The next generation of electronic voting sys- La prochaine génération de systèmes de vote élec- tems should be better engineered than the current tronique devra être mieux construite que la génération generation. A first step towards this is a more actuelle. Une analyse plus approfondie et plus précise thorough and precise analysis of the voting do- du domaine du vote est une première étape vers ceci. main. Then, procurement offices can leverage the Alors, les bureaux d’acquisition peuvent exercer une in- understanding in such a model in order to better fluence sur la compréhension d’un tel modèle dans le but specify their requirements. Consequently, manu- de mieux spécifier leurs besoins. Par conséquent, les fab- facturers should be encouraged to develop a SPL ricants devraient être encouragés dans le developpement for e-voting machines, in order to best manage d’une SPL pour les machines de vote électronique, afin de the obvious commonalities and variations. mieux gérer les variations et points communs évidents.
In this proposal, we have shown that a Dans cette proposition, nous avons montré qu’une feature-oriented approach can be applied to the approche “feature-oriented” peut être appliquée au de- design of an e-voting SPL architecture. We be- sign d’une architecture de SPL pour le vote électronique. lieve that refinement has a key role to play in Nous croyons que le raffinement a un rôle-clé à jouer the development and application of such a SPL, dans le développement et l’application d’une telle SPL, particularly in the re-use of verified feature com- en particulier dans la réutilisation de composants features ponents. Integrating SPL techniques with for- vérifiés. Intégrer des techniques de SPL avec des méth- mal methods is a promising approach: refinement odes formelles est une approche prometteuse : le raffine- for re-use of trustworthy components has already ment pour la réutilisation de composants fiables a déjà été been addressed with respect to e-voting machine traité en ce qui concerne les interfaces [CGM07b] et le interfaces [CGM07b] and storage [CGM07a]. stockage [CGM07a] d’une machine de vote électronique. Current research — based on the notion La recherche actuelle — fondée sur la notion d’un of a feature interaction algebra[Gib98] — sug- algèbre d’interactions de services [Gib98] — suggère gests that a correct-by-construction approach qu’une approche “correct-by-construction” pour garan- to guaranteeing the functionality of e-voting tir la fonctionnalité des systèmes de vote électronique systems[CGM07b, CGM07a] merits further in- [CGM07b, CGM07a] mérite davantage d’investigation. vestigation. La construction d’un système de vote électronique
Building an e-voting system has a high risk comporte un risque élevé d’échec en raison de standards of failure due to unstable standards [GM08] and instables [GM08] et le manque de compréhension du do- lack of understanding of the problem domain. maine. “Requirements creep” constitue un problème ma- Requirements creep has been a major problem jeur dans les systèmes de vote électronique. Ce qui con-
in e-voting systems. A good example is of stitue un bon exemple, c’est celui de l’exigence pour un the requirement for a voter verifiable audit trail “voter verifiable audit trail” (VVAT) [BPR+04]. De nom-
(VVAT) for increased security [BPR+04]. Many breuses machines de vote électronique ne remplissent pas current e-voting machines do not meet this re- cette exigence et n’ont pas été conçues pour le faire. quirement, and were not designed to do so. How- Néanmoins, les administrateurs d’élections et les fabri- ever, the election administrators and manufactur- cants semblent croire que cette fonctionnalité supplémen- ers seem to believe that this additional function- taire peut d’une manière ou d’une autre être boulonnée ality can be somehow bolted on to already pro- sans risque à des machines déjà procurées. Une SPL de cured machines without risk. An e-voting SPL vote électronique devrait être développée afin de gérer le should be developed in order to manage the risk risque d’exigences évoluents: la recherche actuelle sur le of evolving requirements: current research on maintien des SPLs [SE08] suggèrent que développer une maintaining SPLs [SE08] suggests that develop- SPL de vote électronique pouvant évoluer en parallèle ing an e-voting SPL that can evolve as standards avec des standards qui changent est faisable en utilisant change is feasible using current techniques, but des techniques actuelles, mais que cela reste un problème that it is a non-trivial problem. This is the main pas banal. Ceci constitue la principale recherche actuelle current and future research being proposed. et la future proposition de recherche.
Although, we focus on e-voting, the funda- Bien que nous nous concentrions sur le vote élec- mental research will have wider impact on soft- tronique, la recherche fondamentale aura un impact plus ware engineering in general; and formal methods large sur le génie logiciel en général, et sur les méthodes and SPLs in particular. formelles et les SPLs en particulier.
The educational component of our proposal is Le composant pédagogique de notre proposition est a key part of our strategy for technology transfer. un élément clé de notre stratégie pour le transfert de tech- Without this component the potential impact of nologie. Sans ce composant, l’impact potentiel de notre our proposed work could be compromised. proposition de travail pourrait être compromis.
4.A-Research Proposal For A Formal SPL for E-voting: Bibliography
[ABHV06] Jean-Raymond Abrial, Michael Butler, Stefan Hallerstede, and Laurent Voisin. An open extensible tool en- vironment for Event-B. In Zhiming Liu and Jifeng He, editors, Formal Methods and Software Engineering, 8th International Conference on Formal Engineering Methods, ICFEM 2006, volume 4260 of Lecture Notes in Computer Science, pages 588–605, Macao, China, 2006. Springer.
[Abr07] Jean-Raymond Abrial. A system development process with Event-B and the Rodin platform. In Michael But- ler, Michael G. Hinchey, and María M. Larrondo-Petrie, editors, Formal Methods and Software Engineering, 9th International Conference on Formal Engineering Methods, ICFEM 2007, volume 4789 of Lecture Notes in Computer Science, pages 1–3, Boca Raton, FL, USA, 2007. Springer.
[ACC+08] Adam Aviv, Pavol Cerný, Sandy Clark, Eric Cronin, Gaurav Shah, Micah Sherr, and Matt Blaze. Secu-
rity evaluation of ES&S voting machines and election management system. In EVT’08: Proceedings of the USENIX/Accurate Electronic Voting Technology Workshop 2008, Berkeley, CA, USA, July 2008. USENIX As- sociation.
[AFT07] R. Anane, R. Freeland, and G. Theodoropoulos. E-voting requirements and implementation. In The 9th IEEE International Conference on E-Commerce Technology and the 4th IEEE International Conference on Enterprise Computing, E-Commerce, and E-Services, 2007. CEC/EEE, pages 382–392, Tokyo, Japan, July 2007.
[AH07] Jean-Raymond Abrial and Stefan Hallerstede. Refinement, decomposition, and instantiation of discrete models: Application to event-b. Fundam. Inf., 77(1-2):1–28, 2007.
[AM05] Chris Armen and Ralph Morelli. Teaching about the risks of electronic voting technology. SIGCSE Bull., 37(3):227–231, 2005.
[AR06] Ben Adida and Ronald L. Rivest. Scratch & vote: self-contained paper-based cryptographic voting. In Ari Juels and Marianne Winslett, editors, Workshop on Privacy in the Electronic Society WPES, pages 29–40, Alexandria, VA, USA, 2006. ACM.
[ASH+08] Nirwan Ansari, Pitipatana Sakarindr, Ehsan Haghani, Chao Zhang, Aridaman K. Jain, and Yun Q. Shi. Evaluating electronic voting systems equipped with voter-verified paper records. IEEE Security and Privacy, 6(3):30–39, 2008.
[AW97] Mark A. Ardis and David M. Weiss. Defining families: the commonality analysis (tutorial). In ICSE ’97: Proceedings of the 19th international conference on Software engineering, pages 649–650, New York, NY, USA, 1997. ACM.
[BB06] Nadja Braun and Daniel Brändli. Swiss e-voting pilot projects: Evaluation, situation analysis and how to proceed. In Krimmer [Kri06], pages 27–36.
[BBC+08] Davide Balzarotti, Greg Banks, Marco Cova, Viktoria Felmetsger, Richard A. Kemmerer, William Robertson,
Fredrik Valeur, and Giovanni Vigna. Are your votes really counted?: Testing the security of real-world electronic voting systems. In Barbara G. Ryder and Andreas Zeller, editors, Proceedings of the ACM/SIGSOFT Interna- tional Symposium on Software Testing and Analysis ISSTA, pages 237–248, Seattle, WA, USA, 2008. ACM. [BEF+56] B. S. Bloom, M. D. Engelhart, E. J. Furst, W. H. Hill, and D. R. Krathwohl. Taxonomy of educational objectives
Handbook 1: cognitive domain. Longman Group Ltd., London, 1956.
[BEH+08] Kevin Butler, William Enck, Harri Hursti, Stephen McLaughlin, Patrick Traynor, and Patrick McDaniel. Sys- temic Issues in the Hart InterCivic and Premier Voting Systems: Reflections on Project EVEREST. In EVT’08: Proceedings of the USENIX/Accurate Electronic Voting Technology Workshop 2008 on Electronic Voting Tech- nology Workshop, Berkeley, CA, USA, July 2008. USENIX Association.
[Ben07] Josh Benaloh. Ballot casting assurance via voter-initiated poll station auditing. In EVT’07: Proceedings of the USENIX/Accurate Electronic Voting Technology Workshop 2007 on Electronic Voting Technology Workshop, Berkeley, CA, USA, August 2007. USENIX Association.
[BF07] Matt Bishop and Deborah A. Frincke. Achieving learning objectives through e-voting case studies. IEEE Security and Privacy, 5(1):53–56, 2007.
[BFK+99] Joachim Bayer, Oliver Flege, Peter Knauber, Roland Laqua, Dirk Muthig, Klaus Schmid, Tanya Widen, and Jean-Marc DeBaud. Pulse: A methodology to develop software product lines. In SSR, pages 122–131, 1999. [BFMV07] Volha Bryl, Roberta Ferrario, Andrea Mattioli, and Adolfo Villafiorita. Evaluating Procedural Alternatives in an
e-Voting Domain: Lessons Learned. Technical Report DIT-07-005, University of Trento, DIT, Italy, 2007. [BGE07] Michael D. Byrne, Kristen K. Greene, and Sarah P. Everett. Usability of voting systems: baseline data for paper,
punch cards, and lever machines. In CHI ’07: Proceedings of the SIGCHI conference on Human factors in computing systems, pages 171–180, New York, USA, 2007. ACM.
[BL05] Michael J. Butler and Michael Leuschel. Combining csp and b for specification and property verification. In John Fitzgerald, Ian J. Hayes, and Andrzej Tarlecki, editors, FM, volume 3582 of Lecture Notes in Computer Science, pages 221–236. Springer, 2005.
[BLRS06] J W. Bryans, B Littlewood, P Y. A. Ryan, and L Strigini. E-voting: Dependability requirements and design for dependability. In ARES ’06: Proceedings of the First International Conference on Availability, Reliability and Security, pages 988–995, Washington, DC, USA, 2006. IEEE Computer Society.
[BLS+03] Benjamin B. Bederson, Bongshin Lee, Robert M. Sherman, Paul S. Herrnson, and Richard G. Niemi. Elec- tronic voting system usability issues. In CHI ’03: Proceedings of the SIGCHI conference on Human factors in computing systems, pages 145–152, New York, USA, 2003. ACM.
[Bos99a] Jan Bosch. Evolution and composition of reusable assets in product-line architectures: A case study. In WICSA1: Proceedings of the TC2 First Working IFIP Conference on Software Architecture (WICSA1), pages 321–340, Deventer, The Netherlands, The Netherlands, 1999. Kluwer, B.V.
[Bos99b] Jan Bosch. Product-line architectures in industry: a case study. In ICSE ’99: Proceedings of the 21st international conference on Software engineering, pages 544–554, Los Alamitos, CA, USA, 1999. IEEE Computer Society Press.
[BPR+04] Jonathan Bannet, David W. Price, Algis Rudys, Justin Singer, and Dan S. Wallach. Hack-a-vote: Security issues
with electronic voting systems. IEEE Security & Privacy, 2(1):32–37, 2004.
[BR96] Joan Borrell and Josep Rifà. An implementable secure voting scheme. Computers & Security, 15(4):327–338, 1996.
[Bra78] C. Brainerd. Piaget’s Theory of Intelligence. Prentice Hall, Englewood Cliffs, NJ, 1978.
[Bre06] Peter Brent. The Australian ballot: Not the secret ballot. Australian Journal of Political Science, 41(1):39–50, March 2006.
[Bru66] J. S. Bruner. Toward a theory of instruction. Belknap Press of Harvard University, Cambridge, Mass„ 1966. [BT80] H.S. Barrows and R.M. Tamblyn. Problem-Based Learning: An Approach to Medical Education. Springer
Publishing Company, New York, 1980.
[BT94] Josh Cohen Benaloh and Dwight Tuinstra. Receipt-free secret-ballot elections (extended abstract). In Twenty- Sixth Annual ACM Symposium on Theory of Computing STOC, pages 544–553, Montréal, Québec, Canada, May 1994.
[BY86] Josh Cohen Benaloh and Moti Yung. Distributing the power of a government to enhance the privacy of voters (extended abstract). In Fifth Annual ACM Symposium on Princiles of Distributed ComputingPODC, pages 52–62, Calgary, Alberta, Canada, August 1986.
[CC97] Lorrie Faith Cranor and Ron K. Cytron. Sensus: A security-conscious electronic polling system for the internet. In 30th Hawaii International Conference on System Sciences (HICSS) Volume 3, pages 561–570. IEEE Computer Society, 1997.
[CC07] O. Cetinkaya and D. Cetinkaya. Verification and validation issues in electronic voting. The Electronic Journal of e-Government, 5(2):117–126, 2007.
[CCM07] Michael E. Clarkson, Stephen Chong, and Andrew C. Myers. Civitas: A secure remote voting system. In Chaum et al. [CKRR08].
[CEB+05] Deirdre Carew, Chris Exton, Jim Buckley, Margaret McGaley, and J.Paul Gibson. Preliminary study to empir- ically investigate the comprehensibility of requirements specifications. In Psychology of Programming Interest Group 17th annual workshop (PPIG), pages 182–202, University of Sussex, Brighton, UK, 2005.
[CEC+08] D. Chaum, A. Essex, R. Carback, J. Clark, S. Popoveniuc, A. Sherman, and P. Vora. Scantegrity: End-to-end voter-verifiable optical-scan voting. Security & Privacy, 6(3):40–46, May/June 2008.
[CF85] Josh D. Cohen and Michael J. Fischer. A robust and verifiable cryptographically secure election scheme (extended abstract). In 26th Annual Symposium on Foundations of Computer Science(FOCS), pages 372–382, Portland, Oregon, USA, October 1985. IEEE.
[CFM+08] Stefano Campanelli, Alessandro Falleni, Fabio Martinelli, Marinella Petrocchi, and Anna Vaccarelli. Mobile implementation and formal verification of an e-voting system. In Abdelhamid Mellouk, Jun Bi, Guadalupe Ortiz, Dickson K. W. Chiu, and Manuela Popescu, editors, Third International Conference on Internet and Web Applications and Services (ICIW), pages 476–481, Athens, Greece, June 2008. IEEE Computer Society. [CGM07a] Dominique Cansell, J. Paul Gibson, and Dominique Méry. Formal verification of tamper-evident storage for
e-voting. In SEFM, pages 329–338. IEEE Computer Society, 2007.
[CGM07b] Dominique Cansell, J. Paul Gibson, and Dominique Méry. Refinement: A constructive approach to formal software design for a secure e-voting interface. Electr. Notes Theor. Comput. Sci., 183:39–55, 2007.
[CGS97] Ronald Cramer, Rosario Gennaro, and Berry Schoenmakers. A secure and optimally efficient multi-authority election scheme. In EUROCRYPT, pages 103–118, Konstanz, Germany, May 1997.
[Cha81] David Chaum. Untraceable electronic mail, return addresses, and digital pseudonyms. Communications of the ACM, 24(2):84–88, 1981.
[Cha04] David Chaum. Secret-Ballot Receipts: True Voter-Verifiable Elections. In Security & Privacy (Vol. 2, No. 1), pages 38–47. IEEE, January/February 2004.
[CHS+10] Andreas Classen, Patrick Heymans, Pierre-Yves Schobbens, Axel Legay, and Jean-François Raskin. Model
checking lots of systems: Efficient verification of temporal properties in software product lines (to appear). In 32nd International Conference on Software Engineering, ICSE 2010, May 2-8, 2010, Cape Town, South Africa, Proceedings. IEEE, 2010.
[CJC04] Yu-Yi Chen, Jinn-Ke Jan, and Chin-Ling Chen. The design of a secure anonymous internet voting system. Computers & Security, 23(4):330–337, 2004.
[CKRR08] David Chaum, Miroslaw Kutylowski, Ronald L. Rivest, and Peter Y. A. Ryan, editors. Frontiers of Electronic Voting, 29.07. - 03.08.2007, volume 07311 of Dagstuhl Seminar Proceedings. Internationales Begegnungs- und Forschungszentrum fuer Informatik (IBFI), Schloss Dagstuhl, Germany, 2008.
[CN02] P. Clements and L. Northrop. Software product lines. Addison-Wesley Boston, 2002.
[Cra96] Lorrie Faith Cranor. Electronic voting: computerized polls may save money, protect privacy. Crossroads, 2(4):12–16, 1996.
[Cra01] Lorrie Faith Cranor. Voting after Florida: no easy answers. Ubiquity, 1(47):1, 2001.
[CRS05] David Chaum, Peter Y. A. Ryan, and Steve A. Schneider. A practical voter-verifiable election scheme. In Sabrina De Capitani di Vimercati, Paul F. Syverson, and Dieter Gollmann, editors, 10th European Symposium On Research In Computer Security(ESORICS), volume 3679 of Lecture Notes in Computer Science, pages 118– 139, Milan, Italy, September 2005. Springer.
[Cur03] W. S. Curran. Teaching software engineering in the computer science curriculum. SIGCSE Bull., 35(4):72–75, 2003.
[DD07] Scott G Decker and Jim Dager. Software product lines beyond software development. In SPLC ’07: Proceedings of the 11th International Software Product Line Conference, pages 275–280, Washington, DC, USA, 2007. IEEE Computer Society.
[Dhu06] Deepak Dhungana. Integrated variability modeling of features and architecture in software product line engineer- ing. In ASE, pages 327–330. IEEE Computer Society, 2006.
[Dij72] Edsger W. Dijkstra. Structured programming, chapter Notes on structured programming, pages 1–82. Academic Press Ltd., London, UK, 1972.
[DJOS07] Jim Davies, Tomasz Janowski, Adegboyega Ojo, and Aadya Shukla. Technological foundations of electronic governance. In ICEGOV ’07: Proceedings of the 1st international conference on Theory and practice of elec- tronic governance, pages 5–11, New York, NY, USA, 2007. ACM.
[DKK+08] Seda Davtyan, Sotiris Kentros, Aggelos Kiayias, Laurent Michel, Nicolas Nicolaou, Alexander Russell, Andrew See, Narasimha Shashidhar, and Alexander A. Shvartsman. Pre-election testing and post-election audit of op- tical scan voting terminal memory cards. In EVT’08: Proceedings of the USENIX/Accurate Electronic Voting Technology Workshop, Berkeley, CA, USA, July 2008. USENIX Association.
[DKR06] Stéphanie Delaune, Steve Kremer, and Mark Ryan. Coercion-resistance and receipt-freeness in electronic voting. In Proceedings of the 19th IEEE workshop on Computer Security Foundations (CSFW), pages 28–42. IEEE Computer Society, 2006.
[DLM82] Richard A. DeMillo, Nancy A. Lynch, and Michael Merritt. Cryptographic protocols. In 14th Annual ACM Symposium on Theory of Computing (STOC), pages 383–400, San Francisco, California, USA, May 1982. ACM. [dMPQ07] Olivier de Marneffe, Olivier Pereira, and Jean-Jacques Quisquater. Simulation-based analysis of e2e voting
systems. In Chaum et al. [CKRR08].
[DS99] Jean-Marc DeBaud and Klaus Schmid. A systematic approach to derive the scope of software product lines. In ICSE ’99: Proceedings of the 21st international conference on Software engineering, pages 34–43, New York, NY, USA, 1999. ACM.
[EB08] Andrew Edmunds and Michael Butler. Linking event-b and concurrent object-oriented programs. Electr. Notes Theor. Comput. Sci., 214:159–182, 2008.
[EBB06] Magnus Eriksson, Jürgen Börstler, and Kjell Borg. Software product line modeling made practical. Commun. ACM, 49(12):49–54, 2006.
[Eve07] Sarah P. Everett. The Usability of Electronic Voting Machines and How Votes Can Be Changed Without Detection. PhD thesis, Rice University, Houston, TX, USA, 2007.
[FHF07] Ariel J. Feldman, J. Alex Halderman, and Edward W. Felten. Security analysis of the Diebold AccuVote-TS voting machine. In EVT’07: Proceedings of the USENIX/Accurate Electronic Voting Technology Workshop 2007, Berkeley, CA, USA, August 2007. USENIX Association.
[FOO93] Atsushi Fujioka, Tatsuaki Okamoto, and Kazuo Ohta. A practical secret voting scheme for large scale elections. In ASIACRYPT ’92: Proceedings of the Workshop on the Theory and Application of Cryptographic Techniques, volume 718 of Lecture Notes in Computer Science, pages 244–251, London, UK, 1993. Springer-Verlag. [Gar83] H. Gardner. Frames of mind: the theory of multiple intelligence. Basic Books, New York, 1983.
[GGR07] Ryan Gardner, Sujata Garera, and Aviel D. Rubin. On the difficulty of validating voting machine software with software. In EVT’07: Proceedings of the USENIX/Accurate Electronic Voting Technology Workshop 2007, Berkeley, CA, USA, August 2007. USENIX Association.
[GH07] Rop Gonggrijp and Willem-Jan Hengeveld. Studying the Nedap/Groenendaal ES3B voting computer: A com- puter security perspective. In EVT’07: Proceedings of the USENIX/Accurate Electronic Voting Technology Work- shop 2007, Berkeley, CA, USA, August 2007. USENIX Association.
[Gib98] J. Paul Gibson. Towards a feature interaction algebra. In Kristofer Kimbler and Wiet Bouma, editors, Feature Interactions in Telecommunications and Software Systems V (FIW 1998), pages 217–231, Malmö, Sweden, 1998. IOS Press.
[Gib00] J. Paul Gibson. Formal requirements engineering: Learning from the students. In Doug Grant, editor, 12th Australian Software Engineering Conference (ASWEC 2000), pages 171–180. IEEE Computer Society, 2000. [Gib07] J. Paul Gibson. E-voting and the need for rigourous software engineering - the past, present and future. In Jacques
Julliand and Olga Kouchnarenko, editors, B 2007, volume 4355 of Lecture Notes in Computer Science, page 1. Springer, 2007.
[Gib08a] J. Paul Gibson. Formal methods - never too young to start. In Formal Methods in Computer Science Education (FORMED), pages 149–159, March 2008.
[Gib08b] J. Paul Gibson. Weaving a formal methods education with problem-based learning. In T. Margaria and B. Steffen, editors, 3rd International Symposium on Leveraging Applications of Formal Methods, Verification and Validation, volume 17 of Communications in Computer and Information Science (CCIS), pages 460–472, Porto Sani, Greece, October 2008. Springer-Verlag, Berlin Heidelberg.
[GJ09] J. Paul Gibson and Doug Jones, editors. First International Workshop on Requirements Engineering for e-Voting Systems (RE-VOTE09), Atlanta, GA, USA, August 2009. IEEE.
[GKK+06] Marcin Gogolewski, Marek Klonowski, Przemyslaw Kubiak, Miroslaw Kutylowski, Anna Lauks, and Filip Za- górski. Kleptographic attacks on e-voting schemes. In Günter Müller, editor, International Conference on Emerg- ing Trends in Information and Communication Security (ETRICS), volume 3995 of Lecture Notes in Computer Science, pages 494–508. Springer, 2006.
[GLR08a] J. Paul Gibson, Eric Lallet, and Jean-Luc Raffy. Analysis of a distributed e-voting system architecture against quality of service requirements. In Herwig Mannaert, Tadashi Ohta, Cosmin Dini, and Robert Pellerin, editors, The Third International Conference on Software Engineering Advances (ICSEA 2008), pages 58–64, Sliema, Malta, October 2008. IEEE Computer Society.
[GLR08b] J. Paul Gibson, Eric Lallet, and Jean-Luc Raffy. How do I know if my design is correct? In Zoltan Istenes, editor, Formal Methods in Computer Science Education (FORMED 2008), pages 61–70, Budapest, Hungary, March 2008. Accepted for publication in ENTCS.
[GLR10] J. Paul Gibson, Eric Lallet, and Jean-Luc Raffy. Engineering a distributed e-voting system architecture: Meeting critical requirements. In Holger Giese, editor, Architecting Critical Systems, First International Symposium, IS- ARCS 2010, Prague, Czech Republic, June 23-25, 2010, Proceedings, volume 6150 of Lecture Notes in Computer Science, pages 89–108. Springer, 2010.
[GM98] J. Paul Gibson and Dominique Mery. Teaching formal methods: Lessons to learn. In Sharon Flynn and Andrew Butterfield, editors, 2nd Irish Workshop on Formal Methods (IWFM 1998), Electronic Workshops in Computing, Cork, Ireland, July 1998. BCS.
[GM08] J. Paul Gibson and Margaret McGaley. Verification and maintenance of e-voting systems and standards. In Dan Remenyi, editor, 8th European Conference on e-Government, pages 283–289. Academic Publishing Inter- national, July 2008. ISBN 978-1-906638-09-2.
[GO05] J. Paul Gibson and Jackie O’Kelly. Software engineering as a model of understanding for learning and problem solving. In ICER ’05: Proceedings of the 2005 international workshop on Computing education research, pages 87–97, New York, NY, USA, 2005. ACM.
[Got06] Don Gotterbarn. E-voting: a failure of professionalism? In ITiCSE-WGR ’06: Working group reports on ITiCSE on Innovation and technology in computer science education, pages 7–8, New York, USA, 2006. ACM.