On Wednesday, I met with Scott McDonell, the new Dane County Clerk. Dane County will be replacing their voting machines soon, and I wanted to find out what the process for selecting the machines would be (state law requires we use them), and what McDonell was considering, if anything specific yet. Finally, I wanted to make sure he knew that "Direct-recording electronic machines" (DREs, or machines that do away with paper ballots) would not be acceptable. Here's what I told him, and what I found out.
McDonell started by telling me, before I'd said much at all, that he was set against DREs. He doesn't want to give up paper ballots, and he said he didn't know of any municipal clerk in the county who did not share that conviction. (Yay!) His sentiment--again, one that he thinks most municipal clerks share--is that the new voting system should be as much like the old one as possible, even down to the ballot design of filling in an arrow.
McDonell will wait until after the April elections, and then call together a committee of municipal clerks to plan the purchase and transition. McDonell is committed to having at least one public hearing. Dane County will purchase the machines, and any municipality that then wants to buy them from Dane County will be able to get them for about half of what Dane County paid (that is, the county will pay for half.) The county cannot force any municipality to buy them, but the county's offer to pay for half will be good for only three years, so McDonell expects all machines in the county to be replaced by the end of 2015, if not before.
One problem is that no jurisdiction in Wisconsin can use any voting machine that hasn't been approved by the GAB, and the GAB has approved only one optical scan system. That rather limits local bargaining power with the vendors! McDonell said GAB told him they might approve a second in 2014, but Dane County needs to get going on replacing our aging machines.
Still, McDonell seemed willing to press the vendors as much as he could. He has already asked about wireless communications ability, and has been told optical scanners are available that have no incoming wireless communications capability, and can only transmit information. (That's a good thing.) He also plans to ask for open-source code, at the very least, he wants the vendor to agree to share all code with Dane County IT staff. That's not an area I know a lot about, but that sounds to me like good out-of-the-gate thinking.
So, McDonell was already on board with many of the things I'd intended to press him about. He wasn't aware, however, of the Humboldt County Transparency Project--the county in California that's been experimenting with different ways of making vote-counting transparent, and McDonell seemed intrigued by the idea of scanning marked ballots and making the digital images available--perhaps even by posting them on the Internet--to allow anyone to count the votes who wants to. He saw an advantage I hadn't thought of before: that making the images of the ballots publicly available will help to dispel the notion that voter-marked ballots are hard to mark and hard to read. He guessed a lot of people would be surprised, once they were able to see a lot of ballots, at how very easy it is to discern voter intent on all but the very rare paper ballot.
Anyway, if you want to read on, here is the text of the six-page letter I left with him. If anyone wants to lift any of these arguments to talk any other county clerk out of DREs, be my guest:
February 13, 2013
Mr. Scott McDonell, Dane CountyClerk
210 Martin Luther King Jr. Blvd, Room 106A
Dear Mr. McDonell:
Thank you for your willingness to accept citizen input at this early stage of selecting the voting system to replace Dane County’s current optical scanners. I cannot think of many government functions, if any, as critical to our sacred right to self-government as the administration of honest, fair, and verifiably accurate elections. In my experience as an election observer, I have been continually impressed by the dedication and hard work of our local elections officials and citizen volunteers. They deserve equipment that will help them administer the high-quality elections for which they work so hard and that will protect them, to the extent possible, from bitter controversy.
Elections officials will never have the resources or expertise to prevent voting machine malfunctions. In the month before this memo was written, news contained reports of manufacturers’ recalls of unreliable heart defibrillators, Lexus automobiles, and baby strollers. A tour bus in California lost its brakes on a mountain road and crashed. Planes crashed in Arizona, California, Florida, Iowa, Nevada, and Washington. The lights went out at the Super Bowl. In the past week, we learned that computer hackers successfully penetrated the computers of the Federal Reserve Bank, the Washington Post and the New York Times; the City of Madison’s website; and George W. Bush’s AOL email account. The day before yesterday, an emergency broadcast system in Montana sent out statewide warnings of a zombie invasion. (News reports of the incident helpfully informed us, “Engineers have confirmed there was no emergency.”)
The quality-control and computer-security programs of the medical device manufacturers, the Lexus division of Toyota, the National Transportation Safety Board, the Federal Reserve Banking System, the Washington Post and the New York Times, and AOL all have expertise and resources that Wisconsin’s elections officials can only dream about.
And yet even they could not prevent the malfunctions that made news in just the past month.
We cannot protect our elections by promising that voting machines will never malfunction if we all try really, really hard to prevent it, any more than the White Star Line could protect the souls on board the Titanic by aggressively asserting the liner’s unsinkability. It is simple prudence to purchase the voting system that is the most transparent in its operation and that provides the most opportunity for any malfunctions to be noticed before election results are certified.
A. Why Dane County should not consider Direct-Recording Electronic systems (DREs, or touch-screen machines)
In every type of voting system, direct recording of votes is done by someone or something. In optical-scan systems like the one DaneCounty currently uses, voters directly record their own votes in the form of visible marks on paper ballots. In DRE systems, it is a computer that directly records the vote in the form of electronic bits preserved in the computer’s memory.
Because DRE machines perform more tasks than the optical scanners, they create more opportunities for malfunction. And because those tasks are performed inside a computer, the DREs provide less opportunity for elections officials to catch and correct any malfunctions that do occur.
Recognizing the possibility of DRE malfunction, Wisconsin law wisely requires a visible audit trail to be printed and displayed to the voter. However, the “Voter-verifiable Paper Audit Trail” (VVPAT) is more decorative than functional. In practice, it does very little to improve the likelihood that malfunctions affecting the recording or counting of votes will be noticed and corrected.
Few DRE voters look at the audit trail. Those who do look rarely notice errors that occur and tend not to report the errors they see.The first problem is the voters themselves—if predictable human behavior can be considered a ‘problem’ and not simply a necessary consideration. Laboratory studies and exit polls have confirmed that at most only 30% of voters look at the audit trail to verify the correct votes were recorded there. Wisconsin elections inspectors in precincts that use DREs know this from simple observation.
Many voters are simply unaware that they are expected to check. Visual verification—an unnecessary step when the voter is marking a paper ballot—occurs at the end of the voting process, so reviewing the audit trail seems an add-on step, and not a particularly easy one. The viewing window through which the voter sees the audit trail is typically enclosed in a case to the side of the computer screen, under glass or plastic to prevent tampering. In some types of machines, the audit trail can be viewed only after lifting a cover. Many voters feel it is not worth their effort.
- When a voter does look at the audit trail, it is often in a different format than the voter just saw on the screen, making it hard to notice differences. In a study at RiceUniversity, two-thirds of test voters who looked at the audit trail didn't even notice when contests disappeared entirely between the on-screen display and the printed audit trail.
- The audit trail is rarely easy to read. Few DRE manufacturers honor the simplest rules of readable print: for example, using ALL CAPS and unfamiliar abbreviations. The thermally printed image may be of no higher contrast or quality than a standard grocery receipt, and the audit trail is under plastic in ambient lighting conditions usually more suitable for reading the lighted screen on the DRE.
- Of the voters who do look at the audit trail, successfully read it, and notice an error, not all will cancel and recast their ballot. Most conclude that they, not the machine, made the error, and many hesitate to make their error obvious by taking additional time at the voting station. Even when embarrassment isn’t a factor, concerns about their own time or that of the voters behind them in line cause others to choose not to correct a noticed error. Of those who do cancel and recast the ballot, few will inform the elections inspector of the problem.
- When voters do notice errors and speak up, the machines are too complicated for elections inspectors to be able to determine whether the error was the voter’s or whether the machine is randomly malfunctioning. They simply assist the voter to cancel the erroneous ballot and recast a correct one.
With these odds, even a significant malfunction can escape detection. For example, assume that a machine was intermittently malfunctioning so that, on Election Day, it recorded one in every ten votes for the Republican for the Democratic candidate instead. In a precinct with 300 votes split evenly between the two candidates, 15 votes (5 percent of the total) would be affected. Four or five of the affected voters would look at the audit trail. Let’s be generous and say four of them would notice the error. Of these four, two of them might take action to correct the vote, and one of those might mention it to the elections inspector. Even if the elections inspector recorded the single reported incident on the log, anyone who looked at the log could not notice any pattern that would arouse interest. Because the tallied results are so rarely audited against the audit trail, a malfunction that disenfranchised 4.3 percent of the electorate (8.7 percent of the Republican voters) would go unnoticed.
Voter inattention to the audit trail has been studied and confirmed—and will rapidly become well-known in the event of any serious challenge to the accuracy of a DRE-recorded election. Elections officials who are left holding only machine-created records have an impossible task when they are challenged to verify election results. They simply cannot defend the results they certified in the absence of any record of the voters’ intent that was not created by the machine—that is, without voter-marked paper ballots.
If a DRE is recording votes correctly on the audit trail, but incorrectly in the memory, it is impossible for voters or elections officials to notice. The second reason why the DREs’ audit trails do not markedly improve election security is because DREs do not count the votes printed on the audit trail in the way that optical scanners count the votes documented on paper. They count electronic bits separately recorded in the computer’s memory. An error in programming or a malfunction can cause the votes recorded in the DRE’s memory to differ from the votes on the printed audit trail. If, when a voter selects Candidate A, the audit trail shows a vote for Candidate A while the computer’s memory records a vote for Candidate B, it is literally impossible for either the voter or elections officials to notice that malfunction unless they count the votes recorded on the audit trail—and under current law, it is highly unlikely they will ever do that. Therefore, this type of malfunction is highly unlikely ever to be noticed.
DREs malfunction in more ways than optical scanners and cause more trouble for elections inspectors when they do. While miscounting may escape notice, elections inspectors do notice mechanical malfunctions—and DREs mechanically malfunction in more ways than optical scanners. Again, think of grocery store receipts: the paper may get stuck, tear, or run out; the reel-to-reel advancing mechanism may malfunction. Or the paper can advance well, but the thermal printing heads fail in some way. How often have you received a receipt that was too faint to read? Other problems that bring DRE voting to a halt include power failures or a full memory.
DRE malfunctions cause more disruption and delay than optical scanner malfunctions. Voting on paper ballots can continue while an optical scanner is out of commission; elections inspectors feed the ballots into the optical scanners after they been reset, repaired, or replaced. But voting cannot continue when a DRE machine is not working unless voters are given paper ballots. After the DRE machine is restored to operation, elections inspectors must hand-count any ballots cast while it was out of commission.
Audits and recounts are more time-consuming with the DRE audit trail than with voter-marked paper ballots. The ease with which a voting system’s results can be audited should also be a consideration. Recounts can happen in any election, and even under current law, populous Dane County can always expect to have at least a few precincts selected for random audits after November elections.
Hand-counting voter-marked paper ballots is as easy as handling a deck of large cards, while hand-counting the DRE audit trail is like working with a long and obstinate cash-register tape. The DRE audit trail must be cut apart, at which point the segments of flimsy thermal-imaging paper curl up. Stacking, sorting, and counting hundreds of pieces of flimsy paper is more time-consuming than doing the same with card-stock ballots. For example, one basic task in hand counts is to place ballots in stacks of 20 or 25. Voter-marked paper ballots can be held, fanned and counted quickly. Segments of the DRE-printed audit trail must be laid on the table, lifted individually (with much licking of fingers), stacked and paper-clipped. Because of their sturdiness, flatness, and high-contrast marks, voter-marked paper ballots can be viewed by two auditors at once, decreasing counting errors, while DRE audit-trail segments can reliably be viewed by only one auditor at a time.
The demand for post-election audits will only increase in coming years. In the foreseeable future—certainly during the functional lifetime of the voting systems Dane County will soon purchase—ease-of-auditing will be an even bigger consideration than it now is. A single well-publicized miscount anywhere in the nation at any time could suddenly bring enormous pressure to bear on all local officials to verify election results. Even in the absence of a high-profile ruined election, voters are becoming more skeptical about voting-machine reliability, and it’s not just fringe groups who are concerned anymore. The Elections Performance Index report released by the Pew Foundation earlier this month singled out vote-counting accuracy as the area of elections administration in which performance measurement was least well developed. Unlike other aspects of election integrity, Pew noted, practices related to measuring the accuracy of election results are “still in their infancy,” and stated that “the issue of (measuring) vote counting (accuracy) is one in which more effort must be expended in the future.”
Innovators are inventing cheaper, easier, and quicker ways to count voter-marked paper ballots. The ‘audit-ability’ advantage possessed by voter-marked paper ballots will become even more pronounced during the next few years. Innovators are developing different ways to use advanced technology to count paper-ballot votes—in addition to the traditional optical scanner. It’s quite possible that post-election auditing—at least in those jurisdictions that use paper ballots—will become easier and cheaper than the process we now use for counting votes on Election Day. For example, digital imaging capability is being built into newer models of optical scanners, providing what is arguably the most significant advance in decades for security and verifiability. As voter-marked paper ballots are fed through the optical scanners, each one can be marked with a unique random number (for security and privacy purposes) and digitally imaged. At poll closing, the machine can produce not just a paper tape showing the results, but a separate file containing an image of each ballot. This file can be preserved in the county for verification purposes, copied inexpensively for citizen auditors, or uploaded to the Internet. In much the same way the Internet posting of Wisconsin’s 2012 recall petitions helped to dispel allegations of invalid or miscounted signatures, jurisdictions that make ballot images available will experience fewer problems caused by voter distrust than jurisdictions that are unable to do more than show skeptics a DRE memory pack and say “We trust the vendor’s programmers and you should, too.”
Other innovators have developed open-source software that can be used with any regular scanner and computer to image ballots and count votes. Such systems can provide an easy, inexpensive, independent method of double-checking voting machine results in the days following an election. While these systems are still in their infancy and not yet as accurate as optical scanners in discerning voter intent on sloppily-marked ballots, the technology is improving—but it will be of use only to those jurisdictions that use voter-marked paper ballots. Jurisdictions with DREs will continue to have no way independently to verify the election results produced by their machines.
Tax dollars spent on DREs flow out of Wisconsin. The use of paper ballots supports Wisconsin businesses. The advantages of optical scanners over DREs go beyond those already described. For example, Wisconsin has no in-state vendors or manufacturers of DREs; expenditures for purchasing, maintenance, training, and post-election verification of DREs benefit only out-of-state vendors. However, Wisconsin does have a significant printing industry, providing clerks with the ability to retain at least some of their elections expenditures in Wisconsin if they use paper ballots. In addition, acceptance of a new voting system among DaneCounty’s voters and municipal elections officials will be less of a problem if the replacement voting system is similar to the old one. Attempts to introduce DREs to DaneCounty are likely to result in substantial controversy and headache, in a way that a switch from older to newer models of optical scanners will not.
Finally, the future of DREs is not bright. Dane County would be unwise to commit itself to DREs in a time of rising voter concern about the transparency of electronic elections. If concern continues to increase, pressures will rise on all DRE-dependent jurisdictions to follow the lead of Wayne County, Pennsylvania; the States of Iowa and New Mexico; and the nations of Ireland and the Netherlands, among other jurisdictions, in scrapping DREs and returning to voter-marked paper ballots. And if voters’ concern over electronic voting subsides, the voting machine of the foreseeable future is likely to be a regular computer terminal or smart phone—again, creating a situation in which Dane County does not want to be stuck with a large investment in DREs.
B. Criteria for selecting a new voting system for Dane County.
Any request for bids for a new voting system for Dane County should contain specifications that will communicate in no uncertain terms Dane County’s interest in accurate and transparently verifiable election results, and that will push every vendor to offer the most advanced and current features for minimizing malfunctions and promptly detecting any malfunctions that do occur.
I cannot today list all the specifications that might be wise. I encourage you, however, to reach into the deep expertise of Dane County’s citizens—particularly those with independent perspectives and specialized knowledge in elections systems and in computer security—as you develop the specifications for the new voting system and the review criteria.
The specifications that I can suggest today, which I believe to be currently within the ability of voting-machine vendors, are these:
- The voting system must provide a way for DaneCounty independently of the vendor, the federal Election Assistance Commission (EAC) and the state Government Accountability Board (GAB), to verify the integrity of all software loaded into each optical scanner. This transparency should cover the source code and all patches, updates, and upgrades, even those the vendor has represented as minor.
The proprietary secrecy of many vendors’ vote-counting software and their practice of installing patches and updates between elections is, arguably, more corrosive of voter trust in electronic vote-counting than any feature inherent in the machines themselves.
Although master copies of all voting machines’ software designs must be tested by independent laboratories paid by the vendors; approved by the federal EAC, and then approved again by Wisconsin’s GAB, the sad fact is that neither of these public entities have the resources that allow them routinely to do a thorough job of either reviewing the master versions/updates or—the more challenging task—verifying an accurate copy of the approved vote-counting software was operating in each voting machine on Election Day.
In addition, federal and state elections regulations allow vendors to install patches and updates on the machines’ software without government oversight or approval, if the vendor declares the modification to be minor. Currently, GAB does not in practice verify these declarations.
Although it seems counterintuitive, open-source software offers more security than secret, proprietary software. Malicious hackers can, it must be admitted, gain access to both open source and proprietary software; it’s just harder with proprietary software. Once a hacker has access to proprietary software, the motivated hacker has few disincentives for making alterations, since very few people will be able to discover the alterations, all of whom have a vested interest in hiding the fact that their software was hacked. Open-source software, however, has a strong, built-in deterrent: Any crime must be committed in full view of anyone who decides to check. Many people have the opportunity to notice any alterations, and most of them have no reason to keep their discovery quiet.
I have been told (and it makes sense to me) that the vote-counting software need not be complicated relative to other common applications and that voting machine companies need not and do not compete on the elegance of their code. I have also been told (but have not yet confirmed) that some vendors are already forgoing claims of proprietary secrecy to meet their customers’ demands that the integrity of the machines’ source codes be open for independent verification.
Additional specifications suggested to me by a software professional with voting-machine knowledge are that the voting machines must be wholly reprogrammable by the election workers and officials, and device interfaces must be clearly documented to make that practical. The software must come in such a form that it can be housed on the election authority's servers and can be loaded into the voting machines whenever the election authority chooses.
2.Each optical scanner will have no wireless communications capability, or will have a feature that enables elections officials physically to disable any wireless communications capability on Election Day (e.g., remove a communications card).
Wisconsin elections officials currently perform public tests of the voting machines’ set-up before each election. These tests demonstrate that the machines are working well before the polls open, but any susceptibility to unauthorized alterations on Election Day undermines the value of the pre-election testing. This specification would address of some of that distrust.
- (NOTE FOR THIS BLOG: These criteria were numbered correctly in the letter. When I copied them onto this blog, they all went to #1. Ignore that.) The vendor will agree to specific reasonable charges, or no additional charges, for assisting DaneCounty in complying with Wisconsin’s open-records laws and with any public investigations into any suspected irregularities or anomalous results.
In the controversies that followed the 2012 recall elections, county clerks were faced with open records requests for the materials related to the election results, which included memory packs and programs of the voting machines. Some vendors imposed unexpected—and unexpectedly high—charges on local elections officials who needed to retain the materials until the open records requests were resolved. This is a reasonably foreseeable issue that should be covered in the contract with the vendor, and Dane County is more likely to get a favorable arrangement if the negotiation occurs before the contract is signed than after.
- In the event that any malfunctions or irregularities are noted during a recount or post-election audit, the vendor agrees to cooperate with an independent investigation of the causes of the malfunction or irregularity.
Current state law and regulations provide that, in the event of a noted anomaly in a post-election audit, GAB staff will investigate and then, if it cannot identify the cause of the miscount, it will order the vendor to investigate itself. Given GAB’s current resources, the inability of most normal human beings objectively to investigate their own employer, and the inability of most normal human beings to trust the results of such investigations, these provisions are unlikely to restore public confidence in the event an anomaly or malfunction is discovered. DaneCounty will want to provide for more credible investigations in the event any serious malfunctions or anomalies are noted. Such a contract provision may also have a preventive value.
- Each optical scanner must have the capability to print a random number on each ballot as it is scanned and to create and store a secure digital image of each ballot.
To allow DaneCounty to take advantage of technological and legal advances that will enable the use of digital images to support efficient auditing of election results, any new machines we purchase should come with this capability built in, even if we do not use it right away.
- The system will not rely on central tabulation of votes. Each machine will have the capability, on Election Day, to count votes at that polling place and print out the results without communication to any other computer or to the Internet.
Electronic transmission of voting data for central tabulation outside the precinct is another source of voter skepticism related to electronic voting. Results that are tabulated on site before any opportunity for external interference receive stronger voter confidence.
- Each machine will print out results indicating for each race the number of votes for each candidate or available choice; the number of undervotes; and the number of ballots that contained overvotes.
This information allows elections inspectors, county clerks, and county boards of canvassers promptly to notice signs of some of the more common forms of machine error.
Please consider those suggested criteria to be preliminary. Others have more expertise than I do regarding the possibilities and recent advances in vote-counting technologies and practices. I am offering them as a starting point that I hope will encourage you and others involved in the procurement process to think constructively and aggressively about how the County can use the procurement and contracting process to push vendors continuously to improve their product to increase voters’ confidence in the integrity of Dane County elections.
Again, thank you for considering citizen input at this stage of the selection process. Although I am coordinator of Wisconsin Grassroots Network’s statewide Election Integrity Workgroup, I have not yet taken the time to conduct the sort of group process that would enable me to characterize the contents of this letter as anything other than my own views. I am asking that you consider it as that. Also, I did not take the time to footnote all the facts as I wrote this letter, but I’ll be happy to provide you with more in-depth information on anything I’ve discussed and to provide you with references.
I would appreciate being kept apprised as the selection process proceeds. In particular, I am requesting to be notified of opportunities to attend demonstrations, ask questions of vendors, and to receive notices of public meetings and hearings at which the replacement of our voting systems will be discussed.