Viewing a single comment thread. View all comments

TheOfficialACM OP t1_itqusk8 wrote

Reply to comment by PaulSnow in I am the co-author behind ACM’s TechBrief on Election Security: Risk-limiting Audits. Ask me anything about election security! by TheOfficialACM

The current business model of elections is that the vendors have no requirements for open source, but they do have the requirement that their systems are subject to certification and testing. The certification process requires the vendors to share their source code with the testing labs.

For what it's worth, there have been a number of attempts at doing an open source voting system that could be commercially viable in the U.S. market, but none of them have achieved significant market share to date, except perhaps the Los Angeles VSAP system, but the source code isn't actually open yet (article from 2018, but I don't think anything has changed since then).

(I do consulting with another open source vendor, VotingWorks.)

30

PaulSnow t1_itrgk17 wrote

Hence require open source. It isn't about being commercially viable, if not providing an open source product means it isn't commercially viable.

9

TheOfficialACM OP t1_itrlcw4 wrote

Here's a more concise way to put it: I would prefer if we did not have trade secrets in elections. Let the vendors copyright and/or patent their stuff, but the source code should be open to public inspection. This isn't about security, per se, as much as it's about transparency. If you want to get nerdier about it, it's also about publicly verifiable reproducible builds, which has ramifications for security and transparency.

15

PaulSnow t1_itrmgg9 wrote

In this case, transparency is security (more review) and verifiable reproducible builds is a given.

[in addition, ] Open source hardware is a critical component here.

Edit: *Added "in addition"

5