The New York Times has published a good article about the Volkswagen fraud. In brief, Volkswagen put fraudulent emissions-control software in its autos. The cars passed government tests for years, all the while spewing pollution in real-world use.
That happened. There’s nothing hypothetical about it.
It shows us what corporations can do with the computers they sell to us.
Now consider these facts:
- Only three companies' computers count 80% of America's votes. One of them, (ES&S) counts about 50%.
- More people have more motive to manipulate elections than anyone has to manipulate auto emissions.
- IT-naïve local election officials are less capable of detecting fraud in pre-election tests than air-quality regulators are capable of detecting fraud in emissions-control tests.
And the government tests didn't even catch it. The hack was discovered by graduate students who bought a car and tested it on the road.
But in elections, no one can perform a real-world voting-machine test. Voting machine companies and election officials maintain too much secrecy.
We have to be honest with ourselves. Local election officials—bless their hearts—will never be able to manage or test their computers well enough to deter or detect any fraudulent software. At least not before the polls close.
We must demand that our election officials do what every other computer-dependent manager does: Check their computers’ output for accuracy while there is still time to correct any errors. Nothing else can protect our right to self-government from computer fraud and error.
We need genuine, reliable outcome-confirming audits of our election results, and we need them NOW.
And no, we do not want to wait, like auto regulators did, until some grad students discover that our software has been hacked for years.
Two days after the April 4 election, 37 voters released the following open letter to Dane County officials, urging them to seek assistance from national experts and implement professional-quality election verification to build confidence in Dane County elections.
If you would like to be contacted to participate in any future actions such as this open letter, please email your contact information to WiscElectionIntegrity@gmail.com. You do not need to live in Dane County; we are working on growing our efforts in other Wisconsin counties, too.
April 6, 2017
An Open Letter to Dane County Executive, Supervisors, and County Clerk
regarding the continuing need for verified accurate election results
We recently read that Dane County will be posting ballot images online after the county canvass has declared election results final. To our knowledge, no other county in the nation is routinely doing this. The stated purpose is desirable: to “provide a level of confidence and faith in our electoral process that has been undermined by unfounded accusations of fraud or meddling.”
We agree that confidence in our elections is vital, and that posting ballot images to the Internet won’t hurt.
But please be aware: It will not guarantee accurate election results. Only official, valid verification during the county canvass can do that.
Let’s take a sober look at why ‘allegations of fraud or meddling’ are so persistent. Set computer-generated election results aside for a moment and think instead about computer-generated property tax bills. Imagine that property owners had no way to check for themselves that those bills were correct. Now imagine that:
- The city never checked the accuracy of the electronically calculated property tax bills until after payments were made;
- In that belated verification, the city never checked the accuracy of more than two neighborhood’s bills, and did not do that until after the city no longer had any authority to make refunds;
- Whenever people questioned a property tax bill, the city followed a policy like elections’ recount policy. That is, only one or two taxpayers had standing to demand verification, and if they suspected an error any larger than one-quarter of one percent, they had to pay the full cost of the audit, in cash, before the audit could start; and
- Finally, when national authorities began to encourage vigilance and the taxpayers’ demands for verification could no longer be ignored, the city posted assessment records on the Internet so that citizens could do the auditing themselves.
It's easy to see that this city’s residents would rapidly be expressing suspicions of fraud, suspicions that would not go away until the city began to verify the accuracy of the computers’ output. It is basic human nature: managerial refusal to audit creates suspicion. Managers who verify accuracy build confidence.
Without routine, official audits during the county canvass, we will have persistent suspicions and unrefuted allegations. With them, we will have voter confidence.
Posting the ballot images on the Internet does not protect our elections, for several reasons. Most importantly, volunteer citizen auditors cannot credibly perform a governmental responsibility such as verifying election results. Even if they could, Dane County has no written procedures for compiling, handling, and storing the digital ballot images, so they are not suitable for auditing. Finally, the County is not providing citizens with workable software to view the ballot images. The clerk’s office failed in a February 2015 attempt to unzip and save even two precincts’ ballots with enough accuracy to support a valid audit. Those of you who have attended demonstrations conducted by the Wisconsin Election Integrity Action Team know that workable open-source software, designed specifically for election auditing with digital images, is available and has been offered at no cost to the county clerk many times.
Concern about undetected electronic fraud is no longer the province of crackpots and ‘sore losers.’ Risks are now so credible that the federal government is suggesting elections technology be protected as critical infrastructure. Claims that any county’s system is immune from tampering are not credible. The additional risk of inadvertent miscounts is not hypothetical after the 2014 Stoughton referendum miscount.
Local jurisdictions in other states are implementing modern, efficient election-verification methods. Reputable national experts offer free consultation and assistance through the Election Verification Network. Because other states have moved ahead of Wisconsin in this area, we could learn from their experience. Counties in California and Colorado in particular are making great progress in building voter confidence by adopting a technique known as risk-limiting auditing, endorsed in 2014 by the Presidential Commission on Elections Administration.
On April 4, Dane County voters cast their ballots in one more election that will be declared final on the basis of unverified computer output. Nothing more than a two-machine spot check is planned after that. Don’t let Dane County fall farther behind. We urge you to intervene with the Dane County Clerk and Board of Canvassers to urge them to begin to build voter confidence with routine, valid, professional-quality verification of election results during the county canvass process.
The following supporters of the Wisconsin Election Integrity Action Team:
Barbara Wright, Madison;
Sue & Steve Trace, Deforest;
Dace Zeps, Madison;
Nate Timm, Mazomanie;
Al Sulzer, Cross Plains;
Gary Storck, Madison;
John Stanley, Deforest;
David Schwab, Madison;
Gary Tipler, Madison;
Martina Rippon, Madison;
Alice & David Schneiderman, Madison;
Margaret Rigney, Deforest;
Susan Phillips, Sun Prairie;
Grant Petty, Madison;
Michael Olneck, Madison;
Keith Nelson, Westport;
Jim Mueller; Algoma, fmr Middleton
Jennifer Miller, Madison;
Dave Knutzen, Waunakee;
Karen McKim, Westport
Peter Johnson, Madison;
Jon Hain, Madison;
Adam Grabski, Mazomanie;
Janice Gibeau, Stoughton;
Nila Frye, Waunakee;
Harriet & Ronald Dinerstein; Madison;
Karen Edson, Deforest;
Bob & Julie Crego, Middleton;
Damian Christianson, Fitchburg;
Joanne E. Brown, Madison;
Andrew Bersch, Madison;
Laurene Bach, Waunakee;
Rebecca Alwin, Middleton
Usually, when you offer an idea and it gets shot down, you don't like it. But at yesterday's meeting of the Election Integrity Action Team, I offered a suggestion and Jake's destruction of it was so trenchant and good I have to share it.
We were talking about a revised objective for our group. Maybe we've been aiming too high, I said, by promoting risk-limiting audits during the county canvass. Maybe we need to pursue nothing more ambitious than getting municipal and county canvasses to perform basic reasonability tests, to stop certifying election results that flat-out don't make sense on their face.
I reviewed the evidence: The recount revealed that county canvasses had certified nonsensical election results all around the state. For the certified results from the City of Marinette to be true, 304 early voters would have had to have decided not to mark any votes on their ballots. Eau Claire County officials had certified 306 votes from a ward with 263 voters. If the results Oneida County officials certified from Hazelhurst were true, more than 52% of the voters there had cast blank ballots. Milwaukee County officials certified a 40% blank ballot rate in one urban ward. If you believe the election results certified by Dane County officials, the lily-white upscale suburb of Waunakee was the state's biggest hotbed of support for Cherunda Fox, a black woman from Detroit who ran for president on a platform of reparations for slavery and imprisoning the "Clinton crime family."
Our election officials are nowhere near ready, I argued, to understand the auditing recommendations of the Presidential Commission on Election Administration. They need first to understand their middle school math teacher's advice to check their work for obvious errors before handing it in.
I thought I made a pretty good argument for switching our objective from risk-limiting auditing to basic reasonability testing, but Jake wasn't having it. He's a professional organizer. He works with people while I work with data and ideas. He shot my idea down with one well-placed bullet.
"We are going to have to arouse citizens in 72 counties to action," Jake pointed out. "I don't think we're going to have much luck with the battle cry: "We are going to ask our county clerks to be a little less negligent!"
Okay. Point taken. We need to strive for something more than a little less negligence.
Summary: Once again, something we hoped would be an improvement is much less than it appears. Dane County Clerk Scott McDonell has been saying that he now conducts voting machine audits after every election. But what might look like an audit to a casual observer is at best only a spot check. The county's efforts follow neither GAB instructions for voting-machine audits nor national recommendations for election audits.
The inefficiency of the county effort is astounding. The Wisconsin Election Integrity Action team, with only two hours of active vote-counting, completed our audit confirming the countywide April 5 outcomes in both the Supreme Court race and the Democratic primary (because we followed national authorities' recommendations.) In contrast, McDonell's idiosyncratic process kept his auditors counting for 7.5 hours in an effort that, at best, could confirm output from only two machines.
Worse, McDonell's insistence on declaring election results accurate first and checking later means that the process cannot protect Dane County's final election results from undetected miscounts. If such a delayed spot-check was to detect an electronic miscount, it would cause only chaos, unnecessary controversy, and possible legal action.
The following post explains five of the flaws in McDonell's process.Read more
I observed Dane County's post-election canvass of the April 5 election results from start to finish this year--all 19 hours over 4 days.
No surprises: As usual, both the municipal and county canvasses checked and double-checked to make sure the right number of BALLOTS had been counted. However, the Board of Canvass (County Clerk Scott McDonell, Democratic Party representative Gretchen Lowe, and Republican Party representative Joyce Waldrop) certified Dane County's election results at around 3:30 PM on Wednesday, before any one had done anything to verify that the correct number of VOTES had been counted.
The votes of 234,681 Dane County voters (99.6% of the total) were certified based only on unaudited computer output. Vote totals are now no longer subject to change or correction.
The other 859 ballots were late-arriving absentee ballots and approved provisional ballots, which had been publicly hand-counted by the municipalities. The last two days of the county canvass were devoted to making sure the votes from those 849 ballots were added to the correct candidates' totals.
Got that? Half the canvass effort to ensure the accurate counting of only 0.4% of the votes.
Over four days, County Clerk McDonell maintained the minimum transparency required by law. Any observers who were already familiar with the statutes and GAB guidance for county canvasses (that would be me) could follow along reasonably well, but anyone else would have been out of luck in terms of understanding what the canvassers were doing or why. McDonell provided no written procedures or standards--not even to the members of the board. Neither did he explain what they were doing as they went along; allow questions from observers; or provide observers with copies of anything the canvassers were looking at, or make it visible to them in any way such as by projecting it on a screen.
"Just guess" was the unspoken message to the public. Finally, he restricted any public comment to five minutes at the end of the four-day-long meeting.
It got this bizarre: At the end of the four days, I asked if I could ask a question and was told I could make a five-minute statement and that was it. (McDonell claimed that to answer a question for the public would be a violation of open meetings law.)
So the official public comment at the county canvass started with this awkwardness coming out of my mouth: "I noticed an agenda-less canvass meeting on the county calendar for 10 AM on April 20. I assume that is the digital-image audit you've been promising. I hope you will let me know if I am right or wrong in that assumption."
I'm not making this up: McDonell didn't even nod yes or no. And when Waldrop wanted to respond to my comment, he wouldn't allow that, either.
This created something of a Mad-Hatter-Tea-Party feeling to the event, since it was basically just four of us sitting around a table in a conference room in the City-County building, sharing Girl Scout cookies from McDonell's daughters. The canvassers and I would chat whenever McDonell left the room, but when he was present they had to pretend I wasn't there, as McDonell himself did.
I left them with a letter, which I've uploaded here. It's kind of wonky--I wanted to address them as professionals who know and care what words like 'risk,' 'prioritize' and 'verification' mean. I could see that at least Lowe was reading it carefully, and she asked me a few sensible questions after the meeting adjourned. The main points of the letter are:
- they spend most of their time addressing risks that are much more remote than the risk of electronic miscounts, or that address no risk at all--such as reviewing vote totals in uncontested races for which it would be impossible for them to certify the wrong winner; and
- they also spend time on tasks that don't need to be completed before they certify the election results, such as discussing individual municipalities' Election-Day practices for keeping track of the number of voters.
And yet they tell us they have no time to check the accuracy of the computer-generated vote totals--which cover 99.6% of the votes.
My request to them wasn't anything dramatic: I simply urged them to consider risk and timeliness when they decide what to do during the canvass, and told them if they thought about it that way, it would be obvious that verification of the computer output is more important than most of what they are doing now.
As I sat listening to them recite numbers for four days, I visualized the following graphic, which shows:
The steps by which our votes are turning into final election results;
The parts of this process that are verified by the current county canvass procedures; and
The parts of the process that are verified by the type of audit we've been demonstrating in our citizens' audits.
Last night at a friend's house, I had an interesting conversation with a county board supervisor who isn't yet convinced that we need to verify electronically tabulated election results. Give him credit for being willing to talk, but Roger (a pseudonym) is still comfortable with leaving the audit trail unaudited while we hand out certificates of election to whomever the output tapes indicated.
Last night, Roger dug in on an argument I find particularly curious. "Who are you," he asked, "to demand that the voting-machine output be checked for accuracy if the candidates themselves have not asked for a recount?
"Because we voters have standing." I replied. "Our right to accurate election results is not contingent upon whether your opponent was satisfied. And neither is the county clerk's statutory responsibility to certify only accurate results."
Roger didn't process that idea, but simply rephrased his point: "I won my last election," he continued, "By only 50 votes. My opponent conceded without asking for a recount. If he was satisfied with the results, why should anyone else question them?"
Roger isn't the only one from whom I've heard this argument in various forms. It's based on a politician's view of elections. To Roger, the election was a man-to-man contest between two and only two competitors. One of them accumulated the most inanimate points (votes) and won the prize of public office. Voters were like mere spectators at a sporting event, able only to boo or to cheer--but not to question--the referee's calls.
I then challenged Roger with the property-tax-bill analogy: Suppose we had a city treasurer who routinely pushed the "Calculate property tax bills" button on his computer and mailed the bills before checking their accuracy.
Assuming that any city treasurer would ever do this (none would!), I told Roger, "We would not tolerate it for a minute if the city treasurer defended this carelessness by saying, "I'll check accuracy when and if an individual property owner demands that I do."
"We would consider it a problem for the whole community, not just one taxpayer, if we knew it was possible that the system had charged lower tax rates to homes in one part of town than another," I said. "We would not wait for the overcharged owners to suspect the error, or demand that they foot the bill for the audit when they did."
"How is it so evident," I asked, "that city treasurers, but not elections officials, have active ongoing responsibility for the accuracy of their computers' output?"
Roger's a lawyer and was in lawyer mode, so I didn't expect him to concede anything. He didn't. He pointed out that the property owners who thought they'd been overcharged would object, and I agreed. He did not, however, engage on either the point that both the city treasurer and the elections official have responsibility to check the accuracy of their computers' output regardless of whether anyone demands it, or the point that the community as a whole has an interest in both accurate property tax bills and accurate election results.
That particular blind spot--perceiving election results to be more like the private property of the candidates than the shared property of the community--accounts for a significant part of the opposition to routine verification. I notice it whenever people start talking about recounts as any sort of acceptable substitute for routine prudent verification of computer output.
Elections are by far the most powerful and basic means by which we, the People, can exercise our collective right to self-government, and I will not concede to any individual candidate--winner or loser--my standing to demand proof that my community's votes were counted accurately.
* * *
The take-away point of this blog post is the major principle: Elections belong to the people, not to the candidates. However, there is a technicality I also want to explain.
When I got home, I looked up the results of Roger's last election. He remembered correctly that he got 50 more votes than his opponent. That gave him 50.89% of the votes to his opponent's 49.1%, or a victory margin of 1.79%. Current law provides for free recounts only when the margin of victory is less than 0.25% (in that election, 7 votes), so his opponent would have had to pay the full cost of the recount.
This in a county where the voting machines have already demonstrated they are capable of allowing dust bunnies to cast at least 1.3% of the votes.
Prudent, professional elections administration simply does not make verification contingent upon individual candidates' willingness and ability to pay for a full recount and to be labeled a 'sore loser.'
I regularly write to county officials about the need for routine, transparent, timely verification of the output of Dane County's voting machines. I rarely get any response--occasionally a polite but negative RSVP if I invite them to a presentation. I don't really expect more, because the decision is entirely up to County Clerk Scott McDonell. Others--particularly pesky 'outsiders' (you might know them as 'voters')--don't have a say.
But today I got a polite and reasoned reply from Dane County Executive Joe Parisi, a former county clerk himself. He expressed his own "strong interest in assuring the accuracy and integrity of our elections," and commended the Wisconsin Election Action Team's "passion for this issue and for your commitment to ensuring that every vote counts," calling it "a noble and worthwhile cause."
So he shares our goals--that much is reassuring. I also appreciated the absence of the all-too-common reflexive defensiveness I've encountered from other officials.
Parisi was county clerk before risk-limiting audits and digital ballot images entered the national discussion, so it's not surprising he is not well-versed on the current and best thinking about management of electronic elections technology. He seems simply to accept what current County Clerk McDonell tells him about today's options. Parisi sent along to me a 'fact sheet' that McDonell prepared about a year ago, and Parisi's comments indicated that he considered it a useful, informative document.
McDonell has slightly updated the document since he first wrote it, but it remains a classic list of rationalizations given by those who defend the use of unaudited computer output as our final election results.
I've uploaded McDonell's arguments, verbatim, along with a point-by-point explanation of their shortcomings. Here are the highlights:Read more
After the 2015 elections, efforts to verify Dane County’s voting-machine output were still in their childhood.
We, the Wisconsin Election Integrity Action Team, had after both 2015 elections demonstrated an efficient, accurate verification method, but had not yet conducted a truly valid audit because we hadn’t yet found a professional statistician willing to work for free.
And Dane County Clerk Scott McDonell wasn’t even trying to conceive. His last pronouncement on the question of official county verification of voting-machine output had been that it was “unnecessary and possibly contrary to statutes.”
Since then, the citizens’ audit process has grown to healthy adolescence. We found a civic-minded statistician willing to work for free, and the March 12 public citizens’ audit of the February election results was a smashing success. Using open-source software developed by a professional Microsoft-certified programmer here in Dane County, we displayed ballot images with about 30 public observers present. All were satisfied that they could see every vote for themselves. We counted votes from 9 randomly selected precincts and verified with 99% statistical confidence that Dane County’s voting machines had identified the correct winner in the February Supreme Court primary.Read more
Just a quick post to share the results from Saturday's Citizens Audit of Dane County's voting-machine output in the February 16 primary for Wisconsin Supreme Court.
I'll expand this blog post later with more detail (post any questions in the comments section if there's something specific you want to know about), but right now I'm in a hurry to get the summary report out and get to work on the more detailed report.
One of the things we are trying to do is to demonstrate what a good, transparent, public post-election audit would look like--and that includes prompt and thorough public reporting of the findings. (Something the Dane County Clerk does not do. He says he routinely performs post-election audits, but if you've even seen him publicly report any findings from those audits, I'm afraid you were hallucinating. Hasn't happened.)
Anyway, here's our report of what we did and what we saw in Saturday's audit, and now I'm back to work writing the more thorough report.
When I see nutty behavior—things like toddlers in beauty pageants, a national system of employer-funded health insurance, or legalizing switchblade knives—I practice empathy for my fellow humans by imagining how I would explain their conduct to space aliens. You see, I don’t want the Martians to get the impression my species is irredeemably stupid, so the exercise forces me to dig deep to figure out any possible rational explanation for the behavior.
To appreciate the irrationality of using unaudited computer output to determine who wins our elections, imagine what would happen if people in your city started questioning the accuracy of their computer-tabulated property tax bills. Here’s what would not happen:
The city treasurer would not say that he has always mailed the bills before checking whether his computer tabulated them correctly, and that no one has ever complained before.
The city treasurer would not point out that no law explicitly requires him to check the accuracy of the property tax bills before he mails them.
If asked to audit his computer’s output, the treasurer would not start chattering about the dangers of ‘tampering’ with his own records.
He would not demand that the suspicious property owner pay the full cost of the audit unless the suspected error was tiny–less than 0.25% (one-quarter of one percent.)
And if some deranged city treasurer ever did respond like that, you can bet the local newspaper would not speculate about why the property owners unexpectedly chose to receive suspicious tax bills, or what sort of tinfoil-hat paranoia made them want verification.
Yet that is precisely what happens when citizens have questions about the accuracy of our computer-tabulated election results.
As a culture, we’re computer-literate. We understand the need to maintain as much security as we can for all computers, including voting machines. We understand the need to test them before putting them into actual use. But voting machines remain the ONLY computers in either business or government that we operate with no routine way of noticing when their output has been affected by errors or by manipulation while the computers were in actual use and not just being tested.
So, how would I explain that to space aliens?
It’s not money: Manual vote-counting to verify the computer output can be done by low-paid temporary staff like poll workers or even by volunteers. Post-election verification would cost only a tiny fraction of our overall elections-administration budget.
It’s not time: Although our statutes unfortunately value speed over accuracy, they still give county officials roughly three weeks following each election to declare results final, and allow them to ask for more time if needed. And verification has been made efficient and economical by sampling methods specifically designed for elections by the American Statistical Association, and by recent technological innovations such as digital ballot images, which can be displayed more quickly than paper ballots can be handled.
So what is it? We can say it’s just habit, but that just kicks the question backwards. Why did such strange habits develop?
The main reasons, I think, are standard human foibles—wishful thinking and its evil twin, denial. We want impartial vote-counting so badly that we imagine it exists where it literally cannot. Just a moment’s thought would make anyone realize that every computer is programmed and maintained by fallible, sometimes dishonest humans. But taking that moment would mean giving up the idea of a magically impartial vote-counting box. Our gut knows that admitting the need for verification in future elections means admitting past elections may already have been stolen without our knowledge. For many it is literally unthinkable that we may already be governed by people chosen by criminals or by computer glitches rather than by the will of the people.
A lesser reason, I think, is the tendency, especially among election officials, to see elections as competitions between individual candidates rather than as the expression of a community’s collective will. Talk not very long to most local elections officials and you’ll pick up a burning desire just to get the thing settled—like your mom felt when she didn’t care which kid was right, she just wanted the fight to stop. Maintaining the illusion of quickly decisive results is more comfortable than making sure everyone understands that Election-Night results are preliminary until verified. I cannot count the times I’ve had election officials express a sense that there cannot possibly be a problem when no individual candidate has challenged the results—as if voters like me have no standing to ask for evidence of accuracy, or as if they themselves have no obligation to ensure accuracy unless challenged.
In summary, it’s a good thing I’m not going to have to defend our management of voting machines to the Haggunenons, because that’s the best I can do. There’s no way around it—using unverified computer output to determine who will govern us is indefensibly irrational.
To get the word out about the necessity for prompt verification and to demonstrate its practicality, the Wisconsin Election Integrity Action Team will be conducting public citizens’ audits of election results in Dane County after every election in 2016.
The next one is scheduled for March 12, at the South Central Federation of Labor Hall, 1602 S. Park St. in Madison. We’ll start the audit at 9 AM and continue until we’ve verified the Dane County outcome of the Supreme Court primary and at least two other contests—maybe around 4 PM. Anyone can drop by at any time to see the process and count votes right along with us. Who knows, maybe soon we can convince the county elections officials to do this themselves, and I won’t have to worry about space aliens thinking we’re stupid.