November 03, 2004
We'll never know
Voting system vendors are using the lack of disasters in the 2004 election to prove that evoting works well.
Here's the trouble: in key states, the exit polls were different from the final result. If the vote was rigged to tilt toward he winning candidate, we will never know.
If we had a voter-verified paper trail, we'd be able to do a recount and find the problem.
More details on evoting problems from EFF.
November 01, 2004
Evoting expert weblog
Evoting weblog from experts including Dan Wallach, Avi Rubin, David Dill, Ed Felten, Bruce Schneier, and others.
Report voting problems
Report voting problems
* by phone1-866-MYVOTE1
* https://voteproblem.org/
* These services are is sponsored by Computer Professionals for Social Responsibility and the Verified Voting Foundation.
Post videos and digital photographs of voting problems
* http://vidvote.org
Be an election monitor
You can sign up to be an election monitor, for several hours during the day, be a "mystery voter", or a poll closing observier
* http://www.commoncause.org/site/pp.asp?c=dkLNK1MQIwG&b=200690
Election observer guidelines, targeted for Hart Intercivic System used in Travis, Harris, Tarrant and Brazos counties
* http://www.cs.rice.edu/~dwallach/voting-observer.html
October 31, 2004
Why is it so hard to run an honest election?
by Bruce Scheier, leading technical expert and voice of reason on computer security.
Four years after the Florida debacle of 2000 and two years after Congress passed the Help America Vote Act, voting problems are again in the news: confusing ballots, malfunctioning voting machines, problems over who's registered and who isn't. All this brings up a basic question: Why is it so hard to run an election?
A fundamental requirement for a democratic election is a secret ballot, and that's the first reason. Computers regularly handle multimillion-dollar financial transactions, but much of their security comes from the ability to audit the transactions after the fact and correct problems that arise. Much of what they do can be done the next day if the system is down. Neither of these solutions works for elections.
American elections are particularly difficult because they're so complicated. One ballot might have 50 different things to vote on, all but one different in each state and many different in each district. It's much easier to hold national elections in India, where everyone casts a single vote, than in the United States. Additionally, American election systems need to be able to handle 100 million voters in a single day -- an immense undertaking in the best of circumstances.
Speed is another factor. Americans demand election results before they go to sleep; we won't stand for waiting more than two weeks before knowing who won, as happened in India and Afghanistan this year.
To make matters worse, voting systems are used infrequently, at most a few times a year. Systems that are used every day improve because people familiarize themselves with them, discover mistakes and figure out improvements. It seems as if we all have to relearn how to vote every time we do it.
It should be no surprise that there are problems with voting. What's surprising is that there aren't more problems. So how to make the system work better?
-- Simplicity: This is the key to making voting better. Registration should be as simple as possible. The voting process should be as simple as possible. Ballot designs should be simple, and they should be tested. The computer industry understands the science of user-interface -- that knowledge should be applied to ballot design.
-- Uniformity: Simplicity leads to uniformity. The United States doesn't have one set of voting rules or one voting system. It has 51 different sets of voting rules -- one for every state and the District of Columbia -- and even more systems. The more systems are standardized around the country, the more we can learn from each other's mistakes.
-- Verifiability: Computerized voting machines might have a simple user interface, but complexity hides behind the screen and keyboard. To avoid even more problems, these machines should have a voter-verifiable paper ballot. This isn't a receipt; it's not something you take home with you. It's a paper "ballot" with your votes -- one that you verify for accuracy and then put in a ballot box. The machine provides quick tallies, but the paper is the basis for any recounts.
-- Transparency: All computer code used in voting machines should be public. This allows interested parties to examine the code and point out errors, resulting in continually improving security. Any voting-machine company that claims its code must remain secret for security reasons is lying. Security in computer systems comes from transparency -- open systems that pass public scrutiny -- and not secrecy.
But those are all solutions for the future. If you're a voter this year, your options are fewer. My advice is to vote carefully. Read the instructions carefully, and ask questions if you are confused. Follow the instructions carefully, checking every step as you go. Remember that it might be impossible to correct a problem once you've finished voting. In many states -- including California -- you can request a paper ballot if you have any worries about the voting machine.
And be sure to vote. This year, thousands of people are watching and waiting at the polls to help voters make sure their vote counts.
October 28, 2004
Travis County "user error" is a voting system problem
Last weekend, frightened emails circulated around Travis County. At least one voter tried to select a straight-party Democratic ticket. When proofing the ballot, George Bush was selected for President.
Travis County Clerk Dana DeBeauvoir and the local democratic party were quick to spread the word that this was "human error and was not a machine malfunction."
They're doing the right thing to get the word out and ask voters to proof their ballots. But they're missing the point about voting system design. User errors are symptoms of design flaws.
The way it happens is this. "After pressing ENTER after marking Straight Democrat, some voters inadvertently turn the SELECT wheel one click through the ballot while meaning to go to the final "PROOF" page. If you hit enter at that point, your cursor is over the first candidate on the ballot: Bush/Cheney."
For the few steps, the user follows a pattern to make selections, and suddenly, the pattern changes. If the user doesn't notice they change, they accidentally select the wrong candidate.
Like the infamous "butterfly ballot" in Florida, this is a design flaw with the user interface.
These types of design flaws can be uncovered with usability testing. There are well-known techniques for detecting and fixing problems in the user interface that lead users to make mistakes.
But we don't do usability testing in Travis County. Before elections, the county does "logic and accuracy testing" to prove that the voting system generates the right results when voters make valid selection. The county puts out press releases explaining how this testing proves that the voting system is reliable.
But we don't test what happens when voters make mistakes. Usability testing is critical for all sorts of systems -- particularly systems where user choices have serious consequences like voting.
The lack of usability testing -- and the lack of rigorous security testing -- show that voting administration hasn't yet caught up to the responsibility of electronic voting.
October 04, 2004
Nevada paper trail voting goes smoothly
On September 7, Nevada became the first state in the US to vote using electronic voting machines producing a voter-verifiable paper trail. The $9.3 million system was provided by Sequoia Systems.
There were a few delays, but no major problems, with 261,000 people voting. According to the AP story, "Several machines failed to start, and some printers jammed in Douglas and Carson City counties. Poll workers simply replaced them with functioning models."
The stored paper ballots were used to audit the election results. Six thousand ballots were sampled. Secretary of State Dean Heller said that the audit shows no variations in tabulation results.
August 18, 2004
Paper trail reveals glitch in Nevada voting system demo
At a demonstration of the new Sequioa electronic voting system in Nevada -- scheduled for use in the November election -- the brand new voter-verified paper trail feature proved that the machine missed votes.
According to this Wired Magazine story, the machines had been configured to display ballots in English and Spanish. But the Spanish-language ballot missed some votes.
But when the testers switched to a Spanish-language ballot, the paper trail showed no votes cast for two propositions."We did it again and the same thing happened," said Darren Chesin, a consultant to the state Senate elections and reapportionment committee. "The problem was not with the paper trail. The paper trail worked flawlessly, but it caught a mistake in the programming of the touch-screen machine itself. For some reason it would not record or display the votes on the Spanish ballot for these two ballot measures. The only reason we even caught it was because we were looking at the paper trail to verify it (emphasis added)."Nevada is the first state to require electronic voting machines to print a paper ballot that shows voters their choices. These ballots can be used to audit or recount the outcome of an election. The Sequoia machines are scheduled to be used in the November election.
This is a classic example of the need for a voter-verifiable paper trail. If there was no paper trail, the votes might have been recorded incorrectly, and there would be no way to catch the problem.
Posted by alevin at 09:56 AM | Comments (1156)
August 15, 2004
Texas Secretary of State Halts closed meetings
Austin, TX - The Texas Secretary of State today agreed to indefinitely postpone a meeting of the state's voting examiners following the filing of a lawsuit by the ACLU of Texas and a Texas voter. The Electronic Frontier Foundation is serving as co-counsel in the case. The lawsuit challenged the practice of holding closed meetings in violation of the state's Open Meetings Act. Today, the parties decided to postpone an upcoming voting examiner meeting that had been set for August 18, 2004. As a result of the Secretary of State's decision, the emergency hearing in the case set for Monday, August 16 has been cancelled. Under the agreement, the Secretary of State and voting examiners are required to notify the plaintiffs at least 14 days before any subsequent meeting is held. The underlying lawsuit seeking to open the voting examiner meetings to public scrutiny is not affected and will proceed as planned...
more here
August 10, 2004
ACLU-TX Lawsuit Attacks Secret Voting Machine Evaluation in Texas
Sunshine Sought for Texas Election Systems Examiners
Lawsuit Attacks Secrecy of Meetings Where E-voting Machines Are Evaluated
Austin, TX. August 10, 2004. The ACLU of Texas and Jon Lebkowsky, a Texas voter, today filed a lawsuit demanding that the meetings of the state’s voting examiners be held in public.
The voting examiners are responsible for studying electronic voting machines and other voting technologies and recommending to the Secretary of State which systems should be certified for use in Texas. In the past few years, the Secretary of State has routinely adopted the recommendations of the panel, yet he has rebuffed efforts by the public to observe the proceedings, claiming that the panel is not subject to Texas’ Open Meetings Act.
Recently, the Texas Safe Voting Coalition obtained videotapes of previous meetings, including one involving Diebold, that suggest a lack of rigor and failure to properly address security and certification compliance issues.
“Texans deserve secure, reliable voting machines, and they deserve to see that the officials charged with certifying those machines are conducting a rigorous evaluation to ensure the systems are secure and effective,” said Adina Levin of theTexas ACLU. “All aspects of the voting process in a democracy should be open and transparent, to give citizens confidence in their vote. The evaluation process should not be hidden behind closed doors."
The case, which will be handled by lead counsel Renea Hicks, seeks a ruling opening up the meetings prior to the upcoming August meeting of the examiners. The lawsuit comes on the heels of a letter filed with the Attorney General in July by Consumers Union that also argued that these closed meetings violate the Texas Open Meetings Act. “The public’s interest in the state’s certification of electronic voting equipment is high,” noted Kathy Mitchell, Open Government Policy Analyst for Consumers Union. “The meetings of the examiners represent the critical point of deliberation during which key issues of interest to the public are discussed and debated.”
“The country is beginning to look under the rug of election certifications and testing processes and the scene is not pretty,” added Cindy Cohn, Legal Director of the Electronic Frontier Foundation which is serving as co-counsel in the case. “Opening up Texas certification processes should send a signal to testing and certification authorities nationwide that they must perform rigorous, public review of the systems that count our votes.
The Complaint is available here:
http://www.safevoting.org/blog/archives/PetitionOpenMeetings.doc
Texas Safe Voting Coalition (including clips of a January, 2004 examiner
meeting):
http://safevoting.org
August 09, 2004
Texas Reviews Paper Trail System
On May 4, the Texas Voting System Examiners reviewed the first electronic voting system with a voter-verified paper trail. The Accupoll system prints out a ballot for each voter to review, which can be stored in case of audits and recounts.
The Accupoll 2.3.14 was missing a few specifications required in Texas law, so it hasn't yet been certified. It didn't yet have a summary screen, sufficient ease of use on a straight-party ticket, or printing a polling-place summary audit log. It also needed greater security to prevent access to the MySQL database.
Accupoll will be back at the next SOS certification meeting on August 18. We hope that they have addressed the feature and security requirements, to begin to give Texas counties options for a voter-verified paper trail.
EFF reviews evoting systems with paper ballot
The full paper is available on the EFF Website
There are two ways to add a paper ballot to an evoting sytem. The first is to take an optical scan system, and add a computer interface for users to vote. The second is to take Direct Recording Electronic system and add a printer. Here's an overview of solutions on or nearing the market.
Electronic Ballot Markers
Electronic ballot markers can be used to fill out optical scan ballots. These systems look like traditional DREs, but they record votes on paper ballots instead of internal memory. This kind of machine can match all of a DRE’s accessibility features (audio interface, sip/puff input, multiple languages, etc.), and every vote can be verified before submission:
a. Avante’s14 Optical Vote-Trakker15 is a federally qualified, accessible, electronic ballot-marking system. It was the first system qualified to the FEC’s 2002 voting standards, a designation that means, in part, that it produces a 0% error rate even after 1.5 million votes. Certification is pending in several states.
b. ES&S, 16 the world’s largest election equipment manufacturer, is also in the process of attaining federal qualification for an electronic ballot marking system. It will be available later this year.17
DREs with Voter-Verified Paper Audit Trails
DREs equipped with a VVPAT can also provide auditable, accessible voting:
a. Avante’s Vote-Trakker18 is an accessible, VVPAT-equipped DRE that has completed federal testing. It is certified for use in several states and has certifications pending in others.19 This system has been used successfully in five separate elections and the American Council of the Blind lists the Vote-Trakker as an accessible voting system.20 In addition, Jim Dickson of AAPD has called Avante’s VVPAT an “elegant way” to provide a paper audit trail if one is mandated.
b. AccuPol produces a federally qualified, accessible, VVPAT-equipped DRE system. The company is actively pursuing state contracts and expects to have equipment in the field for the November 2004 election. The American Council for the Blind lists AccuPoll as an accessible voting system manufacturer.
c. Sequoia Voting Systems,25 the country’s third-largest election equipment manufacturer, will have a VVPAT-equipped AVC Edge26 on the market by the summer of 2004. The unit will be deployed in every Nevada election jurisdiction in time for the 2004 presidential election.
d. TruVote is in the process of qualifying a VVPAT-equipped DRE. The system also allows voters to verify that their vote was part of the final vote tally via a post-election web interface. The TruVote system should be qualified and available for purchase in the summer of 2004.
Flawed voting audits in Florida
As reported by the Miami Daily Business Review
A scathing internal review of the iVotronic touch-screen voting machines used in Miami-Dade and Broward, Fla., counties, written by a Miami-Dade County elections official, has raised fresh doubts about how accurately the electronic machines count the vote.
The review, contained in a June 6, 2003, memo that came to light last month, concludes there is a "serious bug" in the voting machine software that results in votes potentially being lost and voting machines not being accounted for in the voting system's self-generated post-election audit.
In the e-mail memo, Orlando Suarez, division manager of the county's Enterprise Technology Services Department, wrote that the system is "unusable" for auditing, recounting, or certifying an election. Suarez came to his conclusion after analyzing one precinct in a North Miami Beach municipal runoff election held May 21, 2003.
Ronnie Dugger on Stealing the Election
In-depth Nation Article, by a journalist who has been covering the security risks of electronic voting since the 1980s.
Last fall during a public talk on "The Voting Machine War" for advanced computer-science students at Stanford, Dill asked, "Why am I always being asked to prove these systems aren't secure? The burden of proof ought to be on the vendor. You ask about the hardware. 'Secret.' The software? 'Secret.' What's the cryptography? 'Can't tell you because that'll compromise the secrecy of the machines.'... Federal testing procedures? 'Secret'! Results of the tests? 'Secret'! Basically we are required to have blind faith.".
In particular, see the damning evidence of security problems with Diebold in Georgia.
In his front parlor at home in Georgia, Rob Behler told me that just before or just as he took over the Atlanta warehouse for Diebold, some of the voting machines had been sent out to "do demos," and in one southern county "somebody broke in and stole...[nine or] fourteen of the machines and, I think, one of the servers." He says the vote-counting programs in the stolen computers could have been completely reconstructed by reverse engineering and employed to jimmy the election.
"Quality-checking" the AccuVote machines as they arrived from Diebold at a warehouse in Atlanta, Behler and his crew found problems, he says, with "every single one" of them and about a fifth of them were shoved aside as unusable. When Diebold's programmers wanted "patches," that is, changes, inserted into the voting-system software, Behler says, they sent them to him via the company's open, insecure File Transfer Protocol (FTP) site in cyberspace. On his own unsecured laptop (resting on his desk as he spoke), Behler made twenty-two or twenty-three of the cards that were used to change the programs in the machines.Posted by alevin at 10:29 AM | Comments (256)
July 22, 2004
Republican and Democratic Party Platforms Call for Paper Ballot
The need for valid election audits and recounts is a "good-government" issue that transcends party lines. The Texas Republican and Democratic Party 2004 Platforms both call for a voter-verifiable paper ballot to ensure election integrity.
The Republican platform section on Fair Elections Procedures (page 6) calls for "prohibition of internet voting and any touch screen voting or other electronic voting which lacks a paper trail."
The Democratic party platform section on Protecting Democracy: Election and Campaign Reform (page 23) calls for: "A requirement that electronic voting systems deploy a voter verifiable paper printout to ensure that our votes are counted and can be accurately recounted and a certification and selection process for voting systems that is open to public review, testing, and analysis".
