Election Integrity: Fact & Friction

Apparent NY SD 7 Winner Says Other Elections Should Have Been Questioned

2011-01-11T12:31:00.023-05:00

Senator Jack Martins -- the apparent court-appointed winner of the contested race for State Senator in New York's 7th District -- wrote in a Jan. 10th Albany Times Union Op Ed that other election results in the state should have been questioned -- not just the results of his contest. On this point, we could not agree more.

Commenting on a recent Times Union editorial, Martins wrote: "It is disappointing and telling that the editorial focuses solely on the 7th Senate District and irresponsibly questions the results of this race and not the others, some of which took weeks to certify, including a Hudson Valley Assembly race that still hasn't been decided."

Martins, a Republican, also cited the 37th Senate District race, apparently won by an incumbent Democrat, in which Martins alleges that 54 ballot scanners broke down on Election Day and thousands of ballots were left uncounted in the machines for days. If he's correct, this would not only be a huge scanner failure rate, but also a violation of our election laws.

The media focused their attention on Martins' race because it was the last contest in the state that could have determined which party controls the Senate -- but it certainly wasn't the only one.

Martins points out that candidates in other close races "graciously conceded." Well, that's their problem!

No candidate should concede a race without strong evidence that he or she actually lost. Yet for many New York elections, neither our current voting system, nor our outdated legal system, provides such assurance.

It's true that outcomes of other races nearly as close as Martins' were not verified in any meaningful way -- yet neither was Senator Martins' contest. Democrats and Republicans alike gave away their constitutional rights by not litigating more effectively for verification of software-based vote tallies and by not legislating such requirements when they had the chance.

Some voting advocates too are to blame, since they insisted on replacing the lever voting system before laws needed to verify computerized election outcomes -- if indeed this is even possible -- were on the books. We are still waiting for such laws.

Martins' own county of Nassau has it right. Its pending bipartisan lawsuit challenges the constitutionality of computerized vote counting.

Columbia County also got it right when both election commissioners there agreed to do full hand counts of all contests before the 2010 elections.

Senator Patty Ritchie of the 48th District may also have it right. Her campaign filed suit, even when she was ahead in the count, claiming that “Upon information and belief, the machines employed in this election are computer operated optical scan machines which are prone to ‘hacking’ and other fraudulent attacks which can compromise the results of an election." To say nothing of the inadvertent programming errors or calibration glitches that have the same potential.

Let's get real. Apparent winners of elections will always claim the system was fair; apparent losers will claim otherwise, or just "graciously concede." But appearances can be deceiving. What seems “apparent” isn’t necessarily what the evidence would have revealed, had it been examined.

Watching and Waiting For a Return to Innocence

2010-12-30T17:54:00.017-05:00

It has not escaped our attention, or that of our readers, that our last post was over a year ago, when it first became evident that New Yorkers would lose their voting system and have it replaced by a software-based system that our legal system is incapable of regulating. We called that post "The End of Innocence" and it covered quite a lot of ground.

There hasn't been a need to post anything more since then; we would just be repeating ourselves. We've met with the powers that be in both houses of the State Legislature responsible for making election law, and they have taken our suggestions under advisement. No laws have been passed to verify election results. But we've seen lots of interest in the National Popular Vote (NPV), Instant Runoff Voting (IRV) and other practically unverifiable voting methods. Even Internet voting!

Perhaps in light of the state's highest court's Dec. 20th denial of a hand count in the NY State Senate District 7 race in which computers -- rather than voters -- determined which party will control the Senate, it's time for a quick review of how we got here.

New York has become the Florida of the Northeast when it comes to elections, or perhaps worse since we don't even attempt to count thousands of undervotes reported by the ballot scanners. Our new machines don't even warn voters of the effect of casting overvotes, which Florida has corrected after their unfortunate 2008 experience.

There is plenty of blame to go around so we've tried to summarize it for your convenience as we keep watching and waiting for a Return to Innocence. Those who are responsible for our current situation know who they are, although they may be in denial about it.

Here's what happened:

1. New York has a history of paper ballot fraud (Tammany Hall) which lever machines were effectively designed to prevent. We don't trust PEOPLE or PAPER unless they can be watched. We do trust machines that can be locked against tampering, observed when opened, and that work on simple observable mechanical principles such as gravity, and that can't switch votes during elections the way software can. They are part of a voting system and a legal system designed to prevent fraud. Reinventing that system to deal with computers is a lot harder than most people think. In fact, it's never been done!

2. Over the last several years, our public officials have heard very little from New York's precinct-count optical scanner (PCOS) advocates and "good-government" groups about the need for software-independent elections (software-independent voting systems are only the beginning!). The opinions of National Institute of Standards and Technology experts and other computer scientists about the need not to trust software, the ineffectiveness of the "certification" of software, BUGS in New York's actual voting system software, etc. have never been widely disseminated except in testimony to a few legislative committee members by people such as us and a few election officials, and on Internet mailing lists and blogs not read by the general public. We're sorry to say there are very few of us making the case against allowing computers to "decide" election results. We are unfunded and practically alone. Compared to the push for Instant Runoff Voting, National Popular Vote, and even PCOS itself, we are voices in the proverbial wilderness. And that's a shame.

3. The same lack of informed consent applies to the so-called manual auditing of elections counted by computers, which is the only way to restore some trust and the NYS-constitutionally required bipartisan administration of elections (that explicitly includes vote-counting). That constitutional requirement has been undermined by the use of vote-counting software. But almost no one wants to hand-count more than 3% of the vote. Counting substantially more than this means the machines were a waste of money. No one wants to hear this after spending $50 million on them, plus the recurring costs of ownership which will be much more over time. One notable exception is Columbia County in which, prior to the elections, both election commissioners agreed to conduct 100% hand counts. Before an election is the best time to make such an agreement since partisan disputes over winners and losers of contests will not arise. You can read more about that good news here, thanks to Commissioner Virginia Martin.

4. Instead of the facts about NOT trusting computers to count votes, what our public officials and the media have been told is that:

New York has the most "rigorous software certification process";
paper ballots would be "available" for audits and recounts, "if necessary";
NY would "RELY on the paper ballots";
NY has a 100% "recount" law (the Election Law § 9-208 "recanvass," which never required recounts of ALL paper ballots, but only absentee, emergency and provisional ballots, and was recently amended only to require some form of ballot accounting).

All of the above provided New Yorkers who did not fact-check these statements with a false sense of security about our voting system, our election laws and our ultimate "reliance" on paper ballots to "verify" elections.

In other words, New Yorkers have been sold a bill of goods and the Legislature and Judiciary have heard very little to correct this record.

With respect to the SD 7 no-recount case, perhaps the attorneys should have had a computer scientist such as Ron Rivest or Rebecca Mercuri testify about the need not to trust software to count votes. But the judge didn't even want to hear testimony from an election auditing expert.

And please remember, the lawyers in the SD 7 case were working for the NY State Senate -- who also have their OWN lawyers who have written some of the very election laws in question in this case! This is part of the same Legislature that has not been properly educated about the risks of computerized vote-counting in the first place -- only to have it come back and bite them in their bids for re-election.

The future for election integrity looks pretty bleak in the Empire State, but we'll keep watching and waiting. The other major bright spot is of course Nassau County's bipartisan lawsuit to return to the lever voting system, which is ongoing.

The End of Innocence -- NY State Board of Elections Says Ballot Scanners Switched Votes in 2009 General Election

2009-12-14T00:01:00.014-05:00

The Help America Vote Act does not require computerized vote counting. But earlier this year in U. S. District Court, the New York State Board of Elections (SBoE) and the U. S. Department of Justice agreed that the Board would certify a new optical scan computerized voting system by December 15, 2009. As that date approaches, the Board is displaying a dismissive attitude toward the risks and problems encountered with the systems they say they will certify.

At a November 12th State Senate Elections Committee hearing in New York City, SBoE Co-Chair Douglas Kellner testified about what he called "glitches" in the programming in one of the new systems that went undetected by Erie County election officials in the 2009 general election. Only after officials noticed some anomalous election results, did they realize their system's configuration files had been compromised.

If future election results are not so anomalous, there is a strong chance such errors will not be detected at all.

Testimony

At the hearing, Commissioner Kellner confirmed our worst fears about e-vote counting (see his testimony below). Kellner stated that in Erie County, during the process of entering ballot programming data, vote switching between candidates had been programmed into the computer (Election Management System or EMS) that, in turn, programed the county's optical scanners. The scanners then proceeded to switch the votes at the polls as the ballots were cast on election day. This real-time vote switching was undetectable by voters, poll workers or other election officials.

Kellner said in this case the vote switching was detected later because the election results appeared to be implausible. The scanners supposedly failed their pre-election Logic and Accuracy test due to the vote-switching problem. That's good, but county election officials ignored the results of their own tests and held the election using the vote-switching configuration anyway.

Commissioner Kellner also stated that this county, which uses ES&S systems, was among the best in the 2009 "pilot" elections (held with real voters and candidates). We don't doubt his word that the errors were eventually corrected. But if Erie was one of the best counties, we'd hate to see one of the worst counties that participated in this experiment.

Different Vendors, Same Design

Different vendors employ the same architecture of centralized EMS programming and configuration. Both of New York's new voting systems (including accessible ballot marking devices) are programmed this way for each election. There are no "stand-alone" voting devices in New York, except the lever voting machines. It is disingenuous to claim otherwise.

Even if the Logic and Accuracy testing had been done properly and had not been ignored, there is no guarantee that vote switching would have been detected. Computer scientists have proved that such tests can be rigged to perform correctly at any time, while the machines can be rigged to switch votes during the election without detection. Under such conditions, subtle manipulations of vote counts, whether intentional or not, would not be detected.

Computers Are Not Voting Machines

Today's e-voting computers are not voting machines; they are Von Neumann machines (stored-program computers). Such general purpose machines can be programmed to do anything the programmers wish. For example, a computer playing an Internet video mimics some functions of a television set. In New York, such computers are supposed to be programmed to mimic the logical functions of the lever voting machines that have served us well for over 100 years. But there is no way to guarantee that a computer is faithfully emulating a real voting machine, just as there is no way to tell simply by observation that a personal computer is not a TV set.

Commissioner Kellner and his colleagues at the SBoE have been quite cavalier about this threat to our democracy, which we find very troubling. For example, in his testimony, Kellner compared the readily observable and limited problem of a lever machine's misaligned ballot face (which the election law requires poll workers to recheck and realign after every voter leaves the booth), to the invisible and unlimited problems of computer programming errors (and possible malfeasance). He implied that these two problems are equivalent when clearly, they are not.

Citizens Barred From Citizens' Meetings

Last week, there was a meeting of the Citizens Election Modernization Advisory Committee (CEMAC) that was closed to nearly all the citizens of New York State. To what extent will the potential for undetectable vote switching be used as a criterion for or against certification of the new systems? Since the meeting was closed to the public, we may never know. However, there is nothing in the certification standards that we know of that prohibits (or that can prohibit) such vote-switching capabilities in computers. So in all likelihood, the new vote-switching machines will be certified.

New York State’s Committee on Open Government (COG) provides oversight and advice regarding the state's Open Meetings Law. In the opinion of COG Executive Director Bob Freeman, CEMAC's restricting of public access via a protracted "executive session" was unlawful. As its reason for doing so, CEMAC had cited a discussion of “proprietary software information” rather than any of the eight allowable grounds found in the Open Meetings Law.

We have learned that the "citizens" committee, comprised mostly of election officials and other insiders, voted 10 to one to advise the SBoE to certify the new machines.

The End of Innocence

New York will soon join the long list of states burdened by electronic vote-counting systems that are so unreliable and untrustworthy that paper ballots must be used as a backup. Every state in the country besides New York uses at least some vote-switching computers [PDF] to run their elections.

These states expect their election officials to do the impossible: to somehow transform a concealed system of voting into a transparent one. It is terribly unfair to ask election officials to do so.

The Citizens' Burden

The burden New Yorkers will face as a result of the unnecessary change to our voting system is going to be huge and unending. Eternal vigilance would be easy compared to what will be required of us.

County election officials will have to redirect their modest resources toward an electronic voting process that is exponentially more resource-intensive than the system it replaces.

The SBoE seems to believe that counties can and will, at every single election, successfully accomplish every one of the new and myriad processes necessary to ensure safe and accurate elections. Even if they do so, new laws will have to be written to regulate technology that is nearly impossible to regulate. It is doubtful that such laws will be enforced.

Most importantly, enough paper ballots will have to be counted by hand to find out who won and who lost each and every election contest -- sometimes a small fraction of such ballots; sometimes more; sometimes all of them. There is no magic number of votes to count by hand, despite the fact that legislators and election lawyers continue to ask for one.

The cost of making these changes will of course be borne by the taxpayers. Other essential services will have to be cut. The alternative is to give up on free and fair elections and trust the computers to decide the outcomes. That's what 49 other states have done, whether they acknowledge it or not.

The Path of Least Resistance

One might reasonably ask why the State Board of Elections would even consider certifying a voting system that can so easily be programmed, intentionally or accidentally, to add together votes intended for two different candidates, and then allocate the total of those votes to just one candidate. We can only speculate that the Board is simply taking the path of least resistance in Federal Court, rather than fighting to protect the constitutional rights of New York's voters, candidates and their fellow election officials.

Those officials are being asked to certify county-level election results without any knowledge of their correctness. This would be a felony under New York's election law if our election officials were made aware of it. As we said, it's terribly unfair.

Commissioner Kellner's testimony, and the full transcript from the 11/12 hearing are available here [PDF].

Here is the relevant vote-switching excerpt:

Kellner from Pgs. 13-14 (Erie County ES&S vote-switching testimony)

[T]here is one other scanning issue
that had come up with the 9th Legislative District in
the Town of Cheektowaga in Erie County where the
machine had not been set up properly.
So that the ballot -- the election management system was
improperly programmed so that the scanning results did
not accurately report the results on the ballot.

Because it had set up the election management system,
that even though there were two different candidates' names,
the persons who had programmed the machine had marked
those candidates as the same candidate so that the votes
were counted as if you were voting twice for the same candidate.

NY CD-23: Questions Remain About "Pilot" Federal Election

2009-11-21T13:20:00.030-05:00

We have written previously about New York's reckless rollout of uncertified voting systems in real elections. Letters from good-government groups to the US Dept. of Justice, the NY State Attorney General and the NY State Board of Elections have also expressed these concerns. The only response from these officials has been to stay the course.

While experts tell us that testing and certification of computerized voting systems is never a guarantee that the outcome of an election will be correct, there are lingering questions about the uncertified machines used in New York's 2009 CD-23 special election, including the procedures purported to reduce the chances of wrongly declared winners of elections.

An article quoting an election official who claimed there was a "virus" in the voting system has been criticized for the misuse of this term. While technically, the critics may be correct -- a bug discovered in the software is not necessarily a virus -- critics also seem unaware of the history of the machines in question.

That history involves the use of uncertified software distributed by Sequoia Voting Systems to third party vendors such as ballot-printing shops. This so-called "Bridge Tool" program allows such vendors, rather than bi-partisan county election officials, to configure uncertified voting machines (or for that matter, certified ones).

Last year -- and this year in counties that did not participate in the pilot -- the Bridge-Tool method was used to provide accessible voting by outsourcing the configuration of ballot marking devices (BMDs) used by voters with special needs. While a small number of accessible paper ballots could easily be hand-counted to ensure that these votes are counted as cast, there is a broader problem: the BMDs are part of the same optical scan systems being used to count thousands of votes in CD-23 this year -- the Sequoia/Dominion ImageCast ballot scanners.

Today we have received reports that BMDs configured using the Bridge Tool, incorrectly printed what was supposed to be a two-sided ballot. In one county, out of 58 ballots printed, one ballot had the races on the front duplicated on the back, omitting the proposals that should have been on the back. On another ballot, only the front side printed, again omitting proposals on the back. On another ballot, both the front and back of the ballot printed, but the races from the front were reprinted over the proposals on the back. Because this small number of ballots were counted by hand, these errors were detected. But consider how such problems might manifest themselves if these ballots, or thousands of pre-printed ballots, were scanned and counted by the same unreliable machines -- the Sequoia/Dominion ImageCast ballot scanners.

No one knows exactly what data was transferred to the scanners using the Bridge Tool and removable memory cards last year, or if some of that data remains on the memory cards to this day. New York has no procedure to independently inspect the contents of scanner memory cards, a service performed by the University of Connecticut at the request of their Secretary of the State. New York has not adopted the rigorous procedures reportedly followed in the State of California to attempt to ensure that its voting machines and Election Management System PCs used to configure them are free of malware.

So the following unanswered questions remain about the electronic vote counts and the voting system used in CD-23 and elsewhere in New York:

Election Security Concerns

1. Was the uncertified Sequoia Bridge Tool program used by any third-party vendors to program any CD-23 ImageCast machines in past elections or the current one? If so, what was the method by which the ballot definition files were transferred to the ImageCast machines and how do we know this did not deliver malware to the scanners? (It's been claimed that because the scanners are Linux machines, it's unlikely that a "wild virus" was introduced. But this does not rule out malicious configuration files. Also, note that the Election Management System PCs that configure the Linux scanners run Microsoft Windows -- NOT Linux.)

2. Are there any internal USB ports in the ImageCast scanners, besides the one the SBoE says is used only for the printer?

Election Integrity Concerns

1. If the problem was caught by a pre-election logic and accuracy test as claimed by the State Board of Elections, then why wasn't the problem caught on every machine where it existed? The SBoE has said that not all machines with multi-winner races were identified, but all machines were supposed to be tested. This means that the tests may not have been run as required; or the tests may have failed to detect the problem in all cases; or the test results may have been ignored. (These are not mutually exclusive.)

2. Why did it take so long for the reported bug to be discovered? New York is supposed to have the most rigorous certification process in the nation -- yet these machines can't even support a simple "Vote-for-2", "Vote-for-3", etc. contest on the ballot. They crash.

3. Were all the relevant election officials informed about the discovery of the problem? If so, when?

4. Why wasn't this problem widely publicized before the election so that voters and candidates -- and not just election officials, vendors and other insiders -- could have known about it?

5. What exactly was changed in the ballot programming (which is not the source code), to serve as as a workaround for a reported bug in the source code? How was this done without preventing voters from voting for as many candidates as they were entitled to vote for (a violation of NY's Election Law and Constitution), or allowing voters to overvote without notifying them (a violation of State and Federal Law (HAVA))?

6. Were all emergency ballots counted at the polls on election night, or were they removed from public view and counted later?

7. Will there be a full hand count; a hand count of all the ballots cast on the machines that had the problems; a 3% hand count; or some other hand count based on the grossly inadequate Part 6210.18 audit Regulations?

8. If not a 100% hand count, will all the machines selected to be hand counted be chosen randomly with respect to the entire set of machines that counted the CD-23 race in each county, or will the machines be chosen because they are needed to audit other contests as provided for in the 6210.18 Regulations? (These regulations are written so as to require a great deal of non-random selections of machines with respect to an individual contest. This not only makes a lot of busy-work for the counties, but undermines the effectiveness of the random audit.)

Eddie Ajamian contributed to this article.

For more coverage of this story see The Brad Blog, Bo Lipari's blog item and Teresa Hommel's response [PDF].

Big Week for Election Integrity in The Big Apple

2009-10-27T22:32:00.023-04:00

It's been quite a week for election integrity advocates (starting last Thursday) here in the City of New York!

First the stunning but perfectly reasonable declaration by Columbia County Election Commissioner Virginia Martin in a State Assembly hearing in the City last Thursday, where she testified [PDF] that she would not certify an election counted by computers "unless an appropriately designed audit of the paper ballots is conducted."

We continue to work toward that end, assuming any county given the choice would actually replace its tried and true lever voting machines with paper ballots counted by computers. But as we have reported previously, auditing elections in New York to any degree of confidence -- statistical or otherwise -- is going to be an uphill climb.

Here's our testimony [PDF] from last Thursday's hearing including some graphics [PDF]. And here's a full recap complied by Teresa Hommel of WheresThePaper.org.

Martin also said that given today’s fiscal environment, the state budget and current and future deficits, the only prudent thing to do is to amend the New York Election Law to allow counties to continue to use their lever voting machines.

In a related E.I. development, tomorrow in response to calls for fiscal responsibility and election integrity, New York City Councilmember Helen D. Foster will introduce a Resolution to keep the City's 7,300 lever voting machines which, contrary to popular belief, the Help America Vote Act does not require to be replaced.

Councilmember Helen D. Foster

Advocates and fellow public officials will commend Councilmember Foster at a press conference on the steps of City Hall on Wednesday, Oct. 28 at 12:45 PM. The public is invited to attend.

$75,000 PCs TO RUN ELECTIONS IN NY COUNTIES (So much for "stand-alone" voting machines.)

2009-08-04T14:40:00.017-04:00

For those who still believe the myth that New York's new voting machines will be "stand-alone, non-networked" devices, just like lever voting machines (put forth by anti-lever zealots), here's a brief summary about how the new systems really work, published in The Daily Star:

Pilot programs for new voting machines to begin locally
By Tom Grace
Cooperstown News Bureau

Published: August 01, 2009 12:00 am

-snip-

The machines cost about $11,500 apiece, and the counties have had to buy special $75,000 Dell computers to program their voting machines.

``We've used up most of our federal money,'' said Ross, who estimated the county had been given about $600,000.

Both counties had to hire more staff, two technicians apiece, to tend to the new machines. Unlike the lever machines that have been used locally for decades, optical scanners cannot be stored in town barns and fire houses, but must be kept in a climate-controlled area and tested periodically. Each time they are needed, they have to hauled to polling places, Ross noted.

The new machines represent more work for staff, and the new way of voting will be more expensive than using lever machines, said Ross.

`` Ballots are 65 cents apiece, and if we need 38,000 of them for elections twice a year for the primary and general election, or three times a year, when there's a special election, that's going to add up.''

But the federal government has ordered changes, the state government has consented to them, and now county boards of election are striving to make sure the transition is as smooth as possible.

``Our biggest problem may be convincing people to fill in the squares completely,'' said Schermerhorn.

A bigger problem in our opinion is that the new ballot scanners are not "stand-alone" devices at all, as many have been led to believe. This means the new voting system will be vulnerable to all the risks inherent in any centrally managed client-server computer network, including wide-scale error, propagation of viruses and malware, denial of service attacks, insider fraud, and so on.

Interestingly, the legislatures of two of the counties mentioned in this report, Delaware and Chenango Counties, have both passed resolutions to keep their lever voting machines. They seem to prefer their inexpensive, low risk, low tech, non-computerized, truly stand-alone vote-counting devices after all. And so should we all.

NY Advocates to State Board of Elections: Audits Won't Find Wrong Winners of Elections

2009-07-29T10:51:00.035-04:00

Since 2006 when this paper [PDF] was published by VoteTrustUSA, it's been widely acknowledged by statisticians and election integrity advocates that the outcomes of many US House races, and smaller state and local contests, can not be confirmed with high confidence using small-percentage precinct-level audits of paper ballots originally counted by computerized ballot scanners -- even if the chain of custody of all the paper ballots could be verified.

These peer-reviewed papers estimated the scope of the problem by examining almost 1,400 Federal elections over six years. The authors found that the winners of more than 17% of all Federal contests from 2002 to 2006 could not be confirmed with high confidence using a 3% audit of precincts, known in NY as Election Districts (EDs) -- even if the audits showed no erroneous vote counts.

Think about that for a moment: even if the 3% audit did not find a single miscounted vote, the winners of many elections counted by computerized voting systems could still be wrong -- and no one would ever know.

This white paper [PDF], published in 2007, covered six years of New York's Federal elections, and extended the study to the 2006 New York Senate and Assembly elections. The author found that in NY, the winners of 14 out of 87 US House races, 7 out of 62 State Senate Races, and 32 out of 150 State Assembly races could not be confirmed with high confidence using a 3% audit of Election Districts.

All of the above papers were sent to the State Board of Elections, New York's election integrity community, and various academics upon publication.

It's worth noting that some statisticians have criticized this work primarily because, they say, it's not sufficiently rigorous. They favor larger and more conservative audits [PDF] that assume even more votes could have been miscounted within the precincts. So the above papers may serve as a floor rather than a ceiling on the number of electoral outcomes that would not be confirmed with 3% precinct-level audits.

While paper ballots are easy for voters to mark, and easy to count by hand, the first paper cited above also showed how today's optical scanners, when used to their full capacity to count thousands of ballots each, are particularly unsuitable as audit units in elections. The reason is simple: for a given percentage of audited machines (such as 3%), larger machines result in fewer machines actually checked for vote-count discrepancies. This results in much lower confidence that the winners of elections are correct, than an audit of 3% of the smaller-sized Election Districts or precincts (or fractions of EDs counted by particular machines).

The calculations in all the papers cited above are therefore optimistic as far as New York is concerned, because New York will not audit its elections by precinct -- but rather by scanner. This means there will be uncertain outcomes of even more contests than previously estimated.

Consider that a problem in a single ballot scanner could miscount the votes cast on up to 4,000 ballots. Unless that scanner were picked to be audited, the problem could go undetected. With a 3% random audit, the smaller the total number of scanners, the greater the chance that a particular scanner (such as one with a 4,000-vote error) will NOT be audited. The same problem exists even if we assume, for example, that "only" 20% of the votes on a scanner could be miscounted.

By contrast, each of New York's 20,000 lever voting machines counts fewer than 1,000 ballots. Lever machines do not count votes with unobservable software, and unlike computers, lever machines can be reliably tested. Levers can't switch votes during an election either, the way scanner software can [PDF]. And of course, levers don't allow voters to cast overvotes, as scanners did in high numbers in Florida last year [PDF].

On July 25, 2009, after years of trying to influence the State Board of Elections to write effective auditing rules, advocates from around the state submitted their public comments on the 3% audits prescribed in the current draft regulations. One such comment [PDF] by New Yorkers for Verified Voting (NYVV) stated that:

"in many state Senate and Assembly races an audit of this size could easily overlook miscounts large enough to alter the outcome of a competitive contest."

While NYVV did not specifically mention Federal elections, it's clear from the above peer-reviewed literature that they too are at risk.

Below, following years of much more detailed comments, discussions and suggestions, are our public comments on New York's proposed auditing regulations [PDF].

Among other problems, as of this writing, it is not clear to us whether our State Board of Elections has even been able to agree on the definition of a "complete audit" in the Election Law. A request for an interpretation sent to their legal counsel remains unanswered. However, it should be obvious from NYVV's comments, and the Law itself that "complete" means all the ballots on which a contest appeared. The Law states:

"If a complete audit shall be conducted, the results of such audit shall be used by the canvassing board in making the statement of canvass and determinations of persons elected and propositions rejected or approved. The results of a partial voter verifiable record audit shall not be used in lieu of voting machine or system tallies." (EL § 9-211 4)

However, the SBoE and our county boards of elections may see things differently. They may have decided that the only way a candidate will be able to get a recount is through the courts.

Our Comments on New York's Proposed
Election Auditing Regulations

Executive Summary:

Regardless of mathematical considerations, if the SBoE does not interpret a "complete audit" in EL § 9-211 as a hand count of all the ballots in a contest, then candidates will have no right to a full recount under NYS Election Law and the audit will not limit the risk of incorrect outcomes of elections.

The mandatory 100% "recanvass of vote" in EL § 9-208 does not include a hand count of all paper ballots. A candidate would have to go to court to obtain a recount, probably with little or no evidence of miscounted votes from the audit, unless the audit can be improved to find such evidence. Therefore it is essential that the intent of ERMA's audit requirement, EL § 9-211 (3) and (4), be clarified and that the regulations comply with it.

Part 6210.18 Should be Amended to Include the Following:

1. Full compliance with EL § 9-211, which requires a uniform statewide standard for expanding the audit to a "complete audit" in the event discrepancies are found. The definition of "complete audit" should include all the ballots on which a particular contest appeared, and be used to determine the winner of the contest or the propositions rejected or approved (EL § -211 (4)). A complete audit should not be limited to a particular county, counties, or machine type, but should include all counties and machine types in which a contest appeared on the ballot.

2. Auditing of more, but smaller units, to provide a greater chance of finding problems that could affect outcomes of contests. Whenever possible (such as for percentage-based expansion of the audit, and for any contests not included in the initial 3% audit), audits should be based on EDs, or the portions of EDs (to be defined as "audit units") counted on a particular scanner, rather than whole scanners. The SBoE has already adopted this in their draft procedures for auditing central-count scanners, but only to avoid 100% hand counts of absentee ballots. The use of EDs, or the portions of EDs counted on particular scanners, should apply to all audits, to increase the chances of finding miscounted votes.

3. Escalation sections should apply to entire contests -- not just individual counties or machine types. Therefore, expansion of the audit should be:

contest-specific;
contest-wide; and
based on EDs on each scanner (which should be defined as "audit units") instead of whole scanners.

Error thresholds that require expansion of the audit if exceeded should also be contest-wide.

4. Larger audits for close elections: A simple formula or table in which the initial number of selection attempts or "picks" is inversely proportional to the victory margin, has been proposed and could be used to allocate auditing resources efficiently for close races in which votes miscounted, regardless of the reason, are most likely to result in an incorrect winner. Such audits should be conducted using the smaller audit units instead of whole scanners to increase their effectiveness and reduce the overall workload for a given confidence level.

5. Close-margin full-recount triggers: The 1% automatic trigger for a full hand count that will be used in the 2009 pilot, should be included in the regulations. A smaller margin (for example 0.35%) could be used for statewide races. All such margins should be based on the contest-wide results and not the results in individual counties.

6. The regulations should require the use of overhead projectors during hand-counts so that all observers can see the ballot being counted. The SBoE should consider inclusion of a requirement for web-casts of hand-counts with close-ups of the ballots being counted.

7. The regulations should require continuous observation of all voted ballots and other election-day materials that are critical to an audit. Election inspectors must be required, and observers allowed, to accompany the ballots and other materials to a central site where meaningful, continuous observation is permitted until completion of all audits. For example, in some counties a cell in the county jail may be considered for use for secure storage of ballots and materials, with observers provided with folding chairs in the aisle outside the cell.

8. To reduce the risk of an incorrect outcome, the first of the two escalation triggers needs to be lowered from the current 0.1% change in any candidate's vote share to a 0.05% reduction in the apparent margin of victory. This could result in fewer ballots to be hand-counted. As an alternative, the error rate requirement of HAVA Section 301 (a)(5) could be used, but only errors that reduce the apparent margin of victory should be considered in the decision of whether to expand the audit. This is important especially if initial samples are not large enough to confirm the outcome of the contest, as is the case with the current draft of the regulations.

9. The regulations should allow each candidate to choose a small number of EDs to be audited in each county in which he/she appears on the ballot, as a check for implausible results.

Submitted by:

Howard Stanislevic
Founder, E-Voter Education Project
http://e-voter.blogspot.com

and

Teresa Hommel
www.wheresthepaper.org/ny.html#KeepLevers
Chair, Task Force on Election Integrity,
Community Church of New York Unitarian Universalist

Most New York Voters Lose Undervote Notification

2009-07-15T14:36:00.009-04:00

The NY State Board of Elections met today and unanimously adopted an emergency regulation to turn off undervote notification on all tabulating ballot scanners. The undervote notification on accessible Ballot Marking Devices will not be affected.

The emergency regulation will be in effect for 90 days. At the end of that time, a permanent regulation will be promulgated.

Under the new regulation, the only voting machines or systems in New York that will warn voters that they have undervoted will be the accessible Ballot Marking Devices.

For decades, New York's lever voting machines have not permitted overvoting. Ballot scanners do permit overvoting, but in an effort to catch up with mechanical lever technology, the scanners must warn the voter about the effect of casting an overvoted ballot, per statute. This recent report from Florida, where excessive overvotes were partially responsible for the close results of the 2000 Presidential Election, reveals how the overvote warning system has been working with some of the same scanners that New Yorkers will be using.

Undervote as well as overvote notification, were both thought to be advantageous to voters when the original New York regulation was drafted. But concerns about confusing voters who wish to undervote intentionally in some contests, the need to keep the lines moving on Election Day, and the need for secrecy of voters' ballot choices prompted today's change.

LWV to NYS Board of Elections:Pilot Off Course!

2009-06-04T01:57:00.046-04:00

According to a report by Bo Lipari, representing the League of Women Voters of New York, the State Board of Elections' and US Department of Justice's so-called "pilot" of uncertified computerized optical scan vote-counting systems is way off course.

Photos from The Sydney Morning Herald

The State and County Boards of Elections participating in the aggressive and reckless roll-out of the uncertified ballot scanners this year may not be so fortunate as to have the services of Captain Chesley B. Sullenberger, III (pictured above), but they may very well need them before Election Day is over this year.

Lipari, a member of the Citizens Election Modernization Advisory Committee, writes that the systems to be used in the 2009 elections still have open defects which will not be fixed in the deployed systems. Moreover, significant changes have been made to software source code which has not yet undergone any wide scale testing, and will be used for the first time in real New York State elections.

Lipari's report goes on to list five areas that need improvement in the proposed plan:

Inadequate Auditing Provisions.
Participation should be limited to no more than 10% of registered voters per county.
No contingency plan in the event of problems.
Inadequate specifications for system and ballot security and chain of custody.
No plan for post pilot evaluation.

He concludes, "While well intentioned, the Proposed Plan has serious weaknesses that should be addressed before the plan is implemented."

That's putting it mildly. We believe that without a 100% hand count of the paper ballots, conducted in accordance with the procedures spelled out in New York's Election Law (PDF), this "pilot" is nothing less than a violation of our Constitutional rights.

The League, The New York Public Interest Research Group and New Yorkers for Verified Voting issued a press release in which LWV's election specialist Aimee Allaud said the State is using the voters of New York as "guinea pigs."

All we can say at this point is: MAYDAY!

Open Letter to the New York State Board of Elections -- Election Audits Must Be Simple But Effective

2009-05-27T19:44:00.015-04:00

A fellow election integrity advocate suggested I post the following as an open letter. It was sent to the NY State Board of Elections (SBoE) on April 20, 2009, a week before they were to meet with the county boards at a conference in Albany. I was told that auditing of elections was going to be on the agenda. Having been involved in the drafting of the relevant regulations, I was prompted to write this note. However, I have heard reports from conference attendees that election auditing was not actually discussed.

Note that the phrase "firm Constitutional ground" in this letter means that Equal Protection derives from an equal chance of detecting incorrect electoral outcomes of contests for the same elected offices in different parts of the State. I did not mean to imply that the use of concealed vote counting would necessarily be constitutional in the first place.

Election Audits Must Be Simple But Effective

Dear Co-Executive Dirs., Co-Chair Kellner and Commissioner Peterson

Thank you for correctly stating in your Apr. 8th letter to the counties that "under some circumstances ... safeguards will possibly escalate what will be required to include a full hand count."

The problem is, without an initial risk-limiting audit sample, there is no way to know whether such an escalation, or any escalation, should or should not occur. The solution can be relatively simple, but NOT as simple as the 3% "spot check" of machines or systems required by EL § 9-211.

In fact, a one-size-fits-all, percentage-based audit would violate Equal Protection by resulting in unequal chances of discovering material discrepancies that could change the outcomes of contests for the same office (e.g., State Senator) in different legislative districts throughout the State. Since the math underlying this is unequivocal, fixed-percentage audits should not be allowed to stand for this reason alone, except as an arbitrary minimum or "floor."

I believe you will be on firm Constitutional ground by implementing a risk-limiting approach, now endorsed by national groups such as LWV and NY good government groups such as NYPIRG.

The only remaining problem is: how to make it simple.

I've spent a great deal of time on this problem, pro bono, with the help of Dr. Mark Lindeman at Bard College and Dr. Ron Rivest and his colleagues at MIT and Northeastern U. The process of simplification has taken years, but I believe we are at a point now where we can offer NY a very simple but effective method, based on the maximum size of EDs, which I hope will remain at 1,150 active registered voters (but could be adjusted if necessary).

Frankly, I was hoping that by now, we would have received some feedback and possibly an endorsement of this approach from the SBoE. Time may be running out for NY and there is no reason for additional delays in light of the new method I have proposed to Commissioner Kellner, Bob Brehm and Kim Galvin, to simplify the risk-limiting audits.

Please advise when you are ready to discuss this further. You have to present something tenable to the counties in only a few days, and I'd hate to see such an opportunity squandered.

Best regards and thanks for doing your best to protect the franchise,

Howard Stanislevic
Founder, E-Voter Education Project
NY, NY
http://e-voter.blogspot.com

New York Rolls Out Uncertified Voting Systems for 2009 Elections

2009-05-22T17:28:00.052-04:00

ALBANY -- At a May 12th Commissioners' meeting, after collaborating with the US Dept. of Justice, the New York State Board of Elections cavalierly decided to risk the disenfranchisement of nearly a million of the state's voters, by allowing what one commissioner called a "huge pilot" of uncertified software-driven electronic vote-counting systems around the state in 45 of its 62 counties.

Here are the links to the Commissioners' resolution, and other documents containing the details of the plan:

Authorizing Resolution 05/12/2009 (PDF 50KB)
Pilot Plan Narrative 05/12/2009 (PDF 65KB)
Timeline 05/12/2009 (PDF 492KB)
County Participation Spreadsheet 05/12/2009 (PDF 42KB)

Over 900,000 voters (read: guinea pigs) could be affected by these irresponsible tests, which one county election commissioner, perhaps unwittingly, compared to filling out lottery tickets. Gambling with the votes of a million New Yorkers is hardly a way to instill public confidence.

The plan contains almost no provisions for manual recounts of the paper ballots to check the computer tallies, other than those that might be obtained through the courts. The only exceptions are for contests with a margin of victory of 1% or less. Full recounts of those contests will be conducted, but we bristle at the suggestion that the victory margin reported by the uncertified voting system will be the one used to determine whether or not the hand count to check the system will take place.

Commissioner Douglas Kellner made a motion at the May 12th meeting to allow any candidate to ask for and obtain a full hand recount. His fellow commissioners defeated it by a bipartisan 3 to 1 vote.

Apparently Kellner's colleagues believe that:

any candidate can convince a judge that a voting machine didn't count her votes -- even without evidence to support such a claim;
the judge will also believe that the paper ballots have been preserved inviolate and thereby allow them to be hand counted to find out who really won an election (contrary to a number of previous decisions by the highest court in the State -- not to mention the highest court in the land); and
the court would gladly spend taxpayers' money for such high-minded purposes as convincing losers of elections, and their supporters, that they really lost fair and square -- even given the amount of money already spent on the new voting systems.

But the voters of New York deserve more than just naive speculation about the ease of obtaining hand counts from a potentially partisan and cost-conscious judiciary. They deserve the actual hand counts if and when they are needed.

So what if the margin of victory happens to be slightly more than 1% (say 1% + 1 vote for example), and the courts deny the recount request? In that case the hand count reverts to only a 3% spot check, per Election Law § 9-211 -- part of the Election Reform and Modernization Act of 2005 that brought us this mess in the first place. If there are no discrepancies found in the spot check, the election could be certified -- which is more than can be said for the voting systems that actually produced the election results.

Unfortunately, the math is unequivocal: in many elections, a 3% audit can reveal absolutely NO discrepancies, and the outcome of the elections can still be absolutely wrong. If that happens, no one will be the wiser.

One other potential safeguard remains for the million voters who will be subjected to this foolish experiment: the long-awaited and yet to be promulgated State Board of Elections auditing regulations known as Part 6210.18. For well over a year now, we have been involved in the drafting of these regulations. They offer the only hope for anything better than the ill-considered 3% spot checks in the Election Law.

A year ago, many of New York's good government groups wrote to the Board, asking for these regulations to reflect best practices. But so far, progress has been slow to non-existent in this area, even as the mad rush to run real elections using potentially fake voting systems continues.

All that said, while the value of certification has been greatly exaggerated, we think it might be fair to say that if done properly, certification can prove that a voting system can work -- not that it actually will work. This weak assurance is of course not sufficient, but it's better than no assurance at all. The only way to be sure to prevent the disenfranchisement of New York's voters by untrustworthy computers, is to hand count 100%, at least until the systems are certified.

We'll be following this story and reporting on efforts to fix this latest debacle and avoid the Floridization of New York's elections. We don't think this is what New Yorkers signed up for when the State accepted $50-million in federal funds to replace its lever voting machines under the Help America Vote Act of 2002 (HAVA). The State has not been able to certify a voting system to replace the levers since then, and as always, it's important to read the law first.

In New York, the law has been decidedly anti-recount. So paper ballots or no paper ballots, the software counts will rule -- just as they did in Florida's 2000 election which brought us Bush v. Gore and ultimately, HAVA itself. Ironic, huh?

The Board did agree to present the matter to the State's Citizens' Election Modernization Advisory Committee. While their opinions are as yet unknown, and probably not binding, at least one member of the group has gone on record as favoring 100% hand counts of ALL votes counted by ANY uncertified voting system. This is in direct conflict with 3 out of the 4 State Board of Elections Commissioners who represent our two major political parties, but unfortunately may no longer be faithfully representing the voters of New York.

Remembering John Gideon (1947-2009)

2009-04-28T16:15:00.009-04:00

John Gideon, a Co-Director of VotersUnite and Editor and Publisher of Daily Voting News passed away in a Seattle hospital last night after a short bout with bacterial meningitis.

John's absence is so keenly felt that it already feels like an eternity has passed since getting this awful news. The election integrity community is devastated by this loss and many have been posting their thoughts in various places on the Internet. There is no central repository for them at this time (because there is no Daily Voting News) but here are a few of my thoughts about the man I knew and respected:

John gave voices to the voiceless.
His featured articles in Daily Voting News called attention to election integrity issues that would otherwise have been under-reported.
Who will report them now?

John was a man of courage.
Never have I seen him take a position for the sake of political correctness or to appease special interests.
He would have made a great New Yorker!

John brought people together.
He was one of the few people in the movement who was willing to talk to all the group-thinkers, true-believers and self-appointed experts from its various factions -- and even folks who actually know what they're talking about! He would bring them together from time to time, with his fire extinguisher at the ready.

John kept the integrity in election integrity.
He never took a position to obtain funding, access or favors.
And if he were occasionally proven wrong, he would stand tall but corrected.

John was humble.
Never a self-promoter, he showed up for work everyday and got the job done, really, really well. E-mails to John seldom went unanswered.
He treated everyone with kindness and respect -- but without compromising his principles.

I hope John is not irreplaceable.
But I have my doubts about that.
He was a rare breed.

We extend our deepest heartfelt sympathy to his family and to Ellen Theisen.

Donations to make it possible for VotersUnite to continue John's work can be made here.

NYVV Asks Voting System Vendors for Announcements, Plans and Promises

2009-04-20T02:53:00.028-04:00

In an April 15th open letter to vendors of computerized voting equipment, New Yorkers for Verified Voting (NYVV) cited what they call "the growing ill-will" and "understandably increased voter skepticism that many New Yorkers feel" toward the machines these companies want to sell to New York.

NYVV's letter points to reports of voting system failures from "around the world" published in the Daily Voting News, as well as two debacles right here in the Empire State:

the widely reported discovery of a ballot-stuffing hole in the Sequoia/Dominion optical scan ballot box; and
ES&S's refusal to participate in a pilot optical scan election this year, originally reported by Erie County Election Commissioner Ralph Mohr and by the Election Transparency Coalition.

Despite these difficulties, NYVV has continued to advocate for replacing New York’s mechanical lever voting system with a system of paper ballots, 97% of which will be counted only by computers.

According to New York's Election Reform and Modernization Act (ERMA), which requires the levers' replacement, paper ballots from only 3% of the computerized optical scanners must be hand-counted -- up to two weeks after an election. This has raised concerns among statisticians and election integrity advocates alike.

Now, says NYVV, the vendors have made the task of "creating enthusiasm" for this new kind of system even more difficult. Indeed, they say, the vendors' delays are making some New Yorkers "increasingly impatient" about the change.

To remedy this situation, NYVV urges the vendors to improve their image in order to "encourage citizen confidence." Their advice to the purveyors of these shoddy products:

announce quality improvement and staffing plans;
negotiate "supportive" policies for software licensing;
promise to adhere to original pricing; and
announce an "open source" software provision.

Critics of both NYVV and the vendors question whether such announcements, plans, and promises can make computerized vote-counting more acceptable to New Yorkers who are still reeling from the effects of scandals such as the AIG, Bear Sterns and the sub-prime mortgage meltdowns.

"I'm sure NYVV means well, but I question whether any assurances from vendors can make unverified, computerized vote-counting safe," said Joanne Lukacher, Executive Director of the Election Transparency Coalition.

Virginia Martin, who serves as an Election Commissioner for Columbia County, has called electronic voting "a boon for vendors and a nightmare for taxpayers."

"Federal law does not require the replacement of lever voting machines. They work well, we own them and they cost next to nothing. So why not keep them?" Lukacher said.

With respect to "open source" software, we learned some time ago that at least one vendor had already committed to disclosing their source code, provided however, that their voting system gets to be "certified." Unfortunately, as any computer scientist knows, investigating lost votes by reading source code is no better than investigating a building collapse by reviewing blueprints.

We commend NYVV for scratching the surface of what's wrong with computerized vote counting and the privatization of our elections, but we recommend that New Yorkers read an in depth analysis of the problems we will face, published by long-time New York election integrity advocate Teresa Hommel, the founder of WheresThePaper.org.

In her essay, "Back to Basics: New York should not replace our lever voting machines", Hommel methodically debunks the entire electronic vote-counting paradigm which, she suggests, is completely unnecessary for New York. Given her deadpan prose, we doubt that she's an "increasingly impatient" New Yorker when it comes to changing voting systems. Fortunately, patience can be a virtue.

We'll have more to say about Hommel's work in a future post.

WHERE'S THE LEVER? Long-Time NY Election Integrity Advocate Opts Out of Op Scan

2009-02-22T16:35:00.023-05:00

New York City--

Since the passage of HAVA, Teresa Hommel has been a tireless leader in the fight for voter-marked paper ballots in New York as an alternative to direct recording electronic (DRE -- usually touch screen) voting machines that lack a reliable voter-verified paper trail. But in a Feb. 22nd essay published on her website, WheresThePaper.org, entitled: Why Keep the Lever Voting Machines?, she comes to the conclusion that the state should keep its current manually operated voting system, rather than switch to a computerized paper ballot optical scan (PBOS) system.*

Why? In a nutshell, because it's too expensive to make the switch and do it right.

Hommel writes:

For nearly six years we have worked against improper use of computers in elections. ... We have said, "IF WE HAVE TO REPLACE OUR LEVER VOTING MACHINES, we should choose PBOS." At this time it appears that no DREs are likely to be certified or purchased in New York. It is very late in the process to say, "Stop! Let's not computerize at all!" But that is what we are saying.

Rather than continuing to fight the last war (PBOS vs. Brand X, i.e., DREs), Hommel goes on to say that lever machines are more secure, easier to manage and less expensive to maintain and use than any other voting technology.

She says that in this time of economic crisis, the higher cost of computerized elections will have to be paid for with cuts to other essential services. Recent conversations we have had with county legislators and election commissioners bear this out.

In fact, so far at least three New York counties have passed resolutions in favor of keeping their lever machines, either unanimously or with only minor opposition, with more such resolutions expected.

Hommel also cites the need for continuous observation of post-election paper ballots to prevent fraud, as well as the need for statistically grounded audits (i.e., hand counts) of paper ballots initially counted only by computerized ballot scanners. Such audits would be designed to either confirm electoral outcomes or trigger full hand recounts when the outcomes are in doubt with a high level of statistical confidence.

But all of this costs time and money we don't have, according to Hommel.

In this realistic assessment of New York's electoral system, Hommel discusses the obstacles to keeping our lever machines, as well as the following benefits of doing so:

Lever voting machines cost less, require fewer observers, and don't use software.
Our counties don't have to spend one extra dollar to use lever machines, because we already have them.
Lever machine technicians are paid somewhat less than computer technicians.
Lever voting machines are rarely tampered with because it takes too much time to do so. For this reason these machines do not require a group of observers to sit and watch them continuously.
Without software that can fail in unexpected ways, software-independent audits are not required.
Lever machines are immune to systemic exploitation.
Meaningful, observable testing of lever machines can be readily accomplished.
Lever voting systems comply with HAVA when used in combination with accessible ballot marking devices for voters with disabilities and limited English proficiency. (See HAVA's definition of "Voting System" in Section 301 (b)).

We strongly recommend that anyone truly concerned about the integrity of New York's elections read Ms. Hommel's excellent piece in its entirety. It's a far cry from some of the dogma we have been seeing from some other advocates who apparently have not fully considered the problems of election verification, or what the solutions would actually entail -- even as they continue to advocate for more computerized vote counting under the guise of voter-marked paper ballots.

* Note: Of course, as in 2008, to comply with HAVA, accessible hand counted paper ballots would continue to be used to accommodate any voters with special needs who wish to use ballot marking devices at the polls, rather than voting absentee.

New York -- Transparency vs. Certification: Fact & Friction

2009-02-11T16:25:00.012-05:00

The Election Transparency Coalition of NY (ETC) has issued a 2 page essay entitled, Only a Transparent Vote-Counting System Can Protect Democracy, now available on their blog at the above URL and here in PDF format.

This short essay by ETC's Founder and Legal Counsel, Andi Novick, Esq., prepared with the assistance of county election officials and the E-Voter Education Project, clearly explains why:

New York's transparent lever voting system is superior to unobservable software-based voting technology;
state and federal "certification" of a software-based vote-counting system is not an adequate safeguard;
the risks inherent in post-election hand counting of paper ballots have caused New York to prohibit recounts of such ballots cast at polling places, except as required on election night before the election inspectors adjourn (we recognize that in other states where software-based vote counting has become the norm, post-election audits and recounts may be the best that can be hoped for to verify election results);
the Help America Vote Act does NOT ban lever voting systems, which can be made fully HAVA-compliant with the addition of at least one accessible voting device for voters with special needs at each polling place (as NY has done in 2008 without exposing anyone's votes to the risks inherent in software-based vote counting).

New York has yet to replace its lever voting system, and has yet to enact any meaningful post-election audit laws or regulations. Those of us who have been studying this problem for years as the battle over which software-based voting system (touchscreens vs. ballot scanners) has been waged, understand exactly what will be necessary to effectively verify election results produced by software -- independently of software -- and, where possible, with confidence approaching that provided by the current lever voting system. We also know what New York's counties will be asked to do to comply with such rules. The task ahead of us is clearly a daunting one, but moreover, it's an unnecessary one -- if we keep and properly maintain our mechanical lever voting system.

Professor Bryan Pfaffenberger of the University of Virginia, who received a grant from the National Science Foundation to study the lever voting machine, has described New York's current machines as follows:

one of the most astonishing achievements of American technological genius, a fact that is reflected in their continued competitiveness against recent voting technologies in every accepted performance measure;

a technology that solved the characteristic problems of American elections;

immune to systemic exploitation, which could affect hundreds of thousands of machines;

in sharp contrast to the way Americans talk about voting machines today ... the lever voting machine—though lacking an independent audit trail—had done something today’s voting technologies have been unable do: it won the confidence of American voters and election officials

After thinking it through and weighing the available alternatives, we are forced to agree with Dr. Pfaffenberger's conclusions. Transparency trumps "certification" every time.

New York's Voter Registration Database: Fact & Friction

2008-10-31T20:29:00.017-04:00

We at Election Integrity: Fact & Friction are concerned primarily with the perils of electronic vote counting systems. However, there have been numerous concerns expressed throughout the year about New York's Voter Registration Database and the potential for voters to be incorrectly listed as:

Purged;
Inactive; or
ID Required (when in fact it is not).

While some of the reported numbers may have been exaggerated (e.g., it's not unusual for 10% of registered voters to actually be Inactive -- that's about a million), the questionable numbers are probably in the hundreds of thousands statewide all told, and therefore have the potential to disenfranchise lots of voters in various ways. After all, not unlike electronic vote counting, computers and software are involved!

And with all the new laws and high profile court cases about photo IDs and the like across the nation, how many New Yorkers actually know what kind of ID is required to vote in NY lately -- and when it does or does NOT have to be shown?

It's all very complicated! Too much to go into in a simple blog about electronic vote counting and risk-limiting post-election statistical audits like this one.

Fortunately, thanks to the folks at votersearch.org, who just happen to be New York election lawyers, we are happy to be able to point readers to this comprehensive compendium of the relevant NY election laws and regulations. And as with HAVA, ERMA and all the other stuff on the books, we advise anyone with an interest such things to read the law first, so you can have it on your side! As of this writing, you have three days to do so before the election!

So go to:
http://www.votersearch.org/reference.php

You can also check your registration in a copy of the NYS Voter Registration Database here:
http://www.votersearch.org/index.php

and in the original database at the State Board of Elections here:
https://voterlookup.elections.state.ny.us/votersearch.aspx

Finally, check with your County Board of Elections if you have any doubts or questions about your status. You can find contact information for them here:
http://www.elections.state.ny.us/CountyBoards.html

After this election is over, we can get back to figuring out how to actually COUNT some votes -- and with luck, maybe all of 'em!

BREAKING: Deja Vu (all over again) -- Feds Pull NY's Testing Lab's Accreditation

2008-10-29T14:14:00.021-04:00

The ink has barely begun to dry on a petition to save New York's lever voting system signed by over 1,100 courageous New Yorkers (so far) and -- what do you know?:

The National Institute of Standards and Technology (NIST) and the US Election Assistance Commission (EAC) have, for the second time in two years, suspended the accreditation of New York's electronic voting system testing lab, SysTest, Inc.

The first such suspension was carried out against Ciber back in 2006, after NY State tech consultants, as well as citizens who were paying attention, couldn't help but notice that Ciber had not been conducting tests required to meet federal and NY State standards and election laws.

That was then and this is now

As NY Yankees and Mets catcher, coach and manager Yogi Berra would say, this time "it's deja vu all over again." Yogi brought the 1973 Mets from last place in the final month of the season to win the National League pennant the year after the death of their beloved manager, Gil Hodges. But unlike Hodges' untimely passing, the death of New York's lever voting system has been greatly exaggerated by everyone from election officials, to election integrity advocates, to rabid anti-lever zealots who, unfortunately, just haven't thought the lever replacement issue through.

Fortunately, cooler heads have prevailed

You don't walk in the winning run with the bases loaded, and you don't dismantle a properly functioning, testable, transparent voting system and replace it with the kind of junk that can't even be adequately tested in the first place (because it runs on software), by labs such as Ciber and SysTest, who can't even meet the standards that allow them to attempt to do the testing.

And besides, New York's voting system is now fully HAVA-compliant, thanks to the addition of at least one ballot marking device for voters with special needs at each polling place. The lever system meets all other HAVA requirements.

Here's an explanation of why some of these problems have been occurring (NIST's computer security experts have already stated that testing software to high levels of security and reliability is impossible) -- not that it excuses SysTest's performance or Ciber's.

And here's the memo from NIST withdrawing SysTest's accreditation, as transcribed by NY State Board of Elections Co-Chair, Doug Kellner (Note -- we took the liberty of correcting some errors that occurred during scanning of the original document by a software-based optical character recognition system. Hope we got 'em all.):

UNITED STATES DEPARTMENT CIF COMMERCE
National Institute of Standards and Technology
Gaithersburg, Maryland 20888

October 28, 2008
Mark Phillips
Vice President of Compliance Services
SysTest Labs, Incorporated
216 16th Street, Suite 700
Denver, CO 80202-5115

NVLAP Lab Code 200733-0

Dear Mr. Phillips,

On behalf of the National Voluntary Laboratory Accreditation Program (NVLAP), I write to notify of you of NVLAP's decision to suspend its accreditation of SysTest's electronic voting testing program pursuant to NIST Handbook 150, NVLAP Procedures and General Requirements, 2006 Edition, section 3.10. This letter provides an explanation of NVLAP's decision and describes the steps SysTest can take to reinstate its accreditation. This action pertains to voting systems under review by SysTest to be recommended for certification by the Election Assistance Commission for future elections and is not pertinent to systems already deployed for the 2008 election which were certified under alternate systems.

Background Discussion

SysTest Labs, Incorporated is currently accredited by the National Voluntary Laboratory Accreditation Program (NVLAP), a program within the National Institute of Standards and Technology (NIST), to perform testing to federal standards in accordance with the Help America Vote Act of 2002 (HAVA). These standards are the 2002 Voting System Standards (VSS-2002) and the 2005 Voluntary Voting System Guidelines (VVSG-2005). On August 8, 2008, NVLAP sent SysTest Labs a letter outlining specific concerns with respect to SysTest's NVLAP-accredited testing of voting systems, including voting system test campaigns submitted to the Election Assistance Commission (EAC) under their voting system certification process. These specific concerns are documented in the March 2008 NVLAP on-site assessment checklist, produced as part of the normal reassessment process, and in communications between the EAC and NIST regarding issues that EAC staffidentified with test reports submitted by SysTest Labs (enclosed).

The August 8th letter (also enclosed) outlined three specific concerns. In short they were:
1) SysTest's lack of properly documented and validated test methods.
2) Testing conducted by unqualified or untrained personnel.
3) Improper assurances made to manufacturers regarding testing outcomes.

NVLAP directed SysTest to submit information to NVLAP, including a schedule of all accredited voting systems testing planned, within 14 days of receipt of the August 8th letter. NVLAP informed SysTest ofits intention to conduct on-site monitoring of the testing of electronic voting machines. SysTest was notified by email on October 6,2008 of NVLAP's intention to visit their lab on October 14th through 16th to observe testing that had been scheduled during that period.

NVLAP assembled a team consisting of the NVLAP voting system technical assessor, the NIST/NVLAP program manager for voting system testing and four members of the NIST Information Technology Laboratory (ITL) involved in writing the federal voting system standards. In addition, two EAC staff members were invited to provide their observations. During the on-site visit this eight-member team witnessed several tests, interviewed testers , and examined documents related to the areas of concern.

Site Visit Observations

As a result of this on-site monitoring visit, NVLAP has serious concerns about SysTest's performance of voting system testing. These concerns were supported by observations of testing where the test methods being used were not fully developed, validated, mapped to the requirements of the applicable standards, and controlled under SysTest's document control policy.

From the team's observations it was unclear who at SysTest had the ultimate responsibility for test method development. During the observed tests, it appeared that the testers were running the tests for the first time. Changes were made to the test procedures to address items that should have been caught during an initial run-through of the test. Basic tests, such as the system readiness test, were not conducted successfully. Three test methods failed due to problems with the procedure, tester error, or unfamiliarity with the test set-up. Some anomalies or potential problems during testing were not reported by the testers but were pointed out by members of the on-site team.

During the team's visit SysTest personnel stated that their policy was to validate test methods during the actual testing of voting equipment. This approach is unacceptable. The lab must validate all test methods separate from actual testing so that equipment nonconformance can be isolated from test method problems. This validation must follow set documented procedures and show a clear chain of responsibility for the process. SysTest has undergone numerous changes in personnel since its original accreditation and, in fact, since the March 2008 NVLAP on-site assessment. SysTest staff conducting testing during the monitoring visit demonstrated a lack of familiarity with the test equipment and procedures. Some personnel who participated in past on-site assessments were no longer associated with the NVLAP-accredited testing; they had been reassigned to work in support of state certification of voting systems. SysTest management's stated goal was to transfer the expertise and testing approach from their New York testing campaign to the NVLAP/EAC accredited testing campaign. SysTest must improve the level of training of personnel involved in NVLAP/EAC accredited testing given that SysTest has reassigned experienced testers to other work. SysTest should consider bringing in outside instructors to train laboratory personnel.

SysTest was advised that an appearance of impropriety had occurred in a case where personnel had given a client an indication that their equipment would successfully pass testing. SysTest's response was that this was an isolated incident and the person involved had not intended to give this impression. SysTest further stated that their employees were given a quiz which they feit covered training in this situation. It is NVLAP's position that this quiz is insufficient and SysTest must provide specific training to their employees on professional ethics and document the employees' intent to adhere to SysTest's stated policy.

NVLAP's Decision

Pursuant to NIST Handbook 150, NVLAP Procedures and General Requirements, 2006 Edition, section 3.10, NVLAP hereby suspends SysTest's accreditation effective as of the date of this letter. SysTest Labs, Incorporated is prohibited from using the NVLAP symbol on its test reports , correspondences, and advertising during the suspension period for all voting system testing. Accreditation may be reinstated only after such time that SysTest can demonstrate voting system testing in accordance with the requirements of the applicable voting system standards and NIST Handbook 150. This demonstration must be achieved through an on-site visit to SysTest to witness testing , review documentation, interview personne1, and any other means necessary to gather objective evidence in support of a decision regarding reinstatement.

This on-site visit will occur only after NVLAP is convinced, through the submission of documentation, that SysTest has taken the necessary steps to correct the areas of nonconformance herein addressed. This documentation will include, but is not limited to:
procedures for test method deve1opment; procedures for test method validation; revised document control procedures that specifically address technical procedures; fully developed test methods showing validation, document control , and mapping to the federal voting system standards; and, procedures or policies that address methods by which SysTest will control statements or assurances to their clients regarding the outcome of voting system testing.

SysTest was accredited by NVLAP based on its ability to develop and perform competent testing within the framework of an effective management system. SysTest now needs to revise its management system to correct the nonconformances found during this visit and implement these system changes. NVLAP believes that the current SysTest management team is committed to accomplishing this goal and will work with them to that end.

Sincerely,

Jon Criekenberger
NIST/NVLAP Program Manager
Enclosures
Cc: Brian Hancoek, Election Assistance Commission

NY: BlackBoxVoting.org Speaks Out for Election Transparency

2008-10-24T17:23:00.038-04:00

I was pleased to see this rather fair and balanced account of New York's voting system produced by BlackBoxVoting.org. As Bev Harris points out, NY is the last state to resist computerized vote counting. Watch this 7 minute video, specific to New York election protection to learn why, and then, please either leave NY alone, or support the fight to retain our transparent lever voting system!:

In the above video, some of the myriad of safeguards currently built into NY's voting system are clearly explained in ways that average voters can understand, as well as the biggest immediate threat to those safeguards -- human beings (albeit of opposing political faiths) simply incorrectly transcribing some tallies from the lever voting machines to the HAVA-and-NY-required permanent paper records they produce by hand on election night. How quaint!

The mitigation of this risk is also discussed in the BBV video: the mandatory 100% recanvass of EVERY lever voting machine and paper return in the State to check for such transcription errors.

In New York City, 55 such errors (out of more than 6,000 machines) were discovered and corrected in the 2008 Presidential Primary. This is standard procedure.

We don't have a "post-election audit" in NY because our lever voting machines do not contain software. We don't audit Gravity here either because we know that if we drop something, it almost always falls. Nor does the Coast Guard require canoes to carry fire extinguishers (lots of water around and they don't run on gasoline -- get it?).

That said, in the event the lever voting machines are replaced, NY's post-election audit law is inadequate, requiring only a paltry 3% of paper ballots to be counted by hand up to two weeks after the election -- no matter how close the outcome of any contest may appear to be. But there is still hope for improvements by the State Board of Elections. Reportedly, the Republican members have been the ones insisting on some larger hand counts, but there is still time for both parties to get with the program -- if we are actually seriously considering replacing lever machines with computers.

Now, compare the old fashioned human transcription errors above to the high-tech debacles we have seen in other jurisdiction including Los Angeles, CA, Washington DC, Pottawattamie County, IA and Cuyahoga County, OH -- just to name a few -- all of which involved computerized vote counting of paper ballots (optical scan or punch card). And how about the dropping of electronic vote tallies from entire precincts by GEMS, and perhaps other EMS central tabulators?

Also, consider the onerous high-tech "white hat" hacking efforts required to protect computerized vote counting systems, such as those of experts such as Harri Hursti and the University of Connecticut. The latter group actually checks things like ballot definition programming for errors or malfeasance that could cause vote switching on the optical scanners' memory cards, before elections. Know how? By exploiting one of the very same security flaws that make these optical scan voting systems so dangerous in the first place -- the use of human-readable (and therefore hackable) "interpreted code" on their memory cards.

One could go on and on about how unprepared NY is to deal with this stuff; how the certification process is a poor substitute for transparency; how the State Constitution and case law require that voters be able to see HOW their votes will be counted -- which is clearly not possible with software-driven computerized e-vote counting systems. Not to mention that the certification process itself is failing -- not only because all the voting systems are failing the tests, but because as computer security researchers at the National Institute of Standards and Technology have clearly stated:

"[E]xperience in testing software and systems has shown that testing to high degrees of security and reliability is from a practical perspective not possible." [emphasis added]

It might just be easier to watch the above video and see how transparent and secure NY's existing lever voting system is and why those whom Harris calls "citizens of courage" are fighting to protect it.

Proposed Mitigation for GEMS (and other EMS) Vote Deletion

2008-08-29T13:47:00.007-04:00

Updated August 29, 2008 to emphasize the point that this is NOT just about "electronic voting machines", undisclosed software, or paper ballots, as some have suggested. It's about Election Management Systems, software bugs (disclosed or otherwise), checks and balances, and good old common sense.

So Diebold/Premier's Global Election Management System (GEMS) drops votes from precinct-based tabulator uploads. Surprise, surprise!

Even if this were not happening all by itself, it was demonstrated four years ago that it's trivial for an insider, or an outsider with GEMS access, to make this and even worse things happen by way of GEMS' Microsoft Access database and perhaps other vendors' "central tabulators." Therefore the potential for central tabulator vote miscounts, as well as manipulation, is nothing new -- and it does not necessarily depend on the use of "electronic voting machines." Any voting system is at risk if there are no checks and balances!

The GEMS code has been reviewed from "Top to Bottom" and this latest bug was not detected, proving yet again that NIST researchers had it right when they said that "experience in testing software and systems has shown that testing to high degrees of security and reliability is from a practical perspective not possible." [Emphasis added]

During the last 4 years, no federal legislation, other than the ill-fated H.R.6414 in the 109th Congress, has been proposed to deal with this problem, even though the problem could be widespread and can be easily mitigated. (See this March 2007 post here at Election Integrity: Fact & Friction for more information.)

So Fix It Already!

The audit that needs to be conducted to find precinct aggregation errors is called a precinct aggregation audit. It could in fact be a 100% audit or "recanvass" of all precincts' election-night tallies, including but not limited to those produced only by software. While post-election auditing usually means comparing hand counts of a sample of paper ballots or VVPATs to software-determined counts of the same votes, in this case the audit need not be limited only to paper. See this story about how the Iowa Democratic Party made such an audit possible for their 2008 caucuses, which are actually voice votes.

Paper is not a requirement for such an audit, except for the permanent paper record produced by the voting system according to HAVA Section 301, which can be used to correct central tallies found to be in error in the event there are no voter-verified paper records to count by hand to make such corrections. This should be a requirement for all jurisdictions and could apply to paper-based, paperless, lever machine, and even hand counted paper ballot voting systems.

As for jurisdictions who do vote on paper, on July 18, 2008 here in NY, where fortunately we still don't have e-vote counting, we proposed regulations to deal with this sort of thing in the future. They coordinate the usual post-election "spot-check" audit (and hopefully a better audit that will eventually be approved by the State Board of Elections) with NY's existing 100% recanvass law that is already applicable to lever machine tallies. Here is the text of the proposed regulation for anyone interested in writing one for their state, or telling the NY State Board of Elections to approve this one and our other improvements to Part 6210.18 preferably before the State rushes headlong into unreliable e-vote counting for no particularly good reason.

As always, the term "election district" in NY is synonymous with the more generic term, "precinct."

Section 6210.18 Recanvass and Audit of Vote

A. Prior to the audits required by this section, the recanvass of vote in every election district (ED) in the state shall be conducted pursuant to NYS Election Law Section 9-208 by comparing all electronically displayed, recorded, printed or transcribed tallies of the vote in each ED, including those displayed, reported or aggregated by any centralized election management or tabulation software. Any discrepancies found in the recanvass of vote shall result in an immediate manual recanvass of all the voter-verifiable paper audit trail records produced or counted by any machine or system used to tally the vote in any ED in which such discrepancies were found. Pursuant to NYS Election Law section 9-211(5) and notwithstanding any other provisions in these regulations, if a voting machine or system is found to have failed to record votes in a manner indicating an operational failure, as evidenced by a discrepancy between two or more electronically displayed, recorded, printed or transcribed tallies, the board of canvassers shall use the manual tally of the voter verifiable paper audit trail records to determine the votes cast on such machine or system, provided such records were not also impaired by the operational failure of the voting machine or system. Such recanvass of votes made pursuant hereto shall thereupon supersede the returns filed by the inspectors of election of the ED in which the original canvass was made.

Now the State Board of Elections has not approved this proposed regulation....yet....but they haven't certified any e-vote counting systems either. So as usual, we are treading water here in the Empire State. Things could be worse.

We can only hope that this and other proposed regulations to deal with e-vote counting will actually be adopted -- prior to the implementation of such high-risk systems to replace lever voting machines. But better yet, let's forget the whole e-vote counting thing, keep the lever machines, and get back to running free and fair elections! That would be real progress.

As for the rest of you who actually have your votes counted on this junk, please try to get with the program before there's an election or something!

NEW YORK'S BACK DOOR TO THE BALLOT BOX

2008-08-17T15:10:00.029-04:00

Due to the unobservable and mutable nature of software used to count votes at elections, full or partial post-election hand recounts of voter-verified paper ballots (VVPBs), also known as post-election audits, are now considered by many to be the "gold standard" of election integrity. Historically, this has not been the case, but as a recent electronic voting system security paper by Haldeman et al (who have actually hacked optical scan and DRE e-vote counting systems for the State of California and demonstrated some of their work to members of Congress) stated:

"While conducting a thorough audit may be time consuming, it provides a higher level of confidence in the integrity of the result than any other mechanism we have been able to identify."

But in 2008 in the State of New York, some disabled voters whom HAVA was intended to help may be putting their votes at risk, even if their ballots are counted by hand. And in 2009, they may have a lot of company. This is because at least one electronic vote-counting system, to be used only as an accessible ballot marking device (BMD) this year in dozens of counties in the state, features a low-tech way to corrupt even a rigorous post-election audit procedure or a full hand count: an old fashioned stuffable ballot box.

As this video by election integrity advocate Rady Ananda and attorney Andi Novick clearly shows, software-based electronic vote counting is not the only thing New Yorkers will have to worry about in the state's rush to comply with HAVA:

Attorney Andi Novick inserts several ballots into a slot on top of the Sequoia/Dominion ImageCast precinct-count optical scan voting system that enables stuffing of the locked ballot box.

You can read more about this at Op Ed News, but it's no wonder that Novick, who founded the Election Transparency Coalition of NY, is planning on suing the state for violating its own Constitution by allowing electronic vote counting, and now perhaps even facilitating the kind of old fashioned paper ballot box stuffing reminiscent of Tammany Hall.

To date, we are not aware of any other open-ended vulnerability, security or penetration testing of the Sequoia/Dominion ImageCast machine, but clearly, it is only too easy to penetrate with low-tech methods such as ballot box stuffing. New York will be hand-counting the BMD ballots this year, instead of relying on software-driven optical scanners which have thus far exhibited hundreds of discrepancies in their source-code reviews against the 2005 federal Voluntary Voting System Guidelines that the state requires voting systems to meet as part of its certification process. But even a full hand count cannot compensate for a stuffed paper ballot box!

There ought to be a law -- and wouldn't you know it? There is!

It's not as if previous New York legislatures hadn't anticipated such nefarious intent; ballot box stuffing is as old as the hills. So what remedies does the NY Election Law provide in the case of a stuffed ballot box?

In their wisdom, our forefathers decided that the best way to deal with a stuffed ballot box was not to count the stuffed ballots. But because a clever attacker would take great pains to ensure that there was no way to distinguish between stuffed ballots and those cast legitimately, Election Law § 9-110 (2) states:

"[S]uch ballots shall all be replaced, without being unfolded, in the box from which they were taken, and shall be thoroughly mingled therein, and one of the inspectors shall, with his back to the box, publicly draw out as many ballots as shall be equal to such excess and, without unfolding them forthwith shall enclose them in an envelope which he shall then and there seal and endorse 'excess ballots from the box for ballots for the general election, presidential electors, or party ballots or otherwise', as the case may be, and shall sign his name thereto, and place such envelope in the box for defective or spoiled ballots."

In other words, the number of excess ballots must be randomly removed from the box, without anyone even knowing which ballots were legitimate or which had been illegally stuffed. Such ballots are then set aside -- never to be counted!

While such measures may seem draconian, randomly disenfranchising some voters whose ballots are removed from the box is preferable to allowing the counting of all the excess ballots that are known to be fraudulent. Stuffed ballots would most likely contain votes exclusively for a particular party or candidate, some of which would be removed at random under the law. Even so, in a highly partisan precinct that votes 90% for the preferred party, a ballot box could be stuffed with ballots voted 100% for the opposition, thereby suppressing the preferred party's advantage. Removing ballots at random and not counting them would do little to ameliorate this situation, but it's the best that could be hoped for under the circumstances.

Obviously, it's very likely that voters would be disenfranchised if legitimately cast ballots happened to be randomly removed. Unfortunately, this year in New York, the voters most likely to be victims of a ballot stuffing attack would be the very voters HAVA was intended to help -- disabled voters.

So much for the election-night count; what about those post-election audits?

For decades, statisticians and EI advocates have known how to calculate the number of ballots that need to be hand counted to see who won elections counted by software with high confidence. It's not usually all the ballots, but at times, such as the 2000 Presidential Election in Florida and the 2004 Gubernatorial contest in Washington, a full hand count (or perhaps preferably, a re-vote or runoff election) is necessary.

In a ballot stuffing scenario, a properly designed audit that also includes ballot accounting will reveal more ballots than voters (unless of course the poll books were also "stuffed" with fake signatures), but election results will still be spoiled by ballot stuffing unless the auditors could discern legitimate ballots from fraudulent ones. This would not be an easy task.

A current draft of the New York State regulations for optical scan voting systems would allow about 4,000 legitimate ballots per box, and the poll worker training manual for the Sequoia/Dominion ImageCast states that the the system's ballot ID number only "distinguishes between ballots from different districts, but can never be used to identify an individual ballot or voter." New York's Constitution requires secret ballots.

What’s worse, if the machines and ballots were left unattended in a warehouse with their back-door ballot stuffing slots exposed, anyone could insert extra ballots that could be used to disrupt a post-election audit; trigger an expanded audit when vote count discrepancies were discovered; and even trigger a fraudulent recount of all the paper ballots which, under NY Election Law, could change the outcome of an election.

At the very least, an election could be thrown into a state of chaos and uncertainty, resulting in litigation that could drag on for months after the reported winner has taken office, undermining public confidence.

So, how do we protect disabled voters who choose to cast their ballots on these insecure "HAVA-compliant" systems? At the Aug. 4th State Board of Elections meeting, Co-Chair Douglas A. Kellner suggested hand counting these paper ballots on election night at the polling place. That's a step in the right direction and regulations may soon be drafted to require it.

But in 2009, nearly all New York voters will be expected to cast paper ballots at polling places, have them optically scanned, counted by computers, and deposited into these stuffable ballot boxes. So what's the plan to protect the rest of New York's voters?

Everything Old Is New Again

Until now, stuffing ballot boxes at elections in New York was thought to be a thing of the past, thanks to our decades-old, yet reliable lever voting machines. We can only guess what other “back doors” may exist in the proprietary, unobservable, undetectably mutable ImageCast software, but if this obviously shoddy hardware design is any indication, it could be the tip of the iceberg. New Yorkers therefore need to think twice before actually allowing their votes to be counted on such machines.

Professor Bryan Pfaffenberger of the University of Virginia Dept. of Science, Technology & Society was awarded a National Science Foundation grant to study the lever voting machine. In Machining the Vote, he defends levers, which were designed with an eye toward preventing paper ballot fraud:

"Having studied the history, I strongly believe that there would be no such call for paper if the ugly history of fraudulent practices enabled by paper ballots were known -- unfortunately, the American people have forgotten the lessons they learned a century ago, and I greatly fear that we will have to repeat them in order to learn them again.

"In my analysis, the lever machine deserves recognition as one of the most astonishing achievements of American technological genius, a fact that is reflected in their continued competitiveness against recent voting technologies in every accepted performance measure."

Dr. Richard Hayes Phillips, who like Rady Ananda, and unlike many armchair investigators and pontificators, has first-hand experience investigating the 2004 Presidential Election in Ohio, wrote in a recent essay entitled: In Defense of Lever Machines,

"I simply will not defend the use of paper ballots if they are transported to another location before they are counted. I would much rather have lever machines counted at the polling place than any system, paper or paperless, counted elsewhere."

Some may claim that software-driven "precinct-count" optical scanners fulfill this requirement, but how do we know that the paper ballots will in fact be counted correctly by these special-purpose trusted computing devices? (Hint: we don't!)

Once again, it's important to remember that the reason for a post-election audit is that we can't trust election results produced only by software. Don't be lulled into a false sense of security because the software has been "certified." Researchers at the National Institute of Standards and Technology have clearly stated: "[E]xperience in testing software and systems has shown that testing to high degrees of security and reliability is from a practical perspective not possible." [Emphasis added.]

And as e-voting expert Dr. Avi Rubin of Johns Hopkins and the ACCURATE center ruminated in his blog:

"The current certification process may have been appropriate when a 900 lb lever voting machine was deployed. The machine could be tested every which way, and if it met the criteria, it could be certified because it was not likely to change. But software is different. [Y]ou cannot certify an electronic voting machine the way you certify a lever machine.... [W]e absolutely expect that vulnerabilities will be discovered all the time....

"Software is designed to be upgraded, and patch management systems are the norm. A certification system that requires freezing a version in stone is doomed to failure because of the inherent nature of software."

A post-election audit, widely viewed as the best we can do to mitigate the risks of software-based electronic vote counting systems, can only be effective if the chain of custody of the paper ballots is absolutely secure. We are not convinced that this will be the case with the system shown in the above video that has already been purchased by most New York counties for the exorbitant sum of $12,000 apiece. (Not to mention the fact that the State Board of Elections has yet to approve our suggestions for risk-based post-election audits, leaving up to 97% of the vote in the State counted only by software.)

The Worst Voting System Around

Let's stop pretending that e-vote counting systems -- with or without paper trails -- are safer overall than a voting system comprised mainly of lever voting machines. There is no evidence to support such claims, especially given the way paper ballots are being used and abused -- particularly with respect to software-driven computerized optical scan "recounts" that are rapidly becoming standard practice in state after state in lieu of the even less trustworthy DREs they are replacing.

The fact is, like democracy itself, lever machines are the worst voting system around -- except for all the others that have been tried.

If you vote in New York, and you'd like to sign the petition in support of Andi Novick's lawsuit to stop the State from replacing lever voting machines and counting votes with software, or to become a plaintiff in the case, go to: http://www.petitiononline.com/etcnysls/petition.html.

NY Advocates to State Board of Elections: Make Election Audits RISK-BASED

2008-06-18T02:06:00.019-04:00

A coalition of New York's election integrity advocates have asked the State Board of Elections not to approve the current draft of the Part 6210.18 auditing regulations, which are loosely based on the State Election Law requirement to manually count the ballots from 3% of electronic vote counting systems in each county (expected to be computerized paper ballot optical scanners).

Among other deficiencies, the regulations contain a loophole that would increase the hand counts well beyond the 3% called for by the election law for some counties and contests, while apparently neglecting others.

A letter sent to the State Board on June 16, after several months of intermittent negotiations and discussions, signed by Bo Lipari (New Yorkers for Verified Voting), Lawrence Norden (Brennan Center for Justice), Aimee Allaud (League of Women Voters), Neal Rosenstein (NYPIRG) and yours truly, among others, proposes risk-based statistical audits and the formation of a state election auditing task force within 60 days. The proposed group would conclude its work at least 60 days prior to the first 2009 election. The audits proposed in the letter are favored by many national election integrity advocates as a more efficient and effective method than percentage-based audits to confirm, independently of software and with a high level of confidence, the winners of elections called by electronic vote counting systems.

Certification of the systems slated to replace New York's mechanical lever machines has been fraught with difficulties such as continued non-compliance with federal and state voting system standards by vendors, and the withdrawal of federal certification of New York's first voting system testing lab, Ciber, Inc. in 2006.

These and other reported problems and failures, including documented cases of incorrect electoral outcomes reported by e-vote counting software, have led an increasing number of advocates, experts, and officials to conclude that the risk-based post-election audit, possibly resulting in a full hand recount, is the only way to know with any certainty that the outcomes of elections reflect the will of the voters.

So Now Can We Talk About Hand Counts?

2008-06-13T17:13:00.022-04:00

I wanted to share yesterday's opening comment by John Gideon in Voters Unite's Daily Voting News because it refers to some important work by John Washburn that I may have played a small role in motivating. I'm also going to report on the state of play in NY, the last state to resist implementation of so-called "HAVA-compliant" voting systems in favor of retaining its sometimes imperfect but usually reliable mechanical lever machines. (The levers are also HAVA-compliant as long as HAVA Accessibility requirements are met with other equipment, but this has yet to be properly adjudicated.)

Gideon writes:

Voting systems are tested for federal certification by a "Voting Systems Test Lab" (VSTL) against the voting systems standards. So, one would expect, that if a voting system fails to meet the standards it fails testing and cannot be certified. One would expect. However, the voting systems standards give the vendors and the VSTLs an out. B.5 of Appendix B of Volume II of the 2002 VSS and the 2005 VVSG says, “….any uncorrected deficiency that does not involve the loss or corruption of voting data shall not necessarily be cause for rejection”. A Premier voting system was recently recommended for certification by Systest, one of the VSTLs. In the test report Systest reported 79 discrepancies. 77 of those discrepancies were serious but fell within the B.5 “get out of jail free card”. Two of the 79 were serious discrepancies that report loss of data and are not covered by the “get out of jail free card”. Yet, the system was recommended for certification and the EAC is considering following that recommendation.

Well, I hate to say "I told you so", but thanks to John Washburn for pointing out:

"[B]oth sets of [2002 and 2005 federal voting system] standards have an explicit loophole that allows almost all the requirements — weak as they are — to be ignored. This second objection was first brought to my attention two years ago by Howard Stanislevic."

It's always nice to see that someone else has been paying attention!

As for how the testing in NY is going, so far, it makes the above discrepancies uncovered by Washburn look like a walk in Central Park!

Thanks to the Honorable Gary L. Sharpe, the judge in the case of US v. The New York State Board of Elections who has previously stated that he gets his information about electronic vote counting from reading the newspapers, the State Board of Elections is now required to send the Court weekly status reports on the progress of, among other things, lever machine replacement testing, also known as "Plan A." According to the report dated June 6, 2008:

SysTest reports that Sequoia/Dominion has 279 open source code discrepancies and ES&S has [a whopping] 915 open source code discrepancies.

This, even according to the inadequate 2005 Voluntary Voting System Guidelines that John Washburn, myself, and others such as UC Berkeley computer science professor Dr. David Wagner have been criticizing for years.

But with the loopholes reported above and the pressure from the US Dept. of Justice and the Court, what assurances will NY voters have that any of the above standards violations will ever be corrected?

Not that source code is the only way to screw up an election. Far from it! Those of us actually paying attention know that ballot programming, also known as election configuration, is much more accessible and dangerous than mere source code. Anyone with access to an Election Management System such as GEMS, Unity or WinEDS (the big 3) already has all the tools necessary to manipulate election results, even BEFORE the election, by tinkering with ballot programming. But voting system source code certainly has the potential to do just as much damage if it doesn't work the way it's supposed to after it's complied and run a voting system.

As New York prepares to dismantle its lever voting system (which, for some uninformed folks, just can't happen soon enough), the fact is to date, there is still no suitable replacement available. With a total of over 1,000 standards violations, even based on the weak Federal standards, it's hard to imagine how they can all be corrected in time for a 2009 election (2008 is already officially out of the question, except for deployment of electronic ballot markers to comply with HAVA's well-motivated Accessibility requirements).

It's the vote counting (stupid)! That's what needs to be checked by counting enough ballots by hand to see who really won our elections. To that end, the State Board of Elections have proposed some new election auditing regulations. Unfortunately, they are still inadequate, but they can be salvaged if the Board would exercise some due diligence and consult with those who, for years, have been studying the problem of confirming electoral outcomes without having to depend on source code, ballot programming or election configuration and management software. Maybe they will.

NY: Planned Lawsuit Challenges Constitutionality of E-Vote Counting

2008-03-20T14:44:00.012-04:00

An open letter to New York's election commissioners, citizens and poll workers, penned by Andrea T. Novick, Esq., the attorney who filed the amicus brief in the US Dept. of Justice's lawsuit against the state, suggests that, among other things, electronic vote counting violates the state's Constitution.

In addition to the constitutional claim, the letter also makes the following claim about New York's current voting system, which is comprised almost entirely of non-computerized lever voting machines used to count votes only on election day:

The present machines are legal under the Help America Vote Act (HAVA), as long as Accessibility requirements are met with at least one accessible ballot marking device per polling place to accommodate voters with disabilities.

Such HAVA accessibility compliance is currently underway in NY.

To support the lever compliance argument, Novick cited the opinion of former New York City Election Commissioner Douglas A. Kellner, as stated in a speech before the NYC Voter Assistance Commission in 2004. Kellner, a Democrat, is now one of two NY State Board of Elections Co-Chairs.

Reading law is hard work

Any reasonable reading of HAVA seems to confirm Kellner's assertion that levers are compliant, since Section 301 of the HAVA statutes, "Voting Systems Standards":

does NOT require voter-verified paper audit records or ballots (which would make many DRE (usually touchscreen) voting machines non-HAVA-compliant);
does NOT require the voting system to use a printer to produce the paper records required by HAVA; and
does NOT contain accuracy requirements that are applicable to either lever machines or hand counted paper ballots.

The mostly theoretical accuracy requirement of an error rate of 1 in 500,000 ballot positions referred to in the statute, is taken from the 2002 federal Voting System Standards/Guidelines. That document, as well as the subsequent 2005 version produced by the US Election Assistance Commission (EAC) under HAVA, only contains standards for voting systems comprised of DREs, computerized electronic ballot scanners and central tabulators.

All other HAVA requirements such as overvote notification, permitting the voter to correct their ballot before it is cast, etc., have been met by the lever machines for decades -- long before electronic voting systems offered such protection.

Novick wrote of the decades-old machines:

"Levers in their mechanical simplicity have a transparency that enables regular human beings to observe both foul play and innocent failures. The evidence of the failed votes can be proven in court just the way the evidence as reflected by the hand-count tally sheets could prove that the people's will may not have been realized."

In truly bi-partisan fashion, which is another state constitutional requirement of NY's election system, Novick also included the following testimony, given by Nassau County Republican Election Commissioner John A. De Grace to the State Board at a Dec. 2005 hearing:

"I can only speak for myself, although I am certain that all other Commissioners in the State of New York feel as impassioned as I do. My main responsibility is to the voters, to ensure that my Board does all it can to implement the law as well as to guarantee fair, just, accurate elections. Up until now I have felt secure and confident that I have been able to do this. Through the use of the Automatic Lever Voting Machines, though aged, I am able to certify election results and I am certain of the accuracy by which we conduct our elections."

In its litigation in the Dept. of Justice case, NY State failed to make the case that levers are in fact HAVA-compliant, even though the attorney for the United States admitted recently in his remarks to the court that HAVA does not require voter-verified paper records to be produced. The issue of lever machine compliance therefore remains unadjudicated.

NY Election Law exempts lever machines from new requirements for as long as they are lawfully used, but also requires their replacement at some future unspecified date. The State Legislature extended the lever replacement deadline indefinitely last year in an amendment to the Election Reform and Modernization Act of 2005.

Reading newspapers is another story

The judge in the DoJ case, the Honorable Gary L. Sharpe has stated that he gets information about the case from reading the newspapers. To the extent that our media will cover Novick's impending lawsuit, perhaps Judge Sharpe may be made aware that federal statutes do not ban the levers after all. If not, he can look it up in HAVA Section 301.

The EAC, for its part, has issued an advisory stating that they believe levers are not HAVA-compliant, presenting the usual thus far unadjudicated arguments.

Should New York not wish to return the HAVA money earmarked for lever replacement, Novick says that there is another possible remedy that would satisfy both HAVA and the state constitution: hand counting paper ballots for federal elections, while the lever machines could continue to be used for state and local elections that are not subject to federal law. This would involve at most, three hand counted contests, and in 2008, would involve only two, since there is no US Senate seat up for grabs this year. Under this plan, the lever machines could be used as privacy booths, allowing most voters to hand mark their paper ballots for the one to three possible federal contests, and then proceed to vote in other elections on the familiar mechanical ballot displayed on the lever machine. A supply of federal ballots, pens and clipboards would be the only required changes to the current voting system -- and of course the hand counters for the federal elections.

Other solutions might involve partial hand counts on election night to check computerized electronic ballot scanner tallies, however NY Election Law not only specifies a number of such hand counts that is not statistically grounded (just 3%, regardless of how close a contest may appear to be or how many electronic voting machines or computerized ballot scanners are involved), but also requires the manual count to begin up to 15 days after an election, raising constitutional questions as well as concerns about the chain of custody of the paper ballots.

Under-Reported: New Holt Bill Says Election Outcomes Could Be Confirmed With Hand Counts

2008-03-18T15:43:00.000-04:00

After months of haggling with Congressman Rush Holt's office about some of the ambiguous language in both H.R.811 and the new voluntary bill, H.R.5036, I happened to notice this verbiage that somehow made its way into the new bill (emphasis added):

(1) IN GENERAL- A hand count conducted in accordance with this section is a count of all of the paper ballots on which votes were cast in the election (including paper ballot printouts verifiable by the voter at the time the vote is cast), including votes cast on an early, absentee, emergency, and provisional basis, which is conducted by hand to determine the winner of the election and is conducted without using electronic equipment or software.

The text of the bill can be found here: http://www.govtrack.us/congress/billtext.xpd?bill=h110-5036

As far as I know, this is the first acknowledgment in any federal legislation that hand counts may actually be conducted to determine the TRUE WINNER of an election. And under this bill, Uncle Sam is supposed to pay for it.

This is a paradigm shift. Some of us have been fighting for language like this for over a year in connection with Holt's so-called election audits. Even the section that allows alternative sampling methods to be used does not say specifically that they should be used to determine who the winner of an election really is. That sort of thing (Congress actually judging the elections of its members, as required by the Constitution) never seemed to be on the table.

But now, for some reason, this election-outcome-confirming language has appeared in a piece of federal legislation, and it's Holt legislation at that! So I say, "Well done Congressman!"

Even if this is some kind of oversight, we should fight to keep this language in the bill so it won't be gutted in committee.

There are some loopholes in the bill, and the whole thing is voluntary anyway. But I think H.R.5036 is worth supporting, if for no other reason, based on the above language.

NJ Governor Signs Landmark Election Protection Legislation

2008-01-15T18:50:00.005-05:00

On Jan. 15, New Jersey Governor Jon Corzine signed S507 into law.

[Note: the text of the law is now available here (PDF)]

I've already written enough about the significance of this bill, what it means to election integrity in the Garden State and the nation, and why it's now the first Law in the nation to seriously address the electronic-vote-counting problem.

What I've not said yet is how appropriate it is for this bill to become law on Martin Luther King, Jr.'s birthday -- not the one that's observed by having a 3-day weekend -- but the actual day, Tuesday, January 15th, 2008, when he would have been 79 years old.

I don't know if this was intentional on the Governor's part. I was not at the bill signing, but it would not surprise me. I do know from having had the privilege of working with Senator Nia Gill, the bill's sponsor who did everything in her power to ensure its passage without any unnecessary compromises, that voting rights and vote-counting rights are inseparably intertwined, as well they should be.

Will this law solve every potential problem with our elections, even if it's copied in all 50 States? Even if Congress begins to take the e-vote-counting problem seriously? No. We know it won't, and some have been all too quick to point this out. It just happens to be a giant step in the right direction, and the people of New Jersey should be proud to have taken it.

New Jersey's Post-Election Audit Bill Goes to the Governor!

2008-01-08T01:36:00.000-05:00

January 8, 2008

It's alive -- and it's almost a law!

Special-event parking tax surcharges, motor vehicle fines and fees and orthotic appliance health benefit coverage. Such is the business of state government.

But today at 1:06 AM, at the end of a grueling 12-hour lame-duck session, the New Jersey General Assembly made history by passing A2730/S507, the state's landmark post-election audit bill, by a bi-partisan vote of 53 to 19.

You can watch history in the making here at time index 11:57:35:
http://rmserver.njleg.state.nj.us/internet/2008/A/0107-1200PM-1.wmv

The bill -- which is the first in the nation to require hand counts of enough votes to confirm the outcomes reported by electronic vote-counting systems independently of software -- now goes to Governor Corzine for his signature.

Put your hands together for the NJ Legislature!

(Oh, and they also abolished the death penalty. ;-)

New Jersey's Post-Election Audit Bill and Its Importance to Our Nation

2008-01-05T16:48:00.000-05:00

Despite the efforts of election integrity advocates, statisticians and computer scientists, 2007 marked the fifth year since the passage of the Help America Vote Act that the federal government has failed to solve the electronic vote-counting problem. Perhaps more significantly, '07 was the 32nd year since Roy Saltman, working for the National Institute of Standards and Technology's predecessor agency, the National Bureau of Standards, proposed what many believe to be the first workable solution to this problem way back in 1975!

While both Houses of Congress have dithered, on Dec. 13, 2007, the New Jersey Assembly diligently amended their version of the state's post-election audit bill, A2730, to match the Senate version, S507, as amended by Senator Nia Gill. Gill's legislation had already sailed through two Senate committees, and on Dec. 17, the full Senate passed S507 by a vote of 22 to 14. On Jan. 7, 2008 the Assembly will vote on A2730. The bill is expected to pass, and Governor Corzine, who has received many phone calls in support of this bill, is expected to sign it into law.

While there will continue to be calls to replace the state's direct recording electronic (DRE -- pushbutton or touch screen) voting machines with optical scan systems, the audit provisions would apply equally to either system including central-count scanners used to count absentee ballots. Inattentive voters may not verify the paper audit records printed by the DREs, which would be essential to the integrity of the audit, so they will have to be educated and directed to do so. But even those seeking to ban DREs have testified in favor of S507, because they know that optical scanners solve only the electronic-vote-casting problem -- not the electronic-vote-counting one.

Many still have a warm fuzzy feeling when comparing ballot scanners to those used to mark the SATs or other standardized tests, just as some might think that DREs are as reliable as ATMs. But the truth is, both are software-dependent electronic-vote-counting systems, and test after test have shown they were not designed with security in mind.

The same security problems that exist with DREs are present with optical scanners. Both use the same centralized election management systems (typically a single PC for an entire county -- sometimes poorly secured), and with either type of system, the combination of the secret ballot and the trade-secret vote-counting software makes it almost impossible for anyone to know that their vote is being counted as cast. Add to this the fact that error-free software is beyond the state of the art, so even with the best of intentions, it's not possible to know who really won an election counted only electronically with software.

Fortunately the solution to this problem is relatively simple. Not surprisingly, it has little to do with computer science, information technology or software -- and it's not very expensive either. Researchers at Northeastern University and MIT (Aslam, Popa and Rivest) have demystified the statistical procedure involved so that it can be implemented using high-school-level math and a hand calculator. Statisticians, auditors, and other advocates across the nation will now be able to explain this procedure to election officials and average voters.

The solution is to hand count enough votes, at a cost of about 10¢ apiece, to find out who won each audited election contest. And New Jersey's post-election audit bill, S507/A2730 will become the first law in the nation to require confirmation of electoral outcomes by using such a procedure, independently of software.

Rather than live in a world of demon-haunted elections, New Jersey is poised to take the lead in solving the electronic vote-counting problem. If their bill becomes law, it could serve as a model for the nation, with some state-specific tweaks of course. Even now the key provisions of this bill are being copied and tailored to meet other states' requirements.

With the help of public-spirited statisticians, advocates, and election officials, similar provisions can be implemented in any state where there are voter-verified paper records or ballots. Congress might be persuaded to be part of this process, perhaps to help fund it, but with the cooperation of states and counties, federal intervention may not even be necessary to institute this long overdue reform.

The NJ post-election audit bill is a victory for the people of the Garden State; their friends from around the country who helped draft it and showed up to testify in its favor; the election officials who provided valuable insights and consultation; the legislature who passed the bill; and most of all, the bill's sponsor, Senator Nia Gill.

New Jersey's Post-Election Audit Bill: Fact & Friction

2008-01-04T22:34:00.000-05:00

A number of people have asked for a copy of S507. Now that it's passed the New Jersey Senate, it can be found on the NJ Legislature's website with the latest amendments here:

http://www.njleg.state.nj.us/2006/Bills/S1000/507_R1.PDF

The Assembly has an identical version, A2730, amended to match S507 on Dec. 13, 2007:

http://www.njleg.state.nj.us/2006/Bills/A3000/2730_R1.PDF

The bill has passed the full Senate and the Assembly will vote on January 7.

Some folks who follow election integrity legislation have expressed some concerns about this bill. I would suggest that before venturing an opinion as to the adequacy (or lack thereof) of this legislation, everyone should first read the bill, with at least some understanding of its provisions.

Just to correct some misinformation that has been circulated thus far:

1. The bill does require a statistical audit to confirm outcomes of elections reported by electronic vote counts by using hand-to-eye counts of VVPRs and VVPBs. There are NO caps on the size of these audits -- even the initial ones. The size of the audit of each contest would have to be determined by the margin of victory, the number of precincts, the number of votes cast in each precinct and some scientifically reasonable assumptions that set a floor, but not a ceiling, on what the audit board may do.

2. The reason there are 2 different statistical power levels (99% vs. 90%) is that each of these applies to elections for different offices. This is clearly spelled out in the bill.

3. The definition of statistical power, as it relates to S507/A2730 audits can be found here. The language in the bill uses the 100% hand count as the "gold standard" to which the effectiveness of the audit is to be compared. All hand counts must be hand-to-eye counts (i.e., not relying on optical scanners or other software).

4. In NJ, an Election District is just another name for a precinct. It is not a Legislative or Congressional district. The Attorney General is the state's chief election official, but this role may revert back to the Secretary of State.

5. There are over 6,000 Election Districts in NJ, so, e.g., the minimum audit of 2% of these precincts per S507/A2730 would be at least 120 precincts statewide; more for close races and due to stratification of the samples by Legislative or Congressional district.

6. S507/A2730 requires all types of ballots counted electronically to be audited, including emergency, provisional, absentee, military and overseas federal ballots.

7. S507/A2730 requires all ballots cast and counted at the precincts to be subject to audit (random or targeted selection) and compared to precinct totals announced by the counties.

8. S507/A2730 requires "batching" of emergency, provisional, absentee, military and overseas federal ballots counted centrally at the county level so they can be randomly audited (or targeted for an audit) by comparing the vote totals of each audited batch, as reported by the optical scanner at the time the ballots were scanned, to hand-to-eye counts of the same ballots. Every ballot in each of these audit units selected for auditing must be hand counted. The use of batch sampling was necessary because NJ does not sort absentee ballots by precinct. The size of each batch is based on the average precinct size but the batches do not include votes already cast and counted at the precincts, as they are covered by the above audit of precincts.

9. S507/A2730 requires the establishment of an independent audit team and empowers them to oversee audits of any precincts or ballot batches in which they believe votes may have been miscounted in addition to the random audits. This team may promulgate additional regulations, subject to public comment, which may go beyond the strict requirements of the bill, and to implement those requirements. They must have verifiable expertise in statistics and auditing.

10. At minimum, S507/A2730 requires the initial sample size of the audit (which is at least 2%, but could be much larger in close races) to be doubled if a 0.1% change in the vote share of any candidate is detected in the sample. The audit board is empowered to order any additional audits they deem necessary to confirm the outcome of the elections prior to certification up to and including a full hand-to-eye recount. The above doubling in the case of a relatively small error rate in the sample is a floor -- not a ceiling.

11. Full manual recounts are still allowed under existing NJ law, but S507/A2730 allows hand-to-eye counts from the audits of precincts to be used in lieu of recounts of the same precincts, unless a court rules otherwise.

12. At minimum, S507/A2730 allows the same observers permitted to attend recounts to observe audits. Election officials may allow additional observers.

There are other good provisions in this bill, many of which are being adopted in other states to solve their e-vote-counting problems. This bill deserves our support, and once again, I'd suggest that before venturing an opinion about it, people should read it, and do so in the context of New Jersey's other election laws, procedures and voting systems.

Far be it from this writer to suggest that one size fits all. But this will be the first post-election audit law to require electoral outcomes to be confirmed independently of software. In other words, it's well worth emulating.

Iowa's Open-Source Precinct Aggregation Audit Tool

2008-01-04T00:07:00.000-05:00

Thanks to Jerry Depew from IowaVoters.org for giving me the opportunity to use this cool tool.

It's all right here: http://www.iowacaucusresults.com

The above URL is a HTML frame. There's nothing to it. But there are a bunch of JavaScripts accessed from this URL contained within the above frame: http://s3.amazonaws.com/caucuspublic/index_live.html
That one's a little harder to remember.

In English, it's open-source precinct aggregation audit software and it can be used for the whole state of Iowa! (Democratic precincts only at the moment.)

In better English, they post the precinct tallies on this website in real time, so anyone who's at the precinct can verify them. If the tallies don't match, people will know. All that's needed is a web browser.

I was able to check Jerry's precinct in Iowa, where I had people (well Jerry anyway) on the ground, to see that the results on the website were the same as at the precinct. And they were! Imagine that.

And I just signed up for access to the "post-caucus analysis" part; I'm supposed to get a password tomorrow.

Note: this is NOT an Election Management System on the Internet; it's just a reporting tool (website).

There Ought To Be A Law

Why should you care?

Because this is free precinct tally aggregation software, and there ought to be a law about having to use it for every election -- not just the Iowa Democratic Caucuses.

It may cost $1-Billion to get paper ballots in every precinct, and even with a statistical audit (which is really the only kind), we still won't know for sure who won our elections without checking precinct aggregation too. At this point, the latter can be done for free, using this Iowan software. As a taxpayer, I'm really interested in the FREE solution, since neither that nor the billion-dollar one solves the e-vote counting problem on its own. But together, they might!

Let's not let our obsession with paper ballots cloud the issue. Any kind of voting system can be rigged by messing with the precinct aggregation -- even Hand Counted Paper Ballots. There are 1,781 precincts in the State of Iowa (and about 180,000 nationwide). I know at least one of them could have been aggregated correctly. Now we just have to check the rest and see if they all add up. I'm hoping the password to the post-caucus analysis will allow that.

Post-Election Auditing: A View From The "Summit"

2007-12-14T02:40:00.007-05:00

They say it's lonely at the top but here are a couple of videos from the first-ever "Post Election Audit Summit" held near the Twin Cities back on Oct. 25-27, 2007.

So far, accounts of this event have been pretty spotty. There was some "coverage" by a blogger in California who says he wasn't there, and a bit more from folks who were there (or who got pretty close at least). This apparent lack of publicity has fueled speculation that this event was supposed to be some kind of secret.

But before you light your torches and sharpen your pitchforks, let me say that the organizers wanted this event to be as open as possible, despite the limited space that required it to be invitation-only; so they made some videos. I thought it might be a good time to break this unintentional silence before this thing starts taking on the guise of a "Skull & Bones" initiation.

I was honored to be a panelist at this event, which meant I got a whole seven minutes to explain how to audit electronic vote counts without upsetting any election officials. That turned out to be the easy part, although I did feel a little pressed for time.

As I see it, the point of this little shindig was to explain to some of the (mostly friendly) powers that be that:

It's not them we don't trust -- it's the software!
We can deal with this mistrust by not relying too heavily on the software.
We can show them how to do this, to the advantage of all stakeholders by using statistically accurate fair and efficient post-election audits, especially if they're conducted "on the ground" rather than up at the "summit."

Unfortunately, some folks who weren't on the guest list were quite upset about this, and I and some others are also concerned about that. I'm not one of the organizers of this event -- just a grunt panelist -- but I can attest to the fact that there really was limited space (for about 100 people), so it was not possible to invite everyone who could have contributed or benefited.

And let's face it: some folks in the Election Integrity "community" have burned more bridges than Madison County! So not everyone got the call.

One of those who did is my colleague and co-author Arlene Ash from Boston University. She has a PhD in Mathematics, but also a way with words. And although she likes to edit most, if not all, of my work when it comes to post-election auditing (you can even see her do this during my LIVE performance in the second of these videos!), she usually comes up with something very constructive.

So here's Arlene's talk, in which we learn, among other things, that auditing elections is a lot like tasting soup. You can follow along with her slide show as you watch the video:

And here I am trying to cram 20 minutes of an interactive auditing demonstration into about seven! I might have been able to do it had Arlene not interjected in the middle, but I think she actually helped to clarify something that I had neglected to mention in my hectic race against the clock. So it's all good. You can follow along with some of these slides and download this spreadsheet, both of which are shown and described in the video:

To read more about this, click here to download the simple 3-step audit protocol shown in the slides and video. It was included in a looseleaf binder that was given to all "Summit" attendees.

As you can see, I managed to get through all this in about nine minutes. After the talk, one well-known election official asked if we could do an "Auditing for Dummies" version of it. Reluctantly, I had to break the news to him that, actually, this was the "dummies" version! This got some laughs as I had anticipated it would, but then I said something like, "But seriously folks, it really takes 20 or 30 minutes to explain all this properly and I only had seven. I'm sure that everyone here would understand it given another 13 minutes or so." (I was thus able to meet the requirement not to upset any election officials.)

After that came another panel discussion, and then lunch. A lot of folks had soup, so we must have done a pretty good job explaining statistical sampling. If I had a copy of the dinner menu, I'd post it here. But there is a limit to even my documentary skills, so I guess some aspects of the "Summit" may have to remain undisclosed -- just not the election-related stuff.

If you want to take 20-30 minutes to think about how to confirm electoral outcomes (independently of software of course), please watch the above videos, view the slides, read the 3-step protocol and try the spreadsheet. Then you can say that you too have been to the "Summit" -- and it was really quite down-to-earth after all.

Landmark NJ Election Audit Bill Passes Budget Committee

2007-12-10T13:56:00.000-05:00

Trenton, New Jersey
Dec. 10, 2007

New Jersey's landmark Post-Election Audit Bill, S.507, passed the Senate Budget and Appropriations Committee today by a party line vote (Democrats for and Republicans against), despite massive opposition from the office of Democratic Attorney General Anne Milgram -- the state's chief election official appointed by Governor Corzine.

The AG sent no less than four attorneys to argue against the bill on the basis of what appeared to be some inflated cost estimates for hand-to-eye counts of voter-verifiable paper records and ballots, and some apparent last-minute misinterpretation of the bill's language regarding the establishment of an independent professional state election audit board to design and oversee the audits.

Ten election officials from 10 counties in the state also voiced their opposition to the bill, although some of these had actually been consulted along with the Attorney General's staff during the bill's drafting process in which several important compromises were reached. Unlike those productive discussions, which did not result in a weakening of the audit provisions, witnesses at today's hearing report that there was a fair amount of antagonism.

No one actually opposed the notion of statistical audits (as required by S.507) per se, but there were some unsupported arguments put forth such as the unpredictability of costs and exaggerated cost estimates of post-election audits.

Costs presented by some counties were as high as several dollars per hand-counted vote, but one county, Mercer, submitted a cost of only 14¢ per hand-counted vote. This latter cost is in line with those submitted by experts and advocates for the bill from around the nation based on data from several other states where election audits and manual recounts have been conducted recently.

The next step for this bill will be a vote on the floor of the full Senate. The bill's sponsor, Senator Nia Gill (D - Montclair), continues her rock solid support for this groundbreaking legislation. She said of today's events, "We have moved one step closer to establishing a process that ensures the integrity of our voting system. Our constitutional right to vote is more than just casting a vote; it is also the right for that vote to be counted. The combination of a voter-verified paper trail and a mandatory audit provides the protection needed when using electronic voting machines. The people deserve nothing less, and I look forward to the bill’s passage before the full senate."

NJ S.507 and VVPAR Bills on Voice of the Voters Radio Again 12/5

2007-12-04T14:02:00.000-05:00

Please distribute widely:

NJ State Senator Nia Gill will be on VotV Radio again tomorrow night to discuss the NJ statistical audit bill, S.507, which was reported out of committee yesterday, as written and amended by Senator Gill.

Also up for discussion will be the voter-verified paper record bill, which needs to be fixed in the Assembly to match the Senate Version, S.2949. The Assembly version of S.2949 is A.4585.

A.4585 must now be amended to keep the Attorney General from allowing paperless electronic voting with no deadline for the introduction of paper.

The current version of the audit bill, S.507, is now online on the NJ Legislature's website. It should be passed as written as a model for the nation by the end of the month! The assembly version of this bill is A.2730 and it needs to be amended to match the Senate version. The assembly bill is a flat 2% audit. (Not very effective.)

S.507 is the first legislation to require outcomes of elections, as determined by electronic vote counts, to be confirmed independently of software through the use of statistical methods, up to and including full hand-to-eye counts of voter-verifiable paper records and ballots when necessary.

I may or may not be on the show, but I'm sure there will be another guest or two to discuss this bill with the Senator. The segment will start at 8:00 PM ET.

The page for the webcast is:
http://www.voiceofthevoters.org/
There is an archive of last week's show which was excellent. It's Part 2.

For more background, see previous posts here on
Election Integrity: Fact & Friction.

Thanks for all the support you've given to this vital piece of legislation so far! But it's not over 'til it's over.

Landmark NJ Election Audit Bill Out of Committee -- AS WRITTEN!

2007-12-03T16:41:00.000-05:00

Just a quick update on S.507 and the VVPAT bill, S.2949:

1. The landmark election audit bill, S.507, passed through the Senate Gov. Committee today as written! The Attorney General's office did not submit their proposed amendments that would have gutted the bill. The vote was 4 to 1 in favor of S.507 as amended by Senator Gill!

2. The paper record deadline in S.2949 was moved to June 2008 but the additional language that would have allowed the Attorney General to delay the voter-verifiable paper record implementation indefinitely was removed. And a commitment was made to hold an oversight hearing on VVPAT implementation in February.

Thanks to everyone who showed up, wrote and called about these bills, and especially Senator Gill whose sponsorship has been rock solid!

The Senator will be asking for continued support as she shepherds the Audit Bill through the legislature. Stay tuned for more on this vitally important issue!

As Gandhi said: "First they ignore you, then they ridicule you, then they fight you, then you win."

URGENT!!! New Jersey Election Audit Bill Needs OUR Help!

2007-11-29T14:14:00.000-05:00

This is urgent folks, and should be done today but we have decided to continue over the weekend since the hearing is at 10 AM on Monday, Dec.3. Note that this a national action and NOT limited to New Jersey!

Contact Gov. Corzine:
Phone: 609-292-6000
http://www.state.nj.us/governor/govmail.html

Please pass this on to other blogs and listservs as you see fit.
It has national significance for the 2008 elections and beyond!:

Last night, on Voice of Voters Radio, http://www.voiceofthevoters.org/
New Jersey State Senator Nia Gill, the sponsor of the NJ election audit bill, S.507, which many consider to be a model for the nation, asked for calls to be made to Governor Corzine's Office.

Why?

Because the State's Chief Election Official -- the Attorney General -- who is unelected and reports to Governor Corzine, wants to gut this vital bill which most consider to be a model for the nation!

Contact info for Gov. Corzine:
Phone: 609-292-6000
http://www.state.nj.us/governor/govmail.html

It is of the utmost urgency that we do this NOW! The bill will be voted out of committee on Monday, Dec 3.

The details:

The AG wants to CAP ALL STATISTICAL POWER REQUIREMENTS at an AD HOC AUDIT PERCENTAGE of 3%, 5% or 10%, any time these numbers would result in SMALLER, LESS EFFECTIVE AUDITS of Electronic Vote Counts than the PROPER use of statistical power (sometimes known as confidence or significance), as called for in the current version of S.507.

Not only is there no scientific or mathematical basis for doing this, but such arbitrary caps on hand counts would:

- HOBBLE THE INDEPENDENT AUDITORS required by S.507;

- make it unlikely or next to IMPOSSIBLE for audits to confirm the correct winners and losers of many elections (especially closer races where larger audits are needed the most);

- not require the use of statistical audits of any kind if the AD HOC PERCENTAGES RESULT IN SMALLER samples.

Contact info for Gov. Corzine:
Phone: 609-292-6000
http://www.state.nj.us/governor/govmail.html

The bill currently requires statistical power levels to confirm the outcomes of elections of:
99% for ALL federal and statewide elections and
90% for other smaller elections such as the entire State Legislature.

This will ensure that enough votes are COUNTED BY HAND to confirm the outcome of any such audited election with a high degree of certainty, completely independent of software.

Contact info for Gov. Corzine:
Phone: 609-292-6000
http://www.state.nj.us/governor/govmail.html

Your message to Governor Corzine should be:

- Tell the Legislature to PASS S.507 As Amended by Senator Gill -- NOT by the Attorney Genral.
- Tell the Attorney General to drop her amendment to cap the audits and hobble the auditors.
- Do NOT impose arbitrary caps on the size of post-election audits.
- Confirm the outcomes of ALL Federal and State elections independently of software.

BUT THIS HAS TO BE DONE TODAY or Friday Morning, Nov. 30, because the hearing to bring this bill out of committee is scheduled for Monday, Dec. 3.

Contact info for Gov. Corzine:
Phone: 609-292-6000
http://www.state.nj.us/governor/govmail.html

Let me know if you make a call and what the governor's office has to say!

Howard Stanislevic
E-Voter Education Project
NY, NY
http://e-voter.blogspot.com/

President Urges Effective Election Audits

2007-08-13T22:28:00.000-04:00

That's right. You heard it here first folks. In a July 24th letter to Senator Dianne Feinstein (D-California), the President has come out for the competent and ethical use of statistical methods to assure the integrity of elections. (That's a real audit for those who haven't been paying close attention.)

In referring to Senator Feinstein's bill, S.1487, the letter states respectfully that effective election auditing may not necessarily be achieved by investigating a pre-specified percentage of votes or voting precincts. The President urges the Senator to replace the 2% audit requirement in her bill with “audits of sufficient statistical power to assure 99 percent discovery of a potentially outcome-reversing defect in the vote tabulation.” Imagine that -- The President!

Of course, I'm talking here about the President of the American Statistical Association (AmStat), Mary Ellen Bock, but hey, the Secretary of State has decided to require serious election audits recently too! Of course Debra Bowen is only the Secretary of the State of California. But we gotta start somewhere!

The President's letter can be found here and I would suggest sharing it with other members of Congress as well. They are on vacation now, so they should not be too hard to find back in their home states. And don't forget your State election officials! There is also a broader statement from AmStat about the many ways in which statistical methods can support the goal of highly reliable and verifiable election management. You can read that here, in the President's Corner.

As recently as a year ago, 2% audits were all the rage and with the exception of one State, North Carolina, in which the law says that the size of the sample is chosen to produce a "statistically significant result and shall be chosen after consultation with a statistician", no one in government was even considering anything other than ad hoc fixed percentages. Now, we have a bill in New Jersey, an edict in California, and a letter from the President of something!

It's almost as if some folks actually want to solve the electronic vote-counting problem after all.

Congress is from Venus; Californians are from Mars*

2007-08-05T13:27:00.000-04:00

* Note: Any references in this piece to planetary bodies or their names are intended to be gender-neutral.

I don't know if anyone else has noticed this, but as I read the documents from the top to bottom review and decertification of e-voting systems by California Secretary of State Debra Bowen and her team, I'm stunned by the contrast between these documents and what passes for election integrity legislation in the US Congress. Venus and Mars have more in common than these proposed laws and regulations do; but one thing's clear: not unlike Venus, Congress is full of hot air!

Consider that on Venus (where Congress resides), even the most basic voting system security precautions such as keeping election management systems (EMSs -- the computers that program ALL the voting machines and ballot scanners in a jurisdiction) off the Internet and the public switched telephone network, have not been included in legislation (such as H.R.811), while on Mars, Bowen and her team have mandated the use of no less than three isolated EMS computers to perform ballot definition programming, central tabulation and reformatting of memory cards -- with nothing but "air gaps" between them (and presumably without wireless transceivers that might be used to bridge those gaps).

Unlike the babbling on Venus, the Martian language is crystal clear too. There is no reason to have to ask a court, a Congressional committee, or a team of Martian lawyers and expert witnesses to interpret it months after an election has been held. This is inevitable on Venus though where the language in the Congressional legislation is barely readable -- even by native Venusians.

There's even an extensive DRE (touchscreen voting machine) ban on Mars, and all the Voter-Verified Paper Audit Records created by the banned Martian DREs have to be hand counted! A portion of the other Martian ballots will have to be hand-counted too, using a risk-based approach and an adjustable sample model with a desired confidence level (e.g., 99%) that the winner of each election has been called correctly. Statisticians and auditors on both planets have been advocating this for years!

But on Venus, Congress is saying that no more than 10% of the paper ballots have to be hand counted, no matter how close an election appears to be. Imagine that! The Venusian Congress is supposed to judge the elections of its members, yet it's the Martians who want to be confident that the winner of each election is called correctly!

Finally, on Venus, those who have proposed a compromise of limiting the purchase and deployment of DREs to the numbers necessary to meet Help Venus Vote Act (HVVA) Accessibility requirements for disabled voters, were actually accused of "ghettoizing" such voters! Yet on Mars, this is exactly what Bowen has decided to do to ensure election integrity.

Meanwhile, back on Earth, I've been thinking of changing the name of this blog to "Election Integrity: Science Fiction", but maybe there's still time for Congress to get their Act together on this issue. After all, some of their key members just happen to be from Mars, uh I mean California.

Let's not forget to thank Debra Bowen and her team for all their great work!

California May Get Audits Right -- So What Took 'em So Long?

2007-07-29T14:23:00.000-04:00

Since 1975, when the solution to the electronic vote counting (election verification) problem was first presented by NIST (then National Bureau of Standards) researcher Roy G. Saltman, some (but apparently not enough) advocates have tried in vain to convince election officials, legislators and policy-makers to implement it. California Secretary of State Debra Bowen's Post-Election Audit Standards Working Group (PEASWG) has finally taken the first step.

In their report entitled: "Evaluation of Audit Sampling Models and Options for Strengthening California’s Manual Count", published July 27, 2007, the team has apparently decided that enough is enough when it comes to unverified electoral outcomes in the State of California. Rather than suggesting a continuation of the present fixed-percentage manual tally of just 1% of the State's voter-verified paper audit records, or the sometimes ineffective and often inefficient "tiered" percentage approach which is all but a requirement for federal elections in Rep. Rush Holt's House Bill, H.R.811, the team has decided to get election audits right for a change -- and the change is long overdue.

According to their report: the tiered approach is "ad hoc"; there is no statistical justification for the particular tiers; and it is inefficient in some cases and inadequate in others. In some races, it requires far more auditing than is needed to discover any errors that might affect the outcome; in others, it does not require enough auditing. Can someone please say "Amen!" now?

It's nice to see that someone is finally getting the message that Congressman's Holt's office and many activists chose to ignore during the drafting of H.R.811. That said, I'm sure some members of the working group will be quick to point out that they support H.R.811 anyway because there is no better alternative in Congress at this time, and that H.R.811 allows States to come up with better alternative audit mechanisms. In my opinion, the States would be foolish not to.

Secretary of State Bowen herself has been quoted as saying that statisticians and not politicians should be the ones to decide how to audit elections, and she has so far been true to her word. Instead of just the "usual suspects" (computer scientists and election officials), the working group she put together to develop auditing recommendations also includes a statistician and a CPA.

According to their report, "The Working Group has reached a consensus that the most effective way to conduct post-election audits is to take a risk-based approach. The sampling model that works best for this approach is the adjustable sample model, where the size of the initial random sample depends on a number of factors, including the apparent margin of victory, the number of precincts, the number of ballots cast in each precinct, and a desired confidence level (e.g., 99%) that the winner of the election has been called correctly."

In a nutshell, the group proposes an enhancement to the work of Saltman, Stanislevic and Dopp, which has been published and cited in numerous papers since Saltman's 1975 seminal work, and most recently in Verified Voting's "Percentage-based versus SAFE Vote Tabulation Auditing: A Graphic Comparison", a draft of which was provided to the group at their first public hearing and via email and can be downloaded here : http://www.verifiedvotingfoundation.org/article.php?id=6483

The working group's version, which has yet to be developed, would address the issues of what to do in the event that discrepancies were found in an initial audit sample, and how to deal with contests that span multiple counties. Both of these issues have been addressed to some extent in the Verified Voting report and in the New Jersey election audit bill No. S.507, as amended. The bill requires the use of a relatively small, but apparently non-random .1% vote switch in the initial sample to trigger additional auditing. The bill and the VV report both state that each county should audit its pro rata share of the total precincts to be audited for a race, rounding up to the next whole precinct in each jurisdiction.

More work needs to be done to spell out in detail how this method can be applied in the specific context of California elections, but the California PEASWG are certainly on the right track, and hopefully, we will not have to wait another three decades before the solution first proposed by Saltman will actually be implemented. The only question now is: which State will be first to get election audits right?

H.R.811: Fact and Friction -- Part IV

2007-06-29T14:37:00.000-04:00

I'd like to conclude this series by stating what I think is most important to include in federal election integrity legislation, seeing how H.R.811 stacks up against that, and finally by saying whether or not I support H.R.811 anyway. (I'll try not to spoil that for readers until near the end.)

As I and other critics of H.R.811 have been told: "If you don't like it, go write your own bill!" Gee, I thought that's what we were supposed to be doing during the H.R.811 drafting process, but I guess I was wrong.

What some of us seem to have forgotten during the drafting of this bill is that experts have told us in no uncertain terms that it's beyond the state of the art to produce error-free software -- not to mention the potential for fraud and abuse of that software which is almost infinitely scalable. So electoral outcomes need to be confirmed independently of software. I don't know how we got so far off the track of achieving this relatively straightforward goal with H.R.811, but here's how to do it (and there ought to be a law about it):

1. Publicly disclose and audit all Ballot Definition Programming before each election. Follow up with rigorous Logic & Accuracy (L&A) tests.

2. Aggregate precinct totals transparently and independently after posting and witnessing them at the precincts on election night.

3. Audit within-precinct tallies (using paper and hand-to-eye counts) with a statistically accurate, fair and efficient method. (I don't care if it's ballot sampling, precinct sampling or machine sampling as long as it's statistically accurate and audits all types of electronically counted ballots and of course, the dreaded "paper records.")

4. Follow up on any discrepancies found until correct outcomes can be confirmed with very high certainty (prior to certification of course). Ninety-nine percent has been shown to be feasible for all recent federal elections without excessive administrative burden.

5. Have plenty of paper ballots on hand in case of DRE failures (or ban the DREs altogether until someone can get them right)! The 9.2% failure rate allowed by the federal voting system standards makes DREs an unacceptable technology for running elections, especially when other methods are used in other jurisdictions within the same State.

So let's see how the new version of H.R.811 reported out of the Committee on House Administration meets these simple criteria:

1. Disclose and audit all Ballot Definition Programming before each election: Well, that may have been possible in the original version of the bill, but the new section on software (non)disclosure gives ballot definitions the same legal status as vendors' source code. This change has been attributed to lobbyists for Microsoft, but I don't recall ever seeing any of their products produce a Ballot Definition File. Even if they did, this should be no more proprietary than a Word for Windows document or Excel Spreadsheet, and should be viewable with open-source software. While there are requirements for ballot definitions to be disclosed, these files are not required to be a matter of public record, as they should be. Without seeing how our ballots and our election have been defined and configured in the vendors' election management systems (EMS), there is no way to know how the machines (be they DREs or optical scanners) will interpret voters' selections -- even on hand-marked paper ballots. So H.R.811 fails on this count.

2. Aggregate precinct totals transparently and independently: This is the goal of another bill introduced by Rep. Holt in the last (109th) Congress, H.R.6414, which has still not been introduced in this session. Its provisions are not contained in H.R.811 or any other federal legislation but they are pretty good. This is not so much a failure of H.R.811, but perhaps a political miscalculation not to reintroduce this bill.

3. Audit within-precinct tallies (using paper and hand-to-eye counts) with a statistically accurate, fair and efficient method: The best that can be said about H.R.811 with respect to this is that it would allow such methods to be used by the States -- but it certainly does not mandate them. The audits mandated by the bill are neither statistically accurate, nor fair, nor efficient. In case you're wondering about the unfair part, the audits in the bill will provide much greater assurance that statewide races are correctly decided than they would for many US House races, and that makes them unfair to candidates for and members of Rep. Holt's own legislative chamber -- the US House of Representatives. I have already written extensively about this problem and suggestions to remedy it have been mostly ignored, although, as I've said here, H.R.811 does allow States to do better. The State of New Jersey, which happens to be Mr. Holt's State, may be the first to do so if S.507, the amended bill pending in their State Senate, becomes law.

4. Follow up on any discrepancies found until correct outcomes can be confirmed with a high level of certainty (prior to certification of course): It's vague, but H.R.811 does say there should be additional audits if cause is shown. However, the States get to decide what the cause and the additional audits will consist of. There's no assurance that they will get this right. Besides, material discrepancies may never be found with the audits required by the bill, especially for close races and US House races where their statistical power to detect potentially outcome-altering miscounts is low.

5. Have plenty of paper ballots on hand in case of DRE failures: This is perhaps the most disturbing aspect of H.R.811. While there was a clear provision for this to happen for the 2008 election, it has mysteriously disappeared without any public record or amendment by the Committee on House Administration to strike it. Attempts by this author and others to find out what happened have yielded no additional information, but we have been assured that it will be restored before the bill is voted on. That's nice, but what other last minute changes can we expect to see, or not see until it's too late? Of course an outright DRE ban is "off the table."

Now, in case you're wondering, I support H.R.811 despite its flaws, so long as condition #5 above is met without any other undesirable changes. We have been told there is no room for improvement, but if there is a process to restore the missing section, why not work to improve the bill as part of this process, and to counter any other unexpected negative changes? Major improvements may not be possible but clarification of the language that, according to talking points, is supposed to ban Internet connections to voting systems (but is actually still limited only to certain "voting devices"), and clarification of the role of dial-up networking (if any) in voting systems, still needs to be included. Otherwise there is little if any improvement in overall voting system security required by the bill. It bans Internet voting while leaving the core of the voting system, the EMS, vulnerable to tampering via the Internet. If this is no longer the bill's intent, it needs to be made crystal clear.

Reasons why I support H.R.811 (anyway):

1. H.R.811 now requires all audits and recounts of federal elections to be conducted with hand counted paper ballots or records. Although the records may be corrupted by DREs incorrectly recording voter intent, the mandatory warning issued to the voters may be enough to get them to notice. Unfortunately, there is currently no requirement for DREs to be taken out of service, or for a paper ballot to be issued in the event of machine failure, so voters would still in effect be forced to vote on faulty equipment. Hopefully, this will change if the missing provision requiring paper ballots to be issued in the event of machine failure is restored. The bill does not ban DREs but it is not DRE-friendly and I believe it discourages their use.

2. H.R.811 allows States to do better. The bill allows States to get audits right and it pays for them. But activists will have to drop their slavish adherence to Holt's audits, start to do a little math, listen to the real experts (professional auditors and statisticians) instead of just the "usual suspects", and take the necessary steps at the State level to make audits work. There is finally some interest in this at the national level, thanks to the efforts of members of the American Statistical Association, Common Cause, Verified Voting Foundation and others, including this author. But it's also essential to be vigilant and not allow any State to come up with a worse audit plan than H.R.811 requires. The alternative audit language in the bill is still quite vague and gives the National Institute of Standards and Technology (NIST) a bit too much authority without sufficient statutory guidance from Congress. While I expect NIST to do a good job based on their past performance in this area, Congress should be the ones to set minimum standards for their elections without loopholes, because under the Constitution, only Congress has the right to judge the elections of its members.

3. The Senate bill, S.1487, introduced by Dianne Feinstein is a lot worse than H.R.811. I know this isn't the best reason for supporting Holt's bill, but at least, in my opinion, there's nothing in Holt's bill that will make things worse, as long as advocates are vigilant and hold their State and local officials accountable for doing things right.

It's clear that Congress still isn't taking the e-vote-counting problem seriously enough, and probably never will, but there's no reason why the States can't pick up the slack. H.R.811 may motivate some of the "slacker" States to finally do that. Without such a bill, it may not be possible.

You can read the other parts of this series here, here and here.

Model for the Nation: New Jersey May Do Audits Right (And Other Needed Reforms)

2007-06-06T22:30:00.001-04:00

New Jersey Citizens’ Coalition
on HAVA Implementation

FOR IMMEDIATE RELEASE
June 7, 2007

Contact:
Renée Steinhagen, Coordinator, NJ Citizens’ Coalition on HAVA Implementation, 973-735-0523
Sandra Matsen, League of Women Voters of New Jersey,
908-236-6847
Glenn Magpantay, Asian American Legal Defense & Education Fund (AALDEF), 212-966-5932 x206

COALITION INTRODUCES GROUNDBREAKING ELECTION REFORM LEGISLATION
Bills seek to improve the administration of elections to ensure accuracy, security, inclusiveness and integrity

Newark, NJ – The New Jersey Citizens’ Coalition on the Implementation of HAVA (Help America Vote Act) is introducing six pieces of legislation that it believes are needed to ensure the integrity of New Jersey’s elections. One bill, which has a sponsor, outlines a procedure for the mandatory audit of election results (amending S.507), and is designed to serve as model legislation for election integrity post-HAVA. Its most innovative feature is that the margin of victory in a race would determine the extent of the audit. In closer races, more districts would be scrutinized, and the districts to be audited would be chosen at random. The process is transparent, nonpartisan, and completely independent of software, assuring that outcome-reversing miscounts are detected. The other five bills address inter-county provisional voting, voter assistance in Asian languages, verification procedures for voter registration information, training for poll workers, and requirements for voter registration agencies.

Over the past few years, the Coalition has been working with State and local election officials and legislators to propose and implement election reforms that build upon the requirements of federal law. By treating HAVA as a floor and not a ceiling, New Jersey is poised to become a leader in election administration. With the 2008 Presidential primaries less than a year away, the need to have reforms in place has created a sense of urgency across the state, causing the Coalition to take the lead in drafting the new legislation and forge new partnerships along the way. Its mandatory audit bill was drafted with the assistance of a Ph.D. political scientist, experienced election integrity advocates from two states that have election auditing laws, Ph.D. statisticians from the American Statistical Association, and other voting rights advocates, all of whom worked pro bono.

“We could no longer simply comment on the initiatives of others,” said Renée Steinhagen, Coordinator of the Coalition. “The time had come to change our stance and become proactive rather than reactive.”

“These bills put New Jersey voters first,” said Justin Levitt, Counsel for the Brennan Center for Justice at NYU School of Law. “They take reasonable steps – some long overdue – to protect the integrity of our elections and promote the participation of all eligible voters. We hope that the legislature will give them the speedy passage they deserve.”

“The proper administration of elections is essential to our democracy,” added Ms. Steinhagen. “All the proposed bills go a great distance toward improving the administration of elections by achieving the goals of transparency, accuracy, and voter inclusiveness.”

In addition to the mandatory audit bill, the Coalition is introducing five other pieces of legislation. “Though the mandatory audit bill is apt to garner the most attention due to NJ’s looming voter-verifiable paper record requirement on January 1, 2008, each and every one of these bills is critical for ensuring fair, nondiscriminatory and inclusive elections in our state,” said Lauren Skowronski, Executive Director, Common Cause New Jersey.

One of the bills will increase election participation among Asian American voters who have limited English proficiency. Glenn D. Magpantay, Asian American Legal Defense and Education Fund staff attorney said, “AALDEF has conducted multilingual exit polls in New Jersey for many years and has consistently found that many Asian American voters need language assistance to exercise their right to vote. Last year, during the November 2006 elections, 32% of Asian American voters we surveyed in New Jersey were limited English proficient. Ballots, voting instructions, and interpreters in Asian languages will ensure access to the vote for the Asian American community in New Jersey, which has now surpassed the 600,000 mark.”

Another bill will permit voters who move between counties to vote a provisional ballot if they do not notify election officials of their move in a timely fashion. Sandra Matsen, League of Women Voters of New Jersey, said, “With the statewide voter registration system up and running, it is time for the promise of provisional ballots to become a reality. Individuals who move between counties and fail to re-register should be able to vote in their current place of residency on a provisional ballot.”

Yet another bill imposes uniform training requirements on poll workers and another sets forth best practices for voter registration agencies. “Poll workers are the link between election administration – the laws, rules and procedures governing the election process – and the voters. We have one set of state election laws and we can no longer tolerate 21 different trainings. Statewide uniformity for training poll workers is essential for a fair and effective election system,” added Jo-Anne Chasnow, Policy Director of Project Vote’s Election Administration Program. “Furthermore, New Jersey must comply with the National Voter Registration Act of 1993 in offering voter registration opportunities in a host of state agencies. Compliance is long overdue, and one of these bills will help to ensure that this will happen.”

To date, the package of six proposed bills has been endorsed by: AARP-NJ, American Civil Liberties Union of New Jersey, Asian American Legal Defense & Education Fund, Asian American Political Coalition of NJ, Asian Pacific American Lawyers Association of NJ, Brennan Center for Justice, Coalition for Peace Action, Common Cause New Jersey, Korean American Bar Association of NJ, Korean American Voters’ Council of NY/NJ, League of Women Voters-NJ, Manavi, New Jersey ACORN, NJ Appleseed Public Interest Law Center, New Jersey Citizen Action, NJ Immigration Policy Network, Organization of Chinese Americans-NJ Chapter, Pan American Concerned Citizens Action League, Pan American Friendship Committee, Philippine American Friendship Committee, Project Vote, and South Asian American Leaders for Tomorrow.

For more information, contact Renée Steinhagen, Coordinator of the NJ Citizens’ Coalition on the Implementation of HAVA at: New Jersey Appleseed Public Interest Law Center,
973-735-0523, rsteinhagen@lawsuites.net, www.njappleseed.net.

Summary of the bills and all six bills in their entirety are available online at:
http://www.njappleseed.net/publications.php

The PDF can be downloaded here:
http://www.njappleseed.net/entity_pdfs/175.pdf

# # #

Amend H.R.811 to Allow States to Use Audits to Confirm ALL Federal Election Outcomes

2007-04-07T17:39:00.000-04:00

Update -- H.R.811 is out of committee with some language changes that recognize science and statistical accuracy with respect to alternate audit methods. While this language is somewhat vague, NIST is granted $100,000 to provide guidance to the States. We are seeking signatures for the Senate now. Anyone who was reluctant to try to improve H.R.811 may wish to consider improving the Feinstein bill, S.1487, by signing the letter below which will be changed to refer to that bill.

Below please find a formal letter and proposed language modification for H.R.811 to explicitly allow States to conduct manual audits of electronic vote counts to confirm the outcomes of ALL federal elections with high statistical confidence. Currently this is not provided for in the bill due to some ambiguous language. The new language, written by Larry Norden (Brennan Center for Justice) in consultation with Dr. Ron Rivest (of MIT), Dr. Mark Lindeman (Bard College Political Studies Program) and yours truly will allow all states to do a better job without weakening any existing provisions of the Holt bill.

We have only a few days left until the markup by the House Administration Committee so there is no time to waste.

For those who haven't been following this issue, there is mounting evidence and a consensus among supporters and critics of H.R.811 alike, that the audits proposed in the bill will not confirm all federal electoral outcomes with high statistical confidence.

This doesn't mean we shouldn't support the bill; it means we can and should do better; and it will not be more burdensome or expensive to do so.

If you care about this issue, please email me with your name, title and any affiliation you wish to include, and this letter will be delivered to the House Administration Committee and later to the Senate Rules committee and those working on Senator Feinstein's bill.

If you have an organization, please let me know and I will add your group to the list of signatories. Election officials are welcome to sign.

Also, please forward this to other interested parties before it's too late.

Regards,

Howard Stanislevic
E-Voter Education Project

Here is the letter:

We believe that Congress, the States, election officials, winning and losing candidates and the American People need to be able to confirm the outcomes of all federal elections independently of the software used.

The language of H.R. 811 that appears to allow alternative audit mechanisms must be clarified to ensure that States are enabled to confirm the outcomes of all Federal elections at a statistically high confidence level. Such standards would provide for maximum efficiency by minimizing redundant auditing in uncompetitive races, while allocating adequate resources to the races where they will be needed most.

On Page 12 of his written testimony of March 20, 2007, Lawrence Norden of The Brennan Center for Justice proposed language for H.R. 811 to improve the alternative audit section of the bill that would explicitly authorize States to establish more effective audits using statistical confidence standards and guidance provided by the National Institute of Standards and Technology to confirm the outcomes of all federal elections independently of software. (See: http://www.verifiedvotingfoundation.org/downloads/Testimony_1.pdf)

A similar measure has already been adopted in the State of North Carolina for low cost and a modest amount of time. Pamela Smith, President of Verified Voting, referred to North Carolina's audits in her testimony before the Committee on House Administration’s Elections Subcommittee on March 15, 2007. (See:
http://www.verifiedvotingfoundation.org/downloads/PamelaSmithTestimonyFinal_2007mar20.pdf)

We therefore propose that the following language suggested by Mr. Norden replace Section. 322 (b) of the Help America Vote Act, as proposed in H.R.811:

Current H.R.811 language (also in S.559 and S.804 with a different section number):

Section 322 --

“’(b) Use of Alternative Mechanism- Notwithstanding subsection (a), a
State may adopt and apply an alternative mechanism to determine the
number of voter-verified paper ballots which will be subject to the hand
counts required under this subtitle with respect to an election, so long
as the National Institute of Standards and Technology determines that
the alternative mechanism will be at least as effective in ensuring the
accuracy of the election results and as transparent as the procedure
under subsection (a).”

Proposed language:

Section 322 –

Use of Alternate Mechanism – Notwithstanding subsection (a), a State may adopt and apply an alternative mechanism to determine the number of voter-verified paper ballots that will be subject to the hand counts required under this subtitle with respect to an election for Federal office, so long as the National Institute of Standards and Technology determines that the alternative mechanism is as transparent as the procedure under subsection (a) and is consistent with the guidelines set forth in Section X.

Section X -- GUIDANCE ON BEST PRACTICES FOR ALTERNATIVE AUDIT MECHANISM. Not later than May 1, 2008, the National Institute for Standards and Technology shall establish guidance for States to establish alternative audit mechanisms. Such guidance shall be based upon scientifically reasonable assumptions for the purpose of creating an alternative audit mechanism that will

“(a) require the hand-count of at least 2% of all precincts (or other audited units) within each Congressional District, and ensure, with at least [90/95/99]% statistical confidence, for each federal election held in the State, that a 100% manual recount would not alter the outcome of the election; or

“(b) be at least as effective as section 322(a) in ensuring that for each federal election held in the state, a 100% manual recount would not alter the outcome of the election.

AUTHORIZATION OF APPROPRIATIONS – There are authorized to be appropriated to the National Institute of Standards and Technology $100,000 to establish the guidance required by this section.

We the undersigned election integrity organizations and advocates support the above changes as written:

Organizations

Citizens for Election Integrity Minnesota

Coalition for Voting Integrity, Pennsylvania

Commonweal Institute, Katherine Forrest, MD, President and Co-Founder, Menlo Park, CA

Florida Fair Elections Coalition

Georgians for Verified Voting

Las Vegas (New Mexico) Peace & Justice Center

New Jersey Appleseed Public Interest Law Center, Renee Steinhagen, Exec. Dir.

North Carolina Coalition for Verified Voting, Joyce McCloy, Founder

United Voters of New Mexico

VotersUnite.Org, John Gideon and Ellen Theisen, Co-Directors

Individuals

Thomas L. Tedeschi, Esq., Election Attorney, NY, NY

John L. McCarthy, Ph.D., Computer Scientist, Berkeley, California

Mark Lindeman, Ph.D., Bard College Political Studies Program, NY

Arlene Ash, Ph.D., Statistician, Fellow of the American Statistical Association, Boston, MA

Mary Batcher, Ph.D., Statistician, Fellow of the American Statistical Association, Silver Spring, MD

David Marker, Ph.D., Statistician, Fellow of the American Statistical Association, Columbia, MD

John S. Gardenier, Research and statistical ethicist, Vienna, VA

Vittorio Addona, PhD, Statistician, Macalester College, MN

Howard Stanislevic, Research Consultant, E-Voter Education Project, NY, NY

Jerry Lobdil, Physicist, Election Integrity Researcher, Fort Worth, Tarrant County, TX

Lisa Young, I.T. Risk Management Consultant, Tampa, FL

Paul Stokes, Electrical Engineer, Corrales, NM

Pamela de Maigret, Documentary Film Maker and Writer, Los Angeles, CA

Jerry Adams, Ph.D., Oregon

Jerry Depew, Laurens, IA, http://iowavoters.org

Donna Mummery, Election Inspector, Monroe County, NY

Henry Greenspan, Ph.D., Justice in Michigan, Ann Arbor, MI

Judy Bertelsen, M.D., Ph.D., Berkeley, CA

Teresa Hommel, wheresthepaper.org, NY, NY

H.R.811: Fact & Friction – Part III

2007-03-28T16:28:00.000-04:00

By Mark Lindeman, Ph.D. and Howard Stanislevic, Research Consultant

In Part I and Part II of this series, we pointed out that the post-election audits provided for in H.R.811 are too small to achieve a high level of statistical confidence that close races for US House seats will be correctly decided. While this observation is actually in agreement with a letter being circulated by Rep. Holt’s office signed by nine prominent experts, we also pointed out that this letter actually overstates the confidence level of Holt’s audits by not taking variations in precinct size into account. The same letter also stated:

“In truth, it may be that attempting to prevent an ‘unacceptable’ level of error on electronic voting machines through audits is too administratively burdensome.”

Put that way, frankly, audits seem pretty useless: if attempting to prevent unacceptable error is just too much of a burden, then what is the point? But on a close reading, the intended point here is subtler and more useful: while it would be ideal to confirm that every vote count is accurate within a fraction of a percentage point, it is much easier to confirm that at least every outcome is correct. Unfortunately, the letter stops short of recommending an audit protocol that actually confirms outcomes. We think that election audits should not only indicate the general accuracy of the counts, but provide a solid basis for believing that the winners really won. Getting the winner wrong is the “unacceptable” error, in most people’s minds – and we believe that it can be prevented without undue administrative burden.

In a nutshell, we believe – and will show below – that the basic problem with the H.R.811 audit is simply the misallocation of resources. By making smarter choices, the country can achieve high confidence in the outcomes of almost all federal races with about the same amount of count-auditing effort. (We say “almost” because in extremely close races, there can always be grounds for controversy about what votes should be counted. Verifying the substantial accuracy of the count isn’t the only task – but it is a very important one.)

Looking too hard in all the wrong places

First, we decided to examine all federal elections in the last three cycles (2002 through 2006) – the presidential race, elections for all 100 Senate seats, and almost 1300 contested House races (about 575,000,000 total votes cast) – to explore the consequences of H.R.811’s quirky allocation of audit resources. For each race, we estimated the size in hand-counted votes of an H.R.811 audit, and the probability that this audit would detect hypothetical outcome-altering vote miscount, using the precinct size adjustment and the other assumptions we made in Part II of this series. We chose to measure the audit size in votes, instead of the number of precincts, because precincts come in many different shapes and sizes. Even using Holt’s methodology, some precincts will require only one race on their ballots to be audited, while others may require audits of all three federal contests. The cost of doing the audit is therefore not necessarily proportional to the number of precincts audited, but is much more closely related to the number of accurately hand-counted votes.

We then figured the size of conducting what we call a 95% SecureAudit in each race: an audit large enough to achieve 95% confidence of detecting outcome-altering miscount under the same assumptions as we have used in evaluating the H.R.811 audits. The closer the race, the larger the necessary audit size. (Some folks call this idea a “probability-based audit,” as in, “based on yielding at least an ‘X’% probability of detecting outcome-altering miscount.” We don’t care much what the audits are called, as long as the idea is clear.) We did the same calculations for a 99% SecureAudit.

(The fine print: these estimates are crude because we do not use actual precinct-level data, but they do consider important variables such as the total number of precincts in each state and the average number of precincts per Congressional District based on the statewide totals. We don’t think that the estimates are biased for or against any particular audit approach. To detect widespread systemic corruption, for all these audits we assume that at least one precinct per county is randomly audited, as required under H.R.811.)

Over these elections, a 95% SecureAudit would support much greater confidence in election outcomes than H.R.811 audits, at somewhat lower cost. Across all three election cycles, H.R.811 audits would mandate manually auditing about 20.3 million votes (about 3.5% of the total vote in these elections).

Here is a table showing the number of races with outcomes that would NOT be confirmed with the H.R.811 audit for various confidence levels:

**Unconfirmed Outcomes w/H.R.811 Audit**
Confidence Level	# of Races
99%	238
95%	162
90%	135
50%	49

In 135 of the races, the estimated probability of detecting outcome-altering miscount would be less than 90%. In 49 races, the probability would be less than 50%. These low-confidence races include not only the very closest races, but some in which the winning margin is over 4%. They even include at least one race (NH-CD1) in which the winning margin is over 7%, but the number of precincts – and, therefore, the audit size – is unusually small. (We’re not saying that these races are likely to be decisively miscounted. We are saying that if one of them were decisively miscounted, an H.R.811 audit very well might miss the problem.)

By comparison, for an estimated total SecureAudit size of about 18.7 million ballots, over 7% less than in H.R.811 audits, we could have attained 95% confidence of detecting outcome-altering miscount for all of these races, as shown in the following table:

**SUMMARY OF AUDITED VOTES**
Races	HR811	95% Conf. SecureAudit
PRES '04	4,426,293	3,681,772
SENATE '02	1,835,416	2,063,447
HOUSE '02	2,521,626	2,556,846
SENATE '04	2,964,954	1,691,639
HOUSE '04	3,661,657	2,925,976
SENATE '06	2,098,375	1,725,986
HOUSE '06	2,774,209	4,103,394
TOTAL	20,282,530	18,749,060

Thus, high confidence levels can be achieved not by mandating “burdensome” audits across the board, but by shifting resources used in the H.R.811 audit from races and precincts where they aren’t needed to confirm the outcome, to those where they are.

Furthermore, we could attain 99% confidence for every audit in every race by auditing a total of about 22.7 million ballots, about 12% more than under H.R.811:

**SUMMARY OF AUDITED VOTES**
Races	HR811	99% Conf. SecureAudit
PRES '04	4,426,293	4,449,975
SENATE '02	1,835,416	2,457,639
HOUSE '02	2,521,626	3,142,558
SENATE '04	2,964,954	1,933,563
HOUSE '04	3,661,657	3,507,100
SENATE '06	2,098,375	2,146,380
HOUSE '06	2,774,209	5,100,798
TOTAL	20,282,530	22,738,013

If counting those additional votes to get to 99% confidence seems a bit excessive, consider that the above numbers do not include any of various optimizations that could be used to achieve higher confidence levels if the States were permitted to do so. We will say more about this issue below.

Why are 95% or 99% SecureAudits about the same total size as the hit-or-miss H.R.811 audits? Because, as we’ve said, the H.R.811 audit throws audit resources into races where they aren’t especially needed. Consider the 2006 California Senate race, which Dianne Feinstein won by about 24 points over Republican challenger Dick Mountjoy. Assuming for a moment that Mountjoy actually won this election, there would have to be 20% miscount favoring Feinstein in almost half of California’s 21,000+ precincts. In principle, a truly random sample of just 10 precincts would let us detect such massive miscount with about 99.8% confidence. Our SecureAudits use 58 precincts because California has 58 counties, so they achieve better than 99.9999999999999% detection probabilities. California law mandates a 1% audit (about 210 precincts) – let’s just say that would be a lot of 9s! But H.R.811 says, in effect, that even a 2% audit is too lax – we “need” a 3% audit – presumably to bolster public confidence. This mandate would hamstring California and other states by misallocating resources that should be used to confirm other races in need of stringent audits.

For instance, H.R.811 would settle for a 3% audit in small, competitive races such as in California’s 4th district. (We have no reason to think that this race was actually miscounted; our question is what sort of audit would be needed to justify confidence that it wasn’t.) The race in CA-CD4 wasn’t even all that close, by H.R.811 standards: the winning margin was 3.2 points, qualifying only for a 3% audit. However, a 3% audit in a California congressional race amounts to about 12 precincts – an audit size that would confer only about 45% confidence of detecting outcome-altering miscount. In Connecticut’s 4th district, which had a similar margin, a 3% audit would have counted only five precincts – yielding about 21% confidence. So, in the interest of public confidence, should the federal government pay to audit hundreds more precincts in an uncompetitive statewide race, or should it put some of that money into the small and close races? Which is a better use of money? Which is a better use of election officials’ time? And which is more administratively burdensome?

Notice that in 2006, the SecureAudits end up being larger overall than the H.R.811 audits. That is a good thing: it means that more races were competitive in 2006, and SecureAudits would have done a much better job of confirming the results. We don’t advocate auditing on the cheap; we advocate auditing intelligently in order to achieve high confidence across the country.

Choices, we need choices…

Another way to increase the confidence level (without increasing cost) is to randomly audit smaller units such as individual DREs or optical scanners instead of entire precincts. This approach can be especially helpful in states with fewer, larger precincts such as New Hampshire. For example, if there were two scanners per precinct and 200 precincts, randomly auditing 16 scanners instead of 8 precincts in a race with a 10% margin would achieve 99% confidence as opposed to only the 90% confidence achieved by selecting whole precincts. In each case, about 4% of the votes would be counted but the larger number of smaller audit units results in a higher confidence level. (Of course no particular ballot type should be excluded from an audit, and this is another area where H.R.811 could stand some improvement. It’s very hard to understand how the bill deals with absentee ballots!)

A purely random audit has some limitations. It doesn’t “care” whether a precinct is large or small, whether the apparent winner did surprisingly well or poorly. Doing away with random audits would be a terrible mistake: properly done, they provide an excellent check on the overall accuracy of the system. However, to detect possible concentrated miscount in particular races, it may be useful to add a “challenge” element to the audit. Losing campaigns could draw up lists of precincts whose results they deem most suspicious; immediately after the random sample is selected, campaigns could choose additional precincts to be audited. If some attacker did attempt to switch 20% of the votes in 5% of the precincts, probably any savvy analyst would choose at least one of those precincts. So the attacker may choose to steal fewer votes in each of more precincts, but that would increase the attack’s visibility to the random part of the audit. In simulations, we have found that adding even as few as 5 or 10 “challenge” precincts often does as much to improve the detection as quadrupling the random audit size! For instance, in Connecticut-CD4 in 2006, we estimate that auditing about 10% of precincts – evenly divided between random and challenge precincts – could yield the same 99% confidence as randomly auditing about 48% of precincts. Take that result with plenty of salt, but still, it’s interesting. It also appears that auditing larger precincts more heavily than smaller precincts could be substantially more efficient than treating them all equally.

There are other suggestions about how to improve upon the H.R.811 audits, and we won’t try to do justice to all of them here. Suffice it to say, we see no reason to settle for H.R.811’s 3%/5%/10% audits. Unfortunately, not only does H.R.811 not implement such suggestions, but it isn’t entirely clear whether H.R.811 would even allow individual states to implement them. The bill does contain language that allows the National Institute of Standards and Technology (NIST) to approve alternative audit methods that are “at least as effective.” Obviously we think that a SecureAudit is much more effective than the H.R.811 audit overall – but we can imagine the lawsuits over whether it is ever acceptable to audit less than 3% of precincts in any federal race, no matter how large or how uncompetitive. Let us be clear that we support vote-count audits even in uncompetitive races, and we don’t have a fixed position on what the minimum audits should be. But we certainly don’t think that large minimums in some races should be allowed to discourage efforts to confirm the outcomes of other races. Above all, we don’t think that Congress should endorse the premise that audits that often yield less than 50% confidence – sometimes less than 20% confidence! – of detecting outcome-altering miscount are good enough. Instead of crossing our fingers that activists around the country will be allowed to fix the audits state by state, wouldn’t it be smart to do better at the federal level right now?

Click here to learn how to tell the House Administration Committee to allow the states to conduct high-assurance, probability-based audits like the SecureAudits proposed above.

So 2008 is history -- ALREADY? I don't think so, and here's why:

2007-03-20T21:43:00.000-04:00

Some of the biggest proponents of voter-verified paper ballots, records and trails are sounding pretty gloomy lately about the chances of implementing them in time for the 2008 elections. Fortunately, there are other ways to improve election integrity.

On Dec. 7, 2006, just before the end of the 109th Congress, H.R.6414, Rush Holt's Vote Tabulation Audit Act of 2006 was introduced with no cosponsors and little fanfare. But unlike some of the provisions of this year's H.R.811, the "other" Holt bill seemed to make a lot of sense.

It was drafted last year using a much more collaborative process than H.R.811, and as a result, some of the major mistakes in the bill (such as allowing printouts of cast vote records from DRE memory to be used to correct central tabulator totals -- yikes!) were actually corrected before the bill was introduced. And unlike H.R.811, the provisions of the other Holt bill can be implemented in time for the 2008 elections, or even in time for a practice run in 2007!

The bill as written would rule out all errors in the vote count except within-precinct errors, and although these are the most dangerous and difficult to detect, they are also more difficult to generate than just switching vote tallies around in a Microsoft Access or other commercial off the shelf database program on a central tabulator PC. They say even a chimpanzee can hack an election that way, and even Hand Counted Paper Ballot tallies can be altered at the central tabulator, more properly referred to as the Election Management System (EMS).

So why not put the other Holt bill on the "fast track" for 2007 now? And while you're at it, get those EMSs off the Internet so they can't be hacked so easily in the first place, Mr. Holt!

There might still be a few bugs in this bill, but at least the major ones were fixed last year and it will get elections officials in every precinct in the nation used to the idea of auditing something. In fact, this bill requires a 100% audit of precinct totals.

Also, some of the better parts of H.R.811 could be included in the 2007 version of the other Holt bill. For example, how about disclosure of all ballot definition programming? And how about an audit of all ballot definition programming before and after every election? It would only take two trained auditors per county to do that -- one from each of the major parties, and of course those from other parties on the ballot should be welcome too!

For those who may not be informed, ballot definition programming error is an unequivocally documented source of vote miscount and is almost never examined or audited by anyone other than the few election insiders who are allowed access to it. It's an open invitation to deliberate malfeasance. But unlike e-voting source code, it's not even a "trade secret" because it's the definition and configuration of the election itself -- not the so-called "intellectual property" of the voting machine companies. Besides, a properly written law could force its disclosure anyway. So what are we waiting for?

I think a Holt Ballot Definition and Tabulation Audit Act of 2007 would be a huge step in the right direction that could be implemented now. And it would not require any voting equipment to be replaced next year -- not even lever machines!

"Don't let the perfect become the enemy of the good!" That's what proponents of H.R.811 keep saying. But haste makes waste, a stitch in time saves nine, and an apple a day...well, you get the drift. Besides, the reforms in this "other" Holt bill are needed regardless of whether or not H.R.811 passes, so we might as well get with the program!

For more information on how this Holt bill could improve election integrity almost immediately, please see: Section VIII: Transparent Aggregation of Voting Results Using the Internet by Juan Jover in the DNC's report, "Democracy At Risk: The 2004 Election in Ohio", as well as the links to VotersUnite's excellent documentation of ballot programming errors above. And of course, the famous Bev Harris/Howard Dean central tabulator hack (as seen on TV).

And then call Holt's office!

H.R.811: Fact & Friction -- Part II

2007-03-10T14:28:00.000-05:00

Guest blogged by Mark Lindeman, Ph.D.*

In Part I of this series, Howard Stanislevic pointed out that the audits mandated by H.R.811 (as written) would be far too small to confirm the outcomes of some close elections – while being far larger than necessary to confirm the outcomes in other races.

You might wonder why it could possibly be a good idea to allow inadequate audits in some races while mandating needlessly large audits in others. (Even if you think there is no such thing as a “too large” audit, the misallocation of resources ought to trouble you.) I’m not sure, although I think Rep. Holt may be using an informal political calculation:

Last time I introduced a bill, people complained that a 2% audit sounded too small, so let’s require a minimum 3% this time – that’s fifty percent more audit! And let’s make the audits even larger in close races – but let’s not go over 10% no matter what, because election officials will get mad if they expect endless recounts.

And so, the Holt bill mandates 3% audits (i.e., 3% of precincts or equivalents) in most federal races, 5% audits in races with a winning margin under 2%, and 10% if the winning margin is under 1%.

Let me be clear: I like Rush Holt, and I don’t fault him and his people for trying to figure out how to pass a bill. And I think the 3% to 10% audits are not only “better than nothing,” but much, much better than nothing. Still, as compromises go, this one is strange. Not only do some people feel it is too soft, and some people feel it is too tough – but the numbers say that it is too soft and too tough. That’s interesting, but not really in a good way. I think we can do better.

First, let me say a word about why H.R.811 is much, much better than nothing. Some people suspect that the 2004 and/or 2006 elections witnessed vote miscount on a massive scale nationwide, on the order of several percentage points or perhaps more. There are about 180,000 precincts or equivalent units around the country, so H.R.811 would entail audits in at least 5400 precincts (3%) in every federal election. Audits that large – if truly random and immune from tampering – should detect vote miscount if it occurred in as few as one out of a thousand precincts nationwide, with 99.6% confidence.

Even a minimum audit of just one precinct per county selected at random (also required by H.R.811) would hand count the votes in about 3000 precincts, or 1.7% nationally. This audit would still detect vote miscount that occurred in as few as one out of 657 precincts with 99% confidence. If one out of every five presidential votes in each of these corrupt precincts were miscounted by the voting system so as to favor one candidate, that would only be enough to alter the popular vote margin by about 0.1%. And, similarly, a “clean” audit of this size would verify the total vote in Senate and House races to about the same tolerance. Not too shabby.

Unfortunately, verifying the approximate accuracy of the overall totals is not the same as confirming election outcomes. As we were all reminded in 2000, it actually doesn’t matter who wins the popular vote! It is very useful to have an upper bound on the overall extent of miscount, but that in itself would not confirm the outcome of the presidential election, nor any other election. Concentrated miscount could still alter the outcome in particular races – and, possibly, determine the presidency or the balance of power in Congress. Not so great.

The Norden letter: accentuating the positive

Holt’s office, sensibly, wants to portray its proposal in the best possible light. It has directed people to a letter , signed by nine prominent experts who consulted on H.R.811’s audit provisions, which seems to express support for the bill. (I will call this the “Norden letter” only because Lawrence Norden of the Brennan Center for Justice is the first signatory.) But as Howard pointed out, the Norden letter also points to some of the problems with the plan. In fact, it understates them.

The Norden letter embraces the general concept of a “tiered” audit – basically, the idea that audits should be larger in closer elections. For instance, on page 2, it argues that in an “imagined typical” congressional district, in order to have 90% confidence of detecting a miscount that would overcome a 1% margin, it would be necessary to audit 10% of the votes. The letter continues:

Mandating a 10% audit for all races would be a high burden on many States. And in the vast majority of races, a shift of 1% of the votes would not alter the outcome of the race.

In such races (says the letter), we might be “willing to live with the risk” of not detecting the 1% counting error – while in the small fraction of races in which a 1% shift would alter the outcome, we might not be. So far, so good. Certainly I think that an audit proposal should focus on delivering high confidence in election outcomes.

The trouble is, even by the Norden letter’s calculations, H.R.811 clearly does not deliver high confidence in the outcome of every race. The letter poses the question of how likely audits under H.R.811 are to detect errors that would change the outcome of particular races. Still assuming an “imagined typical” congressional district of “400 precincts of roughly equal size,” the letter presents the following probabilities of detecting miscounts just large enough to overcome various margins, for various audit sizes. (These calculations also assume that 20% of votes per precinct could be switched from one candidate to the other, without being too blatantly obvious.) The results for the audits mandated by H.R.811 appear underlined in bold.

Norden memo’s estimated probabilities of detecting outcome-altering miscount
[Edited to correct typographical, formatting and rounding errors]

# of pre- cincts	Margin of victory	Probability in a 2% audit	Probability in a 3% audit	Probability in a 5% audit	Probability in a 10% audit
400	0.50%	10%	14%	23%	41%
400	0.75%	15%	22%	34%	57%
400	1.00%	18%	27%	40%	66%
400	1.75%	31%	43%	61%	86%
400	2.00%	34%	46%	65%	88%
400	5.00%	66%	80%	94%	99.6%

The letter rightly points out that the H.R.811 audits yield much higher probabilities than an across-the-board 2% audit would. That said, the letter carefully avoids speculating about how many people would be “willing to live with” as low as a 40% probability of detecting possible outcome-altering miscount. (If you don’t think that’s bad, keep reading.)

Note well that for margins smaller than 0.5%, the probability of detecting outcome-altering miscount will get smaller… and smaller… and smaller. Presently, some states provide for optional or mandatory recounts for races with very small winning margins, while others do not. People may disagree about how far Congress should go in mandating large audits for very close races. But let’s not kid ourselves that the issue will never arise. In 2006, the race in Connecticut’s 2^nd district was decided by under 200 votes, about 0.1%. A 10% audit in such an election might confirm that the election was pretty close, but it certainly can’t confirm who won.

Even if we set aside very close races, the confidence problem is actually worse than indicated by the Norden letter. Unfortunately, the letter’s reference to “imagined typical” districts is only too accurate. In real life, congressional districts don’t have “precincts of roughly equal size.” That wouldn’t matter if we could expect that any vote miscount would be randomly scattered across precincts regardless of their size. But what if an attacker were able to target the largest precincts? Then fewer precincts would have to be miscounted in order to reverse the election outcome, and it would be even harder for a random audit to detect the fraud.

To give an idea of how much precinct size can matter, I examined vote counts in Ohio’s 18 congressional districts in 2004, and chose to use the 5^th district as a baseline. Among Ohio’s congressional districts, the 5^th had the greatest precinct size disparities – but the disparities are even greater in (for instance) New Hampshire’s congressional districts. So, OH-05 is a bad case, but definitely not the worst. I used the OH-05 size distribution to revise the Norden letter’s assumptions. For instance, the letter assumes that in order to overcome a 1% margin of victory, votes would have to be miscounted in 2.5% of precincts. However, in OH-05, the largest 1.1% of precincts contain 2.5% of the votes. Therefore, my size-adjusted analysis assumes that one could overcome a 1% margin of precincts by miscounting 1.1% of precincts, instead of 2.5% of precincts. (With rounding, that works out to miscount in five precincts instead of ten.) I make a similar adjustment based on the margin in each race – generally, the smaller the margin, the larger the adjustment. Adjusting for size, what happens to the probabilities of detecting outcome-altering miscount? They go down, a lot.

Size-adjusted estimated probabilities of detecting outcome-altering miscount

# of pre- cincts	Margin of victory	Probability in a 2% audit	Probability in a 3% audit	Probability in a 5% audit	Probability in a 10% audit
400	0.50%	4%	6%	10%	19%
400	0.75%	8%	12%	19%	34%
400	1.00%	10%	14%	23%	41%
400	1.75%	17%	24%	37%	62%
400	2.00%	18%	27%	40%	66%
400	5.00%	46%	60%	79%	95.8%

If you think 40% sounded iffy, how do you feel about 23%, or 19%, or even less in a closer race?

Granted, the previous example is moving toward a worst case – but it isn’t there yet, especially since the Norden letter’s assumptions about number of precincts are also somewhat optimistic. Although it is true that congressional districts average about 400 precincts apiece, sixteen states average fewer than 300 precincts (or equivalent units) per House district. New Hampshire has a total of under 250 units, divided between two House districts, and these units vary wildly in size. In New Hampshire’s 1^st district, just three units (out of 114) comprised almost 22,000 House votes in 2006 – over 11% of the total. In non-technical terms, New Hampshire is where percentage-based audits go to die. One nice feature of H.R.811 is that it would allow jurisdictions to adopt stronger audits; I hope that New Hampshire would!

It's one thing to complain that someone else's proposal isn't good enough, but the real question is: can the country feasibly do better? Howard and I are convinced that it can. Since H.R.811 audits too few ballots in some races and more than enough in others, it should be possible to attain more confidence in election results at little or no additional cost. To test our reasoning, we decided to examine all federal elections in the last three cycles (2002 through 2006) -- the presidential race, elections for all 100 Senate seats, and almost 1300 House races. We looked at the consequences of H.R.811's quirky allocation of audit resources, and we explored some alternatives. We will present the results of this analysis in Part III of this series.

* Mark Lindeman teaches Political Studies at Bard College in New York.

H.R.811: Fact & Friction -- Part I

2007-03-04T22:18:00.000-05:00

Now that H.R.811, Congressman Holt's "Voter Confidence and Increased Accessibility Act of 2007", is wending its way through the House with almost 200 co-sponsors, I thought it would be a good idea to blog about some under-reported aspects of the bill and the process that spawned it.

Despite the best intentions of many in the election integrity (EI) community, there has been a relative lack of attention paid to certain crucial problems with the new Holt bill and their potential solutions. I'm speaking primarily about software-independent audits and recounts -- not just "auditability" -- a buzzword bandied about in Congressional testimony and elsewhere.

It's taken years to get members of Congress interested in doing anything about the lack of independent verification of the e-vote tallies generated by touchscreen direct recording electronic (DRE) and optical scan electronic vote-counting systems, but now that we may be on the cusp of doing something (via H.R.811, Rep. Rush Holt's new bill in the House), it doesn't seem to be nearly enough.

Holt's bill, which I had the good fortune to be involved in drafting, leaves much to be desired. And the drafting process itself, while being somewhat open to the EI community, was not as open as advertised. Many important leaders in this movement had not even seen the drafts but more importantly, it was not possible to tell who had and who hadn't because there was no coordinated effort to make this known. This made meaningful collaboration and discussion rather difficult because no one knew who else had a copy of any particular draft and who did not.

Some expert advice was ignored too. How else can one explain the loophole in the bill that allows Election Management Systems such as Diebold's GEMS, ES&S's Unity and Sequoia's WinEDS to be connected directly to the Internet?

Moreover, the final version of the bill was vetted by very few of us and by the time some major mistakes were identified in the bill, it had already been introduced in the House.

One such example is the new language that makes the so-called paper "ballot" the ballot of record only in the event that irregularities are found in an audit or recount. The problem is there is nothing anywhere in the bill to require a recount, no matter how closely a race appears to be decided!

Therefore we are left with at most, a 10% manual audit standing between a correctly tabulated federal election outcome and an incorrect, possibly fraudulent one. Such an audit, which is the only requirement in the bill for a software-independent count, may not be enough to detect an outcome-altering discrepancy, or any discrepancy at all for that matter.

While some states may conduct manual recounts, others will not, or may only conduct recounts using software-dependent methods such as counting cast vote records from DRE memories or rescanning paper ballots.

For example, in Ohio's 15th Congressional District, there was only a 10% hand count of a US House race with a 0.5% margin in 2006. Surprisingly, the Columbus Dispatch reported this as a "recount", but worse than this is the fact that nothing in H.R.811 would have required anything more effective.

So does the audit in the Holt bill guarantee the correctness of outcomes in federal elections? Don't bet on it.

In fact, the 10% "recount" of the Ohio CD-15 race seems to have been a model for H.R.811, which is extremely troubling. If the US Congress, who under the Constitution has the right to judge the elections of its members, is satisfied with only a 10% recount in such close elections, one has to wonder how seriously they are taking this responsibility and for what purpose all those voter-verifiable paper audit records generated as a result of H.R.811 will ever be used.

Although some proposed improvements were included in the bill in one form or another, the most important ones (involving audits and recounts) were never seriously considered, despite some reports to the contrary. The auditing clauses in the bill were based on what seems like an ad hoc approach, requiring more than a minimum percentage of precincts to be sampled randomly, but only in extremely close races, the outcomes of which may not necessarily be confirmed with the mandated audits.

And it gets worse.

The minimum percentage of the audit, which was 2% of precincts in Holt's bill in the previous Congress, H.R.550, has been raised unnecessarily to 3% in this bill. That's an increase of one half. But because this higher minimum applies to every federal contest, it drives up the cost of auditing noncompetitive races or those with thousands of precincts in states such as California. So election officials will have something new to complain about besides having to deal with paper records -- they will be forced to recount many votes unnecessarily. This fruitless exercise will divert resources from the more important task of counting enough votes to confirm the outcomes of closer races where larger audits will be needed.

As I've said on several occasions in correspondence about H.R.811, the minimum audit is too big; the maximum audit is too small; sometimes the audits will be just right, but this will be purely coincidental.

This author, along with others who have written election auditing protocols, has suggested a proper way to conduct audits by basing the sample sizes on the probability of detecting outcome-altering miscounts. Variations in precinct size also need to be taken into account. This was repeatedly brought to the attention of Mr. Holt's office but we were told only that other experts would be addressing the auditing issue.

Finally, shortly after the auditing language in the bill was released, a letter to Mr. Holt penned by those with whom he apparently had consulted, showed that the audits in the bill will not provide a high level of confidence that races were correctly decided in many cases. The letter also stated that attempting to prevent an unacceptable level of error on electronic voting machines through audits may be, "too administratively burdensome."

Rather than throwing in the towel, we will offer a different assessment of the auditing problem and Mr. Holt's solution in Part II of this series.

Fortunately, it's not too late to rectify the errors in H.R.811, but this depends on using the bill as a vehicle for amendments, and also trying to improve the Senate version now under construction by Senator Dianne Feinstein's office.

Here are some comments produced by Teresa Hommel, to which I contributed, with links to other useful suggestions for amending H.R.811. The bill with all its faults still has the potential to help solve the e-vote-counting problem by requiring voter-verifiable paper records, but it also has the potential to do away with software-independent recounts of those records in federal elections by sending a clear message that a 10% hand count is good enough for the US Congress.

The bill's supporters are quick to point out that it's "better than nothing", but personally, I expected more from a member of Congress such as Mr. Holt who, to his credit, has taken so much of an interest in this issue -- especially now that his party is in power.

Click here to read Part II of this series.

E-Voter Education Project Links Page

2006-06-17T23:23:00.005-04:00

Updated 6/17/2008

Commentary and Advocacy