Independent Testing Authority

An Independent Testing Authority (ITA) is a laboratory certified by the United States–based National Association of State Election Directors (NASED) to test voting systems to the Voting System Standards (VSS) or the Voluntary Voting System Guidelines (VVSG) in the process of certifying voting systems. The Election Assistance Commission has taken over the responsibility for accrediting such laboratories and now uses the National Institute of Standards and Technology's National Voluntary Laboratory Accreditation Program. Under the EAC process, ITAs are now known as Voting System Testing Laboratories (VSTLs).

History

In 1990, the Federal Election Commission (FEC) established national standards for testing voting equipment, which did not exist prior to that year. However, these standards only tested system performance during extreme temperatures and the claims of the equipment manufacturers, exempting commercial off-the-shelf software. Revised standards were published in 2002, 2005 and 2007, but voting machines that were used during the 2008 elections were certified based on the 1990 and 2002 standards. As of 2008, the federal standards are considered voluntary, and states are not required to adopt them.^[1]

The FEC authorized NASED to choose which organizations would independently test voting equipment. NASED claimed in 2004 that the ITAs "have neither the staff nor the time to explain the process to the public, the news media or jurisdictions."^[2] The labs have been private companies that are funded by the voting machine vendors to test their equipment, which gives the vendors control over testing.^[3] In 2002, the Help America Vote Act required the labs to be federally certified.^[4] The Election Center, a non-profit based in Houston, Texas, worked alongside NASED on testing,^[1] in particular on certifying testing labs and tracking voting equipment approvals.^[5] Until Autumn 2003, voting equipment manufacturers informed NASED when testing labs approved their equipment. Neither NASED nor the Election Center followed up on inspecting the testing labs after they were accredited, citing a lack of resources. NASED also did not review contracts between the testing labs and voting equipment companies.^[5]

In 2004, there were three authorized ITAs:^[3] Wyle Laboratories (starting in 1994^[3]), Ciber (starting in 1997^[4]), and SysTest (starting in 2001^[3]). By 2008, this list expanded to include iBeta Quality Assurance and InfoGard Labs.^[1] By 2021, there were only two: Pro V&V and SLI Compliance.^[6]

Methodology

As of 2004, testing consisted of two parts: hardware testing ("shake n' bake") and firmware testing (voting machine software), and election management software. If a voting system passes the labs' tests, states would run functional tests and counties would run logic and accuracy tests.^[3]

Controversies and criticism

The labs have been criticized for secretive behavior. In August 2004, the Associated Press reported that the three labs who were authorized at the time have refused to discuss their work, including issues with electronic voting machines, citing non-disclosure agreements with the voting equipment vendors.^[2] Critics have accused those labs of not having enough resources for their work, including cybersecurity knowledge. Thomas Wilkey, the former chair of NASED's voting systems board, blamed this secretive behavior on the FEC deferring choice of the testing labs and the federal government not paying for testing.^[2][3] Both the testing process and testing results by the labs are considered proprietary.^[5]

Wired reported in November 2004 that there is little communication between state officials and testing labs, and no processes for connecting voting systems back to the labs that reviewed them; for requiring vendors to fix their equipment; or for information about equipment issues to be shared more broadly with local election officials. Lab tests at the time took 3-6 months, and during this time frame, voting system vendors could have repeatedly changed their software through upgrades or patches, so states had no guarantee that the software that was tested was the same as the software on the deployed voting machines.^[3]

Investigations by academic researchers and several states evidenced that voting equipment approved by the testing labs had major security vulnerabilities.^[3][5]

In 2004, Douglas W. Jones also criticized source code reviews for focusing more on coding conventions than security by design.^[3]

Michael Ian Shamos testified to the House of Representatives in June 2004 that the process "testing and certifying voting equipment in this country is not only broken, but is virtually nonexistent".^[2] A 2003 whistleblower who formerly worked at a voting machine company compared the labs to Arthur Andersen.^[7]

Two labs had their accreditation suspended by the EAC in the late 2000s, Ciber and SysTest, citing little testing documentation and a lack of quality assurance testing in both cases.^[1]

References

1. Zetter, Kim (2008-10-29). "Lab that Tests and Certifies Voting Machines Suspended". Wired. ISSN 1059-1028. Archived from the original on 2024-05-29. Retrieved 2025-08-24.
2. Poovey, Bill (2004-08-23). "Nation's voting machines tested in secret". NBC News. Archived from the original on 2022-11-04. Retrieved 2025-08-24.
3. Zetter, Kim (2004-11-01). "E-Voting Tests Get Failing Grade". Wired. ISSN 1059-1028. Archived from the original on 2023-06-01. Retrieved 2025-08-24.
4. "Feds bar e-voting machine testing firm". NBC News. 2007-01-04. Archived from the original on 2025-07-10. Retrieved 2025-08-24.
5. Ackerman, Elise (2004-05-30). "Lax controls over e-voting testing labs". The Mercury News. Archived from the original on 2004-06-03. Retrieved 2025-08-24.
6. Fifield, Jen (2021-02-17). "A closer look at who is auditing Maricopa County's election and why it matters". The Arizona Republic. Archived from the original on 2024-02-11. Retrieved 2025-08-24.
7. Manjoo, Farhad (2003-02-21). "Hacking democracy". Salon.com. Archived from the original on 2014-04-01. Retrieved 2025-08-24.