November 23, 2024

Response to ITIF Voting Report

[This post was written by David Robinson and me, based on our discussions with Alex Halderman, Joe Calandrino, and Ari Feldman.]

On Tuesday, the Information Technology and Innovation Foundation released a report on the possible role of paper trails in auditing elections conducted using DRE machines. The report contained a blend of reasonable and unreasonable claims, and careful and uncareful argumentation. A lay reader might come away from the report – entitled Stop the Presses: How Paper Trails Fail to Secure e-Voting – with the belief that the addition of paper trails to DRE voting machines makes them less secure than they are on their own. Such a belief would be incorrect.

As the report puts it at one point, “The addition of paper audit trails to DRE voting machines would simply convert our elections back to a paper ballot system.” The report dwells at remarkable length on the convenient appearance of extra ballots during Lyndon Johnson’s political career. But we know about that cheating today precisely because paper ballots, unlike many DRE vote tallies, can be independently recounted.

One could spend months arguing about what exact position emerges from the 19 pages of delicately drafted hedging that make up the body of this report. But the bottom line – contrary to the impression most readers will gather from the report – is that paper and electronic voting together are, if done right, better than either the best paper system or the best computerized system would be alone.

The ITIF report suggests that a situation in which the paper and electronic records don’t match would be a disaster, since authorities wouldn’t know which record to trust. But that’s a shortsighted view. Divergent paper and electronic records are a sure sign that something has gone awry during voting. In some cases, that sign lets officials make a reasonable judgment about which record is, under the specific circumstances of a given race, more likely to be trustworthy.

The real worst-case scenario isn’t divergent paper and electronic records – with their attendant litigation and political discord. The real worst case is an attack or error that never even comes to the attention of election officials or the public, because there isn’t an independent way of catching problems.

Why Don't NFL Teams Encrypt Their Signals Better?

Yesterday the National Football League punished the New England Patriots and their coach, Bill Belichick, for videotaping an opposing team’s defensive signals. The signals in question are used by coaches to tell their on-field defensive unit how to line up and which tactics to use for the next play. The coach typically makes hand signals and arm movements that the on-field players know how to interpret. (The offense also needs to send signals to players from the sidelines before each play, but they use radios.) The opposition gets an advantage if they know what play is coming, so they will try to figure out what the signals mean.

This is essentially a weak form of cryptography. The coaches apply a kind of encryption to translate the desired play into a ciphertext, which is a sequence of hand and arm movements. They transmit the ciphertext (by making the indicated movements) to the on-field players, who then decrypt it, recovering the original play that the coaches wanted to send. An adversary who can see the ciphertext is supposed to be unable to recover the original message.

I don’t know what systems NFL teams use, but Belichick and the Patriots apparently thought they had a chance of breaking their opponents’ code.

There’s an interesting technical problem here: how to encrypt defensive plays into sideline signals securely, in a way that’s practical for real coaches and players in a game situation. I can think of at least one solution that is secure and practical. (Exercise for geeky readers: How would you do this?)

You might think that any solution would be too complicated for a mere football player to decode. If you think that, you’re underestimating the players involved. NFL defensive captains already cope with complex information and plans, and their teams’ current signaling systems already require decoding of symbols. Clever solutions can be pretty simple.

Crypto applies not only to designing a team’s signals, but also to analyzing rivals’ signals. Who will be the first NFL team to hire a cryptographer?

iPhone Unlocking Secret Revealed

The iPhone unlocking story took its next logical turn this week, with the release of a free iPhone unlocking program. Previously, unlocking required buying a commercial program or following a scary sequence of documented hardware and software tweaks.

How this happened is interesting in itself. (Caveat: This is based on the stories I’m hearing; I haven’t confirmed it all myself.) The biggest technical barrier to a software-only unlock procedure was figuring out the unlocking program, once installed on the iPhone, could modify the machine’s innermost configuration information – something that Apple’s iPhone operating system software was trying to prevent. A company called iPhoneSimFree figured out a way to do this, and used it to develop easy-to-use iPhone unlocking software, which they started selling.

Somebody bought a copy of the iPhoneSimFree software and reverse engineered it, to figure out how it could get at the iPhone’s internal configuration. The trick, once discovered, was easy to replicate, which eliminated the last remaining barrier to the development and release of free iPhone unlocking software.

It’s a commonplace in computer security that physical control over a device can almost always be leveraged to control it. (This iceberg has sunk many DRM Titanics.) This principle was the basis for iPhoneSimFree’s business model – helping users control their iPhones – but it boomeranged on them when a reverse engineer applied the same principle to iPhoneSimFree’s own product. Once the secret was out, anyone could make iPhone unlocking software, and the price of that software would inevitably be driven down to its marginal cost of zero.

Intellectual property law had little to offer iPhoneSimFree. The trick turned out to be a fact about how Apple’s software worked – not copyrightable by iPhoneSimFree, and not patentable in practice. Trade secret law didn’t help either, because trade secrets are not shielded against reverse engineering (for good reason). They could have attached a license agreement to their product, making customers promise not to reverse engineer their product, but that would not be effective either. And it might not have been the smartest thing to rely on, given that their own product was surely based on reverse engineering of the iPhone.

Now that the unlocking software is out, the ball is in Apple’s court. Will they try to cram the toothpaste back into the tube? Will they object publicly but accept that the iPhone unlocking battle is essentially over? Will they try to play another round, by modifying the iPhone software? Apple tends to be clever about these things, so their strategy, whatever it is, will have something to teach us.

Intellectual Property and Magicians

Jacob Loshin has an interesting draft paper on intellectual property among magicians. Stage magic is a form of technology, relying on both apparatus and technique to mislead the audience about what is really happening. As in any other technical field, innovations are valuable, and practitioners look for ways to cash in on their inventions. They do this, according to Loshin, without much use of intellectual property law.

This makes magic, like cuisine and clothing design, a thriving field that operates despite a lack of strong legal protection for innovation. Recently legal scholars have started looking harder at such fields, hoping to find mechanisms that can support innovation without the cost and complexity of conventional intellectual property law, and wondering how broadly those alternative mechanisms might be applied.

What makes magic unusual is that practitioners rarely rely on intellectual property law even though magic tricks are protectable by patent and as trade secrets. Patent protection should be obvious: patents cover novel mechanisms and methods, which most magic technologies are. Some classic tricks, such as the saw-a-person-in-half trick, have been patented. Trade secret protection should be obvious too: how to do a particular trick is valuable business information whose secrecy can be protected by the inventor. (The audience sees the trick done, but they don’t really see the secret of the trick.)

Yet Loshin, and apparently most magicians, think that patent and trade secret are a poor fit. There are basically three reasons for this. First, part of the value of a trick is that the audience can’t figure out how it’s done; but a patent must explain the details of the invention. Second, tricks are subject to “reverse engineering” by rival magicians who watch the trick done, repeatedly, from different parts of the audience, then do experiments to try to replicate it; and of course trade secrets are not protected against reverse engineering. Third, there’s a sort of guild mentality among magicians, holding that knowledge can be shared within the profession but must not be shared with the public. This guild mentality can’t easily be implemented within current law – a trade secret must be carefully protected, and so cannot be passed around casually within a loosely defined “community”.

The result is that the guild protects its secrets through social norms. You’re accepted into the guild by demonstrating technical prowess and following the guild’s norms over time; and you’ll be excommunicated if you violate the norms, for example by making a tell-all TV special about how popular tricks are done. (There’s an exception for casual magic tricks of the sort kids do.) The system operates informally but effectively.

As a policy guy, I have to ask whether this system is good for society as a whole. I can understand why those inside the profession would want to limit access to information – why help potential competitors? But does it really benefit society as a whole to have some unelected group deciding who gets access to certain kinds of information, and doing this outside the normal channels that (at least in principle) balance the interests of society against those of inventors? It’s not an easy question.

(To be clear, asking whether something is good or bad for society is not the same as asking whether government should regulate it. A case for regulation would require, at least, that the regulated behavior be bad for society and that there be a practically beneficial way for government to intervene.)

The best argument that magicians’ guild secrecy benefits the public is that tricks are more valuable to the public if the public doesn’t know how they are done. This is almost never the case for other technologies – knowing how your iPod works doesn’t make it less valuable to you – but it just might be true for magic, given that it exists for entertainment and you might enjoy it more if you don’t know how it’s done.

But I have my doubts that publishing information about tricks actually makes them less entertaining. Goldin’s patent on the saw-a-person-in-half trick – which explains pretty clearly how to do the trick – was issued in 1923, but the trick is still a staple today. In theory, anybody can read Goldin’s patent whenever they want; but in practice hardly anybody has read it, and we all enjoy the trick despite suspecting how it’s probably done. And do we really need to read Gaughan’s patent to know how a “levitating” magician stays up in the air? Gaughan’s cleverness is all about how to keep the audience from seeing the evidence of how it’s done.

One effect of the guild’s secrecy is that the public rarely learns who the great innovators are. We know who puts on a good show, but we rarely know who invented the tricks. The great innovators may be venerated within the profession, but they’re unknown to the public. One has to wonder whether the field would move faster, and be more innovative and entertaining, if it were more open.

HR 811 Up For House Vote Tomorrow

H.R. 811, the e-voting bill originally introduced by Rep. Rush Holt, is reportedly up for a vote of the full House of Representatives tomorrow. Passing the bill would be an important step in securing our elections. I have supported H.R. 811 from the beginning, and I am still firmly behind it. I hope it passes tomorrow.

H.R. 811 gets the big issues right, requiring a voter-verified paper ballot with post-election audits to verify that the electronic records are consistent with the paper ballots.

The bill is cautious where caution is warranted. For example, it gives states and counties the flexibility to choose optical-scan or touch-screen systems (or others), as long as there is a suitable voter-verified paper record. Though some e-voting activists want to ban touch-screens altogether, I think that would be a mistake. Touch screens, if done correctly – which no vendor has managed yet, I’ll admit – do offer some advantages. Federalism makes sense here: let localities make their own choices, as long as basic standards, such as the paper-trail and audit requirements, are met. Down the road, we may be glad that we left room for better touch-screen systems to develop.

The current version of the bill allows inferior paper-trail systems, such as ones storing ballots on a continuous reel of relatively fragile thermal paper, to be used through 2010, in places where they were already in use. The full requirement of a durable, permanent, privacy-preserving paper record takes effect everywhere in 2012, but starts immediately in places not already using a paper trail. Though less than ideal, the grace period is the best reasonable choice under the circumstances. A change of this magnitude takes time, so some kind of grace period is necessary. We could argue over whether it should be two years or four years, but at this point the most important thing is to start the clock ticking, by passing a bill.

If your representative is on the fence, this is a good time to call and urge a vote for H.R. 811.

[UPDATE (Sept. 6): The schedule has slipped so the bill will not be up for vote today. So there’s still time to call your congressperson.]