Philip Stark et al v. United States Election Assistance Commission

The U.S. Election Assistance Commission (EAC) was created in 2002 by the Help America Vote Act. One of its principal responsibilities is to develop federal voting system standards, known as the Voluntary Voting System Guidelines (VVSG), and to certify voting systems to those standards.  Since it began testing and certifying voting systems in 2006, the EAC has certified voting systems to outdated guidelines that were established in 2005, the VVSG 1.0. Although the EAC did approve a modified version in 2015, the VVSG 1.1, vendors still were allowed to certify against the older, outdated VVSG 1.0. In 2015, the EAC began developing an updated set of guidelines, termed VVSG 2.0.

The Help America Vote Act (HAVA) mandates a public-facing, stakeholder driven process to develop the VVSG, including the participation of voting system vendors, election officials, computer scientists, election advocates, and members of the public. The law requires the EAC to obtain input from technical experts (both on and off its official advisory boards) and directs the Technical Guidelines Development Committee (“TGDC”), which the National Institute of Standards and Technology chairs and manages, to provide initial recommendations. Prior to consideration for final adoption by the Election Assistance Commission, the EAC must first submit the VVSG to the EAC Standards Board and Board of Advisors for review, as well as solicit public comments and hold a public hearing on the record. To augment this process, the EAC established working groups, open to the public, vendors, election officials and other stakeholders, to help inform the development of the VVSG.

On February 7, 2020, the TGDC voted to recommend the draft VVSG 2.0 to the EAC’s Acting Executive Director. The EAC submitted the VVSG 2.0 for public notice and comment in March of 2020. Notice and comment on the VVSG 2.0 closed in June of 2020. On July 31, 2020, the EAC Standards Board voted to approve the VVSG 2.0.

In July of 2020, after closure of public notice and comment on the draft standards, an EAC official revealed that the Commission was holding regular, non-public meetings with the voting system manufacturers to consider changes to the proposed guidelines.  Free Speech For People tried to join these meetings to fulfill its mission to represent the public in the development of the guidelines, but was not permitted to participate  The meetings were not noticed or open to the public, nor were meeting materials made public.

In August of 2020, through a Freedom of Information request, Free Speech For People requested all communications between the EAC and vendors. The EAC failed to produce any documents for more than nine months. In April of 2021, Free Speech For People sued to obtain responsive records. The EAC began producing records shortly after the lawsuit was filed, which  revealed details of the back-door negotiations that resulted in significant modifications to the original language drafted for the VVSG 2.0.

On February 1, 2021, nine days before the scheduled vote to approve the VVSG 2.0, the EAC posted on its website the proposed final VVSG 2.0 and a redline showing many significant changes developed without any public scrutiny and that the Board of Advisors, the Standards Board, and the public had never even seen. These changes had all been made after the Board of Advisors and Standards Board reviewed and voted to approve what they understood to be a final draft of the VVSG 2.0.

In addition to weakening a requirement that would ban the inclusion of devices capable of connecting to the internet, the new version of the VVSG 2.0 included other substantive revisions that benefit the vendors such as: (i) removal of the requirement for all voting systems to provide data reports that account for all cast ballots and all valid votes at the termination of a given election; (ii) removal of a transparency requirement granting public access, without an explicit request, to any cryptographic End-to-End protocol submitted for certification, for open review for two years before it enters the voting system certification process; (iii) limitation of the logging requirement to record external connections or disconnections, to apply only to voter-facing devices, not  backend voting systems, during the activated voting state; (iv) removal of a standard for physical locks installed in voting machines; (v) removal of the requirement that all physical security countermeasures which are reliant on electrical power log incidents of power disruption; (vi) removal of the requirement that systems be expected to have a life span of 10 years; and (vii) removal of the ban on printing voting machine vendors’ advertisements on the ballot.

Wireless modems are used to transmit unofficial election results from the polling places to the county headquarters via the Internet, exposing the voting devices to remote attackers anywhere in the world.  Free Speech For People has been a leader in exposing this threat to our elections and this issue has attracted considerable press and public attention.

To learn more about Free Speech For People’s work to challenge the use of wireless modems in voting machines, read these blogs:

CHALLENGING FALSE ADVERTISING BY VOTING MACHINE VENDORS

On August 13, we won a significant victory before the US Election Assistance Commission (EAC). In January, we co-wrote a letter to the EAC which detailed evidence showing that Election Systems & Software (ES&S), the nation’s largest voting machine manufacturer, was deceptively marketing its DS200 voting machines that include wireless modems as federally certified by the EAC. In response to our letter, the EAC launched an investigation of the voting system and agreed with our findings. The EAC has now censured ES&S for the false claims, and is directing ES&S to recall all misleading marketing materials, in addition to notifying customers to inform them that the voting systems with modems are non-EAC certified.

Read More

LETTER URGING MICHIGAN ATTORNEY GENERAL TO INITIATE INQUIRY INTO ELECTRONIC VOTING MACHINE VENDOR’S MISREPRESENTATION OF INSECURE WIRELESS MODEMS

Free Speech For People issued a letter to Michigan Attorney General Dana Nessel urging her office to launch an inquiry into ES&S’s false claims about its DS200 ballot tabulators with wireless modems. Although ES&S frequently claims that its voting tabulators never connect to the internet, researchers have found multiple election systems visible on the internet. The letter further calls for the state to compel ES&S to remove the modems at no cost to the state or localities and consider judicial action if the vendor refuses to do so.

Read More