Bo Lipari – Essays and Images

Update I, 2/19/10 – Court documents posted, links here

Update II, 2/19/10, 1:30 PM – The judge did not grant a temporary restraining order and will hear arguments on Friday, February 26.

In a surprise move, Dominion Voting Systems has filed an Article 78 lawsuit in New York State Supreme Court in Albany to stop the New York City Board of Elections from awarding a $70 million dollar contract for new voting machines to ES&S. If a temporary restraining order is granted, it would call into question the city’s ability to deploy new voting systems in the 2010 elections, a schedule already in jeopardy due to the City Board of Election’s long delay in selecting new systems. The competition between the two companies for the New York City contract was intense, and has raised questions of lobbyist influence, possible investigations, and even subpoenas.

In court papers, Dominion argues that the New York City Board of Elections failed to comply with New York State and New York City Procurement Laws, Rules and Regulations, and awarded the contract on the basis of illegal criteria. Further, the lawsuit argues that the New York City Board of Elections:

1) Did not conduct a lawful bidding and procurement process;

2) Did not disclose the method and criteria used in evaluating bidders;

3) Did not award the contract to the lowest responsible bidder.

The city used a point system to evaluate the two companies. In the final evaluation, ES&S received 3,417 points, while Dominion received 3,395, a difference of only 22 points. Dominion claims that the slightly higher overall score for ES&S in the city’s evaluation is due to extra points given to the ES&S DS200 scanners for an option called “Easy Startup”. This option is said to include electronic machines pre-programmed in the warehouse prior to delivery to poll sites, and the ability for poll workers to open the machines without a password (such a configuration is not only an obvious security risk, but disallowed under New York election law). The lawsuit claims that the State Board of Elections explicitly ruled that the DS200 Easy Startup option does not comply with state law, and informed the New York City Board that it would reject any contracts that included it.

It remains to be seen if what impact, if any, the suit will have on the city’s ability to deploy of new voting systems this year, a schedule already in jeopardy. And of course, if the State Supreme Court were to grant the restraining order, the reaction of Federal Judge Gary Sharpe to yet further delays in New York City’s HAVA implementation schedule will need to be reckoned with as well.

Update I, 2/19/10

Dominion Lawsuit Documents, February 17, 2010

• Compressed file, all documents (5 mb)

Individual Documents

• Dominion Memorandum of Law (1.2Mb)

• Dominion Verified Petition 2-17-10 (840k)

• Order to Show Cause (105k)

• Poulos Affidavit (471k)

• Poulos Exhibit B (10Mb)

• Poulos Exhibit C Part1 (14Mb)

• Poulos Exhibit D-H (5Mb)

• Harding Affirmation 2-17-10 (2.7Mb)

ES&S pays more for used systems than they cost new

In last week’s post, I reported on the surprise decision of New York State’s Nassau County to dump it’s 450 Dominion ImageCast voting machines after an intense effort and behind the scenes deal making by ES&S. As the purchasing proposal shows, ES&S spared no expense to convince this large county to dump the small upstart competitor who had won the contract, offering perks, discounts, and a highly unusual arrangement to resell Nassau’s current ImageCasts and split the profits with the county. But the real surprise here, and surely one that will be of interest in the rumored upcoming DOJ investigation into the ES&S/Diebold merger, is that ES&S is actually paying more for Nassau’s used ImageCasts than the county paid for them new!

According to the contract pricing posted by New York’s Office of General Services, Nassau paid $11,097.50 per ImageCast (assuming they received the 3.5% discount). According to the ES&S purchase proposal, here’s what ES&S is paying Nassau for the used machines:

• Trade-in Allowance for ES&S Purchase of 450 ImageCast Units is $4,692,012.50, or $10,426.69 per machine.

• An additional $500,000 immediate credit against sale of the used machines – $1,111.11 per machine.

Add the two together and we see that ES&S is paying Nassau County $11,537.80 per machine. That’s $440.30 more for a used machine than Nassau paid for them brand new! [Note - if Nassau did not receive the state 3.5% pre-payment discount, the original price per machine was $11,500,in which case ES&S is still paying$40 more for the used machines than the original purchase cost.]

And this is before any profits from sales of the used machines. Nassau stands to make even more money on the trade-in than they are now as the used machines are sold off. I have no idea what ES&S intends to sell the used ImageCasts for, but for purposes of illustration let’s assume a bargain basement price of $6,000 (remember, by selling ImageCasts to New York counties, ES&S further erodes Dominion’s sales, so it makes sense for them to offer the machines at a deep discount). Selling all of Nassau’s 450 ImageCasts would yield $2.7 million dollars, of which Nassau gets half, minus the $500,000 already received up front. So after the sale, Nassau nets another $850,000 in cash, or $1,888.89 per Image Cast. Add that to the per machine total calculated above, and we find that ES&S is effectively paying Nassau County $13,426.69 per ImageCast – $2,329.19 more per used machine than Nassau paid for them new!

Like I said last week, a pretty sweet deal for Nassau County, with lots of cash and incentives provided by ES&S to dump the ImageCasts systems that Nassau poll workers have been training to use for two years. Now, I’m neither a lawyer or an economist, so I can’t tell you what variant on monopolistic practices this is. Is it predatory pricing? Price discrimination? All I know is that when a big company uses their financial muscle to buy up the competition’s systems at more than their original cost, and then seeks to dump them on the market below the standard price, something rotten is going on. And that cannot bode well for election officials and voters around the United States.

Update 7PM – I’ve posted a copy of the ES&S purchase proposal that I received from several independent sources. See below for an update on the terms of the deal.

There was lots of reporting last week about the decision to award New York City’s huge voting machine contract to the ES&S, but the really interesting story slipped by nearly unnoticed – Nassau County, home to nearly 1 million registered voters, announced they were abandoning their recently purchased Dominion ImageCast machines for ES&S systems. This announcement came as quite a surprise because Nassau County has been using the Dominion machines for accessible voting in all polling places since 2008, as well as spent time and money training poll workers in the use of the new systems. So how is it that ES&S managed to snatch away Nassau County, in terms of voting system sales the second largest prize in New York State, from the much smaller Dominion? The answer is a cautionary tale about the power of a near monopoly to force smaller competitors out of the market.

ES&S has long been one of a handful of voting machine companies dominating the United States market. But recently, with Sequoia Voting Systems struggling financially, and the absorption of Diebold into ES&S (a move opposed by many), the company already has a near-stranglehold on providing voting systems and services to election officials. In New York State however, ES&S faces a small competitor from just across Lake Ontario in Canada, Dominion Voting. Dominion designed and built the ImageCast, a new scanner and accessible ballot marker combination system that many County Boards of Elections around the state, including Nassau, liked enough to order and use in 2008 and 2009 [Note - initially Dominion partnered with Sequoia to bring the ImageCast to New York, but Sequoia later pulled out and turned the contract over to Dominion]. Indeed, even if New York City chose the ES&S DS200 scanner, a decision finally made this week, little upstart Dominion would still have provided over half of the Empire State’s huge number of voting machines! But big companies like Wal-Mart and ES&S don’t stand around idly letting small competitors take what they see as their market share. And the way they do it is by being big enough to offer customers deals that are simply too good to pass up. And that’s exactly what ES&S did in Nassau County.

I spoke with Nassau Election Commissioner Bill Biamonte, who told me the details of the county’s arrangement with ES&S. An arrangement so good, it convinced them to decide to abandon the 450 Dominion ImageCasts they already own. It’s a darn sweet deal, and shows the kind of to-the-bone cost cutting that a large company can and will do in order to drive out the competition. According to Commissioner Biamonte, here’s what ES&S agreed to in order to get Nassau to ditch the ImageCast and buy their systems:

1) Nassau’s current ImageCast machines will be purchased by ES&S from the county. ES&S will provide Nassau a $3.5 million dollar credit against Nassau’s new ES&S systems, including a $500,000 guaranteed upfront payment. ES&S intends to sell Nassau’s ImageCasts to other counties that use the Dominion system, with proceeds from sales being split 50/50 between ES&S and Nassau.

2) ES&S will waive a $150,000 Election Management System licensing fee.

3) ES&S will provide Nassau County with a dedicated project manager, and 400 days of free support service.

4) Nassau will purchase 1300 DS200 scanners at a cost of $7100 per scanner (list price is $8347) and 450 AutoMARK ballot marking devices (I don’t have a price on these).

You gotta love ES&S’ thinking on this. Buy up a big county’s Dominion machines, sell them at cut rate prices to smaller counties (further cutting Dominion sales), offer the big county half of the proceeds along with plenty of cash and perks. A big company like ES&S has deep, deep pockets, and they can dig down into those pockets to offer deals like this in order to further drive out the competition. ES&S used their muscle to convince Nassau to abandon their investment in Dominion machines, a very large sale which not incidentally, now makes ES&S the dominant voting system vendor in New York State.

Are they working right now to cut similar deals with other large New York counties like Suffolk and Westchester, encouraging them to abandon their current systems and making them offers they can’t refuse? It’s just like the famous game where you acquire the most expensive lots, force your competitors to cede more and more of theirs until their money is all gone, and finally you own the whole board. The game is called Monopoly.

Update 7PM – After my post, I received a copy of the ES&S purchase proposal from several independent sources. According to that document some of what I reported above is incorrect. ES&S is offering Nassau a $4.7 million dollar credit for their ImageCasts, not $3.5 million; they are offering 100 project management days, not 400; the waived $150,000 license fee is not for the Election Management System but for a ES&S voter registration system; finally, the cost of the DS200 scanners is quoted at the full list price of $8347 each, not the $7100 per scanner that I reported. I find this last difference most interesting, because multiple sources had quoted the lower price independent of each other, and seemed quite certain of the lower number. Hard to account for the big difference in cost between the document and what Nassau officials originally stated.

The document shows a few other perks I didn’t report on initially. ES&S is agreeing to provide Nassau with ballot printing for three years at a guaranteed price of 55 cents per ballot; they will provide 400 hours of custom development for the voter registration system valued at $250/hour; finally ES&S is promising to sell their DS850 central count scanner to Nassau for $125,000, if the system “is certified for use in the State of New York.”

During the week of December 7, 2009, the New York State Citizen Election Modernization Advisory Committee met and reviewed certification test data results from the state’s testing program, and to vote on recommending approval of the two voting systems to the four Commissioners of the State Board of Elections. The Commissioners will vote on final certification at their December 15, 2009 meeting. On December 10, 2009, the Advisory Committee approved recommendation by a vote of 10 For and 1 Against. I was the only vote opposing the recommendation. Below is the statement I made prior to the committee vote.

I believe in New York State’s certification process. It is rightfully called the best in the nation. We have required vendors to conform to a higher standard than ever before, we have conducted extensive testing with independent oversight, and as a result we have a huge trove of data upon which we can base our decision on whether these new voting systems are ready to be certified. Just the fact that we even have this substantial set of test results against a large number of very specific standards is a credit to New York’s process. Arguably, we have more data available to us about these systems than has ever been made available to a public body such this Advisory Committee before. It is because of this comprehensive approach that we can even be talking about some of the test findings, which never would have been revealed in a typical voting system certification program.

While New York’s certification process is excellent, and execution of it by State Board staff and NYSTEC has been superb, ultimately certification is about the vendors – how precisely have they met the requirements put forth in the New York specification, and to which they are contractually obligated to fulfill? Arguably, the two systems being considered in New York have been subjected to a more rigorous examination than any before, where every detail has been tested, reviewed, and retested under close observation not only by the test team but also by independent reviewers.

But the findings show that as of today, while the two voting systems have managed to meet most of the New York’s requirements, they have not yet met all of them, including some which to me, as a technologist, are important. I understand the feeling that these machines are ready to be approved, because indeed, they are so, very, very close to meeting all of the state requirements – only a handful of items remain unresolved. But as the only member of the Citizens Advisory Committee with a technical background, I believe that the citizens of New York State expect me to base my decision on technical considerations, not administrative or political ones. When I managed software projects, I’d often frustrate my engineers when I would refuse to release software which was oh-so-close to meeting the full requirements specification, but was not quite there yet. How often did I hear “But that’s not really an important requirement”, “We’ll never see that condition out in the field”, or “We can retrieve the data from the backup system, so what’s the difference?” But I would never budge. My job was to make sure that the specification was met, fully and completely. That is what my boss expected of me back then, and I believe that is what the voters of New York State expect of me today.

It seems to me that we can’t pick and choose which aspects of the law we wish to comply with, the law is the law. So to me, our criteria for recommendation are straightforward. We can’t make our recommendation based on personal preferences; we can only base our recommendation on the specific requirements of the law.

I’m sure many lawyers will have many discussions over the coming days and weeks about what legally constitutes conformance with New York’s Election laws and regulations. I am not a lawyer, I’m just a software engineer who’s been asked to evaluate compliance with a technical specification. And while I rely on my technical knowledge and experience to evaluate the data, I can only evaluate conformance with the law based on common sense. And common sense tells me that the law is NOT like a game of horseshoes, where close is good enough. It seems to me that complying with the law means complying with all of it, not just 90 percent of it, or 95, or even 99. Based on my evaluation of the data I conclude that no matter how far they’ve come and how close they now are, the voting systems under consideration have not yet met all of New York’s requirements. I will therefore vote No on recommending approval of these systems for certification.

This is my opening statement for today’s meeting of New York’s Citizen Election Modernization Advisory Committee, which was created by the State Legislature to advise the Board of Elections on adoption of the new systems. Testing is now completed and results are being evaluated, with the State Board of Elections scheduled to make a determination on certifying systems on December 15th.

We have come to an important moment in New York’s saga in adopting HAVA compliant voting systems. The long and rigorous testing required by New York State’s laws and regulations, arguably the best in the nation, has now been completed. Remaining is the difficult part – determining whether the systems have met the high standards required by New York State.

We have been presented with a huge amount of data to evaluate, and have only an extremely short time in which to do so. I’m pleased the Board staff has set aside this day to answer all our questions, but I am concerned that even the long, intense session we are embarking on may be insufficient to thoroughly assess the volume of data before us. Nevertheless, I look forward to today’s session and getting answers to the literally hundreds of questions I have about the test results.

Finally, here are my thoughts on what we should use as our evaluation criteria to determine whether the systems have met New York’s standards. It is simple – the systems must meet specific standards set forth by state law and regulation. In New York’s case, this also includes meeting standards defined in the Voluntary Voting Systems Guidelines of 2005. New York is the first state in the country to require compliance with this standard, so the results here have national implications as well.

The results present a large matrix of the tests outcome against specific requirements of New York law and regulation. It seems to me that our criteria for recommending a system is this – have the specific requirements of New York State law been met? After all, we can’t pick and choose which aspects of the law we wish to comply with, the law is the law. So to me, our criteria for recommendation is straightforward. We cannot make a recommendation based on personal preferences. We can only base our recommendation on the specific requirements of the law. New York has been rightly proud of our best-in-the-nation certification process. Now we are obligated to our fellow citizens, for whom we stand in proxy, to assess whether those requirements have been fully met.

Testimony on the voting machine pilot I gave at the New York State Senate Election Committee’s hearing on November 30, 2009. Full submitted testimony is posted here.

New York State was wise to do a pilot of our new voting systems. It provides an opportunity to work out the kinks in new systems and the procedures for managing them, allows us to learn from the inevitable mistakes, and to apply what we learn in the future. In my opinion, New York’s just concluded pilot was extremely valuable and revealed some important areas that need improvement. Certainly, privacy and ballot design issues often came up. However, given my limited speaking time I will submit comments on those two issues with my written testimony. Today I will discuss another pilot experience from which important lessons can be learned – the failure of some of the new voting machines and how New York can benefit from this failure.

Questions Raised in NY-23 Congressional Race
The NY-23 Congressional race had national attention, with 9 of 47 pilot counties holding elections in this race. Despite assurances from vendors, some of the new machines were inoperable on Election Day. In cases where machines failed, paper ballots were treated according to New York State emergency ballot rules, assuring that all votes were counted. Indeed, this is the great strength of New York’s new voting system – it ultimately relies on the marked paper ballot which contains a software independent record of voter intent.

I do not agree with those who claim “impossible” results – there is simply not enough data available from pilot districts to justify such sweeping claims. But all of New York’s voters have a stake in knowing what happened, so why not take a full look? After all, wasn’t that exactly the point of the pilot program – to take a detailed look at what happened, from soup to nuts, in full view of the public?

We know what went wrong – a bug caused some machines to hang on certain vote combinations in multiple candidate elections. As a retired software engineer, I seriously question vendors’ in-house testing, which absolutely should have turned up a simple defect like this. It also indicates that the state’s certification testing has some big holes, something which the State Board needs to be looking at very closely.

The good news is that New York’s required pre-election testing was robust enough to discover the mistake, but recovery procedures failed to identify all machines that needed a corrective patch. And the fact that some counties found the problem in pre-election testing while others did not indicates that not all counties performed adequate testing. The explanation given by the State Board is reasonable and I have no reason to doubt it, but a much fuller accounting of the events surrounding the machine failures is in order and would silence critics.

Given that the pilot revealed a serious equipment failure, the State Board of Elections should release a complete and detailed description of the events including: full details of each county’s pre-election testing; procedures used to identify problem machines; an analysis of why these procedures failed; the process used to develop, approve and apply a patch to machines; the county, state and vendor personnel involved in developing, approving, and applying the patch.

This was a pilot – it was inevitable there were going to be flaws. But the whole point of conducting it was to make sure that problems are identified and corrected. If we’re serious that the purpose of the pilot was to find flaws in equipment and gaps in procedures prior to a state wide roll out, then we can only do so with a full collection of data, analysis of that data, and full publication of that data so that it can be independently reviewed by the public.

I ask the Senate Elections Committee to task the State Board of Elections with providing a full analysis of the entire pilot program and the performance of the new systems, and provide a complete set of data from all pilot Election Districts to the public for independent analysis. In order to perform a meaningful analysis, the State Board should provide the public with the following data from all participating pilot districts:

• The number of voters signed in to each Election District poll book.
• The number of ballots distributed to voters at each poll site.
• The number of absentee ballots counted at each poll site.
• The number of absentee ballots counted at the County Boards.
• The number of emergency ballots counted at each poll site.
• The number of emergency ballots counted at the County Boards.
• For each machine in each Election District:

o Totals from tally tapes for all races.

o Public counter numbers before election open and after election close.

o Viewable images of tally tapes.

• For all races, from each Election District:

o Election night totals initially reported from polling places to County Boards.

o Election night totals reported by Election Management System after import from poll site memory cards.

o Certified election totals.

o Results of required 3% audit.

Conclusion
New York State has worked hard to make the process of using the new HAVA compliant voting systems the most rigorous in the nation. As part of that rigor, the pilot program was meant to be a test run to help us learn from mistakes. Now the State Board of Elections is at a critical juncture – New Yorkers want and need to know the full details of the pilot. What went right, what went wrong, what are we going to do better next time?
Thank you.

Erroneous reports are circulating that a virus caused a problem in the scanners used in the NY-23 Congressional race. The reports, based on an inaccurate article published in the Gouverneur Times, are incorrect. There was no virus in the NY-23 machines. How do I know? Well, in the first place, the Dominion ImageCast scanners in question run the Linux operating system, which is nearly immune to viruses due to its inherent ability to lock out programs that lack explicit permission to run, unlike the highly vulnerable Windows operating system. Second, the State Board of Elections gave an account of the problem at their public meeting on November 10, and which I confirmed in a phone conversation with staff earlier this week. Here’s what really happened:

Let’s be clear. While no votes were lost due to the ability to independently count the paper ballots, a problem did occur that affected certain machines around the state. The issue was a bug in the Dominion source code that caused the machine to hang while creating ballot images for certain vote combinations in multiple candidate elections (the ImageCast, like the other scanner used in New York, the ES&S DS200, creates digital images of each ballot which can be reviewed after the election). So if, for example, a “vote for three candidates out of five” race was voted in a certain way, the scanner would hang. This is one reason why the defect affected some, but not all machines with ballots containing this type of race, because only certain combinations of votes caused the memory problem. But here’s the thing – the problem was discovered before the election.

New York State has decent requirements for pre-election testing of machines, and they came through. The defect described above was discovered a week before the election during pre-election testing, just as it should! Indeed, it was putting the machines through their pre-election paces when the defect was discovered. The problem was determined to be in the ImageCast source code, which may not be modified without retesting and certification prior to use. But it was possible to modify the ballot configuration file to contain less ancillary text, freeing up a bit more memory and preventing the crash. The Board of Elections approved the configuration file change, the 10 counties which had races susceptible to the bug were identified, and the changes made to the files in plenty of time for the election. Everything worked the way it should have, except for one thing – the process of identifying machines which needed the fix missed some of them, so the modified configuration file was not installed, and, as expected, these machines hung.

In my opinion, it’s a Bad news-Good news-Bad news-Good news situation:

1) The bad news is that the scanner source code had a bug that Dominion should have found before they delivered machines to New York for certification testing. I spent a long time doing software engineering, and in my opinion a robust in-house test plan absolutely should have turned up a simple memory buffer overflow like this long before the code was delivered to the state, especially when New York’s ballot requirements are known and supposedly addressed by the vendor. Dominion gets an ‘F’ for blowing an easy one in their first roll-out of their new scanner.

2) The good news is that pre-election testing found the bug before the election, a reasonable fix was found and approved, and it was applied to the machines that needed it before the election – well, almost.

3) The next bit of bad news is of course, that not everyone who needed the fix had it applied. I’ve had conflicting accounts of who was responsible for determining this. I’ve heard of at least three – the State Board, the local county election officials, and Dominion. In my opinion, it’s all of the above. Here we have a serious procedural problem that needs to be addressed. When a problem is found prior to an election, what are the proper procedures for accurately determining who is affected? This is one good lesson the State Board should take from the pilot.

4) Finally, the good news – because New York votes on paper, everybody’s vote was counted. When the scanner stopped working, the ballots were removed and counted, so no votes were lost. Paper ballots, a software independent record of the vote, proved their great value in their very first outing in the Empire State. Compare this to lever machines, where counters on the back would get stuck and wouldn’t turn when the vote is cast, something that occurred with far more frequency than most New Yorkers realize. When the counters on the back of a lever machines froze, a machine bug typically not discovered until the polls close, those votes were lost forever. More than a few lever machine elections had the incorrect candidate declared the victor as a result. When the scanner freezes, everyone knows about it, the machine is removed from service, and the paper ballots of those who have voted already and of those who will vote later in the day are sure to be counted.

I’ll take paper any day.

When I heard that New York City had found that a photocopy of a ballot could be successfully scanned by both of the two systems being used in New York State, my first thought was that this is Sun-Rises-in-the-East news. It didn’t surprise me, and the first line of defense against attacks involving any type of fake ballot, photocopied or printed, is well designed and implemented ballot management security procedures. But this is a complex issue which bears some discussion.

Before discussing the security threat, let’s look at a technical question – should a scanner be able to detect a photocopied ballot? One of the challenges posed by modern high resolution copiers and printers is that they are capable of producing all manner of difficult to detect counterfeits. This became an extremely serious problem in the 1990’s as convincing counterfeit currency became easy to produce using the off the shelf copiers. In response, the United States has been replacing currency with new bills containing anti-counterfeiting features. So it’s no surprise that a modern copier can create a ballot that can be successfully scanned.

Is there any way to make a scanner detect a counterfeit ballot? Yes, it could be done. Although it’s a little known fact (and a bit unsettling from a civil liberties perspective), modern copiers and printers create an invisible tracking code in the form of dots viewable only with a special flashlight. The Electronic Frontier Foundation cracked these codes, finding that they contained the printer serial number and date and time the document was printed. In theory, one could use this or a similar technique to print ballots with an invisible code that the scanner could look for, and failing to find it, flag it as a counterfeit. But to do this we’re talking adding new features to the machines, and raising the cost of paper ballots even more than their current exorbitant cost. Would it be worth adding such a counterfeit detection feature? My opinion is no. And the reason is that the place to address fake ballot attacks is not by adding features to the machine and ballots, but implementing proper ballot security procedures and protocols.

Let’s analyze the ways an attacker might use counterfeit ballots, then look at ways to defend against it. There are three points where one might insert counterfeit (and possibly pre-marked) ballots in with real ones – before the election, during voting, and after the election. Before the election, an attacker would need to get their counterfeits mixed into the stack of real ballots, hoping to get them handed out to voters. But here in New York State, we require that ballots come in pads with tear off stubs containing a serial number. These numbered ballot pads become part of the chain of custody record as soon as they are received from the printer. During an election, each ballot is torn off the pad when it is handed to a voter, with a notation made of the number and the voter it was given to (the ballots themselves don’t have serial numbers so a voted ballot can’t be traced back to a specific voter without using specialized paper analysis techniques). So in New York, you can’t just throw in a batch of photocopied ballots with the real ones prior to voting. You’d need to counterfeit an entire pad, tear off serial numbers and all. To produce fakes of NY stubbed and numbered ballots, you pretty much need a print shop, a photocopier just won’t cut it.

Potential attack point two occurs during voting. A voter could hide a photocopied ballot, vote their real ballot, and then attempt to insert one or more fake ballots into the scanner after the first. Of course, it might not be quite that easy to insert two or more ballots without being seen by poll workers, but we should assume that someone practiced could pull it off. Now we’ve got more ballots scanned, counted, and in the ballot box, than were actually handed out. But this attack is easily detected on a scanner. Each machine has a public counter, which notes the number of votes cast on that machine. It increments by one every time a ballot is successfully scanned. The public counter number is noted at the beginning and end of the election, and the difference compared to the number of voters who signed into the polling book. If the public counter matches the number of voters, no extra ballots were cast. If it is greater than the number of voters, you have detected the presence of counterfeit ballots, and response procedures now have to be invoked to determine which ballots were faked and to recount the real ones.

Finally, you could insert counterfeit ballots into the stack of ballots anytime after the close of the election, so that the fakes are included in an audit or recount. The answer to this is good ballot handling security practices – securing ballots with tamper evident seals; proper inspection of those seals to detect tampering; keeping ballots under observation; maintaining detailed and accurate chain of custody records. Ultimately, this is what it comes down to. You must be rigorous about handling ballots in a secure fashion, no ifs, ands or buts.

A final note – these attacks are not specific to ballot scanners, but are possible with any election, whether counted by machine or counted by hand. In a counterfeit ballot attack, the method used to count ballots is not important as long as you can insert the fakes at some point before they are counted or audited. A hand counted election is as vulnerable to counterfeit ballot attacks as one counted by scanners. All voting methods have vulnerabilities. Confidence in the election’s outcome depends on requiring and implementing excellent security procedures no matter what you vote on. In order to preserve the voter’s intent in a verifiable, software independent way, no current system is superior to a paper ballot. But you cannot, must not, skimp on security procedures for handling them – before, during, and after the election.

For the first time, NY-23 will vote on paper ballots

The special election for the seat in the NY-23 Congressional district has begun to draw national attention, being seen by some as a bellwether of the strength of conservative Republicans. Unnoted by the mainstream media is the fact that the election will be conducted on new voting systems that are being used for the first time as part of the state’s pilot program. The pilot, which permits use of the as yet uncertified machines on a provisional basis, was designed to allow local Boards of Elections try out the new systems in an off year election when turnout is typically low and few races for state or national offices are held. However, the vacancy in the NY-23 seat created by the resignation of Representative John McHugh and the political makeup of the district, always strongly Republican, creates a high tension atmosphere where the eyes of the nation will focus on northern New York on November 3rd. The performance of the new voting machines as well as the procedures used to manage and secure the paper ballots will be under intense scrutiny.

NY-23 lies in the northern most part of New York State. It is made up of all or parts of 11 counties, all of which but for two, Clinton and Essex, will be using new Dominion ImageCast scanners to tally paper ballots marked by voters. The county Boards of Elections will be programming and installing the election data, sealing systems with tamper evident seals, printing and distributing paper ballots. Poll workers at 277 poll sites across NY-23 will follow new security procedures to inspect and turn on machines, record everything in chain of custody logs, and hand out paper ballots to voters. Next week the high visibility of the NY-23 race will test how well election officials have prepared for the election in terms of poll worker training, secure management of ballots and machines, and procedures for auditing and recounts. It will also be a test for the ImageCast machines, which are being used for the first time in a general election.

The September primary saw a limited use of the new scanners, and for the most part went well, although not without some hiccups. We should expect the same on Election Day, and given the national focus on the race there is a good chance that someone will raise questions if there is any indication at all of machine problems, or ballot security issues, or procedural mistakes by poll workers. All the more reason that election officials in NY-23 counties should be paying meticulous attention to getting all the myriad details of preparing and running a 21st Century election right. As the saying goes, the last thing an election official wants is to be in the newspaper on the day after the election. If you’re in the newspaper, it means something has gone wrong. And in today’s media environment and a high stakes election like this one, if anything goes wrong you don’t just get in the newspaper, you’re fodder for the 24/7 cable/internet news cycle.

So what happens if something does go wrong? Well, that’s the beauty part of paper ballots. With good security and chain of custody procedures, we can count them independently of the scanners. While New York’s current auditing provision leave much to be desired, it’s not nothing – 3% of the machines must be audited. And, given the high stakes and New York’s well known propensity for ‘litigious behavior’, I expect that if any questions arise someone will be in Court requesting a recount of the paper. Since this is the first use of new machines and a pilot program at that, there’s a good chance a Judge will grant a request for a recount of the paper ballots, just as one did in Putnam County after the September primary.

Look at what happened just this year in Minnesota, in a hotly contested Senate race that had the eyes of the nation on it. After all the questions and controversy, hand counting the paper ballots decided the contest once and for all. At last, in New York State, we can do that too.

Bad for the country, bad for New York

On the face of it, it would seem that the proposed merger of Premier Voting Systems (aka Diebold) and Election Systems & Software (ES&S) shouldn’t matter much to New York State. After all, Premier pulled out of the state over a year ago, and ES&S splits the state’s voting system sales with a competitor, Dominion Voting Systems. But there’s plenty of reason for New Yorkers to be wary of further consolidation of the rapidly shrinking voting machine industry.

Recall the not so distant past when ES&S, along with Sequoia Voting Systems, jointly decided that paperless voting was New York’s future and offered only touch screen DREs to the state. When New Yorkers for Verified Voting organized the first ever demonstration of a paper ballot system with an accessible Ballot Marking Device and an optical scanner at the Albany State Capitol, the makers of the AutoMark ballot marking device, with whom we had arranged the demo, were ordered by ES&S to remove the scanner because it didn’t fit their product plans. The New York Daily News reported this story in 2005:

At the Capitol recently, a lobbyist managed to shut down a demonstration of optical scanning by getting his client to pull its machine from the display. Assemblywoman Sandra Galef of Westchester called the company to object and was told that New York is “a touch-screen state.” ” I said, ‘We are?’” Galef recalled. “I’m a legislator. I don’t think I’ve voted on anything.”

Thanks to citizen activism, DREs were ultimately defeated in New York, but four years after that incident there remain only two vendors supplying voting systems to the state. Sequoia Voting Systems recently turned over their New York State contract to Canadian based Dominion Voting. That leaves this relatively small company up against the only other vendor left standing – ES&S, which by merging with Premier seeks to dominate US voting machine sales and service contracts. Domination of the voting system industry by a single corporation is bad for many reasons – less leverage for states to negotiate reasonable prices; transparency issues; even greater risks to security and reliability. Somehow, I can’t see it being good for New York.

But New York has two vendors, so there is competition, right? Yes, we do – for now. But a possible future New Yorkers might consider is one where Dominion is swallowed by ES&S, ceding it’s New York State voting machine contracts to ES&S just as Sequoia has with Dominion. This is not so unthinkable. A small company has incentive to sell out to a larger company anytime the company principals deem it in their best interests to do so. Recent history is full of small companies swallowed by larger ones which were swallowed in turn by even larger ones, as once diverse industries shrink and consolidate until controlled by just a few. This consolidation process is taking place in the voting machine industry right now, with ES&S and Premier’s merger effort as the most recent example. Is it so hard to imagine a scenario where ES&S makes an offer they can’t refuse and swallows Dominion, bringing New York State’s voting machine contracts under its exclusive control?

New York State’s own Senator Schumer has already spoken up, calling for the DOJ to investigate the potential merger. But it is also critical that local election officials and state Attorneys General weigh in on this, as they are in the best position to represent the interests of voting machine customers and the public. Unfortunately there is little time and the only opportunity to do so may be before the upcoming November 12 hearing of the Hart InterCivic antitrust complaint, which alleges violations of the Sherman Antitrust Act. Here in New York, we need to urge state Attorney General Cuomo to intervene along with other state Attorneys General and support Hart’s effort at injunctive relief. The proposed merger of ES&S and Premier is bad for the country, and bad for New York.