Friday, October 31, 2008

New York's Voter Registration Database: Fact & Friction

We at Election Integrity: Fact & Friction are concerned primarily with the perils of electronic vote counting systems. However, there have been numerous concerns expressed throughout the year about New York's Voter Registration Database and the potential for voters to be incorrectly listed as:

  • Purged;
  • Inactive; or
  • ID Required (when in fact it is not).
While some of the reported numbers may have been exaggerated (e.g., it's not unusual for 10% of registered voters to actually be Inactive -- that's about a million), the questionable numbers are probably in the hundreds of thousands statewide all told, and therefore have the potential to disenfranchise lots of voters in various ways. After all, not unlike electronic vote counting, computers and software are involved!

And with all the new laws and high profile court cases about photo IDs and the like across the nation, how many New Yorkers actually know what kind of ID is required to vote in NY lately -- and when it does or does NOT have to be shown?

It's all very complicated! Too much to go into in a simple blog about electronic vote counting and risk-limiting post-election statistical audits like this one.

Fortunately, thanks to the folks at votersearch.org, who just happen to be New York election lawyers, we are happy to be able to point readers to this comprehensive compendium of the relevant NY election laws and regulations. And as with HAVA, ERMA and all the other stuff on the books, we advise anyone with an interest such things to read the law first, so you can have it on your side! As of this writing, you have three days to do so before the election!

So go to:
http://www.votersearch.org/reference.php

You can also check your registration in a copy of the NYS Voter Registration Database here:
http://www.votersearch.org/index.php

and in the original database at the State Board of Elections here:
https://voterlookup.elections.state.ny.us/votersearch.aspx

Finally, check with your County Board of Elections if you have any doubts or questions about your status. You can find contact information for them here:
http://www.elections.state.ny.us/CountyBoards.html

After this election is over, we can get back to figuring out how to actually COUNT some votes -- and with luck, maybe all of 'em!

Wednesday, October 29, 2008

BREAKING: Deja Vu (all over again) -- Feds Pull NY's Testing Lab's Accreditation

The ink has barely begun to dry on a petition to save New York's lever voting system signed by over 1,100 courageous New Yorkers (so far) and -- what do you know?:

The National Institute of Standards and Technology (NIST) and the US Election Assistance Commission (EAC) have, for the second time in two years, suspended the accreditation of New York's electronic voting system testing lab, SysTest, Inc.

The first such suspension was carried out against Ciber back in 2006, after NY State tech consultants, as well as citizens who were paying attention, couldn't help but notice that Ciber had not been conducting tests required to meet federal and NY State standards and election laws.

That was then and this is now

As NY Yankees and Mets catcher, coach and manager Yogi Berra would say, this time "it's deja vu all over again." Yogi brought the 1973 Mets from last place in the final month of the season to win the National League pennant the year after the death of their beloved manager, Gil Hodges. But unlike Hodges' untimely passing, the death of New York's lever voting system has been greatly exaggerated by everyone from election officials, to election integrity advocates, to rabid anti-lever zealots who, unfortunately, just haven't thought the lever replacement issue through.

Fortunately, cooler heads have prevailed

You don't walk in the winning run with the bases loaded, and you don't dismantle a properly functioning, testable, transparent voting system and replace it with the kind of junk that can't even be adequately tested in the first place (because it runs on software), by labs such as Ciber and SysTest, who can't even meet the standards that allow them to attempt to do the testing.

And besides, New York's voting system is now fully HAVA-compliant, thanks to the addition of at least one ballot marking device for voters with special needs at each polling place. The lever system meets all other HAVA requirements.

Here's an explanation of why some of these problems have been occurring (NIST's computer security experts have already stated that testing software to high levels of security and reliability is impossible) -- not that it excuses SysTest's performance or Ciber's.

And here's the memo from NIST withdrawing SysTest's accreditation, as transcribed by NY State Board of Elections Co-Chair, Doug Kellner (Note -- we took the liberty of correcting some errors that occurred during scanning of the original document by a software-based optical character recognition system. Hope we got 'em all.):

UNITED STATES DEPARTMENT CIF COMMERCE
National Institute of Standards and Technology
Gaithersburg, Maryland 20888

October 28, 2008

Mark Phillips
Vice President of Compliance Services
SysTest Labs, Incorporated
216 16th Street, Suite 700
Denver, CO 80202-5115

NVLAP Lab Code 200733-0

Dear Mr. Phillips,

On behalf of the National Voluntary Laboratory Accreditation Program (NVLAP), I write to notify of you of NVLAP's decision to suspend its accreditation of SysTest's electronic voting testing program pursuant to NIST Handbook 150, NVLAP Procedures and General Requirements, 2006 Edition, section 3.10. This letter provides an explanation of NVLAP's decision and describes the steps SysTest can take to reinstate its accreditation. This action pertains to voting systems under review by SysTest to be recommended for certification by the Election Assistance Commission for future elections and is not pertinent to systems already deployed for the 2008 election which were certified under alternate systems.

Background Discussion

SysTest Labs, Incorporated is currently accredited by the National Voluntary Laboratory Accreditation Program (NVLAP), a program within the National Institute of Standards and Technology (NIST), to perform testing to federal standards in accordance with the Help America Vote Act of 2002 (HAVA). These standards are the 2002 Voting System Standards (VSS-2002) and the 2005 Voluntary Voting System Guidelines (VVSG-2005). On August 8, 2008, NVLAP sent SysTest Labs a letter outlining specific concerns with respect to SysTest's NVLAP-accredited testing of voting systems, including voting system test campaigns submitted to the Election Assistance Commission (EAC) under their voting system certification process. These specific concerns are documented in the March 2008 NVLAP on-site assessment checklist, produced as part of the normal reassessment process, and in communications between the EAC and NIST regarding issues that EAC staffidentified with test reports submitted by SysTest Labs (enclosed).

The August 8th letter (also enclosed) outlined three specific concerns. In short they were:
1) SysTest's lack of properly documented and validated test methods.
2) Testing conducted by unqualified or untrained personnel.
3) Improper assurances made to manufacturers regarding testing outcomes.

NVLAP directed SysTest to submit information to NVLAP, including a schedule of all accredited voting systems testing planned, within 14 days of receipt of the August 8th letter. NVLAP informed SysTest ofits intention to conduct on-site monitoring of the testing of electronic voting machines. SysTest was notified by email on October 6,2008 of NVLAP's intention to visit their lab on October 14th through 16th to observe testing that had been scheduled during that period.

NVLAP assembled a team consisting of the NVLAP voting system technical assessor, the NIST/NVLAP program manager for voting system testing and four members of the NIST Information Technology Laboratory (ITL) involved in writing the federal voting system standards. In addition, two EAC staff members were invited to provide their observations. During the on-site visit this eight-member team witnessed several tests, interviewed testers , and examined documents related to the areas of concern.

Site Visit Observations

As a result of this on-site monitoring visit, NVLAP has serious concerns about SysTest's performance of voting system testing. These concerns were supported by observations of testing where the test methods being used were not fully developed, validated, mapped to the requirements of the applicable standards, and controlled under SysTest's document control policy.

From the team's observations it was unclear who at SysTest had the ultimate responsibility for test method development. During the observed tests, it appeared that the testers were running the tests for the first time. Changes were made to the test procedures to address items that should have been caught during an initial run-through of the test. Basic tests, such as the system readiness test, were not conducted successfully. Three test methods failed due to problems with the procedure, tester error, or unfamiliarity with the test set-up. Some anomalies or potential problems during testing were not reported by the testers but were pointed out by members of the on-site team.

During the team's visit SysTest personnel stated that their policy was to validate test methods during the actual testing of voting equipment. This approach is unacceptable. The lab must validate all test methods separate from actual testing so that equipment nonconformance can be isolated from test method problems. This validation must follow set documented procedures and show a clear chain of responsibility for the process. SysTest has undergone numerous changes in personnel since its original accreditation and, in fact, since the March 2008 NVLAP on-site assessment. SysTest staff conducting testing during the monitoring visit demonstrated a lack of familiarity with the test equipment and procedures. Some personnel who participated in past on-site assessments were no longer associated with the NVLAP-accredited testing; they had been reassigned to work in support of state certification of voting systems. SysTest management's stated goal was to transfer the expertise and testing approach from their New York testing campaign to the NVLAP/EAC accredited testing campaign. SysTest must improve the level of training of personnel involved in NVLAP/EAC accredited testing given that SysTest has reassigned experienced testers to other work. SysTest should consider bringing in outside instructors to train laboratory personnel.

SysTest was advised that an appearance of impropriety had occurred in a case where personnel had given a client an indication that their equipment would successfully pass testing. SysTest's response was that this was an isolated incident and the person involved had not intended to give this impression. SysTest further stated that their employees were given a quiz which they feit covered training in this situation. It is NVLAP's position that this quiz is insufficient and SysTest must provide specific training to their employees on professional ethics and document the employees' intent to adhere to SysTest's stated policy.

NVLAP's Decision

Pursuant to NIST Handbook 150, NVLAP Procedures and General Requirements, 2006 Edition, section 3.10, NVLAP hereby suspends SysTest's accreditation effective as of the date of this letter. SysTest Labs, Incorporated is prohibited from using the NVLAP symbol on its test reports , correspondences, and advertising during the suspension period for all voting system testing. Accreditation may be reinstated only after such time that SysTest can demonstrate voting system testing in accordance with the requirements of the applicable voting system standards and NIST Handbook 150. This demonstration must be achieved through an on-site visit to SysTest to witness testing , review documentation, interview personne1, and any other means necessary to gather objective evidence in support of a decision regarding reinstatement.

This on-site visit will occur only after NVLAP is convinced, through the submission of documentation, that SysTest has taken the necessary steps to correct the areas of nonconformance herein addressed. This documentation will include, but is not limited to:
procedures for test method deve1opment; procedures for test method validation; revised document control procedures that specifically address technical procedures; fully developed test methods showing validation, document control , and mapping to the federal voting system standards; and, procedures or policies that address methods by which SysTest will control statements or assurances to their clients regarding the outcome of voting system testing.

SysTest was accredited by NVLAP based on its ability to develop and perform competent testing within the framework of an effective management system. SysTest now needs to revise its management system to correct the nonconformances found during this visit and implement these system changes. NVLAP believes that the current SysTest management team is committed to accomplishing this goal and will work with them to that end.

Sincerely,

Jon Criekenberger
NIST/NVLAP Program Manager
Enclosures
Cc: Brian Hancoek, Election Assistance Commission

Friday, October 24, 2008

NY: BlackBoxVoting.org Speaks Out for Election Transparency

I was pleased to see this rather fair and balanced account of New York's voting system produced by BlackBoxVoting.org. As Bev Harris points out, NY is the last state to resist computerized vote counting. Watch this 7 minute video, specific to New York election protection to learn why, and then, please either leave NY alone, or support the fight to retain our transparent lever voting system!:



In the above video, some of the myriad of safeguards currently built into NY's voting system are clearly explained in ways that average voters can understand, as well as the biggest immediate threat to those safeguards -- human beings (albeit of opposing political faiths) simply incorrectly transcribing some tallies from the lever voting machines to the HAVA-and-NY-required permanent paper records they produce by hand on election night. How quaint!

The mitigation of this risk is also discussed in the BBV video: the mandatory 100% recanvass of EVERY lever voting machine and paper return in the State to check for such transcription errors.

In New York City, 55 such errors (out of more than 6,000 machines) were discovered and corrected in the 2008 Presidential Primary. This is standard procedure.

We don't have a "post-election audit" in NY because our lever voting machines do not contain software. We don't audit Gravity here either because we know that if we drop something, it almost always falls. Nor does the Coast Guard require canoes to carry fire extinguishers (lots of water around and they don't run on gasoline -- get it?).

That said, in the event the lever voting machines are replaced, NY's post-election audit law is inadequate, requiring only a paltry 3% of paper ballots to be counted by hand up to two weeks after the election -- no matter how close the outcome of any contest may appear to be. But there is still hope for improvements by the State Board of Elections. Reportedly, the Republican members have been the ones insisting on some larger hand counts, but there is still time for both parties to get with the program -- if we are actually seriously considering replacing lever machines with computers.

Now, compare the old fashioned human transcription errors above to the high-tech debacles we have seen in other jurisdiction including Los Angeles, CA, Washington DC, Pottawattamie County, IA and Cuyahoga County, OH -- just to name a few -- all of which involved computerized vote counting of paper ballots (optical scan or punch card). And how about the dropping of electronic vote tallies from entire precincts by GEMS, and perhaps other EMS central tabulators?

Also, consider the onerous high-tech "white hat" hacking efforts required to protect computerized vote counting systems, such as those of experts such as Harri Hursti and the University of Connecticut. The latter group actually checks things like ballot definition programming for errors or malfeasance that could cause vote switching on the optical scanners' memory cards, before elections. Know how? By exploiting one of the very same security flaws that make these optical scan voting systems so dangerous in the first place -- the use of human-readable (and therefore hackable) "interpreted code" on their memory cards.

One could go on and on about how unprepared NY is to deal with this stuff; how the certification process is a poor substitute for transparency; how the State Constitution and case law require that voters be able to see HOW their votes will be counted -- which is clearly not possible with software-driven computerized e-vote counting systems. Not to mention that the certification process itself is failing -- not only because all the voting systems are failing the tests, but because as computer security researchers at the National Institute of Standards and Technology have clearly stated:

"[E]xperience in testing software and systems has shown that testing to high degrees of security and reliability is from a practical perspective not possible." [emphasis added]
It might just be easier to watch the above video and see how transparent and secure NY's existing lever voting system is and why those whom Harris calls "citizens of courage" are fighting to protect it.

Friday, August 29, 2008

Proposed Mitigation for GEMS (and other EMS) Vote Deletion

Updated August 29, 2008 to emphasize the point that this is NOT just about "electronic voting machines", undisclosed software, or paper ballots, as some have suggested. It's about Election Management Systems, software bugs (disclosed or otherwise), checks and balances, and good old common sense.

So Diebold/Premier's Global Election Management System (GEMS) drops votes from precinct-based tabulator uploads. Surprise, surprise!




Even if this were not happening all by itself, it was demonstrated four years ago that it's trivial for an insider, or an outsider with GEMS access, to make this and even worse things happen by way of GEMS' Microsoft Access database and perhaps other vendors' "central tabulators." Therefore the potential for central tabulator vote miscounts, as well as manipulation, is nothing new -- and it does not necessarily depend on the use of "electronic voting machines." Any voting system is at risk if there are no checks and balances!

The GEMS code has been reviewed from "Top to Bottom" and this latest bug was not detected, proving yet again that NIST researchers had it right when they said that
"experience in testing software and systems has shown that testing to high degrees of security and reliability is from a practical perspective not possible." [Emphasis added]

During the last 4 years, no federal legislation, other than the ill-fated H.R.6414 in the 109th Congress, has been proposed to deal with this problem, even though the problem could be widespread and can be easily mitigated. (See this March 2007 post here at Election Integrity: Fact & Friction for more information.)

So Fix It Already!

The audit that needs to be conducted to find precinct aggregation errors is called a precinct aggregation audit. It could in fact be a 100% audit or "recanvass" of all precincts' election-night tallies, including but not limited to those produced only by software. While post-election auditing usually means comparing hand counts of a sample of paper ballots or VVPATs to software-determined counts of the same votes, in this case the audit need not be limited only to paper. See this story about how the Iowa Democratic Party made such an audit possible for their 2008 caucuses, which are actually voice votes.

Paper is not a requirement for such an audit, except for the permanent paper record produced by the voting system according to HAVA Section 301, which can be used to correct central tallies found to be in error in the event there are no voter-verified paper records to count by hand to make such corrections. This should be a requirement for all jurisdictions and could apply to paper-based, paperless, lever machine, and even hand counted paper ballot voting systems.

As for jurisdictions who do vote on paper, on July 18, 2008 here in NY, where fortunately we still don't have e-vote counting, we proposed regulations to deal with this sort of thing in the future. They coordinate the usual post-election "spot-check" audit (and hopefully a better audit that will eventually be approved by the State Board of Elections) with NY's existing 100% recanvass law that is already applicable to lever machine tallies. Here is the text of the proposed regulation for anyone interested in writing one for their state, or telling the NY State Board of Elections to approve this one and our other improvements to Part 6210.18 preferably before the State rushes headlong into unreliable e-vote counting for no particularly good reason.

As always, the term "election district" in NY is synonymous with the more generic term, "precinct."

Section 6210.18 Recanvass and Audit of Vote

A. Prior to the audits required by this section, the recanvass of vote in every election district (ED) in the state shall be conducted pursuant to NYS Election Law Section 9-208 by comparing all electronically displayed, recorded, printed or transcribed tallies of the vote in each ED, including those displayed, reported or aggregated by any centralized election management or tabulation software. Any discrepancies found in the recanvass of vote shall result in an immediate manual recanvass of all the voter-verifiable paper audit trail records produced or counted by any machine or system used to tally the vote in any ED in which such discrepancies were found. Pursuant to NYS Election Law section 9-211(5) and notwithstanding any other provisions in these regulations, if a voting machine or system is found to have failed to record votes in a manner indicating an operational failure, as evidenced by a discrepancy between two or more electronically displayed, recorded, printed or transcribed tallies, the board of canvassers shall use the manual tally of the voter verifiable paper audit trail records to determine the votes cast on such machine or system, provided such records were not also impaired by the operational failure of the voting machine or system. Such recanvass of votes made pursuant hereto shall thereupon supersede the returns filed by the inspectors of election of the ED in which the original canvass was made.
Now the State Board of Elections has not approved this proposed regulation....yet....but they haven't certified any e-vote counting systems either. So as usual, we are treading water here in the Empire State. Things could be worse.

We can only hope that this and other proposed regulations to deal with e-vote counting will actually be adopted -- prior to the implementation of such high-risk systems to replace lever voting machines. But better yet, let's forget the whole e-vote counting thing, keep the lever machines, and get back to running free and fair elections! That would be real progress.

As for the rest of you who actually have your votes counted on this junk, please try to get with the program before there's an election or something!

Sunday, August 17, 2008

NEW YORK'S BACK DOOR TO THE BALLOT BOX

Due to the unobservable and mutable nature of software used to count votes at elections, full or partial post-election hand recounts of voter-verified paper ballots (VVPBs), also known as post-election audits, are now considered by many to be the "gold standard" of election integrity. Historically, this has not been the case, but as a recent electronic voting system security paper by Haldeman et al (who have actually hacked optical scan and DRE e-vote counting systems for the State of California and demonstrated some of their work to members of Congress) stated:

"While conducting a thorough audit may be time consuming, it provides a higher level of confidence in the integrity of the result than any other mechanism we have been able to identify."
But in 2008 in the State of New York, some disabled voters whom HAVA was intended to help may be putting their votes at risk, even if their ballots are counted by hand. And in 2009, they may have a lot of company. This is because at least one electronic vote-counting system, to be used only as an accessible ballot marking device (BMD) this year in dozens of counties in the state, features a low-tech way to corrupt even a rigorous post-election audit procedure or a full hand count: an old fashioned stuffable ballot box.

As this video by election integrity advocate Rady Ananda and attorney Andi Novick clearly shows, software-based electronic vote counting is not the only thing New Yorkers will have to worry about in the state's rush to comply with HAVA:

Attorney Andi Novick inserts several ballots into a slot on top of the Sequoia/Dominion ImageCast precinct-count optical scan voting system that enables stuffing of the locked ballot box.

You can read more about this at Op Ed News, but it's no wonder that Novick, who founded the Election Transparency Coalition of NY, is planning on suing the state for violating its own Constitution by allowing electronic vote counting, and now perhaps even facilitating the kind of old fashioned paper ballot box stuffing reminiscent of Tammany Hall.

To date, we are not aware of any other open-ended vulnerability, security or penetration testing of the Sequoia/Dominion ImageCast machine, but clearly, it is only too easy to penetrate with low-tech methods such as ballot box stuffing. New York will be hand-counting the BMD ballots this year, instead of relying on software-driven optical scanners which have thus far exhibited hundreds of discrepancies in their source-code reviews against the 2005 federal Voluntary Voting System Guidelines that the state requires voting systems to meet as part of its certification process. But even a full hand count cannot compensate for a stuffed paper ballot box!

There ought to be a law -- and wouldn't you know it? There is!

It's not as if previous New York legislatures hadn't anticipated such nefarious intent; ballot box stuffing is as old as the hills. So what remedies does the NY Election Law provide in the case of a stuffed ballot box?

In their wisdom, our forefathers decided that the best way to deal with a stuffed ballot box was not to count the stuffed ballots. But because a clever attacker would take great pains to ensure that there was no way to distinguish between stuffed ballots and those cast legitimately,
Election Law § 9-110 (2) states:
"[S]uch ballots shall all be replaced, without being unfolded, in the box from which they were taken, and shall be thoroughly mingled therein, and one of the inspectors shall, with his back to the box, publicly draw out as many ballots as shall be equal to such excess and, without unfolding them forthwith shall enclose them in an envelope which he shall then and there seal and endorse 'excess ballots from the box for ballots for the general election, presidential electors, or party ballots or otherwise', as the case may be, and shall sign his name thereto, and place such envelope in the box for defective or spoiled ballots."
In other words, the number of excess ballots must be randomly removed from the box, without anyone even knowing which ballots were legitimate or which had been illegally stuffed. Such ballots are then set aside -- never to be counted!

While such measures may seem draconian, randomly disenfranchising some voters whose ballots are removed from the box is preferable to allowing the counting of all the excess ballots that are known to be fraudulent. Stuffed ballots would most likely contain votes exclusively for a particular party or candidate, some of which would be removed at random under the law. Even so, in a highly partisan precinct that votes 90% for the preferred party, a ballot box could be stuffed with ballots voted 100% for the opposition, thereby suppressing the preferred party's advantage. Removing ballots at random and not counting them would do little to ameliorate this situation, but it's the best that could be hoped for under the circumstances.


Obviously, it's very likely that voters would be disenfranchised if legitimately cast ballots happened to be randomly removed. Unfortunately, this year in New York, the voters most likely to be victims of a ballot stuffing attack would be the very voters HAVA was intended to help -- disabled voters.

So much for the election-night count; what about those post-election audits?

For decades, statisticians and EI advocates have known how to calculate the number of ballots that need to be hand counted to see who won elections counted by software with high confidence. It's not usually all the ballots, but at times, such as the 2000 Presidential Election in Florida and the 2004 Gubernatorial contest in Washington, a full hand count (or perhaps preferably, a re-vote or runoff election) is necessary.

In a ballot stuffing scenario, a properly designed audit that also includes ballot accounting will reveal more ballots than voters (unless of course the poll books were also "stuffed" with fake signatures), but election results will still be spoiled by ballot stuffing unless the auditors could discern legitimate ballots from fraudulent ones. This would not be an easy task.

A current draft of the New York State regulations for optical scan voting systems would allow about 4,000 legitimate ballots per box, and the poll worker training manual for the Sequoia/Dominion ImageCast states that the the system's ballot ID number only "distinguishes between ballots from different districts, but can never be used to identify an individual ballot or voter." New York's Constitution requires secret ballots.

What’s worse, if the machines and ballots were left unattended in a warehouse with their back-door ballot stuffing slots exposed, anyone could insert extra ballots that could be used to disrupt a post-election audit; trigger an expanded audit when vote count discrepancies were discovered; and even trigger a fraudulent recount of all the paper ballots which, under NY Election Law, could change the outcome of an election.

At the very least, an election could be thrown into a state of chaos and uncertainty, resulting in litigation that could drag on for months after the reported winner has taken office, undermining public confidence.

So, how do we protect disabled voters who choose to cast their ballots on these insecure "HAVA-compliant" systems? At the Aug. 4th State Board of Elections meeting, Co-Chair Douglas A. Kellner suggested hand counting these paper ballots on election night at the polling place. That's a step in the right direction and regulations may soon be drafted to require it.

But in 2009, nearly all New York voters will be expected to cast paper ballots at polling places, have them optically scanned, counted by computers, and deposited into these stuffable ballot boxes. So what's the plan to protect the rest of New York's voters?


Everything Old Is New Again

Until now, stuffing ballot boxes at elections in New York was thought to be a thing of the past, thanks to our decades-old, yet reliable lever voting machines. We can only guess what other “back doors” may exist in the proprietary, unobservable, undetectably mutable ImageCast software, but if this obviously shoddy hardware design is any indication, it could be the tip of the iceberg. New Yorkers therefore need to think twice before actually allowing their votes to be counted on such machines.

Professor Bryan Pfaffenberger of the University of Virginia Dept. of Science, Technology & Society was awarded a National Science Foundation grant to study the lever voting machine. In Machining the Vote, he defends levers, which were designed with an eye toward preventing paper ballot fraud:
"Having studied the history, I strongly believe that there would be no such call for paper if the ugly history of fraudulent practices enabled by paper ballots were known -- unfortunately, the American people have forgotten the lessons they learned a century ago, and I greatly fear that we will have to repeat them in order to learn them again.

"In my analysis, the lever machine deserves recognition as one of the most astonishing achievements of American technological genius, a fact that is reflected in their continued competitiveness against recent voting technologies in every accepted performance measure."
Dr. Richard Hayes Phillips, who like Rady Ananda, and unlike many armchair investigators and pontificators, has first-hand experience investigating the 2004 Presidential Election in Ohio, wrote in a recent essay entitled: In Defense of Lever Machines,
"I simply will not defend the use of paper ballots if they are transported to another location before they are counted. I would much rather have lever machines counted at the polling place than any system, paper or paperless, counted elsewhere."
Some may claim that software-driven "precinct-count" optical scanners fulfill this requirement, but how do we know that the paper ballots will in fact be counted correctly by these special-purpose trusted computing devices? (Hint: we don't!)

Once again, it's important to remember that the reason for a post-election audit is that we can't trust election results produced only by software. Don't be lulled into a false sense of security because the software has been "certified." Researchers at the National Institute of Standards and Technology have clearly stated: "[E]xperience in testing software and systems has shown that testing to high degrees of security and reliability is from a practical perspective not possible." [Emphasis added.]

And as e-voting expert Dr. Avi Rubin of Johns Hopkins and the ACCURATE center ruminated in his blog:
"The current certification process may have been appropriate when a 900 lb lever voting machine was deployed. The machine could be tested every which way, and if it met the criteria, it could be certified because it was not likely to change. But software is different. [Y]ou cannot certify an electronic voting machine the way you certify a lever machine.... [W]e absolutely expect that vulnerabilities will be discovered all the time....

"Software is designed to be upgraded, and patch management systems are the norm. A certification system that requires freezing a version in stone is doomed to failure because of the inherent nature of software."
A post-election audit, widely viewed as the best we can do to mitigate the risks of software-based electronic vote counting systems, can only be effective if the chain of custody of the paper ballots is absolutely secure. We are not convinced that this will be the case with the system shown in the above video that has already been purchased by most New York counties for the exorbitant sum of $12,000 apiece. (Not to mention the fact that the State Board of Elections has yet to approve our suggestions for risk-based post-election audits, leaving up to 97% of the vote in the State counted only by software.)

The Worst Voting System Around

Let's stop pretending that e-vote counting systems -- with or without paper trails -- are safer overall than a voting system comprised mainly of lever voting machines. There is no evidence to support such claims, especially given the way paper ballots are being used and abused -- particularly with respect to software-driven computerized optical scan "recounts" that are rapidly becoming standard practice in state after state in lieu of the even less trustworthy DREs they are replacing.

The fact is, like democracy itself, lever machines are the worst voting system around -- except for all the others that have been tried.


If you vote in New York, and you'd like to sign the petition in support of Andi Novick's lawsuit to stop the State from replacing lever voting machines and counting votes with software, or to become a plaintiff in the case, go to: http://www.petitiononline.com/etcnysls/petition.html.

Wednesday, June 18, 2008

NY Advocates to State Board of Elections: Make Election Audits RISK-BASED

A coalition of New York's election integrity advocates have asked the State Board of Elections not to approve the current draft of the Part 6210.18 auditing regulations, which are loosely based on the State Election Law requirement to manually count the ballots from 3% of electronic vote counting systems in each county (expected to be computerized paper ballot optical scanners).

Among other deficiencies, the regulations contain a loophole that would increase the hand counts well beyond the 3% called for by the election law for some counties and contests, while apparently neglecting others.

A letter sent to the State Board on June 16, after several months of intermittent negotiations and discussions, signed by Bo Lipari (New Yorkers for Verified Voting), Lawrence Norden (Brennan Center for Justice), Aimee Allaud (League of Women Voters), Neal Rosenstein (NYPIRG) and yours truly, among others, proposes risk-based statistical audits and the formation of a state election auditing task force within 60 days. The proposed group would conclude its work at least 60 days prior to the first 2009 election. The audits proposed in the letter are favored by many national election integrity advocates as a more efficient and effective method than percentage-based audits to confirm, independently of software and with a high level of confidence, the winners of elections called by electronic vote counting systems.

Certification of the systems slated to replace New York's mechanical lever machines has been fraught with difficulties such as continued non-compliance with federal and state voting system standards by vendors, and the withdrawal of federal certification of New York's first voting system testing lab, Ciber, Inc. in 2006.

These and other reported problems and failures, including documented cases of incorrect electoral outcomes reported by e-vote counting software, have led an increasing number of advocates, experts, and officials to conclude that the risk-based post-election audit, possibly resulting in a full hand recount, is the only way to know with any certainty that the outcomes of elections reflect the will of the voters.

Friday, June 13, 2008

So Now Can We Talk About Hand Counts?

I wanted to share yesterday's opening comment by John Gideon in Voters Unite's Daily Voting News because it refers to some important work by John Washburn that I may have played a small role in motivating. I'm also going to report on the state of play in NY, the last state to resist implementation of so-called "HAVA-compliant" voting systems in favor of retaining its sometimes imperfect but usually reliable mechanical lever machines. (The levers are also HAVA-compliant as long as HAVA Accessibility requirements are met with other equipment, but this has yet to be properly adjudicated.)

Gideon writes:

Voting systems are tested for federal certification by a "Voting Systems Test Lab" (VSTL) against the voting systems standards. So, one would expect, that if a voting system fails to meet the standards it fails testing and cannot be certified. One would expect. However, the voting systems standards give the vendors and the VSTLs an out. B.5 of Appendix B of Volume II of the 2002 VSS and the 2005 VVSG says, “….any uncorrected deficiency that does not involve the loss or corruption of voting data shall not necessarily be cause for rejection”. A Premier voting system was recently recommended for certification by Systest, one of the VSTLs. In the test report Systest reported 79 discrepancies. 77 of those discrepancies were serious but fell within the B.5 “get out of jail free card”. Two of the 79 were serious discrepancies that report loss of data and are not covered by the “get out of jail free card”. Yet, the system was recommended for certification and the EAC is considering following that recommendation.
Well, I hate to say "I told you so", but thanks to John Washburn for pointing out:
"[B]oth sets of [2002 and 2005 federal voting system] standards have an explicit loophole that allows almost all the requirements — weak as they are — to be ignored. This second objection was first brought to my attention two years ago by Howard Stanislevic."
It's always nice to see that someone else has been paying attention!

As for how the testing in NY is going, so far, it makes the above discrepancies uncovered by Washburn look like a walk in Central Park!

Thanks to the Honorable Gary L. Sharpe, the judge in the case of US v. The New York State Board of Elections who has previously stated that he gets his information about electronic vote counting from reading the newspapers, the State Board of Elections is now required to send the Court weekly status reports on the progress of, among other things, lever machine replacement testing, also known as "Plan A." According to the report dated June 6, 2008:
SysTest reports that Sequoia/Dominion has 279 open source code discrepancies and ES&S has [a whopping] 915 open source code discrepancies.
This, even according to the inadequate 2005 Voluntary Voting System Guidelines that John Washburn, myself, and others such as UC Berkeley computer science professor Dr. David Wagner have been criticizing for years.

But with the loopholes reported above and the pressure from the US Dept. of Justice and the Court, what assurances will NY voters have that any of the above standards violations will ever be corrected?

Not that source code is the only way to screw up an election. Far from it! Those of us actually paying attention know that ballot programming, also known as election configuration, is much more accessible and dangerous than mere source code. Anyone with access to an Election Management System such as GEMS, Unity or WinEDS (the big 3) already has all the tools necessary to manipulate election results, even BEFORE the election, by tinkering with ballot programming. But voting system source code certainly has the potential to do just as much damage if it doesn't work the way it's supposed to after it's complied and run a voting system.

As New York prepares to dismantle its lever voting system (which, for some uninformed folks, just can't happen soon enough), the fact is to date, there is still no suitable replacement available. With a total of over 1,000 standards violations, even based on the weak Federal standards, it's hard to imagine how they can all be corrected in time for a 2009 election (2008 is already officially out of the question, except for deployment of electronic ballot markers to comply with HAVA's well-motivated Accessibility requirements).

It's the vote counting (stupid)! That's what needs to be checked by counting enough ballots by hand to see who really won our elections. To that end, the State Board of Elections have proposed some new election auditing regulations. Unfortunately, they are still inadequate, but they can be salvaged if the Board would exercise some due diligence and consult with those who, for years, have been studying the problem of confirming electoral outcomes without having to depend on source code, ballot programming or election configuration and management software. Maybe they will.

Thursday, March 20, 2008

NY: Planned Lawsuit Challenges Constitutionality of E-Vote Counting

An open letter to New York's election commissioners, citizens and poll workers, penned by Andrea T. Novick, Esq., the attorney who filed the amicus brief in the US Dept. of Justice's lawsuit against the state, suggests that, among other things, electronic vote counting violates the state's Constitution.

In addition to the constitutional claim, the letter also makes the following claim about New York's current voting system, which is comprised almost entirely of non-computerized lever voting machines used to count votes only on election day:

The present machines are legal under the Help America Vote Act (HAVA), as long as Accessibility requirements are met with at least one accessible ballot marking device per polling place to accommodate voters with disabilities.

Such HAVA accessibility compliance is currently underway in NY.

To support the lever compliance argument, Novick cited the opinion of former New York City Election Commissioner Douglas A. Kellner, as stated in a speech before the NYC Voter Assistance Commission in 2004. Kellner, a Democrat, is now one of two NY State Board of Elections Co-Chairs.

Reading law is hard work

Any reasonable reading of HAVA seems to confirm Kellner's assertion that levers are compliant, since Section 301 of the HAVA statutes, "Voting Systems Standards":

  • does NOT require voter-verified paper audit records or ballots (which would make many DRE (usually touchscreen) voting machines non-HAVA-compliant);
  • does NOT require the voting system to use a printer to produce the paper records required by HAVA; and
  • does NOT contain accuracy requirements that are applicable to either lever machines or hand counted paper ballots.
The mostly theoretical accuracy requirement of an error rate of 1 in 500,000 ballot positions referred to in the statute, is taken from the 2002 federal Voting System Standards/Guidelines. That document, as well as the subsequent 2005 version produced by the US Election Assistance Commission (EAC) under HAVA, only contains standards for voting systems comprised of DREs, computerized electronic ballot scanners and central tabulators.

All other HAVA requirements such as overvote notification, permitting the voter to correct their ballot before it is cast, etc., have been met by the lever machines for decades -- long before electronic voting systems offered such protection.

Novick wrote of the decades-old machines:
"Levers in their mechanical simplicity have a transparency that enables regular human beings to observe both foul play and innocent failures. The evidence of the failed votes can be proven in court just the way the evidence as reflected by the hand-count tally sheets could prove that the people's will may not have been realized."
In truly bi-partisan fashion, which is another state constitutional requirement of NY's election system, Novick also included the following testimony, given by Nassau County Republican Election Commissioner John A. De Grace to the State Board at a Dec. 2005 hearing:
"I can only speak for myself, although I am certain that all other Commissioners in the State of New York feel as impassioned as I do. My main responsibility is to the voters, to ensure that my Board does all it can to implement the law as well as to guarantee fair, just, accurate elections. Up until now I have felt secure and confident that I have been able to do this. Through the use of the Automatic Lever Voting Machines, though aged, I am able to certify election results and I am certain of the accuracy by which we conduct our elections."
In its litigation in the Dept. of Justice case, NY State failed to make the case that levers are in fact HAVA-compliant, even though the attorney for the United States admitted recently in his remarks to the court that HAVA does not require voter-verified paper records to be produced. The issue of lever machine compliance therefore remains unadjudicated.

NY Election Law exempts lever machines from new requirements for as long as they are lawfully used, but also requires their replacement at some future unspecified date. The State Legislature extended the lever replacement deadline indefinitely last year in an amendment to the Election Reform and Modernization Act of 2005.

Reading newspapers is another story

The judge in the DoJ case, the Honorable Gary L. Sharpe has stated that he gets information about the case from reading the newspapers. To the extent that our media will cover Novick's impending lawsuit, perhaps Judge Sharpe may be made aware that federal statutes do not ban the levers after all. If not, he can look it up in HAVA Section 301.

The EAC, for its part, has issued an advisory stating that they believe levers are not HAVA-compliant, presenting the usual thus far unadjudicated arguments.

Should New York not wish to return the HAVA money earmarked for lever replacement, Novick says that there is another possible remedy that would satisfy both HAVA and the state constitution: hand counting paper ballots for federal elections, while the lever machines could continue to be used for state and local elections that are not subject to federal law. This would involve at most, three hand counted contests, and in 2008, would involve only two, since there is no US Senate seat up for grabs this year. Under this plan, the lever machines could be used as privacy booths, allowing most voters to hand mark their paper ballots for the one to three possible federal contests, and then proceed to vote in other elections on the familiar mechanical ballot displayed on the lever machine. A supply of federal ballots, pens and clipboards would be the only required changes to the current voting system -- and of course the hand counters for the federal elections.

Other solutions might involve partial hand counts on election night to check computerized electronic ballot scanner tallies, however NY Election Law not only specifies a number of such hand counts that is not statistically grounded (just 3%, regardless of how close a contest may appear to be or how many electronic voting machines or computerized ballot scanners are involved), but also requires the manual count to begin up to 15 days after an election, raising constitutional questions as well as concerns about the chain of custody of the paper ballots.

Tuesday, March 18, 2008

Under-Reported: New Holt Bill Says Election Outcomes Could Be Confirmed With Hand Counts

After months of haggling with Congressman Rush Holt's office about some of the ambiguous language in both H.R.811 and the new voluntary bill, H.R.5036, I happened to notice this verbiage that somehow made its way into the new bill (emphasis added):

(1) IN GENERAL- A hand count conducted in accordance with this section is a count of all of the paper ballots on which votes were cast in the election (including paper ballot printouts verifiable by the voter at the time the vote is cast), including votes cast on an early, absentee, emergency, and provisional basis, which is conducted by hand to determine the winner of the election and is conducted without using electronic equipment or software.
The text of the bill can be found here: http://www.govtrack.us/congress/billtext.xpd?bill=h110-5036

As far as I know, this is the first acknowledgment in any federal legislation that hand counts may actually be conducted to determine the TRUE WINNER of an election. And under this bill, Uncle Sam is supposed to pay for it.

This is a paradigm shift. Some of us have been fighting for language like this for over a year in connection with Holt's so-called election audits. Even the section that allows alternative sampling methods to be used does not say specifically that they should be used to determine who the winner of an election really is. That sort of thing (Congress actually judging the elections of its members, as required by the Constitution) never seemed to be on the table.

But now, for some reason, this election-outcome-confirming language has appeared in a piece of federal legislation, and it's Holt legislation at that! So I say, "Well done Congressman!"

Even if this is some kind of oversight, we should fight to keep this language in the bill so it won't be gutted in committee.

There are some loopholes in the bill, and the whole thing is voluntary anyway. But I think H.R.5036 is worth supporting, if for no other reason, based on the above language.

Tuesday, January 15, 2008

NJ Governor Signs Landmark Election Protection Legislation

On Jan. 15, New Jersey Governor Jon Corzine signed S507 into law.

[Note: the text of the law is now available here (PDF)]

I've already written enough about the significance of this bill, what it means to election integrity in the Garden State and the nation, and why it's now the first Law in the nation to seriously address the electronic-vote-counting problem.

What I've not said yet is how appropriate it is for this bill to become law on Martin Luther King, Jr.'s birthday -- not the one that's observed by having a 3-day weekend -- but the actual day, Tuesday, January 15th, 2008, when he would have been 79 years old.

I don't know if this was intentional on the Governor's part. I was not at the bill signing, but it would not surprise me. I do know from having had the privilege of working with Senator Nia Gill, the bill's sponsor who did everything in her power to ensure its passage without any unnecessary compromises, that voting rights and vote-counting rights are inseparably intertwined, as well they should be.

Will this law solve every potential problem with our elections, even if it's copied in all 50 States? Even if Congress begins to take the e-vote-counting problem seriously? No. We know it won't, and some have been all too quick to point this out. It just happens to be a giant step in the right direction, and the people of New Jersey should be proud to have taken it.

Tuesday, January 8, 2008

New Jersey's Post-Election Audit Bill Goes to the Governor!

January 8, 2008

It's alive -- and it's almost a law!

Special-event parking tax surcharges, motor vehicle fines and fees and orthotic appliance health benefit coverage. Such is the business of state government.

But today
at 1:06 AM, at the end of a grueling 12-hour lame-duck session, the New Jersey General Assembly made history by passing A2730/S507, the state's landmark post-election audit bill, by a bi-partisan vote of 53 to 19.

You can watch history in the making here at time index 11:57:35:
http://rmserver.njleg.state.nj.us/internet/2008/A/0107-1200PM-1.wmv

The bill -- which is the first in the nation to require hand counts of enough votes to confirm the outcomes reported by electronic vote-counting systems independently of software -- now goes to Governor Corzine for his signature.

Put your hands together for the NJ Legislature!

(Oh, and they also abolished the death penalty. ;-)

Saturday, January 5, 2008

New Jersey's Post-Election Audit Bill and Its Importance to Our Nation

Despite the efforts of election integrity advocates, statisticians and computer scientists, 2007 marked the fifth year since the passage of the Help America Vote Act that the federal government has failed to solve the electronic vote-counting problem. Perhaps more significantly, '07 was the 32nd year since Roy Saltman, working for the National Institute of Standards and Technology's predecessor agency, the National Bureau of Standards, proposed what many believe to be the first workable solution to this problem way back in 1975!


While both Houses of Congress have dithered, on Dec. 13, 2007, the New Jersey Assembly diligently amended their version of the state's post-election audit bill, A2730, to match the Senate version, S507, as amended by Senator Nia Gill. Gill's legislation had already sailed through two Senate committees, and on Dec. 17, the full Senate passed S507 by a vote of 22 to 14. On Jan. 7, 2008 the Assembly will vote on A2730. The bill is expected to pass, and Governor Corzine, who has received many phone calls in support of this bill, is expected to sign it into law.

While there will continue to be calls to replace the state's direct recording electronic (DRE -- pushbutton or touch screen) voting machines with optical scan systems, the audit provisions would apply equally to either system including central-count scanners used to count absentee ballots. Inattentive voters may not verify the paper audit records printed by the DREs, which would be essential to the integrity of the audit, so they will have to be educated and directed to do so. But even those seeking to ban DREs have testified in favor of S507, because they know that optical scanners solve only the electronic-vote-casting problem -- not the electronic-vote-counting one.

Many still have a warm fuzzy feeling when comparing ballot scanners to those used to mark the SATs or other standardized tests, just as some might think that DREs are as reliable as ATMs. But the truth is, both are software-dependent electronic-vote-counting systems, and test after test have shown they were not designed with security in mind.

The same security problems that exist with DREs are present with optical scanners. Both use the same centralized election management systems (typically a single PC for an entire county -- sometimes poorly secured), and with either type of system, the combination of the secret ballot and the trade-secret vote-counting software makes it almost impossible for anyone to know that their vote is being counted as cast. Add to this the fact that error-free software is beyond the state of the art, so even with the best of intentions, it's not possible to know who really won an election counted only electronically with software.

Fortunately the solution to this problem is relatively simple. Not surprisingly, it has little to do with computer science, information technology or software -- and it's not very expensive either. Researchers at Northeastern University and MIT (Aslam, Popa and Rivest) have demystified the statistical procedure involved so that it can be implemented using high-school-level math and a hand calculator. Statisticians, auditors, and other advocates across the nation will now be able to explain this procedure to election officials and average voters.

The solution is to hand count enough votes, at a cost of about 10¢ apiece, to find out who won each audited election contest. And New Jersey's post-election audit bill, S507/A2730 will become the first law in the nation to require confirmation of electoral outcomes by using such a procedure, independently of software.

Rather than live in a world of demon-haunted elections, New Jersey is poised to take the lead in solving the electronic vote-counting problem. If their bill becomes law, it could serve as a model for the nation, with some state-specific tweaks of course. Even now the key provisions of this bill are being copied and tailored to meet other states' requirements.

With the help of public-spirited statisticians, advocates, and election officials, similar provisions can be implemented in any state where there are voter-verified paper records or ballots. Congress might be persuaded to be part of this process, perhaps to help fund it, but with the cooperation of states and counties, federal intervention may not even be necessary to institute this long overdue reform.

The NJ post-election audit bill is a victory for the people of the Garden State; their friends from around the country who helped draft it and showed up to testify in its favor; the election officials who provided valuable insights and consultation; the legislature who passed the bill; and most of all, the bill's sponsor, Senator Nia Gill.

Friday, January 4, 2008

New Jersey's Post-Election Audit Bill: Fact & Friction

A number of people have asked for a copy of S507. Now that it's passed the New Jersey Senate, it can be found on the NJ Legislature's website with the latest amendments here:

http://www.njleg.state.nj.us/2006/Bills/S1000/507_R1.PDF

The Assembly has an identical version, A2730, amended to match S507 on Dec. 13, 2007:

http://www.njleg.state.nj.us/2006/Bills/A3000/2730_R1.PDF

The bill has passed the full Senate and the Assembly will vote on January 7.

Some folks who follow election integrity legislation have expressed some concerns about this bill. I would suggest that before venturing an opinion as to the adequacy (or lack thereof) of this legislation, everyone should first read the bill, with at least some understanding of its provisions.

Just to correct some misinformation that has been circulated thus far:

1. The bill does require a statistical audit to confirm outcomes of elections reported by electronic vote counts by using hand-to-eye counts of VVPRs and VVPBs. There are NO caps on the size of these audits -- even the initial ones. The size of the audit of each contest would have to be determined by the margin of victory, the number of precincts, the number of votes cast in each precinct and some scientifically reasonable assumptions that set a floor, but not a ceiling, on what the audit board may do.

2. The reason there are 2 different statistical power levels (99% vs. 90%) is that each of these applies to elections for different offices. This is clearly spelled out in the bill.

3. The definition of statistical power, as it relates to S507/A2730 audits can be found here. The language in the bill uses the 100% hand count as the "gold standard" to which the effectiveness of the audit is to be compared. All hand counts must be hand-to-eye counts (i.e., not relying on optical scanners or other software).

4. In NJ, an Election District is just another name for a precinct. It is not a Legislative or Congressional district. The Attorney General is the state's chief election official, but this role may revert back to the Secretary of State.

5. There are over 6,000 Election Districts in NJ, so, e.g., the minimum audit of 2% of these precincts per S507/A2730 would be at least 120 precincts statewide; more for close races and due to stratification of the samples by Legislative or Congressional district.

6. S507/A2730 requires all types of ballots counted electronically to be audited, including emergency, provisional, absentee, military and overseas federal ballots.

7. S507/A2730 requires all ballots cast and counted at the precincts to be subject to audit (random or targeted selection) and compared to precinct totals announced by the counties.

8. S507/A2730 requires "batching" of emergency, provisional, absentee, military and overseas federal ballots counted centrally at the county level so they can be randomly audited (or targeted for an audit) by comparing the vote totals of each audited batch, as reported by the optical scanner at the time the ballots were scanned, to hand-to-eye counts of the same ballots. Every ballot in each of these audit units selected for auditing must be hand counted. The use of batch sampling was necessary because NJ does not sort absentee ballots by precinct. The size of each batch is based on the average precinct size but the batches do not include votes already cast and counted at the precincts, as they are covered by the above audit of precincts.

9. S507/A2730 requires the establishment of an independent audit team and empowers them to oversee audits of any precincts or ballot batches in which they believe votes may have been miscounted in addition to the random audits. This team may promulgate additional regulations, subject to public comment, which may go beyond the strict requirements of the bill, and to implement those requirements. They must have verifiable expertise in statistics and auditing.

10. At minimum, S507/A2730 requires the initial sample size of the audit (which is at least 2%, but could be much larger in close races) to be doubled if a 0.1% change in the vote share of any candidate is detected in the sample. The audit board is empowered to order any additional audits they deem necessary to confirm the outcome of the elections prior to certification up to and including a full hand-to-eye recount. The above doubling in the case of a relatively small error rate in the sample is a floor -- not a ceiling.

11. Full manual recounts are still allowed under existing NJ law, but S507/A2730 allows hand-to-eye counts from the audits of precincts to be used in lieu of recounts of the same precincts, unless a court rules otherwise.

12. At minimum, S507/A2730 allows the same observers permitted to attend recounts to observe audits. Election officials may allow additional observers.

There are other good provisions in this bill, many of which are being adopted in other states to solve their e-vote-counting problems. This bill deserves our support, and once again, I'd suggest that before venturing an opinion about it, people should read it, and do so in the context of New Jersey's other election laws, procedures and voting systems.

Far be it from this writer to suggest that one size fits all. But this will be the first post-election audit law to require electoral outcomes to be confirmed independently of software. In other words, it's well worth emulating.

Iowa's Open-Source Precinct Aggregation Audit Tool

Thanks to Jerry Depew from IowaVoters.org for giving me the opportunity to use this cool tool.

It's all right here: http://www.iowacaucusresults.com

The above URL is a HTML frame. There's nothing to it. But there are a bunch of JavaScripts accessed from this URL contained within the above frame: http://s3.amazonaws.com/caucuspublic/index_live.html
That one's a little harder to remember.

In English, it's open-source precinct aggregation audit software and it can be used for the whole state of Iowa! (Democratic precincts only at the moment.)

In better English, they post the precinct tallies on this website in real time, so anyone who's at the precinct can verify them. If the tallies don't match, people will know. All that's needed is a web browser.

I was able to check Jerry's precinct in Iowa, where I had people (well Jerry anyway) on the ground, to see that the results on the website were the same as at the precinct. And they were! Imagine that.

And I just signed up for access to the "post-caucus analysis" part; I'm supposed to get a password tomorrow.

Note: this is NOT an Election Management System on the Internet; it's just a reporting tool (website).

There Ought To Be A Law

Why should you care?

Because this is free precinct tally aggregation software, and there ought to be a law about having to use it for every election -- not just the Iowa Democratic Caucuses.

It may cost $1-Billion to get paper ballots in every precinct, and even with a statistical audit (which is really the only kind), we still won't know for sure who won our elections without checking precinct aggregation too. At this point, the latter can be done for free, using this Iowan software. As a taxpayer, I'm really interested in the FREE solution, since neither that nor the billion-dollar one solves the e-vote counting problem on its own. But together, they might!

Let's not let our obsession with paper ballots cloud the issue. Any kind of voting system can be rigged by messing with the precinct aggregation -- even Hand Counted Paper Ballots. There are 1,781 precincts in the State of Iowa (and about 180,000 nationwide). I know at least one of them could have been aggregated correctly. Now we just have to check the rest and see if they all add up. I'm hoping the password to the post-caucus analysis will allow that.