Ciber Not Given Interim Accreditation, Part 1

The story in the New York Times that Ciber Labs has been barred from certifying election equipment under the EAC interim certification rules simultaneously stuns me and frustrates me. That Ciber has not been performing the work it was contracted to do is very old news to me. It is somewhat frustrating to see this breathlessly reported as something new. The thing that stunned me, though, was that the Ciber portion of the Ciber/Wyle team failed to meet the requirements of the EAC interim accreditation. How can that be?

In this, the first of a two articles I will discuss the interim certification process of the EAC. I will endeavor to make this rather dry topic interesting. The second article will discuss the lack of work by the Ciber/Wyle team which I documented over the 18 months ago here in Wisconsin.

EAC Interim Process

Any discussion of the EAC Interim Accreditation process, unfortunately, cannot begin unless you first discuss the two accreditation processes it is between. The first process is the NASED qualification process administered by the private trade group, the National Association of State Election Directors, and the second is the yet-to-be-implemented National Voluntary Lab Accreditation Program (NVLAP) accreditation process to be administered by the Election Assistance Commission with substantial support from the National Institute of Standards and Technology (NIST). The additional rigor from the EAC/NIST program would mean its initial accreditation of labs would not be available until September 2006 at the soonest. The interim certification process was adopted as a bridge for the time between the end of the NASED qualification program and the beginning of the EAC/NIST program.

For each of these accrediting bodies: NASED and EAC/NIST there are two things to be certified/accredited:

1. Voting Systems. A given voting system is certified if it adheres to some standard.

2. Testing Labs. A given laboratory is accedited to test voting systems if its credentials and competence of laboratories are shown to meet accreditation standards.

This article focuses solely on this second form a certification: the accreditation of the testing labs.

NASED Process

The NASED process for testing equipment has been in place since the mid-1990’s and is documented here. Unfortunately, this is the only extant document which describes how ITA labs are accredited by NASED. There was a link at testimony which describes how SysTest became an ITA. But this document of testimony is now a dead link. Like many things regarding electronic voting; the truth is a trade secret. The short answer is no one in the public, and certainly no elected official, knows what if any qualifications, are required to be a NASED ITA lab. The only people who may know are the labs themselves, R. Doug Lewis of the Election Center and the members the NASED Voting Systems Board. The Election Center connection is important because initially the Election Center and Mr. Lewis administered the machine qualification process. Later, the EC joined with NASED in ITA testing. Prior to 1998 NASED merely republished the results produced by the Election Center . This re-publication policy was in place in November 1998 as found in the footnote. By December 2003 the qualification of machinery was administered by the Election Center under the auspices of NASED. Again the relevant information is in the footnote. At some point prior to December 2004, lists of certified systems drop any links between the Election Center and NASED.

So, in summary, the accreditation process to become an NASED/Election Center ITA lab is unknown or at least published in a very limited way. You will have to ask the Election Center and the NASED Voting Systems Board for answers to these questions.

EAC/NIST Process

The accreditation process for labs to test voting machinery under the EAC/NIST program is very well documented. The acronym for the labs changes from ITA to VSTL which stands for Voting Systems Testing Laboratory. The process to become a VSTL under the National Voluntary Lab Accreditation Program (NVLAP) is described in detail on the NVLAP page of the NIST website. And how the labs are to conduct testing in order to certify election machinery is described in the NIST Handbook 150-22 and the EAC VSTL manual.

Back to the EAC Interim Process

The initial accreditation under the EAC/NIST process has to date (January 7, 2007) yet to be completed for even a single lab that applied back in August of 2005. Thus, the EAC interim certification processeses is critical. These interim rules will be in place for some unspecified time to come.

So, what does is take to become accredited as a test lab under the EAC interim certification process? Not much.

Here is the document defining the EAC interim process for the certifying of election machinery. Paragraph A covers the accreditation of testing labs during the interim period.

Provide for interim accreditation of National Association of State Election Directors (NASED) accredited Independent Test Authorities (ITA).

The procedure for this interim accreditation is documented in the EAC Interim Accredited Test Lab information published by the EAC in August 2006:

Specifically, the requirements for interim accreditation are in paragraph 3.

Prior to accreditation review, the labs were required to submit documentation to EAC providing information on the laboratory, including their organization, their quality program, and their parent organization. EAC also required a completed EAC Certification of Laboratory Conditions and Practices document (Attachment 1).

This is the only documentation there is. This is only slightly better than the documentation available from the NASED/EC process for accrediting ITA labs.

To get interim accreditation from the EAC all a lab needs to do is:

1) Be a NASED ITA.

2) Tell the EAC who the lab is

3) Tell the EAC what is the lab’s quality assurance program

4) Tell the EAC which larger organization the lab is a part of

5) Sign a form entitled: Certification of Laboratory Conditions and Practices.

6) Pass some unspecified accreditation review

There is no documentation available though on what this review consists of or if it consists of anything at all.

Here are some questions for the EAC on the matter of interim certification.

1. Is the review process mentioned in paragraph 3 documented anywhere?
2. If so, where is this documented?
3. If not, why is this not documented?
4. Remember this review process, if it exists, is NOT the same process defined under the NIST/NVLAP program but something else generated by the commissioners of the EAC.
5. Is this undocumented review what Ciber failed to pass?
6. Or is the failure more fundamental? Did Ciber refuse to sign the required Certification of Laboratory Conditions and Practices?
7. If the failure by Ciber was related to the undocumented review process, what was the nature of the failure?
8. Was there more than one item of failure?
9. Where is the report on this review?
10. Who performed the review and when?

Given the elementary and pro forma nature of the EAC interim accreditation process how did a NASED ITA of more than 10 years fail? Hopefully the answer to this question and those above are not considered a trade secret as so much of election administration in the past 5 years has been declared.