From Bruce O'Dell, President, Election Audit Institute, 10/13/05

Re: Cuyahoga's planned "Performance Testing" of its 6037 new Diebold DRE's---

"Performance testing"?? What does performance - or even functional - testing of a DRE have to do with the question of determining the integrity of the end-to-end voting administration process? No test on arbitrary device A at time B has any relevance at all to the behavior of thousands of different devices at election time.

In fact, no type of testing can mitigate the risks inherent to the industrial process of programming the thousands of machines fielded in a real election, installing them, operating them, extracting, tallying and archiving the results. You obviously cannot see what happens inside any computer; you rely on software to tell you what is happening. And you rely on software to vouch for that software. And software to vouch for that software. Ad infinitum. That's why we have to ultimately give up the impossible task of trying to verify electronic transactions by electronic means, and you always have to check expected inputs against expected outputs. Always, and no exceptions.

In fact, in case if you have not seen it, please check out http://www-db.stanford.edu/pub/keller/2005/Shamos-rebuttal.pdf - a wealth of very clearly-stated arguments setting forth the inherent limitations of any kind of testing in assuring the integrity of an unaudited DRE system. And of the ability of sufficiently clever insiders to counteract any all-electronic recording and audit mechanisms. (Of course, you may also point out vulnerabilities in a variety of Diebold equipment were reported by the Department of Homeland Security www.us-cert.gov/cas/bulletins/SB04-252.html as well as independent security consultants ( http://www.bbvforums.org/cgi-bin/forums/board-auth.cgi?file=/1954/10434.html ) - hardly confidence-builders. Would you keep your cash in a bank where although independent bank examiners discovered a tunnel leading to an unlocked door in the vault, the bank assured its customers that no theft could possibly have occurred, and there was no need to have an independent auditor count the money that remained?

Voting is a private, anonymous transaction that nevertheless must be recorded with complete accuracy. Therefore the authors make a compelling case that paper is the only feasible mechanism for countering the type of arbitrarily complex fraud available to insiders at the vendor. Of course, paper audit trails, even if produced, need to actually be audited. Given the large variety of audit countermeasures that are available, the scope of he audit could need to be so large and performed so soon after the polls close that the purported benefits of electronic tallying largely disappear.