00523-20040719 letter to sc att gen

8/14/2019 00523-20040719 Letter to SC Att Gen

http://slidepdf.com/reader/full/00523-20040719-letter-to-sc-att-gen 1/20

<:

~t~=~~n~ p~m-::~F!e~:~~t~~~~~~~~e-;'

July 19,2004

Via Overnight Delivery

The Hon. Henry McMasterAttorney General,Stateof SouthCarolina

P.O. Box 11549Columbia,S.C. 29211

andRembertDennisBuilding1000AssemblyStreet,Room 519Columbia,S.C. 29201

RE: Request rom RepresentativeJoe Neal,HA V A and E-Voting Choices or South Carolina

Dear Mr. McMaster:

SouthCarolina s choosingnew voting technologieso comply with the federal HelpAmerica vote Act (HA V A).l We understandhat, as Attorney General,you havebeenaskedby RepresentativeoeNeal to considerhow HA V A applies o the electronicvotingtechnologies nown as direct recordingelectronic DRE) that havebeenchosenasfinalists n the bidding process n SouthCarolina. Specifically, you havebeen asked oconsiderwhether he stateshould equire a voter verified paperballot (VVPB), a widely

recognized ecurityand auditability enhancement ow requiredby three other statesandsubject o pending egislation n severalmore, aswell as ederally. The ElectronicFrontier Foundation,a leading echnology ights organization,2 rovides his analysis oassistyou. We conclude hat, while authoritiesdisagreeaboutwhetherHA V A itselfrequiresa voter verified paper rail, requiring sucha trail is consistentwith SouthCarolina's dutiesunder HA V A and s a wise policy choicegiven the anticipatedadditional ederal egulations or voting machinesand he problems hat have alreadyoccurredwith the use of theseelectronicvoting machines n actualelections.

1 Help America Vote Act of 2002, 42 U.S.C.A. §§ 15301-15545West Supp.2003).

2TheElectronic rontierFoundation"EFF") s a nonprofit ublic nterest rganizationedicatedoprotectingcivil liberties and ree expressionn the digital world. Founded n 1990,EFF has over 13,000paying membersand epresentshe nterestsof Internetusers n court cases nd n the broaderpolicydebates uri-oundinghe applicationof law in the digital age. EFF publishesa comprehensive rchive of

digital civil liberties nformation at one of the most inked to websites n the world, <http://www.eff.org>.EFF representsndividuals and a small nternet ServiceProvider hreatenedwith copyright iability byDRE vendorDiebold for publishing embarrassingnternale-mails online in a caseentitled Online PolicyGroup v. Diebold, currentlypending n the Northern District of California and has iled amicusbriefs inseveralof the awsuitscurrently pendingconcerningelectronicvoting machines. EFF currently has over 25

members n SouthCarolina.

well Street. San Francisco, CA 94110 USA

0+14154369993 Owww.eff.org [email protected]



The Hon. Henry McMaster

July 19,2004Page2

I. Introduction

Since he hanging chadsdisaster n Florida 2000, more attention han ever hasbeendevoted o the mechanicsof elections. Many stateswishing to avoid Florida's problemsquickly replaced heir old voting technologieswith newerones,often before hosesystems ave beenproperly testedor even ully developed.Vendorshave rushedsystemsto market o take advantage f this concern,plus the flood of federal unds provided nHA V A. SouthCarolina's bidding process as esulted n threeDRE systemsmaking thefinal round. DRE systems iffer from other kinds of election systems ecauseheydirectly record a vote nside a computerized ystem ather han on a piece of paperor viamechanical evers. All record of the vote resideswithin the computer. The voter orelection officia};attemptinga recountor audit has no independentnformation with whichto verify that the vote hasbeen ecordedcorrectly or that it hasbeen ransportedwithin

the machineand o the tally machinewithout changeor error.3Since he adoptionand mplementationof DREs, substantialerrorshave occurredduringelections, ncluding errors esulting n significant voter disenfranchisement nd, n atleastone case~he need or an election o be reheld.4 Additionally, computerscientistsnationwide have expressed oncernabout he security and auditability of DREs, notingthat the current designof the machineseaves hem vulnerable o malicious altering thatwould be difficult to trace. Fortunately, here s a simple solution hat can help uncover,if not prevent,suchproblems. This solution ensureshat even f the machinemalfunctions, he voters ntentionsare ecorded n a second ocation and can be properlycountedas cast. Called a "voter verified paperballot" or VVPB, the proposal sstraightforward. It requires hat the printer alreadysuppliedon most DREs print out the

vote at the time it is castso that the voter canreview it. If the summary s correct, tdrops nto a ballot box. Ifit is not, the vote s cancelledand he voter can start over.5The addition of a VVPB works on a very basicprinciple- that two records eflecting thevoters ntention arebetter han one. Severalelection systems hat provide a VVPB havebeen ederally qualified6and Nevadawill use a VVPB system n the Novemberelections.

) Another technology hat is allowed by HA V A is called "optical scan." This allows voters o continue o

mark their preferences n paperwhich is then scannednto a computer or counting. Thesesystems

inherentlyprovide an audit trail and are widely recognized s more reliable han DREs. They also haveboth paperand computerizedways o assistdisabled ndividuals n marking their ballots. Since SouthCarolina hasapparentlynot chosenany of these echnologiesn its recentbidding, we will not discuss hemhere. We would be happy o provide additional nformation on thesesystems pon request,however.

4 Seenote aboutHinds County, Mississippi on page 10, nfra.

S Note that the printout is not retained,or under suchsystemseven ouched,by the voter.

6 Accessibility and Auditability in Electronic Voting, EFF White Paper May 17, 2004), available at

http://www.eff.org/e-vote/e-vote_white-paper_20040517.php.n addition, Avante's systemwas federally

qualified in June.



oC

~

TheHon.HenryMcMaster

July 19,2004Page3

To assist he Attorney General n his consideration f whetherWPBs shouldbe requiredin SouthCarolina,EFF provides irst, a summaryof the Help America Vote Act

provisionsconcerningauditability of machinesand he currentdebateaboutwhether hatprovision requiresa VVP8. Next, we will explain he upcomingcertification decisionsthat will be made ederally and hat could affect South Carolina's ability to use DREswithout a VVPB in the future. Finally, we will explain why we believe that requiring thatvendorsproviding systems o SouthCarolinaprovide a VVPB is the correctpolicydecision or SouthCarolina and supported y HA V A.

A. The HelD America Vote Act of 2002

The Help America Vote Act of 2002 (HA V A) modernizes lectionsby encouragingand

eventually orcing new voting technologit:s. f stategovernmentsmplement systemsmeetingHA V A guidelines precinct-countoptical scanmachinesor DREs - by 2004,

they canreceive ederal unding. Statesmust comply with HA V A requirements yimplementing hesesystems with someexceptions) y 2006 or all federal elections.HA V A mandates n audit trail as a "uniform non-discriminatory equirement" or allsystems y 2006, or 2004 for systems eceiving unding. Federalguidelines nconjunctionwith HA V A havenot been ssuedyet, but it is clear hat HA V A doesnot pre-empt a voter-verified record and could evenbe interpreted o require one.

1. StatesAre not Prohibited from ReQu!ring PaRerTrails: SomeHave

Already Acted

HA V A makesspecific requirements, ut still leaveswide discretion o states o run

electionsand makepolicy choices.7Requirements eyond he HA VA's are explicitly

allowed:

The requirements stablished y this title areminimum requirements ndnothing n this title shall be construed o preventa State rom establishingelection echnologyand administration equirementshat aremore strictthan he requirements stablished nder his title. . .8

Most stateelection aw is already ar beyondminimum HA V A requirements: allotlisting requirements, oll locations,audits, ecounts,supervision,andmore. Local orstate esting, certification, and sealingof voting machinesare all beyondHA V A, and all

are standard ractice across he country.

1 See42 U.S.C.A. § 15404 West Supp.2003) (planning or complianceby states);42 U.S.C.A. § 15485

(West Supp.2003) (leaving discretion o states o implementpolicies).

g42 U.S.C.A. § 15484 West Supp 2003).




July 19,2004Page4

States are mandating voter-verified paper trails as well. Nevada, the first state to do so,

will have voter-verification by November 2004. By 2006, California and Ohio will also.9

Over a dozen states have pending legislation. 10 In addition, several bills pending inCongress would expressly require a paper trail. I I

2. HA VA Could Be Interoreted to ReQuire Voter Verification

Several commentators, including one of the Senators who drafted HA V A, maintain that it

requires voter verification. The 2006 mandatory uniform nondiscriminatory requirementsinclude alternate language access,disabled access,provisional voting, and several other

requirements. The language in question regarding audit capacity is also a mandatory

nondiscriminatory requirement:

(2) Audit capacity.

(A) In general. The voting system shall produce a record with an audit

capacity for such system.

(B) Manual audit capacity.

(i) The voting system shall produce a permanent paper record with a

manual audit capacity for such system.

(ii) The voting system shall provide the voter with an opportunity tochange the ballot or correct any error before the permanent record is

produced.

(iii) The paper record produced under subparagraph (A) shall be available

as an official record for any recount conducted with respect to any electionin which the system is used.12

9 KatherineQ. Seelye,DemandGrows o RequirePaper Trailsfor Electronic Votes,New York Times, The

2004 Campaign:Voting Machines,at 20 (May 23,2004). Ohio passedegislation n May, H.B. 262(2004). The Nevadaand California Secretaries f State ssuedorders o similar effect.

lold.II SeeH.R. 2239, 108thCongo 2003), at http://frwebgate.access.gpo.gov/cgi-

bin/getdoc.cgi?dbname=108_con~bills&docid=f:h2239ih.txt.pdf; . 1980, 108thCongo 2003), atS.

2045, 108thCongo 2004), at http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=108_con~bills&docid=f:s2045is.txt.pdf;. 2313, 108thCongo 2004), at

S.

1986, 108thCongo 2004),at http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=08_con~bills&docid=f:s 1986is.txt.pdf.

1242U.S.C.A. § 15481(a)(2) West Supp 2003).




July 19,2004Page5

The most convincing argument hat § I 548 (a)(2) requiresvoter-verification s a four-pagepaperby former FEC chairmanDarryl R. Wold.i3 Wold relies heavily on the

definition of "manual audit capacity,"arguing hat a manualaudit is meaninglesswithoutvoter-verified ballots. Relying on the ong history election ecounts,he emphasizeshumanoversightand udgment n a manual ecount. He argues he auditing requirementis "not a bare egal requirementwithout practical significance. To the contrary,a paperrecord hat hasbeen eviewedand verified by the voter s an essential lementof a

transparent nd openvoting system."i4

Language y Senator ohn Ensign of Nevada,authorof the amendmentncorporatedasthe relevantaudit section,hasadded o the debate. His statemento the conferencecommitteeduring the egislative debateon HA V A abouthis amendment hows ntent to

make he audit voter-verified:

[Amendment2900] is simple. It would give voters a receipt at the timetheir ballot is cast,and allow the voter to confirm, and, f necessary,ochange he vote before he ballot is cast. This receiptwould then be setasideas a permanent ecordof that election. This would instill confidencein new, paperlessouch-screen oting machinesand would also provide abackup ecord n the eventof a recount.s

SenatorEnsign's etter to the editor n the New York Timesstateshis amendment equires"that votersusing electronicvoting systems e able o review their ballots before castingthem to confirm and, f necessary, hange heir votes. A paperballot would then be setasideas a permanent ecord."i6 Thesestatementsmake a strongcase or the requirement,but other nterpretationsarepossible,and other Senators nd egal analystsdisagreewith

SenatorEnsign and Mr. Wold.

It is possible o think aboutwhat a "manual audit capacity" meanspractically, as ormerCommissionerWold did, and concludeH.A..A requiresvoter verification. It is alsopossible o view the requirementas oo vague o containa technicalmandateor tointerpret he audit requirementasrequiring recordsat, say,poll closings. Allinterpretationsare merely viewpointsuntil this statute s litigated or the federalgovernment ssuesguidance. Under any nterpretationofHA V A, however,SouthCarolina s free to implement a voter-verifiedpaperballoting system f it chooses.

13 Darryl R. Wold, TheHAVA Requirementfora Voter VerifiedPaper Record,July 23,2003,http://www.verifiedvoting.org/resources/documents/HAA_Requirement_for- VP_Record. df. We

attacha copy for your cortvenience s Exhibit A.

1. fd. at 4.

IS Letter from Sen.JohnEnsign o Sen.Mitch McConnell (May 29,2002), attached s Exhibit B.

16 John Ensign, Editorial, How to Make Sure That Your Vote Counts, N.Y. Times, Dec. 15,2003, at A26.




July 19,2004Page6

3. Guidance Has not Been ssued vet: Future ReQuirementsMi2ht Mandate

Voter Verification

Not only is SouthCarolina ree to implementa VVPB, the changing ederal egulationsand guidelines or voting systemsndicate hat sucha decision s likely to be far-sighted.Decisionsaboutnew requirements nd standards re n processn severalareasand neacharea,VVPB is being seriouslydiscussed.Should ederalstandards e changed orequirevoter verification, SouthCarolinacould face he problem of, at best,havingpurchased utdatedmachinesand at worst, having o replace ts new machines n the near

future.

First, federal guidelines o implementHA V A havenot been ssuedyet. The HA V A-createdadministrativebody, the Election AssistanceCommission EAC), is developing

them and many participating n the processareurging a paper rail. Though any suchguidelinesare unlikely before he Novemberelections,EAC could easily recommendapaper rail by 2006 and many of thoseconsultingwith the EAC areurging this.

The first federal echnicalstandards boutelection equipmentwere ssuedby the FEC in1992. Thesevoluntary FEC standardswere ast u~dated n 2001, and HA V A maintainsthis set as he currentdefault technicalstandards. SouthCarolina equirescompliancewith thesestandards mongother restrictions.S The successoro thesestandards hould

be issuedsoonby the EAC, working with severalother bodiescreated or the purposeofdrafting generalvoluntary technicalstandardsor electionequipment. 9

The EAC will also ssuevoluntary guidanceaboutHA VA's nondiscriminatoryrequirements oon. For 42 V.S.C. § 15481,which contains he audit requirement, heEAC was required o issuevolunt~ guidanceby January2004,but late appointmentofthe EAC itself delayed his process.0 It is possible hat either setof standards,he

general echnical guidelinesor the non-discriminatory equirementguidelines,could

mandateor suggesta voter-verified paper rail.

Additionally, the ndustry representative rganization, he Institute of Electrical andElectronicsEngineers IEEE), has ts own election equipment tandards lso,but theywill not be updated n time for the 2004 elections. Tllcse standards o not currently

17This duty was delegated o the FEC's Office of Election Administration. For more on the FEC standards,

seePeggySims & Brian Hancock,FederalElection Commission,TheFederal Election Commission'sOffice of Election Administration and ts Role n the Voting SystemStandardsProgram (2002), available at

http://63.206.28.66/pdfs/OEA.pdf.18 S.C. CodeAnn. § 7-13-1620 1976).

1942U.S.C.A. § 15362 (West Supp.2003).

2042U.S.C.A. § 15501 West Supp.2003).



The Hon. Henry McMasterJuly 19, 2004Page7

include VVPB, but the IEEE plans o revise ts standards eavily soon after the 2004elections. Currentdrafts of the revisions nclude standardsor VVPB.

B. A Voter-Verified PaDerTrail Is a Sound Policv Choice for South Carolina

As noted above,SouthCarolina s free o implementa voter-verifiedpaperballot underfederal aw, and given upcomingstandardst might savemoney and effort in the ong runby doing so. Moreover,given the manifestproblems hat DREs without voterverification present or election securityand eliability, the ntegrity of South Carolina'selectionswill be greatly enhanced y acting now.

Put simply, while DREs may hold promise or the future, hey are simply not ready o betrustedwith our most mportantdemocrC1[icechanism our elections. Mechanical

failures, software ailures, and simply wlexplainable ailures haveplaguedelectionsusingDREs. Serioussecurity hreats100m; omputerexpertsnote hat relativelyunsophisticatedechnicalpersons ould alter entire electionswithout detection. Thesethreatscanbe mitigated with simple echnology:a voter-verified paperballot. This ballotwould createa paper rail, just like thoseSouthCarolinahas ong beencanvassingncloseor contested lections. The addition of a VVPB fulfills a basic maxim of bothelection and generalauditing: two setsof books arebetter han one.

1. A PaRerRecord Miti2ates Technical or Other Falline:

DRE malfunctionsandpollworker errors n using thesecomplicated echnologiesduringelectionshavebeenwidespread, esulting n significant disenfranchisement nd

uncertainty n election esultsaround he country. Even without interference, hesemachinesoften performedunacceptably!1 Many of theseproblems nvolve Diebold and

ES&S technologies, endorschosen n SouthCarolina's recentbidding process:

A. Diebold

Maryland (November 5, 2002)!2

Voters using Diebold DRESwatchedas hey voted for the Republicancandidate or governorand he 'X' appeared eside he nameof theDemocraticcandidate.The machines sedwere Diebold DREs with no

21 This list of problemssubmitted o the federalcourt n Benavidez . Shelley. Amicus Curiae Brief of

Electronic Frontier Foundation "EFF"), the California Voter Foundation, he Verified Voting Foundation,and Voters Unite!, Benavidez . Shelley,2004 U.S. Dist. LEXIS 12587 C.D. Cal. 2004). The court hassubsequently ff1rn1edhe California Secretary f State'sorder decertifying certainvoting systemsandrequiring voter verification in the future. The full amicusbrief is availableathttp://www.eff.orgiActivism/E-votingiBenavidezJ2004058-benavidez- micus.pdf.

22 Glitches cited at some olls ..., " THEWASHINGTONIMES,November6, 2002.




July 19,2004Page8

paperballot so the machines ould not be audited. "I pusheda Republicanticket for governorand his namedisappeared," aid Kevin West of Upper

Marlboro. "Then the Democrat'snamegot an X' put in it."

MuscogeeCounty, Georgia (November 4, 2003)!3

Allegations of widespread omplaintsby citizenswho voted "no" on asales ax propositionbut saw Diebold machines egister yes" causedcounty officials to take he machineout of serviceduring the election.

RobesonCounty, North Carolina (November 2002).24

Ballot tabulatingmachinesby Diebold failed to work properly n 31 of 41precincts. Local election officials said he problem was he result of a

softwareprogrammingerror, andballots from the ndividual votingmachineshad o be retabulated.

San Diego County, California (March 2, 2004).25

Delayedopeningof55% of the polling places,573 out of 1038pollingplaces,due a problemswith the batteries n Diebold voting machines. Theproblemscausedan unexpectednitial login screenso appearon themachines,preventingproper encodingof electronicballot cardsat thosepolls. Due to the county's decisionnot to provide paperballots at thepolling placesas a back up, many voterswere turned away and old to

return ater. There s no reliable estimateof the numberof voters whoreturnedas opposed o thosewho were unable o return and vote ater.

23 Mark Rice, NAACP disputes ales ax results,DuBosefiles complaint n MuscogeeSuperior Court,

LEDGER-ENQUIRER,ovember 13,2003.24 The AssociatedPress,Voter urnout surprisesofficials, SUNNEWS,September 2,2002, at

http://www .myrtlebeachonline. com/midi sunnews/news/local/ 4056664 .htm.

Z5Office of the Secretaryof State,Report on the March 2, 2004 StatewidePrimary Election (April 20,

2004. http://www ss.ca.gov/elections/ks_dre-papers/march_2_report_fmal.pdfhereinafter March 2Election Report") at 17; Official Reportof the Chief Administrative Officer of SanDiego County, athttp://www signonsandiego.com/news/poltics/county/2004031-1315report.html.Jeff McDonald and LuisMonteagudo r., Poll Workers,VotersCite Tied-UpHotline, Poor Training, Confusion,UNIONTRIBUNE;March 7, 2004, http://www signonsandiego.com/news/politics/20040307-9999-ln7vote.html.morecompletedescriptionof many of the problemswith DRE machines ncluded n this brief is included n the"Myth Breakers" eport attached o the Declarationof Ellen Theisenunder FederalRule of Evidence 1006,filed herewith.




July 19,2004Page9

26Montgomery County, Maryland (March 2, 2004).

At leastone voter using Diebold electionequipmentwas not presentedwith a completeballot. After castinghis vote, he realized hat the Senateracehad not beenpresentedo him for his vote. When he complained, hepoll workers irst told him, "Once you've castyour vote, you can't voteagain." A poll worker asked f the voter had pressed he magnificationbutton. The worker said hey knew that the error occurredwhen hemagnificationbutton had beenpressed.

San Diego County, California (March 2, 2004).27

Ten voteswere nexplicably ost at one polling placeusing he DieboldTSx DRE. An election nspector n SanCarlossaid when polls closedat 8p.m. Tuesday, he numberof peoplewho signed he voter log differedfrom the numberof ballots countedby computers."We lost 10 votes,andthe Diebold technicianwho was herehad no explanation,"he said.

Alameda County, California (March 2, 2004 and October, 2003):8

A report released n April 12, 2004,by Diebold Election Systems howsthat nearly 25% of its ballot encoders, 86 of763 encoders,ailed onelectionday because f hardwareor softwareproblemsor both. l.ocalnews reported hat "no electronicvotes could be cast hat morning at AnnaYates ElementarySchool." Voters were urned away rom the polls,

losing their opportunity o vote n the primary as well ason other ssues.Failuresof votercard encoders lso occurredon SuperTuesday n Newark,SanLeandro,Emeryville, Oakland,and acrossSanDiego County.Diebold also admitted n its April 12, 2004, eport that tabulationerrorsduring the October2003, recall electionwere due o softwarebugs.

26 Jeffrey F. Liss, Think You Voted n Md.? ThinkAgain, WASHINGTONOST,March 7,2004, at

http://www.washingtonpost.com/wp-dyn/articles/A38008-2004Mar6.html;iveca Novak, The Vexationof

VotingMachines,TIMEMAGAZINE t 42 (May 3, 2004).27 Seealso Jeff McDonald and Luis Monteagudo r., Poll Workers,VotersCite Tied-Up Hotline, Poor

Training, Confusion, supra.28 March 2 Election Reportat 18; an Hoffman, VotersShort ChangedAt ThePolls, OAKLAND RIBUNE;

March 7,2004, at http://www.oaklandtribune.com/Stories/O,413,82-1865-200227700.htm1; anHoffman, Diebold ReportsMultiple Problems:Registrar WantsReasonFor E-Voting, TRI-VALLEY

HERALD, pril 13, 2004, at http://www.trivalleyherald.com/Stories/0,1413,86-10671-2080327OO.html.




July 19,2004Page10

B. ~

Wake County (Raleigh), North Carolina (November 2002)}9

Electronic voting machinesby industry eaderES&S failed to count 436ballots castat two Wake County early voting locations. The vendorconfirmed hat the machineshad defective irmware that caused omevotes not to be recorded. The county returned o using ts optical scanmachinesand hasdecidednot to purchaseDREs.

Broward Counties, Florida (January 6, 2004).30

In a specialelection or the StateHouseDistrict 91 seat,with only oneitem on the ballot, ES&S electronicvoting machines howeda total of 134undervotes that is, 134 ballots n which voters did not selecta candidateeven hough t was a single-race lection. The winner, Ellyn Bogdanoff,received 12 more votes han he runner-up. Florida law requiresa manualrecountof invalid voteswhen he winning margin s less han one-quarterof one percent. However, electionofficials determined hat no recountwas requiredbecausehe 134 nvalid voteswere caston electronicvotingmachines,and here s no record of the voter's original votes.

Dallas County, Texas (October 22, 2002).31

The Democrats aid hey receivedseveraldozencomplaints rom people

who said hat they selecteda Democraticcandidate ut that their vote onan ES&S DRE appeared eside he nameof a Republicanon the screen.Somevotes cast or Republicanswere counted or Democrats. The articlepoints out that the previousyear, he outcomesof 18 suburbanDallasCounty elections emaineduncleardaysafter the electionbecause f vote-countingproblemson the samemachines. About 5,000of nearly 18,000ballots castduring the early voting period were not properly assignedocandidates.

29 Seehttp://www.verifiedvoting.org/resources/documents/ElectronicsInRecentElections.pdf.

)0 JeremyMilarsky and Lisa J. Huriash,Electronic VoteRecountStumpsBroward Officials, SUN-SENTINEL,

January10,2004.)1 Ed Housewrightand Victoria Loe, Area Democratssay early votesmiscounted,Court hearing delayedas

meeting planned on touch-screen problems, THE DALLAS MORNINGNEWS, October 22, 2002.



The Hon. Henry McMasterJuly 19, 2004Page I

Miami-Dade County, Florida (May 20, 2003).32

An internal review of election esultsby a Miami-Dade county electionofficial found that a DREsystem sold by ES&S and used n the May 20,2003 North Miami Beach unoff election as well as n earlier elections)was "unusable" or auditing, ecountingor certifying an electiondue to a

"seriousbug" in the software.

c. Other Vendors

Hinds County, Mississippi (November 4, 2003).33

A VS Voting machinesat somep.Jllingplaces n District 29 failed to startup. Othersoverheated nd broke down during the election,and notenoughpaperballots were available o allow all voters o vote. TheMississippi Senate ecided t was mpossible o determine he will of thevoters. It declared he election nvalid, and a new electionwas held on

February10,2004.

Bernalillo County, New Mexico (November 5, 2002).34

Insufficient memory capacity or the Sequoia oftwareused o tabulate hevotes causedabout25% of the votesnot to be counted n the nitial tally.Although about48,000peoplevoted on 212 DREs, he nitial figuresgiven to the commissionersndicated hat no race,not even or governor,

showeda total of more han about36,000votes. Apparently heMicrosoft SQL 6.5 softwareprogramused o report all of the voteshad acapacityof only 64 kilobytes of data at a time. Any more than hat fed tothe eporting rogramn onechunkwassimplynot tallied.

32 Matthew Haggman,Count Crisis? Election Officials Wam of Glitches hat May Scramble VoteAuditing,

MIAMI DAILV BUSINESS REVIEW, May 16, 2004, athttp://www.law.com/jsp/newswire_article.jsp?id=1084316008117;harlesRabin, Glitch Forces Chang.?n

VoteAudits, THEMIAMI HERALD,May 15,2004, at

http://www.miami.com/mld/miamiherald/news/local/8671922.htm.33 Clay Harden,Long lines, machinemalfunctionsmark today's voting, THECLARION-LEDGER,ovember

4, 2003, at http://www.clarionledger.com/news/0311/04/mvproblems.html;ulie Goodman,District vot~~set; contendermay quit, Democratsayshe's "been hrough enough" n disputedSenate ace, THE

CLARION-LEDGER,anuary21, 2004, at http://www.clarionledger.com/news/0401/21/ma04.html.

34 Frank Zoretich, Election Results Certified After Software Blamed, ALBUQUERQUE RIBUNE,November

19,2002, at http://www.abqtrib.com/archives/news02/111902_news_vote.shtml.




July 19,2004Page12

Boone County, Indiana (November 2003 Municipal Election).35

Electronicvote-tabulationequipmentby vendor Microvote reported hat140,000 oteshadbeencast n a county of 50,000 esidents. Only 19,000of those esidentswere registered o vote and only 5,352voted. Thetabulationmachinehad not been nitialized and t was set o give excessivenumbers o call attention o the error. The county clerk said t wasobvious he numberswere wrong since he county s small, but shewondered f the error would havebeennoticed n a large county.

Fairfax County, Virginia (November 4,2003).36

Somevotersusing AdvancedVoting SolutionsDREs watchedas he 'X'they put beside he nameof RepublicanSchoolBoard Member,RitaThompson,dimmedout andmoved o her Democraticopponent. Ms.Thompsoncomplainedand one machinewas tested. Surprisedofficialswatchedas he machinesubtracted pproximately out of 100votes orMs. Thompson. .

Harris County, Texas (November 4,2003).37

Hundredsof Houstonareavoterswere disenfranchised ecause fproblemswith the Hart lntercivic electronicvoting machines.Specifically, voters at two polling placeswere told to comeback aterwhen machinesmalfunctioned,and at one polling place election udges

had voterswrite their choicesdown on paper.

Orange County, California (March 2004).38

Approximately 7,000voterswere presentedwith the wrong ballots due oproblemswith pollworker understanding f complexHart Intercivic

3S Grant Gross, Voting machine glitch shows thousands of extra votes, IDG NEWSSERVICE,November 13,

2003,at http://www.itworld.com/Tech/2987/031113votingg1itch/.36 Cho, Fairfax Judge Orders Logs Of Voting Machines Inspected, WASHINGTON OST,November 6, 2003,

at BO1, at http://www.washingtonpost.comlac2/wp-dyn?pagename=artic1e&node=&contentld=A6291-2003Nov5&notFound=true.37 11News Staff Reports,Polling machineproblemsanger manyvoters,November4, 2003, 07:27 PM

CST, athttp://www khou.cominews/10cal/houstonmetro/stories/khou03114_mh-po11ingprobs.la536189htm1

38 March 2 Election Report at 20-21; Ray F. Herndonand StuartPfeifer, 7,000Orange County Voters Were

GivenBad Ballots, Los ANGELESIMES,March 9,2004, at

m es/7 OOOorangecoun tyv 0 ersweregi venbadba110ts.



The Hon. Henry McMasterJuly 19, 2004Page13

DREs. In 21 precinctswhere he problem was most acute, hereweremore ballots cast han registered oters. Tallies at an additional 55 polling

placeswith turnoutsmore than double he county average f 37% suggestat least 5,500votershad their ballots tabulated or the wrong precincts."OrangeCounty electionofficials have raced he problem o poll workerswho were responsible or giving eachvoter a four-digit code o enter nto

the voting machines."

San Bernardino County, California (March 2004).39

In SanBernardinoCounty, officials waited hreehours for their newSequoia ote countingcomputer o process he resultsbeforeresorting o

shuttingdown the computerand startingover.

This certainly ncomplete ist shows hat significant problemswith DREs havebeenreportedacross he country. This record questionswhetherDREs can be trusted o

function correctly evenwithout malicious nterference.

2. A PaDerRecord Can HelD Security Problems

Not long after states tartedwidely adoptingDREs, computerscientistsexpressedconcernabout hesemachines. After a voting machinemanufacturermistakenlymade ts

softwareavailableon the Internet,40esearchers iscovereddauntingsecurityproblemslater also shownby others.41Basic securityprotectionswere missing or implemented nways undergraduate rogrammingstudentswould know to avoid. After these eports, he

stateof Maryland commissioned n ndependent tudy, n which computerexpertswereable o alter a mock election n minuteson a budgetof $750.42Ohio also commissioned

39 Elise Ackemlan, Election Officials Report Some E-Voting Glitches, SAN JOSEMERCURYNEWS, March 4,

2004 at

.0 Voting activist Bev Harris downloaded he Diebold sourcecode rom an nsecureFTP server.

41 Kohno, Stubblefield,Rubin, Wallach,Analysisof an Electronic VotingSystem, ohnsHopkins/Rice

University, IEEE Symposium on Security and Privacy 2004, IEEE ComputerSocietyPress,May 20'04,at http://www eff.org/Activism/E-voting/20030724_evote_research_report.pdfJohnsHopkins/Rice e~:>rt,originally published n August, 2003); ScienceApplications nternationalCorporation SAIC), Risk

Assessment eport: Diebold AccuVote-TSVotingSystem nd ProcessesSep.2,2003),

pdf; Compuware,Direct RecordingElectronic (DRE) TechnicalSecurityAssessment eport,

commissioned y the Ohio Secretary f State November,2003) http://www.voterwest.org/ohio-

compuware-study.df.42 RABA Innovative Solution Cell (RiSC), TrustedAgent ReportDiebold AccuVote-TSVoting System, Jan.

20,2004) http://www.raba.com/press/TA_Report_AccuVote.pdf.




July 19,2004Page14

report n late 2003 hat concluded hat all four DREs selectedn its bidding processhad

high security isks, ncluding Diebold and ES&S.43

It is notoriously difficult to promisecompletesecurity n a computingsystem. It issimply impossible o anticipateall of the attacks,especiallyon a systemof greatvalueand great complexity. Certification and esting shouldprovide no solace or untested,poorly implemented ecurity. Currently he main testingprovided on election systems scalled "logic and accuracy esting," but these ests,developed or lever machines,havenot beensufficiently updated or use on DREs. The other major sourceof testing orelection systemsare he certification and qualification processes, hich are also widelybelieyed o be insufficient. Moreover,both Diebold and ES&S havebeencaughtcircumventingeven hesemost minimal of tests. Diebold sold federally unqualifiedelectionmachines o severalCalifornia countiesand nstalleduncertified softwareon itselectionmachines n 17 counties.44ES&S surreptitiously nstalled and useduncertified

software n Indiana.45

A sufficiently malicious attackon a voting systemcould be hidden many ways. It couldbe subtleby changingonly a portion of the votes. It could verify the resultson the screenand hen change he results nto a different sequence f 1s and Os, he way the vote isstored n the machine. The recountwould process he samebad string of binary andproduce he same ncorrectresults. Worst of all, the resultscould be impossible o detect.It is impossible o predict whether herewill be malicious nterferenceor on what scale nupcomingelections. Even he most experienced omputersecurityexpertscannotpromiseprotectionon Election Day, but a paper ecord could verify the results.

3. A Paper R~£o!:dWill Help_Recountin2

New election echnologywill alter SouthCarolinaelectionsdramatically. Before makingthis kind of changes,SouthCarolina shouldconsiderwhat t would like "recounting" to

meanunder his new technology.46Without a paper ecord, he recounts raditionallyrelied on in SouthCarolinawill be largely empty gestures.Print-outs rom the samebadcodewill alwaysproduce he samebad results. It will be mpossible o take a set of

records ndicating true voter intent to a udge for review.

4:1Ohio Secretaryof State, Direct RecordingElectronic (DRE) TechnicalSecurityAssessment eport,"(November21,2003), at http://www.sos.state.oh.uslsos/hava/filesicompuware.pdf.44 StaffReport n he nvestigationf DieboldElectionSystems,nc.presentedo Secretaryf StateShelleyand he Voting Systemsand Procedures anel Apr. 20, 2004), at page4, at

http://www ss.ca.gov/lectionsltouchscreen.html.4S PressRelease,Marion County ndiana Election Board, "Marion County Clerk Doris Anne SadlerChaI'ges

Election Systems& SoftwareWith BreachOf Contract," April 20, 2004), at

http://www6.indygov.orgiclerk/election/press/04-04-20.htm.46S.C.CodeAnn. § 7-17-2801976).




July 19,2004Page15

Imaginea disastrous cenariosimilar to thoseseenallover the country. SouthCarolinacould face a recountevenworse han Florida's n 2000 - no real recountat all. HA V A

rightly delegatesecounts o the states,and f SouthCarolinavalues ecounting, t shouldimplementa voter-verified paper rail.

II. Conclusion

HA V A creates o obstacles o SouthCarolina mplementinga voter-verified ballotingsystem. It is possible o interpret he HA V A audit requirementas requiring suchballots,and uture guidancemight require his protection. Voter-verified paper rails are a soundpolicy choice or SouthCarolinabecausehey guardagainstelection raud and errors.Physical ecordsauthenticate omputerized alloting andbring reliability to currently

untrustworthyDRE election systems.

EFF appreciateshis opportunity o shareour knowledgeofHA V A and hesenewtechnologies.Weare happy o discuss his issueor others elating to electronicvotingmachines urther. Pleasedo not hesitate o contactus at (415) 436-9333x108 or

[email protected] f you have any questions r concerns.

Sincerely,

ELECTRONIC FRONTIER FOUNDATION

~~~(:::::~:2-Legal Director

Enclosurescc: Representative oeNeal



THE HA VA REQUIREMENT FOR A VOTER VERIFIED PAPER RECORD

Darryl R. Wold

July 23,2003

This paper explains that the Help America Vote Act of 20022 equires that any votingsystemused n an election for Federal office must produce a paper record of the vote cast byeachvoter that has been seenand verified by the voter. HA VA further requires that this voterverified paper record be available for a manual audit of the voting system,and for any recount.

HA V A requires, n section 15481,subdivision (a)(2)(B), that:

"(i) The voting system shall produce a permanentpaper record with a manual auditcapacity tor such system.

"(ii) The voting system shall provide the voter with an opportunity to change he ballot orcorrect any error before the permanentpaper record is produced.

"(iii) The paper record. . . shall be available as an official record for any recount. . .."

Taken together, heseprovisions requiring a "paper record" that is to be used for a"manual audit" for the "voting system" make t apparent hat HA V A requires a paper record thatis seen,verified, and turned in by the voter.

The suggestionhas been made, however, that the requirement ofa paper record to beused or a manual audit can be satisfied by a paper record of votes that is produced for the firsttime after the polls have closed - that is, a printout. of what the computer has stored, and that has

never been seenby the voter.

This interpretation, however, that a post-closing printout of what the computer has storedwould satisfy HA V A, would permit an audit or a recount to be conducted on the content of acomputer and not on a contemporaneous aper record of votes cast, and would make therequirement for a "manual audit capacity" virtually meaningless.

1 Mr. Wold servedas chairman of the Federal Election Commission in Washington, D.C., during

2000, and as a Commissioner rom 1998 o 2002. He is currently an attorney in private practicein Orange County, California. His practice emphasizes olitical and election law, including

campaign finance compliance ssues,ballot access,and recounts. His clients include AccuPoll,Inc., Irvine, California, a manufacturerof electronic voting systems.

2 Help America Vote Act of 2002 ("HA VA" in this paper), enactedas Public Law Number 107-

252, October 29,2002, 116 Statutes1704, and codified at 42 V.S.C. §15301 et seq.. All

references n this paper are to 42 V.S.C. §15481 unless otherwise noted.

1



A paper record consisting solely of ballots printed by the computer after the closing ofthe polls -- and therefore never seenby the voters -- would mean that a manual audit or recount

would simply amount to reviewing what was stored n the computer. The audit or recount couldnot manually verify that the computer had accurately recorded he voter's intent, or hadaccurately stored hat information, or had accuratelyprinted out that information. Both an audit

and a recount, therefore, would miss the key element of the system whether the voter'sintention had been accurately recorded.

At most, even a complete manual count of paper ballots printed by the computer post-.closing could only verify that the computer had accurately abulated various totals - that is, that

the computer had "done the math."

Such an audit or recount could not manually determine whether the computer hadaccurately made a record of voter intent - that is, that the paper record printed post-closing

actually represented he votes intended o be cast by the voters.

An audit using a record of votes printed post-closing, of course,could not be considereda

manual audit of the complete voting system it would be a partial audit, at best, limited to themath performed by the computer. It would not be an audit of whether the voters' intent wasaccurately recorded by the computer - and that is the critical issue.

HA V A's requirement of a "manual audit" compels he interpretation of "paper record" as

meaning a record that has been seenand verified by the voter.

First, it is apparent rom the common meaning of the words "manual audit" that HA V A

requires that this audit be conductedby visual examination and counting by hand, and not bymachine. A common dictionary definition of "manual" applicable to this context is "worked ordone by hand and not by machine." The term "audit" applicable to this context means"a

methodical examination and review." (Both definition's from Webster's Ninth New CollegiateDictionary. )

So far, therefore, we have a requirement or a methodical review by hand. The next

question s: What is to be reviewed?

HA V A provides that it is the "voting system" that is to be audited (§15481(a)(2)(B)), anddefines the voting system as ncluding "the total combination" of equipment hat is used "(A) todefine ballots; (B) to cast and count votes; (C) to report or display election results; and (D) tomaintain and produce any audit trail information. . ." (§15481(b)(I)). In other words, the systemto be audited is the complete processof casting and counting votes. There cannot be a "manual"audit of the casting of votes, of course,unless here is credible and contemporaneous vidence of

the votes cast that can be reviewed by hand, as a check on the electronic portion of the system.

Further, the critical issue n any voting system s whether the systemhas accuratelyreflected voter intent. The question raised n counting the votes in Florida in the 2000Presidential election, for instance,was not whether the machineshad accurately done the math -

it was whether the ballots that were counted actually reflected the voters' intentions. That issue

2



can be determined n an audit of a voting systemonly by examining what the voter has seenandapproved-- a paper record reviewed and verified by the voter.

The importance of a paper record verified by the voter is also emphasizedby HA V A'suse of the term "audit" rather than some other term that would merely require some ower .level

of examination. Requiring an "audit capacity" for the voting system, ncluding the accuraterecording of the votes cast, clearly contemplatesa paper record as the source document - as theoriginal record of the voters' actions - and not a secondarydocumentproduced after the fact as

evidenceonly of what is in the computer systemat that time.

The distinction between an original paper record of an act and electronic records asindirect evidence s an important one in the field of auditing, as ndicated by the standardsofauditing practice promulgated by the American Institute of Certified Public Accountants n itsStatementson Auditing Standards AICPA ProfessionalStandards,1998, American Institute ofCertified Public Accountants, New York). The AICPA's "StandardsofField Work" require that"Sufficient competentevidential matter is to be obtained hrough inspection, observation. . . andconfirmations to afford a reasonablebasis for an opinion." (AU § 150.02,~ 3.) Under "Natureof Evidential Matter" the standards ecognize hat "Corroborating evidential matter includes bothwritten and electronic information" (AU §326.17), and that "In certain entities, some of th~accounting data and corroboratjng evidential matters are available only in electronic form" (AU§326.18). Thus, the AICPA standardsdraw a distinction betweena source document that is anoriginal written record, on one hand, and an electronic record, on the other. The standards orfield work do not contemplate hat an electronic record printed out after the fact is the sameas anoriginalwritten ecord. .

In this light, the significance of the HA V A requirement hat the system produce "apermanentpaper record" for use n a "manual audit" or a recount js again apparent. HA V A doesnot provide for a manual audit of an electronic record of votes cast (or of a printout of an

electronic record, which is the same hing). HA V A requires a permanentpaper record of votescast, and that can only be read as meaning a contemporaneous aper record, that the voter hasseenand verified.

This distinction between an original paper record of a transaction or an act and electronicrecords as ndirect evidence of that matter is also found in standardspromulgated for governmentauditing promulgated by the Comptroller General (Government Auditing Standards,2003Revision, General Accounting Office, June 2003), which incorporate he AICP A standards orfield work for financial audits (§4.01). In addition to financial audits, government audits alsoinclude performance audits. In that context, the field work standards equire that "Sufficient,competent, and relevant evidence s to be obtained o provide a reasonablebasis for the auditor'sfmdings and conclusions" (§7.48). Guidanceprovided for concluding what constitutes

"sufficient, competent,and relevant evidence" provides that "Evidence obtained through theauditors' direct physical examination, observation,computation, and inspection is morecompetent han evidence obtained ndirectly" (§7 53, ~ b) and "Examination of originaldocumentsprovides more competent evidence han do copies" (§7.53, ~ c). Thus, thesegovernment auditing standardsalso contemplate hat an original written record is the betterevidence of a fact than indirect evidenceor a copy. Applied to the context of an audit of a voting

3



system, t is apparent hat a paper ballot that the voter has seenand verified is better evidencethan a printout of an electronic record that the voter who purportedly created he record hasn't

seen.

In summary, t is apparent hat the requirementof HA V A that a voting systemused n a

Federal election provide a paper record for a manual audit can be satisfied only by a system hatproducesa paper record that the voter seesand verifies, and that is retained by the election

official as the record of votes cast for purposesof an audit and any recount.

This statutory requirement s not a bare egal requirement without practical significance.To the contrary, a paper record that has been reviewed and verified by the voter is an essentialelement of a transparentand open voting system. A voter verified paper record that will beavailable for an audit of the systemand for any recount greatly reduces he possibility of fraud

and provides a meansof detecting and correcting unintentional error in the electronic system.Equally importantly, it assureseach voter that the vote has been accurately cast, and that there is

a paper record of that vote to serve as a check on the electronic system, and eliminates thesuspicion of impropriety. An open and transparentvoting system ncreases he voters'confidence n the systemand the public's trust in the results. It is an essentialelement of the

democratic processby which we elect the governmentof this great republic.

4



JOHN Ei'ISiei'I" - .,"- ,-~

NEVADA' " 364:~I.;SSEl'-c"..~! :'"'.c~U:l:1N

N..S""'O,ON. wC CS,O-2:JC(2021 24-0244

BANKING HOUSI,\jG A~ID ~~nlt~~ ~ to",,!!f ~ ~ ~ngt". ~~URBAN AFF.o1JRS ~ W P l.U .0 ~ ~ \ ~ 333 s IEu"S 30Ul.,'.."C. 5cl.;",

~.. ~ I~ 3~" 3i.1'"c ~.~ ~., ;)1.;.0 4.

.;~~M~AERCE.S,",,~NC~..-,"jD \\"\~" I \ Ir:"!"~\ 1 ~c: ~~~.", ~<;C~ ~,; iO~~,;.".j\1,3';!, ":'RANSPORTAT:Cl-i " ~H. -, ~I ,- ~ -,,~ ",,-,,- - -r-' -"8- " 5\, _L. -~ -cC

SMALL BUSINESS

Si'ECIALCOMMI:-:-~: :),\1 G;IIG

0.;.): ,;-.1;..;'.;0-'=0-5.."', ;c.:.

May 29 2002 :,,"501" :;'!V 'N 397!J1, '7;:i3S5-~~.1

SenatorMitch McConnellCommitteeon Rules andAdministration305 SenateRussellBuildingWashingtonD.C. 20510

Dear SenatorMcConnell:

As you know, during Senate onsideration fS. 565, he Equal Protection of Voting Rights Act\ of2001, I introducedan amendmentwhich was passed y voice vote. This amendmentequires

electronicvoting systems o producea permanent aper ecord o be usedas an "official record"for recounts.As you continue o work to reconcile he differencesbetween he Houseand Senateversionsof this legislation, ask hat you support his important amendment.

This amendments simple. It would give voters a receiptat the time their ballot is cast,andallow the voter to confirm, and, f necessary, hange he vote before eachballot is cast. 11risreceiptwould then be set asideas a permanent ecordof that election. This would instillconfidence n new, paperless ouch-screen oting machinesand would also provide a backuprecord n the event of a recount.

To find a need or this legislation, one need ook no further than the 2000 PresidentialElectionrecount n Florida. Had a reliable backupof eachvote beenavailable or the recount, his

country would not havehad to endure he ong controversialcourt battle that resultedbecause fthe inconclusive ecount esults. This amendmentwould ensure hat every voter has he chanceto verify eachselectionbefore he vote s cast.

I have enclosed copy of this amendment s ncluded n the Senate ersion of the EqualProtectionof Voting Rights Act of2001. If you would iike more Ilformation, pleasedo nothesitate o contactCarrie Schroeder t 224-4430. Thank you for your continuedhard.work onthis important egislation.

Sincerely,

~ C:;~" ~

JOHN ENSIGN/JUnited StatesSenaor

JE/cas

00523-20040719 letter to sc att gen

Documents