NIST Roles: Help America Vote Act Past, Present and Future

1
NIST Roles Help America Vote Act Past, Present
and Future

• Dr. Susan Zevin, Acting Director
• NIST Information Technology Lab
• National Association of Secretaries of State
• Winter Meeting February 16, 2004

2
Agenda

• Historic NIST Strengths in Standards Setting.
• Decision to Support HAVA
• Near-term Benefits to the Election Community
• Near term Benefits to all Voters
• Potential Timeline for future NIST HAVA
  Implementation

3
1901 National Bureau of Standards (NBS) Begins
to Assist States with Standards

• Industrialization Urbanization Brought A Search
  for Order
• NBS A Federal Partner to State regulatory
  Agencies
• Ohio Machine Parts needed to fit with New York
  Machine Parts
• 1 gallon in Maine1 gallon in Georgia (?)
• Commercial transactions depended on accurate
  weights measures

4
Today, NIST Still Works Closely with
Customers and Stakeholders

• NIST Laboratory work emphasizes partnerships
• Voluntary consensus standards and guidelines
• Driven by user community
• Cooperative research agreements with other
  agencies, universities, and industry
• Laboratory accreditation
• Expert advice to government agencies and others
• Contracts, grants, collaborative research
• Consortia and standards development organizations

5
Why NIST and HAVA ?

• An Opportunity to advance measurement science
  applied to Information Technology
• An Opportunity to Assist State Local
  Governments in securing their computer systems
• A Role as a Neutral Objective 3rd Party for
  Vendors
• An Opportunity to Apply NIST tools in
• Laboratory Accreditation
• Software Quality and testing
• Computer forensics

6
NIST Pre- HAVA Implementation

• Research and Write Human Factors Report
• Interactions with Election Community
• Initial review of Computer Security Issues
  Relevant to Voting Systems
• Advance Work Prior to Initiation of an ISO 17025
  Accreditation Process for Independent Testing
  Authorities

7
December Symposium Consensus Issues

• Need Good Procedures Best Practices -Physical
  Cyber Security - Usability and Accessibility
• Raise the Bar on Testing Certification
• Keep it Simple for Voter, Poll Worker, and
  Election Officials

8
December Symposium Consensus Issues

• NIST has a potential to assist states assure
  practical, secure elections, with every vote
  being important.
• It is important to look at the system end-to-end.
  
• We need to separately address both short-term and
  long-term challenges.
• We (the election community) need to work
  together.

9
Moving to the Next Level ?

• America cannot afford another election in which
  there is widespread mistrust of the result.
  There should be bipartisan support for fully
  financing the Help America Vote Act, and for
  picking up the pace of reform.New York Times
  Editorial 2/9/2004

10
Significant Challenges

• Moving forward with Human Factors Report
  recommendations
• Applying FIPS standards to state voting Systems
• Secure Protocols for Wireless transmissions
• Improving Software Quality
• Implementing TGDC and Accreditation Program

11
What Could Be Done in the Next Six Months

• Spin Up New ISO 17025 Accreditation Process for
  Independent Testing Authorities
• Begin Development of Conformance Tests for Voter
  verifiable Audit Trail
• Review of 1990/2002 Voting System Standards
  -Identify Priorities
• Spin Up TGDC- Hold Public Meetings

12
What Could Be Done in the Next Six Months

• Perform Risk Analysis of Voting System

13
What Could Be Done in the Next Six Months

• Recommend cyber security guidelines from
  adaptation of existing guidelines

14
What Could Be Done in the Next Six Months

• Develop a viable tested security standards
  baseline to be incorporated into the VSS
• Recommend best practices for Securing Voting
  Systems to State and Local Officials
• Develop Computer Forensics Tool of known file
  signatures of commercial voting system software

15
What Could Be Done in the Next Six Months

• Obtain initial usability data
• Run a Pilot Test to determine usability testing
  procedures
• Assist State Election Directors Vendors to
  implement Human Factors Report Recommendations
• Begin to Develop Ballot Design Guidelines

16
What Could Be Done in the Next Six Months

• Recommend to State Local Officials -
  Usability Testing requirements from vendors in
  standard Common Industry Format -Evaluation by
  Usability professional of voting system with
  actual ballots, voters and poll workers -
  Interpretation of Vendors Usability Test Reports
  by A Usability Professional

17
- What Could Be Done in the Next Six Months

• Recommend to Vendors - Implementation of
  User-Centered Design Approach in their System
  Engineering Processto prepare for Usability
  testing - Documentation of Usability
  Evaluation Usability testing - Usability
  testing reports in Common Industry Format

18
Potential Future NIST Contributions to
HAVA Implementation

• Public Benefit
• Improved Voter Experience
• Improved Election Process

• Election Community
• IT Systems development, testing
• Security
• Measurements and Data
• Usability/ Accessibility
• Information Assurance

NIST expertise in measurements, standards, and
data lead to - Partnerships - Accuracy -
Technical excellence - Reliability -
Objectivity - Improved Performance
19
Status Updates

• NIST Symposium CDs sent to Attendees
• Future NIST HAVA Activity Updates Available on
  the Web Sitehttp//vote.nist.gov
• Questions?