NY times makes it official: voting machines can’t be trusted

2008-01-06

Richard Moore

Original source URL:
http://www.truthout.org/docs_2006/010508C.shtml
http://www.nytimes.com/2008/01/06/magazine/06Vote-t.html


January 6, 2008

Can You Count on Voting Machines?
By CLIVE THOMPSON

Jane Platten gestured, bleary-eyed, into the secure room filled with voting 
machines. It was 3 a.m. on Nov. 7, and she had been working for 22 hours 
straight. ³I guess we¹ve seen how technology can affect an election,² she said. 
The electronic voting machines in Cleveland were causing trouble again.

For a while, it had looked as if things would go smoothly for the Board of 
Elections office in Cuyahoga County, Ohio. About 200,000 voters had trooped out 
on the first Tuesday in November for the lightly attended local elections, 
tapping their choices onto the county¹s 5,729 touch-screen voting machines. The 
elections staff had collected electronic copies of the votes on memory cards and
taken them to the main office, where dozens of workers inside a secure, 
glass-encased room fed them into the ³GEMS server,² a gleaming silver Dell 
desktop computer that tallies the votes.

Then at 10 p.m., the server suddenly froze up and stopped counting votes. 
Cuyahoga County technicians clustered around the computer, debating what to do. 
A young, business-suited employee from Diebold ‹ the company that makes the 
voting machines used in Cuyahoga ‹ peered into the screen and pecked at the 
keyboard. No one could figure out what was wrong. So, like anyone faced with a 
misbehaving computer, they simply turned it off and on again. Voilà: It started 
working ‹ until an hour later, when it crashed a second time. Again, they 
rebooted. By the wee hours, the server mystery still hadn¹t been solved.

Worse was yet to come. When the votes were finally tallied the next day, 10 
races were so close that they needed to be recounted. But when Platten went to 
retrieve paper copies of each vote ‹ generated by the Diebold machines as they 
worked ‹ she discovered that so many printers had jammed that 20 percent of the 
machines involved in the recounted races lacked paper copies of some of the 
votes. They weren¹t lost, technically speaking; Platten could hit ³print² and a 
machine would generate a replacement copy. But she had no way of proving that 
these replacements were, indeed, what the voters had voted. She could only hope 
the machines had worked correctly.

As the primaries start in New Hampshire this week and roll on through the next 
few months, the erratic behavior of voting technology will once again find 
itself under a microscope. In the last three election cycles, touch-screen 
machines have become one of the most mysterious and divisive elements in modern 
electoral politics. Introduced after the 2000 hanging-chad debacle, the machines
were originally intended to add clarity to election results. But in hundreds of 
instances, the result has been precisely the opposite: they fail unpredictably, 
and in extremely strange ways; voters report that their choices ³flip² from one 
candidate to another before their eyes; machines crash or begin to count 
backward; votes simply vanish. (In the 80-person town of Waldenburg, Ark., 
touch-screen machines tallied zero votes for one mayoral candidate in 2006 ‹ 
even though he¹s pretty sure he voted for himself.) Most famously, in the 
November 2006 Congressional election in Sarasota, Fla., touch-screen machines 
recorded an 18,000-person ³undervote² for a race decided by fewer than 400 
votes.

The earliest critiques of digital voting booths came from the fringe ‹ 
disgruntled citizens and scared-senseless computer geeks ‹ but the fears have 
now risen to the highest levels of government. One by one, states are renouncing
the use of touch-screen voting machines. California and Florida decided to get 
rid of their electronic voting machines last spring, and last month, Colorado 
decertified about half of its touch-screen devices. Also last month, Jennifer 
Brunner, the Ohio secretary of state, released a report in the wake of the 
Cuyahoga crashes arguing that touch-screens ³may jeopardize the integrity of the
voting process.² She was so worried she is now forcing Cuyahoga to scrap its 
touch-screen machines and go back to paper-based voting ‹ before the Ohio 
primary, scheduled for March 4. Senator Bill Nelson, a Democrat of Florida, and 
Senator Sheldon Whitehouse, Democrat of Rhode Island, have even sponsored a bill
that would ban the use of touch-screen machines across the country by 2012.

It¹s difficult to say how often votes have genuinely gone astray. Michael 
Shamos, a computer scientist at Carnegie Mellon University who has examined 
voting-machine systems for more than 25 years, estimates that about 10 percent 
of the touch-screen machines ³fail² in each election. ³In general, those 
failures result in the loss of zero or one vote,² he told me. ³But they¹re very 
disturbing to the public.²

Indeed, in a more sanguine political environment, this level of error might be 
considered acceptable. But in today¹s highly partisan and divided country, 
elections can be decided by unusually slim margins ‹ and are often bitterly 
contested. The mistrust of touch-screen machines is thus equal parts 
technological and ideological. ³A tiny number of votes can have a huge impact, 
so machines are part of the era of sweaty palms,² says Doug Chapin, the director
of Electionline.org, a nonpartisan group that monitors voting reform. Critics 
have spent years fretting over corruption and the specter of partisan hackers 
throwing an election. But the real problem may simply be inherent in the nature 
of computers: they can be precise but also capricious, prone to malfunctions we 
simply can¹t anticipate.

During this year¹s presidential primaries, roughly one-third of all votes will 
be cast on touch-screen machines. (New Hampshire voters are not in this group; 
they will vote on paper ballots, some of which are counted in optical scanners.)
The same ratio is expected to hold when Americans choose their president in the 
fall. It is a very large chunk of the electorate. So what scares election 
observers is this: What happens if the next presidential election is extremely 
close and decided by a handful of votes cast on machines that crashed? Will 
voters accept a presidency decided by ballots that weren¹t backed up on paper 
and existed only on a computer drive? And what if they don¹t?

³The issue for me is the unknown,² Platten told me when we first spoke on the 
phone, back in October. ³There¹s always the unknown factor. Something ‹ 
something ‹ happens every election.²

NEW VOTING TECHNOLOGIES tend to emerge out of crises of confidence. We change 
systems only rarely and in response to a public anxiety that electoral results 
can no longer be trusted. America voted on paper in the 19th century, until 
ballot-box stuffing ‹ and inept poll workers who lost bags of votes ‹ led many 
to abandon that system. Some elections officials next adopted lever machines, 
which record each vote mechanically. But lever machines have problems of their 
own, not least that they make meaningful recounts impossible because they do not
preserve each individual vote. Beginning in the 1960s they were widely replaced 
by punch-card systems, in which voters knock holes in ballots, and the ballots 
can be stored for a recount. Punch cards worked for decades without controversy.

Until, of course, the electoral fiasco of 2000. During the Florida recount in 
the Bush-Gore election, it became clear that punch cards had a potentially 
tragic flaw: ³hanging chads.² Thousands of voters failed to punch a hole clean 
through the ballot, turning the recount into a torturous argument over ³voter 
intent.² On top of that, many voters confused by the infamous ³butterfly ballot²
seem to have mistakenly picked the wrong candidate. Given Bush¹s microscopic 
margin of victory ‹ he was ahead by only a few hundred votes statewide ‹ the 
chads produced the brutal, monthlong legal brawl over how and whether the 
recounts should be conducted.

The 2000 election illustrated the cardinal rule of voting systems: if they 
produce ambiguous results, they are doomed to suspicion. The election is never 
settled in the mind of the public. To this date, many Gore supporters refuse to 
accept the legitimacy of George W. Bush¹s presidency; and by ultimately deciding
the 2000 presidential election, the Supreme Court was pilloried for appearing 
overly partisan.

Many worried that another similar trauma would do irreparable harm to the 
electoral system. So in 2002, Congress passed the Help America Vote Act (HAVA), 
which gave incentives to replace punch-card machines and lever machines and 
authorized $3.9 billion for states to buy new technology, among other things. At
the time, the four main vendors of voting machines ‹ Diebold, ES&S, Sequoia and 
Hart ‹ were aggressively marketing their new touch-screen machines. Computers 
seemed like the perfect answer to the hanging chad. Touch-screen machines would 
be clear and legible, unlike the nightmarishly unreadable ³butterfly ballot.² 
The results could be tabulated very quickly after the polls closed. And best of 
all, the vote totals would be conclusive, since the votes would be stored in 
crisp digital memory. (Touch-screen machines were also promoted as a way to 
allow the blind or paralyzed to vote, via audio prompts and puff tubes. This 
became a powerful incentive, because, at the behest of groups representing the 
disabled, HAVA required each poll station to have at least one ³accessible² 
machine.)

HAVA offered no assistance or guidelines as to what type of machine to buy, and 
local elections officials did not have many resources to investigate the 
choices; indeed, theirs are some of most neglected and understaffed offices 
around, because who pays attention to electoral technology between campaigns? As
touch-screen vendors lobbied elections boards, the machines took on an air of 
inevitability. For elections directors terrified of presiding over ³the next 
Florida,² the cool digital precision of touch-screens seemed like the perfect 
antidote.

IN THE LOBBY OF JANE PLATTEN¹S OFFICE in Cleveland sits an AccuVote-TSX, made by
Diebold. It is the machine that Cuyahoga County votes on, and it works like 
this: Inside each machine there is a computer roughly as powerful and flexible 
as a modern hand-held organizer. It runs Windows CE as its operating system, and
Diebold has installed its own specialized voting software to run on top of 
Windows. When the voters tap the screen to indicate their choices, the computer 
records each choice on a flash-memory card that fits in a slot on the machine, 
much as a flash card stores pictures on your digital camera. At the end of the 
election night, these cards are taken to the county¹s election headquarters and 
tallied by the GEMS server. In case a memory card is accidentally lost or 
destroyed, the computer also stores each vote on a different chip inside the 
machine; election officials can open the voting machine and remove the chip in 
an emergency.

But there is also a third place the vote is recorded. Next to each machine¹s LCD
screen, there is a printer much like one on a cash register. Each time a voter 
picks a candidate on screen, the printer types up the selections, in small, 
eight-point letters. Before the voter pushes ³vote,² she¹s supposed to peer down
at the ribbon of paper ‹ which sits beneath a layer of see-through plastic, to 
prevent tampering ‹ and verify that the machine has, in fact, correctly recorded
her choices. (She can¹t take the paper vote with her as proof; the spool of 
paper remains locked inside the machine until the end of the day.)

Under Ohio law, the paper copy is the voter¹s vote. The digital version is not. 
That¹s because the voter can see the paper vote and verify that it¹s correct, 
which she cannot do with the digital one. The digital records are, in essence, 
merely handy additional copies that allow the county to rapidly tally 
potentially a million votes in a single evening, whereas counting the paper 
ballots would take weeks. Theoretically speaking, the machine offers the best of
all possible worlds. By using both paper and digital copies, the AccuVote 
promised Cuyahoga an election that would be speedy, reliable and relatively 
inexpensive.

Little of this held true. When the machines were first used in Cuyahoga Country 
during the May 2006 primaries, costs ballooned ‹ and chaos reigned. The poll 
workers, many senior citizens who had spent decades setting up low-tech 
punch-card systems, were baffled by the new computerized system and the rather 
poorly written manuals from Diebold and the county. ³It was insane,² one former 
poll worker told me. ³A lot of people over the age of 60, trying to figure out 
these machines.² Since the votes were ferried to the head office on small, 
pocket-size memory cards, it was easy for them to be misplaced, and dozens went 
missing.

On Election Day, poll workers complained that 143 machines were broken; dozens 
of other machines had printer jams or mysteriously powered down. More than 200 
voter-card encoders ‹ which create the cards that let voters vote ‹ went 
missing. When the machines weren¹t malfunctioning, they produced errors at a 
stunning rate: one audit of the election discovered that in 72.5 percent of the 
audited machines, the paper trail did not match the digital tally on the memory 
cards.

This was hardly the first such incident involving touch-screen machines. So it 
came as little surprise that Diebold, a company once known primarily for making 
safes and A.T.M.¹s, subsequently tried to sell off its voting-machine business 
and, failing to find a buyer, last August changed the name of the division to 
Premier Election Solutions (an analyst told American Banker that the voting 
machines were responsible for ³5 percent of revenue and 100 percent of bad 
public relations²).

Nearly a year after the May 2006 electoral disaster, Ohio¹s new secretary of 
state, Jennifer Brunner, asked the entire four-person Cuyahoga elections board 
to resign, and Platten ‹ then the interim director of the board ‹ was tapped to 
clean up the mess. Platten had already instituted a blizzard of tiny fixes. She 
added responsibilities to the position of ³Election Day technician² ‹ filled by 
young, computer-savvy volunteers who could help the white-haired poll workers 
reboot touch-screens when they crashed. She bought plastic business-card binders
to hold memory cards from a precinct, so none would be misplaced. ³Robocalls² at
home from a phone-calling service reminded volunteers to show up. Her staff 
rewrote the inscrutable Diebold manuals in plain English.

The results were immediate. Over the next several months, Cuyahoga¹s elections 
ran with many fewer crashes and shorter lines of voters. Platten¹s candor and 
hard work won her fans among even the most fanatical anti-touch-screen 
activists. ³It¹s a miracle,² I was told by Adele Eisner, a Cuyahoga County 
resident who has been a vocal critic of touch-screen machines. ³Jane Platten 
actually understands that elections are for the people.² The previous board, 
Eisner went on to say, ridiculed critics who claimed the machines would be 
trouble and refused to meet with them; the new replacements, in contrast, 
sometimes seemed as skeptical about the voting machines as the activists, and 
Eisner was invited in to wander about on election night, videotaping the 
activity.

Still, the events of Election Day 2007 showed just how ingrained the problems 
with the touch-screens were. The printed paper trails caused serious headaches 
all day long: at one polling place, printers on most of the machines weren¹t 
functioning the night before the polls opened. Fortunately, one of the Election 
Day technicians was James Diener, a gray-haired former computer-and-mechanical 
engineer who opened up the printers, discovered that metal parts were bent out 
of shape and managed to repair them. The problem, he declared cheerfully, was 
that the printers were simply ³cheap quality² (a complaint I heard from many 
election critics). ³I¹m an old computer nerd,² Diener said. ³I can do anything 
with computers. Nothing¹s wrong with computers. But this is the worst way to run
an election.²

He also pointed out several other problems with the machines, including the fact
that the majority of voters he observed did not check the paper trail to see 
whether their votes were recorded correctly ‹ even though that paper record is 
their legal ballot. (I noticed this myself, and many other poll workers told me 
the same thing.) Possibly they¹re simply lazy, or the poll workers forget to 
tell them to; or perhaps they¹re older and couldn¹t see the printer¹s tiny type 
anyway. And even if voters do check the paper trail, Diener pointed out, how do 
they know the machine is recording it for sure? ³The whole printing thing is a 
farce,² he said.

What¹s more, the poll workers regularly made security errors. When a 
touch-screen machine is turned on for the first time on Election Day, two 
observers from different parties are supposed to print and view the ³zero tape² 
that shows there are no votes already recorded on the machine; a hacker could 
fix the vote by programming the machine to start, for example, with a negative 
total of votes for a candidate. Yet when I visited one Cleveland polling station
at daybreak, the two checkers signed zero tapes without actually checking the 
zero totals. And then, of course, there were the server crashes, and the 
recording errors on 20 percent of the paper recount ballots.

Chris Riggall, a spokesman for Diebold, said that machine flaws were not 
necessarily to blame for the problems. The paper rolls were probably installed 
incorrectly by the poll workers. And in any case, he added, the paper trail was 
originally designed merely to help in auditing the accuracy of an election ‹ it 
wasn¹t supposed to be robust enough to serve as a legal ballot, as Ohio chose to
designate it. But the servers were indeed an issue of the machine¹s design; when
his firm tested them weeks later, it found a data bottleneck that would need to 
be fixed with a software update.

The Nov. 6 vote in Cuyahoga County offered a sobering lesson. Having watched 
Platten¹s staff and the elections board in action, I could see they were a model
of professionalism. Yet they still couldn¹t get their high-tech system to work 
as intended. For all their diligence and hard work, they were forced, in the 
end, to discard much of their paper and simply trust that the machines had 
recorded the votes accurately in digital memory.

THE QUESTION, OF COURSE, is whether the machines should be trusted to record 
votes accurately. Ed Felten doesn¹t think so. Felten is a computer scientist at 
Princeton University, and he has become famous for analyzing ‹ and criticizing ‹
touch-screen machines. In fact, the first serious critics of the machines ‹ 
beginning 10 years ago ‹ were computer scientists. One might expect computer 
scientists to be fans of computer-based vote-counting devices, but it turns out 
that the more you know about computers, the more likely you are to be terrified 
that they¹re running elections.

This is because computer scientists understand, from hard experience, that 
complex software can¹t function perfectly all the time. It¹s the nature of the 
beast. Myriad things can go wrong. The software might have bugs ‹ errors in the 
code made by tired or overworked programmers. Or voters could do something the 
machines don¹t expect, like touching the screen in two places at once. 
³Computers crash and we don¹t know why,² Felten told me. ³That¹s just a routine 
part of computers.²

One famous example is the ³sliding finger bug² on the Diebold AccuVote-TSX, the 
machine used in Cuyahoga. In 2005, the state of California complained that the 
machines were crashing. In tests, Diebold determined that when voters tapped the
final ³cast vote² button, the machine would crash every few hundred ballots. 
They finally intuited the problem: their voting software runs on top of Windows 
CE, and if a voter accidentally dragged his finger downward while touching ³cast
vote² on the screen, Windows CE interpreted this as a ³drag and drop² command. 
The programmers hadn¹t anticipated that Windows CE would do this, so they hadn¹t
programmed a way for the machine to cope with it. The machine just crashed.

Even extremely careful programmers can accidentally create bugs like this. But 
critics also worry that touch-screen voting machines aren¹t designed very 
carefully at all. In the infrequent situations where computer scientists have 
gained access to the guts of a voting machine, they¹ve found alarming design 
flaws. In 2003, Diebold employees accidentally posted the AccuVote¹s source code
on the Internet; scientists who analyzed it found that, among other things, a 
hacker could program a voter card to let him cast as many votes as he liked. Ed 
Felten¹s lab, while analyzing an anonymously donated AccuVote-TS (a different 
model from the one used in Cuyahoga County) in 2006, discovered that the machine
did not ³authenticate² software: it will run any code a hacker might 
surreptitiously install on an easily insertable flash-memory card. After 
California¹s secretary of state hired computer scientists to review the state¹s 
machines last spring, they found that on one vote-tallying server, the default 
password was set to the name of the vendor ‹ something laughably easy for a 
hacker to guess.

But the truth is that it¹s hard for computer scientists to figure out just how 
well or poorly the machines are made, because the vendors who make them keep the
details of their manufacture tightly held. Like most software firms, they regard
their ³source code² ‹ the computer programs that run on their machines ‹ as a 
trade secret. The public is not allowed to see the code, so computer experts who
wish to assess it for flaws and reliability can¹t get access to it. Felten and 
voter rights groups argue that this ³black box² culture of secrecy is the 
biggest single problem with voting machines. Because the machines are not 
transparent, their reliability cannot be trusted.

The touch-screen vendors disagree. They point out that a small number of 
approved elections officials in each state and county are allowed to hold a copy
in escrow and to examine it (though they are required to sign nondisclosure 
agreements preventing them from discussing the software publicly). Further, 
vendors argue, the machines are almost always tested by the government before 
they¹re permitted to be used. The Election Assistance Commission, a federal 
agency, this year began to fully certify four private-sector labs to stress-test
machines. They subject them to environmental pressures like heat and vibration 
to ensure they won¹t break down on Election Day; and they run mock elections, to
verify that the machines can count correctly. In almost all cases, if a vendor 
updates the software or hardware, it must be tested all over again, which can 
take months. ³It¹s an extremely rigorous process,² says Ken Fields, a spokesman 
for the voting-machine company ES&S.

If the machines are tested and officials are able to examine the source code, 
you might wonder why machines with so many flaws and bugs have gotten through. 
It is, critics insist, because the testing is nowhere near dilligent enough, and
the federal regulators are too sympathetic and cozy with the vendors. The 2002 
federal guidelines, the latest under which machines currently in use were 
qualified, were vague about how much security testing the labs ought to do. The 
labs were also not required to test any machine¹s underlying operating system, 
like Windows, for weaknesses.

Vendors paid for the tests themselves, and the results were considered 
proprietary, so the public couldn¹t find out how they were conducted. The 
nation¹s largest tester of voting machines, Ciber Inc., was temporarily 
suspended after federal officials found that the company could not properly 
document the tests it claimed to have performed.

³The types of malfunctions we¹re seeing would be caught in a first-year computer
science course,² says Lillie Coney, an associate director with the Electronic 
Privacy Information Commission, which is releasing a study later this month 
critical of the federal tests.

In any case, the federal testing is not, strictly speaking, mandatory. The vast 
majority of states ³certify² their machines as roadworthy. But since testing is 
extremely expensive, many states, particularly smaller ones, simply accept 
whatever passes through a federal lab. And while it¹s true that state and local 
elections officials can generally keep a copy of the source code, critics say 
they rarely employ computer programmers sophisticated enough to understand it. 
Quite the contrary: When a county buys touch-screen voting machines, its 
elections director becomes, as Warren Parish, a voting activist in Florida, told
me, ³the head of the largest I.T. department in their entire government, in 
charge of hundreds or thousands of new computer systems, without any training at
all.² Many elections directors I spoke with have been in the job for years or 
even decades, working mostly with paper elections or lever machines. Few seemed 
very computer-literate.

The upshot is a regulatory environment in which, effectively, no one assumes 
final responsibility for whether the machines function reliably. The vendors 
point to the federal and state governments, the federal agency points to the 
states, the states rely on the federal testing lab and the local officials are 
frequently hapless.

This has created an environment, critics maintain, in which the people who make 
and sell machines are now central to running elections. Elections officials 
simply do not know enough about how the machines work to maintain or fix them. 
When a machine crashes or behaves erratically on Election Day, many county 
elections officials must rely on the vendors ‹ accepting their assurances that 
the problem is fixed and, crucially, that no votes were altered.

In essence, elections now face a similar outsourcing issue to that seen in the 
Iraq war, where the government has ceded so many core military responsibilities 
to firms like Halliburton and Blackwater that Washington can no longer fire the 
contractor. Vendors do not merely sell machines to elections departments. In 
many cases, they are also paid to train poll workers, design ballots and repair 
broken machines, for years on end.

³This is a crazy world,² complained Ion Sancho, the elections supervisor of Leon
County in Florida. ³The process is so under control by the vendor. The primary 
source of information comes only from the vendor, and the vendor has a conflict 
of interest in telling you the truth. The vendor isn¹t going to tell me that his
buggy software is why I can¹t get the right time on my audit logs.²

As more and more evidence of machine failure emerges, senior government 
officials are sounding alarms as did the computer geeks of years ago over the 
growing role of private companies in elections. When I talked to Jennifer 
Brunner in October, she told me she wished all of Ohio¹s machines were ³open 
source² ‹ that is, run on computer code that is published publicly, for anyone 
to see. Only then, she says, would voters trust it; and the scrutiny of 
thousands of computer scientists worldwide would ferret out any flaws and bugs.

On Nov. 6, the night of the Cuyahoga crashes, Jeff Hastings ‹ the Republican 
head of the election board ‹ sat and watched the Diebold technicians try to get 
the machines running. ³Criminy,² he said. ³You¹ve got four different vendors. 
Why should their source codes be private? You¹ve privatized the essential 
building block of the election system.²

The federal government appears to have taken that criticism to heart. New 
standards for testing voting machines now being implemented by the E.A.C. are 
regarded as more rigorous; some results are now being published online.

Amazingly, the Diebold spokesman, Chris Riggall, admitted to me that the company
is considering making the software open source on its next generation of 
touch-screen machines, so that anyone could download, inspect or repair the 
code. The pressure from states is growing, he added, and ³if the expectations of
our customers change, we¹ll have to respond to that reality.²

IF YOU WANT TO GET a sense of the real stakes in voting-machine politics, 
Christine Jennings has a map to show you. It is a sprawling, wall-size diagram 
of the voting precincts that make up Florida¹s 13th district, and it hangs on 
the wall of her campaign office in Sarasota, where she ran for the Congressional
seat in November 2006. Jennings, a Democrat, lost the seat by 369 votes to the 
Republican, Vern Buchanan, in a fierce fight to replace Katherine Harris. But 
Jennings quickly learned of an anomaly in the voting: some 18,000 people had 
³undervoted.² That is, they had voted in every other race ‹ a few dozen were on 
the ballot, including a gubernatorial contest ‹ but abstained in the 
Jennings-Buchanan fight. A normal undervote in any given race is less than 3 
percent. In this case, a whopping 13 percent of voters somehow decided to not 
vote.

³See, look at this,² Jennings said, dragging me over to the map when I visited 
her in November. Her staff had written the size of the undervote in every 
precinct in Sarasota, where the undervotes occurred: 180 votes in one precinct, 
338 in another. ³I mean, it¹s huge!² she said. ³It¹s just unbelievable.² She 
pointed to Precinct 150, a district on the south end of Sarasota County. 
Buchanan received 346 votes, Jennings received 275 and the undervote was 133. ³I
mean, people would walk in and vote for everything except this race?² she said. 
³Why?²

Jennings says he believes the reason is simple: Sarasota¹s touch-screen machines
malfunctioned ‹ and lost votes that could have tipped the election in her favor.
Her staff has received hundreds of complaints from voters reporting mysterious 
behavior on the part of the machines. The specific model that Sarasota used was 
the iVotronic, by the company ES&S. According to the complaints, when voters 
tried to touch the screen for Jennings, the iVotronic wouldn¹t accept it, or 
would highlight Buchanan¹s name instead. When they got to the final pages of the
ballot, where they reviewed their picks, the complainants said, the 
Jennings-Buchanan race was missing ‹ even though they were sure they¹d voted in 
it. The reports streamed in not merely from technophobic senior citizens but 
also from tech-savvy younger people, including a woman with a Ph.D. in computer 
science and a saleswoman who actually works for a firm that sells touch-screen 
devices. (Even Vern Buchanan¹s wife reported having trouble voting for her 
husband.)

If the election had been in Cuyahoga, the paper trail might have settled the 
story. But the iVotronic, unlike Cuyahoga¹s machines, does not provide a paper 
backup. It records votes only in digital memory: on a removable flash-memory 
card and on an additional flash-memory chip embedded inside the machine. Since 
the Jennings-Buchanan election was so close, state law called for an automatic 
recount. But on a paperless machine like the iVotronic, a recount is purely 
digital ‹ it consists of nothing but removing the flash memory inside the 
machine and hitting ³print² again. Jennings did, indeed, lose the recount; when 
they reprinted, elections workers found that the internal chips closely matched 
the original count (Jennings picked up four more votes). But for Jennings this 
is meaningless, because she says it was the screens that malfunctioned.

As evidence, she brandishes pieces of evidence she says are smoking guns. One is
a memo from ES&S executives, issued in August 2006, warning that they had found 
a bug in the iVotronic software that produced a delay in the screen; after a 
voter made her choice, it would take a few seconds for the screen to display it.
This, Jennings noted, could cause problems, because a voter, believing that the 
machine had not recorded her first touch, might push the screen again ‹ 
accidentally deselecting her initial vote. Jennings also suspects that the 
iVotronic¹s hardware may have malfunctioned. An August HDNet investigation by 
Dan Rather discovered that the company manufacturing the touchscreens for the 
iVotronic had a history of production flaws. The flaw affected the calibration 
of the screen: When exposed to humidity ‹ much like the weather in Florida ‹ the
screen would gradually lose accuracy.

Elections officials in Sarasota and ES&S hotly disagree that the machines were 
in error, noting that the calibration problems with the screens were fixed 
before the election. Kathy Dent, Sarasota¹s elections supervisor, suspects that 
the undervote was real ‹ which is to say, voters intentionally skipped the race,
to punish Jennings and Buchanan for waging a particularly vitriolic race. 
³People were really fed up,² she told me. Other observers say voters were simply
confused by the ballot design and didn¹t see the Jennings-Buchanan race.

To try to settle the question, a government audit tried to test whether the 
machines had malfunctioned. The state acquired a copy of the iVotronic source 
code from ES&S and commissioned a group of computer scientists to inspect it. 
Their report said they could find no flaws in the code that would lead to such a
large undervote. Meanwhile, the state conducted a mock election, getting 
elections workers to repeatedly click the screens on iVotronic machines, voting 
Jennings or Buchanan. Again, no accidental undervote appeared. Early results 
from a separate test by an M.I.T. professor found that when voters were 
presented with the Sarasota ballot, over 16 percent accidentally skipped over 
the Jennings-Buchanan race ‹ suggesting that poor ballot design and voter error 
was, indeed, part of the problem.

These explanations have not satisfied Jennings and her supporters. Kendall 
Coffey, one of Jennings¹s lawyers, has a different theory: the votes were mostly
lost because of a ³nonrecurring software bug² ‹ a quirk that, like the 
sliding-finger bug, only crops up some of the time, propelled by voter actions 
that the audits did not replicate, like a voter¹s accidentally touching the 
screen in two places at once. For her part, Jennings brushes off the idea that 
voters were punishing her and Buchanan. Plenty of Congressional fights are 
nasty, she says, but they almost never yield 13 percent undervotes.

And on and on it goes. ES&S and Sarasota correctly point out that Jennings has 
no proof that a bug exists. Jennings correctly points out that her opponents 
have no proof a bug doesn¹t exist. This is the ultimate political legacy of 
touch-screen voting machines and the privatization of voting machinery 
generally. When invisible, secretive software runs an election, it allows for 
endless mistrust and muttered accusations of conspiracy. The inscrutability of 
the software ‹ combined with touch-screen machines¹ well-documented history of 
weird behavior ‹ allows critics to level almost any accusation against the 
machines and have it sound plausible. ³It¹s just like the Kennedy 
assassination,² Shamos, the Carnegie Mellon computer scientist, laments. 
³There¹s no matter of evidence that will stop people from spinning yarns.²

Part of the problem stems from the fact that voting requires a level of 
precision we demand from virtually no other technology. We demand that the 
systems behind A.T.M.¹s and credit cards be accurate, of course. But if they¹re 
not, we can quickly detect something is wrong: we notice that our balance is off
and call the bank, or the bank notices someone in China bought $10,000 worth of 
clothes and calls us to make sure it¹s legitimate. But in an election, the voter
must remain anonymous to the government. If a machine crashes and the county 
worries it has lost some ballots, it cannot go back and ask voters how they 
voted ‹ because it doesn¹t know who they are. It is the need for anonymity that 
fuels the quest for perfection in voting machines.

Perfection isn¹t possible, of course; every voting system has flaws. So 
historically, the public ‹ and candidates for public office ‹ have grudgingly 
accepted that their voting systems will produce some errors here and there. The 
deep, ongoing consternation over touch-screen machines stems from something new:
the unpredictability of computers. Computers do not merely produce errors; they 
produce errors of unforeseeable magnitude. Will people trust a system when they 
never know how big or small its next failure will be?

ON THE FRIDAY BEFORE the November elections in Pennsylvania, I wandered into a 
church in a suburb of Pittsburgh. The church was going to serve as a poll 
location, and I was wondering: Had the voting machines been dropped off? Were 
they lying around unguarded ‹ and could anyone gain access to them?

When I approached the side door of the church at 6 p.m., two women were 
unloading food into the basement kitchen. (They were visitors from another 
church who had a key to get in, but they told me they¹d found the door 
unlocked.) I held the door for them, chatted politely, then strolled into the 
otherwise completely empty building. Neither woman asked why I was there.

I looked over in the corner and there they were: six iVotronic voting machines, 
stacked up neatly. While the women busied themselves in their car, I was left 
completely alone with the machines. The iVotronics had been sealed shut with 
numbered tamper seals to prevent anyone from opening a machine illicitly, but 
cutting and resealing them looked pretty easy. In essence, I could have tampered
with the machines in any way I wanted, with very little chance of being detected
or caught.

Is it possible that someone could hack voting machines and rig an election? 
Elections officials insist that they are extremely careful to train poll workers
to recognize signs of machines that had been tampered with. They also claim, 
frequently, that the machines are carefully watched. Neither is entirely true. 
Machines often sit for days before elections in churches, and while churches may
be wonderfully convenient polling locations, they¹re about as insecure a 
location as you could imagine: strangers are supposed to wander into churches. 
And while most poll workers do carefully check to ensure that the tamper seals 
on the machines are unbroken, I heard reports from poll workers who saw much 
more lax behavior in their colleagues.

Yet here¹s the curious thing: Almost no credible scientific critics of 
touch-screen voting say they believe any machines have ever been successfully 
hacked. Last year, Ed Felten, the computer scientist from Princeton, wrote a 
report exhaustively documenting the many ways a Diebold AccuVote-TSX could be 
hacked ‹ including a technique for introducing a vote-rigging virus that would 
spread from machine to machine in a precinct. But Felten says the chance this 
has really happened is remote. He argues that the more likely danger of 
touch-screen machines is not in malice but in errors. Michael Shamos agrees. ³If
there are guys who are trying to tamper with elections through manipulation of 
software, we would have seen evidence of it,² he told me. ³Nobody ever commits 
the perfect crime the first time. We would have seen a succession of failed 
attempts leading up to possibly a successful attempt. We¹ve never seen it.²

This is a great oddity in the debate over electronic voting. When state 
officials in California and Ohio explain why they¹re moving away from 
touch-screen voting, they inevitably cite hacking as a chief concern. And the 
original, left-wing opposition to the machines in the 2004 election focused 
obsessively on Diebold¹s C.E.O. proclaiming that he would help ³Ohio deliver its
electoral votes² for Bush. Those fears still dominate the headlines, but in the 
real world of those who conduct and observe voting machines, the realistic 
threat isn¹t conspiracy. It¹s unreliability, incompetence and sheer error.

IF YOU WANTED to know where the next great eruption of voting-machine scandal is
likely to emerge, you¹d have to drive deep into the middle of Pennsylvania. 
Tucked amid rolling, forested hills is tiny Bellefonte. It is where the 
elections board of Centre County has its office, and in the week preceding the 
November election, the elections director, Joyce McKinley, conducted a public 
demonstration of the county¹s touch-screen voting machines. She would allow 
anyone from the public to test six machines to ensure they worked as intended.

³Remember, we¹re here to observe the machines, not debate them,² she said dryly.
The small group that had turned out included a handful of anti-touch-screen 
activists, including Mary Vollero, an art teacher who wore pins saying ³No War 
in Iraq² and ³Books Not Bombs.² As we gathered around, I could understand why 
the county board had approved the purchase of the machines two years ago. For a 
town with a substantial elderly population, the electronic screens were large, 
crisp and far easier to read than small-print paper ballots. ³The voters around 
here love ¹em,² McKinley shrugged.

But what¹s notable about Centre County is that it uses the iVotronic ‹ the very 
same star-crossed machine from Sarasota. Given the concerns about the lack of a 
paper trail on the iVotronics, why didn¹t Centre County instead buy a machine 
that produces a paper record? Because Pennsylvania state law will not permit any
machine that would theoretically make it possible to figure out how someone 
voted. And if a Diebold AccuVote-TSX, for instance, were used in a precinct 
where only, say, a dozen people voted ‹ a not-uncommon occurrence in small towns
‹ then an election worker could conceivably watch who votes, in what order, and 
unspool the tape to figure out how they voted. (And there are no alternatives; 
all touch-screen machines with paper trails use spools.) As a result, nearly 40 
percent of Pennsylvania¹s counties bought iVotronics.

Though it has gone Democratic in the last few presidential elections, 
Pennsylvania is considered a swing state. As the political consultant James 
Carville joked, it¹s a mix of red and blue: you¹ve got Pittsburgh and 
Philadelphia at either end and Alabama in the middle.

It also has 21 electoral-college votes, a relatively large number that could 
decide a tight presidential race. Among election-machine observers, this 
provokes a shudder of anticipation. If the presidential vote is close, it could 
well come down to a recount in Pennsylvania. And a recount could uncover 
thousands of votes recorded on machines that displayed aberrant behavior ‹ with 
no paper trail. Would the public accept it? Would the candidates? As Candice 
Hoke, the head of Ohio¹s Center for Election Integrity, puts it: ³If it was 
Florida in 2000 and Ohio in 2004, everyone is saying it¹s going to be 
Pennsylvania in 2008.²

The prospect of being thrust into the national spotlight has already prompted 
many counties to spar over ditching their iVotronics. The machines were an 
election issue in Centre County in November, with several candidates for county 
commissioner running on a pledge to get rid of the devices. (Two won and are 
trying to figure out if they can afford it.) And the opposition to touch-screens
isn¹t just coming from Democrats. When the Pennsylvania Republican Rick Santorum
lost his Senate seat in 2006, some Santorum voters complained that the 
iVotronics ³flipped² their votes before their eyes. In Pittsburgh, the chief 
opponent of the machines is David Fawcett, the lone Republican on the county 
board of elections. ³It¹s not a partisan issue,² he says. ³And even if it was, 
Republicans, at least in this state, would have a much greater interest in 
accuracy. The capacity for error is big, and the error itself could be so much 
greater than it could be on prior systems.²

GIVEN THAT THERE IS NO perfect voting system, is there at least an optimal one? 
Critics of touch-screen machines say that the best choice is ³optical scan² 
technology. With this system, the voter pencils in her vote on a paper ballot, 
filling in bubbles to indicate which candidates she prefers. The vote is 
immediately tangible to the voters; they see it with their own eyes, because 
they personally record it. The tallying is done rapidly, because the ballots are
fed into a computerized scanner. And if there¹s a recount, the elections 
officials can simply take out the paper ballots and do it by hand.

Optical scanning is used in what many elections experts regard as the ³perfect 
elections² of Leon County in Florida, where Ion Sancho is the supervisor of 
elections. In the late ¹80s, when the county was replacing its lever machines, 
Sancho investigated touch-screens. But he didn¹t think they were user-friendly, 
didn¹t believe they would provide a reliable recount and didn¹t want to be 
beholden to a private-sector vendor. So he bought the optical-scanning devices 
from Unisys and trained his staff to be able to repair problems when the 
machines broke or malfunctioned. His error rate ‹ how often his system miscounts
a ballot ‹ is three-quarters of a percent at its highest, and has dipped as low 
as three-thousandths of a percent.

More important, his paper trail prevents endless fighting over the results of 
tight elections. In one recent contest, a candidate claimed that his name had 
not appeared on the ballot in one precinct. So Sancho went into the Leon County 
storage, broke the security seals on the records, and pulled out the ballots. 
The name was there; the candidate was wrong. ³He apologized to me,² Sancho 
recalls. ³And that¹s what you can¹t do with touch-screen technology. You never 
could have proven to that person¹s satisfaction that the screen didn¹t show his 
name. I like that certainty. The paper ends the discussion.² Sancho has never 
had a legal fight over a disputed election result. ³The losers have admitted 
they lost, which is what you want,² he adds. ³You have to be able to convince 
the loser they lost.²

That, in a nutshell, is what people crave in the highly partisan arena of modern
American politics: an election that can be extremely close and yet regarded by 
all as fair. Not only must the losing candidate believe in the loss; the public 
has to believe in it, too.

This is why Florida¹s governor, Charlie Crist, stung by the debacle in Sarasota,
persuaded the state to abandon its iVotronic machines before the 2008 
presidential elections and adopt optical scanning; and why, in Ohio, Cuyahoga 
County is planning to spend up to $12 million to switch to optical scanning in 
the next year (after the county paid $21 million for its touch-screens just a 
few years ago).

Still, optical scanning is hardly a flawless system. If someone doesn¹t mark a 
ballot clearly, a recount can wind up back in the morass of arguing over ³voter 
intent.² The machines also need to be carefully calibrated so they don¹t 
miscount ballots. Blind people may need an extra device installed to help them 
vote. Poorly trained poll workers could simply lose ballots. And the machines 
do, in fact, run software that can be hacked: Sancho himself has used computer 
scientists to hack his machines. It¹s also possible that any complex software 
isn¹t well suited for running elections. Most software firms deal with the 
inevitable bugs in their product by patching them; Microsoft still patches its 
seven-year-old Windows XP several times a month. But vendors of electronic 
voting machines do not have this luxury, because any update must be federally 
tested for months.

There are also serious logistical problems for the states that are switching to 
optical scan machines this election cycle. Experts estimate that it takes at 
least two years to retrain poll workers and employees on a new system; Cuyahoga 
County is planning to do it only three months. Even the local activists who 
fought to bring in optical scanning say this shift is recklessly fast ‹ and 
likely to cause problems worse than the touch-screen machines would. Indeed, 
this whipsawing from one voting system to the next is another danger in our 
modern electoral wars. Public crises of confidence in voting machines used to 
come along rarely, every few decades. But now every single election cycle seems 
to provoke a crisis, a thirst for a new technological fix. The troubles of 
voting machines may subside as optical scanning comes in, but they¹re unlikely 
to ever go away.

Clive Thompson, a contributing writer for the magazine, writes frequently about 
technology.

Copyright 2008 The New York Times Company
-- 

--------------------------------------------------------
Posting archives: 
http://cyberjournal.org/show_archives/?lists=newslog

Escaping the Matrix website: http://escapingthematrix.org/
cyberjournal website: http://cyberjournal.org

How We the People can change the world:
http://governourselves.blogspot.com/

Community Democracy Framework: 
http://cyberjournal.org/DemocracyFramework.html

Moderator: •••@••.•••  (comments welcome)