E-Voting News and Analysis, from the Experts

Problems in Maryland Just Now Surfacing?

Wed, 09 Mar 2005 01:13:41 +0000

It appears, if this report pans out, that there were massive systemic failures across Maryland involving Diebold AccuVote-TS machines last November; problems including lost votes, multiple machine failures and even unreadable data cartridges.

Why have we only heard about this now? It’s unclear. From the first report I’ve seen on this:

Scoop: Emerging Scandal on MD Voting Machine Performance

Montgomery County, Maryland. According to county election officials and other sources, all Maryland voting machines have been on ‘’lockdown'’ since November 2, 2004 due to statewide machine failures including 12% of machines in Montgomery County, some of which appear to have lost votes in significant numbers. The State Board of Elections convinced the media that Election Day went smoothly, when in fact there were serious statewide, systemic problems with the Diebold electronic voting machines – so serious that the SBE and Diebold still have not figured out how to prevent the loss of votes in the future.

“Election Day was anything but smooth. Votes were lost, computer cards storing votes were unreadable, thousands of error messages were reported, machines froze in mid-voting and machines refused to boot up. The problems with the machines were so widespread and serious that efforts to hide the problems have failed,” said Linda Schade, director of TrueVoteMD.org. “It is not sufficient for Diebold and the SBE to investigate themselves. They have misled the public about this problem and an independent investigation is needed. Further, these problems indicate that the Diebold machines should be decertified as required by Maryland law and as provided for in the Diebold contract. This is an opportunity to correct the mistaken purchase of paperless electronic voting machines. Diebold should refund Maryland tax dollars and we should start anew with a system that voters trust because it can be independently audited and recounts can be meaningful.”

We’ll need to see some corroboration of this report and what evidence is consistent across the report and what the Maryland elections officials have to say for themselves. I truly hope that this hasn’t been shrouded in secrecy for more than four months… that would be an unqualified disaster of the electoral system and responsibility would lie on the shoulders those we entrust to ensure our votes count.

UPDATE [2005-03-09 17:03:57]: A bit more information on this situation has surfaced in an AP story and in a few critical documents on the TrueVoteMD website.

Apparently, the Montogomery County Board of Elections just released a report, “2004 Presidential General Election Review - Lessons Learned”, which is the basis for the data cited in the story below. Note that the Maryland State Board of Elections claims to have not seen this report and disputes these numbers saying that only 12 out of approximately 3,000 machines in Montgomery County failed.

TrueVoteMD has posted copies of the report (linked to above) and an internal memo, “Montgomery County Root Cause Failure Analysis”. These documents appear to be authentic (that is, no county official is yet disputing their authenticity).

Here’s the skinny from the AP story:

Report Shows Problems With Montgomery Voting Machines

ROCKVILLE, Md. (AP) - A review of voting machines used in Montgomery County on Election day found that 7 percent of the machines had problems such as frozen screens or failed to boot up.

An additional 5 percent had vote tallies that were considerably lower than other machines used in the same precincts, causing elections officials to deem them “suspect,” according to the report drafted by the county in December for the local election board. […]

[Montgomery] county’s review of the election concluded that 189 of the units failed. Of those, 58 would not boot up and 106 had the screen freeze.

“In staff opinion, this is the most serious of the problems,” the report states of the screen freezes.

An additional 122 units had results that were deemed suspect, meaning each had 25-50 votes recorded when all other units in a polling place had more than 150 votes.

Margie Rohrer, spokeswoman for the county election board, said some of the machines have been sent to Diebold for testing. She referred all other questions to the state board. The report does not mention whether the vote tally was affected by the problems. […]

Exit Poll Post Mortem

Mon, 31 Jan 2005 13:42:28 +0000

Paul Velleman at left2right has an interesting analysis of the exit poll data from the November presidential election.

His conclusions:
(1) Discrepancies between exit polls and votes cannot be explained by random chance, so the discrepancies must have had a systematic cause.
(2) Explanations given by the exit pollsters are not statistically plausible.
(3) We don’t yet have an adequate explanation. Perhaps we’ll find one after the exit pollsters release their precinct-by-precinct data.

“Christopher Danielsen’s Voting Experience and The Nature Of Accessibility [and Human Factors]”

Wed, 15 Dec 2004 05:00:02 +0000

Christopher Danielsen, the editor of NFB’s The Voice of the Nation’s Blind, describes his experience casting a ballot on a Sequoia AVC Advantage (a full-face button-matrix DRE) with a braile template and instructions (“On My Voting Experience and The Nature Of Accessibility”). In addition to highlighting how difficult it is to vote with tactile templates, it provides some stark illustrations of human factors issues such as environmental conditions and voter fatigue (which can be particularly heightened with the lengthy process of reading braille… not to mention that braille literacy rates have been dropping):

The ability of a blind person to vote privately and independently does not consist merely of being able to identify which button to press, or which oval to mark, or which hole to punch in order to make a candidate selection. Sighted voters receive confirmation that their vote has been cast, and on newer equipment they are told whether they have over-voted or under-voted a race and so forth. Blind people should receive responses from the voting terminal which tell us what we have accomplished. Similarly, we should be able to navigate through contests and ballot questions at our own pace, and we should be able to review our ballot before casting it as sighted voters can. A static template can’t replace this interactive voting experience, whether that template is laid over a punch card or optically scanned ballot or a touch-screen machine. We must have response from the machine to indicate that the voting machine is accurately recording our choices and that our ballot is cast as we intended. Otherwise, we will be left only with the option of having a poll worker or a person of our choice review the ballot with us to make sure our votes are cast as we intend. While blind voters should certainly be permitted to retain the option of using assistance from another individual of our choice if we so desire, the chance to have a completely private and secret voting experience must not be denied to any blind voter. It is available to every sighted voter, and thus true equality for the blind will not be achieved in voting unless it is also available to us.

More Information Surfaces About ES&S “Counting Backwards” Feature/Bug

Tue, 14 Dec 2004 22:00:08 +0000

More information has surfaced in a letter from ES&S to Guilford County, NC, Board of Elections (provided by Joyce McCloy, PDF here and text here):

We would like to explain in further technical detail what caused this issue, should you or others at the county have questions. the 32,767 capacity limitation at a singled precinct level is a function of the design and definition of the results database used by ERM. The data storage element used to record votes at the precinct level is a two byte binary field. 32,767 is 2 to the 15th power, which is the maximum number held by a two byte word (16 bits) in memory, where the most significant bit is reserved as the sign bit (a plus or minus indicator). Additionally, ERM precinct count level data is stored in a binary computer format known as two’s complement. Data on ERM results reports are printed as the absolute value of the two’s complement of the associated data in the ERM database. This means that once the 32,767 limitation is reached, additional incremental tallies of vote results would not be printed correctly (32,768 through 65,536 would actually be represented as 65,536 to 32, 768).

While this value, 32,767 is certainly higher than any practical value that could be tabulated in a single election day precinct, the consideration of reporting all absentee ballots or early voting into a single absentee or “One Stop” precinct does hold the possibility of yielding much higher totals than what may be possible in single election day precincts.

This appears to be a case where a local jurisdiction used voting equipment out of the context of the vendor’s design. If they had used an unsigned 16-bit integer variable, they could have reported 65,536 votes.

561 Votes found in Washington

Tue, 14 Dec 2004 19:34:31 +0000

Washington is in its third vote-count. There was the initial count, then a recount and now a third hand count. King county has been particularly fluctuant in its reported numbers in each of these counts. Now – where the margin of victory in the Governor’s race is 42 votes according to the second recount and 88 votes counting votes found in the current recount – King County has found 561 ballots that were improperly disqualified because signatures of a few hundred registered voters had not made it into their registration database (these signatures existed on the hard-copy registration cards) (from the Seattle Times, “Error discovery could give Gregoire election”):

The King County error came to light Sunday when Larry Phillips, chairman of the Metropolitan King County Council, was looking over a list of voters from his neighborhood whose ballots had been disqualified.

Phillips spotted his own name on the list, prompting an investigation by King County elections workers that turned up 561 improperly disqualified ballots.

King County Elections Director Dean Logan said that when workers were verifying signatures on absentee ballots, they erroneously disqualified voters whose signatures hadn’t been entered into a computer system.

Instead, Logan said, they should have double-checked with signatures on voters’ registration cards on file with the county.

This is yet another reminder that the voting system is exactly that, a system. There are many points of failure outside of the polling place and even the central tabulation activities. Any part of this system can potentially affect the outcome of the race, by accident or on purpose.

NRC on Electronic Voting

Mon, 06 Dec 2004 18:23:14 +0000

The Committee for Electronic Voting - under the Computer Science and Telecommunications Board (CSTB) of the National Academies’ National Research Council (NRC) - recently issued a call for papers for input on what questions policy makers should be thinking about given the current state of electronic voting. Here are the whitepapers submitted (listed alphabetically by author/organization):

Making Each Vote Count: A Research Agenda for Electronic Voting, report of an AAAS workshop on electronic voting, October 2004
The Need for Usability of Electronic Voting Systems: Questions for Voters and Policy Makers, ACM Special Interest Group on Computer-Human Interaction (SIGCHI), U.S. Public Policy Committee
Voting, Vote Capture and Vote Counting Symposium: Electronic Voting Best Practices, Jean Camp, Allan Friedman, and Warigia Bowman, Harvard University John F. Kennedy School of Government, June 2004
Electronic Voting Machines in South Carolina, Duncan Buell and Carter Bays, University of South Carolina
Electronic Voting, David Dill and Will Doherty, Verified Voting Foundation
Accessibility and Auditability in Electronic Voting, Electronic Frontier Foundation
Electronic Voting Machines and the Standards-Setting Process, Eddan Katz and Rebecca Bolin, Yale University School of Law
Putting People First: The Importance of User-Centered Design and Universal Usability to Voting Systems, Sharon Laskowski, National Institute of Standards and Technology; and Whitney Quesenbery, Whitney Interactive Design LLC
Illustrative Risks to the Public in the use of Computer Systems and Related Technology, Excerpt: Election Problem Cases as of [November] 25, 2004, Peter G. Neumann, SRI International
Preliminary Analysis of E-Voting Problems Highlights Need for Heightened Standards and Testing, Deirdre Mulligan and Joseph Lorenzo Hall, University of California, Berkeley
Electronic Voting Systems: The Good, the Bad, and the Stupid, Barbara Simons

Hand Recount of Computer Results

Mon, 06 Dec 2004 15:12:36 +0000

Two Washington counties are going to recount e-voting results by printing them out from a computer and then counting the printouts by hand, according to an AP story.
The e-voting technology stores each vote in an electronic cartridge. These cartridges will be used to create a PDF file for each ballot, which will be printed, thus allowing a hand recount of paper ballots.

This makes no sense, obviously. If the electronic cartridges are the only available records of how people voted, then the print-then-recount-by-hand procedure can only introduce further errors. (Of course, recounting voter-verified paper ballots, had their been any, would have given us useful information about how votes were cast.)

So why is this charade going on? Presumably because Washington state law requires a recount of paper voting records when recounting a very close election, such as this year’s gubernatorial election. Perhaps the current law was adopted back before anybody foresaw the possibility of computerized voting.

This kind of problem isn’t unique to Washington state. I understand that New Jersey election laws require election machines to be examined by mechanical engineers. That made sense back when all such machines were mechanical, but it’s the wrong approach for computerized machines. Technology has moved much faster than voting law.

UPDATE (Dec. 7): One of the two affected counties (Snohomish) has asked for permission to transfer the machine votes onto computer tape, and then use a computer to recount the records on the tape, according to a Seattle Times Changes found in segregation amendment recount

The statewide recount on a measure to remove segregation-era language from Alabama’s constitution is turning up variations from the official canvass, with changes exceeding 100 votes in at least three counties.

These three counites (Hale, Macon and Madison) all use the same type of voting technology - ES&S’s Optech-III Eagle optical scan machine. (Note that 75% of all of Alabama counties use the same technology… 95% of counties use optical scan (different models)).

Not surprisingly, the totals in the counties that used DRE equipment didn’t change. That’s not the kind of thing that inspires much confidence in our crowd. If they had recounted a slew of voter-verified audit trail documents and compared to a retally of electronic ballots, that would be begin to be a proper audit… as Doug Jones, pointed out in his October 2004 CACM piece, “Auditing Elections”,

One important aspect to examine is the chain of custody for each piece of evidence pertaining to the election. What machinery produced this data, who collected it from the machine, and how was it preserved? What we need is analogous to the documentation for the chain of custody required to bring evidence to court in a criminal case.

New Study of E-Voting Effects in Florida

Fri, 19 Nov 2004 15:09:37 +0000

Yesterday, a team of social scientists from UC Berkeley released a study of the effect of e-voting on county-by-county vote totals in Florida and Ohio in the recent election. It’s the first study to use proper social-science modeling methods to evaluate the effect of e-voting.

The study found counties with e-voting tended to tilt toward Bush, even after controlling for differences between counties including past voting history, income, percentage of Hispanic voters, voter turnout, and county size. The researchers estimate that e-voting caused a swing in favor of Bush of up to 260,000 votes in Florida. (A change of that many votes would not be enough to change the election’s result; Bush won Florida by about 350,000 votes.)

No e-voting effect was found in Ohio.

The study looks plausible, but I don’t have the expertise to do a really careful critique. Readers who do are invited to critique the study in the comments section.

Regardless of whether it is ultimately found credible, this study is an important step forward in the discourse about this topic. Previous analyses had shown differences, but had not controlled for the past political preferences of individual counties. Skeptics had claimed that “Dixiecrat” counties, in which many voters were registered as Democrats but habitually voted Republican, could explain the discrepancies. This study shows, at least, that the simple Dixiecrat theory is not enough to refute the claim that e-voting changed the results.

Assuming that the study’s authors did their arithmetic right, there are two possibilities. It could be that some other factor, beyond the ones that the study controlled for, can explain the discrepancies. If this is the case, we can assume somebody will show up with another study demonstrating that.

Or it could be that e-voting really did affect the result. If so, there are several ways this could have happened. One possibility is that the machines were maliciously programmed or otherwise compromised; I think this is unlikely but unfortunately the machines are designed in a way that makes this very hard to check. Or perhaps the machines made errors that tended to flip some votes from one candidate to the other. Even random errors of this sort would tend to affect the overall results, if e-voting counties different demographically from other counties (which is apparently the case in Florida). Another possibility is that e-voting affects voter behavior somehow, perhaps affecting different groups of voters differently. Maybe e-voting scares away some voters, or makes people wait longer to vote. Maybe the different user interface on e-voting systems makes straight party-line voting more likely or less likely.

This looks like the beginning of a long debate.

Election Verification Project Press Conference Thursday 11/18 in DC

Wed, 17 Nov 2004 10:13:52 +0000

There will be an important press conference this Thursday in DC (“Election Verification Project Press Conference”). Here’s the skinny (from Kim at the CVF):

WHAT:

A national coalition of voting rights and computer security experts will hold a post-election press conference to provide a preliminary analysis of electronic voting problems and solutions, and their implications for increasing voters’ confidence in the legitimacy of elections.

WHO:

Kim Alexander, California Voter Foundation

Lillie Coney, National Committee for Voting Integrity/Electronic Privacy Information Center

David Dill, Ph.D., Verified Voting Foundation

Will Doherty, Verified Voting Foundation/Election Incident Reporting System

Chellie Pingree, Common Cause

Matt Zimmerman, Electronic Frontier Foundation

WHEN:

Thursday, Nov. 18, 10:30 a.m. to 12 Noon

WHERE:

Cabinet Room
Beacon Hotel and Corporate Quarters (formerly Governor’s House Hotel)
1615 Rhode Island Avenue, N.W.
Washington, D.C.

(Metro Stop: Dupont Circle or Farragut North)

———-
The Election Verification Project is a coalition of technology, legal and voting rights organizations promoting transparency and accountability in the voting process. The Project advances reforms that reduce computerized voting risks, and fosters public confidence in the integrity and accuracy of the electoral process.

Voting Problems in Indiana

Sat, 13 Nov 2004 00:19:22 +0000

From a story in the National Journal’s House Race Hotline (“How Far Reaching Is This Fidlar Flop?”):

Election equipment counted straight party votes for [Democratic] candidates as Libertarian votes, in an error “that could affect election outcomes in as many” as 9 [counties]. [Democrats] discovered the error in Franklin Co. on 11/9 after noticing a final tally they couldn’t “decipher.” Fidlar, the [county’s] election equipment vendor, then notified election officials of the error on 11/10. The Franklin Co. Elections Board held an emergency meeting 11/11 and the ballots will be counted again 11/12. GOP Chair Bob Jewell: “Hopefully (the recanvassing) won’t change the outcome of the election.” Fidlar has machines in 9 [Indiana counites], including 2 in the 9th [congressional district] where Baron Hill [D] lost by fewer than 1.4K votes to Rep. Mike Sodrel [R]. Fidlar officials have said Franklin Co. “is the only county where a database error occurred” (Howey Political Report, 11/12). (emphasis and un-abbreviations added)

This is a big deal. Many people vote straight-party tickets, and every single one of those votes that were cast by Democrats in these counties will have to be accounted for. To boot, Fidlar has touchscreen machines in 4 counties in Iowa (Clay, Clayton, Plymouth, Union) and 4 counties in North Carolina (Alleghany, Bertie, Hertford, Surry). It’s hard to believe that their “database error” only occured in Indiana. Of course, we’ll need more information from these other counties and the vendor to determine if that is the case. Also note, I count 10 counties using Fidlar machines in Indiana (Elkhart, Franklin, Fulton, LaGrange, Newton, Ripley, Scott, Steuben, Switzerland, and White).

UPDATE: It appears that this problem might only affect counties that use optical scan systems provided by Fidlar (“Recount changes one Franklin Co. race”):

A Democrat gained enough votes to bump a Republican from victory in a county commissioner’s race after a recount prompted by a computer glitch in optical-scan voting.

The glitch in the Fidlar Election Co. vote-scanning system had recorded straight-Democratic Party votes for Libertarians.

Fidlar confirmed the error on Wednesday, a day after Democrats raised questions about preliminary results that included a Libertarian candidate for Congress winning 7.7 percent of the vote in Franklin County. That was more than four times the percentage of votes he had won across the entire district.

No programming problems were found in Fidlar’s optical scan Accuvote 2000 ES system, said Dana Pittman, an account manager for the Rock Island, Ill.-based company.

However, Fidlar also is verifying programming of its optical scan equipment in Wisconsin and Michigan, which, like Indiana, have straight-party voting, Vern Paddock of Fidlar technical support told the Palladium-Item of Richmond.

The Franklin County problem does not call into question any results in Wisconsin or Michigan, Bill Barrett, national sales manager for Fidlar, told The Associated Press today.

“That was an isolated incident in a single jurisdiction,” Barrett said in a telephone interview from Detroit.

Paddock, meanwhile, said programs for the Accuvote 2000 ES have been checked for all 10 Indiana counties that use the system.

So, how the heck do we have “glitches” without “programming problems” in this situation? What is going on here?

Waiting to Vote

Fri, 12 Nov 2004 19:37:34 +0000

One of the underreported stories from last week’s election was the effect of long waiting lines at polling places. Many polling places in Ohio, for example, had lines of three hours or more. Though many voters waited, determined to cast their votes, quite a few must have been driven away. Not everybody has three hours to spend at the polling place.

A story in the Boston Phoenix, by David S. Bernstein, points to significant reductions in the number of polling places in some parts of Ohio, compared to the 2000 election. According to the article, polling places were consolidated on the theory that voters would cast their votes much more quickly on the touch-screen systems that were to be used in this year’s election. But then many counties put aside the touchscreens due to security concerns, and used the old punch-card system instead. The result is the same voting system as before, but with many fewer polling stations. Add in a higher than usual turnout and long lines result.

How did this affect the election results? Some data from the article:

Of Ohio’s 88 counties, 20 suffered a significant reduction — shutting at least 20 percent (or at least 30) of their precincts. Most of those counties have Republicans serving as Board of Elections director, including the four biggest: Cuyahoga, Montgomery, Summit, and Lucas.

Those 20 counties went heavily to Gore in 2000, 53 to 42 percent. The other 68 counties, which underwent little-to-no precinct consolidation, went exactly the opposite way in 2000: 53 to 42 percent to Bush.

In the 68 counties that kept their precinct count at or near 2000 levels, Kerry benefited more than Bush from the high turnout, getting 24 percent more votes than Gore did in 2000, while Bush increased his vote total by only 17 percent.

But in the 20 squeezed counties, the opposite happened. Bush increased his vote total by 22 percent, and Kerry won just 19 percent more than Gore in 2000.

This suggests that the long lines may have driven away more Kerry voters than Bush voters. But it’s only a suggestion at this point, not a solid inference; and in any case the effect doesn’t look big enough to call Bush’s victory into question.

It would be great to see a carefully, methodologically sound study of this issue.

Diebold Settles California Lawsuit

Thu, 11 Nov 2004 14:26:20 +0000

Diebold and the State of California have reached a settlement in the suit brought by the state against the e-voting vendor, according to an AP story. Diebold has agreed to pay the state $2.6 million, to reimburse California counties for the cost of using paper ballots rather than insecure Diebold systems in the recent election, and to make security improvements to its systems.

Settling the case allows Diebold to avoid further discovery, which probably would have revealed facts putting the company and its products in a bad light.

Lack of Paper Trail Ruins North Carolina Election

Tue, 09 Nov 2004 21:05:46 +0000

Just in case you thought that lawsuits about pregnant chads were the worst possible election outcome, here’s a story about the consequences of e-voting without a proper paper trail.

A bug in e-voting system software caused about 13% of the votes cast in Carteret County, North Carolina in last week’s election to be lost irretrievably, according to a story by Kelcy Carlson at WRAL.

The state Board of Elections discovered on election night that 4,532 electronic ballots through early voting were not recorded.

“The bottom line that we have heard from the manufacturer is that these votes are not missing. They’re lost,” county commissioner-elect Tom Steepy said. “It’s very disheartening. It really is.”

Carteret County had one stop for early voting. Twelve electronic booths fed into one electronic system that was expected to hold just over 10,000 votes. In reality, it only held just over 3,000. Officials said anyone who voted after 11 a.m. on Oct. 22 through Oct. 30 did not get their ballot counted.

“The company has admitted now that it was its error and that it was a simple keystroke that should have been applied to the system perhaps several years ago and was not,” said Ed Pond, of the Carteret County Board of Elections.

(See also the earlier USA Today story.)

Had these machines used a voter-verified paper ballot, the problem could have been rectified by counting the paper ballots. As it is, there is no backup to protect against software problems, so Carteret County voters will have to go to the polls again to vote in a new election.

Open Source Software in E-voting

Sat, 06 Nov 2004 21:37:36 +0000

(This is a highly abbreviated version of a forthcoming paper)

Approximately one year ago, California Secretary of State Kevin Shelley handed down the first open source software mandate (PDF) of any U.S. government official. This open source mandate came in response to a specific subsystem of electronic voting machines: the system that verifies the selections on an AVVPAT for disabled voters must run on open source software. As well, Rush Holt’s bill (HR 2239, 108th Congress) require that “No voting system shall at any time contain or use undisclosed software.”

There have been attempts in the past at coding open source election software for Internet voting. For example: Lorrie Cranor’s Sensus, MIT’s EVOX and Jason Kitcat’s GNU.FREE. All of these systems are now unmaintained, and voting over IP (a/k/a the other VoIP) has been fundamentally discredited by David Jefferson, Avi Rubin, Barbara Simons and David Wagner in their report examining the Pentagon’s SERVE project.

However, there hasn’t been a serious effort at developing an open platform for polling place voting until recently. In the past few years, the Open Voting Consortium (OVC) has developed software and a design for an open voting platform. The software, EVM2003, is written in python using XML ballot specifications and can run on a standard PC using a CD-bootable GNU/Linux called Knoppix. The OVC is currently in the middle of a fundraising campaign to get “1111 subscribers by 11/11″ to raise money for their efforts from small, grass-roots donations of $10 a pop; if you have a decent salary and less than two kids, consider give them a few bucks. (None of which should be confused with the Open Vote Foundation which intends to fork the open source Australian e-voting software called eVACS that is no longer open source)

Why open source?

Elections have a long history of being open processes. Openness is one of the central aspects that lends legitimacy to the electoral process. Even with lever-based election machines, which have been around since the last few decades of the 19^th century, it was still possible for election officials to hire a reasonably confident engineer to open the machine up and verify that, in fact, the right gears were turning the proper amount of times.

Over the past two decades, computerized technology has become a growing element of election administration and many parts of voting technology are now enshrouded in mystery. Computer software is subject to all types of intellectual property protection (copyright, patents, trade secrets and trademark) and electronic voting machine vendors are notoriously protective of their products. They do business in a small and highly competitive market that has just seen a large injection of $3.9 billion from HAVA. While any trade secret that they may hold is in no way rocket science, you can imagine that their implementation of software and hardware would give their competitors an edge if known publicly.

Now that we are seeing serious concerns in the areas of vote tabulation and human factors from Tuesday’s election, there will be a need, as David Wagner suggests below, for comprehensive investigation into the source of these problems. Undoubtedly, this will involve examinations of source code and attempts to reproduce problems on the same machines used in the election. The examination of any vendor’s source code is a particularly sensitive topic filled with NDAs and negotiation; for example, it took the California office of the SoS 6 months to negotiate the terms of an independent source code examination of California’s four EVM vendors (Diebold, ES&S, Hart Intercivic and Sequoia).

Another benefit of open source, open standards, is also highly desirable in election administration. As you can imagine, having different types of raw vote data (encrypted or not) in proprietary formats, makes combining results from different vendors at the state level a major pain in the ass. In fact, I’ve got anecdotal evidence that the “official” canvass here in California involves a few employees of the office of the Secretary of State entering in county totals by hand into a spreadsheet precisely because there is no interoperability between data formats of our 4 vendors. Talk about an environment ripe for human error… This is why it is heartening to see IEEE standards work (IEEE 1622) and the OASIS Elections and Voter Services TC working on voting data interchange.

What are the risks of open source in e-voting?

Jason Kitcat, author and maintainer of GNU.FREE, wrote a piece for the October issue of the Communications of the ACM where he described why he had ceased to specifically advocate for open source software and had come to recognize that it only brings modest improvements at best ("Source Availability and Evoting: An Advocate Recants” Communications of The ACM October 2004/Vol. 47, No. 10, 65-67). He thesis can broadly be stated as arguing that disclosure in software does add some benefits for e-voting in terms of security and transparency, but not enough to outweigh the inherent difficulties in “creating a secure, private, reliable and anonymous system that provably records voters intentions accurately.”

There are a few risks of open-source voting that have been pointed out (some rebuttals are in italics):

Disclosure or withholding vulnerabilities: By having the code disclosed, attackers are free to examine the code at their leisure and exploit bugs and vulnerabilities that are not found before election day. This will never be solvable with open source code, but extensive third-party policing - like by coders with Verified Voting or another nonprofit - could go a long way towards ensuring very good code. As well, if a serious flaw is found right before an election, this might have adverse consequences on voter turnout. If the alternative is allowing a compromised election, I personally think this is a good thing.
Reduced competitive advantage: If vendors are required to open their source, this would mean new competitors could enter the market and “free-ride” off of the years of work that vendors have put into their software. Of course, this depends on licensing terms mandated by the regulating body. Of course, if the licensing terms, as in the Holt Bill, are merely disclosure-oriented, there’s still something called copyright folks.
Reduced market supply: If vendors are not allowed to keep software and interfaces proprietary, there will be reduced incentive to enter the market or create new products. I have a feeling that most of the money in election systems is in service- and maintenance-oriented contract work. Plus, vendor lock-in is always a good thing for the vendor and always a bad thing for the customer.
Lack of participation: (This is Kitcat’s “Transparency goes only so far” argument) E-voting isn’t very sexy and as such, will not attract talented (or any) coders to contribute. However, community source consortia-based projects like SAKAI are a better model for e-voting software development, whereby in order to be able to contribute and make changes to the application an institution has to devote a certain amount of coders and resources to the project.
End users compromising security: The end-users of open source e-voting software, the counties, could change the code, recompile it and implement it in very insecure ways not knowing the details of its design and the assumptions behind the model. This could be alleviated by having technicians in counties certified to make changes or requiring that no changes are made after a code-freeze date (which was properly scheduled to allow the code to be certified in time for use in the election in question). This would ensure that counties run the code through the ringer on the systems they intend to use and reconcile any bugs our vulnerabilities before the code-freeze date.

Of course, I’m sure I’ve left plenty out… please leave comments or send me an email and I’ll incorporate your arguments/suggestions (and acknowledge you in my paper, of course!).

A Quick Note on Licensing

Unfortunately, CA SoS Shelley never specified what license or what licensing terms would satisfy his “open source” mandate. Open source software licensing terms range from the complex (GPL) to the simple (modified BSD) to the just barely open source (VoteHere’s disclosed source or MS’s shared source). What’s the right license that ensures the public is allowed to vet the source on their own, that experts can debug and build the code and so that vendors still retain a leverage point around their intellectual property? For my thoughts on that, you’ll have to wait to read the full paper.

UPDATE [2004-11-07 07:43:04 PST]: Changed sentence that said Jason Kitcat now advocates for closed source. He is now an advocate for voter-verifiability. Added a note on licensing.

Failures that should not have happened

Sat, 06 Nov 2004 02:52:01 +0000

Three congressmen asked the GAO to investigate problems reported with e-voting. This is a good thing. When a plane crashes, crash investigators descend upon the scene to learn what went wrong so that it won’t happen again, and the results of their investigation are published for the world to learn from. We need the same mindset in electronic voting.

Some of these errors sound like the sort of failure that never should have happened with any well-designed voting system. In Ohio, news stories are reporting that close to 4000 imaginary ballots were erroneously created out of thin air as votes were transmitted to election headquarters, apparently because of a transmission error. If this is indeed what happened, it is troubling. In a well-designed computer system, undetected transmission errors should essentially never occur. Checksums and similar techniques should have been able to protect the integrity of the transmission against undetected errors. It is too soon to know what actually happened, and it would be premature to draw any conclusions, but I hope this failure will be investigated closely.

Meanwhile, in Broward County, Florida, software exhibited a surprising failure mode. Their mayor is quoted as saying: “The software is not geared to count more than 32,000 votes in a precinct. So what happens when it gets to 32,000 is the software starts counting backward.” Pretty wild stuff. (There aren’t enough details to know what is going on here, but could the real threshold be 32,767 (not 32,000) votes, could it be that the number wraps around after that to -32,768 rather than counting “backwards", or could it be that the count was stored a signed 16-bit int variable? This sounds like a pretty odd failure mode.) Meanwhile, the vendor is being blamed for not fixing this defect – apparently the same thing happened two years ago in a Broward County mayoral race. This is exactly the reason we need public investigations into e-voting failures. If we don’t investigate failures, then those failures will keep recurring, and eventually they may cause real harm.

Wired News: “House Dems Seek Election Inquiry”

Sat, 06 Nov 2004 01:31:12 +0000

From Kim at Wired News, “House Dems Seek Election Inquiry”:

Three congressmen sent a letter to the General Accounting Office on Friday requesting an investigation into irregularities with voting machines used in Tuesday’s elections.

The congressmen, Democratic members of the House of Representatives from Florida, New York and Michigan, cited a number of incidents that came to light in the days after the election. One was a glitch in Ohio that caused a memory card reader made by Danaher Controls to give George W. Bush 3,893 more votes than he should have received. Another was a problem with memory cards in North Carolina that caused machines made by UniLect to lose 4,500 votes cast on e-voting machines. The votes were lost when the number of votes cast on the machines exceeded the capacity of the memory cards.

[…]

In their letter, representatives John Conyers Jr. of Michigan, Jerrold Nadler of New York and Robert Wexler of Florida asked the GAO to “immediately undertake an investigation of the efficacy of voting machines and new technologies used in the 2004 election, how election officials responded to difficulties they encountered and what we can do in the future to improve our election systems and administration.”

Needed: Careful E-Voting Correlation Study

Fri, 05 Nov 2004 21:12:17 +0000

Tuesday’s election created lots of data about voting patterns in places that used different voting technologies. Various people have done exploratory data analysis, to see how jurisdictions that used e-voting might differ from those that did not. See, for example, the analysis cited in Joe Hall’s entry below.

As a commenter ("Jon") notes, voting technology is not the only difference between Florida counties that might account for the observed differences. Counties that used e-voting tend to be larger, more densely populated, and more Democratic-leaning than those that don’t. Perhaps these differences explain the data.

To answer questions like these would require more sophisticated data analysis, probably performed by a person who does such analyses for a living. Such a person could control for differences in voter demographics, for instance, to see whether there is an e-voting effect separate from the kinds of differences cited above. Such a person could also tell us how big the remaining effect is, and whether it is statistically significant.

It would be great if some hotshot social science data analyst would agree to do such a study. I’m sure that the folks out there who have data would be willing to furnish it, and to suggest theories to test.

It’s also worth thinking about what a particular finding would tell us. It’s one thing to find an anomaly in the data; but it’s another thing to explain what could have caused it. If you can point to an anomaly, but you don’t have a plausible story about how a rational election-stealing strategy would have caused that anomaly, then you don’t have strong proof of fraud, no matter how much evidence of the anomaly’s existence you can present.

If real anomalies exist, I think it’s more likely that they’ll turn out to be caused by errors or technology failures than by e-voting fraud. Either way, a careful study of the data might be able to teach us a lot about how well various voting technologies work in practice.