After the 2015 elections, efforts to verify Dane County’s voting-machine output were still in their childhood.
We, the Wisconsin Election Integrity Action Team, had after both 2015 elections demonstrated an efficient, accurate verification method, but had not yet conducted a truly valid audit because we hadn’t yet found a professional statistician willing to work for free.
And Dane County Clerk Scott McDonell wasn’t even trying to conceive. His last pronouncement on the question of official county verification of voting-machine output had been that it was “unnecessary and possibly contrary to statutes.”
Since then, the citizens’ audit process has grown to healthy adolescence. We found a civic-minded statistician willing to work for free, and the March 12 public citizens’ audit of the February election results was a smashing success. Using open-source software developed by a professional Microsoft-certified programmer here in Dane County, we displayed ballot images with about 30 public observers present. All were satisfied that they could see every vote for themselves. We counted votes from 9 randomly selected precincts and verified with 99% statistical confidence that Dane County’s voting machines had identified the correct winner in the February Supreme Court primary.
We also investigated a suspicious result in one Madison precinct, where the voting machine output indicated it had read 1.26% of the ballots as blank, compared to an average undervote rate of only 0.14% among similar precincts with only the Supreme Court primary on the ballot. A full recount of this precinct verified the voting machine had counted accurately, and an observer with knowledge of voter-registration requirements explained that a large elderly housing complex in that precinct may account for the large number of blank ballots, because homebound ‘permanent absentee’ voters can maintain that status only as long as they return a ballot in every election.
And as for Dane County Clerk Scott McDonell—he still hasn’t announced anything publicly, but his office may recently have given birth to a baby official county process! He’s communicating with us only in response to legalistic open-records requests, but if you dig deep into the Dane County website, you can find a report of his close-to-the-vest efforts, beginning in December 2015, to devise his own system for verifying voting-machine output.
It’s absolutely an improvement over anything we've seen from McDonell's office before, but his infant process shows no awareness of nationally accepted best practices for election auditing or even basic concepts of quality monitoring. According to the report, McDonell hired one auditor—an experienced City of Madison chief inspector (head poll worker)—to develop a procedure for using digital ballot images to verify two randomly selected voting machines.
Is the county process VALID? Whether it's valid depends on what question the audit is designed to answer, and McDonell's report doesn't include that information. The process could be valid if its intent is nothing more significant than “Can we find two voting machines that counted correctly?” The report contains no clue as to why the sample size of two machines was chosen, or any awareness that a valid audit program needs to justify its sample size.
Is it ROUTINE? Good news: the report implies (page 6) that McDonell might intend to achieve the ‘routine’ standard—that is, to do an audit after every election so that would-be election thieves know there’s never a time when the figurative security cameras are turned off.
EFFICIENT? RELIABLE? Are you sitting down? The auditor, judging from a little Google stalking, is a professional college-level music instructor. Nothing wrong with that--the world loves a good tuba player--but McDonell appears to have offered him no professional IT support. All alone, the music instructor/chief inspector attempted to work with the zipped .pbm files (the format in which our voting machines save our ballot images). Unfortunately, the county clerk instructed him to download free image-viewing software from an Austrian Internet site, which cannot open zipped files. Our beleaguered auditor could come up with no solution but manually unzipping both precincts' ballot images—a total of 1,252—one by one.
So after receiving the digital ballot images from the county clerk late on the morning of February 24 (page 3), the auditor took them home and worked with them from 1:40 PM to 3:30 AM the next morning. As a college instructor, he was probably aware of what all-nighters can do to performance, so he slept from 3:30 to 6:00 AM. He continued unzipping files until 8 AM, when he had manually unzipped and extracted 1,245 ballot images, one by one. (Yes, he accidentally missed seven.)
This process wasted time (about 13 hours for file manipulation alone); must have been unpleasant for the auditor (his time sheet specifies “timeout to rest eyes”); provided opportunity for human error; and created an insurmountable barrier to public confidence that no one had altered the files. (Well, okay, I’m being kind. It created certainty that someone had altered the files.)
Before beginning the audit, the auditors did not detect the mismatch in the number of digital images extracted and ballots counted on Election Day, and so did not correct the error. That, of course, resulted in audit findings that did not match the machine output (page 4). The auditors were then obliged to do a hand count of paper ballots (page 9) to refute the findings of their digital-ballot verification effort. The report does not say how many hours were spent on that.
Does the county process use ACCURATE AUDIT RECORDS? Give the auditor credit for being honest about his homework, but it didn’t qualify as secure internal control of the audit record.
“Internal control” is the term financial and other auditors use to refer to the procedures that ensure the records used in an audit are complete and true. In elections work, this function is served, in part, by a set of procedures known to election workers as ‘chain of custody.’ Most election workers, including the auditor who wrote this report, understand they are to seal election records in security bags with numbered seals and to document, every time the record is accessed or changes hands, the numbers on those seals—which this auditor diligently did. That’s all good, but it’s insufficient to provide information about how anyone confirmed, or could have confirmed, that the images had not been tampered with, particularly considering that a full eight days elapsed between the election and the chain of custody documented in this report (page 3). The internal controls were obviously insufficient to ensure the audit records were complete, because seven ballot images went missing.
In addition, good internal controls would include policies and procedures that address other conditions and circumstances. Obviously, taking the files home to work with them in private for 13 hours violates basic internal-control principles, no matter how diligently the seal numbers are recorded. The report leaves readers in the dark about any other organizational practices, such as making multiple copies of the record to be stored with different custodians, that might have prevented anyone else, including the County Clerk, from altering the images before the audit.
Obviously, internal control is even more of a problem for any citizens’ audit—in fact, it’s a functional impossibility. By the time we received the digital images in the mail from the county clerk, weeks after the election, with no documentation of how the record had been created, handled, or protected to that point, basic internal-control standards had already been irreparably violated. In consultation with an audit professional familiar with procedures for internal control of electronic records, the county clerk should devise respectable internal-control procedures to ensure a complete, secure, and accurate audit record for the digital ballot-image files. That’s nothing a chief inspector, music instructor, or volunteer citizen group can do for him.
How about TRANSPARENCY? The absence of an intention to achieve meaningful transparency is arguably the most glaring flaw in the county procedures, as they can be discerned from this report.
The audit itself—scheduled for 10AM on a weekday—was publicly noticed only two days beforehand, through the regular county system and, curiously, the Facebook page of the county clerk’s re-election campaign. To the extent that procedures and standards were documented, it appears to have been done only afterwards. The report didn’t describe the method for random selection (page 2) or make any mention of citizens observing either the selection of precincts or the audit itself. None of the written procedures mentions inviting or accommodating public observers.
The report states (page 5), “Ideally, all work should be done … in the presence of a minimum of two audit personnel at all times…” No, that is not ideal; that's not even the minimum desirable. Ideally the audit would be performed in the presence of as many voters and citizens as you can round up to witness the event, confirm accuracy for themselves, and help to build public confidence that their votes were counted accurately.
It’s possible that McDonell could be hesitant to encourage observers while his audit process is still in its infancy, but the report or the Facebook post could easily have made mention of that if it was the case.
TIMELINESS? Both our system and McDonell’s have a disability that can be remedied only when he accepts the nationally accepted standard for timeliness of voting-machine verification--to get it completed before certifying election results as final--or when we win a legal challenge that we’ve been unwilling to initiate until we are sure we can use the digital images immediately upon their release.
Because of the risk of detecting errors when election results can no longer be corrected without expensive and divisive litigation, Wisconsin is alone among states that practice verification in allowing it to be delayed until after election results have been declared final. For example, California requires candidates’ recount requests to wait until verification has been completed, but Wisconsin election officials do the opposite—they demand that citizens wait for verification until they are sure no candidate wants a recount.
Under current law, McDonell could rely on sworn-in citizens to conduct the verification under his auspices as the county board of canvass performs its current functions. When this issue is resolved, Dane County will be initiate verification within a few days of the election and complete it within a week, as is done in most other states that perform verification. Only this will ensure that no Dane County certificate of election is ever issued based on an undetected electronic miscount.
This critique of McDonell’s verification procedures has left out several less serious issues. For example, he appears to have provided auditors (page 4) with incomplete results, leaving out the undervotes which are known to be a key indicator of several types of machine malfunction.
In conclusion, Dane County election results are now protected from undetected electronic miscounts by an adolescent citizens’ audit process and a toddler of a county audit process. The older kid is willing and able to help the younger kid, if the younger kid’s father will cooperate.
We hope it will become as obvious to McDonell as it is to any sensible voter or concerned taxpayer that Dane County would be best served if the county clerk begins actively to cooperate with the Wisconsin Election Integrity Action Team. If we can cooperate, we can share the software that has already solved the IT issues that caused his auditor so much grief and unnecessary work (we’ve offered it multiple times), and we can stop doing citizens audits that have significant chain-of-custody limitations.
Dane County voters can help out by contacting the County Clerk and County Board of Supervisors to tell them that we want election results that are protected by national-caliber verification procedures as soon as possible—definitely before November. Let them know we won’t be satisfied with half-baked efforts that verify only one or two voting machines without producing statistically valid results.
And join in the fun of verifying election results—I’m not joking; it really is fun to count votes from digital ballot images! The next verification event will be on Saturday, April 30, starting at 9AM, at Bethel Lutheran Church, 312 Wisconsin Avenue, just off the square in downtown Madison. Farmer’s Market and election integrity—what could be more motherhood and apple pie!
Postscript: And if anyone says that Dane County residents cannot, for whatever reason, perform post-election audits that meet national standards, that person should be present at any random polling place when polls close on any Election Day. There, I guarantee, you will see a post-election audit that:
- asks the clear and specific question “Did the voting machines count the correct number of ballots,” and answers that question with statistical certainty (valid);
- uses well-known written procedures (reliable);
- is performed quickly with no wasted effort (efficient);
- is completed before certifying the election record for the county board of canvass (timely);
- is performed reliably after every election without exception (routine); and
- does all this in a way that any member of the public who is present can observe (transparent).