New York State’s highest Court has upheld lower Court decisions to stop any further counting of ballots and declare a winner in the 7th Senate District race. The decision is unfortunate on many levels, not the least of which is that it sets legal precedent in the State for how we verify election results by auditing and recounting paper ballots. New York’s Courts have now ruled, in essence, “We do not use paper ballots to verify elections.” The Court, displaying a lever-machine mindset, believed it’s okay to trust the machine. It never was of course, but New York has never had a way to verify election results before. The Court didn’t understand why we need to compare machine reported results with a manual inspection of ballots in the audit, failing to grasp that the way we get to the real result is counting the paper, not avoiding it at all costs.
Author - Bo Lipari
In the first test case of how we verify election results using New York’s new paper ballots, the State Judiciary is in the process of setting an egregious precedent – Judges are free to nullify audits and recounts in the interests of having a quick decision. In Nassau County’s contested 7th Senate District (SD7) race, two State Courts that have heard the case to date have made very bad decisions. Ruling that even if New York’s audit laws require a further hand count of paper ballots, accepting the machine results and declaring a winner outweigh the public’s right to know who really won the election. [ See news reports here and here.]
The Johnson and Martins dispute demonstrates the typical dynamic in close political contests when paper ballots are available to inspect – regardless of party affiliation, the candidate in the lead wants to stop further ballot counting, the candidate behind wants to continue. And the Courts almost always become involved in one way or another. In the SD7 case, Johnson asks the Court to order a full manual recount, since several machines failed the initial 3% audit. Martin’s legal team on the other hand argues that “At the end of the day we must balance accuracy with finality”. The meaning here is hardly disguised – stop counting ballots, we’re more interested in winning than getting an accurate result.
The 2010 elections quietly marked a milestone in election technology history. For the first time in over a hundred years, this was the first national election in which mechanical lever machines were not used. Lever machines were at one time so ubiquitous in US culture that the phrase “pull the lever” is still the go-to phrase we use to mean “cast the vote”. Most states made the transition from levers years ago, beginning in the 1980s when the first optical scanners were employed. But in New York State, this election was the first one without levers in a very long time. Fortunately, the new technology the State chose to use is paper ballots and optical scanners, not paperless electronic voting. And those paper ballots are proving their worth already in several disputed elections around the state.
Media reports of “problems with the new voting systems” really have it the wrong way around. Perhaps it’s because New York isn’t yet used to having an actual paper record of votes, so we don’t yet understand the value of a recount. When outcomes are uncertain or disputed, recounting paper ballots is the best way there is to find out who really won an election. New York’s new ability to count the paper is not a problem, it’s the solution.
For years, computer security experts have said that casting ballots using the Internet cannot be done securely. Now, after a team from the University of Michigan successfully hacked the Washington D.C. Board of Elections and Ethics (DCBOEE) public test of Internet voting, we have a visceral demonstration of just how serious the threats really are.
Prior to rolling out the Internet voting system this November year, the DCBOEE allowed a 5 day trial period, inviting the public to test the ballot casting system and probe its security. Despite short notice given to the public, Dr. Alex Halderman and a team of students took up the challenge. What they were able to achieve in 36 hours demonstrates how vulnerable Internet voting is to a whole host of attacks, and how serious the security threats really are.
In testimony before the DC Council Hearing of The Committee on Government Operations and The Environment, Dr. Halderman detailed the extent to which his team was able to take complete control of DCBOEE’s Internet voting system:
On September 29th Senator Joseph Addabbo, chair of the Senate Elections Committee held a hearing on the recent New York State primary when new paper ballot and optical scan systems were used statewide for the first time. The hearing focused on reported problems that occurred in New York City, the largest election jurisdiction in the country with almost 4.5 million registered voters. In addition to the New York City Board of Elections, others giving testimony included the New York City Public Advocate Bill de Blasio, the Brennan Center for Justice, the League of Women Voters of the City of New York, NYPIRG, Commissioner Doug Kellner of the State Board of Elections and others. Senator Addabbo chaired the hearing, with Senators Bill Perkins, Liz Krueger, and Daniel Squadron also attending.
The hearings started out focusing on the principal witnesses, New York City Board of Elections Executive Director George Gonzalez, President Julie Dent, and other key staff. While acknowledging that problems did occur on Primary Day, the Board seemed particularly unwilling to accept any responsibility for them. Alternately blaming lack of funding, insufficient time to prepare, not enough staff, rigorous pre-election testing requirements, media focus on problems, the Police Department and the Mayor’s office, the Board’s testimony was remarkable in its failure to admit any blame for Primary Day problems. If the public had a nickel for every time the City Board accepted responsibility for problems during the hearing, we’d be flat broke.
Despite the impressions received from media reports, the September 14th primary was not the first time that New Yorkers voted on paper ballots and scanners. In the 2009 off-year election, 47 counties in upstate New York used the new systems as part of a pilot program. This trial run taught participants valuable lessons, and New York City’s decision to abstain led directly to many of the problems reported there. In general, things went smoother upstate than in the City. Problem reports broke down into a few main categories:
Privacy Issues – One of the big lessons from the 2009 pilot was that voters felt that their ballots were too often exposed to public view. Some of this was inevitable – using a lever machine, surrounded on all sides by panels and curtains, the voter is in an isolation booth. Today, the small privacy booths where voters fill out their ballots are open on the back side, and if not placed correctly at the poll site (for example with the open side facing a wall) one can feel exposed. It’s very important that Boards of Elections think about layout and lines of sight within the polling place. A second frequent privacy complaint concerned carrying the paper ballot in plain view over to the scanner. This can only happen if Boards of Elections do not provide sufficient supplies of ‘privacy sleeves’ (folders which conceal the completed ballot) and adequately train poll workers in their distribution and use. Lack of privacy sleeves is an administrative failure, and is really inexcusable.
If we can use the Internet to deliver blank ballots, then why not use it to return voted ballots? Part of the answer lies with the nature of the Internet itself. If we are to be sure that the vote cast is the same as the vote counted, we need a way to guarantee that 1) the voted ballot has not been substituted or altered in transit, and 2) the ballot received actually was sent by the voter, not someone impersonating them. But due to the way the Internet currently works, neither of these conditions can be assured. Before looking at sending ballots via Email, it’s helpful to understand how all Internet communication works, whether it be an email, website, file download, or tweet. What we now call the Internet grew out of research on connecting computers of different types and at different locations into a single network. One of the problems facing researchers was how to move electronic information reliably on pathways that are unknown and unpredictable. Two computers might be connected via a wire across the room, or across a huge network of sub-connections spanning the planet.
As noted in Part One of this series, one of the goals of the MOVE Act is to improve access to election materials such as voter registration forms and blank ballots. Examining why (and ignoring voter registration for the moment), we see that there are two parts to the process of voting from an overseas location: 1) obtaining a blank absentee ballot, and 2) returning the voted ballot. The first problem, obtaining a blank ballot, should be refined a bit – part of the problem for overseas voters is obtaining a blank ballot with sufficient time for it to be returned within state designated absentee ballot deadlines. And one way to solve this part of the problem is to send blank ballots to military and overseas voters via the Internet.
In a wired world, it was inevitable that the subject of Internet Voting become a hot topic sooner rather than later. But more than just a topic of discussion, this year eighteen states will allow overseas ballots to be returned via email in November’s elections. Yet according to security experts, voted ballots sent via Internet simply cannot be made secure, and make easy and inviting targets for attackers ranging from lone hackers to foreign governments seeking to undermine US elections.
The Pentagon rejected the idea of returning voted ballots via the internet as recently as 2004, when the SERVE (Secure Electronic Registration and Voting Experiment) project was canceled. In a memo, Deputy Defense Secretary Paul Wolfowitz said “In view of the inability to ensure legitimacy of votes that would be cast in the SERVE internet voting project, thereby bringing into doubt the integrity of the election, I hereby direct you to take immediate steps to ensure that no voters use the system to register or vote via the internet.”
For members of the military, their families, and other United States citizens living overseas, voting has always presented unique challenges. Some of these problems include reliable delivery of blank ballots to the voters, secure and timely return of voted ballots, and authenticating that ballots were completed and returned by the same person they were sent to. According to an EAC study, Voting from Abroad: A Survey Of UOCAVA Voters:
“There are no reliable data available on the number of [military and overseas] voters dispersed around the globe; some estimates hover around 4 million. Active-duty military are estimated at 1.5 million and family of military another 1.5 million.“
In 1986 and again in 2009, Congress passed laws looking to improve access to voting for military and overseas voters. And today, as communication technologies like fax and email have become available, states are moving forward with plans for electronic transmission and receipt of ballots, all too often without sufficient regard for the privacy and security issues involved.
Update I, 2/19/10 – Court documents posted, links here
In a surprise move, Dominion Voting Systems has filed an Article 78 lawsuit in New York State Supreme Court in Albany to stop the New York City Board of Elections from awarding a $70 million dollar contract for new voting machines to ES&S. If a temporary restraining order is granted, it would call into question the city’s ability to deploy new voting systems in the 2010 elections, a schedule already in jeopardy due to the City Board of Election’s long delay in selecting new systems. The competition between the two companies for the New York City contract was intense, and has raised questions of lobbyist influence, possible investigations, and even subpoenas.
In court papers, Dominion argues that the New York City Board of Elections failed to comply with New York State and New York City Procurement Laws, Rules and Regulations, and awarded the contract on the basis of illegal criteria. Further, the lawsuit argues that the New York City Board of Elections:
1) Did not conduct a lawful bidding and procurement process;
2) Did not disclose the method and criteria used in evaluating bidders;
3) Did not award the contract to the lowest responsible bidder.
The city used a point system to evaluate the two companies. In the final evaluation, ES&S received 3,417 points, while Dominion received 3,395, a difference of only 22 points. Dominion claims that the slightly higher overall score for ES&S in the city’s evaluation is due to extra points given to the ES&S DS200 scanners for an option called “Easy Startup”. This option is said to include electronic machines pre-programmed in the warehouse prior to delivery to poll sites, and the ability for poll workers to open the machines without a password (such a configuration is not only an obvious security risk, but disallowed under New York election law). The lawsuit claims that the State Board of Elections explicitly ruled that the DS200 Easy Startup option does not comply with state law, and informed the New York City Board that it would reject any contracts that included it.
It remains to be seen if what impact, if any, the suit will have on the city’s ability to deploy of new voting systems this year, a schedule already in jeopardy. And of course, if the State Supreme Court were to grant the restraining order, the reaction of Federal Judge Gary Sharpe to yet further delays in New York City’s HAVA implementation schedule will need to be reckoned with as well.
In last week’s post, I reported on the surprise decision of New York State’s Nassau County to dump it’s 450 Dominion ImageCast voting machines after an intense effort and behind the scenes deal making by ES&S. As the purchasing proposal shows, ES&S spared no expense to convince this large county to dump the small upstart competitor who had won the contract, offering perks, discounts, and a highly unusual arrangement to resell Nassau’s current ImageCasts and split the profits with the county. But the real surprise here, and surely one that will be of interest in the rumored upcoming DOJ investigation into the ES&S/Diebold merger, is that ES&S is actually paying more for Nassau’s used ImageCasts than the county paid for them new! According to the contract pricing posted by New York’s Office of General Services, Nassau paid $11,097.50 per ImageCast (assuming they received the 3.5% discount).
There was lots of reporting last week about the decision to award New York City’s huge voting machine contract to the ES&S, but the really interesting story slipped by nearly unnoticed – Nassau County, home to nearly 1 million registered voters, announced they were abandoning their recently purchased Dominion ImageCast machines for ES&S systems. This announcement came as quite a surprise because Nassau County has been using the Dominion machines for accessible voting in all polling places since 2008, as well as spent time and money training poll workers in the use of the new systems. So how is it that ES&S managed to snatch away Nassau County, in terms of voting system sales the second largest prize in New York State, from the much smaller Dominion? The answer is a cautionary tale about the power of a near monopoly to force smaller competitors out of the market.
ES&S has long been one of a handful of voting machine companies dominating the United States market. But recently, with Sequoia Voting Systems struggling financially, and the absorption of Diebold into ES&S (a move opposed by many), the company already has a near-stranglehold on providing voting systems and services to election officials. In New York State however, ES&S faces a small competitor from just across Lake Ontario in Canada, Dominion Voting. Dominion designed and built the ImageCast, a new scanner and accessible ballot marker combination system that many County Boards of Elections around the state, including Nassau, liked enough to order and use in 2008 and 2009 [Note – initially Dominion partnered with Sequoia to bring the ImageCast to New York, but Sequoia later pulled out and turned the contract over to Dominion]. Indeed, even if New York City chose the ES&S DS200 scanner, a decision finally made this week, little upstart Dominion would still have provided over half of the Empire State’s huge number of voting machines! But big companies like Wal-Mart and ES&S don’t stand around idly letting small competitors take what they see as their market share. And the way they do it is by being big enough to offer customers deals that are simply too good to pass up. And that’s exactly what ES&S did in Nassau County.
During the week of December 7, 2009, the New York State Citizen Election Modernization Advisory Committee met and reviewed certification test data results from the state’s testing program, and to vote on recommending approval of the two voting systems to the four Commissioners of the State Board of Election. The Commissioners will vote on final certification at their December 15, 2009 meeting. On December 10, 2009, the Advisory Committee approved recommendation by a vote of 10 For and 1 Against. I was the only vote opposing the recommendation. Below is the statement I made prior to the committee vote.
I believe in New York State’s certification process. It is rightfully called the best in the nation. We have required vendors to conform to a higher standard than ever before, we have conducted extensive testing with independent oversight, and as a result we have a huge trove of data upon which we can base our decision on whether these new voting systems are ready to be certified. Just the fact that we even have this substantial set of test results against a large number of very specific standards is a credit to New York’s process. Arguably, we have more data available to us about these systems than has ever been made available to a public body such this Advisory Committee before. It is because of this comprehensive approach that we can even be talking about some of the test findings, which never would have been revealed in a typical voting system certification program.
This is my opening statement for today’s meeting of New York’s Citizen Election Modernization Advisory Committee, which was created by the State Legislature to advise the Board of Elections on adoption of the new systems. Testing is now completed and results are being evaluated, with the State Board of Elections scheduled to make a determination on certifying systems on December 15th. We have come to an important moment in New York’s saga in adopting HAVA compliant voting systems. The long and rigorous testing required by New York State’s laws and regulations, arguably the best in the nation, has now been completed. Remaining is the difficult part – determining whether the systems have met the high standards required by New York State.
We have been presented with a huge amount of data to evaluate, and have only an extremely short time in which to do so. I’m pleased the Board staff has set aside this day to answer all our questions, but I am concerned that even the long, intense session we are embarking on may be insufficient to thoroughly assess the volume of data before us. Nevertheless, I look forward to today’s session and getting answers to the literally hundreds of questions I have about the test results.
Testimony on the voting machine pilot I gave at the New York State Senate Election Committee’s hearing on November 30, 2009. Full submitted testimony is posted here.
New York State was wise to do a pilot of our new voting systems. It provides an opportunity to work out the kinks in new systems and the procedures for managing them, allows us to learn from the inevitable mistakes, and to apply what we learn in the future. In my opinion, New York’s just concluded pilot was extremely valuable and revealed some important areas that need improvement. Certainly, privacy and ballot design issues often came up. However, given my limited speaking time I will submit comments on those two issues with my written testimony. Today I will discuss another pilot experience from which important lessons can be learned – the failure of some of the new voting machines and how New York can benefit from this failure.
Questions Raised in NY-23 Congressional Race
The NY-23 Congressional race had national attention, with 9 of 47 pilot counties holding elections in this race. Despite assurances from vendors, some of the new machines were inoperable on Election Day. In cases where machines failed, paper ballots were treated according to New York State emergency ballot rules, assuring that all votes were counted. Indeed, this is the great strength of New York’s new voting system – it ultimately relies on the marked paper ballot which contains a software independent record of voter intent.
Erroneous reports are circulating that a virus caused a problem in the scanners used in the NY-23 Congressional race. The reports, based on an inaccurate article published in the Gouverneur Times, are incorrect. There was no virus in the NY-23 machines. How do I know? Well, in the first place, the Dominion ImageCast scanners in question run the Linux operating system, which is nearly immune to viruses due to its inherent ability to lock out programs that lack explicit permission to run, unlike the highly vulnerable Windows operating system. Second, the State Board of Elections gave an account of the problem at their public meeting on November 10, and which I confirmed in a phone conversation with staff earlier this week. Here’s what really happened:
Let’s be clear. While no votes were lost due the ability to independently count the paper ballots, a problem did occur that affected certain machines around the state. The issue was a bug in the Dominion source code that caused the machine to hang while creating ballot images for certain vote combinations in multiple candidate elections (the ImageCast, like the other scanner used in New York, the ES&S DS200, creates digital images of each ballot which can be reviewed after the election). So if, for example, a “vote for three candidates out of five” race was voted in a certain way, the scanner would hang. This is one reason why the defect affected some, but not all machines with ballots containing this type of race, because only certain combinations of votes caused the memory problem. But here’s the thing – the problem was discovered before the election.
Last week the state Massachusetts, intending to improve military voters access to the ballot while serving overseas, approved a law which throws the integrity and security of those ballots into question by allowing their return by email. The original bill contained excellent provisions which would have helped solve one of the biggest problems facing overseas military personnel – timely receipt of absentee ballots. Currently, absentee ballots are sent by conventional mail, which can take two weeks to reach military voters. The problem is further exacerbated when soldiers are deployed in the field where they may not receive mail for long periods of time.
In its original form, the Massachusetts bill allowed military only to acquire an absentee ballot online. The downloaded blank ballot could then be printed, voted on and sent back, greatly enhancing the availability of ballots. But, in an ill conceived last minute addition, the bill was modified to also allow return of voted ballots by email. In terms of voter privacy and ballot security, email return of ballots is one of the worst choices and should never have been inserted in the bill let alone been approved. It’s not like the data wasn’t available. All lawmakers needed to do was consult a 2008 NIST research document which lays out the problems with email return of ballots in gruesome detail.
Bad for the country, bad for New York
On the face of it, it would seem that the proposed merger of Premier Voting Systems (aka Diebold) and Election Systems & Software (ES&S) shouldn’t matter much to New York State. After all, Premier pulled out of the state over a year ago, and ES&S splits the state’s voting system sales with a competitor, Dominion Voting Systems. But there’s plenty of reason for New Yorkers to be wary of further consolidation of the rapidly shrinking voting machine industry. Recall the not so distant past when ES&S, along with Sequoia Voting Systems, jointly decided that paperless voting was New York’s future and offered only touch screen DREs to the state. When New Yorkers for Verified Voting organized the first ever demonstration of a paper ballot system with an accessible Ballot Marking Device and an optical scanner at the Albany State Capitol, the makers of the AutoMark ballot marking device, with whom we had arranged the demo, were ordered by ES&S to remove the scanner because it didn’t fit their product plans. The New York Daily News reported this story in 2005:
At the Capitol recently, a lobbyist managed to shut down a demonstration of optical scanning by getting his client to pull its machine from the display. Assemblywoman Sandra Galef of Westchester called the company to object and was told that New York is “a touch-screen state.” ” I said, ‘We are?’” Galef recalled. “I’m a legislator. I don’t think I’ve voted on anything.”
When I heard that New York City had found that a photocopy of a ballot could be successfully scanned by both of the two systems being used in New York State, my first thought was that this is Sun-Rises-in-the-East news. It didn’t surprise me, and the first line of defense against attacks involving any type of fake ballot, photocopied or printed, is well designed and implemented ballot management security procedures. But this is a complex issue which bears some discussion.
Before discussing the security threat, let’s look at a technical question – should a scanner be able to detect a photocopied ballot? One of the challenges posed by modern high resolution copiers and printers is that they are capable of producing all manner of difficult to detect counterfeits. This became an extremely serious problem in the 1990’s as convincing counterfeit currency became easy to produce using the off the shelf copiers. In response, the United States has been replacing currency with new bills containing anti-counterfeiting features. So it’s no surprise that a modern copier can create a ballot that can be successfully scanned.