June 14, 2017 -- Over the past five years, I’ve read every commercial media story I could find regarding election technology. Sadly, that has not been a big job. Few reporters ever mentioned the risks, and those who did tended to interview only election officials. The typical news item would hint ‘some are concerned’ and then quote some official saying “We see no evidence of problems.” The question of whether the officials had been monitoring for problems--or whether they even knew how to--was left unasked and unanswered.
But recently, I am noticing progress in commercial news media’s coverage of the risks of elections technology. America’s reporters are catching up with millions of citizens and all IT professionals. They are realizing that computerized elections have risks, and that IT experts understand those risks better than election officials do.
That's not the only recent improvement. Some reporters have noticed the solution, too. This morning I saw a news story in national mainstream media that went beyond hand-wringing over the risks and mentioned routine election verification.
Under the headline If Voting Machines Were Hacked, Would Anyone Know?, NPR’s Pamela Fessler gave listeners the answer: No. Then instead of musing about hypothetical alternate technologies, she finished the piece with a plug for routine election audits. A few weeks ago, the Atlantic also had a good article focusing on election audits, with the subtitle "A low-tech solution to America’s voting problems."
Don't get me wrong. We are still not seeing the sort of explanatory or investigative journalism that our elections deserve. But things are looking up. Commercial journalists have finally found the phone numbers of election-technology experts. In recent weeks, Reuters turned to the University of Michigan’s Alex Halderman and ABC News quoted the University of Iowa’s Douglas W. Jones.
Even a city reporter, Kristian Torres of the Atlanta Journal-Constitution, now knows to pick up the phone to interview Princeton’s cybersecurity expert, Edward W. Felten, when she has questions about elections technology. A local lawsuit there challenged Georgia's failure to preserve an auditable paper trail.
But when the same opportunity (that is, renowned experts explaining the local angle on a topic of national interest) presented itself to Wisconsin journalists, they missed the opportunity. Last November, when three crème de la crème national experts testified in Dane County Court, Wisconsin reporters focused on mundane, predictable angles, such as the cost of the recount.
The currently trending issue--Russian hacking--might blow over, but I don't think the improvement in reporters' understanding of the larger issues will fade. National-beat journalists are truly waking up to this issue. So it's only a matter of time before state and local journalists, too, bring some gravitas to their reporting on the topic.
I'm optimistic that we will see fewer formulaic stories approvingly quoting a clerk saying "It's all good because we have no evidence of miscounts." I'm looking forward to seeing more actual IT experts quoted.
And I can't wait to hear Wisconsin officials' answers after the next election when for the first time they face a reporter who asks, "Got it--no evidence of hacking. Now can you show us the evidence of accuracy?"
In brief: Our election officials tell us that every single valid vote and not one single invalid vote should be counted. But if you watch closely, you’ll notice that election officials tend to tolerate any size or type of miscount unless it seems to affect the outcome.
Well, which is it? Do we want 100% accuracy, or do we want only approximate election results that probably identify the right winner? Until we face the need for clear and consistent standards, we cannot hold our election officials to any.
(Updated with additional information from a June 2017 report from WEC staff--see end of blog post.)
May 30, 2017 -- During the 15 years I supervised investigations for Wisconsin’s legislative oversight agency, I learned the value of several specific thinking skills. One was to be clear about expectations.
Auditors call them ‘standards’. Investigations start when someone reports that something is not as it should be. A good investigator’s first step is to figure out: What is it that should be? What would things look like if everything was working right?
If, for example, the complaint is “This permitting process takes too long”, we need to know how long people expect it to take.
This habit of noticing standards—or their absence--spilled over into the rest of my life. It's useful. You probably know that you’re less likely to be swayed by a salesperson if you’ve already decided how much you want to spend before you set foot in the store.
And standards keep us heading in the right direction. As the Cheshire Cat told Alice, which way you need to go from here depends a good deal on where you want to get to.
The way things are now, however, paying close attention to the standards we set for our elections can make a person dizzy.
Sometimes we apply a strict standard: Not a single wrong vote. Not one.
According to Chris Ott, Executive Director of the Wisconsin ACLU, "We know precisely the number of eligible voters that is too many to keep away from the polls: even one."
He was talking about Voter ID, and how it keeps some eligible voters from the polls.
Those who fuss about ineligible voters proclaim the same single-vote standard. In April 2015, I observed a Wisconsin county board of canvass as they decided what to do about a ballot cast by a voter who lacked ID. She had been given a provisional ballot. Those ballots are supposed to be sealed in an envelope and counted only after the voter returns with identification. However, the voter naively fed it into the voting machine right away, and it was counted.
There were 234,680 other ballots in that election. But the officials decided that if the voter did not provide identification by the deadline, they were going to go after that one rogue ballot. They were going to unseal the ballot bags, find it, and discard it. They were not willing to tolerate even one wrong vote.
And on those rare occasions when officials find evidence of voter fraud, they take action. In 2014, a Wisconsin audit reviewed voting records in statewide elections from February 2010 through April 2014 and found that, across four years and 16 elections, a total of 33 felons might have cast illegitimate votes. The legislature directed the state elections agency to refer the cases to district attorneys for possible prosecution.
This single-vote standard is also applied to voting machines. Federal standards require no more than one miscounted vote in every 500,000 from perfectly marked ballots, when counted in laboratory tests.
In real life situations, modern paper-ballot systems have achieved 99.99% accuracy even when the ballots contain some poorly marked votes. But in 2012, one Texas county thought “hand-marked paper ballots …open the door to ambiguous voter intent.” The possibility of one miscounted vote in 10,000 was too much for them, so they threw away their paper ballots and bought touchscreen voting machines instead.
Other times we apply a lax standard: A few thousand wrong or miscounted votes isn't anything to worry about.
In the 2016 recount of Wisconsin’s presidential election, one county’s board of canvass discovered more than five dozen valid absentee ballots had been left uncounted on Election Day. And the errors didn’t stop there. That county's officials determined they and their voting machines had originally miscounted 1,475 votes—either not counted them when they should have, counted when they should not have, or counted them for the wrong candidate. Then, when reporting the recount results, they accidentally recorded 21 votes in the wrong candidate’s column. They did not correct that error when informed of it. (1)
Commenting after the recount, the county clerk said he was “extremely proud.” He made it clear he thought the recount had been unnecessary. Checking accuracy when the race is not close, he wrote, is “really quite an insult to suggest that we don’t know how to do our jobs.”
News media coverage of the recount reflected the same relaxed standard. In Marinette County, the recount revealed that one city’s voting machines had failed to detect votes on 291, or 24%, of the ballots. This miscount was obvious to both municipal and county officials on Election Night, but they considered it tolerable and certified results without correcting the error. Only the recount forced correction. No reporters considered the incident worthy of investigation or reporting, and it received no coverage.
The Wisconsin State Journal’s headline made its standard clear: “Recount found thousands of errors, but no major flaws.”
So which accuracy standard should we use—exact or approximate?
Readers familiar with my work may be surprised that I don’t think we should pursue 100% accuracy. Until we can find someone other than humans to run our elections, perfection is not within our grasp. Reaching for it throws us off balance. For example, when the Texas county threw away voter-marked paper ballots because of a tiny miscount rate, it threw away its ability to detect miscounts of any size because it no longer had an auditable record.
The whole voter ID mess is the worst illustration of what happens when we seek perfection. Even without ID requirements, our registration system prevents all but insignificant voter fraud. And yet states with voter ID are spending millions to go after the remaining, minuscule problem. They are inconveniencing every honest citizen who casts a vote, and preventing thousands from voting at all. All in the vain pursuit of perfection.
So I’m not on board with an “every single vote” standard of accuracy. But when our election officials and media yawn at thousands of miscounted votes, I’m not willing to say "Mistakes are okay," either.
A complete lack of standards leaves the door open for wild inconsistency. I told you about one county where officials were willing to track down and discard even one illegitimate vote out of more than 234,000. And I told you about a county where standards were so lax that when they discovered 1,475 miscounting errors, the county clerk said he was insulted that anyone would request verification. Both stories are from the same county, the same clerk, the same board of canvass—Dane County, Wisconsin.
That’s what happens without standards. Officials can pick and choose their own targets, grabbing one before Election Day and a different one after. They can apply one standard to voters' errors and a different one to their own. Without standards, voters, candidates, and reporters—and conscientious officials—have no solid ground to stand on when they try to assess the quality of the elections.
If we had a clear standard—say, 99% confidence that the election results identified the correct winner—we could make better judgments about where to spend our effort and election resources. We could set a threshold for voter fraud, and establish that it is not worth millions of dollars to prevent a few people from voting twice. We could tell our election officials that no, it's not okay to declare election results final until after you've corrected the voting-machine output that missed one in every four votes.
And by the way, should we count write-in votes?
It’s not just a question of picking a maximum acceptable error rate. Wisconsin hasn’t yet settled the question of how—or even whether—to count write-in votes.
For those who believe elections need to do no more than identify winners, write-in votes are not worth counting. Some election officials appear to be in this group. In last November’s presidential election, Wisconsin officials counted only 84.3 percent of the votes for registered write-in candidate Evan McMullin until the recount forced a do-over. That is, more than one in seven voters’ expressed preference for McMullin was simply ignored when officials first tabulated and certified the election results.
Bernie Sanders’ voters fared even worse. Wisconsin law currently does not require officials to count votes for unregistered write-in candidates. The state elections agency allows counties, at their option, to report the total number of such votes in a miscellaneous category called ‘scattering.’ But not all counties do. So 24 of Wisconsin’s 72 counties did not report the number of miscellaneous write-in votes in the original results, the recount, or both. In these counties, write-ins for unregistered write-in candidates were literally—and legally—treated as if the ballots were blank. No one has any idea how many voters were so frustrated with the nominees that they were willing to go to the polls to express their feelings.
For those who believe election results need to reflect the voice of the people, that’s not okay. Some voters may be content to have the voice of the people constrained to saying only one of two things: either “I like the Democratic candidate” or “I like the Republican candidate.” But others want an opportunity to say that they want someone else, and to have that voice heard.
If and when we want to improve the accuracy of our elections—or even talk about it productively—we’re going to have to face and resolve these questions.
(1) The author detected the error—21 votes added to Cherunda Fox’s total for the Village of Waunakee—while reviewing the recount findings. An email exchange with the Village Clerk in March 2017 confirmed that the votes should have been added to Evan McMullin’s total. A check of official results on the state's website on May 28, 2017 confirmed that the error had not been corrected—and likely will not be, because the recount results have been certified final and are no longer subject to correction.
UPDATE, June 20, 2017
At today's meeting of the Wisconsin Election Commission, staff presented a report on the 47 voting-machine audits--something different than recounts--that were performed in accordance with s.7.08(6), Wis. Stats. following the November election. My detailed description of how these audits work is here.
Instructions for the audit (page 6 of the memo) seem to indicate the audit standard is "not one vote must be miscounted." However, the memo is not specific about the number of votes in any of the audits, which gives us a sign that the officials performing the audits and reporting the results were applying a less precise standard.
One of the villages randomly selected for audit, the Village of Hortonville in Outagamie County, could not reconcile the results of its audit hand-count with the Election-Night results they reported and certified. (Outagamie County uses the Optech Eagle, and did its recount by machine, so the electronic miscounts must have merely been replicated in the recount, not caught.)
However, the report does make it clear that after separate attempts by the municipality, county, and state to reconcile the different vote totals, "This exercise did not produce a result that allowed staff to understand how the Optech Eagle treated these ballots with confidence."
Now, back to the point of this blog post: What is the implicit standard that our election officials applied in this case? 'Not one vote', or 'miscounts are okay'? A key statement is on page 11 of the memo:
"The analysis of the performance of the Optech Eagle identified a significant limitation of the equipment, but the Optech Eagle performed as expected during the 2016 Presidential Election."
Read that again to make sure that phrase sinks in: "A significant limitation...as expected." That's the standard for accuracy that is applied by our election officials to Wisconsin's voting-machines.
May 07, 2017 -- The New York Times has published a good article about the Volkswagen fraud. In brief, Volkswagen put fraudulent emissions-control software in its autos. The cars passed government tests for years, all the while spewing pollution in real-world use.
That happened. There’s nothing hypothetical about it.
It shows us what corporations can do with the computers they sell to us.
Now consider these facts:
- Only three companies' computers count 80% of America's votes. One of them, (ES&S) counts about 50%.
- More people have more motive to manipulate elections than anyone has to manipulate auto emissions.
- IT-naïve local election officials are less capable of detecting fraud in pre-election tests than air-quality regulators are capable of detecting fraud in emissions-control tests.
And the government tests didn't even catch it. The hack was discovered by graduate students who bought a car and tested it on the road.
But in elections, no one can perform a real-world voting-machine test. Voting machine companies and election officials maintain too much secrecy.
We have to be honest with ourselves. Local election officials—bless their hearts—will never be able to manage or test their computers well enough to deter or detect any fraudulent software. At least not before the polls close.
We must demand that our election officials do what every other computer-dependent manager does: Check their computers’ output for accuracy while there is still time to correct any errors. Nothing else can protect our right to self-government from computer fraud and error.
We need genuine, reliable outcome-confirming audits of our election results, and we need them NOW.
And no, we do not want to wait, like auto regulators did, until some grad students discover that our software has been hacked for years.
April 06, 2017 -- Two days after the April 4 election, 37 voters released the following open letter to Dane County officials, urging them to seek assistance from national experts and implement professional-quality election verification to build confidence in Dane County elections.
If you would like to be contacted to participate in any future actions such as this open letter, please email your contact information to WiscElectionIntegrity@gmail.com. You do not need to live in Dane County; we are working on growing our efforts in other Wisconsin counties, too.
April 6, 2017
An Open Letter to Dane County Executive, Supervisors, and County Clerk
regarding the continuing need for verified accurate election results
We recently read that Dane County will be posting ballot images online after the county canvass has declared election results final. To our knowledge, no other county in the nation is routinely doing this. The stated purpose is desirable: to “provide a level of confidence and faith in our electoral process that has been undermined by unfounded accusations of fraud or meddling.”
We agree that confidence in our elections is vital, and that posting ballot images to the Internet won’t hurt.
But please be aware: It will not guarantee accurate election results. Only official, valid verification during the county canvass can do that.
Let’s take a sober look at why ‘allegations of fraud or meddling’ are so persistent. Set computer-generated election results aside for a moment and think instead about computer-generated property tax bills. Imagine that property owners had no way to check for themselves that those bills were correct. Now imagine that:
- The city never checked the accuracy of the electronically calculated property tax bills until after payments were made;
- In that belated verification, the city never checked the accuracy of more than two neighborhood’s bills, and did not do that until after the city no longer had any authority to make refunds;
- Whenever people questioned a property tax bill, the city followed a policy like elections’ recount policy. That is, only one or two taxpayers had standing to demand verification, and if they suspected an error any larger than one-quarter of one percent, they had to pay the full cost of the audit, in cash, before the audit could start; and
- Finally, when national authorities began to encourage vigilance and the taxpayers’ demands for verification could no longer be ignored, the city posted assessment records on the Internet so that citizens could do the auditing themselves.
It's easy to see that this city’s residents would rapidly be expressing suspicions of fraud, suspicions that would not go away until the city began to verify the accuracy of the computers’ output. It is basic human nature: managerial refusal to audit creates suspicion. Managers who verify accuracy build confidence.
Without routine, official audits during the county canvass, we will have persistent suspicions and unrefuted allegations. With them, we will have voter confidence.
Posting the ballot images on the Internet does not protect our elections, for several reasons. Most importantly, volunteer citizen auditors cannot credibly perform a governmental responsibility such as verifying election results. Even if they could, Dane County has no written procedures for compiling, handling, and storing the digital ballot images, so they are not suitable for auditing. Finally, the County is not providing citizens with workable software to view the ballot images. The clerk’s office failed in a February 2015 attempt to unzip and save even two precincts’ ballots with enough accuracy to support a valid audit. Those of you who have attended demonstrations conducted by the Wisconsin Election Integrity Action Team know that workable open-source software, designed specifically for election auditing with digital images, is available and has been offered at no cost to the county clerk many times.
Concern about undetected electronic fraud is no longer the province of crackpots and ‘sore losers.’ Risks are now so credible that the federal government is suggesting elections technology be protected as critical infrastructure. Claims that any county’s system is immune from tampering are not credible. The additional risk of inadvertent miscounts is not hypothetical after the 2014 Stoughton referendum miscount.
Local jurisdictions in other states are implementing modern, efficient election-verification methods. Reputable national experts offer free consultation and assistance through the Election Verification Network. Because other states have moved ahead of Wisconsin in this area, we could learn from their experience. Counties in California and Colorado in particular are making great progress in building voter confidence by adopting a technique known as risk-limiting auditing, endorsed in 2014 by the Presidential Commission on Elections Administration.
On April 4, Dane County voters cast their ballots in one more election that will be declared final on the basis of unverified computer output. Nothing more than a two-machine spot check is planned after that. Don’t let Dane County fall farther behind. We urge you to intervene with the Dane County Clerk and Board of Canvassers to urge them to begin to build voter confidence with routine, valid, professional-quality verification of election results during the county canvass process.
The following supporters of the Wisconsin Election Integrity Action Team:
Barbara Wright, Madison;
Sue & Steve Trace, Deforest;
Dace Zeps, Madison;
Nate Timm, Mazomanie;
Al Sulzer, Cross Plains;
Gary Storck, Madison;
John Stanley, Deforest;
David Schwab, Madison;
Gary Tipler, Madison;
Martina Rippon, Madison;
Alice & David Schneiderman, Madison;
Margaret Rigney, Deforest;
Susan Phillips, Sun Prairie;
Grant Petty, Madison;
Michael Olneck, Madison;
Keith Nelson, Westport;
Jim Mueller; Algoma, fmr Middleton
Jennifer Miller, Madison;
Dave Knutzen, Waunakee;
Karen McKim, Westport
Peter Johnson, Madison;
Jon Hain, Madison;
Adam Grabski, Mazomanie;
Janice Gibeau, Stoughton;
Nila Frye, Waunakee;
Harriet & Ronald Dinerstein; Madison;
Karen Edson, Deforest;
Bob & Julie Crego, Middleton;
Damian Christianson, Fitchburg;
Joanne E. Brown, Madison;
Andrew Bersch, Madison;
Laurene Bach, Waunakee;
Rebecca Alwin, Middleton
March 2017: Final report on Wisconsin's historic recount issued by the Stein recount team!
- Although Wisconsin is among the shrinking number of states that do not routinely audit election results, Wisconsin did a better job of recounting than either of the other two states in which recounts were sought.
- Unfortunately, only about half of Wisconsin's ballots were actually recounted. The other half were fed back through voting machines programmed by the same people who programmed them for the election.
- County canvasses reported election results after the recount that differed by at least 17,681 votes from the results that they certified as 'correct and true' before the recount.
- The major causes of miscounts included inaccurate counting of write-in votes; unreliable processing of early ballots; and voting machines that were unable to read voter intent.
- Canvass procedures used by Wisconsin election officials allowed them to certify even obvious miscounts before the recount. Until Wisconsin voters insist that officials verify accuracy during the canvass, it is virtually certain that the final results of every Wisconsin election will contain errors that could have been detected and corrected with responsible, modern canvass procedures.
* * *
In December 2016, Wisconsin election officials got a rare opportunity to review the quality of their work when fed-up citizens donated more than the State's quoted price of $3.7 million to finally get our election results checked for accuracy.
Unfortunately, the recount discovered what we expected.
First, officials in most of Wisconsin's largest counties didn't recount at all, but ran the ballots back through computers programmed by the same people who programmed them for the election. So if Milwaukee County's voting machines were hacked, we still wouldn't know it.
Second, even with hand counts of only about half the State's ballots, vote-counting errors were discovered in 2,340 polling places, more than 64% of the total. The state's county clerks changed their vote totals by more than 17,681 votes from the election results they had previously sworn to be 'correct and true.'
- Vote-counting computers in Marinette County were discovered to have missed one quarter of all votes on paper early ballots. The clerk told Wisconsin Election Integrity that the county canvass hadn't noticed the error, didn't look for errors, and wouldn't correct any if they saw them. She believes it's the poll workers' job to count votes correctly, and her job to add up the totals they submit. (She's wrong about that--poll workers have no authority to correct a machine count with hand count on their own initiative, but the county clerk does.)
- In Milwaukee County, one precinct simply dropped 247 votes for one candidate. Neither the county officials nor the state Wisconsin Election Commission noticed the apparent 40.25% undervote rate until the recounters found the error.
- In Dane County, polling places in three municipalities, including Madison, failed to count more than five dozen absentee ballots, which were still in their envelopes when the recount started. Neither the municipal nor county canvass had noticed those errors.
- Vote-counting computers in St. Croix County were discovered to have been operating with broken security seals for two years through the past four elections.
- In at least two counties, recount observers noticed that vote-counting computers were equipped with wireless communications capability, despite the assurances of national and local officials that our voting machines are never connected to the Internet.
Check out our Facebook page for discussion.
May 20, 2016 at 2:21am
Summary: Once again, something we hoped would be an improvement is much less than it appears. Dane County Clerk Scott McDonell has been saying that he now conducts voting machine audits after every election. But what might look like an audit to a casual observer is at best only a spot check. The county's efforts follow neither GAB instructions for voting-machine audits nor national recommendations for election audits.
The inefficiency of the county effort is astounding. The Wisconsin Election Integrity Action team, with only two hours of active vote-counting, completed our audit confirming the countywide April 5 outcomes in both the Supreme Court race and the Democratic primary (because we followed national authorities' recommendations.) In contrast, McDonell's idiosyncratic process kept his auditors counting for 7.5 hours in an effort that, at best, could confirm output from only two machines.
Worse, McDonell's insistence on declaring election results accurate first and checking later means that the process cannot protect Dane County's final election results from undetected miscounts. If such a delayed spot-check was to detect an electronic miscount, it would cause only chaos, unnecessary controversy, and possible legal action.
The following explains five of the flaws in McDonell's process.
1 - The big problem--TIMELINESS
Certification of election results needs to mean something. We cannot issue certificates of election to candidates only to ask for their return two weeks later if we find an error. Statutes provide the county board of canvass with two weeks or so following every election for a very good reason: to make sure the results are accurate because they won't be able to change them later. Final is final.
On April 13, 2016, Dane County Clerk Scott McDonell and the county board of canvassers certified the April 5 election results as final by signing their names to a statement declaring that they had reviewed the results and found them to be 'true and correct.' On April 20, McDonell asked several experienced poll workers to check to see whether or not they were.
What exactly is the point of auditing if results have already been certified? You cannot fix any errors you might find. And you won't convince any suspicious citizens of the election's integrity: No one is reassured when a public official checks information he has already sworn is accurate.
Accuracy needs to be established during the canvass process, as part of that process.
"Post-election audits must be completed prior to finalizing official election results." Principles and Best Practices for Post-Election Audits
2 - Too few machines; miscounts might not be detected -VALIDITY
Spot-checking the accuracy of only two machines is good enough if the audit's purpose is to create an appearance of careful management for casual observers. It also works if the purpose is limited to detecting malfunctions that uniformly affect every one of the 150+ machines in Dane County.
But if the purpose is to make sure that the voting machines identified the correct winners,* two machines isn't enough. Election outcomes can be altered even when some machines count correctly. Overheating, dust and dirt, loss of calibration, and other malfunctions can affect some voting machines and not others. A corrupt insider with access to the voting machines' memory sticks can tamper with some and leave others alone--in fact, some forensic experts say that not-everywhere-at-once fraud is the most likely kind.
That's why national election-administration authorities, including the Presidential Commission on Election Administration, recommend risk-limiting auditing, a method developed by members of the American Statistical Society specifically for the purpose of confirming election outcomes--that is, who won. I won't bore you with the details, but if you come to any of the Wisconsin Election Integrity Action Team's Citizen's Audits (the next one is scheduled for September 10, 2016), you can see it demonstrated.
Briefly: A random sample of either whole precincts or individual ballots is selected that is large enough so that the manually counted sample results can be compared to the electronically tabulated results and, with the application of a statistical formula, reveal the probability that the two counts accurately represent the same thing--the verdict of the voters. The sample size will vary depending upon how many ballots were cast and the reported margin of victory. (Closer races need larger samples than landslides.) If the probability is 99% (or whatever level of certainty you're aiming for), the audit is complete. If the manual count of the sample does not produce 99% probability of accuracy, the sample size is expanded until the electronically tabulated outcome is confirmed as either correct or incorrect.
The point is to make sure that the audit confirms the election results, not just the output of a few machines.
"The Commission endorses both risk-limiting audits that ensure the correct winner has been determined according to a sample of votes cast, and performance audits that evaluate whether the voting technology performs as promised and expected." Report of the Presidential Commission on Election Administration
3 - No one can tell whether the auditors are accurate or inaccurate, honest or cheating - TRANSPARENCY
To provide confirmation that elections have integrity, the audits must also be confirmed to have integrity. Outside elections, auditors often provide that confirmation by being independent--having no stake in the outcome of the audit. But for election audits, no truly disinterested auditor exists because we all have a stake in the outcome. For that reason, election audits need full transparency. People other than the auditors need to be able to tell--for themselves--that the audit is being conducted honestly and correctly.
Transparency means having written procedures (so that observers can tell the auditors are not just making steps up as they go along); secure internal control of the audit documents (to prove to observers that no one had an opportunity to alter or replace the audit records without being detected); and a way for observers to see that the tasks are honestly and accurately performed during the audit.
The Dane County audits have none of those.
"Any election where all post-election activity is done in secret or in a manner that doesn't support oversight and accountability will engender zero confidence in the electorate." Transparency in Post-Election Audits
No written procedures. With regard to written procedures, we can cut the Dane County auditors some slack. McDonell didn't hire the chief inspector who is helping him develop the audit procedures until late December 2015, and they have conducted audits after only two elections--February and April 2016. They're still working out the kinks, so I wasn't surprised when observers at the April audit were given nothing in writing to help them know what the auditors were supposed to be doing. The auditors themselves weren't provided with any. The reports that followed both the February and April audits contained after-the-fact written descriptions of what had happened, but both reports also contained recommendations that the procedures change before the next audit.
Weak internal controls. Professional auditors know that "internal controls" are those measures that ensure the records used in an audit can be proven to be true and complete. Most election workers in Wisconsin--at least those with no management or audit experience--know internal control only as "chain of custody." Using what Joseph Hall of the Center for Democracy and Technology calls a "dotting the i's and crossing the t's" mentality," audit-naive election workers consider that they achieve adequate internal control simply by following a prescribed ritual involving security bags and seals. Election records are placed in security bags, closed with numbered seals in such a way that the records cannot be taken from the bag without breaking the seal. Comparison of the seal number to a paper record upon opening the bag is intended to ensure that the seal has not been opened and replaced with another. Some commercial seals used are difficult but not impossible to defeat, but in Wisconsin little care is typically taken to make sure no one ever has solitary access to the sealed records during the time they are stored. I don't know what security is provided to the paper record of the seal numbers.
McDonell's amateurish appreciation of internal control shows in how he allowed his auditors to handle the records. In the February audit, which relied on digital ballot images, the chief auditor documented that he took the sealed bag containing the audit records home with him overnight, documented that he opened the bag and worked alone with the ballot images all night, documented that he resealed the bag in the morning, and then at the next day's audit, the seal was ceremoniously broken in compliance with the ritual. This is Keystone Cops internal control: The auditor wasn't documenting that he had no opportunity to tamper with the records; he was documenting that he had and in fact did.
At the April audit, the naivete about internal control took another form. Observers were carefully informed that the paper ballots (no digital images in this audit) had been transported from Stoughton, where they were being stored, by two of the auditors. In states more knowledgeable about standard audit precautions, transportation is usually handled in a way that precludes any opportunity for the clerk's employees to alter or substitute the records, such as by having representatives of opposing political parties accompany the ballots. Any citizen who was skeptical about McDonell's motive for doing the audit would have just rolled his eyes when told the clerk had sent two hand-picked employees to retrieve the ballots, with no one to watch whether they switched out the ballot bags as they did.
Observers' inability to observe. The first big violation of transparency came the day after the election, when the county clerk and the chief auditor selected the precincts in the privacy of the clerk's office--randomly, they assure us. I don't need to explain what's silly about that.
Then, at the audit, the auditors insisted all observers stand at least three feet away at all times, and they employed no technology, such as document projectors, to make anything they were doing visible to anyone other than themselves. It's not as if county election officials don't know the importance of observation--Wisconsin recounts are conducted with members of the opposing parties viewing each ballot as it is counted. which ensures that no one has an opportunity to cheat or make mistakes. But the Dane County audits made no provision for anyone other than the auditors to see anything of consequence. To his credit, the lead auditor for a while turned his back to me as he held each ballot just above his head to read it. In this way he was allowing me, from three feet away, to discern where the votes were, even if I couldn't read any of the names. No way could either he or I have kept that up for the entire 7.5-hour duration of the hand count.
But it wasn't just observers who couldn't observe enough to tell whether votes were being counted accurately--it was most of the auditors themselves! One vote-reading auditor would read the votes aloud as two other auditors made hash marks on a tally sheet, without ever seeing an actual vote themselves. The obvious flaw in this method is that it requires everyone to trust that the reading auditor is reading the votes honestly. Another danger (the one most often cited as the need for having more than one set of eyes on each ballot) is that the reading auditor can misspeak so that both tallying auditors record the the same error. That brings us to the fourth weakness....
4 - Insufficient safeguards to make sure it's done right - RELIABILITY
When only one auditor sees each ballot, the audit becomes less of a test of the voting machines' accuracy than a test of the one auditor's ability to read votes aloud for hours and the tally-makers' ability to keep hash marks accurately. And because the 'votes' that the tally-makers were recording were nothing more than spoken words, there is no way at the end of the audit to determine the source of any errors if the hand-count totals mismatch the machine-count totals. In fact, the auditors' report from the April audit confirms what any experienced hand-counter would have predicted: Most candidates' hand counted totals mismatched the machine counts (by only a little) and the auditors could only guess at the reasons.
THIS IS BASIC: A redundant count--having at least two people, if not more, read every ballot--is a standard feature of any reliable hand count procedure, including the one recommended by GAB for voting-machine audits.
5- It takes much more time than it needs to - INEFFICIENCY
Auditors at the Citizens' Audit, 10 days after the county audit, clocked themselves accurately counting votes at a rate of 100 ballots every 4 minutes. The auditors at the county audit didn't time themselves, but you can calculate it from their report. In 7.5 hours of active counting, the faster of the two teams counted 1,186 ballots--a rate of 100 ballots every 38 minutes.
The difference is the citizens' ability to use digital images instead of paper ballots, something the county auditors cannot do because McDonell insists on using impractical ballot-viewing software.
Now couple that with McDonell's refusal to consider using the risk-limiting audit method recommended by the Presidential Commission. Following those recommendations, the citizens' audit determined they needed to count 216 ballots, randomly selected from across the entire county, to confirm the outcome in the Supreme Court race and 524 ballots to confirm the Democratic primary result. In contrast, the county auditors set out to count 2,504 ballots. But because those ballots came from only two precincts, the county's relatively extravagant effort could not have confirmed the countywide outcome in either race.
The combined effect of the two audits' differences (digital images versus paper ballots, and statistical sampling versus whatever you want to call the county's sample) is astounding. The citizens completed their audit of the Supreme Court race in approximately 30 minutes and the Democratic primary result in approximately 90 minutes. performing both random selection and vote-counting during that time. Having done the random selection weeks earlier, the county auditors spent 7.5 hours in active counting, and still did not confirm anything beyond the accuracy of two individual machines. To match the citizens' audit result--confirmation of the countywide outcomes--using the county's method would have required county auditors to count at least 6 more randomly selected precincts, likely taking them three more days.
How much of a problem is this inefficiency? If the county has enough money to pay a team of six auditors for 4 days' work rather than two hours', is that a fatal problem? Looking back at timeliness, validity, transparency, and reliability, I'm going to say it is.
- Timeliness: It's important to complete the audit during the two-week county canvass period, which places a premium on speed.
- Validity: You need to audit a sample big enough to confirm the election outcome, so excessive time-per-precinct makes validity more difficult in a limited amount of time;
- Transparency: You want volunteer observers to show up to confirm the audit's integrity, which means you cannot place too big a burden on them; and
- Reliability: After two hours, human errors begin to creep in, and become more frequent as auditors tire.
* The only purpose for the county audits I've heard McDonell articulate is to see whether the voting machines can count votes marked in different color inks. That's naivete from any angle:
- Unaware of the capabilities of his equipment? The DS200 machine was designed and manufactured to count any color ink, a capability that has been confirmed in testing for years, and does not change over time or among machines.
- Unaware that Dane County's municipal clerks do a reliable job of publicly demonstrating the machines' capabilities in pre-election tests before every election? It doesn't need his "double-checking." Almost all the municipal clerks take care to mark their test ballots with a variety of different inks.
- Unaware of what his own auditors are doing? If he did, in fact, instruct them to make note of the ink color in which votes were marked, they didn't follow his instructions. Their methods wouldn't have allowed them to detect the causes of any miscounts (ink color or anything else), and their final report contains no mention of the question.
April 14, 2016 at 1:29pm -- I observed Dane County's post-election canvass of the April 5 election results from start to finish this year--all 19 hours over 4 days.
No surprises: As usual, both the municipal and county canvasses checked and double-checked to make sure the right number of BALLOTS had been counted. However, the Board of Canvass (County Clerk Scott McDonell, Democratic Party representative Gretchen Lowe, and Republican Party representative Joyce Waldrop) certified Dane County's election results at around 3:30 PM on Wednesday, before any one had done anything to verify that the correct number of VOTES had been counted.
The votes of 234,681 Dane County voters (99.6% of the total) were certified based only on unaudited computer output. Vote totals are now no longer subject to change or correction.
The other 859 ballots were late-arriving absentee ballots and approved provisional ballots, which had been publicly hand-counted by the municipalities. The last two days of the county canvass were devoted to making sure the votes from those 849 ballots were added to the correct candidates' totals.
Got that? Half the canvass effort to ensure the accurate counting of only 0.4% of the votes.
Over four days, County Clerk McDonell maintained the minimum transparency required by law. Any observers who were already familiar with the statutes and GAB guidance for county canvasses (that would be me) could follow along reasonably well, but anyone else would have been out of luck in terms of understanding what the canvassers were doing or why. McDonell provided no written procedures or standards--not even to the members of the board. Neither did he explain what they were doing as they went along; allow questions from observers; or provide observers with copies of anything the canvassers were looking at, or make it visible to them in any way such as by projecting it on a screen.
"Just guess" was the unspoken message to the public. Finally, he restricted any public comment to five minutes at the end of the four-day-long meeting.
It got this bizarre: At the end of the four days, I asked if I could ask a question and was told I could make a five-minute statement and that was it. (McDonell claimed that to answer a question for the public would be a violation of open meetings law.)
So the official public comment at the county canvass started with this awkwardness coming out of my mouth: "I noticed an agenda-less canvass meeting on the county calendar for 10 AM on April 20. I assume that is the digital-image audit you've been promising. I hope you will let me know if I am right or wrong in that assumption."
I'm not making this up: McDonell didn't even nod yes or no. And when Waldrop wanted to respond to my comment, he wouldn't allow that, either.
This created something of a Mad-Hatter-Tea-Party feeling to the event, since it was basically just four of us sitting around a table in a conference room in the City-County building, sharing Girl Scout cookies from McDonell's daughters. The canvassers and I would chat whenever McDonell left the room, but when he was present they had to pretend I wasn't there, as McDonell himself did.
I left them with a letter, which I've uploaded here. It's kind of wonky--I wanted to address them as professionals who know and care what words like 'risk,' 'prioritize' and 'verification' mean. I could see that at least Lowe was reading it carefully, and she asked me a few sensible questions after the meeting adjourned. The main points of the letter are:
- they spend most of their time addressing risks that are much more remote than the risk of electronic miscounts, or that address no risk at all--such as reviewing vote totals in uncontested races for which it would be impossible for them to certify the wrong winner; and
- they also spend time on tasks that don't need to be completed before they certify the election results, such as discussing individual municipalities' Election-Day practices for keeping track of the number of voters.
And yet they tell us they have no time to check the accuracy of the computer-generated vote totals--which cover 99.6% of the votes.
My request to them wasn't anything dramatic: I simply urged them to consider risk and timeliness when they decide what to do during the canvass, and told them if they thought about it that way, it would be obvious that verification of the computer output is more important than most of what they are doing now.
As I sat listening to them recite numbers for four days, I visualized the following graphic, which shows:
The steps by which our votes are turning into final election results;
The parts of this process that are verified by the current county canvass procedures; and
The parts of the process that are verified by the type of audit we've been demonstrating in our citizens' audits.
March 14, 2016 at 12:20pm -- Just a quick post to share the results from Saturday's Citizens Audit of Dane County's voting-machine output in the February 16 primary for Wisconsin Supreme Court.
I'll expand this blog post later with more detail (post any questions in the comments section if there's something specific you want to know about), but right now I'm in a hurry to get the summary report out and get to work on the more detailed report.
One of the things we are trying to do is to demonstrate what a good, transparent, public post-election audit would look like--and that includes prompt and thorough public reporting of the findings. (Something the Dane County Clerk does not do. He says he routinely performs post-election audits, but if you've even seen him publicly report any findings from those audits, I'm afraid you were hallucinating. Hasn't happened.)
Anyway, here's our report of what we did and what we saw in Saturday's audit, and now I'm back to work writing the more thorough report.
January 14, 2016 at 1:46am -- It's time to start gearing up for the citizens' audits that will verify the electronically tabulated results of the 2016 elections, in Dane County and any other Wisconsin counties where people want to join the effort to improve management of Wisconsin's elections technology.
Almost all large Wisconsin counties now use voting machines that automatically, immediately preserve a digital image of every ballot.
In any of these counties the county clerk or involved citizens could choose to use the images in astoundingly efficient, transparent manual counts to verify the accuracy of the voting-machine output.
The Wisconsin Election Action Team demonstrated the method after the February and April elections in Dane County last year, and will be conducting similar public demonstrations after the 2016 elections.
We have released a report that describes the procedures, benefits and risks of Using Automatically Created Digital Ballot Images to Verify Voting-Machine Output in Wisconsin. (Catchy title, that!) In this report, you will find:
- A technical description of the digital ballot images created by the ES&S DS200 and a picture of one of the images;
- A layperson's description of 'risk-limiting auditing,' the technique that allows audits to count just a sample of the ballots while still achieving statistical certainty that the correct winners were identified (or not);
- A step-by-step description of an efficient, transparent process for conducting a citizens' audit; and
- A frank discussion of the limitations and risks of using digital ballot images for this purpose.
Please pass this along to your friends who live in Dane County and encourage them to mark their calendars for Saturday, March 12, to attend a public, transparent post-election audit that will verify Dane County's results in the February 16 Supreme Count primary and perhaps a few other races. The location wil be announced later--follow Wisconsin Election Integrity on Facebook.
Residents of other Wisconsin counties, please read this report and consider whether you could help to organize a similar citizens' audit in your own county, particularly if you live in one of Wisconsin's larger counties that use optical-scan voting systems. If you can, please contact us at WiscElectionIntegrity@gmail.com, and we can provide you with the necessary software, instructions, and pointers.
December 31, 2015 at 3:13pm -- Dozens if not hundreds of Volkswagen employees must have known of the recently detected emissions software fraud that continued for six years and affected 11 million cars around the world.
And yet the fraud was not revealed by a whistle-blower; it was discovered by outsiders. How could Volkswagen management have coerced so many otherwise reasonable, ethical people into silent cooperation over so long a time? Or did they deliberately hire only crooks?
I’m writing about the Volkswagen fraud in this blog because it raises two big questions relevant to elections: First, is it plausible that voting machine companies could perpetrate a similar sort of fraud? Second, is it plausible that their customers, local election officials, wouldn’t notice?
Now, I don’t run around claiming fraud I cannot prove. I have a natural-born skeptic’s aversion to making accusations without conclusive evidence. Years working at Wisconsin’s Legislative Audit Bureau—an investigative and oversight agency--only sharpened that instinct. At the same time, my hard-wired respect for hard facts also makes me dubious about election officials’ claims that they can ensure 100% correct results every time without routine verification. No other computer-dependent manager makes such an extraordinary demand on my trust. I am acutely aware that when it comes to electronic elections fraud, the only elections we are sure were not miscounted (arguably) are the very few that were recounted. Considering what is at stake, that is a very serious problem.
Back to the questions. First, with regard to the voting-machine companies, the Volkswagen affair clearly demonstrates the plausibility of systemic fraud by companies that manufacture, sell, or service computerized equipment, whether it’s cars or voting machines. Fraud is particularly feasible when they demand proprietary secrecy for their software, and when they sell their product to consumers who have no particular information technology expertise--like local government election officials.
For example, a voting-machine company could routinely install clandestine wireless communications capability on each of its voting machines, in case the company ever feels the need to fix a bug (or an election) without the knowledge of local election officials. The vendors know that local officials never inspect the equipment in any way that might discover the chip, because they don’t want to appear to be ‘tampering with the machines.’ (See footnote.) And IT experts tell us that is only one of several ways voting-machine company insiders could alter election results if they chose to.
With regard to the second question—the local election officials’ willingness to allow possible fraud to go undetected: That’s readily answered. We know they are willing. They grant vendors proprietary secrecy for their software, so no election official ever inspects the vote-tabulating software loaded into any machine. And yet, knowing they did not and cannot inspect the software, the vast majority of jurisdictions—including all Wisconsin counties—routinely neglect to verify the accuracy of electronically tabulated results. My previous post in this blog described the puzzling refusal of many officials even to learn about their practical options for detecting miscounts.
In a well-researched and well-written article in the most recent Atlantic Magazine, What Was Volkswagen Thinking?, business journalist Jerry Useem provides insight into both the corporations and their customers.
Using examples of actual corporate conduct both good and bad, the article explains how otherwise ethical employees of a company, such as a voting-machine company, could go for years without saying anything about their machines’ hack-ability, and why otherwise responsible election officials could choose to trust the machines’ Election-Day accuracy based on nothing more than a determined will to believe.
People within an organization, Useem explains, fall prey to “a cultural drift in which circumstances classified as not okay are slowly reclassified as okay.” In response to pressures and expectations in their workplace, otherwise competent people come to see careless conduct as admirable flexibility. They begin to tolerate excessive risk-taking as if it was creative experimentation. Withholding damaging information starts to feel like prudent discretion. Actual fraud is mentally redefined to be practical adaptation to circumstances.
The derailment usually starts at the top. Useen notes the obvious: in many cases, management is simply dishonest, as seems to have been the case with Volkswagen, and as many election-integrity activists fear when they point to voting machine companies owned by active partisans.
But management might be honest and just as genuinely self-deluded as their employees. Upper-level management might have made ‘fantastic commitments’ without being aware that the company’s employees could not fulfill them without cheating. From my own experience with contracting and procurement, I also suspect impetus to cheat can arise from customers’ demands.
For example, one Wisconsin county clerk has written he does not allow updates or patches to that county’s voting-machine software. If this is true, it’s easy to see how the vendor would be tempted to install wireless communications capability in that county’s voting machines. And why not? The company needs occasionally to update and patch the software, and the county clerk will never discover the communications chip. It would be the only way the company could keep the machines up to date without upsetting the clerk. And once that chip is there, every employee who knows about it is on nothing stronger than an honor system not to alter the election results, because output isn't routinely verified in Wisconsin.
Once expectations are clear, employees will try to conform their behavior. And that behavior is comfortable only when they also bring their perceptions and beliefs into compliance.
For example, an in-depth study following the Challenger space-shuttle explosion found that engineers had observed O-ring failure--the cause of the disaster--in many previous tests; had reported it; and had repeatedly been pressured to endorse more risk as acceptable. Compliantly, they had rewritten their reports to approve looser and looser standards. Then, just before the fatal flight, freezing temperatures convinced the engineers to issue a “No Launch” recommendation. However:
“The data they faxed to NASA to buttress (their no-launch recommendation) were the same data they had earlier used to argue that the space shuttle was safe to fly. NASA pounced on the inconsistency. (Faced with the) script they themselves had built in the preceding years, (the engineers) buckled. The “no-launch” recommendation was reversed to “launch.”
Useem explains that the engineers and managers “were not merely acting as if nothing was wrong. They believed it, bringing to mind Orwell’s concept of doublethink, the method by which a bureaucracy conceals evil not only from the public but from itself.”
That could explain why so many otherwise responsible election officials seem to shut down when you try to talk to them about examining voting-machine output for accuracy. We look at them and think, “You’ve got so very much invested in the elections—all those security measures, all those pre-election tests--how could you not want to check to make sure everything came out right on Election Day?”
But they look at all their hard work and think, “I promised everyone it would work. My career will be over if it doesn’t work. It’s got to work. I’m sure it worked.” Useem explains what happens next:
Even without stress, people tend to underestimate the probability of future bad events. Put them under emotional stress ... and this tendency gets amplified. People will favor decisions that preempt short-term social discomfort even at the cost of heightened long-term risk.
So how do we help election officials break out of this mindset? How do we increase their fear of a ‘future bad event’ that could cause them ‘short-term social discomfort’?
Oddly enough, it is not the risk of a miscounted election occurring that causes their fear; it is the risk of a miscount being detected. Most computer-dependent managers--not election officials--realistically expect that if they do not catch a computer error, someone else will. For them, routine audits reduce fear. But miscounting voting machines don’t blow up like space shuttles, and candidates cannot take voting machines out for test drives between elections. Therefore, in the absence of post-election verification, election officials have no realistic fear of anyone discovering a miscount. The idea of an audit has the opposite effect on them: their fear goes from nothing to, well, something.
That’s why transparent, high-quality citizens’ audits are critical. Even if they cannot be completed before the identified winners are sworn into office, they will still serve a useful purpose of increasing election officials’ realistic expectation (okay, fear) that any miscounts will be detected—if not by them, by someone else. That will create for them the same discomfort felt by bankers, city treasurers, grocery store owners, and all the other computer-dependent managers who fear embarrassment or worse if they don’t notice the computer error and correct it before someone else does.
Note: I know of no requirement that anyone inspect Wisconsin's voting machines to verify they have no wireless communications capability. Over the years, I’ve asked several Wisconsin election officials if they inspect the machines anyway and have not had any tell me that they do. If anyone reading this has any first-hand knowledge of any local officials’ inspection practices that include checking for wireless communications capability, please email me at WiscElectionIntegrity@gmail.com.