[E-voting] Summary of meeting

[Adrian Colley]

Here's my informal summary of the meeting we had with the Minister and
his officials today.  There's a health warning on this summary: it's
based on fragments of memory of a 1.5-hour meeting.  There are certainly
bits in the wrong chronological order, bits missing, and bits which are
wrong.  I post it now to satisfy the curious, but the final version
won't be ready at least until it's merged with Colm's and Mags's
recollections.

In an attempt to minimise bias in the main report, I moved anything that
seemed like a subjective evaluation to the second section.

 --Adrian.

-- 
GPG 0x43D3AD19 17D2 CA6E A18E 1177 A361  C14C 29DB BA4B 43D3 AD19
http://user-aecolley.jini.org/
-------------- next part --------------
Adrian's summary of meeting between ICTE delegation and Minister for the
Environment, Heritage and Local Government; 2005-01-18 in the West Wing
of the Custom House in Dublin.

The meeting was scheduled to go on 45 minutes, but it actually went on
for slightly more than twice that.

Attending for ICTE were Colm MacC?rthaigh, Margaret McGaley, and Adrian
Colley.  Attending for the Minister were Dick Roche (the Minister
himself), Dave Walsh, and two other Department officials whose name I
was too disorganized to record.

ICTE's agenda for the meeting spanned a short presentation and 17
further points:

 1. VVAT should be enshrined in law.
 2. Ireland should lobby for VVAT in the Council of Europe.
 3. Running DRE without VVAT is a logistical nightmare.
 4. The CEV is now examining a doomed system, which is a waste of money.
 5. An independent Electoral Commission should be formed.
 6. The Department of EHLG is unqualified for technical duties such as
    system integration and security policy specification.
 7. The testing of the system was very badly specified.
 8. There are too few voting machines provided.
 9. Powervote are quite unprofessional.
10. The use of public funds for the PR campaign calling the N/P system
    "safe, secure and accurate" should be investigated.
11. The conclusion of the contract with Nedap/Powervote deserves
    investigation too.
12. There should be extensive consultation with the IT community
    regarding e-voting.
13. What was the business case for adopting the N/P system?  What was
    the rationale?
14. There should be an education campaign to help people vote who
    currently accidentally spoil their votes.
15. Usability by voters with disabilities needs to be improved.
16. The commercialisation of democracy and the changing responsibilities
    of returning officers are insufficiently well examined.
17. Ireland could take the lead in introducing VVAT.

The Minister expressed surprise that this was our first meeting with the
Department.  He said that this was a "very open Department" and added
that you couldn't find a group of people who cared more - or knew more -
about voting systems than the Franchise section.  I pointed out that we
had been trying to communicate with the Department on this matter since
2001, but without success, and that as a result we had been involved in
a dialogue of the deaf for much of the intervening time.

Colm's slide show <URL:http://www.stdlib.net/~colmmacc/vvat.pdf> - a
6-year-old-level introduction to VVAT - explained the difference between
auditing and testing by illustrating how a 'multiply by 4' process will
pass testing for positive integers less than 2^29, but will fail due to
integer overflow if given any higher number; whereas an audit would have
caught the error by comparing the result with an expected result.  We
explained that NASA's research had led them to conclude that errors in
software are inevitable and that they designed systems to cope with
those errors by real-time auditing.

The Minister interrupted with an explanation of the problems with the
paper-only system, focusing on invalidation of votes due to voter error
and also to the lack of the official stamp on some votes.  He went on to
describe the horrors of a 10-day count in Wicklow in which "half of the
Law Library" argued over ballot meanings.  We agreed that this was a
deplorable situation, and attempted to assure him that a VVAT does not
involve similar problems.

The Minister asked whether such 10-day counts would not be inevitable
when a VVAT was used in a paper count to check the electronic result.
He added that he didn't want a "dual system" which would have all the
problems of the all-paper system.  Colm explained that the VVAT is not
put through a full count as in the all-paper system, but that it is
instead reconciled against the electronic record of the same ballots,
following which the electronic record is used as the basis for an
electronic count.  The Minister asked whether that would take as long or
longer than a full paper recount; Colm explained how the paper record
can be effectively reconciled with only a single sort and count.

The official on the Minister's right (hereinafter Official R) asked what
mechanisms we had in mind to effect the VVAT.  We described the
voter-puts-printed-ballot-in-box model.  The Minister declared that as a
democrat, he would not be happy with any scheme that allowed voters to
take their receipts home with them.  We assured him that it was not a
receipt, and that voters would not be allowed to leave with their paper
ballots.  Official R expressed scepticism about the idea that this
prohibition could be enforced, and said that it would lead to
discrepancies in every box.

The Minister told us that he doesn't believe in conspiracies, and then
asked what would happen if a couple of hundred people decided to
sabotage the election by taking their printed ballots out of the polling
station and then falsely complaining of some kind of e-voting fraud.
Margaret pointed out that it is already an offence to remove a ballot
paper from a polling station.  The Minister replied that it sometimes
happens anyway, and told another anecdote about a polling station which
had a low turnout when the lights went out, and a high turnout when the
lights came back on.

The Minister sketched a system in which the VVAT consisted of a card
with a magnetic stripe, and which would have a visible representation of
the vote and another representation encoded on the magnetic stripe (the
sketched system would also store the vote in a ballot module).  He began
to explain that the vote seen by the voter would not necessarily be the
same as the vote on the magstripe.  Mags interrupted him and explained
that the VVAT could only consist of the vote seen by the voter, and that
anything recorded on the magstripe could not be used as a VVAT.

Official R asked about the Mercuri method, and in particular asked what
happens when a voter decides that the printed paper behind the glass is
not the ballot he/she wants to cast.  Colm and I explained that the
ballot could be cancelled under the supervision of the presiding
officer.  Official R expressed further scepticism about this, and
claimed that it would lead to complex procedures and lengthy confusion.
He went on to predict that every method of VVAT which we could devise
would be rendered unrealistic by some practical flaw in each method.

Colm described the optical-scan method in which voters' electronic
ballots are not 'cast' until the VVAT card is accepted by the system.
The Minister rejected this on the ground that optical scanning was very
unreliable in the 1980s.  Mags assured him that the technology was
greatly improved by 2005, and also cited the Lotto system as a
successful optical-scan example.  The Minister's officials asked whether
VVAT was already in use anywhere.  We cited Venezuela, but when we
admitted that the paper record there had been put through a full paper
count, the officials lost interest.  We suggested that Ireland could
take a leading role here, but the interest stayed lost.

The Minister argued that the voter would see his/her vote "stored" on
the display in front of him/her, and suggested that this was sufficient
voter verification.  We all argued about the meaning of "stored" for a
while before Mags pointed out that the vote is also stored in the ballot
module, and there is a possibility of discrepancy.

Official R asked if the trustworthiness could be satisfied by
"compounding" the machines involved after the election, and examining
them to see if they have been tampered with.  We said no.  Colm provided
the Minister with a copy of "Reflections on Trusting Trust" and briefly
described it.  I said that the voting machine may not behave during an
election the way it behaves during testing, and described how a "cheat"
mode may be triggered by the system time, by some condition of the
ballot module, or even by the multiple-unlikely-button-push scenario
(outlined in the CEV report at p. 148).  The Minister said it was
unlikely that a single person would be able to travel the whole country
pressing a cheat code into all 7000 machines.  Mags explained that an
attacker would only have to do this on one machine in a constituency.

The Minister's officials suggested that as no computer system is
perfect, and as ICTE seems to be chasing perfection, that we will never
be happy with any practical system.  We responded that we want a system
in which the realistic risks are properly handled so that the system
would be practically trustworthy, though not perfect.

The Minister asked if we really believed that all the "sophisticated
democracies" that had chosen a form of e-voting similar to the
Nedap/Powervote system had in fact seriously endangered their
democracies and ignored the dangers.  I suggested that the situation was
much more likely than the Minister seemed to believe, and that in
Ireland we pay more attention to detail in matters of IT than those
other countries.  I further suggested that the electronic voting
industry was in a state of immaturity, and compared it to the early
aviation industry, in which problems were swept under the carpet and
loose procedures (which wouldn't be acceptable today) often led to
disaster.  It didn't prevent many countries from embracing aviation, and
it doesn't stop countries from adopting e-voting systems which are not
"up to scratch".

The Minister said that he had read the CEV report over Christmas, and
much more material on e-voting, including Google searches.  He lamented
the fact that there wasn't much comparison of the proposed system with
the old all-paper system, and cited the risk analysis section of the
report (Appendix 2H) as one which could be "ripped apart" (in the sense
of academic criticism).  After an excursus into his past as an academic,
including his doctoral thesis which apparently outlived three
supervisors, he said that the CEV report's various appendices seemed to
contradict each other.

The Minister asked if there were any problems or concerns raised at the
time of the 2002 pilots.  We brought up the problems reported in the
Dublin Returning Officer's Post Election Report, notably the 1294-vote
discrepancy in one of the Dublin constituencies.  The Minister and his
officials then explained to us the procedure for that reconciliation (of
the number of votes recorded versus the number of voters marked off the
register minus the number of machine deactivations).  The Minister asked
whether the 1294 was too many or too few, but didn't pursue the line of
questioning when Colm told him it was one constituency each way.  The
Minister explained that the marked register is frequently inaccurate,
and supported it with an anecdote from his own family, one of whom had
voted but had not been marked on the (FOI'd) marked register.  The
official on the Minister's extreme left (believed to be Dave Walsh)
explained that the discrepancies were due to a mix-up over the
allocation of the colour-coded voting tickets in use, and that once this
had been sorted out, the discrepancies virtually vanished.

Colm pointed out that none of these problems were made public in time to
challenge the result.  The Department officials suddenly and
emphatically stated that there could be no suggestion that the results
of the elections in the pilot three constituencies were in any way
unusual.  We reassured them that we were not contending that the results
were incorrect.

We suggested that the Department engage in a seminar or other
consultation process with the IT community.  The Minister rejected this,
saying that it might be seen to be conflicting with the role of the
Commission on Electronic Voting.  We attempted to explore the objection,
but the Minister was steadfast in rejecting any public process before
the CEV's work is finished.

We suggested that the CEV was now involved in a wasteful exercise,
testing a system which would never be used.  We suggested that it be
brought to a dignified end.  The Minister disagreed, and said that after
spending ?52m on the system, he very much hoped that it would be used.
We switched tack and asked instead that the CEV's terms of reference be
expanded to include other issues such as a VVAT and other e-voting
systems.  The Minister said that this was not what the Commission itself
wanted.  Mags pointed out that the Commission's report went out of its
way to draw attention to several aspects which were relevant to its work
despite being outside its terms of reference.  The Minister admitted
that the Commission had interpreted its terms of reference differently
from the way he would have preferred (he wanted it to spend more time
comparing the proposed system with the all-paper system), but insisted
that the Commission did not want to expand its workload.  He said that
the Commission is always capable of asking for its terms of reference to
be changed if that is what it wants.

We suggested that an independent Electoral Commission be created in
order to handle some of the Department's current responsibilities in
this area.  The Minister expressed doubt that there are any truly
independent bodies, and briefly illustrated this theory with reference
to An Bord Plean?la.  We added that the Department lacks qualified
expertise in several areas essential to e-voting procurement, including
system integration and security.  The Minister hinted that this might be
about to change, which shut us up quite well.

We raised the fact that voting machines had been acquired to replace
ballot boxes instead of voting booths, and that consequently there were
too few.  This point was interrupted and derided as being a matter of
mere detail.

Colm said that Powervote were "unprofessional", and added that anyone
with IT experience who examined their record would come to the same
conclusion.  He emphasized this point strongly.  I interrupted to say
that if Colm seemed to be underscoring the point a lot, it was because
we had heard many of Powervote's positions come out of Martin Cullen's
mouth without having undergone any fact-checking or other filtering.

Colm cited the change in the PR campaign line from "it's easier for
everyone" to "electronic voting is safe, secure and accurate" as being a
suitable basis for an investigation into the expenditure of public
funds.  The claim in the ad was demonstrably false, as the Commission's
report showed.  The official on the Minister's immediate left
(hereinafter Official L) produced a page and read several
carefully-chosen phrases that - to someone who hadn't read the full CEV
report - would have given the false impression that the CEV wished for
more testing but otherwise gave the system a clean bill of health.  (The
page may have been a copy of the Minister's December press release.)
The Minister said it was a matter for the Comptroller and Auditor
General.

We raised the question of the unusually-favourable contract terms which
the Department had signed with the suppliers.  Dave Walsh pointed out
that the Department has a contract with Nedap, but not with Powervote.
When I asked him to confirm this, he said that the Department has a
letter of intent and a tender agreement with Powervote, but that the
final contract is still unsigned.

The Minister also said that he disliked digging into the past (meaning
Cullen's questionable actions) as it is an "arid" area of discussion.

Colm asked that the statutory instrument ordering use of the e-voting
system in the next election be signed at least six months in advance.
After some confusion caused by the officials' initial assumption that
this referred to the order fixing the day of an election, the Minister
asked why such a delay was wanted.  Colm said "so we can bring a High
Court challenge".  The Minister laughed and said it was a shame we
hadn't heard him talking on the radio that morning about people wasting
the Court's time.  He went on to outline some recent vexatious cases
taken against him (as Minister).  He said it was a great feature of our
country that everyone has such easy access to the courts.

Mags said that the proposed system would replace the flaws of the
all-paper system with even greater flaws arising from lack of
trustworthiness, and that it would be better to have no e-voting than to
have a system the public couldn't trust.  The Minister said that public
trust was always lost when specialists made criticisms of a system, and
so the system was being tested further.  There followed some discussion
of the distinction between "trusted" and "trustworthy", which broke down
in laughter when Colm said "I can prove that you can't prove it's
accurate".

I said that the Department officials appeared to believe that once more
testing was performed, the system would become trustworthy.  I said that
we didn't agree with this belief.  I added my opinion that the
Department would eventually realise that testing cannot solve the
problem of needing to show that the system deployed is equivalent to the
system tested; especially in a charged political atmosphere.

The Minister said that he was pleased that we had established "a more
open line of communication", and closed the meeting.

---------------------------------------------------
UNALLOYED TRUTH / SUBJECTIVE OPINION SEPARATION BAR
---------------------------------------------------

Dick Roche is a very personable and friendly Minister who shows every
sign of intelligence and energy.  Occasionally his quick and firm
responses suggest that political considerations have forced his attitude
to a given issue, but otherwise he is hard to read.

He claims to have read the entire CEV report, which would have been
implausible if said of the average Minister but is quite believable in
Roche's case.  It is difficult, however, to reconcile this with his
apparent belief that there are no serious problems with the system, and
that the more disturbing sections of the CEV report are somehow
cancelled out by the other, less critical, appendices.

The Minister's language is filled with some depressingly familiar
themes:- conspiracies; the idea that the risks of the system are merely
theoretical; the belief that the system has passed its tests; the belief
that the problem with the system is one of public confidence alone; VVAT
as vote receipts; the potential for discrepancies as a reason to avoid
VVAT; a dread of paper apparently rooted in painful memories of long
recounts; a fixation with accidentally-spoiled paper ballots; the belief
that the opinion of an elections expert trumps the opinion of an IT
expert in any elections-related IT matter; and a constant comparison of
the Nedap/Powervote system with the all-paper system instead of with any
VVAT e-voting system.

It seems inescapable that Roche is working largely off Cullen's notes
and the various briefs prepared for Cullen.  It is probably too much to
hope for that he knows how much BS is in those notes and that he was
only trying them out on us: it's much more likely (unfortunately) that
he has really joined the Powervote reality-distortion field.

The good news is that he was willing to talk to us, which implies that
he is willing to challenge his Department's incorrect assertions.  The
bad news is that his language on closing the meeting ("we have opened a
line of communication") - coupled with his absolute refusal to consider
a consultation with IT people - implies that we probably won't be seeing
him again, and that the Department will simply use the fact of this
meeting to pretend that they have addressed all of our concerns.

The timing of the meeting was very strange.  On the one hand, the
Minister often seemed to be filling the time with anecdotes and
tangential discussions; on the other, we were allowed twice the time
that had been arranged in advance.  In the end, we neither completed our
agenda nor examined any of the really contentious issues in any depth.

It seemed to me that the Minister and his officials were trying to give
us the impression that they are taking neither us nor our concerns
seriously.

I'm sure the remark about a High Court challenge was taken seriously
despite Roche's cheery contempt.

We did not anticipate that the Minister would seriously believe that the
CEV report was anything other than a damning book of evidence.  We are
left once again to wonder whether he actually believes his press release
or if it's all put on for our benefit.

The Minister several times returned to the topic of how bad the paper
system was and how much misery it caused because of spoiled or disputed
ballots.  Whether he eventually understood that a VVAT wouldn't have
spoiled/disputed ballots, or he just tired of repeating the topic, I
couldn't say.

Colm's carefully drawn distinction between auditing and testing seemed
to go right over their heads - they were distracted by the technical
details of integer overflow.

I say "we" a lot in this summary when I can't remember who made the
point in question.

I later regretted interrupting Colm's tirade against Powervote's
unprofessionalism.  It only seemed to undermine the point he was making,
and it probably broke his rhetorical stride too.

I don't know who Official L was trying to convince by reading the spin
phrases about the CEV report.  Perhaps the Minister?  It had a kind of
surreal nature, like Monty Python's dead parrot sketch.  "Look, this
system is dead!"  "Nah, nah, it just needs more testing."

The Minister kept using the word "conspiracy".  I think his briefing
officials must have described us as a bunch of conspiracy nuts.

Official R smirked a lot when telling us our VVAT schemes wouldn't work.
He didn't actually say why any of them wouldn't work.  The
put-it-in-a-ballot-box method, which we had clearly distinguished from a
vote-receipt method, he eventually dismissed as "receipts" without
further comment.  He simply interrupted the description of the Mercuri
method as soon as "presiding officer" was mentioned, saying that the
procedure seemed to grow ever more complex (as if we were shifting the
goalposts).  He didn't return to the topic when it was pointed out that
the same procedure (mutatis mutandis) exists involving the presiding
officer in the all-paper system; he simply mocked us, saying "when you
have a problem in one method, you come up with another, then when
there's a problem with that, you've got another, and so on!".  I don't
recall him saying anything at all when the optical-scan method was
discussed.  I suppose we should have told him off for this, but we were
in a constant rush to get on to the next thing, always fearing that the
meeting was about to be over.

I have a hard time believing the Minister was being entirely straight
with us in claiming that the VM display "stores" the vote.

Any flaws in the system that are mentioned in the CEV appendices seemed
to be dismissed by the officials (and by the Minister) on the basis that
the appendices are full of contradictions.  This is not of course an
excuse for denying the whole factual record, but again we failed to
pause and flame.

By "charged political atmosphere" I meant a situation of massive public
distrust in the Government of the day and the election officials
appointed by it, such as in Ukraine, Venezuela, and the US.  It isn't
unthinkable that Sinn F?in may be in Government in this country within
the lifetime of the Electoral (Amendment) Acts, 2001 and 2004; who would
bet against there being widespread distrust in the integrity of whatever
system is deployed in the next following election?

We never got back to the presentation after the Minister's interruption,
by the way.  For that matter, we missed a lot of agenda items too.

END