Elections Commission
2009 2008 2007 2006 2005 2004 2003 2002 Questions from attendees to the
March 29, 2006 Forum on Voting Systems
- “Has anyone/group developed a good set of electionwatch material (for entire voting system of the election, not just the machine) especially for day of the election.” - Kaye Griffin ([email protected])
Responses:
Warren Slocum, Chief Elections Officer, San Mateo County:
I don’t know of any.
Alan Dechart, President, Open Voting Consortium:
I assume you mean something for voters to use in contrast to procedures that elections officials use. I believe that Black Box Voting has put together some materials along these lines.
Courtenay Strickland Bhatia of Verified Voting Foundation:
Various groups have developed materials for observing elections. The Election Protection Coalition, which is composed of many groups and led by People for the American Way and the Lawyers’ Committee for Civil Rights Under Law, has Election Day polling place observation programs in various areas of the country and has created materials for the volunteer observers.
For the November 2004 elections, VVF sponsored a program called TechWatch, which focused on observing logic and accuracy testing of voting equipment by elections officials prior to Election Day, and on providing technical expertise to polling place observation during Election Day.
The Verified Voting Foundation web site provides significant guidance for observation, including information for observation at the central tabulating facility and questions for observers to consider when observing any logic & accuracy testing that is scheduled by the county.
Please see http://www.verifiedvotingfoundation.org/downloads/20041024.pollmonitorsguide.pdf for poll monitor observation information and http://www.verifiedvotingfoundation.org/article.php?id=6153 for questions that observers can take with them when going to observe pre-election testing.
Individuals wishing to engage in observation at the county’s central office may need to make advance arrangements due to space limitations. For observation of logic & accuracy testing, one would need to contact the Elections Department in advance to find out the schedule.
VVF has also worked with the Miami-Dade Election Reform Coalition in the past to sponsor “poll closing” observation in Miami, Florida. That particular observation program focused on ballot accounting at the time of poll closing – reconciling the number of votes cast on the machines with the number of voters signing in at the polling place. In November, 2004, such a program revealed election irregularities that offered lessons for election administration across the country.
For November 2006, VVF anticipates implementing a targeted observation program similar to the 2004 poll closing project in additional counties. We will be preparing materials for groups that wish to implement such a program.
2. “What is your opinion of increasing audits (to approx. 10%)?” – Jennifer Hammond.
Responses:
Warren Slocum, Chief Elections Officer, San Mateo County:
I am OK with this proposal – and we should include absentees in the audit.
Alan Dechart, President, Open Voting Consortium:
Audits need to be improved. It’s not just a matter of increasing the percentage, however. Ensuring a statistically valid audit is a complicated matter. How sure do we need to be that the results were correct? 99 percent? How about 99.9999 percent? Or what? And, what do you mean by correct? For example, consider these two questions:
- Were there anomalies in the count?
- Was the winner of the contest correctly declared?
Which question do we care about the most? In a landslide, there could be quite a few anomalies while we could still have a high confidence level that the winner was correctly determined.
Then, what actions are to be taken depending on the audit results?
Here’s the problem: the best answer (which would include a lot of statistical formulas and such) is way too complicated and scientific to include in election law. The formulas would also depend somewhat on the voting technology employed. An answer with language simple enough to be included in a bill (like “10% audit”) is not sufficiently detailed.
The best way to handle this would be to create a published standard and reference that standard in the law. This way, the standard could be refined and improved without needing to change the law. The law could say something like “audits will be done in accordance with the XYZ election audit protocol maintained by the National Institute of Standards and Technology (NIST)” (I’m not suggesting that NIST is the right body to maintain this standard – just using this as an example).
Courtenay Strickland Bhatia of Verified Voting Foundation:
The effectiveness of auditing a small number of precincts is greater in a statewide election than in a citywide election. This means that auditing 10% would be more useful for races representing fewer voters. There is an obvious cost tradeoff, though.
- “I tend to trust our optical scanning voting machines, but I wonder about the equipment downstream or i.e., the tabulating machines. How reliable are they?” – Allyson Washburn (V.P., League of Women Voters of SF)
Responses:
Warren Slocum, Chief Elections Officer, San Mateo County:
There is no perfect system. I like them because in a recount situation you always have a real ballot voted by the voter.
Alan Dechart, President, Open Voting Consortium:
We can assume they are reliable because they have been tested. But should be assume that? Tabulating machines are black boxes whose inner workings cannot be checked by the public. We just have to take it on faith that the authorities are making sure. Shouldn’t the details about how these systems work and how they are tested be made public? I think so.
Courtenay Strickland Bhatia of Verified Voting Foundation:
It is easier for someone with a password to change lots of votes in the Election Management System, which handles tabulation, than in lots of machines. However, it is also easier to audit the EMS, if the election office helps.
1. Precinct-by-precinct data should be posted on the internet as soon after the election as possible.
2. Precinct results should be posted at the polling place as soon as they are printed at the close of the election. California law can be read to require this, and Secretary Shelley issued a rule that it had to be done. That rule may still be in effect. Anyone can then compare the posted results with the results on the internet, and add up the numbers themselves.
3. Another step could be to ask poll workers to print extra copies of the results, and compare the numbers the next day to make sure the internet results match their numbers. While I don’t know whether anyone does this, it would probably be doable.
This goes back to the primary point that it’s important for the voting system in its entirety to provide transparency, reliability, and security, and for the system to be administered in a transparent, reliable, and secure manner. Tabulating machines can have vulnerabilities, both in terms of reliability and security, that must be managed. Ion Sancho, Supervisor of Elections in Leon County, Florida, showed how his own tabulating machine could be quickly manipulated by someone on the inside in order to change election results. It’s important to choose the best possible equipment, but also to establish practices that will guard against exploitation of any vulnerabilities that the system may have. The three steps above are some good practices to follow.
- “Is ‘interpreted’ code really prohibited by the FEC 2002 Regulation or is it merely ‘voluntary’ and if only voluntary – what are the teeth to the regulation?” – Pete Newcome
Responses:
Warren Slocum, Chief Elections Officer, San Mateo County:
Cannot comment.
Alan Dechart, President, Open Voting Consortium:
This is a pretty complicated question, legally and technically. I’ll try to be brief. Computers (binary computers, actually) only understand zeros and ones (“machine code”). Programmers don’t write the machine code that computers understand directly. Programmers write code using words and symbols relevant to their programming language of choice. Before a program can run, these words and symbols have to be translated into code the computer can understand – the translation will be done by another program, either an interpreter or a compiler, that works with the specific language and computer in use.
There are a couple of ways programmers’ code can be translated into machine code: all-at-once, or on-the-fly. Interpreted code is programmers’ code that gets translated into machine code on-the-fly. The interpreter (the program that interprets or translates the programmers’ code into machine code) works line-by-line as the program executes (actually, some modern interpreters are smart enough to do more than a line at a time). Have you ever seen someone giving a speech in one language, stopping periodically while an interpreter repeats what is said but in another language? It’s like that, but with computers the first speaker is talking the programmer’s language and the interpreter repeats it in machine language. In a way, this is inefficient because the code may be executed over and over as the program repeats all or part of what it is designed to do. So, the same line of code may be translated into the same machine code over and over. Why not translate all the programmers’ code into machine code and be done with it?
A compiler does just that. It takes the programmers’ code and translates the whole thing into machine code. No interpretation (or translation) is needed while the program is executing because it’s all written out in machine code (analgous to the speaker-translater example, it’s like the original speaker doesn’t say anything … only the translation is read). In this way, a compiled program is more efficient and will execute faster than interpreted code. So why use interpreters at all?
With an interpreter, you can change the code and then run it. With a compiler, you have an extra step. You change the code, compile it, and then run it. Compilation can be automated to a certain degree, but when programs get large and complicated, this extra step can take some time.
So, it’s easier to change a program that uses an interpreter compared to a program that uses a compiler. Does this mean that interpreted code is more hackable (because it’s easier to change)? Yes, in some ways, but not necessarily. A lot of this depends on the physical security of the equipment. A computerized system used in the voting process that has no interpreted code could still be hackable. If someone with sufficient knowledge and tools has access to the machine, s/he could introduce malicious software.
Do the 2002 standards prohibit interpreted code? I have read the standards and nowhere does it say anything like, “interpreted code (or interpreter) is not allowed.” There are some requirements that would seem to exclude interpreters, but there is also some language that would seem to allow them (that’s not the only instance where there is some vague and contradictory language in the standards). It has been asserted that interpreters are prohibited, and enough authorities seem to have bought into this viewpoint to make it fact (or near fact).
So, let’s assume that the 2002 standards say that interpreted code should not be used. Does that really mean NO? Is it illegal to have interpreted code in a voting machine? Not exactly.
The guidelines are voluntary. No one is required to follow the standards. Furthermore, there has been little oversight when it comes to ensuring the standards are followed in the certification process. Certification is a transaction between two private companies: the vendor and the test lab. For the most part, no one else is involved and they keep everything a secret. The Help America Vote Act of 2002 (HAVA) created the Election Assistance Commission (EAC) and gave them some oversight responsibilities. However, this new system has not really kicked into gear yet (and it’s not clear how new the system is or will be… the EAC hired Tom Wilkey, the guy that used to run the old system).
Notwithstanding the voluntary nature of the guidelines, the provisions may be considered mandatory for California. This is because California has chosen to opt into this system. Still, it can be a challenge to know what those provisions are. Test authorities seem to say interpreted code should not be used but they did allow it. Will they continue to allow it?
I have recommended (and will continue to recommend over and over) that CA opt out of this system. It will not be trivial to get out, and will take some time (if we opt out right now, we may have to repay some HAVA funds). We need to put an alternate system in place. We should probably be working with the EAC and the CA alternate system in parallel for a while before we cancel out of the old system.
So, to make a long story short, as long as California has opted into this system, we need to go along with the requirements. It’s not perfectly clear that interpreted code is not allowed. The Secretary of State needs to find out.
Courtenay Strickland Bhatia of Verified Voting Foundation:
The interpreted code requirement is subject to interpretation (no pun intended). The recent report by the Secretary of State's Voting Systems Technical Assessment Advisory Board (VSTAAB) said that interpreters were contrary to the FEC 2002 requirement.
This rule has not been enforced well by the Federal certification process.
Some technical experts say that interpreters are not inherently bad, although Diebold's way of using them is problem. The FEC 2002 regulations are neither clear, nor particularly well-informed technically on this question.
- “California law requires an accessible voter-verified paper trail. When is a paper trail considered accessible, and do the voting systems certified for use in California meet or violate this state law?” – anonymous
Responses:
Warren Slocum, Chief Elections Officer, San Mateo County:
The paper trail component is deemed “accessible” when a voter can validate his/her vote independently and in private. In a DRE environment, the choices of a voter should be “read” back to the voter through headphones from the paper trail (EC 19251a). Currently, the Diebold, Sequoia, and the Hart InterCivic voting machines certified by the state “read” back votes from the tally component of the system, but not directly from the paper trail.
Alan Dechart, President, Open Voting Consortium:
See section 19251(a) of the election code:
19251. For purposes of this article, the following terms shall have the following meanings:
(a) "Accessible" means that the information provided on the paper record copy from the voter verified paper audit trail mechanism is provided or conveyed to voters via both a visual and a nonvisual method, such as through an audio component.
This section says the audio readback is supposed to come from the paper. I don’t think any of the current systems do that. The audio is not obtained from the paper but from the stored data reflecting voter choices.
So, it seems that current DRE systems with the voter verified paper audit trail are in violation of state law.
Courtenay Strickland Bhatia of Verified Voting Foundation:
I don't think this question has been clarified. Verified Voting's position for a long time has been that people with disabilities have to be able to verify the contents of the VVPR, by electronic means if need be. In other words, the results have to be read off the paper, either by eye or electronically.
This requirement was in one of the original drafts of California's paper trail requirements, but it was then watered down. So far as we know, the AutoMark is the only accessible machine that reads back the marked ballots electronically.
- “Does HAVA require counties to purchase new electronic voting systems? If not, has SF considered using the HAVA funds for good quality, transparent scanning equipment not the error-prone Sequoia machines?” – Lee Munson
Responses:
Warren Slocum, Chief Elections Officer, San Mateo County:
A: HAVA requires that all voters be able to vote independently and in private. Current scanning (paper base) voting system cannot meet this requirement by itself. Therefore, new electronic voting systems made to serve this segment of the voting population must be acquired.
Courtenay Strickland Bhatia of Verified Voting Foundation:
This is an excellent question, and one that Verified Voting has heard from several counties. In answer to it, we prepared a commentary entitled, “Voting Systems Purchases and the Help America Vote Act,” which can be downloaded at http://www.verifiedvotingfoundation.org/article.php?id=6346. In short, before January 1, 2007, HAVA does permit the acquisition of ACCESSIBLE optical scan voting systems. On or after January 1, 2007, HAVA still permits the acquisition of accessible optical scan systems so long as HAVA Title II funds are used only for purchase of the accessible components.
At present, Verified Voting encourages the use of precinct-count optical scan voting systems and accessible ballot-marking devices as the most practical, cost-effective and accessible means of providing a voter-verified paper record, which is the essential ingredient for meaningful recounts and routine audits.
- “It seems to me that a 1% audit of precincts is inadequate. What can be done to improve the rigors of audits? We need to be reasonably sure that no cheating is going on.” – Jim Soper
Responses:
Warren Slocum, Chief Elections Officer, San Mateo County:
A: As a general policy we should strengthen the Canvass of the Vote process which includes the 1% manual recount. Specifically we should increase the requirement from the current level; we should run software checks to ensure the version of software used on Election Day was the same as the version certified; and we should include absentees in the Canvass process. In addition, there should be a mandatory recount statue which would require the government to automatically recount a contest if it is within a certain percentage.
Alan Dechart, President, Open Voting Consortium:
Same answer as I gave in #2 above.
Courtenay Strickland Bhatia of Verified Voting Foundation:
For a statewide race, 1% may be enough. For a local race, it doesn't prove much. One solution is to count more precincts.
Randomly auditing small races is a big problem. Audits that take advantage of randomly selected BALLOTS instead of PRECINCTS could theoretically be much more effective, but they would require some way of individually matching paper and electronic ballots. We don't know if this method could be applied to existing equipment.
One step that can be taken to improve the rigors of audits is to make sure that random audits are truly random. In order to do this, selection of the precincts must be public, transparent, and random in a way that is easily observed by the general public. For example, a researcher with the ACCURATE (A Center for Correct, Usable, Reliable, Auditable, and Transparent Elections) project has suggested that rolling 10-sided dice under public observation might be one way to achieve true randomness and transparency at the same time.
- “San Francisco’s current voting equipment is pretty good (i.e., paper trail op-scan). Can we meet HAVA standards without throwing all that out? Something new might be worse.” – Brian
Courtenay Strickland Bhatia of Verified Voting Foundation:
You have a point. Access for persons with disabilities needs to be addressed.
- “Are efforts being made towards implementing background checks and enforcement for vendors?” – anonymous
Responses:
Warren Slocum, Chief Elections Officer, San Mateo County:
Not that I know about.
Courtenay Strickland Bhatia of Verified Voting Foundation:
Probably not. One issue that we might want to consider is whether procurement standards should be linked to the certification process – for example, requiring vendors to demonstrate their capacity to fill orders.
- 10.“Were the vendors the same in each of the voting poll places where there were discrepancies between reported counts and exit polls?”
- anonymous
Response:
Courtenay Strickland Bhatia of Verified Voting Foundation:
No.
Why advocate for complete open source systems, software; hardware & firmware, considering that 99% of people/voters are not technically skilled enough to even look at source code? And considering that some number of people who could, in fact, look at source code may be the type of person who would consider doing something malicious, why invite that? Would it not be better to allow "disclosed source" systems, and have a wide body of responsible individuals and organizations (including the Open Voting Consortium) invited to review software that is in a more accessible escrow environment? What is wrong with the "disclosed source" system?- Commissioner Gerard Gleason
Response:
I covered part of this in my presentation. It doesn’t matter if “99% of people/voters are not technically skilled enough to even look at source code.” A similar percentage of people cannot evaluate legal code either. But we still want that freely available online for anyone that wants to study it.
The limited disclosure model you describe has its own problems. Who gets to review the code? Under what conditions? It may be a liability to look at it depending on what the disclosure agreement says. Will vendors have a say in approving/disapproving reviewers?
You specifically mention Open Voting Consortium but that may present serious conflicts of interest for us. I probably would advise our engineers to not look at it just as I did when VoteHere disclosed their source code. If few organizations/individuals get to see it, there may be too much work and responsibility placed on them. Real testing is a lot of work. Will the reviewers get paid? How much? By whom?
Review by prominent academics is not likely to be conclusive. They’re going to find plenty of issues. I don’t see disclosure as a way to give a thumbs up or thumbs down. Vendors need to come clean and say, “see, we have nothing to hide.” This will improve public confidence. With full public disclosure, over time, the large body of reviewers will contribute improvements.
Generally, I favor full public disclosure because there are more pros than cons
- For Slocum, Dechert & Bhatia:
Why is there a need to allow individual California counties to select voting systems from a multitude of vendors? Many county registrars talk about the "uniqueness" regarding the voting systems needs of their jurisdictions, however it seems all elections require one simple product, a device to count votes. Some states have single system or selected choice voting systems. Given that in the private sector, 19 vendors would unlikely be able to compete delivering most products to such a restricted market need, why should California counties continue to engage in such a disjointed purchasing model? Why not restrict the selection to one or two reliable systems?
- Commissioner Gerard Gleason
Responses:
Warren Slocum, Chief Elections Officer, San Mateo County:
California counties have always enjoyed freedom from state control in this area despite the fact that under law counties are considered an arm of the state. Perhaps the government should sponsor efforts to create a open voting system that could then have incentives for counties to use? Local Registrars have always had the power to select the machines of their choice – I could envision the state changing this but it would be difficult. And once again, there is no perfect voting system and this approach would have pros and cons – plus the always present “unintended consequences.”
I favor moving to one system in California – public software and commodity hardware. In this business model, election vendors would make their money on the services they provide to counties – not on the hardware and software. Hardware would be purchased from companies like Dell, IBM, HP, etc. Software would be free.
Courtenay Strickland Bhatia of Verified Voting Foundation:
It’s possible to make statewide mistakes. Los Angeles does have different needs from rural counties, because of the sheer number of ballots. LA needs to allow voting in SEVEN languages, by law.
Also, if systems are chosen on a statewide level, we should be mindful of the impact that the voting machine selections of big states like California and Texas would likely have on the market as a whole. Voting machines could become like text books, with big states essentially determining through their choices what small states must use, since the vendors would likely cater to markets in the largest states.
With respect to the number of voting machine vendors, currently, the market is an oligopoly that is dominated by just a handful of companies. In Florida, all the vendors certified in that state refused for a time to do business with a Florida county whose election official exposed security vulnerabilities in his voting system. The small number of certified vendors (not to mention the behavior of the ones that were) was a big problem.
While this is not to say that we shouldn’t adopt statewide systems, it is to say that there are a variety of factors that must be taken into account in determining whether that is a good idea.
- 14. “I hear SF is considering Sequoia and Auto-Mark. Will SF consider one of the vote assistive devices, for example, Vote Pad or Equalivote to comply with HAVA’s disability access requirements.” – Sherry Healy
Response:
None of the panelists responded to this question.