Saturday, November 26, 2005
Diebold "hack" initiated by California Secretary of State?
Reports have been circulating since earlier this week that California's Secretary of State, Bruce McPherson, has asked Harri Hursti (from Finland) to try to "hack" a randomly selected Diebold voting machine. I first started hearing of this earlier this week, and at that time could not find any confirmation of this request. But this morning the story started to circulate on the newswires, and through a variety of news outlets. For example, here is the Associated Press story, as provided online by MercuryNews.com. There is a longer version of the story provided by the San Francisco Chronicle. I could not find any confirmation of this request on McPherson's website, nor any official statement or elaboration of this test.
Thus, at this time, details of the test are a bit sketchy. The wire reports indicate that one Diebold precinct voting device, from one of the California counties using these voting machines, will be selected randomly for the test. But exactly what methodology the "hack" will involve is not known; whether it will focus primarily on technology or procedures (or perhaps both) is not known; nor is it clear what information will be provided to the public about this "hack" once it is completed (for example, will we know how many attacks are attempted, what types of attacks they are, and about the outcome of each attack?). It is unclear from the available information whether the vendor will be involved in the "hack" (other than the report that the vendor was not allowed to pick the exact voting device that will be used in test); also unclear is the extent of election official (state or local) involvement in the "hack". It is also not clear whether the same type of "hack" will be initiated for other voting devices, either those now certified for use in California or those pending certification.
In any case, perhaps more about this "hack" will be revealed in next week's "Voting System Testing Summit 2005", sponsored by McPherson's office. That might be a good opportunity to hear more discussion about the role of "hacks" (also known as "red team" or "tiger team" attacks), as part of a broader process of assessing the overall operational security of a voting technology. I'll be attending this conference, and I am moderating a session on "Security/Paper Trails/Accountability". Panelists on our Tuesday afternoon session include Kim Alexander, Henry Brady, David Dill, Avi Rubin, and Michael Shamos. We have been asked to address five different questions:
It will be an interesting discussion, and I'll do my best to try to summarize this session, as well as the entire conference, next week.
Thus, at this time, details of the test are a bit sketchy. The wire reports indicate that one Diebold precinct voting device, from one of the California counties using these voting machines, will be selected randomly for the test. But exactly what methodology the "hack" will involve is not known; whether it will focus primarily on technology or procedures (or perhaps both) is not known; nor is it clear what information will be provided to the public about this "hack" once it is completed (for example, will we know how many attacks are attempted, what types of attacks they are, and about the outcome of each attack?). It is unclear from the available information whether the vendor will be involved in the "hack" (other than the report that the vendor was not allowed to pick the exact voting device that will be used in test); also unclear is the extent of election official (state or local) involvement in the "hack". It is also not clear whether the same type of "hack" will be initiated for other voting devices, either those now certified for use in California or those pending certification.
In any case, perhaps more about this "hack" will be revealed in next week's "Voting System Testing Summit 2005", sponsored by McPherson's office. That might be a good opportunity to hear more discussion about the role of "hacks" (also known as "red team" or "tiger team" attacks), as part of a broader process of assessing the overall operational security of a voting technology. I'll be attending this conference, and I am moderating a session on "Security/Paper Trails/Accountability". Panelists on our Tuesday afternoon session include Kim Alexander, Henry Brady, David Dill, Avi Rubin, and Michael Shamos. We have been asked to address five different questions:
- Evaluating security --- how to do it best
- Recovery process/contingency plans
- Source code --- how much should be reviewed? By whom?
- Standards for AVVPAT
- For what purpose should AVVPATs be used?
It will be an interesting discussion, and I'll do my best to try to summarize this session, as well as the entire conference, next week.
Wednesday, November 23, 2005
The Poll Worker Factor
I recently gave at talk to my colleagues at the University of Utah about the impact that poll workers have on public confidence in elections. The powerpoint slides from the presentation are here.
This summer I did a study with two colleagues from BYU--Quin Monson and Kelly Patterson--where we implemented an internet survey of voters who had cast ballots in the 2004 general election at a polling place in Utah. Quin and Kelly run an exit poll project and in 2004, a random sample of individuals did not complete an exit poll; instead, they provided their email address and basic demographics. Utah has the nation's highest internet penetration, making it an excellent population to survey online.
In the survey, we asked four types of questions: (1) their political preferences about candidates and issues, (2) their experiences at their polling place in 2004, (3) how confident they were that various aspects of the electoral process were fair, and (4) demographic information.
What we found was that poll workers have a very significant impact on how confident people are that their ballot was counted accurately, that the election was run fairly, and that democracy works in the state. It was the second most important factor in the analysis, after partisanship. (Not surprisingly, Republicans were more confident than Democrats in a state run by Republicans!)
If you study polling places regularly, as Mike and I both do, you often see instances where poll workers implement the rules in their own way. In fact, researchers at Loyola-Marymount in Los Angeles found this to be the case in a report published in 2004. For example, poll workers were asking voters for ID in a small but sizable number of polling places, even when doing so was counter to California law. Not surprisingly, problems occurred more often in low income and minority communities.
Poll workers can be seen, therefore, as having the ability to add to the cost of voting for some voters. If a voter has a bad experience at the polls, it may not make voting so costly that they do not vote again, but it could. It could also drive them to vote in another way--such as by absentee ballot--or it may merely make them less confident in the way government works.
One problem with studying elections today is that we know so little about poll workers. However, this study does help us see that the need to study poll workers is great, because the voter-poll worker interaction clearly affects the way people view important aspects of the electoral process.
This summer I did a study with two colleagues from BYU--Quin Monson and Kelly Patterson--where we implemented an internet survey of voters who had cast ballots in the 2004 general election at a polling place in Utah. Quin and Kelly run an exit poll project and in 2004, a random sample of individuals did not complete an exit poll; instead, they provided their email address and basic demographics. Utah has the nation's highest internet penetration, making it an excellent population to survey online.
In the survey, we asked four types of questions: (1) their political preferences about candidates and issues, (2) their experiences at their polling place in 2004, (3) how confident they were that various aspects of the electoral process were fair, and (4) demographic information.
What we found was that poll workers have a very significant impact on how confident people are that their ballot was counted accurately, that the election was run fairly, and that democracy works in the state. It was the second most important factor in the analysis, after partisanship. (Not surprisingly, Republicans were more confident than Democrats in a state run by Republicans!)
If you study polling places regularly, as Mike and I both do, you often see instances where poll workers implement the rules in their own way. In fact, researchers at Loyola-Marymount in Los Angeles found this to be the case in a report published in 2004. For example, poll workers were asking voters for ID in a small but sizable number of polling places, even when doing so was counter to California law. Not surprisingly, problems occurred more often in low income and minority communities.
Poll workers can be seen, therefore, as having the ability to add to the cost of voting for some voters. If a voter has a bad experience at the polls, it may not make voting so costly that they do not vote again, but it could. It could also drive them to vote in another way--such as by absentee ballot--or it may merely make them less confident in the way government works.
One problem with studying elections today is that we know so little about poll workers. However, this study does help us see that the need to study poll workers is great, because the voter-poll worker interaction clearly affects the way people view important aspects of the electoral process.
Qualitative evaluation of Buenos Aires e-voting pilot project available
My initial report on the recent Buenos Aires e-voting pilot project is available, as is my photographic collection, and some of the initial data and statistics on pilot project participation that I was recently provided. The initial data consist of graphs that give the participation in the pilot project by age, by gender, by pilot system prototype used, by voting location, and by educational attainment level.
There is a great amount of detail in my report, covering the background of the project and the international observation mission that I participated in. The six key recommendations are:
Folks closely involved with the project say that more detailed data will soon be available ... when I have a chance to work with the pilot project data, I'll certainly post additional analyses and reports here!
There is a great amount of detail in my report, covering the background of the project and the international observation mission that I participated in. The six key recommendations are:
- Much care is needed in analysis and study of the evaluation data.
- Determine the extent of usability problems.
- Take a careful look at the optical scanning system.
- Develop and implement proceduresfor physical security.
- Develp and implement procedures for pilot testing security.
- Continue pilot testing, but narrow down the number of options being tested.
Folks closely involved with the project say that more detailed data will soon be available ... when I have a chance to work with the pilot project data, I'll certainly post additional analyses and reports here!
Monday, November 21, 2005
Election odyssey: lesson three, maintaining voter privacy
Something that I doubt occurs to many who are interested in election reform and election administration are the on-the-ground complexities of precinct voting. I mentioned a few in "lesson two" of this series of essays, and will have more to say about this general issue in later essays as well. But overall, two general conclusions that I've reached having observed many precinct voting operations over the past few years are that every precinct voting situation is unique, and that layout of the voting operation can be one of the most important issues determining a successful precinct voting situation from a pathological precinct voting situation.
One of the issues of precinct voting layout is the placement of the voting devices in the precinct. A very typical layout is shown in this photograph from the California special election, showing the touchscreen voting devices in a Riverside County precinct (Corpus Christi Catholic Church, 3750 McKinley Street, Corona, California). To the far left is the table where the polling place workers sat, facing the voting devices.
This was a very small voting precinct, located in a small space. From my perspective, located right next to the polling place worker table, I could very easily see the information that was being rendered to the screen of four of the five voting devices. In fact, you can relatively easily see the starting screen on most of the voting machines in the photograph. If I could see these screens from where I was located, so could the polling place workers.
While I don't have precise quantitative data on how many voting machines seemed to be easily visible to polling place workers or observers, it certainly is not rare. Here is a second Riverside County example, from St. John's Episcopal Church, 526 Magnolia, Corona, California. Again, the poll workers sat to the left of the photo, facing the voting machines. While the interior space of this voting location was much larger than that of the Corpus Christi Catholic Church, in both locations one could see the screen of the voting devices from where the polling place workers were located, and what was being rendered on those screens.
This represents a dilemma of sorts for election administrators. On one hand, we need to insure that voters have the opportunity to cast a secret and private ballot, at least under current laws and regulations. That principle requires that the choices being made by a voter should not be visible to polling place workers or to any observers. But on the other hand, the polling place workers do need to be able to observe what voters are doing while voting, to insure that voters are not tampering with the voting devices and to be in a position to easily provide assistance when needed.
The bottom line is that we need more analysis of polling place layout, in particular of the placement and orientation of the voting devices themselves. We might also need to more carefully analyze the physical nature of the voting devices themselves, including how they are equipped to insure that voter privacy is maintained. As our observations have made clear, privacy is not a principle that is easy to maintain with contemporary polling place practices.
One of the issues of precinct voting layout is the placement of the voting devices in the precinct. A very typical layout is shown in this photograph from the California special election, showing the touchscreen voting devices in a Riverside County precinct (Corpus Christi Catholic Church, 3750 McKinley Street, Corona, California). To the far left is the table where the polling place workers sat, facing the voting devices.
This was a very small voting precinct, located in a small space. From my perspective, located right next to the polling place worker table, I could very easily see the information that was being rendered to the screen of four of the five voting devices. In fact, you can relatively easily see the starting screen on most of the voting machines in the photograph. If I could see these screens from where I was located, so could the polling place workers.
While I don't have precise quantitative data on how many voting machines seemed to be easily visible to polling place workers or observers, it certainly is not rare. Here is a second Riverside County example, from St. John's Episcopal Church, 526 Magnolia, Corona, California. Again, the poll workers sat to the left of the photo, facing the voting machines. While the interior space of this voting location was much larger than that of the Corpus Christi Catholic Church, in both locations one could see the screen of the voting devices from where the polling place workers were located, and what was being rendered on those screens.
This represents a dilemma of sorts for election administrators. On one hand, we need to insure that voters have the opportunity to cast a secret and private ballot, at least under current laws and regulations. That principle requires that the choices being made by a voter should not be visible to polling place workers or to any observers. But on the other hand, the polling place workers do need to be able to observe what voters are doing while voting, to insure that voters are not tampering with the voting devices and to be in a position to easily provide assistance when needed.
The bottom line is that we need more analysis of polling place layout, in particular of the placement and orientation of the voting devices themselves. We might also need to more carefully analyze the physical nature of the voting devices themselves, including how they are equipped to insure that voter privacy is maintained. As our observations have made clear, privacy is not a principle that is easy to maintain with contemporary polling place practices.
Indian "Electronic Voting Machine" voter education videos
There are currently elections ongoing in the Indian state of Bihar, and in doing some research on these elections and the procedures used in their electoral system, I stumbled across some very interesting voter education and information videos regarding the Indian "Electronic Voting Machine" (if you are not familiar with the Indian EVM, see their descriptive material).
If you have a very fast Internet connection, you should check out their education videos, especially the "Spots & Aayee Vote Machine" video (I watched it in English, of course!). If you do download this video collection, you should look out for a one-minute clip near the front of the file, titled "Aui Vote Machine (Song-1)". This is one of the funniest voter education spots I've ever seen, with a really catchy song, a fun dance, and a guy dressed up as the Indian EVM, moving his arms up and down like a robot!
But again, don't try to download these clips unless you have a very fast Internet connection. I will try to get these videos on our website for faster download, and if successful, I'll post a notice here.
If you have a very fast Internet connection, you should check out their education videos, especially the "Spots & Aayee Vote Machine" video (I watched it in English, of course!). If you do download this video collection, you should look out for a one-minute clip near the front of the file, titled "Aui Vote Machine (Song-1)". This is one of the funniest voter education spots I've ever seen, with a really catchy song, a fun dance, and a guy dressed up as the Indian EVM, moving his arms up and down like a robot!
But again, don't try to download these clips unless you have a very fast Internet connection. I will try to get these videos on our website for faster download, and if successful, I'll post a notice here.
