Government Computer News

July 29, 2004

Does every vote count?
By William Jackson

LAS VEGAS-The American election system is broken and needs a good
dose of pencil and paper to fix it, two election analysts said
Thursday at the Black Hat Briefings computer security conference.

"It is really crap," said election analyst Rebecca Mercuri. "It is
not data that is being expressed in any meaningful way. That same
sack of crap is what we're going to get in November."

Electronic voting emerged as a major topic at this week's Black Hat Briefings.

"Thanks to the Help America Vote Act, electronic voting software will
be the primary tool used to count votes in the 2004 election," said
conference founder Jeff Moss. "If the security concerns identified by
experts are not addressed, it will be difficult to trust this
technology in the future."

The problem is inadequate procedures and standards for voting systems
that do not produce verifiable results, said Bev Harris, author,
journalist and activist.

"I think they need to replace the machines with paper and pencil
until they get that resolved," Harris said.

The problem is not technology itself, but technology contributes to
the problem, the two said.

"We know it's having an effect," Mercuri said. "We don't know for
sure what effect it is having."

Paper ballots are not perfect, but they are adequate and can provide
a more credible result than many electronic voting systems, she said.

"You can make paper ballots as bad as you can make touch screens,"
she said. "But we also know how to do paper ballots right."

Mercuri presented an analysis of results from last year's California
gubernatorial recall election, which she said raised questions about
the accuracy of the systems used.

The analysis showed that from 4.6 to 11.4 percent of voters neglected
to cast votes for some questions on the ballot. These inconsistencies
are called residual votes.

"There are always undervotes," Mercuri said. "Typically the number is
3 to 5 percent, regardless of the type of system used. This residual
vote is really huge."

An audit after the October election revealed that Diebold Election
Systems Inc. of North Canton, Ohio, had installed uncertified
software on its AccuVote-TSx voting machines in at least four
counties.

In the run-up to this year's March primary elections, the company
displayed what one state election analyst called "a disturbing
pattern" of continually updating software and firmware with versions
that had not undergone the federal approval process.

"The results of these applications are that the vendor jeopardized
the conduct of the March primary," the analyst told the secretary of
state's Voting Systems and Procedures Panel at hearings in April.

Following the hearings, Secretary of State Kevin Shelley decertified
direct-recording electronic voting machines that could not provide a
voter-verified paper audit trail, unless the machines already had
been in use and the polling place could also offer a paper ballot
option to voters.

The Diebold AccuVote-TSx was specifically excluded from use because
of its failure to receive federal approval for the hardware and
software.

Shelley in June issued standards for the paper audit trails that
electronic voting machines must provide. The standards are the first
in the nation and require a paper printout of each voter's choices
that the voter could accept or void, but not touch, before vote is
cast electronically.

The paper ballots would be retained and used for the state's
mandatory 1 percent manual recount. The electronic vote would be the
official record, except in the case of a full manual recount, in
which case the paper ballots would be the controlling record.

No DRE voting machines are expected to meet the audit trail
requirements by November.

No type of voting machine emerged as a clear winner in Mercuri's analysis.

"It has as much, if not more, to do with how the ballots are laid
out," she said. "There are a whole host of questions."

Harris blamed the problem on poorly designed equipment and software,
inadequate testing and implementation standards, and a lack of clear
accountability at the local level for verifying results.

Some computer experts have raised questions about the security and
reliability of electronic voting machines.

"We can't just depend on the computer profession," to raise questions
and improve the system, Harris said. Producing accountability means
involving the accounting community to produce verifiable results with
an audit trail, she said.