Rolling the dice

“Electronic systems simply aren’t up to the job of voting. The only thing the computer is good for is as a fancy ballot printer.”

— Computer expert Rebecca Mercuri of Harvard’s John F. Kennedy School of Government

When you cast your ballot on a touch-screen voting machine, can you be confident that your vote has been accurately recorded? A growing controversy is raising serious questions about both the security and accuracy of electronic voting.

At its April 17 convention, the Buncombe County Democratic Party passed a resolution calling for all voting machines used in North Carolina to be equipped with a voter-verifiable recording device that produces a paper record to help ensure accurate, honest vote counts.

Delegate Anne Walch, a co-sponsor of the resolution, told Xpress. “It is deeply concerning that the most fundamental component of our democracy, voting, has been handed over to private corporations via their electronic machines, with proprietary software that is highly vulnerable to tampering. We must have voter-verified paper ballots that will allow a permanent record of a voter’s ballot and … meaningful recounts. Anything else puts our democracy at risk.”

This week, Sen. Ellie Kinnard (D-Chatham, Orange) and Rep. Verla Insko (D-Orange) will propose legislation in the N.C. General Assembly that would require such a paper trail in time for the November election.

In a recent interview, Buncombe County Director of Elections Trena Parker told Xpress that there’s never been a problem with the local machines. Asked how she knows this, Parker said: “We haven’t had any complaints from voters or precinct workers. That’s a pretty good indication that the system is working well.”

Yet a growing chorus of authoritative voices worldwide maintains that the type of machine used here (known in the industry as direct-record electronic devices, or DREs) is inherently unreliable and prone to tampering in ways that couldn’t even be detected.

Rebecca Mercuri, a specialist in voting systems and a research fellow at Harvard’s John F. Kennedy School of Government, told London’s Independent last year: “There are hundreds of ways to embed a rogue series of commands into the code and nobody would ever know because the nature of programming is so complex. The numbers would all tally perfectly.”

And in 2001, the Voting Technology Project — a joint venture of Caltech and MIT — issued a series of research papers concluding that of the five voting methods currently in use (hand-counted paper, mechanical lever machines, punch-card ballots, optically scanned paper and electronic voting machines), none worked as reliably as manually counting paper ballots. Between 1988 and 2000, lever machines had the worst track record, these researchers reported, with electronic systems running a close second.

Accordingly, some also question whether voting machines are even needed, since numerous studies have found hand-counted paper ballots to be the most secure and accurate system.

On April 30, California Secretary of State Kevin Shelley imposed a statewide ban on electronic voting for the 2004 general election. The same day, Ireland announced a similar decision about its upcoming vote. Venezuela and the Philippines have also recently scrapped their DREs. And Fortune magazine labeled paperless voting the worst technology of 2003.

Closer to home, High Point Enterprise Editor Tom Blount wrote in a May 9 editorial, “You may be just as successful voting on a one-armed bandit.”

How would we know?

Buncombe County voters have used Sequoia Pacific AVC touch-screen machines since 1997, when the county replaced its old lever-type machines.

Assistant Director of Elections Marvin Hollifield explains that although the county had considered electronic machines back in 1985 as an alternative to buying more lever-type machines (used locally since 1954), “We decided the technology was still in its infancy and that it was better to let someone else work out the bugs first.”

But the 1996 election proved very difficult, says Hollifield. “There were so many races on the ballot that we didn’t have enough room on the lever machines, which raised the possibility of using an additional paper ballot.” It was also becoming hard to get parts for the older machines, he said.

During last November’s election, however, this reporter was the first voter to cast a ballot in Asheville Precinct No. 1. After the machine appeared not to record my vote, I reported it to a poll worker, who flipped a switch and let me vote again.

When Xpress asked Trena Parker how the board would know if a computer glitch or vote fraud had occurred, she replied, “Our machines are not networked” — meaning it would be difficult for someone to introduce a software change into all of them at once. (Some systems are networked or even Internet-connected, making it easier to introduce systemwide changes — whether by accident or intent.) Nonetheless, software “patches” are routinely issued by the manufacturer and installed on all Buncombe machines.

Pressed again about the difficulty of detecting software problems, Parker conceded that it isn’t possible to absolutely verify election results. Nonetheless, she expressed confidence in the machines the county uses.

When the system works as advertised, voters touch a screen and their choices are accurately tabulated on a removable cartridge inside the machine. At the end of the day, the machine prints out totals for each candidate or referendum question on the ballot, and the cartridge is removed. A master machine totals all of the cartridges for each precinct and also prints out vote totals. After that, separate couriers deliver the cartridges and printouts (to reduce the likelihood of their being altered en route) to the Board of Elections, where all the results can be compared and verified.

Sounds secure, doesn’t it?

But here’s the rub: There’s no way to double-check the system to determine whether it correctly recorded individual voters’ choices. You might vote for candidate A, the machine might register a vote for candidate B — and there’s absolutely no way to go back later and check. Then again, you might vote a straight ticket yet have the computer register votes for someone in the other party. We have no way of knowing, and there’s no data trail that can be traced during a recount, because only totals are recorded — not individual ballots.

A last-minute decision

In 1995, the Buncombe County Board of Commissioners appointed a Blue Ribbon Commission to study voting machines. Over the next year, the commission researched various available machines and, according to BRC member Bill Fishburne, chose the Optech Eagle — an optical-scan system using paper ballots. Voters mark the ballots using a No. 2 pencil, the machine scans and tabulates the votes, stores the paper copy, and immediately rejects mismarked or otherwise spoiled ballots. (Almost half the counties in the U.S. are expected to use optically scanned ballots in the 2004 election, according to a May 5 report from Election Data Services, a consulting firm.)

The Eagle system was tested in two Buncombe precincts in 1996 with mixed results. In the Fairview precinct, the company representative provided the wrong pencils, and “The machine rejected about eight of 10 ballots fed into it,” Fishburne recalls. “The chief judge at the Fairview precinct was dealing with all the people waiting to vote and didn’t know what to do. No one was there from the Board of Elections. The representative suddenly realized that the pencils were wrong and took off to find more somewhere.”

After that, commission members lost some of their enthusiasm for optical-scan systems; a year later, Fishburne reports, they’d settled on the UniLect Patriot DRE system. Then, at their final meeting, a new machine was introduced — the Sequoia AVC. “It was a choice made by Trena [Parker] at the last minute,” Fishburne told Xpress. The commission followed Parker’s lead and approved her recommendation 11-1.

Speaking to the county commissioners, Fishburne, who had cast the lone dissenting vote, said the group had been unhappy with many aspects of the AVC system, including its high cost and weight and the need to use paper ballots for curbside voting. He recently told Xpress, “It is a big box with a nice friendly face, but it is expensive and involves a lot of overhead cost in storage and transport.”

The UniLect, on the other hand, was found to be lightweight, easy to expand as precincts grew, easy to use and much less expensive.

After a PowerPoint presentation by Parker, however, the Board of Commissioners opted to spend an extra $1.1 million to buy the Sequoia AVC system.

Parker told Xpress that she hadn’t liked the UniLect system because it was “a brand-new company, only composed of two individuals” and Buncombe County would have been their biggest customer to date. Commissioners David Gantt and David Young stressed the latter point when speaking out against the system.

In addition, Parker noted that the UniLect system consists of a single central computer with multiple voting stations attached. “If the central module goes down, the entire precinct goes down.” The unit also lacked a built-in electrical backup that would kick in if there were a power failure, meaning the county would have had to buy one. And in time trials conducted by the Board of Elections, the UniLect took longer per voter, she said. Finally, UniLect hadn’t provided the county with the required financial-disclosure statements.

Fishburne, on the other hand, points out that the central-hub design means more voting stations can be added quickly and at minimal cost.

Unilect President/CEO Jack Gerbel attended the 1997 Board of Commissioners meeting at which the final decision was made; he says he offered to provide machines free of charge for a side-by-side test in that year’s primary election, but his offer was rejected. Instead the county commissioners voted unanimously to spend $2.7 million on the more-established Sequoia system versus $1.6 million for the contender.

In a recent interview, Gerbel told Xpress that UniLect clients now include both Cook County, Ill., and the city of Chicago, which between them have 5,000 precincts. (Buncombe County has 72.) “We have never had significant problems of any kind and have never lost a vote. Our track record is the best in the industry,” boasted Gerbel.

In a year-and-a-half of research on DREs, Xpress has never found a single mention of problems of any sort with the UniLect Patriot system.

Halifax County, Va., recently adopted the Patriot system and General Registrar Judy Meeler, who oversees the elections there, told Xpress: “We couldn’t be happier with the system. Voters talk about how much easier and faster it is than our old lever-type machines, and we use both the curbside and the visually impared units.” Meeler added, “One blind voter told me, ‘I feel like I’ve gotten some of my independence back.'”

Perhaps surprisingly, the lack of a recount mechanism on the Sequoia machines does not appear to have loomed large in Buncombe County’s decision on which machines to buy. Asked about it, Gantt replied, “We did study it, but it wasn’t a big issue at the time.” And several of the commissioners involved in the decision said they’d been assured that there were safeguards. “I remember that we were excited that this would speed up voting and results,” said Commissioner Patsy Keever. “The main concern at the time was speed.” Tom Sobol, then chairman of the Board of Commissioners, noted, “One of the things that precipitated [the decision] was lines and lines and lines of people waiting to vote at those old green machines.”

No protection?

Critics of DREs focus on two key issues: security and verification of results. If Buncombe County staged a recount, it would consist of simply rereading all the (possibly flawed) data to make sure the final totals agreed with the original tally. This would ensure that no individual machine’s totals were overlooked but would not necessarily detect other kinds of errors or manipulations.

One person — Marvin Hollifield — is responsible for programming all Buncombe County voting machines (using software supplied by Sequoia Voting Systems).

In an interview following the 2002 election, Hollifield outlined the county system for Xpress. He added: “After I program the machines, every one is tested by a few BOE employees. We divide them up between us. Each machine is tested up past 100 votes” to ensure accuracy into three digits.

But as Mercuri and other experts have repeatedly stressed, the problem with such testing is that a computer program can be written to activate a change at a specific time on a specific date — and subsequently remove all trace of the switch. Such a change would not show up in either pre- or post-election testing.

The Buncombe County Board of Elections Web site links to a lengthy defense of electronic voting prepared by the Election Center, a Houston-based nonprofit corporation that trains election workers and advises Congress and government agencies on election-process issues. Both Parker and Hollifield have attended Election Center training sessions.

In March, Executive Director R. Doug Lewis told the Philadelphia Inquirer that the center is supported by Sequoia Voting Systems, Electronic Systems & Software and “probably Diebold.”

In a report on her web site titled “A Better Ballot Box?” Mercuri writes: “Even more risky is the fact that at least one machine’s firmware, that of the Sequoia [AVC] Edge, can be reprogrammed through a port on the voting machine kiosk. Although this port is “secured” during the voting session by a flimsy, numbered, plastic tab, it is exposed after the election, providing essentially no protection against reprogramming.”

Sequoia has responded to the growing concern about DRE voting. Last November, for example, Wired News reported, “Sequoia has also produced a voter-verifiable hardware and software component for its machines that it plans to submit for federal certification in early 2004.” The unit costs an estimated $500 per machine, said Wired, and the company expects the price to drop.

Revolt of the machines

All voting systems are prone to error — though this fact was largely ignored until butterfly ballots and hanging chads became national news during the 2000 presidential race. Between 1988 and 2000, lever machines lost 7.6 percent of the votes cast in statewide races, according to the Voting Technology Project. During the same period, DREs lost 5.9 percent, punch-card systems lost 4.7 percent, and paper ballots lost 3.3 percent of the votes cast. (The VTP determined these figures by comparing the total number of voters entering polling places with the total number of ballots cast.)

In 2002, almost 20 percent of U.S. voters lived in precincts using electronic machines, according to Election Data Services. That’s about double the number in 1996. And recent federal legislation is hastening the transition to digital ballots (see “HAVA or HAVA Not?”).

Defenders of mechanical systems maintain that the error rate, an inevitable byproduct of automation, is statistically insignificant in most races. They also point out that besides speeding up the tally, DREs improve access for disabled voters and can easily be set up to provide foreign-language ballots.

Still, some critics question why we need to automate at all. The primary argument for mechanized voting is faster tabulation. Yet the Voting Technology Project concluded, “Paper ballots are the standard against which other systems must be measured.”

The rush to automate in the 1950s was driven, in part, by the rise of television news departments, which wanted quick results in order to emphasize their time advantage over print media. In 1964, the major TV networks teamed up to establish the voter news service designed to funnel the newly available electronic data to member stations so they could report results in real time. And as computers began transitioning from super-secret military equipment into pervasive civilian tools and their cost shrank, voting systems shifted from hand-marked or punched ballots tallied by machine to computer terminals — today’s DREs.

Meanwhile, even DRE critics admit that old-fashioned paper ballots have their drawbacks. “Paper ballots are expensive to print, secure and transport,” notes the Voting Technology Project. “Counting is slow, labor-intensive and cumbersome, especially in many U.S. jurisdictions, where there can be 20 offices and 20 ballot questions.”

But computer-generated paper records address all of these issues, according to the VTP. They can be compact (since only the results are recorded) and can be encoded for both security and rapid tabulation by other counting machines. For these reasons, the project approves of DREs that include a voter-verifiable audit system.

Mercuri, on the other hand, was quoted in Salon.com as saying: “Electronic systems simply aren’t up to the job of voting. The only thing the computer is good for is as a fancy ballot printer.”

Gerbel of UniLect told Xpress that although the Patriot records all the ballots in random order (to preserve voter privacy), they can be individually printed for recounting, and the system includes five separate tabulators that can be independently verified and compared.

Tangled threads

California’s secretary of state recently banned electronic voting unless ballot-machine manufacturers, including the California-based Sequoia Pacific, significantly improve the security and verification systems on their equipment. In addition, Shelley completely banned the use of Diebold Voting System’s newest model, the AccuVote-TSx — and asked California’s attorney general to investigate the company for allegedly lying to state officials.

Odd programming activity and anomalous results were reported on Diebold DREs, which were used statewide in Georgia in the 2002 election (see “It Ain’t Peanuts”). Researchers from the Information Security Institute at Johns Hopkins University in Baltimore investigated and discovered what they called “stunning flaws” in the programs used to run the machines.

Johns Hopkins researcher Adam Stubblefield, who co-wrote the paper, told The New York Times, “With what we found, practically anyone in the country — from a teenager on up — could produce these smart cards that could allow someone to vote as many times as they like.”

Although Diebold hotly defended its system, a follow-up study conducted by Johns Hopkins for the state of Maryland reached similar conclusions, discovering 328 software glitches (more than two dozen of which were labeled “critical”).

Last year, Diebold admitted that there were problems with the systems in those two states — but insisted that its machines everywhere else are reliable. Last month, however, California learned that Diebold had sold and installed thousands of its new TSx machines in the state without the required testing and certification.

“I understand your frustration,” Diebold chief developer Tab Iredell told the Bay area’s Tri-Valley Herald. “Why did we sell something that we didn’t think we could run? Our understanding, based on past experience, was we thought we could get that certified.”

And in what might be the weirdest fallout of the 2000 electoral chaos, voterverification.org (a voting-machine activist group) notes that in Bush v. Gore, the U.S. Supreme Court ruled that a “legal vote” is one in which there is a “clear indication of the intent of the voter” — which appears to make all votes cast on most DREs illegal, since there is no record of the clear intention of any voter, only a cumulative total of the votes cast. Last month, group members testified before the House Government Affairs Committee, which is now considering voting-machine legislation.

Who writes the rules?

One obvious question to ask about any computer system that might be using fraudulent software is, “Who writes the program?”

The answer is troubling. About two-thirds of the machines now in use in the United States are manufactured by either Diebold or Election Systems & Software (or their subsidiaries) according to Election Data Services. Both of these private companies are owned by conservative political activists.

Walden O’Dell, the chairman of the board/chief executive of Diebold, is one of George Bush’s “Pioneers and Rangers,” each of whom has pledged to raise more than $100,000 for the Bush re-election campaign. Last August, he wrote in a Republican fund-raising letter that he was committed “to helping Ohio deliver its electoral votes to the President.” Election Systems & Software is owned by McCarthy & Co., an Omaha investment group. Sen. Chuck Hagel (R-Neb.) was the company’s chairman when he ran for the U.S. Senate; other company owners are heavy contributors to Republican officeholders. Both companies’ machines have been used in races where Republican victories were widely at odds with pre-election opinion polls (see “It Ain’t Peanuts”). Sequoia, the nation’s third-largest manufacturer of voting machines, is owned by a subsidiary of the Carlyle Group, a multinational investment corporation whose top echelon includes former President George Bush, former CIA Deputy Director Frank Carlucci, and former Secretary Of State James Baker.

And whereas other countries require that voting software be open to public scrutiny, in the U.S. it’s considered private corporate property, and court decisions have repeatedly blocked efforts to open it for examination. The companies maintain that this helps prevent hacking. But computer-security experts say that for any system to be truly secure, it must be designed to resist tampering by those who have an intimate knowledge of its inner workings.

Turning the tide

In the past six months, nine states have voted to require a voter-verifiable, auditable record on all DREs; similar legislation is pending in at least 20 other states.

In North Carolina, Johnnie McLean, deputy director of the State Board of Elections, says it’s waiting for new federal guidelines before taking further action, and Parker affirmed that Buncombe County will comply with state rules. Any changes would have to be approved by the state legislature, which would have to act quickly during the current short session in order for the changes to be in place in time for this November’s elections.