Category: Electronic Vulnerability

BradBlog reports that the Election Assistance Commission (EAC) may have been wrong when it issued an advisory indicating that lever machines were banned by the Help America Vote Act (HAVA) <read>

The EAC Lied, Lever Voting Machines (Almost) Died

Exclusive: Discredited federal E-voting oversight commission issued an incorrect 2005 ‘legal advisory’ helping to keep NY on a collision course with democracy
But it’s not too late to save the last transparent electoral system in the United States…

So what is driving New York State to stick with a law that so many in New York believe to be such a bad idea? As a New Yorker who has been talking to many election commissioners, legislators and citizens, I was surprised to learn how many people believe the “Help America Vote Act” (HAVA) actually banned lever machines.

I read HAVA. It clearly does not ban levers. I recently discovered what has helped fuel this misinformed opinion in part: it is the discredited position of the discredited U.S. Election Assistance Commission (EAC), as detailed in a newly-unearthed document prepared for the state of Pennsylvania, at their request, in regard to the legality of lever voting machines.

We remember that Connecticut and New York were “late” in becoming HAVA compliant.  Connecticut rushed to comply almost making the expensive and risky mistake of purchasing uncertified “touch-screen” from Danaher,  with the Secretary of the State, thankfully, changing course to optical scanners.  New York chose defy the feds and stick with levers until a suitable alternative could be found.

But there is more to the story. Here is a quote in the article, not clearly attributed, purporting to describe lever machines:

* For those who don’t know, here’s how lever machines work:
Voter pulls lever for candidate of her choice; gears increment a mechanical counter by one and only one vote — only for the desired candidate. No vote switching or overvoting is possible! (Some machines increment the counters as the big lever is pulled, but unlike software, either method of operation can be observed and thoroughly tested before and after each election and both have been completely disclosed in the machines’ patents.) Rinse and repeat for the entire ballot, which takes less than a minute for most voters. Change or correct your votes as many times as you like – not just three. When you’re done, just pull the big lever that casts the ballot, locks in all your votes, opens the privacy curtain, and repositions the candidate levers for the next voter, leaving the locked immutable mechanical counters as the durable record of all the votes cast on the machine — until after the election is certified. On election night, a permanent paper record of the vote tallies on each machine is produced by the machine, and/or by bi-partisan teams of poll workers, before the machine is moved and the poll workers are permitted to leave.

Not so fast.  Looking at comment #3 below the article, David Jefferson, makes the case against levers:

Without commenting on the rest of this posting let me say that the italic comment at the bottom that describes lever machines somewhat mischaracterizes them.

1) Although it is true that the mechanics of a lever machine are vastly simpler than software, and can be understood by careful observation (if the back of the machine is open) by a mechanically inclined person, it is easy to tamper with the gear mechanism so that it miscounts votes, either by failing to increment one time out of 10 or by failing to carry into the next decimal place. This almost always causing an undercount for particular candidate(s), and not an overcount. If such a problem occurs, it is unlikely to be discovered very quickly, since undercounts never lead to any outright inconsistency with the counts of voters or any other data. And whether the problem is detected or not, there is no possibility of recovery, because there is no redundancy at all, let alone anything you would call an audit trail.

2) The same is true if the machine has been misconfigured (equivalent to having a bad election definition file). There my be no recovery.

3) It is true that you can change your (tentative) vote as many times as you want with lever machines. But you can also do that with DREs. The max number of three spoiled ballots is only a limitation of paper ballots, and then only because of an arguably obtuse law–not for any fundamental reason.

4) The counters are not any more “immutable” than any other volatile memory medium. If I remember correctly, a single key turn allows all counts to be zeroed, with no record of the time the occurred, or who did, it or anything else. Arguably, the paper record of the counts is just as durable as the counts that are stored mechanically.

5) A lever machine does not accumulate a “record of all the votes cast”. It records only counts of the votes cast, which is vastly less information than any other voting system. There is absolutely no redundancy in this information, as there is with all other forms of voting, which is why it is impossible to do a meaningful audit that corresponds in any way to the audits that are possible with paper ballots or VVPAT.

We tend to agree with David Jefferson about the attributes of lever machines.  Yet, given all that we know now – the cost of optical scanners — the risks without sufficient, reliable audits — the stories we have heard from registrars about problems with lever machines covered over in the backrooms in Connecticut — it is a close call.  But with sufficient audits, a stronger chain-of-custody for ballots, and manual recounts we still would favor optical scanners.

American Association for the Advancement of Science meeting, “”Science for Public Confidence in Election Fairness and Accuracy”  <read> statements by Ed Feltion and Arlene Ash.

it’s mathematically impossible to verify that the code they run will behave properly under all circumstances, which means that the best we can do is provide a verifiable and auditable record of the vote, allowing problems to be identified retrospectively. Even that’s difficult to reconcile with our expectations for anonymity; in describing the challenge of creating an algorithm that simultaneously encrypts and anonymizes the votes, Felten said, “we’ve reduced this to a previously unsolved problem—we’re really good at that in computer science.”

Until that problem is solved, many states are opting for optical scan voting or printing voter verifiable receipts, which can allow a post-election audit to identify significant problems. But running these audits raises a whole new series of issues, some of which are less a technical challenge than a matter of how carefully we want to listen to what an rigorous analysis of a vote tells us…

This, from Ash’s perspective, represents the crux of the problem. We have sophisticated statistical tools that we rely on for everything from medical research to verifying the flow of money through Las Vegas casinos but we simply haven’t chosen to mandate that they be used to verify election results. Even in cases like the elections in Sarasota, where they were deployed, the results were deemed legally irrelevant unless they provide an indication that election results were distorted by malice or intent. Sloppiness or incompetence, apparently, is acceptable, despite our country’s promise to respect the intent of the voters.

Update: John Gideon attempts to get a straight answer from the EAC <email exchange>

**********

Based on the problems discovered in Humboldt, CA, Secretary of State Deborah Bowen is considering decertifying the GEMS system.  But it’s complex and unclear exactly what decertificaiton would mean.  This is another case of being caught between the Glitches and the Gotchas, at the mercy of a broken system of certification and an oligarchy providing inadequate products.

The Eurika Times-Standard has the story <read>

Chris Riggall, a spokesman for Premier Elections Solutions, said in a previous interview with the Times-Standard that the company had known of the programming error since 2004. Saying the certification process is too lengthy and time consuming to have had the software re-certified, Riggall said Premier instead issued “work around” orders by e-mail to its customers instructing them how to take steps to avoid the problem…

The transparency project that discovered the error passes every ballot cast in an election through an optical scanner after it’s been officially counted. The ballot images are then placed online, along with open-source software, created by volunteer Mitch Trachtenberg, that allows viewers to sort the ballots by precinct and scrutinize the vote as they see fit…

But, the possible decertification of the version of GEMS currently used in Santa Barbara and San Luis Obispo is raising some questions there for elections officials, especially with the state calling a special election in May. Officials in both counties said they are still looking into how they would proceed if the approval of their voting systems were to be withdrawn.

Meanwhile, some in the election watchdog community are pushing for either the Secretary of State’s Office or the federal Elections Assistance Commission to pursue punitive actions against Premier, which they say knowingly kept elections systems in place that had unacceptable error rates.

Riggall said Premier has done nothing disingenuous, and notified its customers immediately upon discovering the error in its vote counting system, carefully instructing them how to “work around” the problem.

”I don’t see that there is anything — absolutely nothing — in how we have handled this issue going back several years that has been disingenuous,” Riggall said.

Meanwhile, in Connecticut we don’t use this particular function of the GEMS system to accumulate election results.  We use GEMS for a different, unrelated function.  We have our vendor, LHS Associates us GEMS to program our elections.  We use an error prone three step system of manual transcription and addition to accomplish the accumulation of vote totals which also can and has been prone to errors.