Voting-machine source code: A ray of light, not yet full sunshine

In brief: Jill Stein’s post-recount organization, Voting Justice, won a victory over voting machines companies ES&S and Dominion in Wisconsin. Stein will be allowed to bring in experts to examine the software for several models of voting machines, and those experts will be able to report their findings publicly. These machines are used not just in Wisconsin, but around the nation. That is all very good.

But this victory is only a breach in the wall of secrecy, not a demolition. Several factors will limit the benefits that will flow from this victory. If we're going to secure future elections, we will need to thank Jill Stein and the Wisconsin Elections Commission--and keep on fighting.

VotingMachineInspection.jpg


An otherwise well-informed voter could be forgiven for not realizing that the 2016 Presidential recount effort, led by the Green Party’s Jill Stein, is still producing valuable results.

Corporate news media see elections as horse races. Once a winner is declared and the bets paid out, journalistic curiosity dies.  Editors see no story in the poor overall quality of American election administration.

So the 2016 Presidential Recount—completed in Wisconsin, aborted in Michigan and Pennsylvania, not even attempted elsewhere—got a big media yawn when it did not change in the outcome. 

Here’s some news you may have missed as a result:

Since 2016, the products of the recounts have supported organizers’ efforts to improve elections administration—with impressive success.  In Pennsylvania, Stein’s organizers used a recount-related lawsuit to force that state to prohibit paperless voting machines and require routine election audits after future elections.

In Wisconsin, the recount produced a mountain of before-and-after data, from every polling place, for every candidate. Academics from MIT, Harvard, and the University of Wisconsin analyzed it.  Although the recount increased neither Trump’s nor Clinton’s ultimate total by more than a few hundred votes, the researchers discovered that more than 17,600 votes had originally been miscounted—or 1 in every 170.  

Those stunning findings were ignored by the news media, but the Wisconsin Elections Commission (WEC) took note. I believe that study contributed to their 2018 decision to encourage county clerks to improve embarrassingly weak canvass practices. (The ‘canvass’ is the weeks-long process after Election Day, during which local election officials should review the results to make sure they are correct.)

Wisconsin organizers also used the recount results successfully to encourage the WEC to prohibit further use of one particularly unreliable model of voting machine, after the recount caught it ignoring votes marked on as many as one-third of the ballots.

And now, Stein’s organization, Voting Justice, has achieved victory in a recount-related lawsuit that will throw some much-needed light on voting-machine software.

A unique Wisconsin law requires voting machine companies to place a copy of the actual vote-tabulating software in escrow after every election. Separate from the process of approving voting machines for sale, this requirement was originally intended to protect local governments’ voting-equipment investment. In case a company went out of business, the State would have a working copy of the most recently updated software as backup to keep the machines counting.

The law also requires the State to allow candidates to inspect the escrowed software if the candidates agree “to exercise the highest degree of reasonable care to maintain the confidentiality of all proprietary information.”  The software in Wisconsin voting machines is the same as that used in other states, and any inspection could have national implications.

So the Stein campaign asked to inspect the software. They and WEC reached agreement on how Stein’s experts can examine the software without having the opportunity to steal the voting machine companies’ trade secrets. (I can hear the computer-security academics scoffing: “As if anyone would want to!”)

But when the voting-machine companies saw the agreement, ES&S and Dominion didn’t want to play by those rules. The two major players in Wisconsin's voting-machine market wanted WEC to impose a gag order on Stein's inspectors.

WEC said "No gag order." The companies sued.

Their demand of the court was basically: “If you’re going to let Jill Stein’s experts examine our software, prohibit them from ever telling anyone their conclusions.” In other words, the voting machine companies wanted the judge to declare that the experts’ opinions were the companies’ proprietary trade secrets.

Dane County Circuit Court Judge Stephen Elke backed the WEC and turned the voting machine companies down. Likely sensing the main reason why any company would seek such a gag order, the judge wrote:

By way of example, a nutritionist might be given access to the secret formula for Coca-cola, which is undeniably a trade secret. It would not be a disclosure of that trade secret for the nutritionist to say, “After seeing the secret formula, I can tell you that Coca-cola is unhealthy and I would never let my own children drink it.”

This is a breakthrough. To my knowledge, independent experts have never before been able to examine “the software components that were used to record and tally the votes in an election” with the approval and support of the state elections agency. That software is defined as "the vote-counting source code, the table structures, modules, program narratives, and other human-readable instructions used to count votes."

Whatever the inspectors find, the voting-machine companies will not be able to say “But the software you saw was only for review purposes. We had fixed that problem in the operational software.” If they make that claim, they’re admitting they violated the Wisconsin law that required them to provide the State with the software that was used in the election.

And what will their inspection find? Smart money would lay odds on serious problems. You need to know only the basics about profit-seeking corporations and low-bid procurement to predict flaws and holes in a product that the manufacturers believed was eternally protected from scrutiny.

We’ll have to wait to see how well the inspectors can describe those problems without violating their pledge to maintain secrecy about the details of the coding. However, this is the best opportunity so far.

A final benefit is, I believe, this decision’s effect on efforts in other states to compel independent examination of vote-tabulating software. With this precedent, those efforts will be more likely to go forward and more likely to succeed.  Wisconsin has shown that states can require voting machine companies to allow inspection of the software that will count our votes.

The wall of secrecy surrounding the “black box” voting-machine programs has been breached. But it has not been torn down. The Stein team grabbed the opportunity that presented itself and made the most of it, but the benefits have limitations.

The first limitation is that this is a one-time event. If no other candidate ever demands to inspect the software, it will never again be inspected. We don’t yet have routine quality assurance.

Second, this decision does nothing, in itself, to banish proprietary software from public elections. If we want to get any closer to open-source software and routine quality assurance inspections, we’re going to have to force this review’s eventual findings into the public’s and legislators’ awareness. We’re going to have to do that ourselves. Count on the news media to maintain their willful blindness to any news, however shocking, that lacks a Republican vs. Democrat partisan angle.

Third, while this review will be able to identify any defects or vulnerabilities in the master copy of each systems software, the inspectors won’t be able to tell whether the election was hacked.

  • Computer programs can be manipulated in ways that are undetectable to even expert forensic analysts. In Brave New Ballot, Johns Hopkins University computer-science professor Aviel Rubin recounted how he annually provides his graduate computer-forensics students with programming he has hacked at the level of the binary code (that is, the ones and zeroes that underlie the human-readable source code). Years go by between the times when a grad student detects the hacked code, and grad students have been able to stump him, too.

  • Neither voting-machine companies nor election officials will be able to provide Stein’s inspectors with the software that actually counted votes on Election Day. In a “precinct-count” state like Wisconsin, computer tabulation takes place in thousands of separate computers—at least one at every polling place.  Before each election, those machines’ software is copied, recopied, and modified for the many different sets of races and candidates that appear on the jurisdictions’ different ballots.     
    In counties that use the Dominion ImageCast Evolution system (with the exception of Fond du Lac County), the software has even been transmitted over the internet from the Colorado manufacturer to the county clerk.  
    Therefore, to confirm with certainty that the software in every machine was compliant in even one election, inspectors would have to obtain access to the thousands of copies. No one is in a position to collect all that software in a single place, and Stein’s experts wouldn’t have time to review it even if it could be collected.

  • Voting machines can be made to mis-tabulate without altering the source code that Stein’s experts will review. For example, a corrupt or lazy service technician could have installed unauthorized remote-access capability in the county elections computer (as Pennsylvania clerks discovered, to their dismay, in 2014) or in individual voting machines. Later, someone could have taken control of the machines’ output (that is, our election results) simply bypassing or overriding the authorized software.

The best possible outcome of these reviews would be that the experts will find the weaknesses, report them out, and motivate legislatures nationwide to adopt laws requiring open-source software and routine independent software inspection in every local jurisdiction in every election.

But even if that happens, it will not close and lock the door against outcome-altering mis-tabulation of our votes.

The only effective protection against hacked elections remains what it has always been: Routine, manual verification of the correct winners, using paper ballots, completed before the results are declared final.

Routine detection-and-correction is the only security measure strong enough to deter hacking while also protecting final election results against undetected error and malfunction.

It is the only way surely to protect the true voice of the people.

 

Add your reaction Share

An Illustrated Introduction to Risk-Limiting Audits

ElectionAudit-small.jpg"As the secret ballot transformed elections in the last century," said Joseph Hall, Chief Technologist for the Center for Democracy and Technology, "risk-limiting audits are going to transform elections in this century."

 In a few years, Americans will look back, aghast, at our current election management. We will be amazed that we ever trusted vote-tabulating computers so much that we routinely declared winners without checking results for evidence of fraud, glitches, or human error.  We will consider routine verification to be an indispensable part of managing elections, just as cash-register reconciliation is now for managing the corner convenience store.

In preparation for that day, it's time to understand: What is a "risk-limiting audit"?

Read more
Add your reaction Share

Wisconsin County Clerks Association doesn't wanna.

Most local government officials take responsibility for the accuracy of their work product. 
No city treasurer would refuse to check accuracy of property-tax bills.
No county executive would release a report on annual expenditures without double-checking the addition.

For most local government officials, checking accuracy is just part of being a responsible manager. They don't need anyone to pass a law telling them: "Be sure to check your work!" 

But the Wisconsin County Clerks Association is officially on record: They don’t want to.

And their work product is our election results.

StubbornClerk_copy.jpgThe WCCA statement came in response to the Wisconsin Elections Commission’s September announcement that they were considering two measures to improve election security.

The first proposal involved once-every-two-years audits of individual voting machines, which are performed by municipal (not county) clerks. They are the only accuracy-checks the Commission has authority to order, but they have limited value. Not only are these audits limited to November elections in even-numbered years, they check only a few random voting machines, without confirming the right winners in any race.

But the municipal voting-machine audits are better than nothing. The Commission said it was considering ordering more machines audited than in previous years and requiring the audits to be completed before election results are declared final.

The second proposal would move Wisconsin slightly toward compliance with national standards for election security. The Commission said it was considering encouraging county clerks to perform election audits of the type recommended by election-security authorities. 

WCCA's response was swift, naïve, and irresponsible.  The county clerks didn’t want the Commission to require, or even encourage, the county clerks to perform genuine election audits.

Perhaps sensing they are defending the losing side in a national trend (they are), the county clerks also described how they want any audits restricted:

  • They don't wanna check accuracy until after they have certified the election results.
  • They don't wanna check accuracy for any but the top race on the ballot.
  • And they want the State to pay extra if it even suggests they check accuracy.

I’m not making that up. The organization’s memo to the Wisconsin Elections Commission is reproduced, verbatim, below.

About delaying audits until after certification: The WCCA wrote that our paper ballots “should be treated like evidence and remain undisturbed” until after the clerks have reached their verdict and know whether anyone demands a recount. Let’s hope the Trial Judges Association doesn’t follow suit and refuse to look at the evidence until after they’ve reached their verdict and know whether anyone demands an appeal.

About auditing only the top race on the ballot: The WCCA’s message could be restated: “If you want us to protect the US Senate election, forget about protecting the Governor’s election.” Hackers are delighted to know ahead of time which race will be off limits to them, and which races will be on an honor system.

About making the state pay extra for accuracy: The WCCA clearly confirmed the clerks' rejection of the idea that accuracy is  a normal managerial responsibility. Imagine a parks manager telling the county budget manager: “I signed off on this accounting of the user fees we collected. If you want me to make sure it's right, you'll need to pay extra.”

For a final, Trumpian flourish, the clerks blatantly misrepresented the findings of a study by MIT, Harvard, and the UW Madison researchers (Learning from Recounts, 2017). The WCCA memo claimed the researchers had declared that “hand counts of election results are inherently inaccurate.” Compare that to the researchers’ actual words:

“...careful hand counting in a recount is the gold standard for assessing the true vote totals — in large part because of the greater focus on a single contest, more deliberate processing of ballots, and careful observation by campaign officials and other interested parties....”
The researchers ultimately expressed no preference for either method of counting, concluding: "ballots originally counted by computer ... appear to be at least as accurate as ballots originally counted by hand."

 *  *  *

Wisconsin statutes give county clerks the buck-stops-here responsibility for election results’ accuracy. Municipal clerks cannot verify results in federal, state, and county races; they have access to the ballots from only their own city, village, or town. And the WEC is the legal custodian of no ballots at all; has only a few days after county certification before they must certify; and has no statutory authority to question results the county has certified.

We must insist the county clerks fulfill their responsibility. They have the paper ballots. They have the time. Modern election-audit practices would allow them to verify a few races on the ballot in just two or three days, at most, out of the two weeks that statutes allow them before they must certify the election.  The only cost would be the hand-counters’ time at $10 or $12 an hour—a tiny fraction of the county’s elections-administration budget.  They could randomly select just a few races for verification—just enough to deter election thieves in the races most liable to attract their interest.

And yet, collectively, they refuse.

Now, the bright notes: The Commission ignored the WCCA's whining and voted unanimously to encourage county clerks to start auditing during their canvass. And as the WCCA memo states, a few county clerks have begun voluntarily to incorporate hand-counted audits into their routine canvass procedures.

Every county clerk in Wisconsin received a memo on October 4 explaining the current nationwide move to election auditing and providing the clerks with instructions on how to get started.  

Only voters, though, can make it happen. Voters who care about election security should contact their county clerk to find out whether their votes in future elections will be protected with hand-counted audits during the county canvass.  

If not, the next election on February 19 will provide an excellent opportunity for your clerk to begin developing routine election-audit practices, since it will likely be a low-turnout election. Your county clerk has plenty of time before February to learn about the various methods of checking accuracy and work out his or her local procedures.

Insist on it.  

WCCAMemo.jpg

Add your reaction Share

Better management, less partisanship

We need to talk about how we can defend election officials from partisan allegations of corruption, when they are guilty only of poor, careless, and ineffective elections management.

I hope you perceived that sentence to be as goofy as I intended it. What I really want to know is when we voters are going to demand high-quality election administration. When poorly operated polling places make voting difficult, when ballots are mishandled or when votes are miscounted, I don’t care which party it hurts or whether it was fraud or incompetence.

I want it fixed.

Following every election, my Facebook news feed fills with reports of sloppy election-management practices. If partisans can find a way to use an incident to their advantage (and they always can), that’s all they want to talk about.

I spent last Saturday morning in New Berlin at a meeting of grassroots conservative voters who are loudly disgusted with Milwaukee’s election administration. They freely alleged corruption and fraud, which I think unlikely, but I appreciate their anger and distrust.

Their candidate for governor lost by 30,849 votes on a night when the City of Milwaukee took hours longer than expected to process 47,000 absentee ballots. City officials explained that they needed to copy more than 2,000 of those ballots by hand because the original ballots were too damaged for the machines to read.

How can anyone expect emotionally invested partisans to refrain from yelling "Corruption!" when something like that happens?

So election officials promptly apologized. They admitted they knew ahead of time exactly how many absentee ballots they would need to process. They accepted full responsibility and started an immediate investigation. They made a public commitment that in future elections, absentee ballots will be processed as smoothly in Milwaukee as elsewhere.

I’m being goofy again. They did no such thing. That’s the kind of response we’d expect from a city treasurer who had sluggishly processed 47,000 property tax payments because 2,000 had been mangled.

In reality, the first response from election officials was that the incident was “routine,” hardly a confidence-building defense. Then, Milwaukee Elections Director Neil Albrecht reframed concerns about management as insults to the workers, and blamed Republicans for not passing legislation that would allow municipal clerks to run the voting machines continuously for weeks before each election. (He did not, however, offer a solution to the as-yet-unresolved details of how security and accuracy safeguards can be maintained when voting machines are in active operation for a six-week period instead of just one day.)

No sensible observer of politics will be surprised when I report that the Republicans in the meeting I attended spoke of using this incident to restrict all early and absentee voting around the entire state. They further mused about reviewing all Milwaukee absentee ballots to make sure the envelope signatures match those on file. They spoke of demanding a randomly selected ballot be thrown out for every ballot disqualified by a non-matching signature. (That’s called a ‘drawdown’ and is legal under current Wisconsin law.) Going after mismatched signatures has been used in other states to get votes thrown out or to make voters jump through hoops to preserve their votes.

Of course, such a process, if done only in Milwaukee County, would throw out many more Democratic votes than Republican votes. That’s why throwing out the ballots of randomly selected innocent voters while creating no consequences for the responsible managers looks like a ‘solution’ through their eyes.

So we’ve got a situation in which the Democrats are using this incident to push for running the voting machines continuously for six weeks, damn the security issues. The Republicans are using it to push for measures that would suppress legitimate Milwaukee votes.

Who is talking about better election administration? Who is asking why Milwaukee officials were prepared to count fewer ballots than they knew they had on hand? Did they not hire enough workers? Did they not assign enough equipment? Were their procedures less efficient than they could have been? Who is demanding to know why Milwaukee had, proportionately, more spoiled ballots than other counties, or what can be done to fix that? 

No one. We don't hold our election managers to the same standards we hold other local government managers. Can you imagine what would happen to a city treasurer who defended comparable news about processing property-tax payments by calling it ‘routine’? When transactions are conducted in votes rather than dollars, our expectations of the managers plummet. 

When we tolerate--even excuse—elections mismanagement, partisans will always take advantage.  To use this case as an example, it is easy to see that people who want to expand early voting should aggressively work to make it as well-managed as possible, not to defend its mismanagement as unavoidable or routine.

Partisanship will never go away; tribalism is what humans do. But our election officials could stop insisting that voters accept poor planning and accidents as routine. If we want to hush the partisan complaints, we must hold our election managers to higher standards of care and competence. 

 

 

 

Add your reaction Share

Audit this election; deter fraud in the next.

Have any Wisconsin elections been hacked? A few elections were recounted, but no one knows about the others. Until this year, Wisconsin's election officials merely added up the machines' vote totals and declared the results final. Audits were something that they did later, if ever.

But Wisconsin's clerks are waking up to the fact that if they choose to, they can detect miscounts in time to correct them.

So this month, for the first time in Wisconsin's history, voters can be present as clerks hand-count paper ballots. These audits will verify at least some computer-tabulated results before they declare election results final. 

At least one audit will be conducted in every county. The day after the election, Wisconsin Elections Commission staff randomly selected 5% of the voting machines and ordered those municipal clerks to conduct hand counts. Those audits are now underway, and will be completed before November 28. Click here to see if a municipality near you is conducting one. 

Do not expect the audits to detect problems.
Finding problems in this election is not the audits' main value.
Routine audits are valuable for the fraud they deter.

Our election officials need public support and recognition for starting down the road to secure, audited elections. Here's what you can do:

  • At a minimum, call your local municipal clerk and your county clerk to thank them for this year's audits and encourage them to do more in future elections. The WEC can order only municipalities (not counties) to check accuracy, and can do that for only one election every two years. Voters need to pressure our local officials to do more, voluntarily.
  • Better yet, ask the municipal clerk when the audit will be conducted in your municipality. Attend and observe, if only for an hour or two. As administrative procedures, audits are more relaxed than recounts. The municipal clerk should allow you to observe closely enough to see the ballots yourself, and your presence will show the clerks their work is appreciated.
  • More detailed instructions for observing the audits are here.

Call your municipal clerk today, and support the efforts to secure Wisconsin's elections with routine audits.


StandingGuard.jpg

Add your reaction Share

How to observe a voting-machine audit

Help protect election integrity.
Observe a hand-counted voting machine audit in your county.

Click here for a pdf version of these instructions.

Note: You will support election security if all you do is show up, sit down, and watch auditors count votes for an hour.

If you're in a hurry, you can stop reading now. Just show up, and you'll be doing a good deed. If you're nervous that you won't remember the following instructions, don't worry. You don't even have to read them. Just show up, follow the clerk's instructions, and watch, and you will be providing a valuable service. Elections cannot be trustworthy without transparency, and our election officials cannot make transparency happen all by themselves. If voters want transparency, we need to be there. Just be there.

To find out when and where:

  • Find a municipality (city, village, or town) near you that was selected for an audit.  This list is in alphabetical order of municipality, or if you want to look them up by county, use this list from the Wisconsin Elections Commission
  • Find the phone number for that municipal clerk from this list or this list.
  • Call the municipal clerk. Ask when and where the voting-machine audit will take place.
    If you're interested and able, ask the clerk whether and how you could participate as one of the vote-counters. Some of the municipal clerks understand the value of public participation and like to get volunteers. Don't be insulted, though, if the clerk already has the audit staffed. Mostly, they will rely on experienced poll workers.
  • If you cannot set aside an entire day, consider observing only in the afternoon, so that you can be there when the results are compared.

The important role of OBSERVER...

JustShowUp.jpg

Election audits must have transparency to be credible--but election officials cannot demonstrate anything to the public if the public isn’t present.

The presence of observers also helps to ensure officials perform the tasks thoroughly and in accordance with instructions, and to ensure that any problems discovered in the audit are not dismissed or ignored.

Observers, too, get something out of observing. Only by being there can we get to know our local election officials, and audits are good opportunities to do that. Election Day is often tense and busy, while recounts are often hurried, complicated, and contentious. In contrast, because audits are administrative tasks that can be relatively relaxed, unhurried occasions. Observers can ask questions and learn more about how elections are managed and secured.

What happens at an audit?

  1. On the morning of the audit, sealed bags containing ballots and election records will be brought to the audit site and opened. Clerks will inspect the material for any signs of tampering and will review the chain of custody.

  2. The auditors--the people who will be counting the votes--will probably be some of the more experienced poll workers, selected by the municipal clerk. They will begin by counting the ballots into stacks of 20, and the stacks of 20 ballots are arranged in batches of 100.

  3. The auditors will pair up, and each pair will take two batches of 100 ballots. Each auditor will then count the votes from one batch and trade batches with his/her partner, by making hash marks on a tally sheet. They will then trade their stacks of ballots and count the batch the other just finished.

  4. When both have counted both batches, they will compare their tally sheets. If their totals match, the two batches will be set aside, and they will move on to the next two batches. If the two auditors’ totals for any batch do not agree, they will jointly review the ballots and try to find the ones that they counted differently. Experienced auditors will flag those ballots in some way, so that they can be located again in the final reconciliation process. When the two auditors agree on the vote totals in each batch, one will change his or her tally sheet, and they will move on to the next.

  5. When all the ballots in the precinct have been hand-counted, the subtotals from all the tally sheets will be added together and compared against the totals on the voting-machine tape that was printed out on Election Night.

  6. If the hand-counted totals in each race agree with the machine-tabulated totals, the audit is done, and the official in charge completes a report for the Wisconsin Elections Commission.If any totals disagree, the auditors need to try to figure out why. They will need to check their addition, and then most likely, will engage in something of a guessing game trying to figure out how the voting machine might have read ambiguously marked ballots when auditing an optical-scan machine, or questioning their own counts.When the auditors have decided how to explain any discrepancies, the audit is complete and the official in charge completes a report for the GAB.

  7. Chances are, you will see some variation from WEC instructions for the auditors, and you might see the auditors struggling to figure stuff out. They don't do this often, so cut them some reasonable slack. Most probably, you won't see any problems more serious than inefficiency and some trial-and-error. If you do see any more serious problems, they are likely to be one of the following:
  • Ignoring certain types of miscounts. The WEC has instructed clerks and auditors have been instructed to dismiss errors that are the result of human rather than machine error. Observers can make sure any such problems are noticed and followed up, after the audit, by the municipal clerk as part of his or her basic responsibility to certify only accurate election results.
  • Unnecessary secrecy. Excessive secrecy is a problem for election security and voter confidence even if no votes are miscounted, because it creates situations that would hide fraud or errors if they occurred. As a result, observers need to be on the lookout for any practices or constraints that prevent them from verifying, with their own eyes, that the clerks and staff are conducting the audit honestly and accurately, particularly if the constraint has no benefit to the audit.
  • Poor handling of election records.  Like unnecessary secrecy, poor handling of election records puts elections at risk of  undetected problems even if no problems affected the election being audited. Observers might notice departures from what is known as “chain of custody” practices.

Step by step: How to observe a voting-machine audit

Before the audit, as soon as you can:

  1. Find out when and where the audit will take place. (See information under the red heading, above.)

  2. If you can attend, please email your name and which municipality you intend to observe to us at  wiscelectionintegrity@gmail.com. We are trying to get as many observers to as many audits as we can, so we'd like to know which municipalities are covered.

  3. Browse through the instructions provided by the WEC to the municipal clerks, so that you know what they are supposed to be doing. You can watch the whole 28-minute training video provided to the municipal clerks—but if you just want a preview of what will happen during the audit you observe, watch the six-minute segment from 13:00 – 19:00.

  4. Print out the clerk’s instructions to take with you for reference, or save the location on your portable device so that you can access it if needed.

  5. Print out this reporting form, so  you can take notes and let us know how it went.

  6. Plan how long you will spend observing. Auditing a single precinct can take all day, depending on the number of people counting votes, so you may want to plan to be there only at the beginning and at the time they reconcile the completed hand count with the machine tape. They will be unable to predict exactly when they will finish the hand count, but you might be able to estimate that after watching them count the first few batches.

  7. Know the rules of observing:
    The basic rule is just common sense--Do nothing to interfere with or obstruct the auditors' work. It's in their interest and ours that they are able efficiently and accurately to complete the audit. You will not be permitted to touch any election materials.
    But observers can observe. You should be permitted to look at any document you want to see, and to photograph some documents or the process. If you plan to photograph, it would be polite (not required) to let the municipal clerk know this ahead of time, so that he or she can make sure the auditors are not surprised or upset at being photographed. The clerk may impose reasonable restrictions about thing like talking, asking questions, bring food or drink into the audit room. 

On the day of the audit:

  • Take a camera with you, in case problems arise that need to be documented.

  • Take a red pen for taking notes. Red pens are typically the only ones allowed in a room when ballots are being handled, to avoid any chance that the election records could be altered or damaged without detection.

  • Arrive a little early to allow time for cordial introductions, and to discuss with the clerk clear expectations of how and what you want to, and will be able to, observe and when and of whom you will be permitted to ask questions. Explain to the official in charge that the point of public observation is to support public confidence in elections. To do that, you would like to be able to see enough that you can verify that the votes are being counted correctly. Let the clerk understand that you would like to be able see the ballots as the auditors are counting the votes, in a way that will not disrupt their work. Some municipal clerks allow observers to stand behind the seated auditors; others have allowed observers to sit beside the auditors.  At a minimum, the municipal clerk should allow you to view any ballots that the auditors discuss. It may be that the clerk will find no way to accommodate this. Please report that to us on the reporting form.

  • The audit should begin with an inspection of the election records, including the ballot bags, to make sure all necessary records are on hand and are in order, much as the clerk would do for a recount. Observers should be able to inspect--not touch--the material closely enough that they can verify that the marked ballots or machine-printed paper trail are sealed in bags or containers in such a way that no ballots could have been inserted or removed without breaking the seal, and that the records show no signs of tampering; the inspector’s statement should be on hand and in order, containing the seal numbers that match those on the ballot bags, among other information; and the machine-printed results tape should be on hand.

    Before the auditors open the ballot bags, they will compare the number on the bag's seal to a number recorded on another record when the bag was sealed on Election Night. Ask to observe, for yourself, that the numbers match. If they do not, take a photo to document the problem. Note the problem and what the auditors did, if anything, to determine why the seal numbers did not match and whether the ballots has been tampered with.

  • As the audit tasks proceed, ask questions throughout, as long as your questions don’t interfere with the purpose of the audit or slow it down more than the officials are willing to accommodate.

Issues to watch for (if you are observing a hand-count of voter-marked paper ballots)

Ambiguously marked ballots   A certain proportion of votes can be expected to be ambiguously or sloppily marked, so that the hand-counters will disagree on the voter’s intent. 

Watch to see about how often the auditors disagree, and how they resolve their differences. Ask to see the ballots that seem to them to be ambiguously marked, so that you can develop your own sense of how well the voters marked their ballots. A very large proportion of ambiguously marked ballots—more than an average of one in every 100 ballots—may indicate a problem you could discuss with your municipal or county clerk: How could the voters be instructed more effectively in the next election?

Votes not read or noticed by the voting machine   The type of miscount that is most likely to be noticed is something called an "undervote."  The human auditors will be able to count more votes on the ballots that the machines counted on Election Night.

There two most common reasons why voting machines ignore some votes are:

  1. Voters marked their votes in odd ways, such as circling a candidate’s name on the ballot rather than filling in the target dot beside the candidate’s name, making a very faint mark, or using a type of ink the machine could not detect. These are legally valid votes if a human can see the voters' intent, even if the machine cannot.
  2. The voter cast a write-in vote but did not mark the oval beside the write-in line on the ballot. A human can easily read that write-in vote; the machine looks only at the ovals and sees nothing.

Other possible causes are, of course, more concerning. Programming errors in the past have caused voting machines to ignore some votes; machines can lose calibration and simply malfunction; and (worst case) malicious code could have been inserted to tell the machine to ignore 5% of the votes for a certain candidate.

In a well-run election, there should not be a large number of these ballots—no more than one in every 200 votes or about 0.5% in the top race on the ballot.  (In other words, 99.5% of the voters typically vote in the main race on the ballot--in this case, governor or US Senate.)

Here's where the audits you will observe get harder to understand--but the problem isn't you. The auditors have been instructed to count the votes as the machines would have counted them, without regard to voter intent. That's because WEC believes that in order to satisfy federal law, they must assess the performance of the machines apart from any human error or interference. Their reasoning (I'm not making this up) is that if the voting machine was programmed to ignore one-third of the votes (an actual incident in Taylor County in 2004), and the voting machine did, in fact, ignore those votes, the machine was working just as it was supposed to and there is no problem.

Voters, of course, see a problem whenever votes are miscounted, for any reason.

In many municipalities, auditors won't follow the WEC's instructions to ignore voter intent and read the votes as the machine would have read them. The auditors are not machines; they're humans and they can see voter intent. But still, observers should be alert that a serious miscount might be dismissed by the auditors on the grounds that it wasn't the machine's fault. 

When all the votes are hand-counted, ask to see the total number of votes for all the candidates in the Governor's race, including the write-ins. Add all the candidates' votes together, and divide that number by the total number of ballots. For example, the auditors might hand-count 599 votes for governor, out of 600 ballots (That is, they found votes on 99.8 percent of the ballots.)That means the actual undervote rate was 0.2%--normal.

Now, compare the total number of votes counted by the machine on Election Day to the total number of ballots. The machine might have counted the same number of votes as the human counters--and everything is fine.

But the machine might have counted only 595 votes for governor--that is, it saw a vote on only 99.2 percent of the ballots. That's an undervote rate of 0.8%--above what experience shows is a normal undervote rate. That could indicate a problem. Ask the auditors if they can find the four votes that account for the difference. If they find four ballots with write-in votes recorded, without the ovals being checked, there's the answer.

But if they cannot find the explanation, or if their explanation is a guess, ask them to note that on their report to the WEC, and please report it to us at wiscelectionintegrity@gmail.com. Small errors in one voting machine can add up to a big difference in a statewide election, and should not be ignored.

Issues to watch for (if you are observing a hand-count of a paper trail printed by a touchscreen voting machine)

Unusable voter-verifiable paper audit trail - Wisconsin law wisely requires touch-screen machines to create a voter-verifiable paper audit trail (VVPAT) –a paper print-out of each ballot cast by each voter. If the auditors finds that the paper trail cannot be read, they will likely go ahead and do what they can, or ask the vendor to reprint the tape from the computers' memory.

But in reality, an audit is impossible, because there is no voter-verified record to audit. Ask the municipal clerk to note that on his or her report to the WEC, and please report it to us at wiscelectionintegrity@gmail.com.

Cancelled votes - Touchscreen voting machines give each voter a chance to reject a ballot after in has been printed on the paper trail. If the voter rejects the printed ballot, a message is printed on the tape and the voter can start over to create a correct ballot. Experts on election fraud have determined that, if a malicious programmer manages to manipulate a touch-screen voting machine, the fraud might leave evidence in the form of a larger-than-expected number of cancelled ballots.

Local election officials in Wisconsin tend to be dismissive and unconcerned about this possibility, but it is a possibility and certainly something an audit should notice. But the municipal clerk will not likely be alert for cancelled votes--except to exclude them from the audit. Observers, however, can watch out for it. If you see the auditors encountering more than two cancelled votes on one voting machine, ask the municipal clerk to not the number of cancelled ballots in his or her report to WED and please report that observation to us at wiscelectionintegrity@gmail.com.

When the hand count is complete

When the hand-count is complete, the results are compared to the machine-tabulated results. If the two totals match, the machine tabulations are confirmed accurate and the audit is done. The clerk will complete a report to WEC indicating an ‘error rate’ of zero.

If the two totals do not agree, the clerk will need to figure out why they differ before he or she can calculate an error rate, per WEC instructions. Common human-error mistakes include addition errors and forgetting to exclude hand-counted provisional ballots. (The machine couldn't have possibly counted these votes in the Election-night machine tape).  

As noted above, if the hand-counters found more votes than the voting machine counted on Election Day, there could be a problem. Watch how the municipal clerk and auditors handle that. If they follow WEC instructions, they are supposed to try to figure out why the two counts differed. If the reason is obvious (such as several write-in votes for which the voters did not mark ovals), the auditors might be able to solve the mystery. 

But other problems simply cannot be diagnosed by a municipal clerk and handful of auditors, without more time and resources. Be on the lookout for auditors guessing at explanations for miscounts, without really having enough information to be sure. Ask the municipal clerk to note the auditors' uncertainty on his or her report to WEC, and please report it to us at wiscelectionintegrity@gmail.com.

What to do if you see problems

If you see any practices that don’t match your expectations of a transparent, fair and accurate hand count, or that don't follow the WEC's instructions, ask the clerk to explain. There may be some necessary, harmless variations the clerk is doing for a sensible reason. As long as the main purpose of the test is fulfilled—to verify the accuracy of the machine-tabulated total by comparing it to the results of an objective hand count—there’s no need for observers to be sticklers.

If the clerk cannot give you a good explanation why he or she is departing from the instructions, and you think the variation prevents the audit from verifying the results’ accuracy, encourage the clerk to contact WEC.

You can call WEC at (608) 266-8005 to report an immediate problem, such as observers being locked out of the audit room (it has happened), or other serious violation of the audit requirements. If the issue is not resolved, ask WEC about the procedure for filing a formal complaint.

- - - - - - - - - - -

Whether your observing experience is good or bad, or a mix, we'd love to hear what you noticed and how it went.
Please write to us, after observing an audit, to let us know: wiscelectionintegrity@gmail.com. 

These instructions can be improved by your feedback. Please email your suggestions to us at wiscelectionintegrity@gmail.com.

Add your reaction Share

Municipal voting-machine audits--How much will they help?

There's no such thing as fail-proof pre-election security. That's why we need audits after each election.

In November 2018, for the first time in Wisconsin history, some of our computer-tabulated election results will be verified by hand-counting paper ballots.

But the audits ordered by the Wisconsin Elections Commission for this November are far from the audits recommended by election-security experts and being implemented in other states.

Here's a run-down of the benefits and limitations, of how far Wisconsin has come and how far we have to go.

First, the benefits:

To effectively prevent miscounted preliminary results from being declared final, audits need to:

  1. be completed early in the canvass period (the two weeks following each election) to allow time to correct any miscounts with a full hand count; and
  2. hand count enough ballots, chosen the correct way, to provide statistical confidence that the right winners had been identified.

First, timing: This is the most important improvement. The state elections agency has had authority to order voting-machine audits ever since 2006, but in previous years allowed local clerks to delay them until after they had certified final election results. This, of course, eliminated the possibility that miscounts could be corrected and with it any fraud-deterrence value the audits might otherwise have had.

The WEC has ordered this year’s voting-machine audits to be completed by November 28, before the results in the statewide races are declared final. This gives the audits some deterrence value, because if the local clerks don’t wait until the very last minute, there still might be time to correct any miscounts before anyone is officially declared the winner.

Second, size of the sample: This year's audits will include more machines that in previous years (five percent of the voting machines, or 183 machines statewide out of more than 3,500). That's almost twice as many machines as in previous years, and--believe it or not--auditing 5% of the state’s voting machines will put Wisconsin in the top dozen states for the size of the post-election verification effort. Many other states require samples of only 1% or 3%.

In addition, the WEC decided to select the sample in a way that ensures at least one voting machine in every county will be audited. Again, this is more protective than it might sound. The vote-counting code for statewide races is typically created for an entire county at the same time, and then copied into each voting machine.  As a result, mis-programming is a county-level risk, and auditing only one machine has a good chance of detecting any such problems.

Now, the limitations:

1. These voting-machine audits won't guarantee the right winner was identified.

VotingMachineAuditvElectionAudit.jpg

These are designed to be voting-machine audits, not election audits. Here's the difference:

Election audits answer the bottom-line question: “Have we identified the right winners?”  Election audits hand-count as many randomly selected ballots or entire precincts as are needed to provide confidence that the correct winner has been identified. If the first sample does not confirm a winner, the sample must be increased and increased again, until either the Election-Night winner is confirmed or a full hand count has identified the real winner.

But under current state law, the WEC has no authority to order election audits.  The sample size for these audits won't be big enough to verify the winner but the widest-margin results, and the WEC is not requiring the municipalities to expand the audit to more machines if one is found to have miscounted. 

Voting machine audits answer a much smaller question: “Did this voting machine work as it was supposed to work on Election Day?” The auditors will NOT be looking to see whether the voting machines correctly identified and counted voter intent. They will be looking to see whether the machines operated as they were designed and programmed to operate--and, sadly, our election laws do not require that those two things to be the same thing.

So, hold onto your hat; I’m not making this up: A voting-machine audit might deem even a serious miscount to be no problem. A real-life example can illustrate this. A vendor who programmed the voting machines for the City of Medford (Taylor County, Wisconsin) once disenfranchised one-third of that city's voters by programming the voting machine to ignore all straight-party-ticket votes. If a voting-machine audit had detected that, it would NOT have been flagged as a problem. Remember: a voting-machine audit asks only whether the voting machine operated as it was supposed to. In the Medford miscount, the answer is “Yes; the voting machine ignored all the votes it was programmed to ignore.”

2. The voting-machine audits will be done only for one election every two years.

WEC's authority to order voting-machine audits is limited to November elections in even-numbered years. Miscounts in other elections will continue to go undetected and uncorrected. Fraud will not be deterred in any other election.

If voters want more security than that--and we do--we're going to have to work on our individual county clerks to do the right thing, voluntarily, after every election.

3. Oversight must be provided by the voters.

VotingMachineTest-NoBorder.jpgObservers are needed at every audit. Transparency is a vital component of a valid audit, and transparency is impossible if no one shows up to observe. It’s not saying anything worse than “Election officials are normal human beings” to point out that they are less likely to cut corners and more likely to follow the procedures carefully when observers are present. WEC does not have the staff--no where near enough staff--to observe these audits to make sure they are done well. 

In addition, because of the weird requirement that miscounts will not be considered ‘errors’ if they can be explained by human error or intervention, observers need to be present to make sure that anomalies are noted and acted upon. The WEC might not require municipal clerks to correct any miscounts they find, but voters should certainly insist upon it.  

There will be a voting-machine audit somewhere in your county between Monday, November 12 and (probably) Thanksgiving.  

Chances are, however, it won't be well-publicized. You will need to contact your municipal clerk to find out when and where it will take place.

BE THERE to observe. Heck, offer to volunteer as a vote-counter if you’ve got a receptive, public-welcoming municipal clerk.  If the municipal clerk follows WEC instructions and common sense, the audit won’t take more than a few hours. Depending on the size of the precinct, you could be done before lunch.

No one will know which municipalities will be conducting voting-machine audits until the day after the election.  That’s done to increase the audit’s value for deterring fraud. The list will be posted on the WEC website, this website, and on our Facebook page, and we’ll be sending email notices to anyone whose home county we know.  (If you want an email telling you where the voting-machine audit(s) in your county will be conducted, email us at WiscElectionIntegrity@gmail.com and tell us what county you live in.)

Add your reaction Share

Are Wisconsin's elections audited yet? No, but....

BikeRiding.jpg

VotersFollowThrough.jpgIf performing election audits is like riding a bicycle, Colorado and a few other states are training for professional racing. 

In about 20 other states, election officials haven’t yet decided whether they want to give up their tricycles, and in about a dozen, officials haven’t even tried a tricycle yet.

And 13 states are still inside, in their pajamas, playing with their paperless touchscreen voting machines.

In Wisconsin, Wisconsin Elections Commission has given our county election officials a two-wheeler with training wheels and told them to get moving.

In other words, we’re on our way.

WCCAonTrike.jpgBefore now, officials didn't check accuracy until after they had declared election results final. That practice, in the words of a recent national comparison of states' election-security practices, "leaves Wisconsin open to undetected  hacking and other Election-Day problems."

So the WEC did what it could: It voted to order municipalities to audit 5% of the voting machines immediately after the November 6 election, and to "encourage" county clerks to start experimenting with legitimate election audits. 

All that is good, but here's the problem: the municipal voting-machine audits have only a limited ability to protect our election results from hacking and errors. But they are the only audits the WEC has authority to order.

Broader election audits could truly protect our elections, but the WEC doesn't have authority to order those. County clerks are elected constitutional officials. They don't have to listen to the national and state election authorities if they don't want to.

In short, only the voters can hold county clerks accountable. Only we can make sure they heed federal and state authorities' advice. Only we can make sure the county officials make sure the election results are accurate.

The WEC’s October 4 memo to the county clerks is probably the best little document on election audits that the state elections agency has ever produced. Click on this link to read it for yourself—it’s clear, simple, and complete. No frills. There is no reason why any Wisconsin county clerk cannot follow the WEC’s simple step-by-step instructions—even if they decide at the last minute to add this powerful safeguard to their canvass procedures.

What voters need to do:

It is absolutely worth checking with your county clerk—or in Milwaukee County, the county election commission. Call today; here’s a link to their contact information.

When you ask your county elections clerks about election audits in your county, you might get some good news. Some have already decided to try their hand at election auditing. 

But others are being stubborn, even childish.  The Wisconsin County Clerks Association, sadly, sent a whiny memo to WEC saying that they didn't want even to be "encouraged" to conduct audits. Among other things, the WCCA thinks no more than one race each election should be verified. They even told WEC that any hand counts would be “inherently inaccurate.”  (In truth, Wisconsin’s county clerks are perfectly capable of conducting an accurate hand count if they want to.)

So contact your county clerk.  When you ask for valid, routine election audits, you're merely repeating what federal and state authorities have already told your count clerk.  Accept no excuses:

  • Your county clerk has the time to ensure accuracy and security. The entire audit process shouldn’t take more than two days if they assign or bring in enough staff and volunteers. They have two weeks in which to schedule it. Some of their counterparts in other states do more auditing with even less time.
  • Your county clerk has the staff. Any competent chief inspector (that’s a head poll worker) could easily lead the audit—it’s not rocket science—while the county clerk keeps on with his or her other duties.
  • Your county clerk has the budget. The only expense should be the hand-counters, and the clerk could accept volunteers. If none of the poll workers want to help (and they do), the clerk can check with the Rotary Club or the high school social studies teacher. There’s no reason high school students cannot do this. The WEC has offered to reimburse the clerks up to $300 to cover the costs, if it costs even that much.

CountyClerks_copy.jpg

Add your reaction Share

PT Barnum-style election security

Reporter: "Does it bother you that what you're showing is humbug?"
PT Barnum: "Do these smiles seem humbug? It doesn't matter where they come from if the joy is real."

BArnumandVotingMachine.jpg

I recalled this dialogue from The Greatest Showman as I was observing a pre-election voting machine test in the City of Elroy, Wisconsin on Monday, August 6.

Conducted in every municipality before every election, these tests serve some necessary functions.

But as a safeguard against hacking, they are humbug—as authentic as a bearded lady whose facial hair is hanging from strings looped around her ears. 

Nevertheless, because the tests make some voters and reporters feel confident, they are touted as a security measure.

I've observed more than two dozen of these tests over the years. The ones I observed this week were typical. Even if you're not an IT professional, I'll bet you can pick out why these tests don't protect Election-Day results from hacking—whether the hacker is an Internet cyber-crook or a corrupt voting-machine company insider.  

Here, try it. Start by predicting what the hacker might try to do. First, do you think the hacker would make the malicious code miscount every single vote or only some votes?

You guessed 'only some,' and experts agree. When a blue-ribbon election-security task force convened by the Brennan Center for Justice worked out how a hacker would steal a statewide race in the imaginary State of Pennasota, they calculated that no hacker would likely alter more than 7.5% of the votes, or a little more than 1 in every 13. So if you want to detect hacking, your set of fake ballots—your 'test deck'—should contain enough ballots to give each candidate at least 13 valid votes.

But Wisconsin municipal clerks typically create test decks with only one vote for each candidate—enough to catch only hacks that affect every single vote.

Second, do you suppose the hacker might instead allow the machines to count votes accurately all day, and then simply flip the candidates' vote totals at the end of the day to give his guy the biggest total? You probably guessed yes, he might. So you would need to create a test deck that has a winner in each race, a different number of votes for each candidate.

Wisconsin municipal clerks' pre-election test results typically contain a lot of ties--the same number of votes for each candidate in each race. Those test decks would not detect any vote-flipping hacks.

Finally, would the hacker's malicious code kick in whenever the machine was turned on, or only on Election Day? This one is easy. Hacks would never trigger on any day other than Election Day.

This is the fatal flaw of pre-election testing as a safeguard against hacking. Hackers can program their code to trigger only when the calendar says it's Election Day...or only when ballots are inserted at a rate typical of Election Day...or only when the machine has been operating continuously for more than eight hours...or only on some other telltale sign that real votes, not test votes, are being counted. As the Brennan Center Task Force report put it, trying to use tests like these to detect hacking would TestVVPATballot.jpgcreate a constantly escalating arms race between election officials trying to make the test look like a normal Election Day and hackers finding new ways to detect a test situation.

As a result, the Task Force didn't bother even to mention pre-election testing as a safeguard in its list of six security recommendations.

Many of Wisconsin's pre-election tests do not hide the fact that the machines are running in test mode, not Election-Day mode. The photo at right is a close-up of the voter-verifiable paper trail from an AVC Edge voting machine, programmed by Command Central, being tested in Juneau County before the August 14, 2018 primary. Notice that the voting machine printed "PRE-LAT PAPER RECORD" at the top of the ballot. 'LAT' is the computer professionals' term for "logic and accuracy testing," a basic routine whenever software has been updated. (I don't know why Command Central calls it "PRE-LAT".)

This machine clearly knows it is counting test ballots, not real ones. Operating in test mode doesn't render the test useless for things like catching innocent programming errors.  But:

It is humbug for election clerks
to fool themselves, or to fool the public,
into thinking these pre-election tests
provide any protection against hacking.
 

If we want to stop being fed humbug, we have to stop falling for it. If your local election officials tell you:

  • "Election results are protected by pre-election voting machine tests", tell them that you know Wisconsin's pre-election voting machine tests could not detect hacking any less obvious than that which in 2010 elected a cartoon robot to the Washington, DC school board.
  • "Election results are protected by keeping the machines unconnected from the Internet," tell them that you know that they have no idea about what happens to the software before it comes into their control.
  • "Election results are protected by federal and state certification," tell them you know that the software has been copied and updated many times since it was certified, and that no one has ever or will ever inspect the software that will count your votes on Election Day.
  • "Election results are protected by the audits we already do," tell them that audits completed only after the canvass cannot possibly protect results they have already declared final ('certified').

The solution: Contact your county election office. In Milwaukee County, that's the Elections Commission; in other counties, it's the county clerk. Tell them:
"This voter is done with humbug. I know that one and only one safeguard can protect our final election results.
Use our paper ballots to detect and correct any electronic miscounts before you declare election results final. Start this November."

Don't expect your county official to be stubborn; several are already planning to check accuracy before they certify the November results as final. Find out if yours is one.

But if your county officials are not now planning to begin auditing, don't accept excuses. They got a memo on August 1, 2018 from the Wisconsin Elections Commission that made it clear: "A post-election audit is a tool that could be implemented to confirm that results have been tabulated accurately," and "post-election audits of the results may be conducted prior to certification of the canvass." The Commission even gave them basic instructions they can follow.

No more humbug
about election security.
Tell your county officials
today: "Time's up.
Pre-certification audits.
This fall."


You can also help by donating to help Wisconsin Election Integrity get the no-humbug word out to voters, officials, and media through our 2018 publicity campaign.

And you can email the Wisconsin Elections Commission at elections@wi.gov to encourage them to mandate pre-certification audits in every county, at their September 25 meeting.

Add your reaction Share

Wisconsin could have real election audits in November!

Just a few tweaks to WECs' audit policy could make Wisconsin’s November 2018 elections the most secure since we started counting our votes with computers.

There's still time before the November 2018 elections for the Wisconsin Elections Commission (WEC) to put a patch on the state’s biggest, most dangerous election-security hole. Up to now, local election clerks haven't been checking the voting machines' Election-Day accuracy before the certify election results. They could be doing that easily, quickly, and cheaply.

To audit voting machines' November 6 output, neither WEC nor the local clerks need to spend an extra penny over what they already have budgeted for that election. The WEC has to change only one policy at their September 25 meeting.

But voters have to speak up--now. We must tell the WEC to revise their policy regarding the voting-machine audits for 2018, and order those audits to be completed in every county before election results are declared final. The WEC can be reached at (608) 266-8005 or by e-mail at elections@wi.gov.

THE PROBLEM

 We have paper ballots. And local officials have up to two weeks after each election to review (‘canvass’) them to make sure the results are correct before they declare the official winners (‘certify’).

SealedBallotBags.jpgBut Wisconsin election clerks seal them in bags on Election Night. During their review, they look at the poll tapes, but leave the ballots sealed. Then they certify. They swear the winners into office. Twenty-two months later, they destroy the ballots.

Perpetually sealed paper ballots do not deter hackers; they protect them.

About half the states require officials to do at least a little auditing of computer-calculated Election-Day results before they certify. But in Wisconsin, state law merely allows, but does not require, accuracy checks.

When I ask county clerks why they don't check Election-Day accuracy, I get answers like, "If we had to count votes manually, that would defeat the purpose of using the machines," and "If these machines were capable of miscounting, the State wouldn't let us use them." And "We did a recount before and didn't find that election had been hacked." Basically, the people who manage our voting machines don't believe they can be hacked. Or that they can malfunction. Or that humans sometimes make programming errors.

We can't have kind of naiveté among our voting-machine managers. 

THE SOLUTION

HandsCountingStackofBallots.jpg Since 2006, Wisconsin statutes have required the state elections agency to order voting-machine audits following November elections. That law, section 7.08(6) of the statutes, also orders local governments to do any audits the WEC tells them to do.

As is typical for laws like this, the statute leaves the details to the bureaucrats. How many voting machines to audit? When to audit? How to select the sample? Those decisions are left to the state elections agency.

But state elections officials have, before this year, denied the risk of an Election-Day hack. They were so confident, they didn't think anyone needed to look for it. So they have never ordered the type of audits that would protect final election results from hackers. 

But times have changed, and awareness of the complex risks--not limited to Russian hackers--has grown. WEC will be tweaking their voting-machine audit instructions soon, as they always do shortly before November general elections, and we voters have got to make sure they do it right this time.

We must demand two things.

First, the 2018 audit instructions need to tell local officials “Finish the audits during the county canvass so that you can correct any hacks or errors you might find.”

From 2006 through 2012, the State told local officials to wait to check accuracy until after they had certified the results. In 2014, state elections board members ordered their staff to stop prohibiting on-time audits. But they have never ordered timely audits—they merely stopped prohibiting them.

Second, we must demand that the WEC order audits of at least one voting machine in each county. More would be better, of course, but they’ve budgeted for only 100 voting-machine audits, and Wisconsin has 72 counties. So they can do this.

The sample selection method used in previous years is too odd to explain here. It has to do with making sure the sample contains five of each make and model of voting machine. The critical fact is that it has always left some counties out.

Wisconsin’s voting machines are, in all but a few counties, programmed at the county level. For the federal, state, and county races, the same vote-counting code is copied onto all the voting machines in a county. So there’s a good chance you could deter hackers by randomly selecting one machine in each county.

The best audit would, of course, include enough ballots to produce a statistically valid answer to “Are these the right winners?” But we're down to the wire in 2018, and valid, respectable audits will probably need to wait until 2020. Until then, we need quick, better-than-nothing audits.

About cost: Funding for around 100 voting machine audits has already been budgeted--or should have been. Unless they increase the sample size, the WEC can order protective audits for the same price they are planning to pay for useless ones.

Just those two tweaks to WECs' audit policy, and Wisconsin’s November 2018 elections will be the most secure in our state’s history since we started counting our votes with computers. They will be the first in which would-be hackers were put on notice: Any voting machine anywhere in the state might be randomly selected for an audit while there is still time to detect your mess and clean it up.

So:  We must tell the WEC to order voting-machine audits in every county, and that they be completed before November 2018 election results are declared final.

This topic will be on their September 2018 meeting agenda, and they have asked for voters' input.

The WEC can be reached at (608) 266-8005 or by e-mail at elections@wi.gov.

Add your reaction Share