pines" to be the lone "supplier" to the governments...

Re:Here is Sequoia's response from their website..

[AlHunt]

I don't see how their threat matters. Professor Felton, nor any other 3rd party, would be bound by Sequoia's contract with the state of NJ.

Hell, send the machine to me - I'll examine the hell out of it. I'm not bound by sequoia's contracts or agreements.

Re:Here is Sequoia's response from their website..

[ScrewMaster]

Their threat matters in the only way such a threat ever matters: the cost required to defend against it.

Re:Here is Sequoia's response from their website..

[Anonymous Coward]

Yeah well I'm willing to bet the New Jersey government has more money to blow than some stupid election company... Besides if they really wanted to be sneaky bastards they'd just alter the legal playing field to suit their needs.

Re:Here is Sequoia's response from their website..

[ScrewMaster]

Yeah well I'm willing to bet the New Jersey government has more money to blow than some stupid election company

Sure they do ... but does Ed Felten? Besides, NJ already caved in. Wimps (or corrupt assholes, hard to say which.)

Re:Here is Sequoia's response from their website..

[gnasher719]

Their threat matters in the only way such a threat ever matters: the cost required to defend against it. I think Sequoia is completely within their rights to prevent anyone from examining their voting machines, since they are protected by trade secrets. On the other hand, any state buying voting machines should absolutely avoid buying voting machines or allowing the use of voting machines from a company that doesn't allow such examination.

Re:Here is Sequoia's response from their website..

[bataras]

Anyone claiming that Ed Felten is unable to responsibly execute such a review should have her head REVIEWED

One ... two, three things to say ...

[multimediavt]

Sequoia seems to be claiming that no one can make a "report" regarding their "software" without their permission.

Ha! Chya right! As if!

Re:Here is Sequoia's response from their website..

[rtb61]

They are not entitled to block people from examining a voting machine. I think you have to remember that once it is sold it is no longer theirs to control. Now if Sequoia want to keep their machines private and secret, they simply need to stop selling them, and voila, every bodies problem is solved.

When you 'sell' stuff it is no longer protected by trade secrets, as it no longer is in the possession of the company. Now as for trade secrets, I don't see why any company is entitled to maintain the lie of trade secrets, the customer should always be fully legally entitled to know everything about the product they are being sold, after all there is patent and copyright protection. From my experience the only reason for trade secrets is to protect B$ advertising, where the marketing wildly diverges from the truth.

That was a very important point that you made, it really is about time that the whole concept of trade lies 'er' secrets be reviewed under law, so that companies become fully accountable for the true qualities or the lack there of, of their products.

Re:Here is Sequoia's response from their website..

[Foobar of Borg]

Yeah well I'm willing to bet the New Jersey government has more money to blow than some stupid election company

Also, considering this is New Jersey:

"Hey, Sequoia, we's gots some guys from Hoboken wants to talk to youse guys." (Actually, Hoboken has gotten a lot nicer since the old days. Jersey City, not so much.)

Union County (NJ) backed off its plans

[buon_professore]

The County, in fact, backed off its plans yesterday to have the machine inspected, just as various other counties have under even more extreme circumstances (Snohomish Washington 2004; Sarasota Florida 2006) Learn more at Election Integrity. http://www.electionintegrity.org/

Re:Here is Sequoia's response from their website..

[Anonymous Coward]

Many independent reviews have been successfully conducted within the framework of Sequoia's license rights It is hilarious that they attempt to masquerade as "successful reviews" studies that found abysmal problems in their products. For example, in the California Top-To-Bottom-Review (mentioned in their press release) university researchers examined the Sequoia machines in use in California, performed source code and red team analysis, identified a huge number of vulnerabilities (and plain bugs), and developed working exploits (even in the form of virus) capable of modifying the results of an election.
The reports are publicly available: source code review, red team review.

Re:Here is Sequoia's response from their website..

[Anonymous Coward]

Perhaps this was meant as a "Sarcastic" post.
If there's any confusion let's clear it up now shall we.

The Citizens of the United States no longer have the luxury of fucking around with these lies and propaganda anymore, everything is at stake since these electronic voting machines are the "spark of life" that was needed to begin the negative downward spiral of the destruction of the constitution, the corporate media, the judicial, the executive, the senate, the economy and the delivery of the United States directly into the hands of fascism. All you need do is compare the Constitution before this administration to the constitution after this administration to understand what these oath of office breaking criminals are up to.

Who ever marked this as funny might want to understand that "Election Technology Council" is made up of the manufactures of these fucked up machines. Which is the same as the fox guarding the hen house. It's very similar to the ACVR saying that there's voter fraud. (When in fact there wasn't and isn't) and that also the ACVR was only a fucking MAILBOX address, and that the damage they did exists to this very day as propaganda, misinformation, and lies. There's nothing funny here. These electronic vote tabulation devices, broken chain of custody, voter roll purging have cost our veterans their lives.

Furthermore, out in California Secretary of State Debra Bowen's Top-To-Bottom (which truly was independent) review resulted in every machine being de-certified because they all failed miserably.

Re:Here is Sequoia's response from their website..

[BobTheLawyer]

You can be sued in many jurisdictions for assisting or causing a breach of contract between two other parties - tortious interference with contract. That said, in this case there seems a clear first amendment defence.

Re:Here is Sequoia's response from their website..

[electrictroy]

If I were Professor Felton I'd tell them to "fuck off" and do the review anyway. Every citizen has the right to obtain a piece of software or hardware (or movie or videogame or whatever), and then issue his or her comments about the product.

It's called free speech.

Free speech, being a Constitutional law, trumps congressional law regarding intellectual "property". Professor Felton's Constitutional rights reign paramount in the legal hierarchy.

Re:Here is Sequoia's response from their website..

[Saint Fnordius]

True. The machine is no longer Sequoia's, really. If a state or a municipality buys a machine, they should have full title to it, and that means the rights to inspect and test their own property. The rights of Sequoia are restricted to the right to prevent copies being made of the software for agencies other than the purchaser. The only rights Sequoia should have is the right to void any warranty agreements.

Well, that's the way it should be. The vagaries of the DMCA make it possible for Sequoia to engage in this sort of thuggery, exploiting legal loopholes to threaten and blackmail. It is now up to us to ensure that this boomerangs against them and scares off future customers.

re:here is sequoia's response from their website..

[ed.han]

screwmaster, that's a valid point. however, it isn't merely ed felten--i'm quite sure the EFF and other parties would be quite happy to take on any resulting concerns on a pro bono basis.

Re:here is sequoia's response from their website..

[Muad'Dave]

...the EFF and other parties would be quite happy to take on any resulting concerns...

That kinda puts a new spin on the phase "EFF you!"

Who knew?

Send the machines back

[Fujisawa Sensei]

Simple solution:

1. Declare the the existing contracts void, there must be numerous BS loopholes in the law that allow them to do that. Even an executive order by the governor.
2. Cancel all future payments.
3. Ship all the existing machines back and marked postage due.
4. When the complain and threaten legal actions, take proactive legal action and appoint a grand jury with subpoena powers to investigate the company for attempted voter fraud and conspiracy.

Right of first sale

[wiredlogic]

If New Jersey owns the machines then the right of first sale rule applies and they can do anything with them unless bound by contractural restrictions. Sequoia can just go suck it. This letter is just the opening salvo in the usual SLAPP antics these companies play when they can't bribe to get what they want.

Sequoia's response

[ColoradoAuthor]

The following press release is available on Sequoia's web site. How thorough are the hand-picked "independent" reviewers they claim to use?

Sequoia Voting Systems supports third party reviews and testing of its election equipment

March 18, 2008 (DENVER, CO) - In response to some recent media reports, Sequoia is issuing this statement to educate individuals on the third party review mechanisms already in place in the election industry as well as our company's business practices regarding third party reviews and testing of its election equipment.

Sequoia Voting Systems is committed to maintaining voter confidence in the electoral process. Our company is dedicated to working with our customers in this regard and has done so over our century of serving state and local election jurisdictions throughout the United States.

Sequoia's products - and those of all election equipment manufacturers - go through a complete and independent review as part of the Election Assistance Commission's (EAC's) federal voting system certification process including rigorous testing and a line-by-line review of the voting system's source code by EAC accredited Voting System Test Labs (VSTLs).

Prior to the EAC's certification program which was initiated in 2007, voting systems were qualified at a federal level by the National Association of State Election Directors (NASED) after testing by NASED-approved Independent Test Labs (ITAs). The ITAs also performed a line-by-line review of voting system source code.

In addition to the federal certification program, individual states have their own state certification programs which vary state-by-state but most often entail additional testing and review by qualified third party experts. Many states also require voting system manufacturers to submit their source code to be kept in escrow, should there be a need to access this code by the state in the case of some type of unanticipated situation or problem.

Sequoia also voluntarily submits its voting system source code to the National Software Reference Library (NSRL) which operates under the umbrella of the federal government's National Institute of Science and Technology (NIST). The purpose of this is so that Sequoia customers can check the hash codes of their product, as installed, against the certified copies at the NSRL.

Additional independent reviews of Sequoia products have most recently taken place in the State of California (Secretary Bowen's Top to Bottom Review of Voting Systems), the State of Colorado and The City of Chicago/ Cook County, Illinois. In addition, the New Jersey Institute of Technology is also completing a review of the Voter Verified Paper Audit Trail (VVPAT) adaptation for Sequoia's AVC Advantage at the request of the state of New Jersey. As recognized by the Election Technology Council (ETC), the election industry trade association of which Sequoia is a founding member company, such an independent review is a complex and interdisciplinary process involving a broad knowledge of election law, public administration and technical matters (see the ETC's Guidelines for States conducting "Top-to-Bottom" Reviews found on the organization's website at http://www.electiontech.org/resource.html ). These independent reviews, and many others, have been successfully conducted within the framework of Sequoia's license rights pursuant to appropriate and mutually agreeable arrangements between Sequoia and governmental agencies charged by law with the authority to conduct such reviews. Sequoia welcomes all such responsibly executed review activities.

Sequoia does not support any and all unauthorized activities that violate or circumvent our product licensing agreements. Licensing agreements are standard practice in the technology industry, including the elections industry and have been for decades. Sequoia will vigorously protect and defend its intellectual property and enforcement of established licensing agreements.

About

Missing the point

[gillbates]

The fact that Sequoia will not allow their machines to be independently reviewed and audited is reason enough to disqualify them from public service.

Period.

No other reason is needed; Democracy is too valuable to submit itself to secret ballots or election systems. Given the sensitive and profound role of the voting machine, no voting machine maker has any right to the secrecy of its designs or workings. The right of the public to be ruled by the leaders of their choosing trumps any supposed trade secret rights the voting machine maker might have.

I would posit that anyone who believes otherwise is quite possibly a traitor. In spite of what you might have read, the greatest threat this nation faces is not terrorism or drugs, but rather, the loss of our fundamental rights, made possible by the loss of real democracy. Sequoia, whether they realize it or not, is part of the problem, not the solution.

Re:Here is Sequoia's response from their website..

[DustyShadow]

I think Sequoia is completely within their rights to prevent anyone from examining their voting machines, since they are protected by trade secrets. If someone can find out your trade secrets through simple reverse engineering techniques, the information loses its trade secret status. Reverse-engineering is a full defense to a claim of trade secret misappropriation.

Fixed...?

[Chysn]

> Sequoia seems to be claiming that no one can make a "report" regarding their
> "software" without their permission.

Sequoia seems to be "claiming" that no one can make a report regarding "their" software without their permission.

if Sequoia has nothing to hide ...

[gr8scot]

why don't they want to be investigated? They're trying to sell a product, in exchange for our hard-earned money. Why are they not showing off their wonderful product? "It slices, it dices, it brings in your morning newspaper and it's a floor polish too!!" Like any other salesmen, they should be bragging about their source code & engineering, unless those are utter crap.

I haven't kept up-to-date on the requisite subjects, but a discussion of the feasibility of fraud-proof voting machines based on optical quantum encryption would be indescribably interesting to me, and hopefully to other /.ers. In the meantime, I strongly suspect that the technology Sequoia employs is ... less than the best.