After EFF Litigation, Diebold Pulls Out of North Carolina

Raleigh, North Carolina - After a series of lawsuits led by the Electronic Frontier Foundation (EFF) to defend North Carolina's election integrity laws, controversial electronic voting machine manufacturer Diebold Election Systems finally withdrew from the state's voting machine procurement process on Thursday.

In November, Diebold filed suit against the North Carolina Board of Elections to try to avoid a state requirement that vendors place into escrow all source code "that is relevant to functionality, setup, configuration, and operation of the voting system." Under a strong new state law, this code is to be available to the Board of Elections and the chairs of the state political parties for review so that they could look for security vulnerabilities. EFF intervened in the case on behalf of local voter integrity advocate Joyce McCloy and succeeded in convincing the judge to dismiss the case and require Diebold to comply.

Despite Diebold's open admission that it could not meet the state requirements for voting machine integrity, the Board of Elections later agreed to certify Diebold. EFF filed suit against the Board of Elections last week, arguing that the Board had violated its own obligations to perform extensive security-related tests of all of the code on all certified systems prior to certification. The court denied EFF's motion, but Diebold was nonetheless forced to withdraw from the North Carolina procurement process because it did not escrow its code.

In a letter to the Board of Elections on Thursday, Diebold indicated that it is still unwilling to comply with the law. Instead, it offered to help the state "revise" the law so that "all vendors will be able to comply with the state election law."

"The purpose of election integrity law is to ensure that votes are accurately counted, not to ensure that all equipment vendors can comply," said Matt Zimmerman, EFF's Staff Attorney specializing in electronic voting issues. "The law requires voting machine transparency for good reason. All vendors must realize that the public will not and should not accept a process that forces them to simply trust, but not verify, their votes are accurately counted."

By withdrawing from North Carolina's electronic voting contract, Diebold cedes the market to competitor ES&S. The rival company has stated that it will comply with all state escrow requirements.

Contacts:

Cindy Cohn
Legal Director
Electronic Frontier Foundation
cindy@eff.org

Matt Zimmerman
Staff Attorney
Electronic Frontier Foundation
mattz@eff.org

Posted at 01:32 PM

----------------------

GENERAL ASSEMBLY OF NORTH CAROLINA

SESSION 2005
SENATE BILL 223
RATIFIED BILL
 

AN ACT TO RESTORE PUBLIC CONFIDENCE IN THE ELECTION PROCESS BY REQUIRING THAT THE STATE BOARD OF ELECTIONS, THROUGH THE DEVELOPMENT OF A REQUEST FOR PROPOSAL, ENSURE THAT ALL VOTING SYSTEMS GENERATE EITHER A PAPER BALLOT OR A PAPER RECORD BY WHICH VOTERS MAY VERIFY THEIR VOTES BEFORE CASTING THEM AND WHICH PROVIDES A BACKUP MEANS OF COUNTING THE VOTE THAT THE VOTER CASTS; BY PROVIDING STATUTORY GUIDANCE AS TO COUNTING; BY STANDARDIZING PURCHASING OF VOTING SYSTEMS IN NORTH CAROLINA, INCLUDING A REVIEW OF SOURCE CODE FOR SOFTWARE RELATED TO THOSE VOTING SYSTEMS AND AUTHORIZATION TO ESTABLISH THE ROLE OF THE STATE BOARD OF ELECTIONS AND COUNTY BOARD OF ELECTIONS RELATED TO TRAINING AND SUPPORT OF VOTING SYSTEMS; BY REQUIRING POSTELECTION TESTING OF VOTING SYSTEMS, INCLUDING A PAPER SAMPLE?COUNT; BY EXPANDING THE RIGHT TO A HAND?TO?EYE RECOUNT OF PAPER BALLOTS; AND BY PERMITTING A PILOT PROGRAM TO EXPERIMENT WITH NONPAPER MEANS OF VOTER VERIFICATION AND BALLOT BACKUP.

 

The General Assembly of North Carolina enacts:

 

SECTION 1.(a)  Effective August 1, 2005, and applicable to any voting systems upgraded or acquired on or after that date and to all voting systems used in the State during any election during or after 2006, G.S. 163?165.7 reads as rewritten:

"§ 163?165.7.  Voting systems: powers and duties of State Board of Elections.

(a)       The State Board of Elections shall have authority to approve types, makes, and models of voting systems for use in elections and referenda held in this State. Only voting systems that have been approved by the State Board shall be used to conduct elections under this Chapter, and the approved systems shall be valid in any election or referendum held in any county or municipality. The State Board may, upon request of a local board of elections, authorize the use of a voting system not approved for general use. Only voting systems that have been certified by the State Board of Elections in accordance with the procedures and subject to the standards set forth in this section and that have not been subsequently decertified shall be permitted for use in elections in this State. Those certified voting systems shall be valid in any election held in the State or in any county, municipality, or other electoral district in the State. Subject to all other applicable rules adopted by the State Board of Elections and, with respect to federal elections, subject to all applicable federal regulations governing voting systems, paper ballots marked by the voter and counted by hand shall be deemed a certified voting system. The State Board of Elections shall certify optical scan voting systems, optical scan with ballot markers voting systems, and direct record electronic voting systems if any of those systems meet all applicable requirements of federal and State law. The State Board may certify additional voting systems only if they meet the requirements of the request for proposal process set forth in this section and only if they generate either a paper ballot or a paper record by which voters may verify their votes before casting them and which provides a backup means of counting the vote that the voter casts. Those voting systems may include optical scan and direct record electronic (DRE) voting systems. In consultation with the Office of Information Technology Services, the State Board shall develop the requests for proposal subject to the provisions of this Chapter and other applicable State laws. Among other requirements, the request for proposal shall require at least all of the following elements:

(1)       That the vendor post a bond or letter of credit to cover damages resulting from defects in the voting system. Damages shall include, among other items, any costs of conducting a new election attributable to those defects.

(2)       That the voting system comply with all federal requirements for voting systems.

(3)       That the voting system must have the capacity to include in precinct returns the votes cast by voters outside of the voter's precinct as required by G.S. 163?132.5G.

(4)       With respect to electronic voting systems, that the voting system generate a paper record of each individual vote cast, which paper record shall be maintained in a secure fashion and shall serve as a backup record for purposes of any hand?to?eye count, hand?to?eye recount, or other audit. Electronic systems that employ optical scan technology to count paper ballots shall be deemed to satisfy this requirement.

(5)       With respect to DRE voting systems, that the paper record generated by the system be viewable by the voter before the vote is cast electronically, and that the system permit the voter to correct any discrepancy between the electronic vote and the paper record before the vote is cast.

(6)       With respect to all voting systems using electronic means, that the vendor provide access to all of any information required to be placed in escrow by a vendor pursuant to G.S. 163?165.9A for review and examination by the State Board of Elections; the Office of Information Technology Services; the State chairs of each political party recognized under G.S. 163?96; the purchasing county; and designees as provided in subdivision (9) of subsection (d) of this section.

(7)       That the vendor must quote a statewide uniform price for each unit of the equipment.

(8)       That the vendor must separately agree with the purchasing county that if it is granted a contract to provide software for an electronic voting system but fails to debug, modify, repair, or update the software as agreed or in the event of the vendor having bankruptcy filed for or against it, the source code described in G.S. 163?165.9A(a) shall be turned over to the purchasing county by the escrow agent chosen under G.S. 163?165.9A(a)(1) for the purposes of continuing use of the software for the period of the contract and for permitting access to the persons described in subdivision (6) of this subsection for the purpose of reviewing the source code.

In its request for proposal, the State Board of Elections shall address the mandatory terms of the contract for the purchase of the voting system and the maintenance and training related to that voting system.

No voting system acquired or upgraded by a county before August 1, 2005, shall be used in an election during or after 2006 unless the county can demonstrate to the State Board of Elections compliance with the requirements in subdivisions (1) through (8) of this subsection, where those requirements are applicable to the type of voting system involved.

(b)       The State Board may also, upon notice and hearing, disapprove decertify types, makes, and models of voting systems. Upon disapproving decertifying a type, make, or model of voting system, the State Board shall determine the process by which the disapproved decertified system is discontinued in any county. If a county makes a showing that discontinuance would impose a financial hardship upon it, the county shall be given up to four years from the time of State Board disapproval to replace the system. A county may appeal a decision by the State Board concerning discontinuance of a voting system the process by which the decertified system is discontinued in that county to the superior court in that county or to the Superior Court of Wake County. The county has 30 days from the time it receives notice of the State Board's decision on discontinuancethe process by which the decertified system is discontinued in that county to make that appeal.

(c)       Prior to certifying a voting system, the State Board of Elections shall review, or designate an independent expert to review, all source code made available by the vendor pursuant to this section and certify only those voting systems compliant with State and federal law. At a minimum, the State Board's review shall include a review of security, application vulnerability, application code, wireless security, security policy and processes, security/privacy program management, technology infrastructure and security controls, security organization and governance, and operational effectiveness, as applicable to that voting system. Any portion of the report containing specific information related to any trade secret as designated pursuant to G.S. 132?1.2 shall be confidential and shall be accessed only under the rules adopted pursuant to subdivision (9) of subsection (d) of this section. The State Board may hear and discuss the report of any such review under G.S. 143?318.11(a)(1).

(d)       Subject to the provisions of this Chapter, the State Board of Elections shall prescribe rules for the adoption, handling, operation, and honest use of certified voting systems, including, but not limited to,including all of the following:

(1)       Procedures for county boards of elections to utilize when recommending the purchase of a Types, makes, and models of certified voting systems approved system for use in this Statethat county.

(2)       Form of official ballot labels to be used on voting systems.

(3)       Operation and manner of voting on voting systems.

(4)       Instruction of precinct officials in the use of voting systems.

(5)       Instruction of voters in the use of voting systems.

(6)       Assistance to voters using voting systems.

(7)       Duties of custodians of voting systems.

(8)       Examination and testing of voting systems in a public forum in the county before and after use in an election.

(9)       Notwithstanding G.S. 132?1.2, procedures for the review and examination of any information placed in escrow by a vendor pursuant to G.S. 163?165.9A by only the following persons:

a.         State Board of Elections.

b.         Office of Information Technology Services.

c.         The State chairs of each political party recognized under G.S. 163?96.

d.         The purchasing county.

Each person listed in sub?subdivisions a. through d. of this subdivision may designate up to three persons as that person's agents to review and examine the information. No person shall designate under this subdivision a business competitor of the vendor whose proprietary information is being reviewed and examined. For purposes of this review and examination, any designees under this subdivision and the State party chairs shall be treated as public officials under G.S. 132?2.

(10)     With respect to electronic voting systems, procedures to maintain the integrity of both the electronic vote count and the paper record. Those procedures shall at a minimum include procedures to protect against the alteration of the paper record after a machine vote has been recorded and procedures to prevent removal by the voter from the voting enclosure of any paper record or copy of an individually voted ballot or of any other device or item whose removal from the voting enclosure could permit compromise of the integrity of either the machine count or the paper record.

Any rules adopted under this subsection shall be in conjunction with procedures and standards adopted under G.S. 163?182.1, are exempt from Chapter 150B of the General Statutes, and are subject to the same procedures for notice and publication set forth in G.S. 163?182.1.

(e)       The State Board of Elections shall facilitate training and support of the voting systems utilized by the counties."

SECTION 1.(a1)  G.S. 163?166.7(c) reads as rewritten:

"(c)      The State Board of Elections shall promulgate rules for the process of voting. Those rules shall emphasize the appearance as well as the reality of dignity, good order, impartiality, and the convenience and privacy of the voter. Those rules, at a minimum, shall include procedures to ensure that all the following occur:

(1)       The voting system remains secure throughout the period voting is being conducted.

CONTINUED:

http://www.ncleg.net/Sessions/2005/Bills/Senate/HTML/S223v6.html