Feasibility of a Voting Machine Test Suite

8/16/2016

Table of Contents

• Executive Summary
• Preliminary Requirements Analysis
• Feasibility
• Success Criteria
• Cost Estimates
• Risk Analysis
• Conclusion

Executive Summary

In the course of the 2016 elections, certain candidates have expressed concern about voter fraud. Although voting machines are currently built according to voluntary certifications and tested by accredited laboratories, these processes do not take into account the social and administrative factors involved in running a voting precinct. Therefore, a field testing suite has been proposed to get a fuller understanding of the entire voting architecture.

For reasons explained in the following report, it is currently infeasible for the Election Assistance Commission to move forward with this project.

Preliminary requirements analysis

There have been various demonstrations of weaknesses in the security of current voting systems, primarily in labs. The Election Assistance Commission has the opportunity to demonstrate the security or lack thereof of voting systems in the field. To that end, a set of tools and procedures could be developed to test various polling locations nationwide.

Depending upon how the suite is designed to be used, its implementation will likely require extensive cooperation from state governments where the suite is used. It may also require legislation from congress.

Feasibility

The testing suite will need to work with many different voting machines. Beyond a basic plan, there is uncertainty on whether any work can be reused between them. Also, the suite will need to be flexible enough to incorporate new machines as they are produced. Beyond these problems, the development of the suite should be possible with standard computer security techniques.

There will likely be legality problems with testing the security at the actual polling places and times. The only way around this is likely a change in laws passed at the federal and possibly even state levels. Due to the current gridlock in congress and the varying makeups of state governments, it is very unlikely that the EAC will be able to deploy the testing suite with any sort of uniformity nationwide.

The EAC likely does not have the financial flexibility to support this project. With its budget of ten million dollars already being used for other important and required functions, and with congress unlikely to allocate more money in the foreseeable future, it is highly unlikely the EAC will be able to find the money for a new major project. As it is the EAC is only capable of supporting about 30 full time equivalent workers

Success criteria

Versatility

• The test suite must be compatible with all currently used voting machines
• The test suite must be adaptable to the different types of locations and setups of polling places

• The testing suite must be flexible enough to adapt to new types of voting equipment

• The results of the security tests must clearly describe any vulnerabilities so they can be monitored and fixed

Cost Estimates

If the EAC goes forward with this project, I do not foresee any major capital costs. Instead, the major cost will be labor. Some of this work can likely be handled by existing employees. This could have a negative impact on their other responsibilities.

It is unlikely that existing workers can handle the increase in tasks by themselves, so new full and part time workers will need to be hired. This could cost a significant amount of money depending on wage rate and how many people end up being hired.

Risk Analysis

The major risk of using a testing suite on the actual election infrastructure is that a bad actor could use the tools to commit election fraud. This could be mitigated by redoing all the polls in locations that were tested. There are major downsides to that solution though, as it would be very burdensome on governmental resources and would almost certainly decrease final voter turnout.

Conclusion

In this researcher's opinion, a field based testing suite would be highly infeasable. There would be major obsticals in legality, coordination, and monetary cost. In return there would be a minimal improvement over current labratory and specification based testing.

If a large amount of political will to complete this testing program manifests itself uniformly across the United States, the EAC could move forward with this project.

I reccomend scrapping this project and looking into other ways to improve current testing.