Independent Testing Authority

An Independent Testing Authority (ITA) is a laboratory certified by the United States–based National Association of State Election Directors (NASED) to test voting systems to the Voting System Standards (VSS) or the Voluntary Voting System Guidelines (VVSG) in the process of certifying voting systems. The Election Assistance Commission has taken over the responsibility for accrediting such laboratories and now uses the National Institute of Standards and Technology's National Voluntary Laboratory Accreditation Program. Under the EAC process, ITAs are now known as Voting System Testing Laboratories (VSTLs).

In 1990, the Federal Election Commission (FEC) established national standards for testing voting equipment, which did not exist prior to that year. However, these standards only tested system performance during extreme temperatures and the claims of the equipment manufacturers, exempting commercial off-the-shelf software. Revised standards were published in 2002, 2005 and 2007, but voting machines that were used during the 2008 elections were certified based on the 1990 and 2002 standards. As of 2008, the federal standards are considered voluntary, and states are not required to adopt them.^[1]

The FEC authorized NASED to choose which organizations would independently test voting equipment. NASED claimed in 2004 that the ITAs "have neither the staff nor the time to explain the process to the public, the news media or jurisdictions."^[2] The labs have been private companies that are funded by the voting machine vendors to test their equipment, which gives the vendors control over testing.^[3] In 2002, the Help America Vote Act required the labs to be federally certified.^[4] The Election Center, a non-profit based in Houston, Texas, worked alongside NASED on testing,^[1] in particular on certifying testing labs and tracking voting equipment approvals.^[5] Until Autumn 2003, voting equipment manufacturers informed NASED when testing labs approved their equipment. Neither NASED nor the Election Center followed up on inspecting the testing labs after they were accredited, citing a lack of resources. NASED also did not review contracts between the testing labs and voting equipment companies.^[5]

In 2004, there were three authorized ITAs:^[3] Wyle Laboratories (starting in 1994^[3]), Ciber (starting in 1997^[4]), and SysTest (starting in 2001^[3]). By 2008, this list expanded to include iBeta Quality Assurance and InfoGard Labs.^[1] By 2021, there were only two: Pro V&V and SLI Compliance.^[6]

Methodology

Controversies and criticism

The labs have been criticized for secretive behavior. In August 2004, the Associated Press reported that the three labs who were authorized at the time have refused to discuss their work, including issues with electronic voting machines, citing non-disclosure agreements with the voting equipment vendors.^[2] Critics have accused those labs of not having enough resources for their work, including cybersecurity knowledge. Thomas Wilkey, the former chair of NASED's voting systems board, blamed this secretive behavior on the FEC deferring choice of the testing labs and the federal government not paying for testing.^[2]^[3] Both the testing process and testing results by the labs are considered proprietary.^[5]

Wired reported in November 2004 that there is little communication between state officials and testing labs, and no processes for connecting voting systems back to the labs that reviewed them; for requiring vendors to fix their equipment; or for information about equipment issues to be shared more broadly with local election officials. Lab tests at the time took 3-6 months, and during this time frame, voting system vendors could have repeatedly changed their software through upgrades or patches, so states had no guarantee that the software that was tested was the same as the software on the deployed voting machines.^[3]

Investigations by academic researchers and several states evidenced that voting equipment approved by the testing labs had major security vulnerabilities.^[3]^[5]

In 2004, Douglas W. Jones also criticized source code reviews for focusing more on coding conventions than security by design.^[3]

Michael Ian Shamos testified to the House of Representatives in June 2004 that the process "testing and certifying voting equipment in this country is not only broken, but is virtually nonexistent".^[2] A 2003 whistleblower who formerly worked at a voting machine company compared the labs to Arthur Andersen.^[7]

Two labs had their accreditation suspended by the EAC in the late 2000s, Ciber and SysTest, citing little testing documentation and a lack of quality assurance testing in both cases.^[1]

Independent Testing Authority

Methodology

Controversies and criticism

References

Related Articles