Wednesday, November 30, 2005

My presentation at the Secretary of State's Voting Systems Testing Summit

This past Monday and Tuesday I participated in the California Secretary of State's Voting Systems Testing Summit, along with about 125 other people. Other participants included many California local election officials, election officials from other states, representatives of the EAC and NASED, voting equipment vendors, computer scientists, academics, and a few activists. Though the event was not open to the public, the Secretary of State's staff did invite a fairly diverse group of people to attend, and permitted reporters to sit in on the sessions.

My presentation focused on the purpose for which voter verified paper audit trails should be used. While there were many people in the audience who have been longtime opponents of a voter verified paper audit trail requirement, I felt my remarks were well-received. All in all, I found the summit to be a good opportunity to talk with people from a variety of perspectives.

Based on the presentations made, I get the feeling that many folks involved in elections are slowly beginning to acknowledge the weaknesses of the federal government's current oversight of voting systems. For example, two representatives from Independent Testing Authorities (ITAs) were scheduled to speak, but only one showed up. Several summit participants expressed disappointment that the representative from Wyle Labs did not show up, since Wyle has been one of the most prominent ITAs involved in the federal voting system qualification process.

It's clear that many states are in the same situation -- facing looming voting equipment deadlines to comply with the Help America Vote Act's accessibility requirements, but not feeling confident about the voting equipment choices before them. Tuesday's Sacramento Bee featured an article by Kevin Yamamura which discusses California Secretary of State Bruce McPherson's comments at the summit and reports that he may not certify any more voting systems before the end of the year, which will make it difficult for current Diebold customers to comply with the HAVA mandate.

Update on Secretary of State's security test plans

The attempted hack of a Diebold voting system will not take place today, as previously reported. The terms of the test are still being negotiated. It's my understanding that the Secretary of State's office has been in touch with Finnish programmer Harri Hursti to make the arrangements. More details are featured in Monday's Alameda Newspaper Group story by Ian Hoffman. Excerpts are below.


Back in May, voting activists went on the Internet and for $300 apiece purchased two devices used to record moisture levels in corn.

Certain corn scanners use the same memory cards as Diebold Election Systems' optical scanning machines for ballots and can easily modify them. That makes corn scanners a tool for vote hacking.

Sitting by a hotel pool last spring in Florida, Finnish computer expert Harri Hursti wrote his own program on a memory card so it could alter poll results on a Diebold machine in Leon County and flash a screen message -- "Are we having fun yet?" -- that shocked the local elections supervisor.

Prodded by activists with nonprofit Black Box Voting, California elections officials have agreed to a test hack of the Diebold voting machines running in 17 of its counties, from San Diego to Los Angeles and Alameda to Humboldt.

The test, first reported by The Daily Review last week, originally was scheduled for Wednesday but will likely be delayed until mid-December.


If Hursti or another computer expert succeeds in hacking Diebold's voting machinery, the McKinney, Texas, firm could be forced to redesign software fundamental to each major component of its voting system. Securing new state and federal approvals would bring delay and loss of sales that the company is counting on before next June's primary.

Counties face Jan. 1 state and federal deadlines for acquiring new, handicapped-accessible voting systems that also offer some form of paper record. Those counties relying on Diebold might turn to other voting-system makers.

As a result, there have been extensive, ongoing negotiations between Black Box Voting and the California secretary of state's office, which also is talking to Diebold, about conditions of the test, confidentiality of the results and measures of success. The talks continued over the weekend, but state officials said they remain committed to performing the test.

"Secretary (Bruce) McPherson takes testing these systems very seriously," said his spokeswoman Nghia Nguyen Demovic. "He wants safeguards in place so that every vote cast is secured. He's doing his due diligence to assure voter confidence."

Last week state officials said they will select the voting equipment at random from a California county using Diebold.

Hacking strategies can be caught by recounting the ballots. California law requires a recount in 1 percent of precincts after every election. But in Los Angeles County and other jurisdictions, elections officials do not recount absentee ballots, which are mailed in and scanned at election offices. Absentee ballots are more than a third of the vote in California and in several counties more than half of the vote.

"You just tamper with the GEMS database for the absentee vote, and then if you exclude the absentees from the one percent recount then you completely own the process," said Jim March, a board member of Black Box Voting. The hacks -- there are two -- are almost elegantly simple.

Friday, November 25, 2005

Hacker to try to attack state voting machines

In today's San Francisco Chronicle, John Wildermuth reports on the California Secretary of State's plan to allow a computer security expert sponsored by Black Box Voting to attempt to hack into Diebold's voting system. The security test will be held Wednesday, Nov. 30. Excerpts from the Chronicle article are featured below.


A computer hacker will be trying to break into one of California's electronic voting machines next week, with the full cooperation of the secretary of state.

Harri Hursti, a computer security expert from Finland, will be trying to demonstrate that voting machines made by Diebold Election Systems are vulnerable to attacks by computer hackers seeking to manipulate the results of an election.

"This is part of our security mission,'' said Nghia Nguyen Demovic, a spokeswoman for the secretary of state's office. "We want to make sure that every vote is counted and registered correctly.''

The stakes are high for Diebold, one of the nation's largest manufacturers of electronic voting systems. The company is trying to get its new voting system approved for use in California, the nation's biggest market, but Secretary of State Bruce McPherson refused certification after 20 percent of the new, printer-equipped voting machines malfunctioned during a July test in San Joaquin County.

"The secretary said that performance wasn't good enough,'' Demovic said.

The new security test, tentatively scheduled for Wednesday, will play a role in Diebold's future certification efforts.

Last May, Hursti and another computer security expert tested a Diebold system for the elections supervisor in Leon County, Fla. They quickly broke into the system, changed the voting results and inserted a new program that flashed the message "Are we having fun yet?" on the computer screens.

"Granted the same access as an employee of our office, it was possible to enter the computer, alter election results and exit the system without any physical record of this action,'' said Ion Sancho, the election supervisor, in a report on the county's Web site.

The California test will use a randomly selected voting machine from one of the 17 counties that use a Diebold system -- either touch screen or optical scan machines. The original plan for the test would have used a machine provided by Diebold, something opposed by the state and the critics of the company.

"We want to test a machine that's already been used in a California election,'' said Jim March, an investigator for Black Box Voting, the consumer group bringing in Hursti for the test. "We want to avoid a so-called 'lab queen,' a voting machine specially rigged for the test.''

Black Box Voting and other groups have complained that the programs loaded into the Diebold machines can be undetectably changed to provide a specific election result. Officials of the company argue their machines provide secure, accurate results.

Officials of the company did not return telephone calls Wednesday.

Diebold has been a popular target, for those worried about the security of electronic voting and for Democrats complaining about the company's links to the Republican Party.


The company also has a checkered record in California. Problems with the company's electronic voting system caused disruptions at 180 Alameda County precincts during the March 2004 primary election. During the October 2003 recall election, several thousand votes for Democratic Lt. Gov. Cruz Bustamante in Alameda County were somehow electronically transferred to Southern California Socialist John Burton.

In May 2004, then-Secretary of State Kevin Shelley yanked certification of the Diebold machines in four counties and restricted their use in 10 other counties until their security and reliability could be improved.

The state has mandated that all electronic voting machines have a paper-ballot backup to record votes by the June 2006 primary.

More coverage of the Diebold hearing

Ian Hoffman of the Alameda Newspaper Group wrote this article about Monday's hearing at the Secretary of State's office regarding certification of the Diebold TSx voting system. It is featured below.


With a quarter of California counties poised to buy Diebold's latest touch-screen voting system, Diebold critics urged its rejection Monday, calling it open to fraud and inaccessible to disabled voters.

If the touch screen isn't approved, most California counties will miss the Jan. 1 deadline to begin offering handicapped-accessible voting machines that also provide a backup paper record.

Fifteen county officials, including elections chiefs in Alameda, Marin, San Joaquin and Los Angeles, wrote Secretary of State Bruce McPherson last week to "urge that you act as quickly as possible ... to ensure our ability to comply with the looming federal and state deadline."

Yet Diebold employees and local elections officials were dismayed to hear the company portrayed as an "ethically challenged" and "corrupt" maker of voting machinery designed to fix elections.

The McKinney, Texas-based firm has spent more than two years trying to win permanent California approval for its AccuVote TSx and undergone the most rigorous state testing of a voting system.

"People have made this a personal issue with Diebold, and they don't see a company that has made improvements," said San Joaquin County Registrar of Voters Debbie Hench, who wants to use more than 1,600 of the Diebold touch screens in the June primary. "I don't think there's a vendor around that could satisfy these people."

Diebold has added stronger passwords and encryption, but opponents say the voting system remains vulnerable to a simple hack. With unobserved access to voting computers and insertion of as little as 60 lines of code, a computer expert for Black Box Voting Inc. says he has been able to change vote tallies for an entire jurisdiction.

Jim March, a board member of the group, called the vulnerabilities "a whole set of aces up the sleeve for an election official who wants to cheat."

Before considering approval of the system, officials at the California secretary of state's office have agreed to test those claims by letting Black Box Voting try to hack into the Diebold system on Nov. 30.

"The places where there are known vulnerabilities in this system should raise a yellow flag before we certify this system," said state Sen. Debra Bowen, a Marina del Rey Democrat expected to challenge Secretary of State Bruce McPherson as the state's chief elections officer.

State law says a voting system cannot be approved for use in California unless it is secure. So far, state voting-system technicians have concluded the system is secure enough. What could matter more in McPherson's decision on the Diebold system is opposition from advocates for visually impaired and physically disabled voters, for whom most counties say they are buying the Diebold system to serve.

Dan Kysor, director of governmental affairs for the California Council for the Blind, and Teresa Favuzzi, executive director of the California Foundation for Independent Living Centers, said the Diebold system is not accessible enough.

Electronic touch screens have brought disabled voters to the brink of casting their ballots privately, without assistance, by offering an audio version of the electronic ballot and various means of marking their choices. But Diebold's latest touch screen lacks a key tool, a sip-and-puff device for physically disabled voters, and it is designed in a way that makes it hard for visually impaired voters to initiate the voting machine, Favuzzi said.

The machine has a printer and rolls of cash register-style thermal paper for producing paper trails, or printed records of ballots that voters can double-check for accuracy and elections officials can use for recounts. But visually impaired voters can't read the printouts, and they are not given such independent verification.

"We actually expect to have access to the verification process," Favuzzi told state elections officials Monday. "We are interested in having accessible voting machines, and this one does not really seem to fit."

Rejection or delay of approval for the Diebold system would put California counties in league with counties throughout the nation that are likely to miss deadlines for handicapped-accessible voting under the 2002 Help America Vote Act. The National Association of Counties recently pressed Congress to roll back those deadlines by two years, citing the lack of available systems.

Monday, November 21, 2005

Report on SoS Hearing on Certification of Diebold's TSx voting system

Today the California Secretary of State's office held a public hearing as part of Diebold's application for certification of its TSx electronic voting system. About 150 people attended the hearing, mostly voting rights activists who traveled from all over the state to participate.

The Secretary of State has disbanded the Voting Systems and Procedures Panel, which caused much confusion in the days and weeks leading up to today's hearing. Many people wondered who from the Secretary of State's office would attend the hearing if not members of the Voting Systems and Procedures Panel? It turned out that today's hearing was chaired by Bruce McDannold, acting chief of the secretary of state's new Office of Voting System Technology Assessment, as well as senior staff from the legal, executive and legislative divisions. Also on today's hearing panel was Steve Freeman, the state's voting systems consultant.

The hearing began at 10 a.m. Prior to its start, activists held a news conference and rally in front of the Secretary of State’s office. Then everyone filed in to the auditorium and Bruce McDannold began the hearing.

Many of the people who spoke at the hearing were there to oppose the certification for one of two reasons: either they opposed Diebold because of its poor track record in California elections as well in other states; or they opposed certification of electronic voting systems generally.

There were also several representatives of disability rights groups who spoke, including two who spoke against certification of the TSx because they believe it is not accessible enough. This may pose a serious barrier to the TSx’s certification, because one of the main reasons counties want to purchase this machine is so they can be in compliance with the Help America Vote Act’s accessibility requirements.

Much of today’s testimony also focused on the procedures the Secretary of State is following for convening public hearings and certifying voting equipment. Many activists were frustrated that they were not aware the VSPP had been disbanded, or that this public hearing had been called. To alleviate these problems in the future, the Secretary of State’s office is now allowing people to sign up on their web site to automatically receive notices of future hearings via email.

Activists were also frustrated that there was no give-and-take between the panel and those providing testimony. Many people who spoke had questions and wanted answers that were not provided by the panel. Hopefully in the future the Secretary of State will establish a way to answer public questions in a public forum. I did ask one person on the panel after the hearing what people should do if they have questions about voting systems, and the response was that they should contact Bruce McDannold, whose email address is

Thursday, November 17, 2005

Diebold TSx Certification Hearing Monday, Nov. 21

On Monday, November 21 the Secretary of State will hold a public hearing on certification of Diebold's TSx electronic voting machine with a voter-verified paper audit trail printer attachment. The hearing begins at 10 a.m. at the Secretary of State's office in downtown Sacramento. The hearing agenda, staff and consultant reports, and California testing reports are available on the Secretary of State's Voting Systems homepage.

Many California counties are Diebold customers and are eagerly awaiting certification of the TSx so they can use these machines in the June 2006 primary election. Secretary of State Bruce McPherson rejected Diebold's initial application for certification back in July due to problems in state testing. See my July 2005 blog entries for details on the initial application and rejection.

Tuesday, November 15, 2005

A collection of glitches from Tuesday's election

Joe Hall, a UC Berkeley grad student and staff for the ACCURATE project has compiled a list of glitches from around the country in last Tuesday's election. His collection features links to news articles where the glitches were originally reported. Excerpts are below.


Harwinton, Connecticut - Voting machine snafu may lead to challenge in Harwinton

One candidate was endorsed in a race by both Republican and Democratic parties and was listed twice in a choose 2 out of 3 race. This candidate, due to being listed twice, got twice as many votes as the other two candidates in the same contest.

Pasquotank Co., North Carolina - In Elizabeth City, a 14-vote gap has one candidate calling for a recount

Selecting a certain candidate in the only contest on the ballot resulted in a write-in candidate box being selected instead. The margin in this race was 14 votes. Also, 60 blank ballots were cast (recall that there was only one race for this election). Also see: "Count on recount in E. City mayor’s race"

Lucas Co., Ohio - State plans to investigate voting chaos; Tuesday's problems are latest for Lucas County

This one is mysterious: "workers accidentally 'set an option [on the five machines] that prevented the results from being transported onto the memory card.'" Also, massive labor shortage resulted in chaos as election was highly understaffed and a system of "rovers" didn't function correctly (where one elections worker would travel to five polling places to get aggregate totals from machines). Also, see: "Poll workers blast use of 'rovers'"

Thursday, November 10, 2005

Relatively calm Election Day

Today's San Francisco Chronicle features an article by Greg Lucas assessing how the election went -- and it appears things were relatively smooth. Excepts are below.


With the exception of some missing poll workers, an on-the-fritz scanner in Tuolumne County, some uncounted votes in Stanislaus County, a power outage in Lassen and transportation problems in Los Angeles, processing the 6.8 million ballots cast in Tuesday's election went off without much hassle.

One reason there were so few snafus is that one third of the ballots -- 2.3 million -- were absentee.

The remaining absentee and provisional ballots still to be counted could push the figures closer to the 40 percent vote-by-mail estimate by Secretary of State Bruce McPherson.

"Sure there was the occasional glitch, but generally the reports coming in from the counties is that the processes worked smoothly," said Conny McCormack, registrar of Los Angeles County and president of the California Association of Clerks and Elections Officials.

"Considering how fast we had to put this election together and pull it off administratively, I thought we all did extremely well," McCormack said.


There were no widespread problems with the election in the Bay Area.

Stephen Weir, Contra Costa County registrar, said the election went well but his county and some others had a higher-than-normal number of "no show" poll workers.

In Stanislaus County, election officials decided not to count 20 precincts of mail-in ballots until Wednesday morning. But state election officials awakened them long after midnight and told them the ballots had to be counted right away.

One of Tuolumne County's vote-counting scanners gave up the ghost, leaving ballot counters with just one scanner to process votes.

"It took us an hour-plus longer than normal. Otherwise, everything was fine and dandy," said Tim Johnson, the county registrar.

Monterey was one of seven counties testing new technology that lets voters double-check their selections before casting a ballot electronically.

The devices are required on all electronic voting machines beginning with the June 2006 primary.

"This wasn't a test, it was the real thing," said Claudio Valenzuela, precinct service coordinator for Monterey County.

"Some voters thought they were getting a receipt, but after poll workers explained it was for verification, not a receipt, they were OK with that," Valenzuela said.

Kari Verjil, registrar of San Bernardino County -- the largest jurisdiction in the country to use the verification devices -- said despite a few paper jams the devices worked "exceptionally well."

The above-and-beyond-the-call-of-duty award for the election probably goes to four poll workers in Lassen County who arrived at their polling place, the Veterans Memorial Hall in Bieber, population 510, to find the power out and no water.

A snowstorm had downed power lines. Rather than give up the site, they opened the polling place with flashlights. To combat the cold, the husband of one of the poll workers brought wood and got a fire blazing in the hall's fireplace. A voter went home and returned with a propane lantern.

End of paperless e-voting in California

Tuesday's election marked the last time paperless electronic voting machines will be used in a California election. Ian Hoffman of the Oakland Tribune wrote an article about the end of the era. Excerpts are below.


Elaine Ginnold awoke in a darkened home with no electricity - a harrowing way for the Alameda County elections chief to launch Tuesday's special election with fully electronic voting machines.

No power, no votes.

Ginnold muttered an epithet but relaxed later when driving past her local polling place, a fire station with its lights blazing. Her Election Day opened with the usual headaches: no-shows of poll workers, polling places still locked and a smattering of technical problems such as inoperable electronic voter cards and a few inoperable e-voting machines. The days of those last glitches, and worrying about power outages, are on their way out. The era of paperless, fully computerized voting machinery ended Tuesday in California.

Ginnold for one isn't sorry to see a return to paper balloting.

“I'm looking forward to it,” she said. “I don't see that we're going backwards at all."

Soon after voters in Piedmont tried their hand at paperless, touch-screen voting in 1999, electronic voting soared in popularity. It was easy as an ATM. The curses of paper balloting multiple languages, multiple districts, multiple parties, paper jams would vanish, along with the hanging and pregnant chad so reviled from the 2000 elections.

E-voting had none of these ambiguities: The memory either stored a vote for, a vote against or none at all.

E-voting makers and elections officials talked of near-instantaneous results, beamed wirelessly from polling places to central elections offices for immediate posting on the Internet. Paperless voting was the way of the future.

But in 2002, criticism arose from an unlikely quarter: Computer scientists who had written software for NASA moonshots and Star Wars missile-defense systems said computers were too subject to programming error and too unsecure to rely upon them solely as arbiters of political power.

More detailed analysis of e-voting software at Johns Hopkins University and elsewhere revealed vulnerabilities to hacking.

The new voting machines also brought their own drawbacks. They were expensive, often costing $4,000 apiece, and while the touch screens themselves had relatively few problems, related hardware and software breakdowns thwarted voters in several large counties in 2004.

In California, voters wary of politics and government latched onto the controversy and to one solution proposed by computer scientists: Add printers to the electronic voting machines and provide a printed record of the ballot for voters to check and elections officials to recount.

In six months, the state became the first to require a voter-verified paper trail for all e-voting machines. Last month, Gov. Arnold Schwarzenegger signed a bill requiring elections officials to use the paper trail in recounts.

“It's been a long road to get where we are now, where the use of paperless electronic machines is on the decline,” said Kim Alexander, president of the nonprofit California Voter Foundation and a leading advocate of paper trails.


Starting Jan. 1, all electronic voting machines must produce a paper trail that will be used in automatic recounts of 1 percent of precincts, as a check of computerized vote tallies, and in full recounts in the event of an election challenge.

Alfie Charles, an executive with Oakland-based Sequoia Voting Systems and a former state elections official, said he thinks paperless e-voting is gone for good.

“It worked well and served its purpose but unfortunately was not trusted, for either perceived or valid reasons,” he said. “And in elections, perception is critical.”

Tuesday, November 8, 2005

Voting Hotline -- Report problems at 1-866-OUR-VOTE

Verified Voting and a coalition of nonprofit organizations is sponsoring a toll-free hotline voters in California and other states can use to report any problems experienced today at polling places. The hotline number is 1-866-OUR-VOTE. Excerpts from their announcement are featured below.


If you experience any problem casting your ballot -- finding the polling place, voter intimidation, accessibility issues, voting machine problems, provisional ballot issues, etc. -- or you witness anyone having voting problems, please immediately call 1-866-OUR-VOTE to report the problem.


Verified Voting Foundation volunteers and staff have developed a new version of the "Election Incident Reporting System" (EIRS) to record all problems reported to 1-866-OUR-VOTE. Since 2004, hundreds of organizations and thousands of individuals in the United States have used EIRS to help protect our right to vote and assure that every vote is counted as cast.

Schwarzenegger Hits Snag at Polling Place

Bob Salladay reports today on the Los Angeles Times' web site that Governor Arnold Schwarzenegger ran into some problems today when he attempted to vote at his Brentwood polling place. His story is featured below.


Gov. Arnold Schwarzenegger showed up to his Brentwood neighborhood polling station today to cast his ballot in the special election — and was told he had already voted.

Elections officials said a Los Angeles County poll worker had entered Schwarzenegger's name into an electronic voting touch screen station in Pasadena on Oct. 25. The worker, who was not identified, was testing the voting machine in preparation for early voting that began the next day.

Somehow, Schwarzenegger's name was then placed on a list of people who had already voted, said Conny B. McCormack, the Los Angeles County registrar.

Schwarzenegger's aides were informed of the problem when they arrived this morning to survey the governor's polling station. The poll worker told the governor's staff he would have to use a "provisional" ballot that allows elections workers to verify if two votes were made by the same person. McCormack said the poll worker did the correct thing.

The governor, however, was allowed to use a regular ballot.

McCormack said she apologized to the governor's staff and would investigate what happened. She said nobody actually voted for Schwarzenegger in Pasadena, and the governor's votes today will be counted.

"This is someone who breached our protocol and was playing around in advance of the election," she said.

Tom Hiltachk, the governor's attorney, said: "I have no reason to believe anything nefarious occurred.

But Kim Alexander, president of the nonpartisan California Voter Foundation, said the problem highlights the need for better verification of electronic voting.

"If the governor is going to have a mix-up on his ballot," she said, "it will make other voters wonder what is going to happen with their ballots."

Voters in Electronic Voting Counties Have the Right to Request a Paper Ballot at the Polls

Nine California counties will use paperless electronic voting machines at their polling places today:

Santa Clara

Voters in these counties have the right to request a paper ballot at the polls. See CVF's voting technology map and county-by-county directory for more information about California voting systems.

And, for a little inspiration, as well as useful information, watch this "Paper or Plastic?" video from last November.

In some electronic voting counties, paper-ballot voters will be treated as provisional voters, which is unfortunate because it subjects these voters to unecessary concerns about their ballot secrecy and whether their ballot will be counted.

There has been some confusion about the number of counties that will use paperless e-voting machines. Please note that the voting system information on the Secretary of State's web site is not up to date. There are seven California counties using touchscreens with voter-verified paper audit trail (VVPAT) printers in today's election, and this information is not fully reflected in the Secretary of State's chart. Those seven are:

San Bernardino

San Bernardino converted from paperless touchscreens to touchscreens with VVPAT printers. Monterey is using one DRE per polling place. Current Secretary of State policies prohibit counties from purchasing paperless DRE systems. This was a directive that was issued by the previous Secretary of State, Kevin Shelley, and to the best of my knowledge still stands.

Monday, November 7, 2005

Bounty of Information for Voters Online

We issued this news release last Friday letting voters know where to look for reliable election information online. Read the release for descriptions of, and links to nonpartisan web sites providing information on all eight statewide ballot propositions.

Tuesday, November 1, 2005

One week to go -- are you ready? Have a house party!

Today I posted this newsletter to CVF-NEWS about my election house party experience last week. If you're interested in hosting a house party, you can read my newsletter and find out more about it. More information about election house parties is also available from our web site.