American Progress Report: Election Security in All 50 States <read>
The report gives every state grades based on some detailed criteria. Connecticut was graded ‘B’, which it shared with several other states as the highest grade awarded – it sets pretty stiff criteria for an ‘A’, yet we doubt that any state deserves an ‘A’. Yet there are problems and limitations with such reports. We would give Connecticut lower grades in some areas, higher in others, and are uncomfortable with other grades.
The criteria at a high level:
1.Minimum cybersecurity standards for voter registration systems2.Voter-verified paper audit trail3.Post-election audits that test election results4.Ballot accounting and reconciliation5.Return of voted paper absentee ballots6.Voting machine certification requirements7.Pre-election logic and accuracy testing
The criteria are good at first glance, yet I question why only “minimum” standards for voter registration systems, criteria should include “recounts” and standards for security of voted paper ballots.
A big weakness in such reports is that much of the information is based on self-reporting by election officials,who can be biased, limit their views to their state’s practices, and may not have the technical expertise to evaluate many of the criteria. Also state statutes may be misread or not represent the actual implementation in practice:
The information included in this report is derived primarily from state statutes and regulations, as well as interviews with state and local election officials.
The ratings in each category ranged from Unsatisfactory, Mixed, and Fair, to Good. Connecticut received a ‘B’ from category ratings of:
Fair 1.Minimum cybersecurity standards for voter registration systems
Good 2.Voter-verified paper audit trail
Mixed 3.Post-election audits that test election results
Fair 4.Ballot accounting and reconciliation
Fair 5.Return of voted paper absentee ballots
Fair 6.Voting machine certification requirements
Fair 7.Pre-election logic and accuracy testing
The factors and category ratings were somewhat complex, with some categories providing a score of 0 or 1 and others scoring 0 to 3 based on the number of criteria matched. resulting in totals leading to the final letter grade. So, where do we question Connecticut’s scores? The details for Connecticut can be found starting on page 50 of the report. Our comments and concerns:
Minimum cybersecurity standards for voter registration systems. This criteria is difficult to judge. The criteria is likely only based on interviews with officials. I suspect there is a tendency to say ‘Yes’ as often as possible. And even with accurate answers it is difficult to judge how well those criteria are met in practice. Yet, for Connecticut it is clear that officials are concerned and working on cybersecurity for of all our systems, not just election systems. As a central mainframe system managed by the State, the voter registration system is subject to every protection applied to that environment.
We would give Connecticut higher grades. Connecticut was downgraded because the voter registration system was judged over 10 years old. We disagree with that broad-brush criteria and the definition of Connecticut’s system as over 10 years old. As an IBM Mainframe, CICS, DB2 system our voter registration system is presumably regularly upgraded with new versions of the operating system, CICS, and DB2. The hardware may also be less than 10 years old. In addition, the registration system itself has been enhanced.
Post-election audits that test election results. Here we would downgrade the “mixed” results. As has been repeatedly reported by the Citizen Audit, the conduct of the audit falls short of what would be reasonably expected of any effective audit. While it is true the statutes require that the audit be completed before certification, in practice that is impossible in some elections since certification must be complete before the date the audits can commence. It also depends on the definition of “complete”. In practice, the overall audits are not complete until the Secretary of the State receives the final report from UConn and files that with the SEEC. The reports for all elections since November 2011 are yet to be filed and only one report for a primary (2014) has been filed in that period.
Ballot accounting and reconciliation. Once again we would downgrade Connecticut’s score. In practice, ballot accounting and reconciliation do not always occur. In recent years in almost every election, the Citizen Audit, has documented instances where write-in ballots (up to 151) have been read into the scanner at the end of election day in error. That results in counts that exceed the number of checked-off voters. In most instances those discrepancies have been discovered only by the audit, showing that they had not been discovered or addressed in the closing of the polls, nor in the review of results by both registrars and municipal clerks.
Voting machine certification requirements. Here we would upgrade Connecticut’s score. Connecticut was downgraded because our optical scanners are just over 10 years old – their design and circuits are even older in technology. Yet, they are working fine and from random survey’s of the Citizen Audit are not showing signs of age. There are incrementally better systems available today, yet voter marked paper ballots will continue to protect our votes. We expect they will need to be replaced in the next 5 to 10 years, but not yet. The longer we wait the better options will become available, at lower cost, and will also last that many years longer.
Missing Criteria Recounts: About half the states have close-vote recounts. Connecticut has close-vote recanvasses, which fall short of the best adversarial manual recounts in some other states. Connecticut should have more open, adversarial recounts, with more time to call for and perform recounts, with stronger criteria than the upper limit of 2000 vote differences which is too low a threshold ( as low as 0.12% in statewide elections). We should also allow for candidates, parties, or citizens to call for a limited number of directed recounts of specified districts, perhaps at a reasonable fee. We would rate Connecticut mixed in this criteria, as our recanvasses are actually conduced, usually fairly, yet not conduced uniformly and in accordance with the law. Sadly, that mixed rating would put us in the top 50% of all States in the recount category.
Protection of Paper Ballots. Here, once again, we would rate Connecticut mixed. Connecticut has an inadequate law for the protection of paper ballots and the actual practices in the vast majority of towns do not provide credible evidence that ballots were not tampered with. Once again, see the Citizen Audit reports. Despite inadequate law and practice, the distributed nature of Connecticut’s election system mean that for statewide elections it is doubtful that enough ballots could be manipulated in the same direction to change anything but the closest of outcomes. Unfortunately, that leaves local and regional elections vulnerable, protected only by trust in every election official and other local staff that frequently have access to voted ballots.
Finally, despite flaws, the report is useful and provides directions for improvement in many areas in every state. Election officials, legislators, and voters should act to improve our voting systems and laws in the near term. We would give the authors A+ for effort and the report a grade of B.