Security, Election Markup Language, and a President Supporting Free Long Distance

InfoWorld links to a new XML-based standard, Election Markup Language (EML) Version 5.0.

There was a related press announcement:

Boston, MA, USA; 24 January 2008 — OASIS, the international open standards consortium, today announced that its members have approved the Election Markup Language (EML) version 5.0 as an OASIS Standard, a status that signifies the highest level of ratification. Developed through an open process by the OASIS Election and Voter Services Technical Committee, EML supports information exchange through the complete election process, including candidate nomination, voter registration and authentication, ballot information, vote casting and confirmation, tabulation, auditing, and more.

"In the election industry today, there are many different election systems and a wide variety of components used for many different functions, so the need for easier integration of different system components has never been greater," said Dr. Ron Rivest, professor of Electrical Engineering and Computer Science at the Massachusetts Institute of Technology (MIT). "EML is an example of the kind of consensus-based, publicly available common format that enables the exchange of electronic records between different components in election systems."

Fair enough, provided that the vendors elect to use the standard. But this statement was a little interesting.

"By providing a uniform, secure, and verifiable way for voting systems to interact, EML safeguards voter confidence in the election process," said Patrick Gannon, president and CEO of OASIS.

Hmm...secure? InfoWorld's Jason Snyder notes that there is a security hole:

Focusing on the interfaces between components of election systems, what the standard doesn't answer for is the security of the systems themselves.

Per the document: "References to security within EML are not to be taken as comprehensive requirements for all election systems in all election scenarios, nor as recommendations or sufficiency of approach when addressing all the security aspects of election system design, implementation or evaluation. In fact, the data security mechanisms described in this document are all optional, enabling compliance with EML without regard for system security at all."

Not exactly a rousing vote of confidence for the standard's ability to ensure the integrity of election results.

In fact, there's another security issue involved in the standard - the nature of XML itself.

One of the primary benefits of XML is that it is easily readable.

One of the primary detriments of XML is that it is easily readable. This not only leads to larger files (I have given technical presentations which compare the length of the new proposed XML-based biometric exchange standard vs. the previous standard), but it also makes it somewhat easier for people to see data that perhaps they shouldn't see.

And, if the security options are not implemented, it makes it easier for people to modify data that perhaps they shouldn't modify.

As I may have mentioned in Twitter a time or two, the California primary (#caprimary) is coming up pretty soon. And there's a heck of a lot of people in California who know XML.

So if Woz gets all of the electoral votes from every party, don't be surprised.

[mrontemp business] | [mrontemp politics] | [mrontemp technology] | [mrontemp del.icio.us tags]

Sphere: Related Content