The new tabulation equipment and processes used in most counties are fatally flawed

For many years, I have joined several other tabulation workers in personally certifying the accuracy of tabulated votes in Wayne County, Indiana. This year, I cannot conscientiously sign my name to the results.

The explanations that follow are lengthy, so here is a quick glimpse at the bottom line:

1. Although they are easier to use, the most commonly used new "DRE" voting machines and tabulation systems do not offer people any reasonable assurance that their votes have been counted. In fact, the DREs might easily be abused to alter the outcome of an election.



2. The previously used punch-card system offered almost perfect assurance that votes are counted as cast.



3. Before more modern systems are adopted, they should be redesigned to provide the same level of assurance that we have come to expect of existing systems.

I'll begin by looking at the punch-card system and the standard that it set. Then I'll take a look at the DREs to see how they compare.

The punch card system set a high standard for testing and verification:

The punch-card systems use standard, readily understood hardware. The equipment used for tabulation in the punch-card system was well known to computer professionals and easily interchangeable. Tabulation software ran on an industry-standard PC that could easily be replaced on short notice. The card reader was standard enough that a replacement could easily be brought in. Wayne County added a margin of security and integrity to their system by acting as a "depot" for a spare card reader in this region, thus having two interchangeable independently tested card readers on hand. The result of this from a testing point of view is that there was no way to tamper with the equipment to affect results because a different computer or card reader might be substituted at the last minute to run with the previously tested software.

The open hardware architecture allowed thorough testing to occur. Testing of the punch-card system began several weeks before the election was scheduled to take place. Our vendor (ES&S) would send us a copy of the parameters that configured the tabulation program for the next election. The program with the parameters loaded was tested in the presence of the local election board, interested members of the public and press, and two "computer experts" observing the tests on behalf the two major parties. This test involved a standard "test deck" of cards designed to cast a different but predictable number of votes for each candidate. In addition, the observers would add a few "trick cards" to the deck to make sure the correct results, although known to the observers, would be unknown in advance by either the programmers or operators of the equipment.

During the test, the observers might ask that the program and/or parameters be reloaded from disk, that the date on the computer be changed, or that an arbitrary new test deck be run in addition to the standard deck. In short, there was almost no way that the vendor of the program or the local operators might predict in advance what the test might look like.

Untested software was never used. Once the test had completed, both the program and the parameters (on standard disk) where then sealed in a lock-box along with the test deck in the presence of the observers. On election night, the observers might ask that the program or parameters be reloaded from the sealed disks to ensure that nobody had replaced the program in the computer in the meantime.

In addition, on election night, the same test deck used for the earlier tests was used to run a pre-tabulation and post-tabulation test on election night. Again, if they wished, the observers could throw a few "trick cards" into the deck at this point.

Although the diligence of the observers played a major role in the effectiveness of this testing process the result was that there was a very strong and credible deterrent in place to keep malicious programmers from altering software to affect the outcome of an election. The chance of getting caught was very high in a county that ran the tests carefully.

A hardcopy of each ballot remained available for confirmation. As a final and ultimate deterrent, the ballot cards themselves served as a check on the system. Because manual recounts, although rare, did occur regularly, there was always a good chance that the results for one or more precincts would be checked by hand. In these situations, the results must always be identical, or questions would be asked and almost certainly a complete manual recount of the county would be ordered.

In summary, several important factors made this system transparent enough to computer experts that we could in good conscience certify the results:

1. The equipment was interchangeable and standard. The observers truly understood what the "boxes" contained.



2. The conditions of the test, such as system date were completely under the control of the observers.



3. The software was sealed between test and tabulation. Nobody could run a different version of the software on election night without a substantial chance of being caught.



4. A physical record of the vote cast in the form of the actual ballot that the voter punched remained as the ultimate check

The new DRE system used in Wayne County does not live up to the standard previously set by the punch-card system:

Although some testing is still done for absentee ballots only, no pre-election test is mandated for the tabulation machines that will count the vast majority of the votes in each county. There is no requirement that local election boards even verify that the every voting device can handle basic functions.

Fortunately, the local election officials and IT department at Wayne County are quite willing to voluntarily allow any tests we might devise. Unfortunately, even with total cooperation from county officials, there is no way to devise a set of tests with a reasonable chance of catching improper tabulation due to either malicious or incompetent programming. Here is why:

1. The DRE voting machines tabulate their own results internally. This means that to even test half of the equipment would involve casting many votes on dozens of machines. Contrast this to testing a single tabulation system for punch cards.



2. Using the current procedures and equipment, there is no way to guarantee that the software that has been tested is the software that actually runs on election day.



3. Although the vendor and local election board might agree to a process that involves thorough pre-election testing, the DRE devices are controlled via a very small "key" that appears to use infra-red or magnetic communication. This means a malicious programmer with knowledge of the DRE could create a key that would change the behavior of the DRE device and send a voter in to a poll with that key, which would then be used in the privacy of the voting booth to trigger changes on election day.



4. Additionally, because the DRE devices are a "black box" which observers cannot inspect internally or control at any level for testing purposes, it would be a simple matter to build in a many sorts of software "triggers" that would change the behavior of the program after certification tests have been done. Here are just a few:



• A date trigger that would record votes differently on election day only, but pass accuracy tests on any other day of the year.



• A "control sequence" based on the user interface to trigger a change by entering a particular unusual sequence of votes.



• A counter that changes the behavior of the program after a certain number of ballots have been cast. (People running tests aren't going to take the time to cast hundreds of test votes on each DRE device.)



5. Because there is no physical record of the vote that is verified by the voter, there is no way for a voter to confirm that the vote has been counted, nor any way to audit the results on election day

The bottom line for those using the vast majority of DREs, including those in Wayne County, is that you must trust the vendor of the system to be both competent and honest. While I do not have any reason to suspect that any vote tabulation company will attempt to misrepresent votes, I also do not believe the leaders of our country should be chosen using a system that relies solely on trust. None of us would trust our money to bank that didn't have a system of independent verification audits, so why would we trust such a system to choose the people who control the course of our country?

Here is my challenge to the vendors of DREs: If you will place all of your company's assets in my control and trust me to tell you how much money you have and where it went without an independent audit, then I will trust you to take my vote and tell me who our next president will be. (I am trustworthy and I can give you some great references, so your money is safe with me!) If you won't take me up on this offer, then what makes you think the American public is less gullible?

My qualifications:

You will find many opinions about this subject and there are plenty of paranoid crackpots using the Internet as their soapbox, so it makes good sense to question the qualifications and character of anyone before accepting their assertions. My experience speaks to both my qualifications and how those who know me evaluate my character, so here's a brief resume:

1. For nine years, I either personally operated or directed the team that operated the vote tabulation equipment in Wayne County, Indiana. I am intimately acquainted with the process.



2. For three years, I served as an observer for the Democrat party in Wayne County. My role was to verify that the tabulation equipment did its job correctly and that the process was correct. At the last election, I observed the DRE tabulation equipment in action and had an opportunity to question the vendor's representative.



3. For one year, I served as an observer for the Democrat party in Union County.



4. I am currently president of the Union County Election Board, the board charged with running fair and accountable elections in Union County, Indiana.



5. At the direction of the Wayne County Circuit Court and the Union County Circuit Court, and the Franklin County Circuit Court, I have served on three recount commissions. A recount commission is charged with examining the information available after the initial certification of votes to determine if a particular race was counted correctly. These recounts were on both the older punch-card system and newer optical scan systems with DRE terminals. In preparation for these recounts, I studied the relevant sections of Indiana Code and Indiana Election Rules and examined our local processes and equipment for vulnerabilities.



6. I do not have any financial or political connection to either side of this issue. I only hope that by adding my voice, I may encourage our legislators and State Election Division to take action to preserve the foundation of our government- The voice of the people.

Don't blame the County Clerk or State Election Administrators (But don't let them ignore this problem either.)

This is not an indictment of people, but rather an exposition of flawed legislation, equipment and processes. It is important to stress that I don't blame the people involved at the county or state level. They are doing their best to keep our country running whilst burdened with an untenable situation created by well intentioned but flawed legislation. In particular, I will note that I am impressed with the service and dedication of Wayne County Clerk Sue Anne Lower and the Co-Directors of the Indiana Election Commission, Kristi Robertson and Brad King. While serving at Wayne County, I have worked with all of these people and I assert that the main reason Indiana has never had serious problems such as Florida's is due to the integrity and skill of our election administrators. In addition I have had the pleasure of meeting our Secretary of State, Todd Rokita on several occasions. I found him to be a conscientious public servant. On the other hand, these folks are not IT professionals, so they may not be aware of issues that are obvious to those of us who work with computers. My intent is to educate and provoke action, not simply complain. In a follow-up to this article, I'll suggest some long-term solutions. In the short term, I can't honestly say that I know how to correct the problems before the 2004 elections. I only know that I won't be placing my signature below results that I can't verify.

Copyright, Updates, Comments, Questions.

Copyright � 2004 Nick Fankhauser.
I grant the right to reproduce this work to anyone with the following restriction: The entire work must be presented in the reproduction.

The reason I require that the entire work be reproduced is that I will probably update it periodically. I believe that all of the statements are true but I am not perfect and may need to make corrections or perhaps even change my opinion. I also hope to be able to report some progress toward a solution eventually. If you are reading a reproduction, please go to the following URL to make sure you have the most current copy: http://www.fankhausers.com/articles/

I invite comments, questions and corrections. I'm willing to post opposing opinions if they are reasonably well written. My EMail address is nick@fankhausers.com