Election Updates

Kentucky Secretary of State Trey Grayson wants to adopt no-excuse absentee balloting in Kentucky, with ballots going out one month before election day, the Lexington Herald Leader reported.

The Cincinnati Enquirer editorializes in favor of no-excuse absentee balloting in Kentucky. They downplay fraud concerns, but describe Oregon's vote by mail system as a poor fir for Kentucky's "bare knuckle" politics.

The American Association for the Advancement of Science (AAAS) held a forum last month on election reform. I was one of the participants and the AAAS has published an article about the forum in Science. I think the quote from Geri Mannion at Carnegie Corporation of New York (which has been a long-time supporter of election reform) summed up the issue the best.

The meeting at AAAS "illustrated you can bring a variety of disciplines together to tackle the continuing problems facing the U.S. election system, especially by teaming with those election administrators from the field willing to explore new and better ways to increase voter confidence in the system," said Geri Mannion, chair of Carnegie's Strengthening U.S. Democracy Program. "There are still a lot of challenges, but it's clear there are solutions, if talent and funding can continue to be invested in ensuring that all American voters have the election system they deserve."

After a long wait, and intense U.S. govermental scrutiny, Smartmatic Corporation announced that it will put Sequoia Voting Systems up for sale. This should effectively end the examination of Sequoia's ownership structure (examination that had been going on for some time by the U.S. Committee on Foreign Investment in the United States).

Here are a few details from the Chicago Tribune:

The companies also said they will withdraw from a review process now under way by the Committee on Foreign Investment in the United States, a panel of 12 government agencies that earlier this year reviewed an attempt by a United Arab Emirates company to take over operations at six U.S. ports.

Sequoia and Smartmatic, which are privately held, had come under review several months ago because of questions about alleged ties to the leftist government of Venezuelan President Hugo Chavez. The inquiry, which will now be dropped, was to determine whether the Venezuelan government has any control or influence over the firm's operations.

Company officials said the controversy over foreign ownership was distracting for both Sequoia and Smartmatic, and was "taking a lot of time from senior management."

For those of you with a wad of cash, and someone special still on your holiday shopping list, this could make for a thoughtful present.

On the serious side, it's hard to see at this point what effect this will have on the voting system industry. This investigation, while clearly a difficult one for Sequoia, might lead to more openness and transparency for Sequoia, once it is acquired by some new entity. I'd hope that this will also serve as a signal to the industry that being open and transparent about their corporate operations is a critical issue as we continue the long process of election reform in the United States. Perhaps voting system companies will step forward now, developing and implementing strong corporate ethics policies --- or perhaps the industry can get together and develop some ethics guidelines that will help them navigate increased scrutiny and calls for more transparency.

UPDATES:

1. The full Smartmatic press release.
   
2. From the Miami Herald. The Miami Herald also has a pdf file of the Smartmatic announcement here.
   
3. Story from Forbes, focusing on the Committee on Foreign Investment in the United States.
   
4. Ian Hoffman (who has followed voting technology issues for the Oakland Tribune) and Barbara Grady, "Potential Buyers Can Cast Lot With Sequoia. This article has interesting information for all of you would-be buyers --- estimating that Sequoia has about 150 employees, and the following information on revenues: "Under its last owner, De La Rue PLC, Sequoia was losing money on revenue of about 23.1 million British pounds, or about $50 million. Those revenues were down by almost half the previous year's when, according to De La Rue, the Sequoia division brought in 44.2 million pounds, about $86 million. But the operating loss was much larger in 2003-04, at 1.9 million pounds, or nearly $4 million. Smartmatic executives said they turned the company around and quadrupled revenues to more than $200 million, with an undisclosed amount of profit."
   

Regarding my recent post about the Electronic voting systems, the National Institute of Standards and Technology (NIST), HAVA, and the EAC: I received an email correcting and amending my post, and thought I should share it here.

The reports and materials referenced in the NY Times story are available at NIST's website.

I've been told that the report which garnered so much press coverage is not an official NIST document. To quote from the email:

Though not available on the EAC site, the reports are available on the NIST site (. I want to take a minute to point out though that the original report authored by NIST and the Security and Transparency Subcommittee (STS) of the TGDC (PaperOnSIinVVSG2007-20061120.pdf), that got so much press was not an official NIST position as explained by NIST Director William Jeffrey in his testimony to the EAC last week -remarks.pdf) and by the QA website NIST posted to try to clarify some of the misunderstandings of the report information public_affairs/factsheet/draftvotingreport.htm

Most importantly though, the TGDC adopted as well as voted down a number of resolutions:
http://vote.nist.gov/AdoptedResolutions12040506.pdf

http://vote.nist.gov/failedres12040506TGDC.pdf

Thanks to the contact! We at election updates are always trying to keep things accurate and informative. We appreciate it when we're emailed corrections and amendments. Keep them coming!

My friend, E, has responded to our request of sharing her pollworking experiences with us. Below is her account of Election Day 2006 experiences in California.

Today I ran into Tina, the area coordinator for my polling station. She gave me the coda to the story that follows.

I am a poll worker, one of those thankless, by-the-end-of-the-day-godless individuals who greets you, escorts you through the voting process and, if need be, takes your wrath for mishaps.

During the recent Gubernatorial Election in the Golden State, I was once again paired with several of the same poll workers as during the primary, as well as, alas, our Poll Inspector (PI), who shall, as will everyone but Tina, remain nameless. You’ll understand why and should you be unable to you really need to spend a 15 plus hour day in my shoes. Or sandals. I think it was sandals.

At orientation, we were told that the starting time on our letters of congratulations (Congratulations! You are now a poll worker! – No, really, it says that or something like it) was a mistake. We were to show up at 6:00 a.m., not 6:30 a.m., so, like the dutiful, godless worker I am, I rose early, dressed business casual and arrived at the nearby elementary school library at 6:00 a.m.

I sat there in the heated library, alone, for about forty minutes. At 6:30, our official or not start time, I called the number we were given for help, stated my name and polling station number, and said that I was alone, I couldn’t get a hold of my PI (just his answering machine). It wouldn’t have been so desperate a situation if there had been equipment to set up, but there was nothing to do but wait. It takes about an hour to set up. In theory – I’ve never had that hour thanks to our PI.

When another colleague poll worker arrived, and then a close friend of the PI’s who’d been corralled into working showed up, we piled into my car and drove to the PI’s house (the location of which his close friend knew). We found him dressed, but injured in one of his feet, and nothing loaded into his car. It was 6:45 a.m. We were supposed to open at 7:00 a.m.

The injury was never explained fully. I begrudge no one his health or lack thereof, but he had our phone numbers and, in case of an emergency, he was to have called us. This, I should add, is the second time he caused a late start at our polling station. The first excuse was that a friend of the family had died the night before. Granted, I understand this need to mourn, but, again he had our numbers and did nothing to ensure that the polling station would open on time during the primary.

We loaded as much as we could into my car, drove back, and slammed together the voting booths. I was most concerned about the InkaVote Plus scanner. This new device scans each ballot and tells the voter only one of three things:

1. You voted correctly (i.e. there were no over votes on the ballot and you voted for only one candidate per category).
2. You didn’t vote at all (achieved by not pushing the InkaVote wand far enough to make contact with the ballot).
3. You over voted (you voted for more than one candidate per office).

We were told this machine takes a while to warm up. We also had to do a systems check before we could actually use the scanner, but we didn’t pick up the InkaVote Plus system in our batch of voting equipment.

We had to turn away angry voters who had come in early to vote before work. One woman was furious and I can’t blame her. “I would have voted absentee if I’d known this would happen. This is the only time today I can vote!”

Fortunately, we had grabbed the sample ballots that we use to demonstrate the process. They are legally binding; we are told to use them should we run out of the actual ballot. So I suggested she cast her vote provisionally. She was still huffy, but agreed and was our first voter once we got a booth up and operational.

Other voters who walked off muttering returned later that day. They were few in number and whenever I recognized one, I thanked them for their patience that morning and their commitment to our way of voting.

Our PI eventually showed (about 7:30) and Tina, who had arrived by then as well to help us out, let him have it. In a very professional, voice held low way, she and the PI entered into a heated discussion about his responsibilities. He claimed he had told her about his foot; she said that it was his duty to contact his staff (us) for help.

We had only one other problem and it, too, has occurred before. Our polling station is in an area with many Armenians. At both the primary and gubernatorial election, we had one man come in who spoke about five words of English. The first time it took an hour before someone had the bright idea to call the main office for a translator, but this time there was an Armenian couple casting their votes, and they translated for me. The gentleman in question had over voted in a category and, by law, we were required to offer him another chance. Legally, we give you three chances, and then you’re done. He declined and left, but I was grateful to the couple that translated so we could fulfill our legal obligation.

The day, in between setting up and tearing down, was actually pretty cool. Parents brought their young children and they loved the InkaVote Plus as it sucked the ballot down (or spit it out! They loved it!). I had to explain more than once that the InkaVote Plus was not tallying votes, but merely making sure the ballot was valid.

And, now, for that coda.

I ran into Tina today at Target. She let me know that our PI lost the red box. This, to the uninitiated, is the box that actually holds the cast ballots. The PI’s last duty of the day is to load his car with the equipment and, alone, take both the equipment and red box to the drop off point. From there the ballots are squirreled away to the magical area where the computers scan the ballots and count the votes.

Apparently, our PI had not cleaned out his car prior to the election (despite being told to do so at the orientation); it was full of his mother’s stuff, and, whatever, and he demanded that one of us follow him with the rest of the equipment. As he and Tina got into another discussion about responsibility (only one car per polling station is supposed to go to the drop off point), I bid everyone good night and went home.

Today Tina let me know about the lost red box, her promotion (deserved from what I saw) and that our PI probably wouldn’t be back. Hurrah!

The day in total was closer to 16 hours long (not the advertised 15 hour day). The votes must be reconciled against the voter registry and the number of ballots torn from the packs, and that was a blood letting, let me tell you.

Still, I know I’ll do it again, even if it is like working in a sausage factory. If you don’t know the adage, it runs like this, “I like sausage; I don’t want to know how it’s made.” Well, that’s democracy. It may be enough to make you become a vegetarian, but just hold your nose and vote. If you don’t vote, you can’t complain.

The Georgia State Election Board has been holding a series of hearings about electronic voting across the state. Yesterday, I testified in Macon about voter-verified paper audit trails and electronic voting. The panel before me--with Election Supervisors Lyn Bailey from Richmond County and Nancy Boren from Muscogee County--was quite good. Lyn explained the security procedures used at the local level to maintain the chain of custody and integrity of the electronic voting machines in the state. Nancy did a very dynamic presentation explaining the differences between punch card, optical scan, and electronic voting and how paper systems involve a two stage voting process--the voter votes but the machine or poll worker interprets the vote--but DREs have a one-stage process.

I talked about public attitudes regarding voter verification and election auditing. My entire presentation is available here, but the key questions I raised are below.

There are several issues associated with auditing elections.

· First, the state needs to determine the purpose of the audit. If the purpose of the audit is to identify the likelihood that fraud has occurred in a given race, then the counties will have to audit a high percentage of ballots in small population races and a slightly lower percentage in races that are statewide. In local partisan races, it might be necessary to audit almost 100 percent of ballots to be confident to a statistical 99 percent confidence level that the election was free of fraud. For statewide races, it might be necessary to do a smaller, but still substantial percentage of ballots to ensure that no fraud occurred.

· Second, the state will need to have chain of custody requirements for the VVPAT canisters. This would include legally binding standards for sealing the canister before the election, running a zero-report on the tape before voting commences, securing the canisters after the election, and securing the tapes once the election is complete.

· Third, the state will need to determine explicitly what the legal status of the VVPAT is going to be should a discrepancy arise. Given that we know that there will be jams and problems with the paper, states need to have a process or legal standard set forth for handling paper tapes that are damaged and how such ballots will be handled in a recount or audit. Related to this, the state statute needs to explicitly state if the VVPAT is to be used strictly for audits or as a ballot form.

· Fourth, the state should treat paper ballots—in Georgia’s case, provisional or absentee ballots—the same as electronic ballots for auditing purposes. There are numerous examples—such as the 2000 election in Florida—demonstrating that the need for auditing elections is as great for paper-based voting as it is for electronic voting.

· Fifth, should the audit turn up a problem, the state needs to have explicit requirements for what next steps should be followed. For example, if the state conducts a one-percent audit and there is an error found in a single race, is the entire race audited 100 percent? Is that audit conducted statewide or just within the jurisdiction where the error is found?

· Sixth, the state should determine if it also plans to do real-time auditing by implementing parallel monitoring. California provides an example of how such a system can be implemented.

The European Union's Election Observation Mission has released a preliminary statement on the 2006 presidential election in Venezuela. The statement provides a generally positive assessment of the conduct of the recent election.

This is from the report's Executive Summary:

1. The electoral process complied in general with international standards and with national legislation as regards the management of the electoral administration and the electronic voting system. The high turnout in the Presidential Elections, and the peaceful environment in which they were held, together with the candidates’ acceptance of results, open the way forward to improvements in the confidence that the general public has in the electoral processes, as well as their quality, and to dialogue between the main institutional and political stakeholders in the country.

2. The EU EOM applauds the efforts made by the new Board of Directors of the Consejo Nacional Electoral, appointed in April 2006, the political parties, and civil society movements, in creating sufficient conditions to hold elections that are acceptable to all stakeholders, factually demonstrating their desire to reach agreements on crucial aspects of the electoral process.

3. However, the EU EOM, has observed persistent problems during the campaign, such as the widespread institutional propaganda in favour of the President, and candidate, Hugo Chavez, and, to a far lesser extent, in favour of the Governor of the State of Zulia, and candidate, Manuel Rosales. Similarly, the Mission has noted an imbalance in the political coverage offered by the media, both public or private, and the CNE’s inactivity in attempting to redress the situation; as well as the participation of public officials in campaign activities for the incumbent candidate, be it of their own free will, or due to pressure from third parties.

4. The electronic voting system established in Venezuela is efficient, secure, and auditable, and the competence of its technical experts is consistent with its advanced technological level.

5. The use of fingerprint readers (captahuellas) neither violates the secrecy of the vote, nor is a source of fraud. On the other hand, they are not directly relevant in the exercise of the right to vote; furthermore, they are not nor trusted by a significant part of the electorate, and in certain cases, they led to unnecessary queuing during Election Day.

6. EU EOM observers evaluated the quality of the electoral process positively in 85% of the polling stations visited on Election Day. Similarly, the appraisal of polling station officials, regarding their knowledge of electoral procedures, was positive in 76% of cases, which leaves a margin for improvement in the management of the electoral process. No major problems were detected regarding the audit of closing, the random selection of polling stations, and the subsequent counting of voting receipts. The correct number of ballot boxes was audited in all visited polling stations.

Peter Ryan gave a talk at MIT on December 1, on "Advances in Verifiable Voting Schemes." MIT has made a webcast of Ryan's talk available (though the current video has a long introduction, be patient!).

Here's the abstract of Ryan's talk:

For centuries, the democratic process has largely been taken for granted and implicit trust has been placed in the paper ballot approach to casting and counting votes. In reality, the democratic process is one of considerable fragility, as the recent US presidential elections demonstrate.

For over a century, the US has been using technological approaches to recording and counting votes: level machines, punch cards, optical readers, touch screen machines, prompted largely by widespread corruption with paper ballots. All have been prey to various scams and forms of corruption or just plain malfunctions. Reports from Johns Hopkins and Princeton have demonstrated that many of the touch screen devices currently deployed in the US are wide open to virtually undetectable corruption.

In this talk I will discuss recent advances in cryptographically based, voter-verifiable schemes. These strive to provide high
assurance of accuracy whilst preserving ballot secrecy whilst requiring minimal trust in hardware, software, officials etc. Voters are able to confirm that their vote is included in the tally whilst having no way to prove to a third party how they voted, thus ensuring coercion-resistance.

In particular, I will outline the Prêt à Voter scheme and describe a number of vulnerabilities identified with the 2005 version. I will then describe enhancements designed to counter these vulnerabilities. These include the distributed generation of Prêt à
Voter ballot forms in encrypted form, on demand decryption and printing of forms, re-encryption mixes for tabulation, and a variant of Adida/Rivest off-line auditing.

Ron Rivest sent along a link to a paper that MIT students Harvey Jones, Jason Juang and Greg Belote produced for their term project for Ron's class on "Computer and Network Security." The paper, "ThreeBallot in the Field", describes some testing these students conducted of the "ThreeBallot" system (here's a link to Ron's paper on "ThreeBallot"). Here's the paper abstract:

Voting systems have been the sub ject of much recent controversy. Due to the difficulty of securing and auditing electronic voting systems, a variety of different paper-based cryptographic voting schemes have emerged. Ronald Rivest has proposed a purely paper-based system called ThreeBallot, which strives to achieve the same level of security as cryptographic systems without using cryptography. Although ThreeBallot has been sub ject to academic criticism, it has not been tested in the field. This paper describes a paper-based and a computer-aided implementation of ThreeBallot. Any successful voting system must be usable, must be secure, and must preserve the secret ballot. To test usability, we held mock elections and observed voters. To test security and privacy, we executed attacks against these mock elections.

In one mock election, 20% of voters successfully sold their vote. One student, when given control of tallying the votes, was able to throw the entire election. In our usability studies we confirmed voter difficulty in using ThreeBallot. We found that about 10% of voters didn’t understand ThreeBallot well enough to check another’s ballot, and in one mock election more than 30% of voters failed to cast a valid ballot on their first try.

I asked Ron about his reaction to this research, and this is what he sent along:

"Yes, the students did an excellent job with this study. The usability results are very interesting, although not so surprising---ThreeBallot was understood from the beginning to be weak on usability. The security aspects of their study are also fascinating, reflecting as they do in the real world the theoretical vulnerabilities discussed in the original paper. The next iteration of ThreeBallot (paper forthcoming, to be co-authored with Warren Smith) should show substantial improvements in both usability and security, compared to the original proposal (stay tuned...). In any case, however, ThreeBallot represents a major qualitative step forward, achieving end-to-end auditability without the use of cryptography..."

Good work by these students! This is great evidence about how the folks like Ron are training the next generation of voting technologists! I for one will stay tuned for the next iteration of "ThreeBallot" --- and will certainly pass along the next iteration when it is available.