Online Voting Is Risky, Riskier than Online Banking

My letter to the Hartford Courant today.

To the Editor,

The article in the Sunday July, 10 Smarter Living Section, “Democracy in The Digital Age”, is a one-sided disservice to readers. The article, abbreviated from Consumer Reports original, provides a one-sided case for online voting.  The article quotes the CEO of a company selling online voting at a huge expense to governments around the world.  She touts the benefits without detailing the risks.  The system she touts as secure, has never been proven secure. It has never been subjected to a public security test.  Unlike the printed version, the original article at Consumer Reports details the risks of online voting…

My letter to the Hartford Courant today.

To the Editor,

The article in the Sunday July, 10 Smarter Living Section, “Democracy in The Digital Age”, is a one-sided disservice to readers. The article, abbreviated from Consumer Reports original, provides a one-sided case for online voting.  The article quotes the CEO of a company selling online voting at a huge expense to governments around the world.  She touts the benefits without detailing the risks.  The system she touts as secure, has never been proven secure. It has never been subjected to a public security test.  Unlike the printed version, the original article at Consumer Reports details the risks of online voting, quoting a nationally known voting integrity advocate and a recognized computer scientist specializing in electronic voting, . How ironic that the lead article in the same section, “Protecting Your Data”, points out how risky it is to do banking transactions over the internet from free wi-fi sites.  If the unedited Consumer Reports article was provided, readers would have learned why, with all its risks, Internet banking is actually much safer than online voting.

Here is the “full” abbreviated Courant Article: <read>

Original Consumer Reports article quoting Pam Smith and Aviel Rubin <read>

The web: Hardly ready for Internet voting.

So many articles this week demonstrating that the web is not safe for voting. Especially when in the hands of under-resourced government agencies and political parties. (It is also unsafe in the hands of fully-resourced governments and cyber-experts.)

 

  • Singapore plans to take its Government offline.
  • Then we have an above average size government agency that cannot create a safe voter registration system.
  • Meanwhile the party that allows overseas voters to participate in its primaries via Internet voting has its own problems.

As CTVotersCount readers know, Internet voting should not be compared to a normal application. Its not like the risk of copying some public information, information that should be public, stealing a few million from a bank. Its about billions in government spending, changing election results and covering that up.

So many articles this week demonstrating that the web is not safe for voting. Especially when in the hands of under-resourced government agencies and political parties.  (It is also unsafe in the hands of fully-resourced governments and cyber-experts.)

Singapore plans to take its Government offline (that is all employees to use a closed network). Der Spiegal <read if you know German>.  The short version is they do secret banking like Switzerland and they do not believe they can protect their tax avoiding customers.  On the other hand it might keep the public from finding out what they are doing in other government activities.  I for one, would not bet on this working.  There are a lot of holes and vulnerabilities in any system, especially when big $ are involved.

Then we have an above average size government agency that cannot create a safe voter registration system, i.e. Washington D.C.  Washington Post: Glitch believed to be based in mobile app erases some D.C. voters’ party affiliation  <read>  D.C. is pretty good size, compared to the average of the 169 towns in Connecticut that would have been charged with implementing and protecting Internet voting if the General Assembly had had its way.  P.S.  Even with help, D.C. had its own problems with Internet voting <read>

Meanwhile the party that allows overseas voters to participate in its primaries via Internet voting has its own problems. Wired: Russia’s Breach of the DNC Is About More Than Trump’s Dirt <read>

As CTVotersCount readers know, Internet voting should not be compared to a normal application.  Its not like the risk of copying some public information, information that should be public, stealing a few million from a bank.  Its about billions in government spending, changing election results and covering that up. E.g from the Daily Dot:  Online voting is a cybersecurity nightmare <read>

Another example of a transparent, evidence-based vote

 

Last week I spent a morning in New London’s historic Town Hall observing a post-election audit. I noticed this interesting device. Can you explain it, without reading further?

 

Last week I spent a morning in New London’s historic Town Hall observing a post-election audit.  I noticed this interesting device. Can you explain it, without reading further?

 

While you are thinking, here is a panorama of the Council Chambers.  Two plaques on the wall list the Mayors starting in 1646 and note New London was founded by John Winthrop, the Younger.

Now back to the device above. It is actually a mechanism for requesting and publicly displaying voters.  Those are ping-pong balls with the names of council members.  The Clerk calls off a member’s name and then places the ball in the yea or nay track.  In the end the longest track wins.

Unlike votes in our elections, the council does not have to deal with a secret ballot.  Like votes in the General Assembly where they are recorded on a big board, or when we raise our hands in a public meeting the whole process is transparent and easily validated by everyone present.

In a town council or legislature it is a good idea since the members should be accountable to the public.  When we vote by secret ballot it is to prevent any voter from being bribed, coerced, or otherwise beholden to anyone but ourselves for our vote.

 

Voter Suppression is not just Southern, Intentional, and Advantageous to those in charge.

Typically the Justice Department goes after Southern states, alleging intentional voter suppression by Republicans against voters who would be expected to vote predominately Democratic. To me, it usually quacks like that duck. Not so in Connecticut, we apparently do it through incompetence at our “legend in its own line”, DMV.

Hartford Courant, Jon Lender: Officials Tense, Tight-Lipped On Feds’ Probe Of State ‘Motor Voter’ Program <read>

Typically the Justice Department goes after Southern states, alleging intentional voter suppression by Republicans against voters who would be expected to vote predominately Democratic. To me, it usually quacks like that duck. Not so in Connecticut, we apparently do it through incompetence at our “legend in its own line”, DMV.

Hartford Courant, Jon Lender: Officials Tense, Tight-Lipped On Feds’ Probe Of State ‘Motor Voter’ Program <read>

The U.S. Department of Justice’s April 15 threat to sue Connecticut over failures in its “motor voter” program — which is supposed to promote voter registration at Department of Motor Vehicles offices — resulted in a closed-door meeting this past Tuesday aimed at resolving the problem out of court…

But, for the moment, perhaps the most interesting thing about the “It shouldn’t take the threat of a federal lawsuit to get the DMV to do its job,” said Cheri Quickmire, executive director of the good-government advocacy group, Common Cause in Connecticut. “I am really disappointed that there’s even cause [to consider] this kind of action. The reality is that DMV has been supposed to do this … for a very long time.”

Sen. Michael McLachlan, R-Danbury, the top-ranked Republican on the General Assembly committee that oversees voter registration, said Friday that the “motor voter” program falls under DMV and Merrill’s office, and “I would say that both them are really responsible.” Complying with federal law should have been “really simple,” he said, if the DMV had paid more attention and Merrill’s office had “nudged” more.Here’s What CT Legislature Got Right And Wrong This Year

Outside of their remarks, only guarded comments could be elicited from taxpayer-funded communications aides who continually seek to put their bosses in the best light.

How not to audit, Chicago style vs. Connecticut style

This video has gone viral over the last week. It is a hearing of a public comment at the Chicago Board of Elections.

This would not normally, exactly, happen in Connecticut

This video has gone viral over the last week.  It is a hearing of a public comment at the Chicago Board of Elections.

In summary:

  • The audit consisted of counting paper records.
  • The public was not permitted to observe the paper records, to confirm that they were counted correctly.
  • At the end of the count, the counters compared the result to the machine tape result.
  • It showed that the counts were way off.
  • The officials simply erased enough marks from one candidate and added enough to the other to make the audit count equal to the machine count.
  • And the Election Board apparently saw no reason for concern with the audit or with the election results.

This would not normally, exactly, happen in Connecticut

  • We do have procedures that require that observers be able to be close enough to see ballot marks etc.
  • In some audits when counts do not match, officials recount until everyone is confident in the result.
  • In some cases officials work to make the counts match in ways that are hard to follow, and provide little confidence in the reported results.
  • Some audits result in high differences between the scanner counts and audit counts reported on official forms to the Secretary of the State, most, with no confirmation, attribute the differences to “Human Error”.
  • Others reported without indicating “Human Error” result in the Secretary’s Office calling local officials to ask if they agree that the cause was “Human Error”.
  • We do not have an Elections Board that officially reviews and accepts the audit result.
  • We have a mandated audit report after each audit, with no specified deadline for its completion.  The last such report released was for the November 2011 election.

EDITORIAL: General Assembly heading the wrong way on post-election audits


UPDATE: The bill passed the House unanimously, including several who responded to your emails with promises they would not vote to cut the audits.

The Connecticut Senate has passed S.B. 252.  If the House passes and the Governor signs the bill it will be another national embarrassment for Connecticut, doing the wrong thing at precisely the worst time.

We have voter-verified paper ballots. To be valuable and provide confidence they must be used for strong, publicly verified, post-election audits. You can help. Tell your legislators that you want stronger audits, not weaker audits. Tell them to oppose S.B. 252. Then consider volunteering one day after each election and primary to observe with the Citizen Audit.


UPDATE: The bill passed the House unanimously, including several who responded to your emails with promises they would not vote to cut the audits.

The Connecticut Senate has passed S.B. 252. If the House passes and the Governor signs the bill it will be another national embarrassment for Connecticut, doing the wrong thing at precisely the worst time.

S.B. 252 would cut our post-election audits from 10% of voting districts to 5%. S.B. 252 was originally intended to strengthen the audits, while providing savings for municipalities. The current version eliminates all the features in the original bill that would make the audits stronger. The current version saves, at most, just $15,000 more annually statewide over the original bill.

Those paying attention to the news in this primary season have heard many charges of potential election fraud, along with calls for post-election audits in Arizona, New York, and elsewhere. There is an embarrassing video of a faulty presidential primary post-election audit in Chicago, where the public was barred from observing the votes as they were being tallied by officials. Worse the counters had the original numbers in front of them. When their counts did not match by a wide margin, they added counts to one candidate and deleted counts from the other, so that the manual counts would exactly match the machine counts. Over the years there have been similar problems with the audits in Connecticut.

For the first couple of years in the Connecticut audits, some local officials barred the public from observing the ballots as they were counted, some made it very difficult for the public to determine the time and place of the audits. Secretary of the State Susan Bysiewicz fixed those problems in procedures, which officials have since followed, for the most part. Other problems have not been effectively addressed.

The Citizen Audit’s observations of Connecticut’s audits have shown that many are conducted well, yet many are not. Many are, at best, only marginally better than the one in the video from Chicago. Connecticut election officials often do not double check counts; they are often aware of the original totals as they count, and work to match machine counts rather than accurately count the paper ballot votes. Frequently officials use confusing, ad-hoc, non-transparent methods for combining totals from multiple ballot stacks and teams of counters. Local officials in their reports and the Secretary of the State’s Office in statewide reports attribute all differences in counts to “Human Error”. The last official statewide report released by the Secretary of the State was for the November 2011 election. Five years is too long to wait for reports on a critical aspect of democracy.

S.B. 252 is still entitled “An Act Concerning Post-Election Audit Integrity and Efficiency”. The original proposed bill was the result of a long negotiated compromise which would have strengthened our audits in return for a reduction in the audit of polling place optical scanners, a change long sought by the Registrars of Voters Association of Connecticut (ROVAC). Among other reforms to strengthen the audits, the bill would have subjected centrally counted absentee ballots to audit, subjected originally hand counted ballots to audit when there were large numbers of them, mandated investigations of significant discrepancies in counts, required stronger ballot security, and timely reporting of results by the State. Municipalities would have saved 40% of their current costs, reducing relatively low annual statewide audits costs from at most $150,000 annually to less than $90,000. The revised, one-sided, bill provides none of the benefits while providing just $15,000 more in annual savings across all municipalities in the State.

We have voter-verified paper ballots. To be valuable and provide confidence they must be used for strong, publicly verified, post-election audits. You can help. Tell your legislators that you want stronger audits, not weaker audits. Tell them to oppose S.B. 252. Then consider volunteering one day after each election and primary to observe with the Citizen Audit.

ACTION ALERT: CT General Assembly Should Not Be Weakening Election Audits

Amid charges of voting integrity lapses around the country, the Connecticut General Assembly is on its way to weakening, our already weak post-election audits. The Senate has already passed substitute S.B. 252. Please call your State Representative and ask them not to make that same mistake. Find your rep and their contact info at: https://www.cga.ct.gov/asp/menu/cgafindleg.asp Tell them:

As a concerned constituent, I urge you to oppose S.B. 252. The committee bill weakens our post-election audits. In a time of public concern with the primary process in several states, we should be strengthening, not weakening our post-election audits.

Call Today. The bill could be called for voting in the House at almost any time!

Amid charges of voting integrity lapses around the country, the Connecticut General Assembly is on its way to weakening, our already weak post-election audits.  The Senate has already passed substitute S.B. 252.  Please call your State Representative and ask them not to make that same mistake. Find your rep and their contact info at: https://www.cga.ct.gov/asp/menu/cgafindleg.asp  Tell them:

As a concerned constituent, I urge you to oppose S.B. 252.  The committee bill weakens  our post-election audits.  In a time of public concern with the primary process in several states, we should be strengthening, not weakening our post-election audits.

Call Today. The bill could be called for voting in the House at almost any time!
Details:

For several years  CTVotersCount,  the Connecticut Citizen Election Audit, and others have been calling for stronger audits. The current audits do not subject all ballots to the potential for audit. The audits are poorly conduced and not reported upon accurately or in a timely manner by the state. (See Citizen Audit reports at:  http://CTElectionAudit.org)

In 2015, we offered a compromise bill with several key reforms to strengthen the audits. The bill received uniform supporting testimony by the Registrars Of Voters Association of Connecticut (ROVAC), the Town Clerks Association, and the Connecticut Conference of Municipalities (CCM).

In 2016, the bill was improved to address some concerns of ROVAC.  Yet the improved bill opposed by ROVAC  and the Town Clerks. It was labeled as too costly by the Secretary of the State because it would require her office to report comprehensive results publicly. Interestingly, the Secretary is now touting an almost equivalent capability, recently implemented by her office, which has been under development for several years at $400,000+.

Instead of strengthening the audits, the Government Administration and Elections Committee has stripped all the strengthening provisions, leaving only the weakening reform of cutting the audit in half,

Amid positive systems news, SOTS recognizes online registration issues

As we mentioned earlier in the week, Connecticut State systems are an embarrassment and our Online Voter Registration system was down Saturday morning.  Apparently it has been down more than that. Yesterday the Secretary of the State took note in a press release

It has come to the agency’s attention that there were intermittent slowdowns and disruptions to the online voter registration system.

UPDATED

As we mentioned earlier in the week, Connecticut State systems are an embarrassment and our Online Voter Registration system was down Saturday morning.  Apparently it has been down more than that. Yesterday the Secretary of the State took note in a press release <read>

It has come to the agency’s attention that there were intermittent slowdowns and disruptions to the online voter registration system. It is now back up and running and we encourage people to use the system. We are working with our IT specialists to identify the issue. At this point, there is no evidence that any agency is to blame. We are working with our vendor to ensure that any problems that arise are addressed immediately. Thousands of people continue to use the system successfully.
Perhaps it took a while to notice the problems amid the interviews touting its success <e.g.>

 

And touting the success of the new election night reporting system, which has yet to be used in a real election.  The real test will come in November <e.g.>

,

We strongly support an online reporting system.  The SOTS Office failed a couple of times when they did not listen to legitimate concerns of registrars of voters across the state.  We are hoping this one works well or that they continue until they listen and fix any problems.

 

Meanwhile another Justice Department investigation.  This one regarding compliance with the Motor Voter Law <read>

The section of the law the Justice Department is accusing Connecticut of violating is related to motor vehicle registration.

“Our investigation indicates widespread noncompliance with Section 5 in Connecticut,” Vanita Gupta, principal deputy assistant attorney general

Update 4/21/2016*********************************************

The Hour has more details <read>

Connecticut Makes National Short List – Embarrassing

Yesterday the Connecticut Online Voter Registration System was down for the morning.  Reminiscent of last fall when the system was down for most of the last day local election officials had to print voter lists for polling places in the November election.

Last week Reuters covered a study of cybersecurity and Connecticut was cited as one of the weakest states. It also cited the U.S. Government as worse than most U.S. Corporations.

We sadly await the Election Day when the Connecticut voter registration system is down, especially with no contingency plan for Election Day Registration. Don’t say “Who Could Have Imagined”, we did.

Yesterday the Connecticut Online Voter Registration System was down for the morning.  Reminiscent of last fall when the system was down for most of the last day local election officials had to print voter lists for polling places in the November election.

Last week Reuters covered a study of cybersecurity and Connecticut was cited as one of the weakest states. It also cited the U.S. Government as worse than most U.S. Corporations:  U.S. government worse than all major industries on cyber security <read>

U.S. federal, state and local government agencies rank in last place in cyber security when compared against 17 major private industries, including transportation, retail and healthcare, according to a new report released Thursday.

The analysis, from venture-backed security risk benchmarking startup SecurityScorecard, measured the relative security health of government and industries across 10 categories, including vulnerability to malware infections, exposure rates of passwords and susceptibility to social engineering, such as an employee using corporate account information on a public social network.

Educations, telecommunications and pharmaceutical industries also ranked low, the report found. Information services, construction, food and technology were among the top performers…

Other low-performing government organizations included the U.S. Department of State and the information technology systems used by Connecticut, Pennsylvania, Washington and Maricopa County, Arizona.

We sadly await the Election Day when the Connecticut voter registration system is down, especially with no contingency plan for Election Day Registration. Don’t say “Who Could Have Imagined”, we did.

Study Shows Connecticut Municipal Websites Do Not Serve Voters

Most fail to provide information voters need to register and vote
Citizens must be better served and municipalities could save money

From the press release:

April 6, 2016: The Connecticut Citizen Election Audit released a study evaluating election information provided to voters by Connecticut’s 169 municipalities. Information was collected by volunteer evaluators just prior to the 2015 November election.

Citizen Audit spokesperson Luther Weeks stated, “Many towns do not provide the information most sought by voters across Connecticut, such as ‘What is on the ballot?’ or ‘Where do I vote?’. Many failed to inform citizens of online registration, which could increase registration and cut municipal expenses.”

Municipal website findings include:

  • Only 33% answered “What is on the ballot?”
  • Only 56% answered “Where do I vote?”
  • Only 58% provided the date of the next election.
  • Only 28% provided registration deadlines.
  • 5 provided an incorrect election date.
  • 2 provided incorrect registration information.
  • 51% had no link to Online Registration. 28% had no link to Online Registration or to a Mail-In Registration form.
  • Only 17% posted results of their 2014 election.
  • Only 15% provided Voter ID information.

Weeks said, “The Secretary of the State’s web has much of this information, yet studies show that voters go first to their local web. Registration information is important for new voters, and all voters want the election date, ‘Who is on the ballot?’, ‘Where do I vote?’ and voter ID requirements.”

The report also includes recommendations to municipalities, the Secretary of the State, and a low-cost sample website for a whimsical town, http://NutmegtonCT.wordpress.com

<Press Release (.pdf)> <Full Report (.pdf)>

Most fail to provide information voters need to register and vote
Citizens must be better served and municipalities could save money

From the press release:

April 6, 2016: The Connecticut Citizen Election Audit released a study evaluating election information provided to voters by Connecticut’s 169 municipalities. Information was collected by volunteer evaluators just prior to the 2015 November election.

Citizen Audit spokesperson Luther Weeks stated, “Many towns do not provide the information most sought by voters across Connecticut, such as ‘What is on the ballot?’ or ‘Where do I vote?’. Many failed to inform citizens of online registration, which could increase registration and cut municipal expenses.”

Municipal website findings include:

  • Only 33% answered “What is on the ballot?”
  • Only 56% answered “Where do I vote?”
  • Only 58% provided the date of the next election.
  • Only 28% provided registration deadlines.
  • 5 provided an incorrect election date.
  • 2 provided incorrect registration information.
  • 51% had no link to Online Registration. 28% had no link to Online Registration or to a Mail-In Registration form.
  • Only 17% posted results of their 2014 election.
  • Only 15% provided Voter ID information.

Weeks said, “The Secretary of the State’s web has much of this information, yet studies show that voters go first to their local web. Registration information is important for new voters, and all voters want the election date, ‘Who is on the ballot?’, ‘Where do I vote?’ and voter ID requirements.”

The report also includes recommendations to municipalities, the Secretary of the State, and a low-cost sample website for a whimsical town, http://NutmegtonCT.wordpress.com

<Press Release (.pdf)> <Full Report (.pdf)>