Sequoia To Publish Source Code For Voting Machines

cecille writes "Voting machine maker Sequoia announced on Tuesday that they plan to release the source code for their new optical-scan voting machine. The source code will be released in November for public review. The company claims the announcement is unrelated to the recent release of the source code for a prototype voting machine by the Open Source Digital Voting Foundation. According to a VP quoted in the press release, 'Security through obfuscation and secrecy is not security.'"

A step in the right direction

[betterunixthanunix]

More work needs to be done; in particular, the government should simply mandate that no proprietary software may be used in any voting machine that is actually used in an election. Hoping for these companies to volunteer their source code is just not enough, although I do applaud Sequoia for taking this step.

Who owns vote data?

[Pete Venkman]

The paper printout needs to be stored somewhere (maybe two or three different *somewheres*) so that if a question does come up after a vote, Sequoia can't say "Oh well, our warehouse leaked and those records were destroyed."

good step

[garynuman]

I'm one of "those people" who still requests a paper ballot due to not trusting diebold machines, this however is a big step in convincing me to trust the machines though, in the past electronic voting has been, to me at least, the equivalent of the board of elections refusing to disclose how exactly they count paper ballots, doing it in secret, and destroying the ballots afterward.... not exactly conducive to honest elections as far as I'm concerned...

Re:plan to

[CityZen]

My thought exactly. In fact, there's no way to trust vendor-supplied hardware on this account, or any hardware of reasonable complexity at all.

I still think there's only one sensible way to do voting:

1. Let the voter fill in an optical scan form.
2. Let lots of different interested parties scan the form.
3. Verify that all parties have the same count after every form.
4. Lock the forms away in case a recount is needed.

If there's only one party doing the counting, they can never be trusted.
Only by having every competing interest do the counting (with constant cross-checking) can a system be potentially trusted.
Even then, you have to have enough parties involved to avoid the possibility of collusion.

Combine this with a system like Punchscan.org to add privacy, and maybe you've got something.

Re:Why a delay?

[vlm]

I'd guess it's worries about patents, partners, and other politically related things.

The solution for Sequoia is pretty simple, write the fancy vote counting machine as an exact emulator of a 1928 IBM 301 tabulating machine, then overclock the emulation a wee bit. Nobody screws around with IBM's patent portfolio, and frankly an overclocked 301 is massive overkill for "counting votes".

http://en.wikipedia.org/wiki/Tabulating_machine [wikipedia.org]

It is really a very elegant solution. Admittedly, I will freaking fall out of my chair laughing if I download their source code and discover this is exactly what they did.

Re:plan to

[KillerBob]

Y'know, in Canada, we use this funky invention, called pen & paper for voting. You are given a ballot that clearly lists each candidate's name, their party affiliation, and has a white circle to the side. You make your mark in the circle of the candidate you want to vote for. If you mark more than one candidate, or if you mark outside of the circle, or make any kind of personally identifying mark on the ballot, your vote is considered spoiled and rejected. It's really idiot-proof, when you think about it... there's even a placard on display in the voting booths that shows examples of how to correctly mark the ballot, and what will cause your ballot to be rejected.

Each polling station has two members of staff, and will handle between 200-500 voters. At the end of polling day, those two will unseal the ballot box, and count the ballots. Each party has a right to have two representatives serve as scrutineers to make sure the count is done correctly. Once their count is completed, they report their count in to the returning officer for the electoral district. They then make arrangements to get the ballot box and its contents to the office of the RO. As the polling stations report in, their results are updated electronically with Elections, who can announce preliminary results. In cases where the count is close between candidates, a judicial recount is required, and candidats have the right to scrutinize the recount in order to make certain that it is done transparently and correctly. All the while, the anonymity of the vote is assured, because the ballot is rejected if it's personally identifiable. After the recount period, the returning officer will announce the official winner, which *usually* matches the preliminary results. It's an expensive way to do things (EC employs about 190,000 people during the average federal election), but we have our final and official results within days of polling day, not months.

Oh, and our elections are usually done in 36 days, not the year+ that American elections campaigns can take.

So yeah. If only there was a system where the vote could be verified efficiently, quickly, and while preserving the anonymity of the elector. Having a physical ballot where telling who the vote is for is idiot-proof, and where the candidates can oversee the ballot counting and have a right to contest a ballot that is invalid or miscounted... what a concept.

Re:Tag story "noshit".

[NotBornYesterday]

That makes about as much sense as anything I could think of. I thought they might be going with Linux on the optical scanners might be a cost-saving measure, and I figured that since they mostly seem to be a Microsoft shop, they might have more C# experience in-house than say, Java.

Their use of embedded Linux makes me wonder if their earlier refusals to release their code was legal. Not their C# stuff, or their DB schema or sql code, but if they took off-the-shelf Linux and resold it, aren't they at least required to make that source available along with any changes, if any, they made?

IANAL or GPL expert, just kind of wondering.