Sequoia Threatens Over Voting Machine Evaluation

enodo writes "Voting machine manufacturer Sequoia has sent well-known Princeton professor Ed Felten and his colleague Andrew Appel a letter threatening to sue if New Jersey sends them a machine to evaluate. It's not clear from the letter Sequoia sent whether they intend to sue the professors or the state — presumably that ambiguity was deliberate on Sequoia's part. Put another clipping in your scrapbook of cases of companies invoking 'intellectual property rights' for bogus reasons." Sequoia seems to be claiming that no one can make a "report" regarding their "software" without their permission.

Comments

No permission should be needed

[Midnight Thunder]

I am sure the state of New Jersey can tell Sequoia to accept this investigation or say good-bye to any certification. Sequoia is just making themselves look bad and like they have something to hide.

Re:No permission should be needed

[falconwolf]

I am sure the state of New Jersey can tell Sequoia to accept this investigation or say good-bye to any certification. Sequoia is just making themselves look bad and like they have something to hide.

I agree however New Jersey probably has already paid for the machines. I can't see Sequoia telling the state they can't test them, have them tested scientifically, if they haven't already been paid for. This case can however be used to show other potential buyers just how the company operates.

Falcon

Re:No permission should be needed

[Rick17JJ]

If they do not have enough confidence in their system's security or accuracy to allow it to be tested, then it is not good enough to be used for e-voting. They have just demonstrated that their system can not be trusted.

Sweet.

[Jaysyn]

Yes, that is *exactly* what we want Sequoia to do. Sue a Priceton professor & *security* researcher.

Bullet. Meet foot.

The ambiguity is a dead giveaway.

[TripMaster Monkey]

It's not clear from the letter Sequoia sent whether they intend to sue the professors or the state -- presumably that ambiguity was deliberate on Sequoia's part.

In other words, this is a scare tactic with nothing to back it up, pure and simple. If Sequoia thought the would have had actual grounds to sue, you can bet that they would have been chillingly specific in their letter.

When people resort to these sort of tactics to attempt to dissuade you, you can be assured you're doing something right.

Check, Meet Balance

[CheeseburgerBrown]

A voting apparatus without a clear path for auditing of every system and sub-system is an invitation to corruption. Comparable mechanisms in governance have checks and balances to ensure fidelity.

Why do these shifty porkchops think they ought to be exempt? Because it may make their investors nervous?

This is definitely a situation where the bottom line should be drawn by logic, not by dollars.

Re:Check, Meet Balance

[CastrTroy]

Any voting system should be verifiable by any member of the voting populous. Having a PhD in computer science should not be prerequisite for understanding the voting system. You also shouldn't have to take somebody else's word for it either. Pen and paper hand counted ballots make sense, because anybody can see exactly what's going on, and fully understand the process. If voters don't understand the voting system, then they might as well not even be voting.

Re:Check, Meet Balance

[CastrTroy]

That's why the ballots can be counted, or viewed by multiple parties, who should all agree on the final counts. Anybody should be allowed to stand around and watch the counting. I'm not saying that no fraud would happen, because it's happened in the past, and it will happen in the future. I'm just saying that it should be obvious to the voting public when fraud is happening. The problem with machines, is that even if they are verified, it's impossible to know what code is running on it when you walk up to it on election day. Think of game consoles. They try to make it so you can only run licensed content. But people always find a way to run homebrew/pirated games. You can verify the machine all you want. There's no guaranteeing that the same machine will actually be used on election day. You could probably even put a completely different machine in front of people on election day, possibly in the same casing, although that's not even necessary, and people wouldn't even know they were using the wrong machine, because each polling district uses different machines.

Re:Check, Meet Balance

[FailedTheTuringTest]

No, it's not the same problem. It's easy for people to watch the movements of pieces of paper, make sure they end up where they belong, and count them. It's much harder to do the same with electrons.

The solution for paper ballots is based on four principles: transparency, adversarial conditions, counting everything in a way that, if done right, makes double-entry accounting look like a random number generator, and decentralization.

Transparency means that every step of the process is done in the open, with multiple people watching. Adversarial conditions means that the people watching include representatives (i.e. campaign workers) of all candidates, who are highly motivated to ensure that the others don't cheat. In Scotland, for example, each candidate can even apply their own seal to the ballot boxes in addition to the electoral commission's seals, so they can verify for themselves that boxes haven't been swapped, opened, or lost. A fraudster would have to be able to duplicate the seals of every political party in addition to the electoral commission.

As for counting, every ballot paper must be accounted for. Polling stations start with a known number of blank ballots (verified by all candidates) and they must count the number of ballot papers issued, used, spoiled, and not used, as well as the number of ballots that end up in the ballot box, and if the numbers don't add up right then one can deduce that funny business is going on.

Finally, decentralization is important. With safeguards in place, it may still be possible to cheat in a few locations (although you'd have to get campaign workers from all sides to look the other way), but widespread fraud serious enough to steal a whole election becomes extremely difficult. It is difficult to compromise the process in many locations at once. And even though the central counting facility receives the counts from each polling station and adds them up, it can be made to echo the numbers back and discrepancies can be spotted. A centralized electronic system, though, can be compromised at the center, you don't have to take over every polling station.

Re:Check, Meet Balance

[moeinvt]

"It is the exact same problem."

Hardly.

Think of the issues in logistical terms. In a paper-ballot system, tampering with a ballot box in such a way as to make any appreciable difference in the vote result would require tools, materials, physical access and a certain amount of time and effort within a relatively small window of opportunity.

With an electronic system, if the state isn't allowed to run simulated elections or do detailed inspection of the voting machine and software, the window of opportunity for tampering is huge, the potential for altering the result is high, and the risk of detection is minimal.

Let's call a spade a spade:

[jockeys]

and see that the only reason Sequoia is pissed off is that they either
a. are afraid that there are gaping security holes in their machines
b. KNOW that there are gaping security holes in their machines

all the privacy zealots will no doubt say that my "if you have nothing to hide you have nothing to be afraid of" mentality is misguided, but let's take a step back and see what is on the line here. this is NOT about personal data, this is about objectively evaluating the security of a device that is going to be used in a VERY public fashion. do lamp makers threaten Underwriters Laboratories for wanting to make sure their device works as intended?

Re:Let's call a spade a spade:

[orclevegam]

I for one say we need to amend the patent and copyright acts to make devices used to voting unpatentable, and exempt from copyright, or barring that, that the certification process requires all rights to be signed over to the government. These machines by their very nature should be open to the most detailed scrutiny imaginable by anyone who feels so inclined. If the companies want to make money on them sell maintenance and manufacturing contracts, but there should be no way to claim trade secrets on anything used for voting.

Re:Let's call a spade a spade:

[Migraineman]

Lamp manufacturers pay UL for the privelege of being certified. UL doesn't randomly grab equipment and force a cert upon it. The voting machine manufacturers should be more than interested in having third-party audits of their equipment ... unless they are either crap or corrupt. I suspect the former, but the latter isn't too far behind.

Regardless, I don't see how the manufacturer could impose restrictions on the equipment if it has been sold. Leased? Yeah, that'd come with a use restriction because title never was transferred.

Re:Let's call a spade a spade:

[NeutronCowboy]

Someone mod this guy up. I find it unconscionable that it is possible to patent or copyright something that is absolutely critical to the fundamental processes of democracy. Sequoia might as well demand that they be made Emperors of America.

History lesson

[i.r.id10t]

Mebbe they need a history lesson...

Anyone care to guess when the last armed revolt against government was here in the US and the reasons behind it?

Answer - Battle of Athens, Tenn. 1946. And it was over voting issues...

http://en.wikipedia.org/wiki/Battle_of_Athens

Re:History lesson

[notthepainter]

The wiki page is pretty short on details.

See http://www.constitution.org/mil/tn/batathen.htminstead.

Re:Speechless.

[The Ancients]

Just speechless.

That's often the results with certain voting machines.

"Really"?

[truthsearch]

Sequoia seems to be claiming that no one can make a "report" regarding their "software" without their permission.

I "beg" to "differ".

Re:Yes but...

[garcia]

Yes, but nothing is stopping Sequoia from being hung in the court of public opinion.

Sure there is, apathy.

Update and more details on this

[MrAtoz]

It was Union County, NJ that was planning to send sample machines to Dr. Felten. They were threatened by Sequoia and have backed down from their plan as a result. The whole thing happened because several counties in NJ reported errors with the Sequoia machines in the February primary election. Sequoia reviewed these and just said that it was "user error" and not a problem. The counties understandably didn't find this an acceptable response, and Union County wanted to get an outside opinion. All the details can be found in this NJ Star-Ledger story.

handy though

[rucs_hack]

If this gets thrown out, it will really dent future attempts to use methods like this to shield shoddy products.

If you ask me, Sequoia has been given some very bad legal advice. Didn't anyone stop to think about the public relations nightmare this would cause? Not to mention damage to their business.

Re:handy though

[MightyMartian]

There is an alternative to all of this. New Jersey can simple remove Sequoia from the list of companies they're considering for voting machines. I mean, if they don't have it already, they can simply pass law stating that all those submitting bids for supplying the state with voting machines must make a machine available for independent review by an organization or institution of the state's choice. If Sequoia doesn't like those terms, they don't have to bid.

It's true, however, that IP claims are getting out of hand when a government and/or institution doing some work for the government is threatened with a lawsuit over testing hardware. These events are only going to get more egregious and ludicrous until Washington and the courts start handing these abusers their proverbial balls on a platter.

Re:handy though

[Darinbob]

If this gets thrown out? Surely no court could be so stupid to think that a third party's opinions of an available product can be stifled on the grounds of intellectual property laws. I can't think of anything even reasonably close to a valid excuse to allow it to go through. That's where "intellectual property" becomes such a vague and dubious notion. Consider if this were a medical device. If health risks were involved, could a company forbid the FDA from investigating the device because someone signed a licensing agreement? Or if the FDA has no interest, what about restriction a state board of health from investigating the device?

In the past, less than one hundred years ago, it was extremely difficult to investigate dangerous products or workplaces. The government just didn't feel it was important enough to get involved in. There had to be major media effort to bring these problems to the public eye before there was enough pressure on the government to put pressure on companies. Such as hair products that could cause blindness and disfigurement, sometimes death (the reason that we have animal testing for cosmetics today). Companies didn't care if customer's were hurt, as long as they got their money first; but bad publicity made them at least pretend to care.

Or the use of radium on watch dials; a company where the chemists would use lead shields to deal with radium would suggest to the factory workers that they could lick the brushes used to pain the dials. That took a media campaign to publicize slow painful deaths of young women before the public demanded change. It's interesting here that US Radium threatened to sue to prevent publication of a damning report, since the author had signed a confidentiality agreement (deja vu).

But in this case, the danger is to elections, not someone's health. The question is whether this rises to the same level of concern. In the health cases, people had to die or become disfigured before the government and the public took any action. Do we have to wait for a stolen or hacked election before the people decide that the public's interests in this matter overrides intellection property? ("intellectual", hah, there's nothing so special about the technology here; shoddy hardware, shoddy software, slick marketting)

I don't think a PR nightmare really applies. This kind of stuff rarely if ever hits mainstream media, and us geeks of Slashdot aren't really the type to buy into proprietary tools in general, let alone ones used for voting. But this needs to hid the mainstream media. Otherwise companies just go on with business as usual. Governments will never take any action unless they detect some sort of public outcry, especially in the modern climate where pro-active governments are frowned upon.

Re:Voting versus Gambling

[dpilot]

> but if they can help a democrat steal an election...

And what's your opinion if it's helping a republican steal an election?

Whatever response you give me, the words "a democrat" did not need to be in your post. Stealing an election is WRONG, whether it's a democrat or a republican. You took a very good post and diminished it with a bit of partisanship. I notice that you said "democrat" where usually the party affiliation is capitalized, so maybe you're scooting by on a technicality. But at that point we're parsing to the degree that we criticize politicians for.

I Agree with Sequoia on this

[Shivetya]

and you too.

If their contract declares as such then they are in the right.

However, it should be a requirement at the state level, if not federal, to require this sort of outside verification and study. If a manufacturer does not agree to it then they should be considered for the application. Fair is fair.

Don't want to be hold accountable then don't expect our money.

I am quite sure some other company will step forward if there is money to be made and their intellectual property rights are protected. I am all for testing and certification by outside groups but I also realize that there is investment here and that needs protected first. What must come first is OUR rights, our rights to know that outside experts have certified a solution and future implementations will protect our vote. Surely some company will step up to this for the money. Maybe it will be the kick in the pants for some group already in place to do so.

Here is Sequoia's response from their website...

[HotNeedleOfInquiry]

3/18/2008
Sequoia Voting Systems supports third party reviews and testing of its election equipment

In response to some recent media reports, Sequoia is has issued a statement found at . Through this statement, we hope to educate individuals on the third party review mechanisms already in place in the election industry as well as our company's business practices regarding third party reviews and testing of its election equipment.

An independent review of a voting system is a complex and interdisciplinary process involving a broad knowledge of election law, public administration and technical matters. Many independent reviews have been successfully conducted within the framework of Sequoia's license rights pursuant to appropriate and mutually agreeable arrangements between Sequoia and governmental agencies charged by law with the authority to conduct such reviews. Sequoia welcomes all such responsibly executed review activities.

Please see the Election Technology Council's "Guidelines for States conducting Top-to-Bottom Reviews" found on the organization's website at for additional information.

- Michelle Shafer, VP of Communications

Re:Here is Sequoia's response from their website..

[ScrewMaster]

Sequoia welcomes all such responsibly executed review activities.

Obviously they don't. Anyone claiming that Ed Felten is unable to responsibly execute such a review should have her head examined. More to the point however, it is equally obvious that they are very much aware of Professor Felten's reputation, and would very much rather he didn't execute a responsible review of their equipment.

Hey ... if they've nothing to hide ...