Over the past five years, I’ve read every commercial media story I could find regarding election technology. Sadly, that has not been a big job. Few reporters ever mentioned the risks, and those who did tended to interview only election officials. The typical news item would hint ‘some are concerned’ and then quote some official saying “We see no evidence of problems.” The question of whether the officials had been monitoring for problems--or whether they even knew how to--was left unasked and unanswered.
But recently, I am noticing progress in commercial news media’s coverage of the risks of elections technology. America’s reporters are catching up with millions of citizens and all IT professionals. They are realizing that computerized elections have risks, and that IT experts understand those risks better than election officials do.
That's not the only recent improvement. Some reporters have noticed the solution, too. This morning I saw a news story in national mainstream media that went beyond hand-wringing over the risks and mentioned routine election verification.
Under the headline If Voting Machines Were Hacked, Would Anyone Know?, NPR’s Pamela Fessler gave listeners the answer: No. Then instead of musing about hypothetical alternate technologies, she finished the piece with a plug for routine election audits. A few weeks ago, the Atlantic also had a good article focusing on election audits, with the subtitle "A low-tech solution to America’s voting problems."
Don't get me wrong. We are still not seeing the sort of explanatory or investigative journalism that our elections deserve. But things are looking up. Commercial journalists have finally found the phone numbers of election-technology experts. In recent weeks, Reuters turned to the University of Michigan’s Alex Halderman and ABC News quoted the University of Iowa’s Douglas W. Jones.
Even a city reporter, Kristian Torres of the Atlanta Journal-Constitution, now knows to pick up the phone to interview Princeton’s cybersecurity expert, Edward W. Felten, when she has questions about elections technology. A local lawsuit there challenged Georgia's failure to preserve an auditable paper trail.
But when the same opportunity (that is, renowned experts explaining the local angle on a topic of national interest) presented itself to Wisconsin journalists, they missed the opportunity. Last November, when three crème de la crème national experts testified in Dane County Court, Wisconsin reporters focused on mundane, predictable angles, such as the cost of the recount.
The currently trending issue--Russian hacking--might blow over, but I don't think the improvement in reporters' understanding of the larger issues will fade. National-beat journalists are truly waking up to this issue. So it's only a matter of time before state and local journalists, too, bring some gravitas to their reporting on the topic.
I'm optimistic that we will see fewer formulaic stories approvingly quoting a clerk saying "It's all good because we have no evidence of miscounts." I'm looking forward to seeing more actual IT experts quoted.
And I can't wait to hear Wisconsin officials' answers after the next election when for the first time they face a reporter who asks, "Got it--no evidence of hacking. Now can you show us the evidence of accuracy?"
I observed Dane County's post-election canvass of the April 5 election results from start to finish this year--all 19 hours over 4 days.
No surprises: As usual, both the municipal and county canvasses checked and double-checked to make sure the right number of BALLOTS had been counted. However, the Board of Canvass (County Clerk Scott McDonell, Democratic Party representative Gretchen Lowe, and Republican Party representative Joyce Waldrop) certified Dane County's election results at around 3:30 PM on Wednesday, before any one had done anything to verify that the correct number of VOTES had been counted.
The votes of 234,681 Dane County voters (99.6% of the total) were certified based only on unaudited computer output. Vote totals are now no longer subject to change or correction.
The other 859 ballots were late-arriving absentee ballots and approved provisional ballots, which had been publicly hand-counted by the municipalities. The last two days of the county canvass were devoted to making sure the votes from those 849 ballots were added to the correct candidates' totals.
Got that? Half the canvass effort to ensure the accurate counting of only 0.4% of the votes.
Over four days, County Clerk McDonell maintained the minimum transparency required by law. Any observers who were already familiar with the statutes and GAB guidance for county canvasses (that would be me) could follow along reasonably well, but anyone else would have been out of luck in terms of understanding what the canvassers were doing or why. McDonell provided no written procedures or standards--not even to the members of the board. Neither did he explain what they were doing as they went along; allow questions from observers; or provide observers with copies of anything the canvassers were looking at, or make it visible to them in any way such as by projecting it on a screen.
"Just guess" was the unspoken message to the public. Finally, he restricted any public comment to five minutes at the end of the four-day-long meeting.
It got this bizarre: At the end of the four days, I asked if I could ask a question and was told I could make a five-minute statement and that was it. (McDonell claimed that to answer a question for the public would be a violation of open meetings law.)
So the official public comment at the county canvass started with this awkwardness coming out of my mouth: "I noticed an agenda-less canvass meeting on the county calendar for 10 AM on April 20. I assume that is the digital-image audit you've been promising. I hope you will let me know if I am right or wrong in that assumption."
I'm not making this up: McDonell didn't even nod yes or no. And when Waldrop wanted to respond to my comment, he wouldn't allow that, either.
This created something of a Mad-Hatter-Tea-Party feeling to the event, since it was basically just four of us sitting around a table in a conference room in the City-County building, sharing Girl Scout cookies from McDonell's daughters. The canvassers and I would chat whenever McDonell left the room, but when he was present they had to pretend I wasn't there, as McDonell himself did.
I left them with a letter, which I've uploaded here. It's kind of wonky--I wanted to address them as professionals who know and care what words like 'risk,' 'prioritize' and 'verification' mean. I could see that at least Lowe was reading it carefully, and she asked me a few sensible questions after the meeting adjourned. The main points of the letter are:
- they spend most of their time addressing risks that are much more remote than the risk of electronic miscounts, or that address no risk at all--such as reviewing vote totals in uncontested races for which it would be impossible for them to certify the wrong winner; and
- they also spend time on tasks that don't need to be completed before they certify the election results, such as discussing individual municipalities' Election-Day practices for keeping track of the number of voters.
And yet they tell us they have no time to check the accuracy of the computer-generated vote totals--which cover 99.6% of the votes.
My request to them wasn't anything dramatic: I simply urged them to consider risk and timeliness when they decide what to do during the canvass, and told them if they thought about it that way, it would be obvious that verification of the computer output is more important than most of what they are doing now.
As I sat listening to them recite numbers for four days, I visualized the following graphic, which shows:
The steps by which our votes are turning into final election results;
The parts of this process that are verified by the current county canvass procedures; and
The parts of the process that are verified by the type of audit we've been demonstrating in our citizens' audits.
Last night at a friend's house, I had an interesting conversation with a county board supervisor who isn't yet convinced that we need to verify electronically tabulated election results. Give him credit for being willing to talk, but Roger (a pseudonym) is still comfortable with leaving the audit trail unaudited while we hand out certificates of election to whomever the output tapes indicated.
Last night, Roger dug in on an argument I find particularly curious. "Who are you," he asked, "to demand that the voting-machine output be checked for accuracy if the candidates themselves have not asked for a recount?
"Because we voters have standing." I replied. "Our right to accurate election results is not contingent upon whether your opponent was satisfied. And neither is the county clerk's statutory responsibility to certify only accurate results."
Roger didn't process that idea, but simply rephrased his point: "I won my last election," he continued, "By only 50 votes. My opponent conceded without asking for a recount. If he was satisfied with the results, why should anyone else question them?"
Roger isn't the only one from whom I've heard this argument in various forms. It's based on a politician's view of elections. To Roger, the election was a man-to-man contest between two and only two competitors. One of them accumulated the most inanimate points (votes) and won the prize of public office. Voters were like mere spectators at a sporting event, able only to boo or to cheer--but not to question--the referee's calls.
I then challenged Roger with the property-tax-bill analogy: Suppose we had a city treasurer who routinely pushed the "Calculate property tax bills" button on his computer and mailed the bills before checking their accuracy.
Assuming that any city treasurer would ever do this (none would!), I told Roger, "We would not tolerate it for a minute if the city treasurer defended this carelessness by saying, "I'll check accuracy when and if an individual property owner demands that I do."
"We would consider it a problem for the whole community, not just one taxpayer, if we knew it was possible that the system had charged lower tax rates to homes in one part of town than another," I said. "We would not wait for the overcharged owners to suspect the error, or demand that they foot the bill for the audit when they did."
"How is it so evident," I asked, "that city treasurers, but not elections officials, have active ongoing responsibility for the accuracy of their computers' output?"
Roger's a lawyer and was in lawyer mode, so I didn't expect him to concede anything. He didn't. He pointed out that the property owners who thought they'd been overcharged would object, and I agreed. He did not, however, engage on either the point that both the city treasurer and the elections official have responsibility to check the accuracy of their computers' output regardless of whether anyone demands it, or the point that the community as a whole has an interest in both accurate property tax bills and accurate election results.
That particular blind spot--perceiving election results to be more like the private property of the candidates than the shared property of the community--accounts for a significant part of the opposition to routine verification. I notice it whenever people start talking about recounts as any sort of acceptable substitute for routine prudent verification of computer output.
Elections are by far the most powerful and basic means by which we, the People, can exercise our collective right to self-government, and I will not concede to any individual candidate--winner or loser--my standing to demand proof that my community's votes were counted accurately.
* * *
The take-away point of this blog post is the major principle: Elections belong to the people, not to the candidates. However, there is a technicality I also want to explain.
When I got home, I looked up the results of Roger's last election. He remembered correctly that he got 50 more votes than his opponent. That gave him 50.89% of the votes to his opponent's 49.1%, or a victory margin of 1.79%. Current law provides for free recounts only when the margin of victory is less than 0.25% (in that election, 7 votes), so his opponent would have had to pay the full cost of the recount.
This in a county where the voting machines have already demonstrated they are capable of allowing dust bunnies to cast at least 1.3% of the votes.
Prudent, professional elections administration simply does not make verification contingent upon individual candidates' willingness and ability to pay for a full recount and to be labeled a 'sore loser.'
After the 2015 elections, efforts to verify Dane County’s voting-machine output were still in their childhood.
We, the Wisconsin Election Integrity Action Team, had after both 2015 elections demonstrated an efficient, accurate verification method, but had not yet conducted a truly valid audit because we hadn’t yet found a professional statistician willing to work for free.
And Dane County Clerk Scott McDonell wasn’t even trying to conceive. His last pronouncement on the question of official county verification of voting-machine output had been that it was “unnecessary and possibly contrary to statutes.”
Since then, the citizens’ audit process has grown to healthy adolescence. We found a civic-minded statistician willing to work for free, and the March 12 public citizens’ audit of the February election results was a smashing success. Using open-source software developed by a professional Microsoft-certified programmer here in Dane County, we displayed ballot images with about 30 public observers present. All were satisfied that they could see every vote for themselves. We counted votes from 9 randomly selected precincts and verified with 99% statistical confidence that Dane County’s voting machines had identified the correct winner in the February Supreme Court primary.Read more
If some genie were to happen by and offer me three wishes, I fear that before world peace, I'd ask to understand our election officials' lack of interest in verification, when I'm sure they all have the sense to know why banks audit to make sure their computers credited deposits to the correct accounts. It puzzles me deeply.
Yesterday. The chairman of Wisconsin's elections authority, the Government Accountability Board, was testifying before a legislative hearing to defend the agency's continued existence. One of his Republican executioners confronted him with the fact that the GAB had, for many years, neglected to perform statutorily required post-election audits. How could the Board, the questioner badgered, assure Wisconsin residents that their voting machines had counted correctly if they never did post-election audits?*
GAB Board Chairman Judge Gerald Nichol responded--right out in public, on the record, and apparently without embarrassment, "It is true we did not do the audits, but I don't find that too worrisome because our staff thoroughly tested the systems before they were approved for use in Wisconsin."
And--I'm not making this up--that answer appeared to satisfy his questioner.
Imagine what Judge Nichol or the legislator would have said if a banker testified, "We never audit, but I don't find that too worrisome because when we bought those computers, we tested one to make sure it was capable of counting correctly."
The over-the-top ridiculousness of that statement would be immediately evident to either of them in relation to a bank's computers, but neither seemed to think it in any way remarkable when the output in question was our election results.
Today. I went to a large-group training where about two dozen municipal clerks were in attendance. I had several opportunities for one-on-one chats, and I used them to feel a few officials out about their level of awareness of voting machine accuracy. I've learned to start such conversations with praise for their efforts in double-checking that the machines counted the right number of ballots--which they do quite well.
"I'm conducting sort of an informal survey about clerks' thoughts on voting machine accuracy," I would start. "I know you know for a fact that the machines always count the correct number of ballots--you've got that nailed down. But what's your level of trust that the machines counted the right number of votes?"
Most conversations go one of three ways from there. The worst conversations don't even get started (two tonight, but I've gotten this reaction on other occasions). The question explodes some landmine: "Our voting machines are accurate! We test and double test and maintain the very best security. Our election results are always accurate, I'd bet my life on it." Any follow-up question (e.g., Can you tell me what gives you that confidence?) will be met with only more anger, and the clerk or poll worker will walk away. The Topic Must Not Be Raised.
The second typical response is less emotional, but no more productive: Some election officials will be unable to understand the question no matter how you phrase and rephrase it. It's as if you are asking "What do you do when the sun comes up in the west?" They mentally rephrase the question into something that makes sense to them and start talking about that. The elections official will describe the process for checking that the machines counted the right number of ballots, and I'll politely wait until she is done, and then ask the question again more specifically: "Yes, but how often do you think the number of votes--that is, the number of votes for Jones, and the number for Smith--are correct or incorrect?" The elections official will repeat the explanation about verifying the number of ballots, or tell you how the machines reject over-votes, or how they check their addition during the municipal canvass, or some other thing. I'm usually the one that ends these conversation, because I start to feel I'm being mean.
The third most typical response is that they 'correct' the question rather than answering it. In a you-should-know-this tone, they will say something like: "The machines cannot miscount," or "Accuracy is the county canvass job." I had two of these conversations tonight. They don't go anywhere, either. Once this type of election official has decided you are just naive, they switch to an all-talk-no-listen mode.
Of seven or eight conversations I started tonight, only one unfolded into a genuine exchange of information. The clerk responded to my question with, "I would say I'm pretty close to 100% confident, but it does bother me we don't know for sure. I've never discovered any miscount in the pre-election test--that's what gives me confidence--but I know that doesn't guarantee they'll count right on Election Day." Wow. Town of York voters, you're in sensible hands.
For the life of me, I cannot understand this mental block. It would be easy to say "People are naive about computers," but this level of blindness affects their thinking about only voting machines--no other computers.
Some sort of reflexive emotional-defense denial is a possibility--the thought of incorrect election results is just so horrifying that they cannot permit its presence. Maybe, but most of an elections official's work is dedicated to preventing various mistakes and frauds. It's simply not believable to me that they could not already have accepted the idea that something could go wrong.
Different officials probably have different reasons. For example, it seems that those who react immediately with anger, taking offense that you would even ask about electronic miscounts, are at some level aware that they might be certifying inaccurate totals--otherwise, why would they be so defensive?
But the others--I genuinely cannot guess.
* Just for the record, with the audit procedures the Board uses, final Wisconsin election results are unprotected against electronic miscounts whether the Board does the audits or not. Even if they had done them, their procedures are not designed to detect and correct incorrect election outcomes. Among other problems, they use a too-small sample size and have no provision for expansion of the audit beyond a single precinct if a miscount was discovered. The audits are performed after election results are certified as final, so unaudited voting-machine output determines the 'winners' regardless.
People have lots of ideas about how to ensure accurate election results, including throwing away the voting machines or piling on more pre-election security measures. Some of these ideas will help.
But without waiting for years of debate and sluggish legislative action, citizens can do five things right now under current law to make election miscounts less likely or to make sure mistakes and miscounts get caught in time to be corrected.
- Let your local election officials know that you want voter-marked paper ballots.
- Observe voting-machine tests before each election.
- Observe poll-closing activities at your precinct.
- Observe municipal and county canvass meetings
- Encourage your local officials to perform post-election voting machine audits and observe them.
(Detailed instructions for the last four activities are here.)
1. Let your local election officials know that you want voter-marked paper ballots.
Two basic kinds of voting machines are used in Wisconsin: voting machines that count votes directly from a touchscreen, where the voter never touches a ballot (DREs); and optical scanners, which count votes by reading a hard-copy paper ballot that voters insert into the machine.
Of those two systems, voter-marked paper ballots provide a much more secure and reliable record of your vote. Even people with disabilities can mark their own paper ballots by using an electronic ballot-marking device, which is available in every polling place. (These machines have touchscreens, but they do not count any votes.)
Both types of voting machines can be hacked in much the same ways, and both can malfuntion. But DREs are less secure because the only paper record of anyone's vote is created by the machine, not by the voter. It's good that Wisconsin's touch-screen machines print a “voter-verifiable paper trail” that any voter can look at to make sure his or her vote was printed correctly--some states' machines don't. However, studies have shown that only a fraction of voters ever look at their printed paper ballot before they leave the polling place, and only a fraction who notice errors report them. The 2016 recount found many polling places in which no usable paper trail printed at all, and no one noticed on Election Day in time to make sure a paper record was created for every voter.
As a result, hackers know that even if they program the DRE computer to switch a portion of their opponents' votes, so few voters will say anything to the poll workers that the switches will likely be assumed to be voter error. Mechanical problems can also prevent the trail from printing properly, rendering the election results unauditable.
County clerks and municipal clerks choose what type of voting system your polling place will use. Regardless of which system your municipality now uses, contact your county and municipal clerks at any time to let them know you prefer voting systems that allow voters to mark their own ballots--that is, systems that use paper ballots. Voting machines wear out, so whichever type of system you are using now could be replaced by the other kind. If voters do not make their preferences known, county and municipal clerks will be influenced only by the voting-machine vendors. Talk to your friends and family about the importance of retaining a voter-marked paper record of every ballot, and have them contact local election officials, too.
* * *
2. Observe voting-machine tests before each election.
Every voting machine needs to be set up specifically for the unique set of races and candidates running in each election. Within 10 days before each election, your municipal clerk tests each voting machine to verify it is set up correctly. While these tests cannot predict or prevent Election-Day malfunction, they are indispensable for detecting mistakes or mis-calibrations in the way the machine was set up.
Citizen observation of the voting-machine tests provides clerks with witnesses to the quality and completeness of their testing; helps to make sure the tests are in fact done; and helps to make sure any problems are noted and corrected before Election Day. Procedures for these tests are available online in the Election Administration Manual.
Instructions for observing these tests are here.
* * *
3. Observe poll-closing activities at your precinct.
Most poll-watchers depart when the polls close, or stay only to see the results printed out, leaving poll workers without citizen observation for such critical tasks as reconciling the number of ballots with the number of voters; processing write-in votes; securing the unmarked ballots; sealing ballot bags; and more. This is the most complicated of the processes open to citizen observers, but it’s not rocket science. Read through the poll-closing instructions in the Election Day Manual; sign in before polls close with your precinct’s chief inspector, follow his or her directions, and you’ll do fine.
Even if you do not know proper poll-closing techniques as well as the poll workers performing those activities, the presence of citizen observers helps to reduce the likelihood of both fraud and error. We are not accusing election officials of anything worse than being normal humans when we point out that observers make carelessness less likely, makes problems more likely to be noticed, and makes noticed problems less likely to be swept under the rug.
Most clerks welcome citizen observers because the observers' presence protects honest, competent clerks from suspicion and can provide independent verification of the election’s integrity.
Instructions for observing poll-closing activities are here.
* * *
4. Observe municipal and county canvass meetings
Within a few days after each election, small “Boards of Canvass” meet in each jurisdiction to review the results from all the precincts; review the records from Election Day; resolve any loose ends such as late-arriving but valid absentee votes and any challenged or provisional votes; check the totals when all the precincts’ results are added together, and make the election results final and official.
This is the municipality’s or county’s best chance to notice and correct problems in the vote-totals. Citizen observers can help to ensure that anomalies—such as a suspiciously high number of blank ballots, which might have resulted from a malfunctioning voting machine—are noticed and resolved. The presence of citizen observers can help to make sure required procedures are followed--such as examining each precinct's totals for suspiciously high proportions of undervotes.
Instructions for observing canvass meetings are here.
* * *
5. Encourage your local officials to perform post-election voting machine audits and observe them.
After every election in the November of even-numbered years, after election results have been declared final, GAB randomly selects a very small number of precincts statewide and instructs those municipalities to conduct post-election voting machine audits. In addition, clerks may, if citizens request, verify the accuracy of voting-machine output at any time after the election--including before certification, if precautions are taken to preserve a well-documented chain of custody.
A voting-machine audit done at GAB's direction must consist of a hand count of all the votes in several races selected by the GAB, and comparison of the hand-count total to the machine-tabulated total. Although these audits have several serious limitations, which we documented in our 2013 report, they provide local election officials and citizens a valuable opportunity to assess how well the machines operated. Although GAB allows clerks to wait until after election results have been declared final, citizens should encourage local elections officials to perform them while there is still an opportunity to correct any errors that might be detected.
Audits performed at the initiative of local election officials or citizens can use more efficient methods of verifying the machines' results, some of which are referenced in the same report. Encourage your local election officials to adopt a practice of routinely auditing at least some randomly selected voting machines after every election. With routine practice, the audit process will become more efficient, and with publicity, even a small amount of random auditing will have a big deterrent effect on fraud and carelessness.
Regardless of whether the audit is ordered by GAB or done at local initiative, citizen observers can provide clerks with independent witnesses who can verify they performed the audits correctly; ensure the chain of custody of the ballots was adequately protected; and make sure any oddities that are noticed are not dismissed without being recorded and resolved.
Audits can be particularly efficient in those counties that use optical scan machines that preserve a digital image of each ballot (the ES&S DS200 or the Dominion Imagecast machines). A group of citizens in Dane County, using software that projects the images in something like a slide show, verified the outcome in the City of Madison mayoral primary of February 2015 in less than 45 minutes! (A full hand count would likely have taken the same number of people at least a full day.) Contact us at WiscElectionIntegrity@gmail.com for information on obtaining a copy of this software and written procedures for these audits.
Instructions for observing voting-machine audits are here.
For updates, follow Wisconsin Election Integrity on Facebook.