I had testified before the same subcommittee on July 19, more than a month ago. So it came as some surprise to be awakened this morning by the beeping of my Blackberry, announcing the arrival of an email from Charlottesville City Councilor Kevin Lynch, who asked that his message be forwarded by General Registrar Sheri Iachetta to the Electoral Board. (He also sent copies to all of his fellow Councilors and to the City Manager.) The original message was dated Sunday, August 21, and sent at 10:50 p.m.
The issues that Councilor Lynch brings up in his message are important and timely enough to require an immediate response. So here it is.
Councilor Lynch writes:
Earlier today I viewed a video of individuals giving testimony to Senate HRJ371 committee on voter system security.There is no official video record of the subcommittee meetings. The only person recording the proceedings on video was Charlottesville resident Don Wells, who must have, directly or indirectly, provided his recording to Mr. Lynch. Since I have not seen that recording, I do not know whether the recording Mr. Lynch saw was complete or redacted. Given that, later in his message, Mr. Lynch takes some of my comments out of context, I suspect that he did not see a complete record of the hearing or of my statement before the subcommittee.
Mr. Lynch goes on:
Mr. Sincere stated that Charlottesville voters were generally not concerned with the integrity of the computer systems used in voting in Charlottesville because they were confident in the level of review that that the systems had been put through, noting that the Hart system had gotten good reviews from every segment of the community. He noted that there were many other opportunities for voter fraud which would not necessarily be solved by a verifiable paper trail and stated that when speaking with citizens who had concerns about voter verifiable paper trails, he sometimes felt as though he we was "stepping into an episode of the X-files".I did, indeed, say this. The context was this: One voter, in bringing his concerns about the Hart eSlate voting system to the Electoral Board, suggested that a wireless device could be secretly installed in the eSlate components, and that someone outside a polling place could use radio signals to change the results of an election unbeknownst to election officials. It was precisely this sort of "phantom menace" that inspired me to use the X-Files
reference.The problem with conspiracy theorists is that, whenever you give them a calm, rational explanation for what it is they find disturbing, they ignore or dismiss such reasoning and move on to some other outlandish claim. For conspiracy theorists, the absence of evidence of a conspiracy is simply evidence of the success of the conspiracy's cover-up. As Peter Schaffer put it in his play, Lettice and Lovage
, "Fantasy floods in where fact leaves a vacuum."Councilor Lynch continues:
Mr. Sincere stated that that there was no motivation for a hardware or software engineer from another state to interfere with a Charlottesville election and that any suggestion that such motivation might exist is "in the realm of science fiction".I did not say that there was "no motivation" for a software developer in another state to interfere in a Charlottesville election; I did say that such a motivation was highly unlikely, and that the scenarios for doing so -- by, for instance, manipulating the ballot through unauthorized code embedded in the software months or years before the candidates in a given election are known -- are so outlandish as to be in the realm of science fiction.
When I testified on July 19, Delegate Melanie Rapp perspicaciously noted that "money is a very strong motivation," which is true. But the transaction costs for rigging a local election by a distant and malevolent force are far to steep to make such manipulation likely.
In today's testimony, I gave the example of the 57th House of Delegates district, which has a rare open-seat election this year. Because of the way the district is configured, whoever wins on November 8 is likely to hold the seat for 20 years or more, making the stakes very high for those interested in the outcome of the election.
The 57th District consists of eight precincts in the City of Charlottesville and eight precincts in Albemarle County. About 60 percent of the voters in the district live in Charlottesville and about 40 percent in Albemarle County.
In order for a sinister force to manipulate the outcome of the election through outright bribery of a software engineer for Hart Intercivic, he (or she) would have to: (1) find out who designs the software for Hart; (2) seek that person out; (3) discover that software is created by teams of designers, not individuals; (4) pay off the supervisor of that software engineering team, who would approve any product before it goes to the customers; (5) pay off the State Board of Election certification specialists who must approve all software upgrades before they can be installed in Virginia-certified equipment; (6) pay off the Charlottesville-based technicians, General Registrar, and Electoral Board members who must approve and supervise any software or hardware changes to the equipment used in Charlottesville elections.
And then that same sinister manipulator would have to go through all six steps, if not more, with Sequoia Voting Systems, the company that provides voting equipment for Albemarle County, and the Albemarle election officials.
This would entail a conspiracy involving dozens of private individuals and public officials. Is it realistically possible to sustain such a conspiracy, short of using the Bilderbergers as a model and supporting device?
Is it possible that a potential election-rigger could do this? Yes, I told the subcommittee today, anything is possible; it is just as likely that Star Wars fans would vote for Jar-Jar Binks as their favorite character. (In other words, not likely at all.)
That's what I mean by "the realm of science fiction."
In offering this example to the subcommittee today, I provided them with a copy of an article I wrote last October, which was published in The Hook, The Free Liberal, and The Metro Herald (and perhaps other newspapers), arguing that diversity of election systems -- each jurisdiction using different types of hardware and software, from paper ballots to lever machines to optical-scan devices to DREs -- is our strongest defense against electoral fraud and manipulation. I urged the subcommittee , whatever it ends up recommending, to avoid imposing a single system on Virginia localities. "Uniformity," I said, "is an invitation to fraud."
More from Mr. Lynch's Sunday email:
He [Mr. Sincere] also stated a concern that with a paper trail system, a voter could disrupt balloting by claiming that the paper trail did not match his/her intended vote.This is a real concern. There is no provision in Virginia election law for allowing a voter to cast a second (or third) ballot if he believes that his first (and only legal) ballot was cast incorrectly. If a voter claims that a paper receipt does not reflect his actual vote, the only recourse election officials would have is to take the voting machine out of service until it can be determined what was "wrong" with it.
In a jurisdiction like Charlottesville, with just eight precincts, it would only take a half-dozen or a dozen people determined to make mischief, to time their visits to polling places and create havoc by claiming, correctly or not, that the machines are not recording their votes properly and forcing the machines off-line. Other voters would find themselves standing in line for long periods of time while election officials deal with the problem; some would choose to leave without voting; others would find plenty to complain about after the election about "inefficiency" and "unprofessionalism" on the part of election officials who are, in fact, doing their best to make a bad situation bearable.
This kind of mischief is not so different from that documented in Milwaukee during the 2004 general election, when it was discovered that partisans of one presidential candidate had slashed the tires of vans owned by the other candidate's local party, vans intended to carry voters to the polls. (I am purposely leaving out the names of the candidates and parties to avoid charges of partisan incitement.) Such actions are intended simply to disrupt the electoral process and prevent some people from voting, undermining confidence in the democratic process and corrupting the system in a direct and palpable way.
Mr. Lynch continues:
Mr. Sincere is of course entitled to his opinion and to give testimony as he sees fit. However, I am concerned that he was speaking as Chair of the Charlottesville Electoral Board and furthermore stated that his Democratic colleagues were "on the same page" as the testimony that he gave.In its wisdom, the Virginia Code insulates Electoral Board members from partisan political pressure. We are appointed by the Circuit Court Judge for our jurisdiction, after being nominated by political party chairs. Our duties are defined by the state and, being independent, we are not answerable to elected officials at any level. The views expressed by an elected official carry no more (or no less) weight, as far as we are concerned, than the concerns of any other voter. Our "clients," such as they are, are voters, and we try our best to deliver election services in a fashion that serves them with both efficiency, trustworthiness, and integrity.
I have no inside information about how other local Electoral Boards operate, but the Electoral Board for the City of Charlottesville is characterized by what some might perceive as an incredible lack of partisanship. The three members of our Electoral Board reach consensus on something like 95 percent of issues that come before us, and on those few issues on which we disagree, the disagreement is seldom -- if ever -- along partisan lines. So when I say that the three of us are "reading off the same page," I can do so with full confidence.
More from Mr. Lynch:
Sheri, you will recall that on March 7, 2005 a member of the public requested that Charlottesville make accommodation for a verifiable paper trail, and as this is a frequent request and you and Mr. Sincere were in the audience, I asked that the Electoral Board investigate whether this feature could be added to the Hart eSlate systems that we have. I believe that the ability to produce a verifiable paper trail, in the event of a recount, or a problem with one of the machines is a concern that is shared by most, if not all of the Councilors, as no one objected to me asking the Board to make this inquiry.Both the General Registrar and I were, indeed, present at that meeting of City Council. The request Mr. Lynch refers to was generated by an afterthought in a public comment presentation by a voter who was primarily concerned about another issue. Mr. Lynch requested information about a verifiable paper trail, which we promptly provided.
I find it puzzling that Mr. Lynch reads the lack of objection to his request for information as agreement by other Councilors that a verifiable paper trail is desirable, or that they share his concerns. City Councilors frequently request information, individually, from city or state agencies, and no one raises objections because information requests are a basic part of any legislator's job. If other legislators raised objections every time they failed to share the aim of an information request, little legislative business could be conducted.
Perhaps Mr. Lynch has independent knowledge that his colleagues share his concerns -- from, for instance, conversations outside of Council meetings -- but to say that their lack of objection to his information request indicates such a shared concern is disingenuous, at best, and presumptuous, at worst.
Now comes a key paragraph in Mr. Lynch's missive:
Following my request, I got a letter from Mr. Sincere, stating that the Electoral Board's "hands were tied", because the Commonwealth of Virginia had not yet certified any equipment with the paper trail function for use by local governments in elections. However, his testimony in front of the State Senate committee seems to be actively discouraging them from taking steps to certify such equipment.It is true that Virginia has not yet certified for use any VVPT (sometimes rendered as VVPAT) equipment. There is, in fact, a lack of national standards and guidelines, something learned too late by some states (such as California and Nevada) that passed legislation requiring such equipment before such standards were in place, leading to, if not chaos, then at least some very dicey situations in various polling places in those states during the 2004 elections.
By saying I seem to be "actively discouraging" the state from certifying VVPT equipment, Mr. Lynch utterly mischaracterizes my position.
In my testimony before the Hugo subcommittee on July 19, and again today, I said quite clearly that I have no objections in principle to the use of VVPT, but that there are a number of very serious issues that must be resolved before VVPT should be mandated by legislation or regulation. For example, the League of Women Voters -- one of America's oldest and most admired non-partisan voting-rights organizations -- says in a FAQ about DREs and VVPT:
There are a number of problems with requiring a voter-verified paper trail as part of DREs. The most significant is that the VVPT does not provide a safeguard against the supposed problem: a machine that is programmed to record the incorrect vote. If the machine can be programmed to record an incorrect vote, then it can be programmed to print out a misleading confirmation, which would give the voter a false sense of security. Advocates for the VVPT say that the individual ballot paper confirmations can be recounted, to guard against this problem. However, a very important problem remains: The VVPT paper records from add-on printers are difficult to recount consistently, leading to inaccuracies. The VVPT system has all the problems inherent in a paper ballot recount. These include questions about mutilated or hard-to read ballots, the possible loss or manipulation of the paper ballots, and the fact that no two recounts yield the same result. VVPT advocates also say that voters do not have to verify the paper records; however, unless each voter verifies each record, then the paper records are not reliable. Thousands of unverified paper records add neither accuracy nor security. In short, the voter-verified paper trail does not provide a real safeguard and it has significant operational problems. The best safeguards are those discussed above – certification, testing and management systems for DREs, as well as all other voting systems.The League of Women Voters adds:
The voter-verified paper trail adds costs and complications to the voting process, does not add significant security, and undermines disability and language access. To summarize: First, the voter-verified paper trail does not provide the security its proponents suggest. Other mechanisms can provide necessary safeguards against security concerns. Second, the voter-verified paper trail has not been demonstrated to work. The individual paper records produced by add-on printers on DREs are not reliable and accurate for a recount. Third, the voter-verified paper trail requirement undermines access for persons with disabilities and limited English skills. Fourth, the voter-verified paper trail doesn’t add reliability to the system at the polling place. It complicates the polling process while the monitoring of machines during Election Day provides a similar safeguard. And fifth, the voter-verified paper trail does not address the real election system problems that caused nearly six percent of votes to be lost in 2000, including registration database failures, ballot design problems and polling place operations.Consider just the question of cost, something that legislators, both in the General Assembly and at the local level -- with fiduciary responsibility to taxpayers -- should always keep in mind.
In Charlottesville, retrofitting the Hart system with VVPT add-ons will cost approximately $100,000, just for hardware. That does not include the cost of training, maintenance, storage, and security for the new equipment. That price is equivalent to the cost of running three local elections in the City of Charlottesville. And those costs are not reimbursable by the federal government under the Help America Vote Act, as our original purchase of the Hart eSlate system was, because the add-ons are not considered "new" equipment designed to replace unacceptable voting technologies that will become illegal as of January 1, 2006.
In a statement before the joint subcommittee today, Judy Flaig, the Election Manager for Fairfax County, noted that the cost of retrofitting for Fairfax would be at least $4 million. She also said that after a typical election using proposed VVPT technologies, the Electoral Board would have to turn over paper ballot records weighing 8 tons to the Clerk of the Circuit Court for storage as required by Virginia election law. (In the car on the way back to Charlottesville, Sheri Iachetta and I did some quick figuring and concluded that, in a Charlottesville election with 50% turnout, we would end up with 20 reams of paper ballots -- the preferred VVPT system, according to proponents who testified today, produces an 8.5 by 11 inch paper receipt -- to be turned over to the Clerk's office, in addition to all the paperwork that must also be stored by the Clerk for a specified period after each election.)
Mr. Lynch acknowledges, to his credit, that such problems exist:
I dont dispute that there may be some unresolved issues with voter verified paper trails, however I believe that this is something that Charlottesville voters and City Council generally support.Councilor Lynch may, as I suggested, have independent knowledge about the views of fellow City Council members, and they can speak for themselves, but he has no evidence that this is something that "Charlottesville voters ... generally support."
We have just over 21,000 active voters on the registration rolls in Charlottesville. We have been using the Hart eSlate system in every election since the May 2002 City Council contest. Prior to the selection of the Hart system by the Electoral Board, Charlottesville citizens were given many opportunities to test the equipment and to offer comments, either praise or objections.
In every election, Chief Election Officers are required to keep a list of "incidents" that occur during the course of Election Day. Incidents are anything from "voter did not have identification" to "air conditioning system was not operating" to "there was a fire in a waste basket." But most incidents that are recorded involve complaints or concerns of voters brought to the attention of Election Officers.
In seven elections using the Hart eSlate system, not a single incident report has included reference to a voter's objection to the lack of a voter verifiable paper trail.
In fact, out of more than 21,000 registered voters in Charlottesville, precisely three have come to the Electoral Board to express concerns about the lack of VVPT. Aside from those three individuals, who take their civic responsibilities seriously enough to meet personally with the public officials in charge of elections, the Charlottesville Electoral Board has received no letters, no phone calls, and no email messages regarding the lack of a VVPT system associated with the Hart eSlate currently in use.
That said, we have made it clear to those concerned voters, and anyone else who asks, that if the state decides to certify VVPT equipment for the Hart eSlate, we want Charlottesville to be a test location for the equipment.
Mr. Lynch says:
If the Electoral Board believes paper trails to be a bad idea, I would like to request that you and the Board come to a Council meeting sometime in the near future and explain to the voters why this is not a good idea - rather than saying in a letter that "our hands are tied" and then testifying to Senate subcommittees in a manner that seems to me to be asking for stronger rope.Charlottesville has been on the cutting edge in making improvements to the delivery of election services to voters. We were the first jurisdiction in Virginia to use high-school pages in polling places on election day. Although these students are not eligible to vote (because of their age) and therefore ineligible to serve as Election Officials, they are able to help out on Election Day, learn something about the electoral process, and perhaps find out that they want to be Election Officials once they reach the age of 18 and they register to vote. (And, since the average age of Election Officials in Virginia is 73, it is immensely important for us to recruit more workers who will be able to serve their communities for years to come.)
Another example of Charlottesville's pioneering experience in election practice is our early adoption of the use of "split shifts" for election officials. Until recently, pollworkers -- that is the term used in other states for what we call "Election Officials" -- were required to work the full day, from 5:00 a.m. to the close of polls at 7:00 p.m. and beyond. This made it difficult to recruit workers, who often cannot give up a full 14-hour-plus day because of job and family demands, or because of health considerations. The "split-shift" system permits some officials to work from 5:00 a.m. to 1:00 p.m. and others to work from 12:00 noon to 7:00 p.m. without jeopardizing the integrity of election record-keeping and the smooth operation of election procedures. Most voters are probably entirely unaware of a shift change during the noon hour, one of the busiest times for voting.
A third, and more salient, example is that the Charlottesville Electoral Board realized early on that the punch-card voting system that had been in use for decades was inadequate for the demands of the 21st century, and recommended moving to a DRE system even before the troubles in Florida during the November 2000 election and before passage of the Help America Vote Act (HAVA) by Congress in 2002. Charlottesville has been pro-active in making elections better for its citizens, and other communities throughout the state look to us as a model to emulate.
So for the Charlottesville Electoral Board to say, as I am saying now, that we know there are potential problems with verifiable-voting technology, but we want to make ourselves available as a test site to overcome those problems if the state decides VVPT is necessary, is neither uncharacteristic nor contradictory.
It is simply churlish of Mr. Lynch to suggest that we are looking for "stronger rope" in preventing the adoption of VVPT technologies. As election professionals, we have a responsibility to voters, candidates, and -- yes -- even elected officials to state the truth about technology and processes as we see it, to warn when necessary and to praise when warranted. To allow political or commercial pressures to influence our decison making ill-serves voters and jeopardizes the integrity of the electoral process.
Mr. Lynch offers an example from his own experience:
Being a software engineer myself, I am concerned that it is just not hackers that could pose a problem with an all electronic system. Bugs can also cause problems. Sheri, you will recall at Fridays after Five a few years back when the Hart system was being demonstrated to the public, I subjected one of the machines to the standard "monkey test" - randomly punching all of the keys. And you will recall that the system locked up completely.I am puzzled again. The Hart eSlate does not have any "keys." The Hart eSlate uses a wheel that voters turn to choose letters or numbers or names of candidates. (There are three buttons on the machine, one for "Cast Vote," and one each for "Forward Page" and "Back Page"; but there are no "keys" in the sense of typewriter or computer keyboard keys with letters and numbers.)
He goes on with his anecdote:
The Hart salesman could not get it working again, even after he pulled the battery out to completely reset it. He had to take it back to his car and get another one. He was very embarrassed and said that this was the first time a system had broken like that. While I dont expect people to go into a voting booth and randomly bang on the keys, the fact is, if this machine had been in use all day and someone had done that, it might not have been possible to get the votes out of it afterwards.The Hart salesman should not have been embarrassed, even if this incident happened as it is recounted by Mr. Lynch. The Hart salesman did exactly what he should do, and what any Election Official should do, in the event that a machine fails to work properly: He took it out of service.
As to whether it would have "been possible to get the votes out of it afterwards," the Hart eSlate is designed with multiple redundancies, so that votes can be retrieved from at least three separate and unrelated memories. The primary memories are in the device known as the JBC, or Judges Booth Controller, which contains the Mobile Ballot Box ("MBB," essentially a removable disk). But the eSlate itself also has a memory, so that in the event of an emergency, the votes cast on an individual unit can be retrieved. In addition to a cumulative total of votes cast for each candidate or referendum, the unique combination of votes cast by each individual voter is retained as a photograph called a Cast Vote Record (CVR), which can be examined after the election if there is a need for an audit or a recount.
Mr. Lynch offers this:
It's software. Bugs happen. Sometimes your computer locks up and you lose a few hours of work. In mission critical applications it is important to have a backup.Indeed, and we do. The Hart eSlate system can operate under hugely adverse conditions. During the November 2004 election, for instance, we lost electrical power at two polling places. The lights went out, but the voting continued -- because every piece of voting machinery comes with a portable battery back-up for use in precisely those circumstances.
It is condescending of Mr. Lynch to suggest, even in such a backhanded way, that the Electoral Board somehow abdicates its responsibility to pay attention to these issues.
Mr. Lynch concludes:
Sheri, I understand that you will also be testifying at the Senate hearing, which is continuing tomorrow. I would appreciate it if you would keep in mind the sentiments of voters who have spoken at Council meetings, my previous request to you and the Board, and please send Council a copy of your statementsActually, I was the person scheduled to speak at today's hearing. At the request of Mr. Lynch and Mayor David Brown -- who followed up Mr. Lynch's email with a telephone call to the General Registrar, as did City Manager Gary O'Connell -- I told the subcommittee, as a courtesy to the two Councilors who have expressed a view on this issue, that they did have some disagreements with me and the Electoral Board.
As I had no written statement to present to the subcommittee -- I hate it when people read a speech off a typewritten script, it lacks spontaneity and flexibility -- but spoke largely off-the-cuff, I would like Mr. Lynch to consider this to be "a copy of [our] statements" to be sent to City Council. In addition, I plan to address these issues in the public comment period of the City Council meeting scheduled for Tuesday, September 6, hours after the regularly scheduled Electoral Board meeting on the same day.
In her testimony today, Fairfax County Election Manager Judy Flaig said:
... let me point out that over 430,000 Fairfax County voters used the touch screen [N.B.: Charlottesville's Hart eSlate system is not a touch-screen system] machines last November, with only a handful of complaints. We received more complaints about waiting in long lines because there weren't enough machines as opposed to concerns about the accuracy of the machines. Nationally, voter registration issues and the lack of a sufficient number of voting machines were more of a problem than the accuracy of the voting equipment. As a taxpayer, I'd hate to see a lot of money wasted on VVPAT to satisfy a few vocal complainers who are attempting to solve a perceived problem that has an extremely low probability of occurring.Well-said, but in all modesty I think I put it more succinctly in my testimony to the subcommittee on July 19: the proponents of VVPAT have "a solution in search of a problem."
Given the undisputedly high levels of voter satisfaction with Charlottesville's eSlate system, and the lack of complaints from voters at large, the burden of proof is on Councilor Lynch and others who insinuate that the system is untrustworthy or inadequate. They, too, are suggesting a solution in search of a problem.
Shaffer, not "Schaffer."
ReplyDelete