00523-20040719 Letter To Sc Att Gen

<:

E8

~~t~=~~n~

p~m-::~F!e~:~ o~t~~~~~~~~e-;'

July 19,2004 Via Overnight Delivery The Hon. Henry McMaster Attorney General,Stateof SouthCarolina P.O. Box 11549 Columbia,S.C. 29211 and RembertDennisBuilding 1000AssemblyStreet,Room 519 Columbia,S.C.29201 RE:

Requestfrom RepresentativeJoe Neal, HA V A and E-Voting Choicesfor South Carolina

Dear Mr. McMaster: SouthCarolinais choosingnew voting technologiesto comply with the federalHelp Americavote Act (HA V A).l We understandthat, asAttorney General,you havebeen askedby RepresentativeJoeNeal to considerhow HA V A appliesto the electronicvoting technologiesknown asdirect recordingelectronic(DRE) that havebeenchosenas finalists in the bidding processin SouthCarolina. Specifically, you havebeenaskedto considerwhetherthe stateshouldrequirea voter verified paperballot (VVPB), a widely recognizedsecurityand auditability enhancement now requiredby threeother statesand subjectto pendinglegislationin severalmore, aswell asfederally. The Electronic Frontier Foundation,a leadingtechnologyrights organization,2providesthis analysisto assistyou. We concludethat, while authoritiesdisagreeaboutwhetherHA V A itself requiresa voter verified papertrail, requiring sucha trail is consistentwith South Carolina'sdutiesunderHAV A and is a wise policy choicegiven the anticipated additionalfederalregulationsfor voting machinesandthe problemsthat have already occurredwith the useof theseelectronicvoting machinesin actualelections.

1

Help America Vote Act of 2002,42 U.S.C.A. §§ 15301-15545(West Supp.2003).

2 TheElectronic FrontierFoundation ("EFF")is a nonprofitpublicinterestorganization dedicated to

protectingcivil liberties and free expressionin the digital world. Foundedin 1990,EFF hasover 13,000 paying membersandrepresentsthe interestsof Internetusersin court casesand in the broaderpolicy debatessuri-oundingthe applicationof law in the digital age. EFF publishesa comprehensivearchive of digital civil liberties information at one of the most linked to websitesin the world, . EFF representsindividuals anda small InternetServiceProviderthreatenedwith copyright liability by DRE vendorDiebold for publishingembarrassinginternale-mailsonline in a caseentitled Online Policy Group v. Diebold, currentlypendingin theNorthern District of California and hasfiled amicusbriefs in severalof the lawsuitscurrently pendingconcerningelectronicvoting machines. EFF currently has over 25 membersin SouthCarolina. 454 Shotwell Street. 0+14154369333

San Francisco, CA 94110 USA 0+14154369993

Owww.eff.org

[email protected]

The Hon. Henry McMaster July 19,2004 Page2

I.

Introduction

Sincethe hangingchadsdisasterin Florida 2000,more attentionthan everhasbeen devotedto the mechanicsof elections. Many stateswishing to avoid Florida's problems quickly replacedtheir old voting technologieswith newerones,often beforethose systemshavebeenproperly testedor evenfully developed.Vendorshaverushedsystems to marketto take advantageof this concern,plus the flood of federalfunds provided in HA V A. SouthCarolina'sbidding processhasresultedin threeDRE systemsmaking the final round. DRE systemsdiffer from otherkinds of electionsystemsbecausethey directly record a vote inside a computerizedsystemratherthan on a piece of paperor via mechanicallevers. All recordof the vote resideswithin the computer. The voter or electionofficia};attemptinga recountor audit hasno independentinformation with which to verify that the vote hasbeenrecordedcorrectly or that it hasbeentransportedwithin the machineand to the tally machinewithout changeor error.3 Sincethe adoptionand implementationof DREs,substantialerrorshave occurredduring elections,including errorsresultingin significant voter disenfranchisement and,in at leastone case~the needfor an electionto be reheld.4Additionally, computerscientists nationwidehave expressedconcernaboutthe securityand auditability of DREs, noting that the currentdesignof the machinesleavesthem vulnerableto malicious altering that would be difficult to trace. Fortunately,thereis a simple solutionthat canhelp uncover, if not prevent,suchproblems. This solution ensuresthat evenif the machine malfunctions,the votersintentionsarerecordedin a secondlocation and canbe properly countedas cast. Called a "voter verified paperballot" or VVPB, the proposalis straightforward. It requiresthat the printer alreadysuppliedon most DREsprint out the vote at the time it is castso that the voter canreview it. If the summaryis correct,it dropsinto a ballot box. Ifit is not, the vote is cancelledandthe voter can start over.5 The addition of a VVPB works on a very basicprinciple - that two recordsreflecting the votersintention arebetterthan one. Severalelectionsystemsthat provide a VVPB have beenfederally qualified6andNevadawill usea VVPB systemin the Novemberelections.

Another technologythat is allowed by HA V A is called "optical scan." This allows voters to continueto mark their preferenceson paperwhich is then scannedinto a computerfor counting. Thesesystems inherentlyprovide an audit trail and are widely recognizedasmore reliable than DREs. They also have both paperand computerizedways to assistdisabledindividuals in marking their ballots. SinceSouth Carolina hasapparentlynot chosenany of thesetechnologiesin its recentbidding, we will not discussthem here. We would be happyto provide additionalinformation on thesesystemsupon request,however. 4 Seenote aboutHinds County, Mississippi on page 10, infra. )

S

Note that the printout is not retained,or under suchsystemseventouched,by the voter.

Accessibility and Auditability in ElectronicVoting, EFF White Paper(May 17, 2004), available at http://www.eff.org/e-vote/e-vote_white-paper_20040517.php. In addition, Avante's systemwas federally

6

qualified in June.

oC

~

~i~

~~~ ';:cc""

TheHon.HenryMcMaster July 19,2004 Page3

To assistthe Attorney Generalin his considerationof whetherWPBs shouldbe required in SouthCarolina,EFF providesfirst, a summaryof the Help America Vote Act provisionsconcerningauditability of machinesandthe currentdebateaboutwhetherthat provision requiresa VVP8. Next, we will explain the upcomingcertification decisions that will be madefederally andthat could affect SouthCarolina'sability to useDREs without a VVPB in the future. Finally, we will explain why we believe that requiring that vendorsproviding systemsto SouthCarolinaprovide a VVPB is the correctpolicy decisionfor SouthCarolinaand supportedby HA V A. A. The HelD America Vote Act of 2002 The Help America Vote Act of 2002 (HA V A) modernizeselectionsby encouragingand eventuallyforcing new voting technologit:s.If stategovernmentsimplementsystems meetingHA V A guidelines- precinct-countoptical scanmachinesor DREs - by 2004, they canreceivefederalfunding. Statesmust comply with HA V A requirementsby implementingthesesystems(with someexceptions)by 2006 for all federalelections. HA V A mandatesan audit trail as a "uniform non-discriminatoryrequirement"for all systemsby 2006, or 2004 for systemsreceivingfunding. Federalguidelinesin conjunctionwith HA V A havenot beenissuedyet, but it is clearthat HA V A doesnot preempt a voter-verified recordand could evenbe interpretedto requireone. 1. StatesAre not Prohibited from ReQu!ring PaRerTrails: SomeHave Already Acted HA V A makesspecific requirements,but still leaveswide discretionto statesto run electionsandmakepolicy choices.7Requirementsbeyondthe HA VA's are explicitly allowed: The requirementsestablishedby this title areminimum requirementsand nothing in this title shall be construedto preventa Statefrom establishing electiontechnologyand administrationrequirementsthat aremore strict than the requirementsestablishedunderthis title. . .8 Most stateelectionlaw is alreadyfar beyondminimum HA V A requirements:ballot listing requirements,poll locations,audits,recounts,supervision,andmore. Local or statetesting,certification, and sealingof voting machinesare all beyondHA V A, and all are standardpracticeacrossthe country.

See42 U.S.C.A. § 15404(West Supp.2003) (planningfor complianceby states);42 U.S.C.A. § 15485 (West Supp.2003) (leaving discretionto statesto implementpolicies). g42 U.S.C.A. § 15484(West Supp2003).

1

'...come,

'

I i

The Hon. Henry McMaster July 19,2004 Page4

States are mandating voter-verified paper trails as well. Nevada, the first state to do so, will have voter-verification by November 2004. By 2006, California and Ohio will also.9 Over a dozen stateshave pending legislation. 10 In addition, several bills pending in Congress would expressly require a paper trail. I I 2. HA VA Could Be Interoreted to ReQuire Voter Verification Several commentators, including one of the Senatorswho drafted HA V A, maintain that it requires voter verification. The 2006 mandatory uniform nondiscriminatory requirements include alternate language access,disabled access,provisional voting, and several other requirements. The language in question regarding audit capacity is also a mandatory nondiscriminatory requirement: (2) Audit capacity. (A) In general. The voting system shall produce a record with an audit capacity for such system. (B) Manual audit capacity. (i) The voting system shall produce a permanent paper record with a manual audit capacity for such system. (ii) The voting system shall provide the voter with an opportunity to change the ballot or correct any error before the permanent record is produced. (iii) The paper record produced under subparagraph (A) shall be available as an official record for any recount conducted with respect to any election in which the system is used.12

KatherineQ. Seelye,DemandGrows to RequirePaper Trailsfor Electronic Votes,New York Times, The 2004 Campaign:Voting Machines,at 20 (May 23,2004). Ohio passedlegislationin May, H.B. 262 (2004). The Nevadaand California Secretariesof Stateissuedordersto similar effect.

9

lold. II SeeH.R. 2239, 108thCongo(2003), at http://frwebgate.access.gpo.gov/cgibin/getdoc.cgi?dbname=108_con~bills&docid=f:h2239ih.txt.pdf; S. 1980, 108thCongo(2003), at S. 2045, 108thCongo(2004), at http://frwebgate.access.gpo.gov/cgibin/getdoc.cgi?dbname=108_con~bills&docid=f:s2045is.txt.pdf; S. 2313, 108thCongo(2004), at S. 1986, 108thCongo(2004),at http://frwebgate.access.gpo.gov/cgibin/getdoc.cgi?dbname= 108_con~bills&docid=f:s 1986is.txt.pdf. 1242U.S.C.A. § 15481(a)(2)(West Supp2003).

The Hon. Henry McMaster July 19,2004 Page5

The most convincingargumentthat § I 548I (a)(2) requiresvoter-verificationis a fourpagepaperby former FEC chairmanDarryl R. Wold.i3 Wold relies heavily on the definition of "manual audit capacity,"arguingthat a manualaudit is meaninglesswithout voter-verifiedballots. Relying on the long history electionrecounts,he emphasizes humanoversightandjudgment in a manualrecount. He arguesthe auditing requirement is "not a bare legal requirementwithout practicalsignificance. To the contrary,a paper recordthat hasbeenreviewedandverified by the voter is an essentialelementof a transparentandopenvoting system."i4 Languageby SenatorJohnEnsignof Nevada,authorof the amendmentincorporatedas the relevantaudit section,hasaddedto the debate. His statementto the conference committeeduring the legislative debateon HA V A abouthis amendmentshowsintent to makethe audit voter-verified: [Amendment2900] is simple. It would give votersa receipt at the time their ballot is cast,and allow the voter to confirm, and,if necessary,to changethe vote beforethe ballot is cast. This receiptwould then be set asideas a permanentrecordof that election. This would instill confidence in new, paperlesstouch-screenvoting machinesandwould alsoprovide a backuprecordin the eventof a recount.is SenatorEnsign's letter to the editor in the New York Timesstateshis amendmentrequires "that votersusing electronicvoting systemsbe ableto review their ballots before casting them to confirm and,if necessary,changetheir votes. A paperballot would then be set asideas a permanentrecord."i6 Thesestatementsmake a strongcasefor the requirement, but other interpretationsarepossible,andother Senatorsand legal analystsdisagreewith SenatorEnsignand Mr. Wold. It is possibleto think aboutwhat a "manual audit capacity"meanspractically, as former CommissionerWold did, and concludeH.A.. V A requiresvoter verification. It is also possibleto view the requirementastoo vagueto containa technicalmandateor to interpretthe audit requirementasrequiring recordsat, say,poll closings. All interpretationsaremerely viewpointsuntil this statuteis litigated or the federal governmentissuesguidance. Under any interpretationofHA V A, however,South Carolina is free to implementa voter-verifiedpaperballoting systemif it chooses.

13 Darryl R. Wold, TheHAVA Requirementfora Voter VerifiedPaper Record,July 23,2003, http://www.verifiedvoting.org/resources/documents/HA V A_Requirement_for-VVP_Record.pdf. We attacha copy for your cortvenienceasExhibit A.

1. fd. at 4. IS

Letter from Sen.JohnEnsignto Sen.Mitch McConnell (May 29,2002), attachedasExhibit B.

16

John Ensign, Editorial, How to Make Sure That Your Vote Counts, N.Y. Times, Dec. 15,2003, at A26.

l

i

The Hon. Henry McMaster July 19,2004 Page6

3. Guidance Has not Been Issued vet: Future ReQuirementsMi2ht Mandate Voter Verification Not only is SouthCarolina free to implementa VVPB, the changingfederalregulations and guidelinesfor voting systemsindicatethat sucha decisionis likely to be far-sighted. Decisionsaboutnew requirementsand standardsarein processin severalareasand in eacharea,VVPB is being seriouslydiscussed.Shouldfederalstandardsbe changedto requirevoter verification, SouthCarolinacould facethe problemof, at best,having purchasedoutdatedmachinesand at worst, having to replaceits new machinesin the near future. First, federalguidelinesto implementHA V A havenot beenissuedyet. The HA V Acreatedadministrativebody, the ElectionAssistanceCommission(EAC), is developing them andmany participatingin the processareurging a papertrail. Thoughany such guidelinesareunlikely beforethe Novemberelections,EAC could easilyrecommenda papertrail by 2006 andmany of thoseconsultingwith the EAC areurging this. The first federaltechnicalstandardsaboutelectionequipmentwere issuedby the FEC in 1992. Thesevoluntary FEC standardswere last u~datedin 2001, andHA V A maintains this set asthe currentdefault technicalstandards. I SouthCarolinarequirescompliance with thesestandardsamongother restrictions.IS The successorto thesestandardsshould be issuedsoonby the EAC, working with severalotherbodiescreatedfor the purposeof drafting generalvoluntary technicalstandardsfor electionequipment.19 The EAC will also issuevoluntary guidanceaboutHA VA's nondiscriminatory requirementssoon. For 42 V.S.C. § 15481,which containsthe audit requirement,the EAC was requiredto issuevolunt~ guidanceby January2004,but late appointmentof the EAC itself delayedthis process.0 It is possiblethat either setof standards,the generaltechnicalguidelinesor the non-discriminatoryrequirementguidelines,could mandateor suggesta voter-verified papertrail. Additionally, the industry representativeorganization,the Institute of Electrical and ElectronicsEngineers(IEEE), hasits own electionequipmentstandardsalso,but they will not be updatedin time for the 2004 elections. Tllcse standardsdo not currently

17 This duty was delegatedto the FEC's Office of Election Administration. For more on the FEC standards, seePeggySims & Brian Hancock,FederalElection Commission,TheFederal Election Commission's Office of Election Administration and Its Role in the VotingSystemStandardsProgram (2002), available at

http://63.206.28.66/pdfs/OEA.pdf. 18 S.C. CodeAnn. § 7-13-1620(1976). 1942U.S.C.A. § 15362 (West Supp.2003). 2042U.S.C.A. § 15501(West Supp.2003).

I

The Hon. Henry McMaster July 19, 2004 Page7

include VVPB, but the IEEE plansto reviseits standardsheavily soonafter the 2004 elections. Currentdrafts of the revisionsinclude standardsfor VVPB. B. A Voter-Verified PaDerTrail Is a Sound Policv Choice for South Carolina As notedabove,SouthCarolinais free to implementa voter-verifiedpaperballot under federallaw, and given upcomingstandardsit might savemoney and effort in the long run by doing so. Moreover,given the manifestproblemsthat DREs without voter verification presentfor electionsecurityandreliability, the integrity of SouthCarolina's electionswill be greatly enhancedby actingnow. Put simply, while DREs may hold promisefor the future, they are simply not readyto be trustedwith our most importantdemocrC1[ic mechanism- our elections. Mechanical failures, softwarefailures,and simply wlexplainablefailureshaveplaguedelectionsusing DREs. Serioussecuritythreats100m;computerexpertsnote that relatively unsophisticatedtechnicalpersonscould alter entire electionswithout detection. These threatscanbe mitigatedwith simpletechnology:a voter-verifiedpaperballot. This ballot would createa papertrail, just like thoseSouthCarolinahaslong beencanvassingin closeor contestedelections. The addition of a VVPB fulfills a basicmaxim of both electionand generalauditing: two setsof books arebetterthan one. 1. A PaRerRecord Miti2ates Technical or Other Falline: DRE malfunctionsandpollworker errorsin using thesecomplicatedtechnologiesduring electionshavebeenwidespread,resultingin significant disenfranchisement and uncertaintyin electionresultsaroundthe country. Even without interference,these machinesoften performedunacceptably!1 Many of theseproblemsinvolve Diebold and ES&S technologies,vendorschosenin SouthCarolina's recentbidding process: A.

Diebold

Maryland (November 5, 2002)!2 Voters using Diebold DRESwatchedasthey voted for the Republican candidatefor governorandthe 'X' appearedbesidethe nameof the Democraticcandidate.The machinesusedwere Diebold DREs with no

This list of problemssubmittedto the federalcourt in Benavidezv. Shelley. Amicus CuriaeBrief of Electronic Frontier Foundation("EFF"), the California Voter Foundation,the Verified Voting Foundation, and Voters Unite!, Benavidezv. Shelley,2004U.S. Dist. LEXIS 12587(C.D. Cal. 2004). The court has subsequentlyaff1rn1edthe California Secretaryof State'sorder decertifying certainvoting systemsand requiring voter verification in the future. The full amicusbrief is availableat http://www.eff.orgiActivism/E-votingiBenavidezJ200405 18-benavidezAmicus.pdf. 22"Glitches cited at somepolls ..., " THEWASHINGTON TIMES,November6, 2002. 21

The Hon. Henry McMaster July 19,2004 Page8

paperballot so the machinescould not be audited. "I pusheda Republican ticket for governorandhis namedisappeared,"said Kevin West of Upper Marlboro. "Then the Democrat'snamegot an 'X' put in it." MuscogeeCounty, Georgia (November 4, 2003)!3 Allegations of widespreadcomplaintsby citizenswho voted "no" on a salestax propositionbut sawDiebold machinesregister"yes" caused county officials to take the machineout of serviceduring the election. RobesonCounty, North Carolina (November 2002).24 Ballot tabulatingmachinesby Diebold failed to work properly in 31 of 41 precincts. Local electionofficials saidthe problemwas the result of a softwareprogrammingerror, andballots from the individual voting machineshad to be retabulated. San Diego County, California (March 2, 2004).25 Delayedopeningof55% of the polling places,573 out of 1038polling places,due a problemswith the batteriesin Diebold voting machines. The problemscausedan unexpectedinitial login screensto appearon the machines,preventingproper encodingof electronicballot cardsat those polls. Due to the county's decisionnot to provide paperballots at the polling placesas a back up, many voterswere turnedaway and told to return later. Thereis no reliable estimateof the numberof voterswho returnedas opposedto thosewho were unableto return and vote later.

23

Mark Rice, NAACP disputessalestax results,DuBosefiles complaintin MuscogeeSuperior Court,

LEDGER-ENQUIRER, November 13,2003. 24 The AssociatedPress,Voterturnout surprisesofficials, SUNNEWS, September12,2002, at http://www .myrtlebeachonline. com/midi sunnews/news/local/ 4056664 .htm. Z5

Office of the Secretaryof State,Report on the March 2, 2004StatewidePrimary Election (April 20,

2004. http://www .ss.ca.gov/elections/ks_dre-papers/march_2_report_fmal.pdf (hereinafter"March 2 Election Report") at 17; Official Reportof the Chief Administrative Officer of SanDiego County, at http://www.signonsandiego.com/news/poltics/county/2004031 0-1315report.html.Jeff McDonald and Luis MonteagudoJr., Poll Workers,VotersCite Tied-UpHotline, Poor Training, Confusion,UNIONTRIBUNE; March 7, 2004, http://www.signonsandiego.com/news/politics/20040307-9999-ln7vote.html. A more completedescriptionof many of the problemswith DRE machinesincludedin this brief is included in the "Myth Breakers"report attachedto the Declarationof Ellen TheisenunderFederalRule of Evidence 1006, filed herewith.

The Hon. Henry McMaster July 19,2004 Page9 26

Montgomery County, Maryland (March 2, 2004).

At leastone voter using Diebold electionequipmentwas not presented with a completeballot. After castinghis vote, he realizedthat the Senate racehad not beenpresentedto him for his vote. Whenhe complained,the poll workersfirst told him, "Once you've castyour vote, you can't vote again." A poll worker askedif the voter had pressedthe magnification button. The worker saidthey knew that the error occurredwhen the magnificationbutton had beenpressed. San Diego County, California (March 2, 2004).27 Ten voteswere inexplicably lost at onepolling placeusing the Diebold TSx DRE. An electioninspectorin SanCarlossaidwhenpolls closedat 8 p.m. Tuesday,the numberof peoplewho signedthe voter log differed from the numberof ballots countedby computers."We lost 10 votes,and the Diebold technicianwho was therehad no explanation,"he said. Alameda County, California (March 2, 2004 and October, 2003):8 A report releasedon April 12, 2004,by Diebold Election Systemsshows that nearly 25% of its ballot encoders,186of763 encoders,failed on electionday becauseof hardwareor softwareproblemsor both. l.ocal newsreportedthat "no electronicvotescould be castthat morning at Anna YatesElementarySchool." Voters were turned away from the polls, losing their opportunityto vote in the primary aswell ason other issues. Failuresof votercard encodersalsooccurredon SuperTuesdayin Newark, SanLeandro,Emeryville, Oakland,and acrossSanDiego County. Diebold also admittedin its April 12, 2004,report that tabulationerrors during the October2003,recall electionwere due to softwarebugs.

26

Jeffrey F. Liss, Think You Votedin Md.? ThinkAgain, WASHINGTON POST,March 7,2004, at

http://www.washingtonpost.com/wp-dyn/articles/A38008-2004Mar6.html; Viveca Novak, The Vexationof VotingMachines,TIMEMAGAZINEat 42 (May 3, 2004). 27 Seealso Jeff McDonald and Luis MonteagudoJr., Poll Workers,VotersCite Tied-Up Hotline, Poor Training, Confusion, supra. 28

March 2 Election Reportat 18; Ian Hoffman, VotersShort ChangedAt ThePolls, OAKLANDTRIBUNE;

March 7,2004, at http://www.oaklandtribune.com/Stories/O, 1413,82-1865-2002277 ,00.htm1;Ian Hoffman, Diebold ReportsMultiple Problems:Registrar WantsReasonFor E-Voting, TRI-VALLEY HERALD,April 13, 2004,at http://www.trivalleyherald.com/Stories/0,1413,86-10671-2080327 ,OO.html.

The Hon. Henry McMaster July 19,2004 Page10

B.

~

Wake County (Raleigh), North Carolina (November 2002)}9 Electronicvoting machinesby industry leaderES&S failed to count 436 ballots castat two Wake County early voting locations. The vendor confirmedthat the machineshad defectivefirmware that causedsome votesnot to be recorded. The countyreturnedto using its optical scan machinesandhasdecidednot to purchaseDREs. Broward Counties, Florida (January 6, 2004).30 In a specialelectionfor the StateHouseDistrict 91 seat,with only one item on the ballot, ES&S electronicvoting machinesshoweda total of 134 undervotes- that is, 134 ballots in which votersdid not selecta candidate eventhoughit was a single-raceelection. The winner, Ellyn Bogdanoff, received12more votesthan the runner-up. Florida law requiresa manual recountof invalid voteswhen the winning margin is lessthan one-quarter of one percent. However,electionofficials determinedthat no recount was requiredbecausethe 134invalid voteswere caston electronicvoting machines,andthereis no recordof the voter's original votes. Dallas County, Texas (October 22, 2002).31 The Democratssaidthey receivedseveraldozencomplaintsfrom people who saidthat they selecteda Democraticcandidatebut that their vote on an ES&S DRE appearedbesidethe nameof a Republicanon the screen. Somevotescastfor Republicanswere countedfor Democrats.The article points out that the previousyear,the outcomesof 18 suburbanDallas County electionsremaineduncleardaysafter the electionbecauseof votecountingproblemson the samemachines.About 5,000of nearly 18,000 ballots castduring the early voting period were not properly assignedto candidates.

29

Seehttp://www.verifiedvoting.org/resources/documents/ElectronicsInRecentElections.pdf.

)0

JeremyMilarsky and Lisa J. Huriash,Electronic VoteRecountStumpsBroward Officials, SUN-SENTINEL,

January10,2004. )1 Ed Housewrightand Victoria Loe, Area Democratssay early votesmiscounted,Court hearing delayedas meeting planned on touch-screen problems, THE DALLAS MORNINGNEWS, October 22, 2002.

.","-

,

ij

"

I

The Hon. Henry McMaster July 19, 2004 PageII

Miami-Dade County, Florida (May 20, 2003).32 An internal review of electionresultsby a Miami-Dade county election official found that a DREsystem sold by ES&S andusedin the May 20, 2003North Miami Beachrunoff election(aswell asin earlier elections) was "unusable"for auditing,recountingor certifying an electiondue to a "seriousbug" in the software. c.

Other Vendors

Hinds County, Mississippi (November 4, 2003).33 A VS Voting machinesat somep.Jllingplacesin District 29 failed to start up. Othersoverheatedandbroke down during the election,and not enoughpaperballots were availableto allow all votersto vote. The Mississippi Senatedecidedit was impossibleto determinethe will of the voters. It declaredthe electioninvalid, and a new electionwas held on February10,2004. Bernalillo County, New Mexico (November 5, 2002).34 Insufficient memory capacityfor the Sequoiasoftwareusedto tabulatethe votes causedabout25% of the votesnot to be countedin the initial tally. Although about48,000peoplevotedon 212 DREs, the initial figures given to the commissionersindicatedthat no race,not evenfor governor, showeda total of more than about36,000votes. Apparentlythe Microsoft SQL 6.5 softwareprogramusedto report all of the voteshad a capacityof only 64 kilobytes of dataat a time. Any more than that fed to

thereportingprogramin onechunkwassimplynot tallied.

32

I

Matthew Haggman,Count Crisis? Election Officials Wam of Glitchesthat May ScrambleVoteAuditing,

MIAMI DAILV BUSINESS REVIEW, May 16, 2004, at

http://www.law.com/jsp/newswire_article.jsp?id=1084316008117; CharlesRabin, Glitch Forces Chang.?in VoteAudits, THEMIAMI HERALD,May 15,2004,at http://www.miami.com/mld/miamiherald/news/local/8671922.htm. 33 Clay Harden,Long lines, machinemalfunctionsmark today's voting, THECLARION-LEDGER, November 4, 2003, at http://www.clarionledger.com/news/0311/04/mvproblems.html; Julie Goodman,District vot~~ set; contendermay quit, Democratsayshe's "beenthrough enough" in disputedSenaterace, THE CLARION-LEDGER, January21, 2004,at http://www.clarionledger.com/news/0401/21/ma04.html. 34

Frank Zoretich, Election Results Certified After Software Blamed, ALBUQUERQUETRIBUNE,November

19,2002, at http://www.abqtrib.com/archives/news02/111902_news_vote.shtml.

(

, 1

I :

The Hon. Henry McMaster July 19,2004 Page12

Boone County, Indiana (November 2003 Municipal Election).35 Electronicvote-tabulationequipmentby vendorMicrovote reportedthat 140,000voteshadbeencastin a county of 50,000residents.Only 19,000 of thoseresidentswere registeredto vote and only 5,352voted. The tabulationmachinehad not beeninitialized and it was setto give excessive numbersto call attentionto the error. The county clerk saidit was obviousthe numberswere wrong sincethe county is small, but she wonderedif the error would havebeennoticedin a large county. Fairfax County, Virginia (November 4,2003).36 Somevotersusing AdvancedVoting SolutionsDREs watchedasthe 'X' they put besidethe nameof RepublicanSchoolBoard Member,Rita Thompson,dimmedout andmovedto her Democraticopponent. Ms. Thompsoncomplainedand onemachinewas tested. Surprisedofficials watchedasthe machinesubtractedapproximatelylout of 100votes for Ms. Thompson.

Harris County, Texas (November 4,2003).37 Hundredsof Houstonareavoterswere disenfranchisedbecauseof problemswith the Hart lntercivic electronicvoting machines. Specifically,votersat two polling placeswere told to comeback later when machinesmalfunctioned,and at onepolling placeelectionjudges had voterswrite their choicesdown on paper. Orange County, California (March 2004).38 Approximately 7,000voterswere presentedwith the wrong ballots due to problemswith pollworker understandingof complexHart Intercivic

3S

Grant Gross, Voting machine glitch shows thousands of extra votes, IDG NEWSSERVICE,November 13,

2003,at http://www.itworld.com/Tech/2987/031113votingg1itch/. 36

Cho, Fairfax Judge Orders Logs Of Voting Machines Inspected, WASHINGTONPOST,November 6, 2003,

at BO1, at http://www.washingtonpost.comlac2/wp-dyn?pagename=artic1e&node=&contentld=A62912003Nov5¬Found=true. 37 11News Staff Reports,Polling machineproblemsanger manyvoters,November4, 2003, 07:27 PM CST, at http://www.khou.cominews/10cal/houstonmetro/stories/khou0311 04_mh-po11ingprobs.la536189 .htm1 38

March 2 Election Reportat 20-21; Ray F. Herndonand StuartPfeifer, 7,000OrangeCounty Voters Were

GivenBad Ballots, Los ANGELES TIMES,March 9,2004, at m es/7 OOOorangecoun tyv 0 tersweregi venbadba110ts.

.

The Hon. Henry McMaster July 19, 2004 Page13

DREs. In 21 precinctswherethe problemwasmost acute,therewere moreballots castthanregisteredvoters. Tallies at an additional 55 polling placeswith turnoutsmore than doublethe county averageof 37% suggest at least5,500votershad their ballots tabulatedfor the wrong precincts. "OrangeCounty electionofficials havetracedthe problemto poll workers who were responsiblefor giving eachvoter a four-digit codeto enterinto the voting machines." San Bernardino County, California (March 2004).39 In SanBernardinoCounty,officials waited threehours for their new Sequoiavote countingcomputerto processthe resultsbeforeresortingto shuttingdown the computerand startingover. This certainly incompletelist showsthat significantproblemswith DREs havebeen reportedacrossthe country. This recordquestionswhetherDREs canbe trustedto function correctly evenwithout maliciousinterference. 2.

A PaDerRecord Can HelD Security Problems

Not long after statesstartedwidely adoptingDREs, computerscientistsexpressed concernaboutthesemachines. After a voting machinemanufacturermistakenlymadeits softwareavailableon the Internet,40researchersdiscovereddauntingsecurityproblems later also shownby others.41Basic securityprotectionswere missingor implementedin ways undergraduateprogrammingstudentswould know to avoid. After thesereports,the stateof Maryland commissionedan independentstudy,in which computerexpertswere ableto alter a mock electionin minuteson a budgetof $750.42Ohio also commissioneda

39

Elise Ackemlan, Election Officials Report Some E-Voting Glitches, SAN JOSEMERCURYNEWS, March 4,

2004 at .0

Voting activist Bev Harris downloadedthe Diebold sourcecodefrom an insecureFTP server.

Kohno, Stubblefield,Rubin, Wallach,Analysisof an Electronic VotingSystem,JohnsHopkins/Rice University, IEEE Symposium on Security and Privacy 2004, IEEE ComputerSocietyPress,May 20'04, at http://www .eff.org/Activism/E-voting/20030724_evote_research_report.pdf (JohnsHopkins/Ricere~:>rt, originally publishedin August, 2003); ScienceApplicationsInternationalCorporation(SAIC), Risk Assessment Report: Diebold AccuVote-TSVotingSystemand Processes(Sep.2,2003),

41

pdf; Compuware,Direct RecordingElectronic (DRE) TechnicalSecurityAssessment Report, commissionedby the Ohio Secretaryof State(November,2003) http://www.voterwest.org/ohiocompuware-study. pdf. 42 RABA Innovative Solution Cell (RiSC), TrustedAgent ReportDiebold AccuVote-TSVoting System,(Jan. 20,2004) http://www.raba.com/press/TA_Report_AccuVote.pdf.

,

I'

I

The Hon. Henry McMaster July 19,2004 Page14

report in late 2003 that concludedthat all four DREs selectedin its bidding processhad high securityrisks, including Diebold and ES&S.43 It is notoriously difficult to promisecompletesecurityin a computingsystem. It is simply impossibleto anticipateall of the attacks,especiallyon a systemof greatvalue and greatcomplexity. Certification andtestingshouldprovide no solacefor untested, poorly implementedsecurity. Currentlythe main testingprovided on election systemsis called "logic and accuracytesting," but thesetests,developedfor lever machines,have not beensufficiently updatedfor useon DREs. The othermajor sourceof testingfor electionsystemsarethe certification andqualification processes,which are also widely belieyedto be insufficient. Moreover,both Diebold and ES&S havebeencaught circumventingeventhesemost minimal of tests. Diebold sold federallyunqualified electionmachinesto severalCalifornia countiesand installeduncertified softwareon its electionmachinesin 17 counties.44ES&S surreptitiouslyinstalled anduseduncertified softwarein Indiana.45 A sufficiently malicious attackon a voting systemcould be hiddenmany ways. It could be subtleby changingonly a portion of the votes. It could verify the resultson the screen and then changethe resultsinto a different sequenceof 1s and Os,the way the vote is storedin the machine. The recountwould processthe samebad string of binary and producethe sameincorrectresults. Worst of all, the resultscould be impossibleto detect. It is impossibleto predict whethertherewill be malicious interferenceor on what scalein upcomingelections. Eventhe most experiencedcomputersecurityexpertscannot promiseprotectionon Election Day, but a paperrecordcould verify the results. 3.

A Paper R~£o!:dWill Help_Recountin2

New electiontechnologywill alter SouthCarolinaelectionsdramatically. Before making this kind of changes,SouthCarolinashouldconsiderwhat it would like "recounting" to meanunderthis new technology.46Without a paperrecord,the recountstraditionally relied on in SouthCarolinawill be largely empty gestures.Print-outsfrom the samebad codewill alwaysproducethe samebad results. It will be impossibleto take a setof recordsindicating true voter intent to a judge for review.

Ohio Secretaryof State,"Direct RecordingElectronic(DRE) TechnicalSecurityAssessmentReport,"

4:1

(November21,2003), at http://www.sos.state.oh.uslsos/hava/filesicompuware.pdf. 44

StaffReportontheInvestigation of DieboldElectionSystems, Inc.presented to Secretary of State

Shelleyand the Voting SystemsandProceduresPanel(Apr. 20, 2004),at page4, at http://www .ss.ca.gov/ electionsltouchscreen.html. 4S PressRelease, Marion County IndianaElection Board, "Marion County Clerk Doris Anne SadlerChaI'ges Election Systems& SoftwareWith BreachOf Contract,"(April 20, 2004),at http://www6.indygov.orgiclerk/election/press/04-04-20.htm. 46 S.C.CodeAnn. § 7-17-280 (1976).

'I""

The Hon. Henry McMaster July 19,2004 Page15

Imaginea disastrousscenariosimilar to thoseseenallover the country. SouthCarolina could facea recountevenworsethan Florida's in 2000- no real recountat all. HA V A rightly delegatesrecountsto the states,andif SouthCarolinavaluesrecounting,it should implementa voter-verifiedpapertrail. II.

Conclusion

HA V A createsno obstaclesto SouthCarolinaimplementinga voter-verifiedballoting system. It is possibleto interpretthe HA V A audit requirementasrequiring suchballots, and future guidancemight requirethis protection. Voter-verified papertrails are a sound policy choicefor SouthCarolinabecausethey guardagainstelectionfraud and errors. Physicalrecordsauthenticatecomputerizedballoting andbring reliability to currently untrustworthyDRE electionsystems. EFF appreciatesthis opportunityto shareour knowledgeofHA V A andthesenew technologies.Weare happyto discussthis issueor othersrelating to electronicvoting machinesfurther. Pleasedo not hesitateto contactus at (415) 436-9333x108 or [email protected] you have any questionsor concerns. Sincerely, ELECTRONIC FRONTIER FOUNDATION

~~~(:::::~:2Legal Director

Enclosures cc: RepresentativeJoeNeal

"""

'I

i.Gl,

..::l;

.I

I

THE HA VA REQUIREMENT FOR A VOTER VERIFIED PAPER RECORD Darryl R. Wold I July 23,2003 This paper explains that the Help America Vote Act of 20022requires that any voting systemused in an election for Federaloffice must produce a paper record of the vote cast by eachvoter that has been seenand verified by the voter. HA VA further requires that this voter verified paper record be available for a manual audit of the voting system,and for any recount. HA V A requires, in section 15481,subdivision (a)(2)(B), that: "(i) The voting system shall produce a permanentpaper record with a manual audit capacity tor such system. "(ii) The voting system shall provide the voter with an opportunity to changethe ballot or correct any error before the permanentpaper record is produced. "(iii) The paper record. . . shall be available as an official record for any recount. . .." Taken together, theseprovisions requiring a "paper record" that is to be used for a "manual audit" for the "voting system" make it apparentthat HA V A requires a paper record that is seen,verified, and turned in by the voter. The suggestionhas been made, however, that the requirement ofa paper record to be used for a manual audit can be satisfied by a paper record of votes that is produced for the first time after the polls have closed - that is, a printout.of what the computer has stored, and that has never been seenby the voter. This interpretation, however, that a post-closing printout of what the computer has stored would satisfy HA V A, would permit an audit or a recount to be conductedon the content of a computer and not on a contemporaneouspaper record of votes cast, and would make the requirement for a "manual audit capacity" virtually meaningless.

1

Mr. Wold servedas chairman of the Federal Election Commission in Washington, D.C., during

2000, and as a Commissioner from 1998 to 2002. He is currently an attorney in private practice in Orange County, California. His practice emphasizespolitical and election law, including campaign finance compliance issues,ballot access,and recounts. His clients include AccuPoll, Inc., Irvine, California, a manufacturerof electronic voting systems. Help America Vote Act of 2002 ("HA VA" in this paper), enactedas Public Law Number 107252, October 29,2002, 116 Statutes1704,and codified at 42 V.S.C. §15301 et seq.. All referencesin this paper are to 42 V.S.C. §15481unless otherwise noted.

2

1

'"""",,---

A paper record consisting solely of ballots printed by the computer after the closing of the polls -- and therefore never seenby the voters -- would mean that a manual audit or recount would simply amount to reviewing what was stored in the computer. The audit or recount could not manually verify that the computer had accuratelyrecordedthe voter's intent, or had accurately stored that information, or had accuratelyprinted out that information. Both an audit and a recount, therefore, would miss the key elementof the system- whether the voter's intention had been accurately recorded. At most, even a complete manual count of paper ballots printed by the computer post-. closing could only verify that the computer had accuratelytabulated various totals - that is, that the computer had "done the math." Such an audit or recount could not manually determinewhether the computer had accurately made a record of voter intent - that is, that the paper record printed post-closing actually representedthe votes intendedto be cast by the voters. An audit using a record of votes printed post-closing, of course,could not be considereda manual audit of the complete voting system- it would be a partial audit, at best, limited to the math performed by the computer. It would not be an audit of whether the voters' intent was accurately recorded by the computer- and that is the critical issue. HA V A's requirement of a "manual audit" compels the interpretation of "paper record" as meaning a record that has been seenand verified by the voter. First, it is apparentfrom the common meaning of the words "manual audit" that HA V A requires that this audit be conductedby visual examination and counting by hand, and not by machine. A common dictionary definition of "manual" applicable to this context is "worked or done by hand and not by machine." The term "audit" applicable to this context means"a methodical examination and review." (Both definition's from Webster's Ninth New Collegiate Dictionary. ) So far, therefore, we have a requirement for a methodical review by hand. The next question is: What is to be reviewed? HA V A provides that it is the "voting system" that is to be audited (§15481(a)(2)(B)), and defines the voting system as including "the total combination" of equipment that is used "(A) to define ballots; (B) to cast and count votes; (C) to report or display election results; and (D) to maintain and produce any audit trail information. . ." (§15481(b)(I)). In other words, the system to be audited is the complete processof casting and counting votes. There cannot be a "manual" audit of the casting of votes, of course,unlessthere is credible and contemporaneousevidence of the votes cast that can be reviewed by hand, as a check on the electronic portion of the system. Further, the critical issue in any voting systemis whether the systemhas accurately reflected voter intent. The question raised in counting the votes in Florida in the 2000 Presidential election, for instance,was not whether the machineshad accurately done the math it was whether the ballots that were counted actually reflected the voters' intentions. That issue

2

i

,1

I

can be determined in an audit of a voting systemonly by examining what the voter has seenand approved -- a paper record reviewed and verified by the voter. The importance of a paper record verified by the voter is also emphasizedby HA V A's use of the term "audit" rather than someother term that would merely require some lower .level of examination. Requiring an "audit capacity" for the voting system,including the accurate recording of the votes cast, clearly contemplatesa paper record as the sourcedocument - as the original record of the voters' actions - and not a secondarydocumentproduced after the fact as evidenceonly of what is in the computer systemat that time. The distinction betweenan original paper record of an act and electronic records as indirect evidence is an important one in the field of auditing, as indicated by the standardsof auditing practice promulgated by the American Institute of Certified Public Accountants in its Statementson Auditing Standards(AICPA ProfessionalStandards,1998, American Institute of Certified Public Accountants,New York). The AICPA's "StandardsofField Work" require that "Sufficient competentevidential matter is to be obtained through inspection, observation. . . and confirmations to afford a reasonablebasis for an opinion." (AU § 150.02,~ 3.) Under "Nature of Evidential Matter" the standardsrecognizethat "Corroborating evidential matter includes both written and electronic information" (AU §326.17),and that "In certain entities, some of th~ accounting data and corroboratjng evidential matters are available only in electronic form" (AU §326.18). Thus, the AICPA standardsdraw a distinction betweena sourcedocument that is an original written record, on one hand, and an electronic record, on the other. The standardsfor field work do not contemplatethat an electronic record printed out after the fact is the sameas. an original written record. In this light, the significance of the HA V A requirementthat the systemproduce "a permanentpaper record" for use in a "manual audit" or a recount js again apparent. HA V A does not provide for a manual audit of an electronic record of votes cast (or of a printout of an electronic record, which is the samething). HA V A requires a permanentpaper record of votes cast, and that can only be read as meaning a contemporaneouspaper record, that the voter has seenand verified. This distinction betweenan original paper record of a transaction or an act and electronic records as indirect evidence of that matter is also found in standardspromulgated for government auditing promulgated by the Comptroller General (Government Auditing Standards,2003 Revision, General Accounting Office, June 2003), which incorporate the AICP A standardsfor field work for financial audits (§4.01). In addition to financial audits, government audits also include performance audits. In that context, the field work standardsrequire that "Sufficient, competent,and relevant evidence is to be obtained to provide a reasonablebasis for the auditor's fmdings and conclusions" (§7.48). Guidanceprovided for concluding what constitutes "sufficient, competent,and relevant evidence" provides that "Evidence obtained through the auditors' direct physical examination, observation,computation, and inspection is more competentthan evidenceobtained indirectly" (§7.53, ~ b) and "Examination of original documentsprovides more competentevidencethan do copies" (§7.53, ~ c). Thus, these government auditing standardsalso contemplatethat an original written record is the better evidence of a fact than indirect evidenceor a copy. Applied to the context of an audit of a voting

3

system,it is apparentthat a paper ballot that the voter has seenand verified is better evidence than a printout of an electronic record that the voter who purportedly createdthe record hasn't seen. In summary,it is apparentthat the requirementof HA V A that a voting systemused in a Federal election provide a paper record for a manual audit can be satisfied only by a systemthat producesa paper record that the voter seesand verifies, and that is retained by the election official as the record of votes cast for purposesof an audit and any recount. This statutory requirementis not a bare legal requirement without practical significance. To the contrary, a paper record that has been reviewed and verified by the voter is an essential elementof a transparentand open voting system. A voter verified paper record that will be available for an audit of the systemand for any recount greatly reducesthe possibility of fraud and provides a meansof detecting and correcting unintentional error in the electronic system. Equally importantly, it assureseachvoter that the vote has been accurately cast, and that there is a paper record of that vote to serveas a check on the electronic system,and eliminates the suspicion of impropriety. An open and transparentvoting systemincreasesthe voters' confidence in the systemand the public's trust in the results. It is an essentialelement of the democratic processby which we elect the governmentof this great republic.

4

I c ~ .,

-

JOHN Ei'ISiei'I"

NEVADA' " COMMITTEES BANKING HOUSI,\jG A~ID URBAN AFF.o1JRS

~~ ~

nl- t ~~ ~ W

P

.,"-

!f ~

to",,! l.U

.0

~

~

~~

ngt". ~

\

333

~~ 30Ul.,'.."C. s IEu"S

5cl.;",!,

;)1.;.0 ~ I~ 3~" 4. 3

~.~ ~., .;~~M~AERCE.S,",,~NC~..-,"jD

,

:'"'.c~aU:l:1NG

N..S""'O,ON. wC .CS,O-2:JC" (2021224-0244

- ,i.1'" ~.. c ,,~

,-~

364:~I.;SSEl':c"..~!

":'RANSPORTAT:Cl-i

\\"\~"

"

~~~.", ~<;C-~ ~H.I \ Ir:"!"~\ -, ~I 1,-~c:~ -,,~ ",,-,,-

~,;

iO~~,;.".j\1,3';! -r-' -"8- "

\, _L. -~

-cC 5

SMALL BUSINESS Si'ECIALCOMMI:-:-~:.:),\1~G;IIG 0.;.): ,;-.1;..;'.;0-'=05.."', ;c.:.

May 29, 2002

:,,"501"

:;'!V 'N 397!J1

'7;:i3S5-~~.1

SenatorMitch McConnell Committeeon Rules andAdministration 305 SenateRussellBuilding WashingtonD.C. 20510 Dear SenatorMcConnell:

\

As you know, during SenateconsiderationofS. 565,the Equal Protectionof Voting Rights Act of2001, I introducedan amendmentwhich was passedby voice vote. This amendmentrequires electronicvoting systemsto producea permanentpaperrecord to be usedas an "official record" for recounts.As you continueto work to reconcilethe differencesbetweenthe Houseand Senate versionsof this legislation,I askthat you supportthis important amendment. This amendmentis simple. It would give voters a receiptat the time their ballot is cast,and allow the voter to confirm, and,if necessary,changethe vote before eachballot is cast. 11ris receiptwould then be set asideas a permanentrecordof that election. This would instill confidencein new, paperlesstouch-screenvoting machinesand would also provide a backup recordin the eventof a recount. To find a needfor this legislation,one needlook no further than the 2000 PresidentialElection recountin Florida. Had a reliable backupof eachvotebeenavailable for the recount,this countrywould not havehad to endurethe long controversialcourt battle that resultedbecauseof the inconclusiverecountresults. This amendmentwould ensurethat everyvoter hasthe chance to verify eachselectionbeforethe vote is cast. I haveencloseda copy of this amendmentas includedin the Senateversion of the Equal Protectionof Voting Rights Act of2001. If you would iike more iIlformation, pleasedo not hesitateto contactCarrie Schroederat 224-4430. Thankyou for your continuedhard.workon this importantlegislation. Sincerely,

~

1" C:;~ /J

JOHN ENSIGN United StatesSenaor JE/cas

'~

::

.;'~

':"'!"c.,.,..,

~l';~

:

~