Source verifiability in eVoting systems

This is the next part of a series of responses to Mr Kitcats monster post about yours truly.

In defence of the problem found in the GNU.Free codebase I blogged about previously (quick question, why oh why, if you thought electronic voting was a bad idea, would you leave the source for a bad eVoting implementation laying around on the Internet? Maybe so you could point at it and say how clever you were?), Jason wrote:

Anyone has been able to view this code online since 2000, yet this is the first time this problem has been pointed out, which rather shows how few people have the expertise and willingness to audit code.

But then goes on to say :

Well, with the exception of GNU.FREE and the source code leaks in the US, as an ordinary voter you can't see the code.

Why would they want to? Given that it's difficult to audit code, why would the ordinary voter want to see the source code? It's just a jumble of characters, indentation and white space surely? Unless the developer was downright daft and had included a line in the counting engine such as:

if (ballot.party=="Conservative" && !result.winner=="Labor") result.party["Labor"]++;

they wouldn't be able to spot any problems (that's joke code by the way, I'm not saying Labor would try to throw an election).

The question isn't whether the source is available to the general voting public, that is largely pointless (only the conspiracy theorists have room to argue the toss there), but whether the source is available to accredited auditors who's job it is to ensure that code operates correctly? If they've seen the code, and can verify that the software is correctly installed on the voting machines, then where's the problem? I suppose you could argue that you don't trust the auditors, in which case multiple audits could be held... if that doesn't hold off the nay-sayers, well a scrutinised paper ballot isn't going to either (since not everyone can verify all the processes, etc. etc.).

One last thing whilst we're on this subject...

Microsoft have a market capitalisation of $289.80 Billion and have not been able to convincingly resolve the security issues in their software after many years of work.

Nice argument Jason. Because cars crash we shouldn't fly in planes! Shock! Horror! Comparing the production of an operating system that is designed for almost universal use to a single use system is quite frankly ludicrous.