Ask any Wisconsin official whether our elections are secure and you'll get this answer: "Our voting machines are never connected to the Internet; elections administration is decentralized; and the machines' designs were approved by the federal and state governments."
Go ahead—call your county clerk and ask. That is the answer you'll get. He or she sincerely believes those three safeguards protect Wisconsin elections.
Today, a consortium of national election-integrity groups released a new report: Securing the Nation’s Voting Machines: A Toolkit for Advocates and Election Officials.
Here's how many of the Wisconsin election officials' three favorite safeguards made the list recommended by the national authorities: None.
Here's why not:
- Voting machines are and always will be programmed by fallible, corruptible humans. Anyone who develops or loads the software can manipulate the vote totals without the Internet.
- You could hack into only one or two big counties' voting machines and swing a statewide election. In fact, county control of the voting machines might make hacking easier by increasing the number of vulnerable entry points. Besides, it's not really the local clerks who manage the machines anyway. It's three companies: Command Central, Dominion, and the biggest one, ES&S, which supplies the software that counts about 2 of every 3 Wisconsin votes.
- Federal and state approval of the voting machines' original design cannot secure the machine that counts your votes. The software was copied and updated dozens of times before it reached the machine in your polling place. No one ever inspects or approves the software that actually counts your votes.
What does protect elections: Paper ballots and audits.
Wisconsin has paper ballots, but not a single county clerk—not one—looks at those ballots before declaring election results final.
As long as our ballots are packed up on Election Night and kept under seal until they are destroyed 22 months later, Wisconsin elections are no safer than if we were using paperless touchscreen machines.
That's where Wisconsin's decentralized elections can help to protect our elections. State law gives every county clerk two weeks after a general elections—and more if they request it—to review the Election-Night results to make sure they are correct. The county clerks and their boards of canvass are free to adopt any review method they choose—it's up to them.
Any county or municipal clerk could, at any time he or she chooses, open the ballot bags and conduct a legitimate audit. It would be harder for municipal clerks, because they have only a week for review, and they certify only local races anyway. But county clerks have plenty of time to audit, and they certify the state and federal races—the ones most likely to be hacked.
Call your county clerk today and educate them. Tell them that the three safeguards they rely on are not really safeguards at all. Tell them to start—NOW—planning how they will verify the voting machines' Election-Day accuracy after future elections. If your county clerk doesn't know how, refer them to Securing the Nation’s Voting Machines: A Toolkit for Advocates and Election Officials, which has a good list of pointers and resources. Write to your local newspaper to make sure they cover this story.
Then, keep calling your county clerk until you get the answer Wisconsin voters deserve: "Yes, we will make sure your votes were counted correctly before we declare election results final."
Forget about whether Russians hacked election computers in 2016. We've got a bigger problem, and not much time to fix it. The November elections are less than six months away.
When the US Department of Homeland Security (DHS) and the Wisconsin Elections Commission (WEC) talk about "election security", they talk only about the voter-registration system. WEC operates that system, and DHS can monitor it.
But the vote-counting system is separate. It resides on no computer that either of them can control, monitor, or inspect. It was outside their range of vision in 2016, and it’s outside their vision now. They don’t talk about voting-machine security because they don't know.
Wisconsin’s vote-counting computers are controlled, protected, and monitored by our local election clerks and by three companies—ES&S, Dominion, and Command Central.
That's all. No one else.
Local election clerks have exactly the level of IT sophistication you think they do. County clerks send our vote-counting software off to Nebraska or Colorado or Minnesota to be reprogrammed for each new election, with no way to notice if it comes back carrying malicious code. A few counties use an application supplied by those companies to reprogram the software themselves. They put a plastic seal on it when they’re done.
Wisconsin’s local election clerks will happily leave a service technician alone with a voting machine or the county’s election-management computer, with no way to notice if he installs malicious code or a wireless communications card. They put a plastic seal on the voting machines for Election Day.
Go ahead—ask them. They seal the software. They seal the machines. They seal the paper ballots that they could use—but don’t—to check the machines’ Election-Day accuracy.
And what about where the real danger lies—within the voting-machine companies? How well does their security guard against external hackers and corrupt insiders?
The companies themselves might not understand IT security. Professor Aviel Rubin of the Johns Hopkins University Information Security Institute checked with the major American voting-machine companies before the 2016 elections and discovered none employed “even one full-time trained expert in computer security.”
Congress, too, has been frustrated in its attempts to get straight answers about the companies’ security practices. When Congressman Ron Wyden tried to get answers from ES&S, he didn't get a response from anyone with 'security' in their job title. Instead, a Senior Vice President for Governmental Relations replied, saying “At ES&S, security is the responsibility of not just one, but all who elect to work for our company.”
This governmental-relations expert reassured Rep. Wyden that ES&S had asked DHS "if they had knowledge of any such security issues involving ES&S to which they responded that they did not." Well, whew.
ES&S—this company where every employee handles IT security and yet the vice president has to ask DHS to find out whether they've had a security breach—is the largest supplier of voting machines to Wisconsin. Just one of their machines—the DS200—counts more than 60% of Wisconsin's votes, including votes from Milwaukee, Dane, Waukesha, and La Crosse Counties.
We cannot make the voting machine companies hire IT security staff before we elect a governor and a US senator in November.
And we cannot make our local election officials into IT sophisticates, ever.
But we can put an end to the honor system. That is, we can force our local election officials to use the paper ballots to detect and correct any miscounts before they declare election results final.
Our local election officials are the legal custodians of the paper ballots. They can unseal them anytime to count votes and make sure the voting machines counted right. At any time before the 2018 midterms, our local election officials could learn about results-audit practices already in use in other states and bring them to Wisconsin.
Do these three things today:
- Contact WEC. Tell them to exercise leadership in getting county clerks to audit election results during the canvass. Tell them to use some of the federal HAVA funds; they’ll know what that is.
- Contact your county clerk. Say you want the county canvass to make sure the voting machines identified the right winners before they certify the election results. If they don't know how, tell them to contact the Election Verification Network or the Verified Voting Foundation.
- Contact your local newspaper editor. Tell him or her that you want to see local journalism take a sober look at voting-machine security right here in Wisconsin—and that doesn't mean writing about plastic seals.
Being a normally flawed human, I cannot resist starting with as we have been saying for six years, Wisconsin's "failure to carry out post-election audits that test the accuracy of election outcomes leaves the state open to undetected hacking and other Election Day problems."
In speaking about Wisconsin, the report concludes: "To protect its elections against potential attack by sophisticated nation-states seeking to interfere in U.S. elections, Wisconsin should adopt robust post-election audits that have binding effect on election results."
CAP researchers picked up on a feature of Wisconsin elections that in-state commentators have missed:
Problems with Wisconsin's election security, along with possible solutions, are not visible unless you look beyond the state level and into the counties and municipalities.
Our state-level agency, the Wisconsin Elections Commission does not control the voting machines. They control only the systems that manage voter registration (WisVote) and that compile already-tabulated election results (the Canvass Reporting System, or CRS).
But the technology that counts Wisconsin's votes is owned and operated by counties and municipalities--not the State.
It is the local clerks, not the WEC, who are responsible for pre-election protective security and for the managerial measures that would detect and correct any Election-Day miscounts.
Not only is pre-election security managed by non-IT professionals, Wisconsin's entire vote-counting system lacks the ability even to detect miscounts, never mind correct them.
Wisconsin's local election officials--bless their hearts--are not IT sophisticates. Asked about the threat of hacking, most will say something like what Sheboygan County Clerk Jon Dobson recently wrote to me: "The equipment is never connected to the Internet, (so) unless someone has figured out a way to hack through the unit's power cord, our equipment is basically unhack-able."
Clerks like Mr. Dobson are not being disingenuous. They genuinely believe that if they cannot see a way to hack the vote-tabulating technology, no one else can, either. Their trust in the voting-machine companies is complete and sincere.
For their education in IT security, Mr. Dobson and his colleagues rely almost entirely on the commercial reassurances of the voting-machine companies. They don't seek the counsel of independent IT-security authorities who could explain the myriad number of ways an elections system can be compromised without Internet connection, particularly by insiders.
Wisconsin's county clerks genuinely do not understand that elections software could be compromised by security lapses outside their vision or control--by the vendors, service companies, municipal clerks, and poll workers.
And as for Internet access, news hasn't yet reached them from their counterparts in Pennsylvania, who found that a voting machine company had installed unauthorized remote access capability on their election computers without their knowledge--something that computer-security professionals had been warning of for years. Like the Wisconsin clerks, the Pennsylvania clerks had been blithely assuring reporters that voting machines were never connected to the Internet--without having checked. When I publicly asked him whether he ever checked Dane County's machines for such unauthorized alterations, Clerk Scott McDonell said that the vendors had told him that would void the machines' warranty so no, he doesn't check. He is not fooling when he says he truly believes the machines to be so very secure that he can doesn't have to check their accuracy before he declares election results final.
And that, fellow voters, is the level of IT naïvete that stands between motivated international hackers and our voting rights.
But we have to be realistic about what we can expect from local election officials. As Prof. Dan Wallach of the Rice University Computer Science Department explained, "You would not expect your local police department to be able to repel a foreign military power."
What we can expect of our local election officials--particularly our county clerks--is that they use the authority and resources already provided by Wisconsin law to manually check accuracy of the computer-tabulated vote totals before they certify election results final.
The only protection can come from using our paper ballots to check the machines' Election-Day accuracy.
That's the solution that 26 states already have in place, with varying degrees of rigor.
It's the solution that we've been advocating for the past six years.
It's the solution that the 2014 Presidential Commission on Elections Administration recommended.
It's the solution that Rep. Mark Pocan wisely wrote into his proposed federal legislation.
And it's the solution that the CAP report recommended for Wisconsin.
Wisconsin reporters and editors need to pick up on it now, too. They need to start asking county clerks the same hard questions about their security practices that they have been asking the WEC about theirs: How do you detect whether the technology worked as intended on Election Day? Do your security and recovery procedures meet national standards? What plans do you have in place for recovery if they fail?
Voters can ask, too. Pick up the phone. Call your county clerk. Get the facts right from him or her. Ask: "At the moment when you sign that certificate declaring the election results to be correct and true, what specifically have you done to verify that the voting machines counted correctly on Election Day?"
Among the 72 county election authorities in this state, not a one will answer: "I follow federal recommendations and conduct a valid post-election audit."
Friday, March 30, 2018 - In defense of our right to self-government, please contact the Wisconsin Elections Commission in the next few days to tell them: Include routine election auditing in Wisconsin's application for federal election-security funding.
Chances like this don't come along very often. Congress sits on its hands for years, ignores problems, messes around, and then--when an issue is hot--throws some money at the states and says "Spend it quick!"
When that happens, states need to be able to grab the money and spend it on something worthwhile.
That is just what has happened with election security. Voters have been warning, shouting, complaining, and worrying for years about the dangers of poorly managed election technology, and then all of a sudden Congress awoke and leapt out of bed. (Thank you, Vladimir!) Last Friday, Congress passed a federal budget bill that includes $380 million for grants to the states for improving election security.*
Just short of $7 million of that is earmarked for Wisconsin--pending the Wisconsin Elections Commission's submission of a plan for spending it.
Thirteen states should definitely spend their money to replace unauditable voting machines--the kind that don't use or create a paper record of each ballot. But that's not Wisconsin's problem. Paperless vote-counting computers have always been illegal here.
Wisconsin's big election-security hole--where we lag most other states--is not that our elections are unauditable. Wisconsin elections are simply unaudited.
Wisconsin is in relatively good shape on most other aspects of election security. The WEC has done a good job with those systems they control, which are the voter-registration system and the 'canvass reporting system,' the automated system that counties use to report results they have already counted and certified. In addition to having respectable security, both these systems also have effective backup in case of manipulation or failure. With same-day registration at the polls, hackers have to ask themselves how much effort they are going to waste deleting Wisconsin voters' registrations when we will be able immediately to vote anyway, with only about five minutes' re-registration inconvenience. And the canvass reporting system kicks in only after our votes have already been counted in the polling places and municipal clerks' offices. Any hacking of that would be easily detectable and reversible, even without a serious audit effort.
But Wisconsin has no more security for our voting machines than any other state that uses paper ballots, and a paper trail is merely decorative if the ballots are sealed on Election Night and never seen again.
Our elections' biggest unprotected vulnerability is that our county boards of canvass make a habit of declaring election results final without lifting a finger to check to see whether the vote-counting computers counted our votes correctly. That practice is justifiably illegal in 25 states (26 if you count D.C.) and contrary to every national election authority's recommendation.
The practical solution: Wisconsin law provides county election officials with paper ballots and allows them to check accuracy before they certify, but they choose not to. The problem isn't time or money. Wisconsin's county clerks have as much time for the canvass as their counterparts in states that do audit, and modern election-audit methods are so efficient they could almost be funded from petty cash.
So we can only guess why our county officials continue to force us to trust our franchise to unaudited computer output--something they wouldn't tolerate for a millisecond from their banks and ATMs. My best guess is that they've been allowed to ignore that basic managerial responsibility for so long that they fear they will find a host of problems when they start to look. Look at the panic this county official exhibited as she refused an observer's request for verification during the 2016 recount. That level of distress looks to me like she knew the machines' unreliability would be revealed if she allowed verification, so she refused to hand count "even five ballots." And she was right: the machines were, in fact, miscounting and were later decertified by the Wisconsin Elections Commission.
What voters need to do:
Contact the WEC and tell them that you want them to include funding for routine audits during the county canvass in Wisconsin's federal grant application. WEC staff are up to date on national election-administration trends, and I believe they understand the need for, and practicality of, routine election audits. In addition, I sense that WEC Commissioners are favorably disposed to effective election audits and will do the right thing if enough citizens express interest and support.
- Tweet to @WI_Elections to say that you want to see county election audits in the application for federal funding;
- Email Chair Mark Thomsen and Administrator Meagan Wolfe at firstname.lastname@example.org.
- Snail-mail them at Wisconsin Elections Commission, P.O. Box 7984, Madison, Wisconsin 53707-7984, with copies to U.S. Election Assistance Commission, 1335 East West Highway, Suite 4300, Silver Spring, MD 20910, and to Jill Lau, Chair, Wisconsin County Clerks Association, 421 Nebraska St, Sturgeon Bay, Wisconsin 54235.
If you want to do more, you can use these web-contact forms to tell Senator Baldwin, Senator Johnson, and the US Election Assistance Commission that they, too, should encourage the WEC to seek funds for election auditing in Wisconsin.
Also, please, tell other voters about this so that they, too, can weigh in for election audits. The WEC hardly ever gets any citizen input on election security issues, and they will definitely sit up and take notice if they get a lot now. So go for it!
* It would be unfair to accuse every member of Congress of inaction. Wisconsin's very own Mark Pocan introduced an excellent elections-security bill, the Secure America's Future Elections (SAFE) Act a year ago. As other representatives wake up to the issue, it's still collecting new co-sponsors. If you live outside Wisconsin's Second Congressional District, contact your congressperson today and ask them to sign on. If you live in Rep. Pocan's district, tell him "Thank you!"
Over the past five years, I’ve read every commercial media story I could find regarding election technology. Sadly, that has not been a big job. Few reporters ever mentioned the risks, and those who did tended to interview only election officials. The typical news item would hint ‘some are concerned’ and then quote some official saying “We see no evidence of problems.” The question of whether the officials had been monitoring for problems--or whether they even knew how to--was left unasked and unanswered.
But recently, I am noticing progress in commercial news media’s coverage of the risks of elections technology. America’s reporters are catching up with millions of citizens and all IT professionals. They are realizing that computerized elections have risks, and that IT experts understand those risks better than election officials do.
That's not the only recent improvement. Some reporters have noticed the solution, too. This morning I saw a news story in national mainstream media that went beyond hand-wringing over the risks and mentioned routine election verification.
Under the headline If Voting Machines Were Hacked, Would Anyone Know?, NPR’s Pamela Fessler gave listeners the answer: No. Then instead of musing about hypothetical alternate technologies, she finished the piece with a plug for routine election audits. A few weeks ago, the Atlantic also had a good article focusing on election audits, with the subtitle "A low-tech solution to America’s voting problems."
Don't get me wrong. We are still not seeing the sort of explanatory or investigative journalism that our elections deserve. But things are looking up. Commercial journalists have finally found the phone numbers of election-technology experts. In recent weeks, Reuters turned to the University of Michigan’s Alex Halderman and ABC News quoted the University of Iowa’s Douglas W. Jones.
Even a city reporter, Kristian Torres of the Atlanta Journal-Constitution, now knows to pick up the phone to interview Princeton’s cybersecurity expert, Edward W. Felten, when she has questions about elections technology. A local lawsuit there challenged Georgia's failure to preserve an auditable paper trail.
But when the same opportunity (that is, renowned experts explaining the local angle on a topic of national interest) presented itself to Wisconsin journalists, they missed the opportunity. Last November, when three crème de la crème national experts testified in Dane County Court, Wisconsin reporters focused on mundane, predictable angles, such as the cost of the recount.
The currently trending issue--Russian hacking--might blow over, but I don't think the improvement in reporters' understanding of the larger issues will fade. National-beat journalists are truly waking up to this issue. So it's only a matter of time before state and local journalists, too, bring some gravitas to their reporting on the topic.
I'm optimistic that we will see fewer formulaic stories approvingly quoting a clerk saying "It's all good because we have no evidence of miscounts." I'm looking forward to seeing more actual IT experts quoted.
And I can't wait to hear Wisconsin officials' answers after the next election when for the first time they face a reporter who asks, "Got it--no evidence of hacking. Now can you show us the evidence of accuracy?"
I observed Dane County's post-election canvass of the April 5 election results from start to finish this year--all 19 hours over 4 days.
No surprises: As usual, both the municipal and county canvasses checked and double-checked to make sure the right number of BALLOTS had been counted. However, the Board of Canvass (County Clerk Scott McDonell, Democratic Party representative Gretchen Lowe, and Republican Party representative Joyce Waldrop) certified Dane County's election results at around 3:30 PM on Wednesday, before any one had done anything to verify that the correct number of VOTES had been counted.
The votes of 234,681 Dane County voters (99.6% of the total) were certified based only on unaudited computer output. Vote totals are now no longer subject to change or correction.
The other 859 ballots were late-arriving absentee ballots and approved provisional ballots, which had been publicly hand-counted by the municipalities. The last two days of the county canvass were devoted to making sure the votes from those 849 ballots were added to the correct candidates' totals.
Got that? Half the canvass effort to ensure the accurate counting of only 0.4% of the votes.
Over four days, County Clerk McDonell maintained the minimum transparency required by law. Any observers who were already familiar with the statutes and GAB guidance for county canvasses (that would be me) could follow along reasonably well, but anyone else would have been out of luck in terms of understanding what the canvassers were doing or why. McDonell provided no written procedures or standards--not even to the members of the board. Neither did he explain what they were doing as they went along; allow questions from observers; or provide observers with copies of anything the canvassers were looking at, or make it visible to them in any way such as by projecting it on a screen.
"Just guess" was the unspoken message to the public. Finally, he restricted any public comment to five minutes at the end of the four-day-long meeting.
It got this bizarre: At the end of the four days, I asked if I could ask a question and was told I could make a five-minute statement and that was it. (McDonell claimed that to answer a question for the public would be a violation of open meetings law.)
So the official public comment at the county canvass started with this awkwardness coming out of my mouth: "I noticed an agenda-less canvass meeting on the county calendar for 10 AM on April 20. I assume that is the digital-image audit you've been promising. I hope you will let me know if I am right or wrong in that assumption."
I'm not making this up: McDonell didn't even nod yes or no. And when Waldrop wanted to respond to my comment, he wouldn't allow that, either.
This created something of a Mad-Hatter-Tea-Party feeling to the event, since it was basically just four of us sitting around a table in a conference room in the City-County building, sharing Girl Scout cookies from McDonell's daughters. The canvassers and I would chat whenever McDonell left the room, but when he was present they had to pretend I wasn't there, as McDonell himself did.
I left them with a letter, which I've uploaded here. It's kind of wonky--I wanted to address them as professionals who know and care what words like 'risk,' 'prioritize' and 'verification' mean. I could see that at least Lowe was reading it carefully, and she asked me a few sensible questions after the meeting adjourned. The main points of the letter are:
- they spend most of their time addressing risks that are much more remote than the risk of electronic miscounts, or that address no risk at all--such as reviewing vote totals in uncontested races for which it would be impossible for them to certify the wrong winner; and
- they also spend time on tasks that don't need to be completed before they certify the election results, such as discussing individual municipalities' Election-Day practices for keeping track of the number of voters.
And yet they tell us they have no time to check the accuracy of the computer-generated vote totals--which cover 99.6% of the votes.
My request to them wasn't anything dramatic: I simply urged them to consider risk and timeliness when they decide what to do during the canvass, and told them if they thought about it that way, it would be obvious that verification of the computer output is more important than most of what they are doing now.
As I sat listening to them recite numbers for four days, I visualized the following graphic, which shows:
The steps by which our votes are turning into final election results;
The parts of this process that are verified by the current county canvass procedures; and
The parts of the process that are verified by the type of audit we've been demonstrating in our citizens' audits.
Last night at a friend's house, I had an interesting conversation with a county board supervisor who isn't yet convinced that we need to verify electronically tabulated election results. Give him credit for being willing to talk, but Roger (a pseudonym) is still comfortable with leaving the audit trail unaudited while we hand out certificates of election to whomever the output tapes indicated.
Last night, Roger dug in on an argument I find particularly curious. "Who are you," he asked, "to demand that the voting-machine output be checked for accuracy if the candidates themselves have not asked for a recount?
"Because we voters have standing." I replied. "Our right to accurate election results is not contingent upon whether your opponent was satisfied. And neither is the county clerk's statutory responsibility to certify only accurate results."
Roger didn't process that idea, but simply rephrased his point: "I won my last election," he continued, "By only 50 votes. My opponent conceded without asking for a recount. If he was satisfied with the results, why should anyone else question them?"
Roger isn't the only one from whom I've heard this argument in various forms. It's based on a politician's view of elections. To Roger, the election was a man-to-man contest between two and only two competitors. One of them accumulated the most inanimate points (votes) and won the prize of public office. Voters were like mere spectators at a sporting event, able only to boo or to cheer--but not to question--the referee's calls.
I then challenged Roger with the property-tax-bill analogy: Suppose we had a city treasurer who routinely pushed the "Calculate property tax bills" button on his computer and mailed the bills before checking their accuracy.
Assuming that any city treasurer would ever do this (none would!), I told Roger, "We would not tolerate it for a minute if the city treasurer defended this carelessness by saying, "I'll check accuracy when and if an individual property owner demands that I do."
"We would consider it a problem for the whole community, not just one taxpayer, if we knew it was possible that the system had charged lower tax rates to homes in one part of town than another," I said. "We would not wait for the overcharged owners to suspect the error, or demand that they foot the bill for the audit when they did."
"How is it so evident," I asked, "that city treasurers, but not elections officials, have active ongoing responsibility for the accuracy of their computers' output?"
Roger's a lawyer and was in lawyer mode, so I didn't expect him to concede anything. He didn't. He pointed out that the property owners who thought they'd been overcharged would object, and I agreed. He did not, however, engage on either the point that both the city treasurer and the elections official have responsibility to check the accuracy of their computers' output regardless of whether anyone demands it, or the point that the community as a whole has an interest in both accurate property tax bills and accurate election results.
That particular blind spot--perceiving election results to be more like the private property of the candidates than the shared property of the community--accounts for a significant part of the opposition to routine verification. I notice it whenever people start talking about recounts as any sort of acceptable substitute for routine prudent verification of computer output.
Elections are by far the most powerful and basic means by which we, the People, can exercise our collective right to self-government, and I will not concede to any individual candidate--winner or loser--my standing to demand proof that my community's votes were counted accurately.
* * *
The take-away point of this blog post is the major principle: Elections belong to the people, not to the candidates. However, there is a technicality I also want to explain.
When I got home, I looked up the results of Roger's last election. He remembered correctly that he got 50 more votes than his opponent. That gave him 50.89% of the votes to his opponent's 49.1%, or a victory margin of 1.79%. Current law provides for free recounts only when the margin of victory is less than 0.25% (in that election, 7 votes), so his opponent would have had to pay the full cost of the recount.
This in a county where the voting machines have already demonstrated they are capable of allowing dust bunnies to cast at least 1.3% of the votes.
Prudent, professional elections administration simply does not make verification contingent upon individual candidates' willingness and ability to pay for a full recount and to be labeled a 'sore loser.'
If some genie were to happen by and offer me three wishes, I fear that before world peace, I'd ask to understand our election officials' lack of interest in verification, when I'm sure they all have the sense to know why banks audit to make sure their computers credited deposits to the correct accounts. It puzzles me deeply.
Yesterday. The chairman of Wisconsin's elections authority, the Government Accountability Board, was testifying before a legislative hearing to defend the agency's continued existence. One of his Republican executioners confronted him with the fact that the GAB had, for many years, neglected to perform statutorily required post-election audits. How could the Board, the questioner badgered, assure Wisconsin residents that their voting machines had counted correctly if they never did post-election audits?*
GAB Board Chairman Judge Gerald Nichol responded--right out in public, on the record, and apparently without embarrassment, "It is true we did not do the audits, but I don't find that too worrisome because our staff thoroughly tested the systems before they were approved for use in Wisconsin."
And--I'm not making this up--that answer appeared to satisfy his questioner.
Imagine what Judge Nichol or the legislator would have said if a banker testified, "We never audit, but I don't find that too worrisome because when we bought those computers, we tested one to make sure it was capable of counting correctly."
The over-the-top ridiculousness of that statement would be immediately evident to either of them in relation to a bank's computers, but neither seemed to think it in any way remarkable when the output in question was our election results.
Today. I went to a large-group training where about two dozen municipal clerks were in attendance. I had several opportunities for one-on-one chats, and I used them to feel a few officials out about their level of awareness of voting machine accuracy. I've learned to start such conversations with praise for their efforts in double-checking that the machines counted the right number of ballots--which they do quite well.
"I'm conducting sort of an informal survey about clerks' thoughts on voting machine accuracy," I would start. "I know you know for a fact that the machines always count the correct number of ballots--you've got that nailed down. But what's your level of trust that the machines counted the right number of votes?"
Most conversations go one of three ways from there. The worst conversations don't even get started (two tonight, but I've gotten this reaction on other occasions). The question explodes some landmine: "Our voting machines are accurate! We test and double test and maintain the very best security. Our election results are always accurate, I'd bet my life on it." Any follow-up question (e.g., Can you tell me what gives you that confidence?) will be met with only more anger, and the clerk or poll worker will walk away. The Topic Must Not Be Raised.
The second typical response is less emotional, but no more productive: Some election officials will be unable to understand the question no matter how you phrase and rephrase it. It's as if you are asking "What do you do when the sun comes up in the west?" They mentally rephrase the question into something that makes sense to them and start talking about that. The elections official will describe the process for checking that the machines counted the right number of ballots, and I'll politely wait until she is done, and then ask the question again more specifically: "Yes, but how often do you think the number of votes--that is, the number of votes for Jones, and the number for Smith--are correct or incorrect?" The elections official will repeat the explanation about verifying the number of ballots, or tell you how the machines reject over-votes, or how they check their addition during the municipal canvass, or some other thing. I'm usually the one that ends these conversation, because I start to feel I'm being mean.
The third most typical response is that they 'correct' the question rather than answering it. In a you-should-know-this tone, they will say something like: "The machines cannot miscount," or "Accuracy is the county canvass job." I had two of these conversations tonight. They don't go anywhere, either. Once this type of election official has decided you are just naive, they switch to an all-talk-no-listen mode.
Of seven or eight conversations I started tonight, only one unfolded into a genuine exchange of information. The clerk responded to my question with, "I would say I'm pretty close to 100% confident, but it does bother me we don't know for sure. I've never discovered any miscount in the pre-election test--that's what gives me confidence--but I know that doesn't guarantee they'll count right on Election Day." Wow. Town of York voters, you're in sensible hands.
For the life of me, I cannot understand this mental block. It would be easy to say "People are naive about computers," but this level of blindness affects their thinking about only voting machines--no other computers.
Some sort of reflexive emotional-defense denial is a possibility--the thought of incorrect election results is just so horrifying that they cannot permit its presence. Maybe, but most of an elections official's work is dedicated to preventing various mistakes and frauds. It's simply not believable to me that they could not already have accepted the idea that something could go wrong.
Different officials probably have different reasons. For example, it seems that those who react immediately with anger, taking offense that you would even ask about electronic miscounts, are at some level aware that they might be certifying inaccurate totals--otherwise, why would they be so defensive?
But the others--I genuinely cannot guess.
* Just for the record, with the audit procedures the Board uses, final Wisconsin election results are unprotected against electronic miscounts whether the Board does the audits or not. Even if they had done them, their procedures are not designed to detect and correct incorrect election outcomes. Among other problems, they use a too-small sample size and have no provision for expansion of the audit beyond a single precinct if a miscount was discovered. The audits are performed after election results are certified as final, so unaudited voting-machine output determines the 'winners' regardless.
People have lots of ideas about how to ensure accurate election results, including throwing away the voting machines or piling on more pre-election security measures. Some of these ideas will help.
But without waiting for years of debate and sluggish legislative action, citizens can do five things right now under current law to make election miscounts less likely or to make sure mistakes and miscounts get caught in time to be corrected.
- Let your local election officials know that you want voter-marked paper ballots.
- Observe voting-machine tests before each election.
- Observe poll-closing activities at your precinct.
- Observe municipal and county canvass meetings
- Encourage your local officials to perform post-election voting machine audits and observe them.
(Detailed instructions for the last four activities are here.)
1. Let your local election officials know that you want voter-marked paper ballots.
Two basic kinds of voting machines are used in Wisconsin: voting machines that count votes directly from a touchscreen, where the voter never touches a ballot (DREs); and optical scanners, which count votes by reading a hard-copy paper ballot that voters insert into the machine.
Of those two systems, voter-marked paper ballots provide a much more secure and reliable record of your vote. Even people with disabilities can mark their own paper ballots by using an electronic ballot-marking device, which is available in every polling place. (These machines have touchscreens, but they do not count any votes.)
Both types of voting machines can be hacked in much the same ways, and both can malfuntion. But DREs are less secure because the only paper record of anyone's vote is created by the machine, not by the voter. It's good that Wisconsin's touch-screen machines print a “voter-verifiable paper trail” that any voter can look at to make sure his or her vote was printed correctly--some states' machines don't. However, studies have shown that only a fraction of voters ever look at their printed paper ballot before they leave the polling place, and only a fraction who notice errors report them. The 2016 recount found many polling places in which no usable paper trail printed at all, and no one noticed on Election Day in time to make sure a paper record was created for every voter.
As a result, hackers know that even if they program the DRE computer to switch a portion of their opponents' votes, so few voters will say anything to the poll workers that the switches will likely be assumed to be voter error. Mechanical problems can also prevent the trail from printing properly, rendering the election results unauditable.
County clerks and municipal clerks choose what type of voting system your polling place will use. Regardless of which system your municipality now uses, contact your county and municipal clerks at any time to let them know you prefer voting systems that allow voters to mark their own ballots--that is, systems that use paper ballots. Voting machines wear out, so whichever type of system you are using now could be replaced by the other kind. If voters do not make their preferences known, county and municipal clerks will be influenced only by the voting-machine vendors. Talk to your friends and family about the importance of retaining a voter-marked paper record of every ballot, and have them contact local election officials, too.
* * *
2. Observe voting-machine tests before each election.
Every voting machine needs to be set up specifically for the unique set of races and candidates running in each election. Within 10 days before each election, your municipal clerk tests each voting machine to verify it is set up correctly. While these tests cannot predict or prevent Election-Day malfunction, they are indispensable for detecting mistakes or mis-calibrations in the way the machine was set up.
Citizen observation of the voting-machine tests provides clerks with witnesses to the quality and completeness of their testing; helps to make sure the tests are in fact done; and helps to make sure any problems are noted and corrected before Election Day. Procedures for these tests are available online in the Election Administration Manual.
Instructions for observing these tests are here.
* * *
3. Observe poll-closing activities at your precinct.
Most poll-watchers depart when the polls close, or stay only to see the results printed out, leaving poll workers without citizen observation for such critical tasks as reconciling the number of ballots with the number of voters; processing write-in votes; securing the unmarked ballots; sealing ballot bags; and more. This is the most complicated of the processes open to citizen observers, but it’s not rocket science. Read through the poll-closing instructions in the Election Day Manual; sign in before polls close with your precinct’s chief inspector, follow his or her directions, and you’ll do fine.
Even if you do not know proper poll-closing techniques as well as the poll workers performing those activities, the presence of citizen observers helps to reduce the likelihood of both fraud and error. We are not accusing election officials of anything worse than being normal humans when we point out that observers make carelessness less likely, makes problems more likely to be noticed, and makes noticed problems less likely to be swept under the rug.
Most clerks welcome citizen observers because the observers' presence protects honest, competent clerks from suspicion and can provide independent verification of the election’s integrity.
Instructions for observing poll-closing activities are here.
* * *
4. Observe municipal and county canvass meetings
Within a few days after each election, small “Boards of Canvass” meet in each jurisdiction to review the results from all the precincts; review the records from Election Day; resolve any loose ends such as late-arriving but valid absentee votes and any challenged or provisional votes; check the totals when all the precincts’ results are added together, and make the election results final and official.
This is the municipality’s or county’s best chance to notice and correct problems in the vote-totals. Citizen observers can help to ensure that anomalies—such as a suspiciously high number of blank ballots, which might have resulted from a malfunctioning voting machine—are noticed and resolved. The presence of citizen observers can help to make sure required procedures are followed--such as examining each precinct's totals for suspiciously high proportions of undervotes.
Instructions for observing canvass meetings are here.
* * *
5. Encourage your local officials to perform post-election voting machine audits and observe them.
After every election in the November of even-numbered years, after election results have been declared final, GAB randomly selects a very small number of precincts statewide and instructs those municipalities to conduct post-election voting machine audits. In addition, clerks may, if citizens request, verify the accuracy of voting-machine output at any time after the election--including before certification, if precautions are taken to preserve a well-documented chain of custody.
A voting-machine audit done at GAB's direction must consist of a hand count of all the votes in several races selected by the GAB, and comparison of the hand-count total to the machine-tabulated total. Although these audits have several serious limitations, which we documented in our 2013 report, they provide local election officials and citizens a valuable opportunity to assess how well the machines operated. Although GAB allows clerks to wait until after election results have been declared final, citizens should encourage local elections officials to perform them while there is still an opportunity to correct any errors that might be detected.
Audits performed at the initiative of local election officials or citizens can use more efficient methods of verifying the machines' results, some of which are referenced in the same report. Encourage your local election officials to adopt a practice of routinely auditing at least some randomly selected voting machines after every election. With routine practice, the audit process will become more efficient, and with publicity, even a small amount of random auditing will have a big deterrent effect on fraud and carelessness.
Regardless of whether the audit is ordered by GAB or done at local initiative, citizen observers can provide clerks with independent witnesses who can verify they performed the audits correctly; ensure the chain of custody of the ballots was adequately protected; and make sure any oddities that are noticed are not dismissed without being recorded and resolved.
Audits can be particularly efficient in those counties that use optical scan machines that preserve a digital image of each ballot (the ES&S DS200 or the Dominion Imagecast machines). A group of citizens in Dane County, using software that projects the images in something like a slide show, verified the outcome in the City of Madison mayoral primary of February 2015 in less than 45 minutes! (A full hand count would likely have taken the same number of people at least a full day.) Contact us at WiscElectionIntegrity@gmail.com for information on obtaining a copy of this software and written procedures for these audits.
Instructions for observing voting-machine audits are here.
For updates, follow Wisconsin Election Integrity on Facebook.