What you are missing is that the technical part is not the hard part. The hard part is all the rest of it.
For example, here [0] is a link to the 200-page "volume 1" of the federal standards, merely one of a complex web of certifications that these things go through.
One random paragraph is illustrative:
Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand, without disruption of normal operation or loss of data, electrical fast transients of:
a. +2 kV and −2 kV on External Power lines (both AC and DC)
b. +1 kV and −1 kV on Input/Output lines(signal, data, and control lines) longer
than 3 meters
c. Repetition Rate for all transient pulses will be 100 kHz
Now I am a software engineer, and quite frankly I have no idea whether these are large tolerances which would require specialized equipment to withstand or whether e.g. my laptop would sail through this kind of event. Nor do I have any idea how I would demonstrate compliance with these requirements to the satisfaction of a federal examiner.
And that is what voting machines are. They are checkboxes on a specification. That means that you can buy them with confidence that somebody else's ass will be on the line when they turn out to be awful. The fact that they actually record votes is ancillary at best, the primary feature and the reason for buying them is that they tick the checkboxes.
As to why they seem overpriced, the reason is that it costs a lot of money to have an engineer hook the thing up to his fancy oscillator and write you a report that yes, this machine complies with requirement 4.1.2.6.c, over and over again.
I used to consult for a company that made WiMax base station equipment in India. Typically, the way government would work, is that they'd send out request for information to multiple vendors. Then, they'd take the list of parameters that they got from each vendor, create a master list of parameters, and pick the "best" under each parameter as a requirement. Then, they'd send out a request for quotes to all vendors with a list of requirements that would be impossible to meet simultaneously.
What happens then ? How did they pick up the most appropriate ? Or maybe they wait for one the vendors (the fastest) to produce a product up to the specs ?
I really don't know. I wasn't there long enough and didn't have full insight into the workings. But my guess is that they eventually settled on a solution that met most of the specs at a reasonable cost.
However, what that opens up, is a way for corrupt officials to favor a vendor and use the others-did-not-meet-this-particular-spec as a justification.
Just my 2c. I really have no idea if it actually was ever used in this way.
Actually, those requirements are par of the course when designing mains-powered devices . You'd be surprised the kind of transient voltage spikes AC motors generate when starting, and I'd assume all devices sold in the US satisfy the same or similar standards.
Having engineers design and test electronics with such kind of safety standards is good practice. You don't want a failed USB power supply to fail in a way that sends mains voltage to the USB for example.
Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand, without disruption of normal operation or loss of data, electrical fast transients of: a. +2 kV and −2 kV on External Power lines (both AC and DC) b. +1 kV and −1 kV on Input/Output lines(signal, data, and control lines) longer than 3 meters c. Repetition Rate for all transient pulses will be 100 kHz
That kind of testing is par for the course for electronics manufacturing at scale, though it does seem these requirements are quite stringent. The 100kHz repetition rate sounds odd though, and some of the other specs aren't completely clear. But regulatory testing of electronics is, in general, a solved problem, as are the mitigations for voltage surges.
> Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand, without disruption of normal operation or loss of data, electrical fast transients of: a. +2 kV and −2 kV on External Power lines (both AC and DC) b. +1 kV and −1 kV on Input/Output lines(signal, data, and control lines) longer than 3 meters c. Repetition Rate for all transient pulses will be 100 kHz
The real question seems to be, they apparently have all these stringent electrical engineering requirements set up in the standards, ones that seem to be made with detailed input from a professional electrical engineer, ones that can only be properly understood and tested by someone with electrical engineering knowledge.
So why did all these requirements on electrical engineering get into the standards, but requirements on software security did not?
Not to mention how hard it is to sell to the government. It can take months to get into the system then you need to wait for the RFP process to have a request that matches your capabilities. Then procurement. It's a huge barrier to entry for startups.
For example, here [0] is a link to the 200-page "volume 1" of the federal standards, merely one of a complex web of certifications that these things go through.
One random paragraph is illustrative:
Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand, without disruption of normal operation or loss of data, electrical fast transients of: a. +2 kV and −2 kV on External Power lines (both AC and DC) b. +1 kV and −1 kV on Input/Output lines(signal, data, and control lines) longer than 3 meters c. Repetition Rate for all transient pulses will be 100 kHz
Now I am a software engineer, and quite frankly I have no idea whether these are large tolerances which would require specialized equipment to withstand or whether e.g. my laptop would sail through this kind of event. Nor do I have any idea how I would demonstrate compliance with these requirements to the satisfaction of a federal examiner.
And that is what voting machines are. They are checkboxes on a specification. That means that you can buy them with confidence that somebody else's ass will be on the line when they turn out to be awful. The fact that they actually record votes is ancillary at best, the primary feature and the reason for buying them is that they tick the checkboxes.
As to why they seem overpriced, the reason is that it costs a lot of money to have an engineer hook the thing up to his fancy oscillator and write you a report that yes, this machine complies with requirement 4.1.2.6.c, over and over again.
[0] http://www.eac.gov/assets/1/Documents/VVSG.1.1.VOL.1.FINAL.p...