Monday, December 14, 2009

The End of Innocence -- NY State Board of Elections Says Ballot Scanners Switched Votes in 2009 General Election

The Help America Vote Act does not require computerized vote counting. But earlier this year in U. S. District Court, the New York State Board of Elections (SBoE) and the U. S. Department of Justice agreed that the Board would certify a new optical scan computerized voting system by December 15, 2009. As that date approaches, the Board is displaying a dismissive attitude toward the risks and problems encountered with the systems they say they will certify.

At a November 12th State Senate Elections Committee hearing in New York City, SBoE Co-Chair Douglas Kellner testified about what he called "glitches" in the programming in one of the new systems that went undetected by Erie County election officials in the 2009 general election. Only after officials noticed some anomalous election results, did they realize their system's configuration files had been compromised.

If future election results are not so anomalous, there is a strong chance such errors will not be detected at all.

Testimony

At the hearing, Commissioner Kellner confirmed our worst fears about e-vote counting (see his testimony below). Kellner stated that in Erie County, during the process of entering ballot programming data, vote switching between candidates had been programmed into the computer (Election Management System or EMS) that, in turn, programed the county's optical scanners. The scanners then proceeded to switch the votes at the polls as the ballots were cast on election day. This real-time vote switching was undetectable by voters, poll workers or other election officials.

Kellner said in this case the vote switching was detected later because the election results appeared to be implausible. The scanners supposedly failed their pre-election Logic and Accuracy test due to the vote-switching problem. That's good, but county election officials ignored the results of their own tests and held the election using the vote-switching configuration anyway.

Commissioner Kellner also stated that this county, which uses ES&S systems, was among the best in the 2009 "pilot" elections (held with real voters and candidates). We don't doubt his word that the errors were eventually corrected. But if Erie was one of the best counties, we'd hate to see one of the worst counties that participated in this experiment.

Different Vendors, Same Design

Different vendors employ the same architecture of centralized EMS programming and configuration. Both of New York's new voting systems (including accessible ballot marking devices) are programmed this way for each election. There are no "stand-alone" voting devices in New York, except the lever voting machines. It is disingenuous to claim otherwise.

Even if the Logic and Accuracy testing had been done properly and had not been ignored, there is no guarantee that vote switching would have been detected. Computer scientists have proved that such tests can be rigged to perform correctly at any time, while the machines can be rigged to switch votes during the election without detection. Under such conditions, subtle manipulations of vote counts, whether intentional or not, would not be detected.

Computers Are Not Voting Machines

Today's e-voting computers are not voting machines; they are Von Neumann machines (stored-program computers). Such general purpose machines can be programmed to do anything the programmers wish. For example, a computer playing an Internet video mimics some functions of a television set. In New York, such computers are supposed to be programmed to mimic the logical functions of the lever voting machines that have served us well for over 100 years. But there is no way to guarantee that a computer is faithfully emulating a real voting machine, just as there is no way to tell simply by observation that a personal computer is not a TV set.

Commissioner Kellner and his colleagues at the SBoE have been quite cavalier about this threat to our democracy, which we find very troubling. For example, in his testimony, Kellner compared the readily observable and limited problem of a lever machine's misaligned ballot face (which the election law requires poll workers to recheck and realign after every voter leaves the booth), to the invisible and unlimited problems of computer programming errors (and possible malfeasance). He implied that these two problems are equivalent when clearly, they are not.

Citizens Barred From Citizens' Meetings

Last week, there was a meeting of the Citizens Election Modernization Advisory Committee (CEMAC) that was closed to nearly all the citizens of New York State. To what extent will the potential for undetectable vote switching be used as a criterion for or against certification of the new systems? Since the meeting was closed to the public, we may never know. However, there is nothing in the certification standards that we know of that prohibits (or that can prohibit) such vote-switching capabilities in computers. So in all likelihood, the new vote-switching machines will be certified.

New York State’s Committee on Open Government (COG) provides oversight and advice regarding the state's Open Meetings Law. In the opinion of COG Executive Director Bob Freeman, CEMAC's restricting of public access via a protracted "executive session" was unlawful. As its reason for doing so, CEMAC had cited a discussion of “proprietary software information” rather than any of the eight allowable grounds found in the Open Meetings Law.

We have learned that the "citizens" committee, comprised mostly of election officials and other insiders, voted 10 to one to advise the SBoE to certify the new machines.

The End of Innocence

New York will soon join the long list of states burdened by electronic vote-counting systems that are so unreliable and untrustworthy that paper ballots must be used as a backup. Every state in the country besides New York uses at least some vote-switching computers [PDF] to run their elections.

These states expect their election officials to do the impossible: to somehow transform a concealed system of voting into a transparent one. It is terribly unfair to ask election officials to do so.

The Citizens' Burden

The burden New Yorkers will face as a result of the unnecessary change to our voting system is going to be huge and unending. Eternal vigilance would be easy compared to what will be required of us.

County election officials will have to redirect their modest resources toward an electronic voting process that is exponentially more resource-intensive than the system it replaces.

The SBoE seems to believe that counties can and will, at every single election, successfully accomplish every one of the new and myriad processes necessary to ensure safe and accurate elections. Even if they do so, new laws will have to be written to regulate technology that is nearly impossible to regulate. It is doubtful that such laws will be enforced.

Most importantly, enough paper ballots will have to be counted by hand to find out who won and who lost each and every election contest -- sometimes a small fraction of such ballots; sometimes more; sometimes all of them. There is no magic number of votes to count by hand, despite the fact that legislators and election lawyers continue to ask for one.

The cost of making these changes will of course be borne by the taxpayers. Other essential services will have to be cut. The alternative is to give up on free and fair elections and trust the computers to decide the outcomes. That's what 49 other states have done, whether they acknowledge it or not.

The Path of Least Resistance

One might reasonably ask why the State Board of Elections would even consider certifying a voting system that can so easily be programmed, intentionally or accidentally, to add together votes intended for two different candidates, and then allocate the total of those votes to just one candidate. We can only speculate that the Board is simply taking the path of least resistance in Federal Court, rather than fighting to protect the constitutional rights of New York's voters, candidates and their fellow election officials.

Those officials are being asked to certify county-level election results without any knowledge of their correctness. This would be a felony under New York's election law if our election officials were made aware of it. As we said, it's terribly unfair.

Commissioner Kellner's testimony, and the full transcript from the 11/12 hearing are available here [PDF].

Here is the relevant vote-switching excerpt:

Kellner from Pgs. 13-14 (Erie County ES&S vote-switching testimony)

[T]here is one other scanning issue
that had come up with the 9th Legislative District in
the Town of Cheektowaga in Erie County where the
machine had not been set up properly.
So that the ballot -- the election management system was
improperly programmed so that the scanning results did
not accurately report the results on the ballot.

Because it had set up the election management system,
that even though there were two different candidates' names,
the persons who had programmed the machine had marked
those candidates as the same candidate so that the votes
were counted as if you were voting twice for the same candidate.

3 comments:

Anonymous said...

The lever machines have so many more security flaws than paper ballots. Those who propose keeping lever style voting are ignorant as to just how bad lever voting is. You cannot audit a lever machine if it loses votes. I have seen them both lose votes and end up with phantom votes.

Howard Stanislevic said...

Dear Annonymous,

Please learn something about I.T. security.

This is not about paper ballots. It's about computers counting paper ballots.

We don't audit lever machines the way we must audit computers. Lever machines are not computers, don't contain software, can be transparently observed before and after the election, can be tested in a meaningful way, can't change their programming by themselves, can't switch votes during elections, and are immune to computer viruses and any attempts to transmit data or alter their programming via the Internet, radio or other wireless means.

Read this blog by Avi Rubin, who does know something about I.T. security, in which he compares lever voting machines to computers:
http://avi-rubin.blogspot.com/2007/08/secretary-bowens-clever-insight.html

When you're done with that, read about how the NY State Board of Elections has decided that proper auditing of paper ballot elections counted by computers is NOT gong to happen on their watch:
http://e-voter.blogspot.com/2009/07/ny-advocates-to-state-board-of.html

And when you're done with that, if you're still interested in auditing elections, you can support the legislation we're proposing to do so properly, assuming NY really does replace its lever voting machines, and really does care about free and fair elections despite that decision.

Lani Brown said...

Another state entrusts the people’s choice to ES&S, a company that cannot or will not produce election computer systems and procedures that produce accurate vote counts. The results are predictable.

While the computer system malfunction described here is not a computer hardware error, it is an ES&S system error and an ES&S procedural error. Election procedures should have red-flagged the vote-switching errors and immediately demanded a halt to this election. Election procedures should not have provided election officials with the opportunity to use their own judgment when the counts were wrong.

Today, authenticated ES&S vote-flipping and result-altering malfunctions remain pandemic. Consider the election errors documented by these states during 2009 and/or 2008: AR, AZ, CA, FL, IN, KS, OH, MA, MI, MN, NC, NM, NY, PA, SC, SD, TN, TX, WI, WV . . . Some errors occurred with scanner systems that provide actual backups in the form of voter marked paper ballots. Others do not. But all errors occurred with ES&S equipment that changed the final results of the elections.

Rule of thumb: Never trust a computer, any computer. For this reason, reputable computer systems provide crosschecks and audits to flush out “glitches” before they produce real-time invalid results . . . Except in the case of ES&S.