New York to CIBER, EAC: "hides their soiled laundry."

[WillYourVoteBCounted]

For public distribution emphasis in bold is mine

Best quote:

"the EAC and the unaccredited testing lab are refusing to open
the curtain that hides their soiled laundry."

From: Doug Kellner
Sent: Wednesday, January 24, 2007 12:46 AM
Subject: New York, Ciber and the EAC


On January 4, 2007, the New York State Board of Elections voted to suspend
Ciber from further testing of voting systems submitted to the New York State
board for certification pending a thorough review of Ciber's accreditation
status. We also addressed requests to both the Election Assistance
Commission and to Ciber for all of the relevant documents and reports
concerning Ciber's application to the EAC for accreditation as a testing
laboratory.

Much to our surprise (well, maybe I'm not really surprised), EAC has still
not provided any of the background documentation that we have requested.
While giving lip service acknowledgement of our request, Tom Wilkey, now
Executive Director of the US EAC and former Executive Director of the New
York State Board of Elections, has completely stonewalled us. The New York
State board felt compelled to make a formal Freedom of Information Act
request. Mr. Wilkey's only response so far is that the EAC is reviewing the
issue and is deciding how to respond.

This failure to provide relevant information to a state agency, the first in
the country to require testing to the 2005 standards, is truly outrageous
and scandalous. Not only does it further delay New York's efforts to come
into compliance with the Help America Vote Act, it seriously prejudices the
five voting system vendors who have made such a substantial investment in
trying to obtain certification to the rigorous standards set by New York.
In addition to requiring compliance with VVSG 2005, New York law requires a
voter verifiable paper audit trail, prohibits devices or functionality
potentially capable of internet, radio or wireless data communication,
requires escrow of all software including source codes and authorizes
disclosure in court proceedings; our regulations require full disclosure of
all political contributions by vendors and their executives and set several
other standards that are more rigorous than the VVSG.

While there is general agreement at the New York State Board that we should
be looking to the EAC to assist and guide us in our investigation, we also
made a formal request to Ciber for the same information. After all, they do
hold a $3 million contract from our agency. There has been nothing but
similar stonewalling from Ciber. Ciber's last communication regarding our
information request was that they were trying to co-ordinate a response with
the EAC.

What's going on here? Both the EAC and the unaccredited testing lab are
refusing to open the curtain that hides their soiled laundry. Co-ordination
of the response suggests that we are only going to receive a laundered
version of the facts.

I have also become increasingly annoyed with Ciber's use of the label
"confidential competition-sensitive" on reports that they have prepared for
our agency at our expense. You may recall that in November I circulated for
comments Ciber's first draft of their report to explain New York's
interpretation of the exceptions to the exemption from testing of Commercial
Off the Shelf (COTS)software that is used in the voting machine itself as
opposed to election management software that does not generate code used in
the actual voting process. (Yes, "exception to the exemption" is a double
negative that means that the COTS source code must be tested in those
cases.)

Ciber was apparently miffed that I dared to subject the advice that they
furnished to New York to public scrutiny. They added the "confidential
competition sensitive" label to the second draft. I objected and requested
that they remove the label. Ciber said they'd think about it, but ignored my
request. When I received the final document that had been approved by both
Ciber and our independent security review consultants, New York State
Technical Enterprise Corp. (NYSTEC), I insisted that I be allowed to make
the document public. Ciber balked. When I renewed what had become demands,
Ciber's attorney-yes their attorney-revised the technical report that the
"experts" at Ciber and NYSTEC had determined to be final and said that he
would not object to release of that report. (I have distributed that
report, known as COTS Testing Version 4 to many). I then asked for an
explanation why Version 3, the "final" report was still labeled
confidential. I also gave formal notice that I would ask the commissioners
to release the report. Last night Ciber's in-house attorney wrote me that
he agreed that there was nothing in the "final" report that was properly
labeled competition sensitive. The New York commissioners voted the make
the Version 3 "final" COTS report public today. I will send copies of
Version 3 to the technical blogs and anyone else who requests it. I am
still distressed, however, at Ciber's efforts to stiffle discussion of the
issue by improperly claiming confidentiality.

At today's meeting of the New York State elections commissioners, while
everyone deplored the stonewalling by EALC and Ciber, I requested authority
to issue a subpoena to Ciber for all of the documents that we have
requested. Republican Commissioner Helena Donohue blocked the subpoena by
arguing that we should give Ciber additional time to respond to our request
voluntarily. She said that she would reconsider issuing a subpoena at our
next meeting scheduled for February 7.

In view of the collaboration between the EAC and Ciber, I am determined that
we should not accept partial disclosure. New York should take a stand to
end the veil of secrecy that shrouds the testing process.

Douglas A. Kellner
Co-Chair
New York State Board of Elections

[troubleinwinter]

1. K & R!!!!!

[BeFree]

2. Can't trust any of the Feds

The EAC is hiding behind a curtain and all the election system people are behind the EAC, behind that curtain. Gawd, it must be getting stinky back there.

K&R