<:

E8

~~t~=~~n~

p~m-::~F!e~:~ o~t~~~~~~~~e-;'

July 19,2004 Via Overnight Delivery The Hon. Henry McMaster Attorney General,Stateof SouthCarolina P.O. Box 11549 Columbia,S.C. 29211 and RembertDennisBuilding 1000AssemblyStreet,Room 519 Columbia,S.C.29201 RE: Requestfrom RepresentativeJoe Neal, HA V A and E-Voting Choicesfor South Carolina

Dear Mr. McMaster: SouthCarolinais choosingnew voting technologies comply with the federalHelp to Americavote Act (HA V A).l We understand that, asAttorney General,you havebeen askedby Representative Neal to considerhow HA V A appliesto the electronicvoting Joe technologies known asdirect recordingelectronic(DRE) that havebeenchosenas finalists in the bidding process SouthCarolina. Specifically, you havebeenaskedto in considerwhetherthe stateshouldrequirea voter verified paperballot (VVPB), a widely recognized securityand auditability enhancement requiredby threeother statesand now subjectto pendinglegislationin severalmore, aswell asfederally. The Electronic Frontier Foundation,a leadingtechnologyrights organization,2 providesthis analysisto assistyou. We concludethat, while authoritiesdisagree aboutwhetherHA V A itself requiresa voter verified papertrail, requiring sucha trail is consistent with South Carolina'sdutiesunderHAV A and is a wise policy choicegiven the anticipated additionalfederalregulationsfor voting machinesandthe problemsthat have already occurredwith the useof theseelectronicvoting machinesin actualelections.

1

Help America Vote Act of 2002,42 U.S.C.A. §§ 15301-15545 (West Supp.2003).

2 TheElectronic Frontier Foundation ("EFF")is a nonprofit publicinterest organization dedicated to

protectingcivil liberties and free expression the digital world. Foundedin 1990,EFF hasover 13,000 in paying members represents interestsof Internetusersin court cases and the and in the broaderpolicy debates suri-ounding applicationof law in the digital age. EFF publishesa comprehensive the archive of digital civil liberties information at one of the most linked to websitesin the world, <http://www.eff.org>. EFF represents individuals anda small InternetServiceProviderthreatened with copyright liability by DRE vendorDiebold for publishingembarrassing internale-mailsonline in a caseentitled Online Policy Group v. Diebold, currentlypendingin theNorthern District of California and hasfiled amicusbriefs in severalof the lawsuitscurrently pendingconcerningelectronicvoting machines. EFF currently has over 25 members SouthCarolina. in
454 Shotwell Street. 0+14154369333 San Francisco, CA 94110 USA 0+14154369993 Owww.eff.org Qinfo@eff.org

The Hon. Henry McMaster July 19,2004 Page2

I.

Introduction

Sincethe hangingchadsdisasterin Florida 2000,more attentionthan everhasbeen devotedto the mechanics elections. Many stateswishing to avoid Florida's problems of quickly replacedtheir old voting technologies with newerones,often beforethose systems havebeenproperly testedor evenfully developed.Vendorshaverushedsystems to marketto take advantage this concern,plus the flood of federalfunds provided in of HA V A. SouthCarolina'sbidding process resultedin threeDRE systems has making the final round. DRE systems differ from otherkinds of electionsystems because they directly record a vote inside a computerized systemratherthan on a piece of paperor via mechanicallevers. All recordof the vote resideswithin the computer. The voter or electionofficia};attemptinga recountor audit hasno independent information with which to verify that the vote hasbeenrecordedcorrectly or that it hasbeentransported within the machineand to the tally machinewithout changeor error.3 Sincethe adoptionand implementationof DREs,substantialerrorshave occurredduring elections,including errorsresultingin significant voter disenfranchisement in at and, leastone case~ needfor an electionto be reheld.4Additionally, computerscientists the nationwidehave expressed concernaboutthe securityand auditability of DREs, noting that the currentdesignof the machines leavesthem vulnerableto malicious altering that would be difficult to trace. Fortunately,thereis a simple solutionthat canhelp uncover, if not prevent,suchproblems. This solution ensures evenif the machine that malfunctions,the votersintentionsarerecordedin a secondlocation and canbe properly countedas cast. Called a "voter verified paperballot" or VVPB, the proposalis straightforward. It requiresthat the printer alreadysuppliedon most DREsprint out the vote at the time it is castso that the voter canreview it. If the summaryis correct,it dropsinto a ballot box. Ifit is not, the vote is cancelledandthe voter can start over.5 The addition of a VVPB works on a very basicprinciple - that two recordsreflecting the votersintention arebetterthan one. Severalelectionsystems that provide a VVPB have beenfederally qualified6andNevadawill usea VVPB systemin the Novemberelections.

Another technologythat is allowed by HA V A is called "optical scan." This allows voters to continueto mark their preferences paperwhich is then scanned on into a computerfor counting. Thesesystems inherentlyprovide an audit trail and are widely recognized more reliable than DREs. They also have as both paperand computerizedways to assistdisabledindividuals in marking their ballots. SinceSouth Carolina hasapparentlynot chosenany of thesetechnologies its recentbidding, we will not discussthem in here. We would be happyto provide additionalinformation on thesesystems upon request,however. 4 Seenote aboutHinds County, Mississippi on page 10, infra.
)

S 6

Note that the printout is not retained,or under suchsystems eventouched,by the voter.

Accessibility and Auditability in ElectronicVoting, EFF White Paper(May 17, 2004), available at http://www.eff.org/e-vote/e-vote_white-paper_20040517.php. addition, Avante's systemwas federally In qualified in June.

oC

~

~i~

~~~ ';:cc""

TheHon.HenryMcMaster
July 19,2004 Page3

To assistthe Attorney Generalin his consideration whetherWPBs shouldbe required of in SouthCarolina,EFF providesfirst, a summaryof the Help America Vote Act provisionsconcerningauditability of machinesandthe currentdebateaboutwhetherthat provision requiresa VVP8. Next, we will explain the upcomingcertification decisions that will be madefederally andthat could affect SouthCarolina'sability to useDREs without a VVPB in the future. Finally, we will explain why we believe that requiring that vendorsproviding systems SouthCarolinaprovide a VVPB is the correctpolicy to decisionfor SouthCarolinaand supported HA V A. by A. The HelD America Vote Act of 2002 The Help America Vote Act of 2002 (HA V A) modernizes electionsby encouraging and eventuallyforcing new voting technologit:s.If stategovernments implementsystems meetingHA V A guidelines- precinct-countoptical scanmachinesor DREs - by 2004, they canreceivefederalfunding. States must comply with HA V A requirements by implementingthesesystems (with someexceptions) 2006 for all federalelections. by HA V A mandates audit trail as a "uniform non-discriminatoryrequirement"for all an systems 2006, or 2004 for systems by receivingfunding. Federalguidelinesin conjunctionwith HA V A havenot beenissuedyet, but it is clearthat HA V A doesnot preempt a voter-verified recordand could evenbe interpretedto requireone. 1. StatesAre not Prohibited from ReQu!ring PaRerTrails: SomeHave Already Acted HA V A makesspecific requirements, still leaveswide discretionto statesto run but electionsandmakepolicy choices.7Requirements beyondthe HA VA's are explicitly allowed: The requirements established this title areminimum requirements by and nothing in this title shall be construed preventa Statefrom establishing to electiontechnologyand administrationrequirements aremore strict that than the requirements established underthis title. . .8 Most stateelectionlaw is alreadyfar beyondminimum HA V A requirements: ballot listing requirements, poll locations,audits,recounts,supervision,andmore. Local or statetesting,certification, and sealingof voting machinesare all beyondHA V A, and all are standard practiceacrossthe country.

1

See42 U.S.C.A. § 15404(West Supp.2003) (planningfor complianceby states);42 U.S.C.A. § 15485 (West Supp.2003) (leaving discretionto statesto implementpolicies). g42 U.S.C.A. § 15484(West Supp2003).

'...come,

'

I
i

The Hon. Henry McMaster July 19,2004 Page4

States are mandating voter-verified paper trails as well. Nevada, the first state to do so, will have voter-verification by November 2004. By 2006, California and Ohio will also.9 Over a dozen stateshave pending legislation. 10 In addition, several bills pending in Congress would expressly require a paper trail. I I 2. HA VA Could Be Interoreted to ReQuire Voter Verification Several commentators, including one of the Senatorswho drafted HA V A, maintain that it requires voter verification. The 2006 mandatory uniform nondiscriminatory requirements include alternate language access,disabled access,provisional voting, and several other requirements. The language in question regarding audit capacity is also a mandatory nondiscriminatory requirement: (2) Audit capacity. (A) In general. The voting system shall produce a record with an audit capacity for such system. (B) Manual audit capacity. (i) The voting system shall produce a permanent paper record with a manual audit capacity for such system. (ii) The voting system shall provide the voter with an opportunity to change the ballot or correct any error before the permanent record is produced. (iii) The paper record produced under subparagraph (A) shall be available as an official record for any recount conducted with respect to any election in which the system is used.12

9

KatherineQ. Seelye,DemandGrows to RequirePaper Trailsfor Electronic Votes,New York Times, The 2004 Campaign:Voting Machines,at 20 (May 23,2004). Ohio passed legislationin May, H.B. 262 (2004). The Nevadaand California Secretaries Stateissuedordersto similar effect. of lold. II SeeH.R. 2239, 108thCongo (2003), at http://frwebgate.access.gpo.gov/cgibin/getdoc.cgi?dbname=108_con~bills&docid=f:h2239ih.txt.pdf; 1980, 108thCongo S. (2003), at S. 2045, 108thCongo (2004), at http://frwebgate.access.gpo.gov/cgibin/getdoc.cgi?dbname=108_con~bills&docid=f:s2045is.txt.pdf; 2313, 108thCongo S. (2004), at S. 1986, 108thCongo (2004),at http://frwebgate.access.gpo.gov/cgibin/getdoc.cgi?dbname= 108_con~bills&docid=f:s 1986is.txt.pdf. 1242 U.S.C.A. § 15481(a)(2) (West Supp2003).

The Hon. Henry McMaster July 19,2004 Page5

The most convincingargumentthat § I 548I (a)(2) requiresvoter-verificationis a fourpagepaperby former FEC chairmanDarryl R. Wold.i3 Wold relies heavily on the definition of "manual audit capacity,"arguingthat a manualaudit is meaningless without voter-verifiedballots. Relying on the long history electionrecounts,he emphasizes humanoversightandjudgment in a manualrecount. He arguesthe auditing requirement is "not a bare legal requirementwithout practicalsignificance. To the contrary,a paper recordthat hasbeenreviewedandverified by the voter is an essential elementof a transparent openvoting system."i4 and Language SenatorJohnEnsignof Nevada,authorof the amendment by incorporatedas the relevantaudit section,hasaddedto the debate. His statement the conference to committeeduring the legislative debateon HA V A abouthis amendment showsintent to makethe audit voter-verified: [Amendment2900] is simple. It would give votersa receipt at the time their ballot is cast,and allow the voter to confirm, and,if necessary, to changethe vote beforethe ballot is cast. This receiptwould then be set asideas a permanent recordof that election. This would instill confidence in new, paperless touch-screen voting machinesandwould alsoprovide a backuprecordin the eventof a recount. is SenatorEnsign's letter to the editor in the New York Timesstates amendment his requires "that votersusing electronicvoting systems ableto review their ballots before casting be them to confirm and,if necessary, changetheir votes. A paperballot would then be set asideas a permanent record."i6 Thesestatements make a strongcasefor the requirement, but other interpretationsarepossible,andother Senators legal analystsdisagree and with SenatorEnsignand Mr. Wold. It is possibleto think aboutwhat a "manual audit capacity"meanspractically, as former Commissioner Wold did, and concludeH.A..A requiresvoter verification. It is also V possibleto view the requirementastoo vagueto containa technicalmandateor to interpretthe audit requirementasrequiring recordsat, say,poll closings. All interpretationsaremerely viewpointsuntil this statuteis litigated or the federal governmentissuesguidance. Under any interpretationofHA V A, however,South Carolina is free to implementa voter-verifiedpaperballoting systemif it chooses.

13 Darryl R. Wold, TheHAVA Requirementfora Voter VerifiedPaper Record,July 23,2003, http://www.verifiedvoting.org/resources/documents/HA V A_Requirement_forVVP_Record. pdf. We attacha copy for your cortvenience Exhibit A. as

1. fd. at 4.
IS
16

Letter from Sen.JohnEnsignto Sen.Mitch McConnell (May 29,2002), attached Exhibit B. as
John Ensign, Editorial, How to Make Sure That Your Vote Counts, N.Y. Times, Dec. 15,2003, at A26.

l

i

The Hon. Henry McMaster July 19,2004 Page6

3. Guidance Has not Been Issued vet: Future ReQuirementsMi2ht Mandate Voter Verification Not only is SouthCarolina free to implementa VVPB, the changingfederalregulations and guidelinesfor voting systems indicatethat sucha decisionis likely to be far-sighted. Decisionsaboutnew requirements standards in process severalareasand in and are in eacharea,VVPB is being seriouslydiscussed.Shouldfederalstandards changed be to requirevoter verification, SouthCarolinacould facethe problemof, at best,having purchased outdatedmachinesand at worst, having to replaceits new machinesin the near future. First, federalguidelinesto implementHA V A havenot beenissuedyet. The HA V Acreatedadministrativebody, the ElectionAssistance Commission(EAC), is developing them andmany participatingin the processareurging a papertrail. Thoughany such guidelinesareunlikely beforethe Novemberelections,EAC could easilyrecommend a papertrail by 2006 andmany of thoseconsultingwith the EAC areurging this. The first federaltechnicalstandards aboutelectionequipmentwere issuedby the FEC in 1992. Thesevoluntary FEC standards were last u~datedin 2001, andHA V A maintains this set asthe currentdefault technicalstandards. SouthCarolinarequirescompliance I with thesestandards amongother restrictions. The successor thesestandards IS to should be issuedsoonby the EAC, working with severalotherbodiescreatedfor the purposeof drafting generalvoluntary technicalstandards electionequipment. for 19 The EAC will also issuevoluntary guidanceaboutHA VA's nondiscriminatory requirements soon. For 42 V.S.C. § 15481,which containsthe audit requirement, the EAC was requiredto issuevolunt~ guidanceby January2004,but late appointmentof the EAC itself delayedthis process.0 It is possiblethat either setof standards, the generaltechnicalguidelinesor the non-discriminatoryrequirementguidelines,could mandateor suggest voter-verified papertrail. a Additionally, the industry representative organization,the Institute of Electrical and ElectronicsEngineers (IEEE), hasits own electionequipmentstandards also,but they will not be updatedin time for the 2004 elections. Tllcse standards not currently do

17 This duty was delegated the FEC's Office of Election Administration. For more on the FEC standards, to seePeggySims & Brian Hancock,FederalElection Commission,TheFederal Election Commission's Office of Election Administration and Its Role in the VotingSystem Standards Program (2002), available at

http://63.206.28.66/pdfs/OEA.pdf. 18 S.C. CodeAnn. § 7-13-1620(1976). 1942 U.S.C.A. § 15362 (West Supp.2003). 2042 U.S.C.A. § 15501(West Supp.2003).

I

The Hon. Henry McMaster July 19, 2004 Page7

include VVPB, but the IEEE plansto reviseits standards heavily soonafter the 2004 elections. Currentdrafts of the revisionsinclude standards VVPB. for B. A Voter-Verified PaDerTrail Is a Sound Policv Choice for South Carolina As notedabove,SouthCarolinais free to implementa voter-verifiedpaperballot under federallaw, and given upcomingstandards might savemoney and effort in the long run it by doing so. Moreover,given the manifestproblemsthat DREs without voter verification presentfor electionsecurityandreliability, the integrity of SouthCarolina's electionswill be greatly enhanced actingnow. by Put simply, while DREs may hold promisefor the future, they are simply not readyto be trustedwith our most importantdemocrC1[ic mechanism our elections. Mechanical failures, softwarefailures,and simply wlexplainablefailureshaveplaguedelectionsusing DREs. Serioussecuritythreats100m;computerexpertsnote that relatively unsophisticated technicalpersons could alter entire electionswithout detection. These threatscanbe mitigatedwith simpletechnology:a voter-verifiedpaperballot. This ballot would createa papertrail, just like thoseSouthCarolinahaslong beencanvassing in closeor contested elections. The addition of a VVPB fulfills a basicmaxim of both electionand generalauditing: two setsof books arebetterthan one. 1. A PaRerRecord Miti2ates Technical or Other Falline: DRE malfunctionsandpollworker errorsin using thesecomplicatedtechnologies during electionshavebeenwidespread, resultingin significant disenfranchisement and uncertaintyin electionresultsaroundthe country. Even without interference, these machinesoften performedunacceptably!1 Many of theseproblemsinvolve Diebold and ES&S technologies, vendorschosenin SouthCarolina's recentbidding process: A. Diebold

Maryland (November 5, 2002)!2 Voters using Diebold DRESwatchedasthey voted for the Republican candidate governorandthe 'X' appeared for besidethe nameof the Democraticcandidate.The machines usedwere Diebold DREs with no

This list of problemssubmittedto the federalcourt in Benavidez Shelley. Amicus CuriaeBrief of v. Electronic Frontier Foundation("EFF"), the California Voter Foundation,the Verified Voting Foundation, and Voters Unite!, Benavidez Shelley,2004U.S. Dist. LEXIS 12587(C.D. Cal. 2004). The court has v. subsequently aff1rn1ed California Secretary State'sorder decertifying certainvoting systemsand the of requiring voter verification in the future. The full amicusbrief is availableat http://www.eff.orgiActivism/E-votingiBenavidezJ200405 18-benavidezAmicus.pdf. 22"Glitches cited at some polls ..., " THEWASHINGTON TIMES, November6, 2002.
21

The Hon. Henry McMaster July 19,2004 Page8

paperballot so the machinescould not be audited. "I pusheda Republican ticket for governorandhis namedisappeared," Kevin West of Upper said Marlboro. "Then the Democrat'snamegot an 'X' put in it." MuscogeeCounty, Georgia (November 4, 2003)!3 Allegations of widespread complaintsby citizenswho voted "no" on a salestax propositionbut sawDiebold machines register"yes" caused county officials to take the machineout of serviceduring the election. RobesonCounty, North Carolina (November 2002).24 Ballot tabulatingmachinesby Diebold failed to work properly in 31 of 41 precincts. Local electionofficials saidthe problemwas the result of a softwareprogrammingerror, andballots from the individual voting machineshad to be retabulated. San Diego County, California (March 2, 2004).25 Delayedopeningof55% of the polling places,573 out of 1038polling places,due a problemswith the batteriesin Diebold voting machines. The problemscausedan unexpected initial login screens appearon the to machines, preventingproper encodingof electronicballot cardsat those polls. Due to the county's decisionnot to provide paperballots at the polling placesas a back up, many voterswere turnedaway and told to return later. Thereis no reliable estimate the numberof voterswho of returnedas opposed thosewho were unableto return and vote later. to

23

Mark Rice, NAACP disputessalestax results,DuBosefiles complaintin Muscogee Superior Court,

LEDGER-ENQUIRER, November 13,2003. 24 The Associated Press,Voterturnout surprisesofficials, SUN NEWS, September 12,2002, at
http://www .myrtlebeachonline. com/midi sunnews/news/local/ 4056664 .htm.
Z5

Office of the Secretaryof State,Report on the March 2, 2004Statewide Primary Election (April 20,

2004. http://www .ss.ca.gov/elections/ks_dre-papers/march_2_report_fmal.pdf (hereinafter"March 2 Election Report") at 17; Official Reportof the Chief Administrative Officer of SanDiego County, at http://www.signonsandiego.com/news/poltics/county/2004031 0-1315report.html.Jeff McDonald and Luis MonteagudoJr., Poll Workers,VotersCite Tied-UpHotline, Poor Training, Confusion,UNION TRIBUNE; March 7, 2004, http://www.signonsandiego.com/news/politics/20040307-9999-ln7vote.html. A more completedescriptionof many of the problemswith DRE machinesincludedin this brief is included in the "Myth Breakers"report attached the Declarationof Ellen TheisenunderFederalRule of Evidence 1006, to filed herewith.

The Hon. Henry McMaster July 19,2004 Page9

Montgomery County, Maryland (March 2, 2004).

26

At leastone voter using Diebold electionequipmentwas not presented with a completeballot. After castinghis vote, he realizedthat the Senate racehad not beenpresented him for his vote. Whenhe complained, to the poll workersfirst told him, "Once you've castyour vote, you can't vote again." A poll worker askedif the voter had pressed magnification the button. The worker saidthey knew that the error occurredwhen the magnificationbutton had beenpressed. San Diego County, California (March 2, 2004).27 Ten voteswere inexplicably lost at onepolling placeusing the Diebold TSx DRE. An electioninspectorin SanCarlossaidwhenpolls closedat 8 p.m. Tuesday,the numberof peoplewho signedthe voter log differed from the numberof ballots countedby computers."We lost 10 votes,and the Diebold technicianwho was therehad no explanation,"he said. Alameda County, California (March 2, 2004 and October, 2003):8 A report released April 12, 2004,by Diebold Election Systems on shows that nearly 25% of its ballot encoders, of763 encoders, 186 failed on electionday because hardwareor softwareproblemsor both. l.ocal of newsreportedthat "no electronicvotescould be castthat morning at Anna YatesElementarySchool." Voters were turned away from the polls, losing their opportunityto vote in the primary aswell ason other issues. Failuresof votercard encoders alsooccurredon SuperTuesdayin Newark, SanLeandro,Emeryville, Oakland,and acrossSanDiego County. Diebold also admittedin its April 12, 2004,report that tabulationerrors during the October2003,recall electionwere due to softwarebugs.

26

Jeffrey F. Liss, Think You Votedin Md.? ThinkAgain, WASHINGTON POST, March 7,2004, at

http://www.washingtonpost.com/wp-dyn/articles/A38008-2004Mar6.html; Viveca Novak, The Vexationof VotingMachines,TIMEMAGAZINE 42 (May 3, 2004). at 27 See also Jeff McDonald and Luis MonteagudoJr., Poll Workers,VotersCite Tied-UpHotline, Poor
Training, Confusion, supra.
28

March 2 Election Reportat 18; Ian Hoffman, VotersShort Changed ThePolls, OAKLAND At TRIBUNE;

March 7,2004, at http://www.oaklandtribune.com/Stories/O, 1413,82-1865-2002277 ,00.htm1; Ian Hoffman, Diebold ReportsMultiple Problems:Registrar WantsReason For E-Voting, TRI-VALLEY HERALD, April 13, 2004,at http://www.trivalleyherald.com/Stories/0,1413,86-10671-2080327 ,OO.html.

The Hon. Henry McMaster July 19,2004 Page10

B.

~

Wake County (Raleigh), North Carolina (November 2002)}9 Electronicvoting machines industry leaderES&S failed to count 436 by ballots castat two Wake County early voting locations. The vendor confirmedthat the machines had defectivefirmware that caused some votesnot to be recorded. The countyreturnedto using its optical scan machinesandhasdecidednot to purchase DREs. Broward Counties, Florida (January 6, 2004).30 In a specialelectionfor the StateHouseDistrict 91 seat,with only one item on the ballot, ES&S electronicvoting machinesshoweda total of 134 undervotes that is, 134 ballots in which votersdid not selecta candidate eventhoughit was a single-race election. The winner, Ellyn Bogdanoff, received12more votesthan the runner-up. Florida law requiresa manual recountof invalid voteswhen the winning margin is lessthan one-quarter of one percent. However,electionofficials determinedthat no recount was requiredbecause 134invalid voteswere caston electronicvoting the machines,andthereis no recordof the voter's original votes. Dallas County, Texas (October 22, 2002).31 The Democratssaidthey receivedseveraldozencomplaintsfrom people who saidthat they selected Democraticcandidate that their vote on a but an ES&S DRE appeared besidethe nameof a Republicanon the screen. Somevotescastfor Republicans were countedfor Democrats.The article points out that the previousyear,the outcomesof 18 suburban Dallas County electionsremaineduncleardaysafter the electionbecause voteof countingproblemson the samemachines.About 5,000of nearly 18,000 ballots castduring the early voting period were not properly assigned to candidates.

29 )0

Seehttp://www.verifiedvoting.org/resources/documents/ElectronicsInRecentElections.pdf. JeremyMilarsky and Lisa J. Huriash,Electronic VoteRecountStumps Broward Officials, SUN-SENTINEL,

January10,2004. )1 Ed Housewrightand Victoria Loe, Area Democrats say early votesmiscounted, Court hearing delayedas
meeting planned on touch-screen problems, THE DALLAS MORNINGNEWS, October 22, 2002.

.","-

,

ij

"

I

The Hon. Henry McMaster July 19, 2004 PageII

Miami-Dade County, Florida (May 20, 2003).32 An internal review of electionresultsby a Miami-Dade county election official found that a DREsystem sold by ES&S andusedin the May 20, 2003North Miami Beachrunoff election(aswell asin earlier elections) was "unusable"for auditing,recountingor certifying an electiondue to a "seriousbug" in the software. c. Other Vendors

Hinds County, Mississippi (November 4, 2003).33 A VS Voting machinesat somep.Jllingplacesin District 29 failed to start up. Othersoverheated broke down during the election,and not and enoughpaperballots were availableto allow all votersto vote. The Mississippi Senate decidedit was impossibleto determinethe will of the voters. It declaredthe electioninvalid, and a new electionwas held on February10,2004. Bernalillo County, New Mexico (November 5, 2002).34 Insufficient memory capacityfor the Sequoiasoftwareusedto tabulatethe votes caused about25% of the votesnot to be countedin the initial tally. Although about48,000peoplevotedon 212 DREs, the initial figures given to the commissioners indicatedthat no race,not evenfor governor, showeda total of more than about36,000votes. Apparentlythe Microsoft SQL 6.5 softwareprogramusedto report all of the voteshad a capacityof only 64 kilobytes of dataat a time. Any more than that fed to

thereporting program onechunkwassimplynot tallied. in

I

32

Matthew Haggman,Count Crisis? Election Officials Wam of Glitchesthat May ScrambleVoteAuditing,

MIAMI DAILV BUSINESS REVIEW, May 16, 2004, at

http://www.law.com/jsp/newswire_article.jsp?id=1084316008117; CharlesRabin, Glitch Forces Chang.? in VoteAudits, THEMIAMI HERALD, May 15,2004,at http://www.miami.com/mld/miamiherald/news/local/8671922.htm. 33 Clay Harden,Long lines, machinemalfunctions mark today's voting, THECLARION-LEDGER, November 4, 2003, at http://www.clarionledger.com/news/0311/04/mvproblems.html; Goodman,District vot~~ Julie set; contendermay quit, Democratsayshe's "beenthrough enough" in disputedSenaterace, THE CLARION-LEDGER, January21, 2004,at http://www.clarionledger.com/news/0401/21/ma04.html.
34

Frank Zoretich, Election Results Certified After Software Blamed, ALBUQUERQUE TRIBUNE,November

19,2002, at http://www.abqtrib.com/archives/news02/111902_news_vote.shtml.

(

, 1

I :

The Hon. Henry McMaster July 19,2004 Page12

Boone County, Indiana (November 2003 Municipal Election).35 Electronicvote-tabulationequipment vendorMicrovote reportedthat by 140,000voteshadbeencastin a county of 50,000residents.Only 19,000 of thoseresidents were registered vote and only 5,352voted. The to tabulationmachinehad not beeninitialized and it was setto give excessive numbersto call attentionto the error. The county clerk saidit was obviousthe numberswere wrong sincethe county is small, but she wonderedif the error would havebeennoticedin a large county. Fairfax County, Virginia (November 4,2003).36 Somevotersusing AdvancedVoting SolutionsDREs watchedasthe 'X' they put besidethe nameof RepublicanSchoolBoard Member,Rita Thompson,dimmedout andmovedto her Democraticopponent. Ms. Thompsoncomplainedand onemachinewas tested. Surprisedofficials watchedasthe machinesubtracted approximatelylout of 100votes for
Ms. Thompson.

.

Harris County, Texas (November 4,2003).37 Hundredsof Houstonareavoterswere disenfranchised because of problemswith the Hart lntercivic electronicvoting machines. Specifically,votersat two polling placeswere told to comeback later when machines malfunctioned,and at onepolling placeelectionjudges had voterswrite their choicesdown on paper. Orange County, California (March 2004).38 Approximately 7,000voterswere presented with the wrong ballots due to problemswith pollworker understanding complexHart Intercivic of

3S

Grant Gross, Voting machine glitch shows thousands of extra votes, IDG NEWSSERVICE, November 13, Cho, Fairfax Judge Orders Logs Of Voting Machines Inspected, WASHINGTON POST,November 6, 2003,

2003,at http://www.itworld.com/Tech/2987/031113votingg1itch/.
36

at BO1, at http://www.washingtonpost.comlac2/wp-dyn?pagename=artic1e&node=&contentld=A62912003Nov5&notFound=true. 37 11News Staff Reports, Polling machineproblemsanger manyvoters,November4, 2003, 07:27 PM CST, at http://www.khou.cominews/10cal/houstonmetro/stories/khou0311 04_mh-po11ingprobs.la536189 .htm1
38

March 2 Election Reportat 20-21; Ray F. Herndonand StuartPfeifer, 7,000OrangeCounty Voters Were

GivenBad Ballots, Los ANGELES TIMES, March 9,2004, at
m es/7 OOOorangecoun tyv 0 tersweregi venbadba110ts.

The Hon. Henry McMaster July 19, 2004 Page13

DREs. In 21 precinctswherethe problemwasmost acute,therewere moreballots castthanregistered voters. Tallies at an additional 55 polling placeswith turnoutsmore than doublethe county average 37% suggest of at least5,500votershad their ballots tabulatedfor the wrong precincts. "OrangeCounty electionofficials havetracedthe problemto poll workers who were responsible giving eachvoter a four-digit codeto enterinto for the voting machines." San Bernardino County, California (March 2004).39 In SanBernardinoCounty,officials waited threehours for their new Sequoiavote countingcomputerto process resultsbeforeresortingto the shuttingdown the computerand startingover. This certainly incompletelist showsthat significantproblemswith DREs havebeen reportedacross country. This recordquestions the whetherDREs canbe trustedto function correctly evenwithout maliciousinterference. 2. A PaDerRecord Can HelD Security Problems

Not long after statesstartedwidely adoptingDREs, computerscientistsexpressed concernaboutthesemachines. After a voting machinemanufacturer mistakenlymadeits softwareavailableon the Internet,40 researchers discovereddauntingsecurityproblems later also shownby others.41 Basic securityprotectionswere missingor implementedin ways undergraduate programmingstudents would know to avoid. After thesereports,the stateof Maryland commissioned independent an study,in which computerexpertswere ableto alter a mock electionin minuteson a budgetof $750.42Ohio also commissioned a

39

Elise Ackemlan, Election Officials Report Some E-Voting Glitches, SAN JOSE MERCURYNEWS, March 4,

2004 at
.0 41

Voting activist Bev Harris downloaded Diebold sourcecodefrom an insecureFTP server. the

Kohno, Stubblefield,Rubin, Wallach,Analysisof an Electronic VotingSystem, JohnsHopkins/Rice University, IEEE Symposium on Security and Privacy 2004, IEEE ComputerSocietyPress,May 20'04, at http://www .eff.org/Activism/E-voting/20030724_evote_research_report.pdf Hopkins/Ricere~:>rt, (Johns originally publishedin August, 2003); ScienceApplicationsInternationalCorporation(SAIC), Risk Assessment Report: Diebold AccuVote-TS VotingSystem Processes and (Sep.2,2003), pdf; Compuware, Direct RecordingElectronic (DRE) TechnicalSecurityAssessment Report, commissioned the Ohio Secretary State(November,2003) http://www.voterwest.org/ohioby of compuware-study. pdf. 42 RABA Innovative Solution Cell (RiSC), Trusted AgentReportDiebold AccuVote-TSVoting System, (Jan. 20,2004) http://www.raba.com/press/TA_Report_AccuVote.pdf.

,

I'

I

The Hon. Henry McMaster July 19,2004 Page14

report in late 2003 that concludedthat all four DREs selected its bidding process in had high securityrisks, including Diebold and ES&S.43 It is notoriously difficult to promisecompletesecurityin a computingsystem. It is simply impossibleto anticipateall of the attacks,especiallyon a systemof greatvalue and greatcomplexity. Certification andtestingshouldprovide no solacefor untested, poorly implementedsecurity. Currentlythe main testingprovided on election systems is called "logic and accuracytesting," but thesetests,developed lever machines,have for not beensufficiently updatedfor useon DREs. The othermajor sourceof testingfor electionsystems the certification andqualification processes, are which are also widely belieyedto be insufficient. Moreover,both Diebold and ES&S havebeencaught circumventingeventhesemost minimal of tests. Diebold sold federallyunqualified electionmachines severalCalifornia countiesand installeduncertified softwareon its to electionmachinesin 17 counties.44 ES&S surreptitiouslyinstalled anduseduncertified softwarein Indiana.45 A sufficiently malicious attackon a voting systemcould be hiddenmany ways. It could be subtleby changingonly a portion of the votes. It could verify the resultson the screen and then changethe resultsinto a different sequence 1s and Os,the way the vote is of storedin the machine. The recountwould process samebad string of binary and the producethe sameincorrectresults. Worst of all, the resultscould be impossibleto detect. It is impossibleto predict whethertherewill be malicious interferenceor on what scalein upcomingelections. Eventhe most experienced computersecurityexpertscannot promiseprotectionon Election Day, but a paperrecordcould verify the results. 3. A Paper R~£o!:dWill Help_Recountin2

New electiontechnologywill alter SouthCarolinaelectionsdramatically. Before making this kind of changes, SouthCarolinashouldconsiderwhat it would like "recounting" to meanunderthis new technology.46 Without a paperrecord,the recountstraditionally relied on in SouthCarolinawill be largely empty gestures.Print-outsfrom the samebad codewill alwaysproducethe samebad results. It will be impossibleto take a setof recordsindicating true voter intent to a judge for review.

4:1

Ohio Secretaryof State,"Direct RecordingElectronic(DRE) TechnicalSecurityAssessment Report,"

(November21,2003), at http://www.sos.state.oh.uslsos/hava/filesicompuware.pdf.
44

StaffReport theInvestigation DieboldElection on of Systems, presented Secretary State Inc. to of

Shelleyand the Voting Systems Procedures and Panel(Apr. 20, 2004),at page4, at http://www .ss.ca.gov/ electionsltouchscreen.html. 4S Press Release, Marion County IndianaElection Board, "Marion County Clerk Doris Anne SadlerChaI'ges Election Systems SoftwareWith BreachOf Contract,"(April 20, 2004),at & http://www6.indygov.orgiclerk/election/press/04-04-20.htm.
46 S.C.Code Ann. § 7-17-280 (1976).

'I""

The Hon. Henry McMaster July 19,2004 Page15

Imaginea disastrous scenariosimilar to thoseseenallover the country. SouthCarolina could facea recountevenworsethan Florida's in 2000- no real recountat all. HA V A rightly delegates recountsto the states, if SouthCarolinavaluesrecounting,it should and implementa voter-verifiedpapertrail. II. Conclusion

HA V A creates obstacles SouthCarolinaimplementinga voter-verifiedballoting no to system. It is possibleto interpretthe HA V A audit requirementasrequiring suchballots, and future guidancemight requirethis protection. Voter-verified papertrails are a sound policy choicefor SouthCarolinabecause they guardagainstelectionfraud and errors. Physicalrecordsauthenticate computerized balloting andbring reliability to currently untrustworthyDRE electionsystems. EFF appreciates opportunityto shareour knowledgeofHA V A andthesenew this technologies.Weare happyto discussthis issueor othersrelating to electronicvoting machines further. Pleasedo not hesitateto contactus at (415) 436-9333x108 or Cindy@eff.orgif you have any questions concerns. or Sincerely, ELECTRONIC FRONTIER FOUNDATION

~~~(:::::~:2Legal Director Enclosures cc: Representative Neal Joe

"""

'I

i.Gl,

..::l;

.I

I

THE HA VA REQUIREMENT FOR A VOTER VERIFIED PAPER RECORD Darryl R. Wold I July 23,2003 This paper explains that the Help America Vote Act of 20022requires that any voting systemused in an election for Federaloffice must produce a paper record of the vote cast by eachvoter that has been seenand verified by the voter. HA VA further requires that this voter verified paper record be available for a manual audit of the voting system,and for any recount. HA V A requires, in section 15481,subdivision (a)(2)(B), that: "(i) The voting system shall produce a permanentpaper record with a manual audit capacity tor such system. "(ii) The voting system shall provide the voter with an opportunity to changethe ballot or correct any error before the permanentpaper record is produced. "(iii) The paper record. . . shall be available as an official record for any recount. . .." Taken together, theseprovisions requiring a "paper record" that is to be used for a "manual audit" for the "voting system" make it apparentthat HA V A requires a paper record that is seen,verified, and turned in by the voter. The suggestionhas been made, however, that the requirement ofa paper record to be used for a manual audit can be satisfied by a paper record of votes that is produced for the first time after the polls have closed - that is, a printout.of what the computer has stored, and that has never been seenby the voter. This interpretation, however, that a post-closing printout of what the computer has stored would satisfy HA V A, would permit an audit or a recount to be conductedon the content of a computer and not on a contemporaneous paper record of votes cast, and would make the requirement for a "manual audit capacity" virtually meaningless. Mr. Wold servedas chairman of the Federal Election Commission in Washington, D.C., during

1

2000, and as a Commissioner from 1998 to 2002. He is currently an attorney in private practice in Orange County, California. His practice emphasizes political and election law, including campaign finance compliance issues,ballot access,and recounts. His clients include AccuPoll, Inc., Irvine, California, a manufacturerof electronic voting systems.
2

Help America Vote Act of 2002 ("HA VA" in this paper), enactedas Public Law Number 107252, October 29,2002, 116 Statutes1704,and codified at 42 V.S.C. §15301 et seq.. All referencesin this paper are to 42 V.S.C. §15481unless otherwise noted.

1

A paper record consisting solely of ballots printed by the computer after the closing of the polls -- and therefore never seenby the voters -- would mean that a manual audit or recount would simply amount to reviewing what was stored in the computer. The audit or recount could not manually verify that the computer had accuratelyrecordedthe voter's intent, or had accurately stored that information, or had accuratelyprinted out that information. Both an audit and a recount, therefore, would miss the key elementof the system- whether the voter's intention had been accurately recorded. At most, even a complete manual count of paper ballots printed by the computer post-. closing could only verify that the computer had accuratelytabulated various totals - that is, that the computer had "done the math." Such an audit or recount could not manually determinewhether the computer had accurately made a record of voter intent - that is, that the paper record printed post-closing actually represented votes intendedto be cast by the voters. the An audit using a record of votes printed post-closing, of course,could not be considereda manual audit of the complete voting system- it would be a partial audit, at best, limited to the math performed by the computer. It would not be an audit of whether the voters' intent was accurately recorded by the computer- and that is the critical issue. HA V A's requirement of a "manual audit" compels the interpretation of "paper record" as meaning a record that has been seenand verified by the voter. First, it is apparentfrom the common meaning of the words "manual audit" that HA V A requires that this audit be conductedby visual examination and counting by hand, and not by machine. A common dictionary definition of "manual" applicable to this context is "worked or done by hand and not by machine." The term "audit" applicable to this context means"a methodical examination and review." (Both definition's from Webster's Ninth New Collegiate Dictionary. ) So far, therefore, we have a requirement for a methodical review by hand. The next question is: What is to be reviewed? HA V A provides that it is the "voting system" that is to be audited (§15481(a)(2)(B)), and defines the voting system as including "the total combination" of equipment that is used "(A) to define ballots; (B) to cast and count votes; (C) to report or display election results; and (D) to maintain and produce any audit trail information. . ." (§15481(b)(I)). In other words, the system to be audited is the complete processof casting and counting votes. There cannot be a "manual" audit of the casting of votes, of course,unlessthere is credible and contemporaneous evidence of the votes cast that can be reviewed by hand, as a check on the electronic portion of the system. Further, the critical issue in any voting systemis whether the systemhas accurately reflected voter intent. The question raised in counting the votes in Florida in the 2000 Presidential election, for instance,was not whether the machineshad accurately done the math it was whether the ballots that were counted actually reflected the voters' intentions. That issue

2

'"""",,---

i

,1

I

can be determined in an audit of a voting systemonly by examining what the voter has seenand approved -- a paper record reviewed and verified by the voter. The importance of a paper record verified by the voter is also emphasizedby HA V A's use of the term "audit" rather than someother term that would merely require some lower .level of examination. Requiring an "audit capacity" for the voting system,including the accurate recording of the votes cast, clearly contemplatesa paper record as the sourcedocument - as the original record of the voters' actions - and not a secondarydocumentproduced after the fact as evidenceonly of what is in the computer systemat that time. The distinction betweenan original paper record of an act and electronic records as indirect evidence is an important one in the field of auditing, as indicated by the standardsof auditing practice promulgated by the American Institute of Certified Public Accountants in its Statementson Auditing Standards(AICPA ProfessionalStandards,1998, American Institute of Certified Public Accountants,New York). The AICPA's "StandardsofField Work" require that "Sufficient competentevidential matter is to be obtained through inspection, observation. . . and confirmations to afford a reasonablebasis for an opinion." (AU § 150.02,~ 3.) Under "Nature of Evidential Matter" the standardsrecognizethat "Corroborating evidential matter includes both written and electronic information" (AU §326.17),and that "In certain entities, some of th~ accounting data and corroboratjng evidential matters are available only in electronic form" (AU §326.18). Thus, the AICPA standardsdraw a distinction betweena sourcedocument that is an original written record, on one hand, and an electronic record, on the other. The standardsfor field work original do not contemplatethat an electronic record printed out after the fact is the sameas. an writtenrecord. In this light, the significance of the HA V A requirementthat the systemproduce "a permanentpaper record" for use in a "manual audit" or a recount js again apparent. HA V A does not provide for a manual audit of an electronic record of votes cast (or of a printout of an electronic record, which is the samething). HA V A requires a permanentpaper record of votes cast, and that can only be read as meaning a contemporaneous paper record, that the voter has seenand verified. This distinction betweenan original paper record of a transaction or an act and electronic records as indirect evidence of that matter is also found in standardspromulgated for government auditing promulgated by the Comptroller General (Government Auditing Standards,2003 Revision, General Accounting Office, June 2003), which incorporate the AICP A standardsfor field work for financial audits (§4.01). In addition to financial audits, government audits also include performance audits. In that context, the field work standardsrequire that "Sufficient, competent,and relevant evidence is to be obtained to provide a reasonablebasis for the auditor's fmdings and conclusions" (§7.48). Guidanceprovided for concluding what constitutes "sufficient, competent,and relevant evidence" provides that "Evidence obtained through the auditors' direct physical examination, observation,computation, and inspection is more competentthan evidenceobtained indirectly" (§7.53, ~ b) and "Examination of original documentsprovides more competentevidencethan do copies" (§7.53, ~ c). Thus, these government auditing standardsalso contemplatethat an original written record is the better evidence of a fact than indirect evidenceor a copy. Applied to the context of an audit of a voting

3

system,it is apparentthat a paper ballot that the voter has seenand verified is better evidence than a printout of an electronic record that the voter who purportedly createdthe record hasn't seen. In summary,it is apparentthat the requirementof HA V A that a voting systemused in a Federal election provide a paper record for a manual audit can be satisfied only by a systemthat producesa paper record that the voter seesand verifies, and that is retained by the election official as the record of votes cast for purposesof an audit and any recount. This statutory requirementis not a bare legal requirement without practical significance. To the contrary, a paper record that has been reviewed and verified by the voter is an essential elementof a transparentand open voting system. A voter verified paper record that will be available for an audit of the systemand for any recount greatly reducesthe possibility of fraud and provides a meansof detecting and correcting unintentional error in the electronic system. Equally importantly, it assures eachvoter that the vote has been accurately cast, and that there is a paper record of that vote to serveas a check on the electronic system,and eliminates the suspicion of impropriety. An open and transparentvoting systemincreasesthe voters' confidence in the systemand the public's trust in the results. It is an essentialelement of the democratic processby which we elect the governmentof this great republic.

4

I
c ~ ., - ~.. c ,i.1'"
,,~

JOHN Ei'ISiei'I"

NEVADA' "
COMMITTEES BANKING HOUSI,\jG A~ID URBAN AFF.o1JRS

~~ ~

.,"-

,-~

364:~I.;SSEl':c"..~!

:'"'.c~ aU:l:1NG

nl- t ~~ ~
W P
\"\~"

N..S""'O,ON. wC .CS,O-2:JC" (2021224-0244 to",,! l.U

!f ~
.0

~

~

~ ~

ngt".
\

~

333

~~ s IEu"S 30Ul.,'.."C.
;)1.;.0 3~" 3 ~ I~ 4. ~,; iO~~,;.".j,3';! -r-' -"8- "

5cl.;",!,

~.~ ~., .;~~M~AERCE.S,",,~NC~..-,"jD

,

":'RANSPORTAT:Cl-i
SMALL BUSINESS

"

I -, ~I ,- ~ ~~~.", ~<; ~ ~H.\ Ir:"!"~\ 1 ~c: -,,~ ",,-,,- C-

\, _L. -~

-cC 5

Si'ECIALCOMMI:-:-~:.:), ~G;IIG 0.;.): ,;-.1;..;'.;0-'=05.."', ;c.:.
:,,"501"

May 29, 2002 Senator Mitch McConnell Committeeon Rules andAdministration 305 Senate RussellBuilding Washington D.C. 20510 Dear Senator McConnell:

'7;:i3S5-~~.1

:;'!V 'N 397!J1

\

As you know, during Senate consideration ofS. 565,the Equal Protectionof Voting Rights Act of2001, I introducedan amendment which was passed voice vote. This amendment by requires electronicvoting systems producea permanent to paperrecord to be usedas an "official record" for recounts.As you continueto work to reconcilethe differencesbetweenthe Houseand Senate versionsof this legislation,I askthat you supportthis important amendment. This amendment simple. It would give voters a receiptat the time their ballot is cast,and is allow the voter to confirm, and,if necessary, change vote before eachballot is cast. 11ris the receiptwould then be set asideas a permanent recordof that election. This would instill confidencein new, paperless touch-screen voting machines would also provide a backup and recordin the eventof a recount. To find a needfor this legislation,one needlook no further than the 2000 Presidential Election recountin Florida. Had a reliable backupof eachvotebeenavailable for the recount,this countrywould not havehad to endurethe long controversialcourt battle that resultedbecause of the inconclusiverecountresults. This amendment would ensurethat everyvoter hasthe chance to verify eachselectionbeforethe vote is cast. I haveenclosed copy of this amendment includedin the Senate a as version of the Equal Protectionof Voting Rights Act of2001. If you would iike more iIlformation, pleasedo not hesitateto contactCarrie Schroeder 224-4430. Thankyou for your continuedhard.workon at this importantlegislation. Sincerely,

~
JE/cas

1" C:;~
/J
:

~

JOHN ENSIGN United StatesSenaor

'~

::
':"'!"c.,.,..,

.;'~

~l';~