Luther Weeks | CTVotersCount.org

We cannot trust computers, communications, or officials with elections

Recently two serious structural flaws in computer chips have been disclosed (they were discovered several months ago). So far, the understanding is that one will be difficult to fix and the other impossible, without a new computer architecture. See: The World Grapples with Critical Computer Flaws <read>

We cannot say it enough, “Ultimately, computers cannot be protected from fraud and error.” We also cannot trust officials to operate flawlessly. Fortunately, there are solutions.

We cannot say it enough, “Ultimately, computers cannot be protected from fraud and error.”

It is useful to take steps to test and protect computers and communication systems from fraud, hacking, and error. Yet, ultimately they cannot be fully protected – that was proven many years ago by Alan Turing, a consequence of his “Halting Problem”.

We also cannot trust officials to operate flawlessly. We cannot trust them even to understand the science involved. Many believe that air-gapped computers are safe from hacking, ignoring the science and the experience of STUXNET.

Fortunately, there are solutions.

Editorial:

The solution is software independence – that a voting system results not be dependent on software – that the system, electronic and manual will detect any error in hardware or software, providing the correct election result. That means paper ballots followed by sufficient ballots security, post-election audits, and where necessary full recounts. AND;

Official independence – that a voting system does not depend on trusting officials. That there is sufficient transparency and public verifiablity that citizens can independently verity all aspects of the voting process, including independently verifying that all votes were counted and totaled accurately.

No New York, Virginia is not like Florida 2000

From the New York Times: Virginia: Voting Mess Was Never Supposed to Happen After Bush v. Gore

I don’t know where the impression was left that somehow we would not have close elections after 2000. There are some analogies here but not everything is the same.

Editorial:

Close elections happen. Each voter and each vote is critical to the result. Every error by voters, by officials, by machines, and by fraud can change the result. When it is this close it truly is a crap-shoot, even when one candidate or the other wins by a hand-full of votes. What is needed is a process that is of high-integrity, every step of the way, followed by a fair, per-established adjudication method. In our opinion that is exactly what is happening in Virginia. A far cry from 2000 and Gore v Bush.

From the New York Times: Virginia: Voting Mess Was Never Supposed to Happen After Bush v. Gore <read>

It was the electoral nightmare Virginia never wanted to experience: being host to a high-profile mess like the 2000 presidential election recount in Florida, with officials obsessing over questionable ballots as political power hangs in the balance. So 17 years ago, the state began writing a guidebook on how to handle such situations. The latest edition includes pictographs of ballots marked in unconventional ways — names crossed out, several boxes checked, “My guy” scrawled over a candidate’s name. Despite the best intentions to avoid a Florida-style snafu, that is where Virginia now finds itself, with lawyers fighting over how to interpret one questionable ballot. And at stake is possible control of the Legislature.

I don’t know where the impression was left that somehow we would not have close elections after 2000. There are some analogies here but not everything is the same.

First, there have been many close elections since 2000, with high-profile court cases. Perhaps the most noted was the Frankin-Coleman Senate contest in Minnesota. Or the close Connecticut House race which went from tie, to single vote win, to tie, ending in a re-vote.
In Florida 2000, there was no recount. That was stopped by the Secretary of the State and the Supreme Court. In Virginia we had a very close race and then a recount that came down to one ballot. It was decided by a legal process and now it is before a court.
The hanging chads with thousands of ballots where votes were in question and also the integrity of preservation of the chads as they were handled multiple times.
This is one ballot that needs to be interpreted in the face of unintended ambiguity/contradiction in the detailed description of how to count voter intent on ambiguous ballots.

Editorial:

Yes, Virginia your vote does count [if you do vote]

The Virginia House election does remind us. From the Hill: Tied Virginia election proves every vote actually does count

Just as one more vote would have made a winner. One vote less on either side would have lost. So, those who voted can all take credit for the result.
This was bigger than it seems. The final adjudication will determine which party controls the Virginia House.
There is no Santa, democracy is in our hands.

The Virginia House election does remind us. From the Hill: Tied Virginia election proves every vote actually does count <read>

Just ask two people today, Shelly Simonds and David Yancey. Both were candidates for delegate to the Virginia state legislature from the 94th House District. Neither has been declared the winner.

The election took place in November. The reason that there is no declared winner or loser is that they both got the exact same number of votes…

This election is not an aberration or once-in-a-century occurrence.

In 1991, in the same state of Virginia, Democrat Jim Scott won his seat in the Virginia House of Delegates by one vote. He beat his Republican opponent, David Sanders, by 6,493 votes to 6,492 votes. That’s 12,985 total votes cast.

The article goes on to list several other instances. We have some recent ones in Connecticut:

In 2012 we had a two way tie in 2012 for the CT House. Then a recanvass resulting in a one vote winner. Another recanvass resulting in a tie and a revote.
This year in Stamford a one vote winner for RTM. Then a recanvass resulting in a tie. Followed by a revote.

Three things to add:

Just as one more vote would have made a winner. One vote less on either side would have lost. So, those who voted can all take credit for the result.
This was bigger than it seems. The final adjudication will determine which party controls the Virginia House.
There is no Santa, democracy is in our hands.

Lots of Smoke in Broward County, after ballots destroyed

From Alternet via TruthOut: Was the Heated 2016 Democratic Primary Rigged for Debbie Wasserman Schultz?

“I see what I would call a high likelihood of massive incompetence. Either that or there is fraud. I don’t think you should see numbers this big in this many precincts.”

“This is really weird.” He continued that they ought to be reconciling the number of voters with ballots and if they’re not doing it, “they’re grossly negligent.” Jones served on the Election Assistance Commission’s Technical Guidelines Development Committee for four years, but said “I’ve never seen a county that looks like this.”

From Alternet via TruthOut: Was the Heated 2016 Democratic Primary Rigged for Debbie Wasserman Schultz? <read>

In August 2016, Florida Congresswoman Debbie Wasserman Schultz faced off against progressive maverick and Bernie Sanders supporter Tim Canova — her first-ever primary challenger — after six terms in Congress…

Now new evidence of original ballots being destroyed and cast ballots not matching voter lists calls into question the results of that election…

According to a transcript of the November hearing, the attorney for the Supervisor’s office Burnadette Norris-Weeks claimed the ballots were destroyed, “Because they can’t just store hundreds and hundreds of thousands of boxes.

It’s possible that lack of storage space is not the only reason Broward County officials wanted to destroy the ballots. Months of investigating the Supervisor’s office and analyzing election data reveal that in the vast majority of precincts in the race, the number of cast ballots does not match the number of voters who voted…

Canova is not the first one to take the Broward County Supervisor of Elections’ office to court. He is in line behind the Republican Party that sued in November of 2016 over absentee ballots being opened in secret, and a not-for-profit that sued in October last year when Broward County left a medical marijuana amendment off some ballots.

Problems with the county’s elections go further back than that. In 2006, according to documents provided by the Florida Fair Elections Coalition, the Broward County Supervisor of Elections’ office admitted to a “loss of data” that included over 100,000 ballot images.

W do not buy the explanations/excuses. Two respected computer scientists characterize it succinctly:

Duncan Buell, a professor of computer science at the University of South Carolina, said, “I see what I would call a high likelihood of massive incompetence. Either that or there is fraud. I don’t think you should see numbers this big in this many precincts.” Buell has examined election records extensively in South Carolina.

Douglas Jones, a computer science professor at the University of Iowa sputtered in disbelief at the data. “This is really weird.” He continued that they ought to be reconciling the number of voters with ballots and if they’re not doing it, “they’re grossly negligent.” Jones served on the Election Assistance Commission’s Technical Guidelines Development Committee for four years, but said “I’ve never seen a county that looks like this.”

This is reminiscent of 2004 across Ohio, there officials kept the ballots for the required time, yet worked to run out the clock on Freedom Of Information Requests. This helped Richard Hayes Phillips expose many issues there in his book Witness to a Crime

We do applaud Florida and Ohio for their unquestioned stand that ballots are FOIable public records.

Fake News from from “respected sources”, travels fast, with and without correction

Many respect and trust mainstream sources like the Washington Post and CNN. Yet, every source makes mistakes and has biases. Unfortunately, usually accurate sources make mistakes and worse, do an inadequate job of correcting them. Another reminder from Glen Greenwald at the Intercept: The U.S. Media Suffered Its Most Humiliating Debacle in Ages: Now Refuses All Transparency Over What Happened

Friday was one of the most embarrassing days for the U.S. media in quite a long time. The humiliation orgy was kicked off by CNN, with MSNBC and CBS close behind, with countless pundits, commentators and operatives joining the party throughout the day. By the end of the day, it was clear that several of the nation’s largest and most influential news outlets had spread an explosive but completely false news story to millions of people, while refusing to provide any explanation of how it happened.

The spectacle began on Friday morning at 11 a.m. EST, when the Most Trusted Name in News™ spent 12 straight minutes on air flamboyantly hyping an exclusive bombshell report that seemed to prove that WikiLeaks, last September, had secretly offered the Trump campaign, even Donald Trump himself, special access to the DNC emails before they were published on the internet. As CNN sees the world, this would prove collusion between the Trump family and WikiLeaks and, more importantly, between Trump and Russia, since the U.S. intelligence community regards WikiLeaks as an “arm of Russian intelligence,” and therefore, so does the U.S. media…

It’s impossible to convey with words what a spectacularly devastating scoop CNN believed it had, so it’s necessary to watch it for yourself to see the tone of excitement, breathlessness and gravity the network conveyed as they clearly believed they were delivering a near-fatal blow on the Trump/Russia collusion story..

Incredibly, to this very moment — almost 24 hours after CNN’s story was debunked — Wittes has never noted to his more than 200,000 followers that the story he so excitedly promoted turned out to be utterly false, even though he returned to Twitter long after the story was debunked to tweet about other matters. He just left his false and inflammatory claims uncorrected…

So numerous are the false stories about Russia and Trump over the last year that I literally cannot list them all. Just consider the ones from the last week alone, as enumerated by the New York Times yesterday in its news report on CNN’s embarrassment:

I recommend reading the whole piece, the lists of false stories, and watching the embedded videos.

Friday was one of the most embarrassing days for the U.S. media in quite a long time. The humiliation orgy was kicked off by CNN, with MSNBC and CBS close behind, with countless pundits, commentators and operatives joining the party throughout the day. By the end of the day, it was clear that several of the nation’s largest and most influential news outlets had spread an explosive but completely false news story to millions of people, while refusing to provide any explanation of how it happened.

The spectacle began on Friday morning at 11 a.m. EST, when the Most Trusted Name in News™ spent 12 straight minutes on air flamboyantly hyping an exclusive bombshell report that seemed to prove that WikiLeaks, last September, had secretly offered the Trump campaign, even Donald Trump himself, special access to the DNC emails before they were published on the internet. As CNN sees the world, this would prove collusion between the Trump family and WikiLeaks and, more importantly, between Trump and Russia, since the U.S. intelligence community regards WikiLeaks as an “arm of Russian intelligence,” and therefore, so does the U.S. media…

It’s impossible to convey with words what a spectacularly devastating scoop CNN believed it had, so it’s necessary to watch it for yourself to see the tone of excitement, breathlessness and gravity the network conveyed as they clearly believed they were delivering a near-fatal blow on the Trump/Russia collusion story..

Incredibly, to this very moment — almost 24 hours after CNN’s story was debunked — Wittes has never noted to his more than 200,000 followers that the story he so excitedly promoted turned out to be utterly false, even though he returned to Twitter long after the story was debunked to tweet about other matters. He just left his false and inflammatory claims uncorrected.

Talking Points Memo’s Josh Marshall believed the story was so significant that he used an image of an atomic bomb detonating at the top of his article discussing its implications, an article he tweeted to his roughly 250,000 followers. Only at night was an editor’s note finally added noting that the whole thing was false…

So numerous are the false stories about Russia and Trump over the last year that I literally cannot list them all. Just consider the ones from the last week alone, as enumerated by the New York Times yesterday in its news report on CNN’s embarrassment:

It was also yet another prominent reporting error at a time when news organizations are confronting a skeptical public, and a president who delights in attacking the media as “fake news.”

Last Saturday, ABC News suspended a star reporter, Brian Ross, after an inaccurate report that Donald Trump had instructed Michael T. Flynn, the former national security adviser, to contact Russian officials during the presidential race.

The report fueled theories about coordination between the Trump campaign and a foreign power, and stocks dropped after the news. In fact, Mr. Trump’s instruction to Mr. Flynn came after he was president-elect.

Several news outlets, including Bloomberg and The Wall Street Journal, also inaccurately reported this week that Deutsche Bank had received a subpoena from the special counsel, Robert S. Mueller III, for President Trump’s financial records.

The president and his circle have not been shy about pointing out the errors.

That’s just the last week alone. Let’s just remind ourselves of how many times major media outlets have made humiliating, breathtaking errors on the Trump/Russia story, always in the same direction, toward the same political goals. Here is just a sample of incredibly inflammatory claims that traveled all over the internet before having to be corrected, walk-backed, or retracted — often long after the initial false claims spread, and where the corrections receive only a tiny fraction of the attention with which the initial false stories are lavished:

Russia hacked into the U.S. electric grid to deprive Americans of heat during winter (Wash Post)

An anonymous group (PropOrNot) documented how major U.S. political sites are Kremlin agents (Wash Post)

WikiLeaks has a long, documented relationship with Putin (Guardian)

A secret server between Trump and a Russian bank has been discovered (Slate)

RT hacked C-SPAN and caused disruption in its broadcast (Fortune)

Crowdstrike finds Russians hacked into a Ukrainian artillery app (Crowdstrike)

Russians attempted to hack elections systems in 21 states (multiple news outlets, echoing Homeland Security)

Links have been found between Trump ally Anthony Scaramucci and a Russian investment fund under investigation (CNN)

That really is just a small sample

I recommend reading the whole piece and watching the embedded videos.

What’s the matter with Wisconsin (and almost every state?)

Recent Headlines:

Wisconsin: Walker makes it harder for candidates to get a recount in close races

Former Trump Advisor: Scott Walker Has ‘Rigged’ 5 Elections

Editorial: What is wrong with this picture?

Wisconsin: Walker makes it harder for candidates to get a recount in close races <read>

Gov. Scott Walker has made it harder to ask for an election recount in Wisconsin. Walker last week signed into law a bill introduced in reaction to Green Party presidential candidate Jill Stein’s 2016 recount request in Wisconsin after she finished a distant fourth. Under the new law, only candidates who trail the winner by 1 percentage point or less in statewide elections could seek a recount. If that had been in effect last year, Democrat Hillary Clinton could have requested a recount since she finished within that margin, losing the state by only 22,000 votes. But Stein would have been barred. Democrats argued against the change, saying if candidates want to pay for a recount they should be allowed to pursue it. Stein paid for the Wisconsin recount.

Former Trump Advisor: Scott Walker Has ‘Rigged’ 5 Elections <read>

“As someone with great sentimental attachment to the Republican Party, as I joined as the party of Goldwater, both parties have engaged in voting machine manipulation,” Stone wrote. “Nowhere in the country has this been more true than Wisconsin, where there are strong indications that Scott Walker and the Reince Priebus machine rigged as many as five elections including the defeat of a Walker recall election.”

Editorial: What is wrong with this picture? We don’t for a second believe Roger Stone. Yet, we have no reason to believe Scott Walker or Wisconsin election integrity. What is needed is transparent and publicly verifiable elections so that we do not need to trust anyone.

“Go FCC Yourself” or lose the last best hope for Democracy

The Trump Administration is doing all it can to kill the Internet as we appreciate it. It is time to follow John Oliver’s advice;
1. Go to http://GoFCCYourself.com
2. Press “+Express” on the right near the top
3. Fill in the form and comment. e.g. “Keep the Internet free, keep it under Tittle II…”

Colorado Completes Nation’s first Risk Limiting Audit

Now it’s in the history books: Colorado has become the first state to complete a “risk-limiting audit” designed to catch mistakes when ballots are tabulated…

“Colorado is a national leader in exploring innovative solutions for accessible, secure and auditable elections,” [Matt} Masterson [Chair of the U.S. Election Assistance Commission] said. “Colorado’s risk-limiting audit provided great insights into how to conduct more efficient and effective post-election audits. The EAC is eager to share some of the lessons learned with election officials across America.”

NPR, All Things Considered: Colorado Launches First In The Nation Post-Election Audits <read>

Press Release, Colorado Secretary of State: A new kind of election audit: Colorado is the first to complete it <read>

From the Press Release:

DENVER, Nov. 22, 2017 — Now it’s in the history books: Colorado has become the first state to complete a “risk-limiting audit” designed to catch mistakes when ballots are tabulated.

The Colorado legislature ordered the use of risk-limiting audits in 2009 — long before widespread media coverage of fears about hacking election equipment and interference by foreigners — but the timeline to implement the RLAs was delayed until this year’s Nov. 7 coordinated election.

“I think it’s fair to say that both state and county election officials were a little anxious because this has never been done before,” Colorado Secretary of State Wayne Williams said. “But it turned out to be an amazing success, and that’s because our staff and our county clerks have done a phenomenal job. I am thankful for their hard work and dedication.”

The process attracted attention nationwide. Matt Masterson, chairman of the U.S. Election Assistance Commission, and fellow commissioner Thomas Hicks were among those who witnessed the procedure.

“Colorado is a national leader in exploring innovative solutions for accessible, secure and auditable elections,” Masterson said. “Colorado’s risk-limiting audit provided great insights into how to conduct more efficient and effective post-election audits. The EAC is eager to share some of the lessons learned with election officials across America.”

A risk-limiting audit is a procedure that provides strong statistical evidence that the election outcome is right and has a high probability of correcting a wrong outcome. Risk-limiting audits require human beings to examine and verify more ballots in close races (exactly when you want to examine more ballots), and fewer ballots in races with wide margins. The procedures for conducting risk-limiting audits are spelled out in Secretary of State Election Rule 25.

If you’re an in-the-weeds kind of election junkie or math wonk, you might be interested in the results the Secretary of State’s office posted on its Audit Center. Under the subheads “Round # 1” and “Round # 2” click on “State report (XLSX)” for a county-by-county review.

I am pleased to have played a very small part in this project, moderating weekly conference calls for the State Audit Working Group. Members of the group assisted with extensive comments and contributions to the regulations to implement the law, contributing to the Free and Fair software, and observation of the audit in progress, on the ground in Colorado. It represents months and years of effort by several members of the group, along with enthusiastic support by many Colorado election officials.

34 Districts Selected for Audit at Wethersfield High School

This morning Secretary of the State, Denise Merrill selected 34 district for audit with the help of students at Wethersfield High School:

This morning Secretary of the State, Denise Merrill selected 34 district for audit with the help of students at Wethersfield High School:

List of selected districts: <press release>

A Year After, Our Elections Aren’t Much More Secure

From Buzzfeed’s Cyber Security Correspondent, Kevin Collier: A Year After Trump’s Victory, Our Elections Aren’t Much More Secure

But the focus on how Facebook and Twitter were used to sow division in the US electorate has diverted attention from one of the weakest spots in the system: … a simple cyberattack can be effective against weak infrastructure and unprepared IT workers. Whether that can be fixed by 2018 or even 2020 is an open question…

“We’re not doing very well,” Alex Halderman, a renowned election security expert, told BuzzFeed News. “Most of the problems that existed in 2016 are as bad or worse now, and in fact unless there is some action at a national policy level, I don’t expect things will change very much before the 2018 election.”

From Buzzfeed’s Cyber Security Correspondent, Kevin Collier: A Year After Trump’s Victory, Our Elections Aren’t Much More Secure <read>

The halfway point between the election of President Donald Trump and the 2018 midterms has come and gone, and it still isn’t fully clear what Russian hackers did to America’s state and county voter registration systems. Or what has been done to make sure a future hacking effort won’t succeed.

US officials, obsessed for now with evidence that Russia’s intelligence services exploited social media to sway US voters, have taken solace in the idea that the integrity of the country’s voting is protected by the system’s acknowledged clunkiness. With its decentralized assortment of different machines, procedures, and contractors, who could possibly hack into all those many systems to change vote totals?

But the focus on how Facebook and Twitter were used to sow division in the US electorate has diverted attention from one of the weakest spots in the system: the gap between those locally operated voting systems that are well-protected by sophisticated technology teams and those that are less prepared. Russia knows those gaps exist and that a simple cyberattack can be effective against weak infrastructure and unprepared IT workers. Whether that can be fixed by 2018 or even 2020 is an open question.

Most states’ elections officials still don’t have the security clearances necessary to have a thorough discussion with federal officials about what’s known about Russian, or others’, efforts to hack into their systems.

Seven states still use all-electronic voting systems whose results cannot be verified because there is no paper trail.

And hundreds of US counties rely on outside contractors to maintain their registration records and update the software on voting machines. Some of those contractors are small operations with few employees and minimal computer security skills.

Here we caution that it is not just Russia to be concerned with. Those same vulnerabilities are open to other foreign actors, foreign and U.S. hackers, along with elements of the the U.S. Government. Beyond that open to official and contractor insiders. Not being connected to the Internet does not preclude attack from any of these actors, especially insiders.

Seven states still use all-electronic voting systems whose results cannot be verified because there is no paper trail.

And hundreds of US counties rely on outside contractors to maintain their registration records and update the software on voting machines. Some of those contractors are small operations with few employees and minimal computer security skills.

Many local officials are reluctant to seek federal help, worried about ceding authority to outside agencies.

“We’re not doing very well,” Alex Halderman, a renowned election security expert, told BuzzFeed News. “Most of the problems that existed in 2016 are as bad or worse now, and in fact unless there is some action at a national policy level, I don’t expect things will change very much before the 2018 election.”…

But in the aftermath of last year’s vote, it has become clear that the sheer complexity of the system is no reassurance that it can’t be exploited by a determined hostile power. Halderman, the election security expert, says that just because it didn’t happen last time — or in the voting completed Tuesday — doesn’t mean it won’t.

“It’s only a matter of time, if we don’t have coordinated national action, until a major US election is disrupted, or even its outcome changed, by a foreign nation-state in a cyberattack,” [former FBI director James Comey] said.

To this day, DHS points to the fact that it’s never found evidence that vote tallies were changed

We add that DHS, as far as we know has not looked for such evidence anywhere, let alone everywhere.

As we have said before. Protecting databases and votes requires Prevention, Detection, and Recovery.

Protection alone is insufficient. Large corporations, the Federal Government agencies, and technology companies are regularly hacked. State and Local officials can’t come close to those ultimately limited efforts.
Detection is necessary to provide assurance that hacking did not occur.
Recovery is necessary for all sorts of potential errors, hacks, and fraud.

Paper ballots, properly secured, are the first requirement for detection and recovery of votes. Strong pre-election voter database backup and audits along with paper voter checkin lists are part, just a part, of recovery from corrupted or electronic voter lists, or election day power failure, equipment failure, and cyber attack.