Mistakes, Malfunctions & Manipulation The Risks of Electronic Election Miscounts

Transcription

1 Mistakes, Malfunctions & Manipulation The Risks of Electronic Election Miscounts Wisconsin Election Integrity Action Team Wisconsinelectionintegrity.org

2 First edition- January 2015 June 2015 revision Reprint, steal, share, whatever. Get the word out. Just don t copyright this.

3 The first thing to remember is that election officials and votingmachine programmers are humans. That means they sometimes make mistakes. Given the number of people involved in running elections who do not make a profession of elections administration, and the intermittent nature of their work, it s delusional to imagine we could ever prevent every mistake. Second, voting machines are machines computers, to be specific. That means they sometimes malfunction. And third: Everyone knows that something very valuable for instance, our right to self-government is liable to be stolen if thieves are given a chance. The companies that sell and service our voting machines and our state and local governments will never have IT security as good as that of major global corporations like Target and Sony, which we know can be hacked. So why is it we never hear about electronic election miscounts? It s not because they don t happen. Some other states routinely check for electronic miscounts. They promptly correct miscounts without fanfare, so those miscounts don t make the news. Other jurisdictions don t check for errors. So they don t find any, and that doesn t make the news either. On rare occasion, a miscount is obvious or discovered by accident. In those cases, it s either promptly corrected or discovered too late to make a difference and that doesn t make the news. This booklet tells the story of only three of the hundreds of known instances in which election results were electronically miscounted. No one knows how many others there have been. Why tell these stories? We need to understand that electronic miscounts will happen, and as long as we use machines to count our votes, the only way to make sure that miscounts never decide our elections is to do what common sense, IT professionals, voting-machine manufacturers, and all national elections experts tell us to do: Routinely verify the accuracy of voting-machine output in time to correct any miscounts before declaring election results to be final

4 Mistake: The Stoughton Miscount Voting machines must be set up before each election so that the machines know how to read that election s unique ballot. In November 2014, the city of Stoughton, Wisconsin had a municipal referendum that presented voters with a simple yes/no choice. Stoughton s four voting machines should have been set up to count the votes like this: 1. If a filled-in oval is detected at index mark #4, count a yes vote. 2. If a filled-in oval is detected at index mark #5, count a no vote. However, there was a mistake, and the machines were set up to count votes like this: 1. If a filled-in oval is detected at index mark #6, count a yes vote. 2. If a filled-in oval is detected at index mark #7, count a no vote. The problem was quickly noticed after the polls closed on Election Night, when poll workers in three of the four precincts printed the voting-machine output and noticed no votes had been recorded for the referendum. Since they knew that they had voted, they knew the machines had miscounted

5 In the fourth precinct, the machine reported 9 No and 7 Yes votes, so the referendum had failed, garnering only 43.7% of 16 tabulated votes. From that point on, the system operated precisely as it should have. The municipal clerk announced that no preliminary referendum results would be released on Election Night. The next morning, city officials scheduled a hand count for the following Monday morning, which was completed with no problems. The referendum passed 4,440 yes (81.7%) and 992 no (18.3%). Municipal results were certified and provided to the county within the time normally allowed for the municipal canvass. This extreme miscount revealed itself without any need for an audit. Had the machine been set up, either deliberately or inadvertently with a slightly different error, the story would have been much different. Rather than being set up to look for votes in blank space on the ballot, the machine could have been instructed to count a No vote for any filled-in ovals next to index mark #4, and a Yes vote for any filled-in ovals next to index mark #5. On Election Night, poll workers would have printed out voting-machine tapes showing 4,440 (81.7%) no votes and 992 (18.3%) yes votes. The referendum would have failed. No recount would have been ordered because the results were far outside the recount margin. Because referenda are never included in the very few post-election audits performed after some of Wisconsin s elections, no one would ever have verified the count. The local newspaper might have written an editorial expressing surprise at the upset, but giving three good reasons why Stoughton voters rejected the referendum that was so popular everywhere else. The ballots would have remained sealed in the basement for the remainder of the retention period, and then destroyed without anyone ever looking at a single ballot. How many times do you suppose such a mistake has changed the outcome in other elections, in other jurisdictions? No one knows the answer to that question, because in Wisconsin, we never check the accuracy of referenda results that are outside the recount margin

6 Now, about those 16 votes Phantom votes can be created by voting machines for several reasons. Ink from a very wet pen might soak through the ballot paper, creating a dark mark on the other side of the ballot that looks like a vote to the voting machine. Voters might leave random smudges and false marks. The rubber wheels that move the ballot through the voting machine sometimes get soiled and leave trails on the ballots that might register as votes. Imperfections in the paper stock, fold marks, ink transferred from another document or from one part of the ballot to another when it was folded could cause smudges that register as votes. A brief investigation by the Wisconsin Election Integrity Action Team, with the cooperation and support of the Stoughton municipal clerk ruled out every possible visible cause for the 16 phantom votes. Douglas Jones, associate professor of computer science at the University of Iowa and nationally recognized expert in elections technology, then reviewed our observations and informed us that when paper moves through a voting machine, it sheds fibers. Those fibers can collect in clumps dust bunnies which blow around inside the voting machine for a while, causing random votes to be recorded by the machine s sensors until the dust bunnies are expelled or get stuck somewhere. Dust bunnies make a nice segue to the next story, which highlights the possibility of voting-machine malfunction

7 Malfunction: The Bronx Miscount In early 2011, a student at the NYU Law School was doing a project that required him to work with election results. He noticed official tallies for a polling place at Public School 65 in the Bronx indicated many more ballots than votes in both of the two most recent elections a primary and a general election in Quick arithmetic indicated that, if the voting machines were to be believed, as many as 70% of the voters had cast blank ballots. The Brennan Center at NYU Law School brought the obviously impossible discrepancy to the attention of the city Board of Elections. The board responded that the elections were over and there was no point in looking into the matter. So the law school team took the matter to the State Elections Board, which agreed with the local board: Water under the bridge; too late now. The law school team took the story to the New York Daily News, and that newspaper s editorial board took the issue to the public. Using the Freedom of Information Law, the newspaper compelled election officials to open the ballots to public inspection. The ballots, of course, indicated that nearly every voter had cast a correctly marked ballot. The state election board and the manufacturer, ES&S, issued their verdict: local officials must have carelessly allowed the ballots to get warped by leaving them on a radiator. In both elections. The city board then ran a test in which the machine counted perfectly even with ballots that had been allowed to sit on a radiator. The state Board of Elections then stepped in to investigate. Technicians calibrated the machine and ran ballots through. The device did fine. Finally, some

8 one realized they needed to replicate conditions on Election Day, and they ran a test in which ballots were fed through the optical scanner at a steady pace for several continuous hours. After about three hours, the machine began to fail with an error rate of close to 100%. The optical scanner was overheating and losing its calibration and its eyesight. Tested while cool, the count was perfect; allow it to heat up, and the count was nonsense. New York City used more than 3,000 of these machines, but their Board of Elections rejected a state recommendation that it audit results whenever a machine reported an unusually high number of invalid or blank ballots. Instead, poll workers were instructed to let each machine run for several hours before test-balloting before each election. ES&S told the state that they had redesigned the machines cooling system. Wisconsin used these same machines (still does), but did not check to see whether any of our election results had been similarly affected. (At least publicly; it s possible some diligent clerks checked on their own.) Notice several things: 1) Rather than being detected promptly by the responsible officials with routine verification procedures, the obvious miscounts affected two separate elections before they were detected by a student working on a school project. 2) Neither the local nor state elections authority was required to investigate the anomaly when it was reported to them. 3) There was no legal way to correct the election results after the results had been certified. 4) The first response of the state board and the manufacturer was to accuse the local officials of error with no real investigation. (In all states, this seems to be the routine response to miscounts.) 5) Although the miscounts were documented and determined to be caused by a flaw that affected many other jurisdictions, no effort was made to determine whether other elections had also been miscounted. Source:

9 Manipulation: The Washington DC Miscount With federal funding, the Washington DC Board of Elections and Ethics had in 2010 developed a new electronic voting pilot program called the DC Digital Vote-by-Mail Service. The consultants who developed the system assured the city that the security was the best possible. (For what it s worth, they might have been telling the truth about that.) Prior to deploying the system in the general election, the District held a unique public trial: a mock election during which the public was invited to test the system by casting realistic votes, and during which hackers were invited to test the system by attempting to compromise its security. For several days, city voters cast ballots with no difficulty, and city officials detected no other problems. On the fourth day, officials monitoring a citizens message board noticed a question: Does anyone recognize the tune that plays when you have finished casting your vote? Knowing that they had programmed no music in to the voting system, election officials halted the tests citing usability issues, took down the pilot servers for analysis, and tabulated the election results. The drunken robot Bender Rodriguez from the cartoon show Futurama who was not on the ballot had been elected to the Washington, D.C. school board. Doctoral students from the University of Michigan Computer Science and Engineering department told the full story in a paper 1 presented to the 16th annual Conference on Financial Cryptography & Data Security in February The Michigan team revealed that within a few hours, they had gained access to the District s servers and started the work of detecting passwords. While doing this, they detected the presence inside the computer of other hackers working from IP addresses in Iran, New Jersey, India, and China and blocked their further progress. Within 48 hours, they had gained near-complete control of the election server, successfully al

10 tered the software to control the election results, and left their calling card --the University of Michigan Fight Song. After discussions with the University of Michigan computer scientists, the Washington DC Board of Elections and Ethics discontinued its plans to deploy the system. Wisconsin elections law wisely forbids voting machines to have wireless communications capacity operating on Election Day. However, no one checks to make sure the machines have this capability not installed or disabled. In addition, the software that counts our votes is out of the control of our elections officials whenever it is being manufactured, installed, or updated by private vendors. Unless these firms have IT security practices markedly better than Anthem, ebay, Target, Sony, and the US Department of Defense all hacking victims we cannot pretend our voting machines are guaranteed to be free of malicious software on Election Day. 1. jhalderm.com/pub/papers/dcvoting-fc12.pdf - 8 -

11 ----- Conclusion If we cannot prevent electronic miscounts, what s the point of telling these stories? Are we just trying to destroy voters and candidates trust in elections? No just the opposite. The point is this: Any time we use technology, we must manage it prudently and responsibly. In all other functions for which we use computers, without exception, managers and their customers have ways to notice computer errors and correct them before making irrevocable decisions. Only in elections do we pretend that computers can be so immune to the effects of unpredictable human mistakes, machine malfunctions, and malicious manipulation that we can safely use their unverified output as the sole basis of consequential, irreversible actions, such as swearing officials into office. The fact that voting machines can miscount is not surprising, and it s not the problem. The problem is that no one checks. Twenty other states require local elections officials to verify the accuracy of voting-machine output before they certify the election results as final; Wisconsin law merely allows it. Wisconsin voters and candidates need to insist that our local elections officials verify the accuracy of voting-machine output with routine, transparent post-election audits BEFORE they certify election results as final. The most effective, affordable way to protect our elections is just that obvious

12 - 10 -