What are the digital images?
Two types of voting machines approved for use in Wisconsin--the ES&S DS200 and the Dominion Imagecast system--preserve a digital image of each ballot at the moment it is cast. The votes, in fact, are read and counted as the machine 'looks at' the digital image, not the ballot.
The machines can be set up to discard the digital images or preserve them. GAB has wisely required Wisconsin election officials to preserve them.
How are they stored?
We haven't yet worked with the Dominion images, but the DS200 images are stored on flashdrives--the same flashdrive that contains the set-up coding for the ballot. After polls close, the flashdrives should be transported securely to the county clerk. In Dane County, they are downloaded into a central computer, and copies can be made for any individual or group filing an open-records request. Dane County charges about $18, mostly to cover the cost of the new flashdrive they use for the copy.
Are the images clear?
The DS200 images are .pbm files with an impressive resolution: 3,856,896 pixels per each side of the ballot. The pixels are either black or white; there's no gray, so some of the gray-shaded areas can show up as funny patterns, but the votes themselves and things like the poll workers' initials show up clearly and precisely.
Can the digital images be hacked?
Yes, of course. Data created or processed by a computer can be altered by a computer. The computer professionals we work with--John Washburn of Washburn Research, Prof. Douglas Jones of the University of Iowa, and Paul Lindquist, a Microsoft programmer who works with our group--all agree, however, that altering digital images would present multiple significant challenges that traditional electronic vote-flipping does not. Washburn likened hacking only vote totals to climbing over a three-foot garden retaining wall, and hacking digital images to climbing over a castle wall.
These difficulties include:
- Preparing ballot images before the election to substitute them for images of actual ballots would be highly detectable. You'd have to be able to duplicate the poll workers' initials; predict the turnout; and invent outcomes in every race, not just the one you want to hack.
- If an insider--say at the voting machine company--wanted to write a hack that would simply move a few pixels around (that is, moving the image of the voter's mark from one candidate to another), he or she would need to know the ballot layout before writing the hack. Because ballot layouts differ by jurisdiction and are not finalized until 6-8 weeks before each election, this both complicates the hack and reduces the window of opportunity for writing and distributing it.
- The processing power of voting machines is not great. They are usually designed to be as cheap as possible, and so are built with only enough processing power to do the relatively simple tasks they are designed to do. Altering digital images may (we don't know for sure until a truly independent professional assesses it) take more processing power than the machines possess. If someone did insert programming that made the machines alter the images before detecting votes and storing the image, that programming could noticeably slow the machine down or cause it to freeze up.
- The digital images could easily be altered, one by one, after the election. Based only on my own pretty-darn-good Photoshop skills, I'm guessing I could change the votes at a rate of 3-4 seconds per ballot, once I loaded them and the digital-image-editing software into my computer. Personally, I wouldn't know how to prevent evidence of the edit from being saved with the file, but I'm sure someone does. If someone was going to alter the outcome of an election using this method, however, he or she would need to have the access and skills to both hack the machines before Election Day to manipulate the vote totals, and then have access to the digital image files after Election Day to manipulate the images to match the totals he or she hacked into the machine. The best way to make sure a records custodian with hacking skills doesn't do this is to quickly make and distribute copies of the digital-image files after the polls close.
If the digital images can be hacked, what's the point in using them in verification?
Neither human error nor unintentional malfunction would move pixels on a digital image from Candidate A to Candidate B, so any miscounts caused by unintentional error or malfunction will be detectable in a digital-image audit. In addition, no one will be trying to cover them up.
And we lose the deterrence value of the digital images if we don't use them in routine verification. If hackers know no one is ever going to look at the digital images, they won't need to bother with altering them; they will be able to use the easier vote-total-altering hacks.
How can digital images be used in verification?
The Wisconsin Election Integrity Action Team has written read-only software (open source, provided for free to any clerk or citizen's group that wants to use it) that allows the digital images to be projected as a slide show. The images can be projected at a rate of 1, 1.5, or 2 seconds per ballot, and the projected image can zoom in on any section of the ballot. The slide show pauses after each 25 images to allow counters to verify subtotals. If you want to see what a vote-counting slide show looks like, check out this video, and skip to 19:40.
Without the need to sort, stack, straighten out, and flip over paper ballots, counting votes from a slide show is breathtakingly fast. A precinct with 1,200 ballots can easily be counted in under 45 minutes. The process is also fully transparent: Every observer can see exactly what the official counters see, and can count right along with them.
Can the digital images be checked against the paper ballots to make sure they are true copies?
They can and they should, but getting that done is going to take a lot of work--logistical work and psychological work. We'll have to get back to this after we get a few counties up and running with digital-image verification.
Logistical issue: The DS200 images don't contain any marks (that we know of) that would allow them to be matched to individual paper ballots. However, every ballot is unique in the placement and style of poll workers' initials, irregularities of stamps, and the voters' marks themselves. With careful, time-consuming work, I'm thinking you could match enough of the ballots from one precinct to that precinct's digital images to achieve confidence that they are the same or gather enough evidence to indicate a need to discard the digital images as flawed and verify the outcomes with the paper ballots instead.
Psychological issue: Wisconsin's election officials, providing comfort and joy to potential election thieves everywhere, are terrified of unsealing ballot bags once they've been sealed on Election Night. They would much, much, much rather risk certifying the wrong winner than risk opening a sealed ballot bag for verification purposes. There's no question that they have the legal authority to open ballot bags for verification purposes if they choose to; it's only folklore that they don't. But they are convinced--down to their bone marrow--that irrational angry partisans will charge them with tampering with the ballots if they unseal the ballot bags, even if they do so in the presence of witnesses while religiously following instructions for maintaining a clear chain of custody.
I'd rather stay away from bullying our public officials, but any clerk who makes that argument is telling us, loud and clear: "I make my policy decisions only in deference to irrational angry bullying; I don't respond to reason and polite requests." Let's work with them cordially for as long as we can, but if any clerk continues to use this excuse as his or her reason for refusing to ensure election results are accurate, responsible citizens will need to criticize and bully them harder than the irrational partisans do.