joegratz.net

Sure, I live in San Francisco now, but I grew up in the great state of Wisconsin — and today, Governor Jim Doyle made me proud of my Wisconsin roots. He signed into law Assembly Bill 627 [Ed: See update below.], mandating a voter-verified paper audit trail for all Wisconsin voting machines and requiring that municipalities disclose the source code of the software that runs the machines.

The law is somewhat inartfully phrased, since “[t]he coding for the software” is not a technologically unambiguous synonym for source code, but the remainder of the provision — specifying that it’s referring to that which “may be used to independently verify the accuracy and reliability of the operating and tallying procedures to be employed at any election” — probably gets rid of any ambiguity.

UPDATE, 6 January 2006: My sources pointed to the wrong bill; it was substantially amended before passage. The enacted bill is here. Happily, it takes care of the “coding of the software” ambiguity, referring specifically to “vote−counting source code, table structures, modules, program narratives and other human−readable computer instructions used to count votes with an electronic voting system” — which is much, much better. Sadly, the requirement of truly open source code was removed, replaced with a code escrow requirement. In the event of a recount, each side gets to deisgnate some geeks to sift through the source, as long as the geeks “exercise the highest degree of reasonable care to maintain the confidentially of all proprietary information.” It’s not as good as requiring real open-source voting machines, but it’s probably enough to prevent serious chicanery, as long as there’s some mechanism to make sure the code submitted to the Board of Elections is really the software that’s running the machines on election day. Having the voting machine companies promise really hard doesn’t cut it, when — in security terms — they’re the attacker in this law’s threat model.