The URL can be used to link to this page

Home My WebLink AboutVoting Machines -�-.. .�.�.:=w'K.�.�� ,�%,T-,�s.. . j�_. �......CxX�eh �cwrkF �, �� I II IN86RT BAL� GS fs£AE `" � � � ( � � � � ' •�- � � : ,. .,�. �� . �� v,.. � : .. � ,�, �' � � � The county's system faces doubts aftey analysis of a yecent veysion. i By PAT BEALL and ADAM PLAYFORD � Palm Beach Post Staff Writers � ' fter the punch-card fias- F�� E�� `�R �:�:�:..��R � � `�"�`�$'°r ' co of 2000, the promise of � high-tech voting equip- � ' `�' ' � � N;^ ' . ment was clear: It would count correctly, the first time. � Results would come quickly, cleanly, with digital certainty. i There would be no room • for error. Twelve years, more than � �� $20 million and two high-tech ��^ �� solutions later, Palm Beach �� County ballots are tallied on � a system linked to four major errors in as man � �` y years. Most •�^�r � recently, it shi�ted votes in `'� ° Wellington to declare that two � `: � �`, losing candidates had won. °' � �� "� Months before the county '�� ` �a..� � �� agreed to buy it, security ex '� � �' �� _� � � perts blasted Sequoia Voting *'` � ,,- " �, : Systems' equipment as riddled -�� ` a �-�� with bugs that jeopardized � �� . votes. It was easily hacked. .. � � M°� Even the instructions �vere � °• �� `•^`� � confusing 6RUCE R. 3ENNETT%2012 staff file photo "We found significant secu- Outrage In Wellington Debbie Frazier reacts to the village's March rity weaknesses throughout mix-ups. Her sign alludes to the county's 2000 Bush-Gore fiasco. the Sequoia system," scien- tists wrote in a review ordered JUN� �0�3�3 ',s�i�� :��' �� by California. "The nature of Election: West Palm Beach Election: Palm Beach County these weaknesses raises seri- specia! election to fill city judicial race ous questions as to whether commission seat the Sequoia software can be Error: Two machines recounted relied upon to protect the in- Error: 14% of the ballots the same ballots; two different tegrity of elections." were uncounted results were protluced Thefourerrors,coupledwith qU��ST2�i0� [�ff.�� gQ�,� what the experts found, call into question the ability of the coun- . Election: Indian River County Elections: Wellington village t�s system to perform two basic presidential primary council, Wellington mayor tasks — count votes correctly Error. 10,737 votes were Error: Results were swapped and keep them secure. counted twice among three races How many problems re- main in Palm Beach County's ,�i ,P,�,� , �; Judiclal recount: current version of that system 4 �� Then-CircuitJudge isn't known. Dominion Voting ~-.� � .�� , Richard Wennet watches Systems, which purchased ��` = tabulations for the 2008 Sequoia and its equipment, �� "�� ', election in which he was declined to answer specific ' ��" � � 3 a candidate. questions, saying only that � � ``i: � � � TAYLORJONES the system has improved. The �° � �'` zoos scarr f��e pnoco system's version number has Details on how these races turned out. 18A See MACHINES, 18A ► MORE COVERAGE ��ST OF THREE PA�� . Warning signs: Why the county TODAY: Election MONDAY: Bad TUESDAY: Floritla disregarded a negative review. 19A errors and flawetl voting machines are law prevents the best How machines work: And where tlesign raise doubts everywhere, so can option for ensuring they may be vulnerable. 18A about reliability. security be ensured? accuracy. ; 18A THE PALM BEACH POST REAL NEWS STARTS NERE • SUNDAY, MAY 6, 2012 + �.�__. � U ry ':� g uarl 1;�w_ � � � � • � C � � �� '�y.. .,,..•� �� INBERT 6 ��:'�+E , ;_'{ .. . ...'..-- I I , ' I r � � � � G • l eIn on.eer ea , •• - wa �e-u ca o lcla warns � ► MACHINES�rom 1A V oting system How it works, where it's weak B eyond the problems they found, they criticized the system's design changed only slightly since the �Cali- A 2007 California study of an earlier version of the voting system used in Palm as inherently insecure. `�e are not fornia review — from version 3.1.012 Beach County found numerous security flaws many of which could be optimistic" that addressing some of to 3.1.077 — which usually indicates �' the issues is "even possible" without "a exploited by hackers to steal an election. It s unclear how many of these flaws minor changes. , , comprehensive re-engineering of the Further, its workings are shrouded still remain in today s system, but it appears the versions aren t vastly different. system itself," they wrote. in state-approved secrecy, making it Dominion didn't answer more than impossible for the public to know how THE VOTING THE COMPONENT WEAKNESS NOTED IN STUDY a do�en specific questions from 7he it works. � Paper ba��ot Palm Beach Post about which of the Fixing the problem will take more Voter marks choices. ,%.. e"�„ None. team's findings have been fixed. "The than equipment upgrades, a Palm � .�'�, ,�` :'- systems we offer today," Dominion Beach Post examination of voting tech- � �' '' wrote, "have more robust security nology shows: �,� r • measures and enhanced usability ■ The California study found that ".� � features than earlier versions." The . other systems were equally flawed. �'� '' company did not elaborate. And experts scrutiny of voting soft- Optech Inslght Plus When the report was released, ware has unearthed problems with vir- Voter drops bailot Controlled by chip that can be Sequoia, then an independent com- tually every technology and product, into this scanner, ��'�� `'� U�� ix -: removed and reprogrammed. Pany, dismissed its findings. Steven even as a federal agency established which counts votes - �'' - ' Bennett, a Sequoia official, told a to provide oversight is so weak that its it receives. �MgEaT nA -` Y � California panel that "none of the White House-appointed board has no �' � `; threats outlined represent a realistic members. � threat." Even in 2007, the software the ■ Paper ballots are widely consid- state tested was years old,. he said, and ered better than both punch cards Memory pack "many" of the problems had been "spe- � and �touch-screen equipment. Yet this Votes storetl on - Could be rewritten with virus cifically addressed" by updates. is largely true only because the origi the memory pack, to make scanner'�electively Letting experts go at the machines nal votes can be counted again — and which is removed rejecY ballots. Hacker also in a lab ignores the tight security that Florida law sharply restricts audits from each scanner. could change results. surrounds voting systems, he. said, and recounts. � adding "This was not a real-world More than village council races are scenario." at issue: Florida once more is shaping � , Palm Beach County's voting equip- u as a critical swin state in the YeSI- Memory pack reader ment is stored in a warehouse, count p g p Reader takes results and WinEDS softvrare Removable chip in memory Y dential race. from memory packs and —••••• �,, �• reader is protected by only four Supervisor of Elections Susan Bucher "Wellington better be a wake-up loads them on a PC `'' screws; can be .reprogrammed ' said. Only five people, have access, call," said Ion Sancho, Leon County su- ' . containing vote-counting `-' ' ' to report different results. and it is protected by an alarm system pervisor of elections and an outspoken software that compiles `� Software did nbt check for , and motion cameras. Before critic among Florida election officials. those votes with '► tampering and did not spit out elections, the equipment is taped shut "We should not take this process for absentees and early ' negative votes in a test. with numbered seals designed to show . granted." votes for a final tally. , �- tampering, then shipped to precincts 500,000 lines of code: in locked cabinets. Can an election be stolen? Source: Staff researoh CHRISTOPHER SMITH/Staff Artist Crucial t1SkS are always done with more than one worker present. Computer security expert Matt � "Nobody has access to anything they Blaze was nervous. could alter," Bucher said. It was 2007, and in California, �, . Access to the e ui ment is "strictl � 4• How we got the story q�P Y three dozen computer scientists were �-. �� ___— _ limited and monitored," a statement preparing for a special project. The � Investigative reporter Pat Beall, curious about' what caused the Wellington from Bucher's office said. Declining to assignment from the secretary of � election mistakes started digging. She founda California study highly critical of give "a detailed disclosure of these se state: Peer into the secret workings of B the basic design of Sequoia voting equipment, published months before Palm ' curity methods," the statement contin- the state's four major voting machine Beach County bough� its system. ued: "It's much harder to pick the lock systems. if you�don't know where the door is." - � .� She teamed with investigative reporter and computer programmer Adam Blaze, a University of Pennsylvania Security experts say such respons Playford to discover what this meant for major election errors seen in our area professor, was leading one of the teams es miss the point. Seals can be ordered examining Sequoia equipment. His �::.- since 2008. They pored over documents and conducted dozens of interviews to online and oll workers m for et ei ht erson g Playford uncover a lurking danger that may be jeopardizing your right to vote. � P �,y g to g p group was char ed with check the seal number. poring through the system's source ' � Palm Beach County uses 5,500 code — the instructions, written in to 6,000 poll workers in presidential computer programming language, The team succeeded — Seven times. from across the county. elections, Bucher said. They must be that lay out how the system works. A third group looked at the system's A year after the blistering report, registered voters, which excludes most The mission: See how hard it would be instructions. It found them long, com- Florida approved the version of the Se- felons, though Bucher's office does not to steal an election. plicated and incomplete. quoia system that Palm Beach County do separate background checks on Reviewing source code is no easy The California secretary of state uses toctay, an update from the scruti- them. City elections are run by a differ- task. No method detects all software reviewed the findings and slammed nized California product. The county ent pool of workers, trained by Bucher's bugs. Source code can be hard to the system, calling it "defective," first used the optical scanner system staff but picked by city clerks. follow, especially if iYs written badly. "unacceptable" and "inadequate." She in a June 2008 West Palm Beach City With millions spent on elections, A trained engineer can understand allowed the machines to continue Commission special election. County workers could be prime candidates for perhaps 1001ines of code an hour, the being used — but issued 10 pages of comm.issioners voted last week to payments from campaigns willing t� team estimated. The Sequoia system's security restrictions designed to keep spend $117,000 to upgrade the system. do anything to win. code was more than 800,000 lines long, unauthorized people away from the If a system can be hacked by any written in 10 programming languages. machines. Weaknesses might be worker, "you have to make sure that It might take a year just to read. Four months later, at then- only `tip of the iceberg' the process for selecting those poll They had s� weeks. Supervisor of Elections Arthur Ander- It's impossible to know precisely workers excludes anyone wha might � And so Blaze was worried. What if son's urging, the Palm Beach County what changed from the system Cali- be tempted to do that," Blaae said."`Is they couldn't find anything? Given the Commission voted to spend $5.5 mil- fornia studied, or how many problems that practical to do? Probably not." pro�ecYs difficulty, they could miss a lion to buy parts of that systerr�. In its still exist, in part because Dominion Mistakes would be obvious weakness that someone with bad in- rush to meet a state deadline to adopt won't say. Blaze and his California tentions might exploit. paper ballots, it handed Sequoia a no- team noted in their report that if their even to amateur programmers His fears were unfounded. By their bid contract. spot-checking found half the prob- Back in 2007, Blaze's team was por- six week deadline, they had produced The report's most prominent find- lems, they would be doing "very well, ing over code. a 100-gage report. "Virtually every im- ings took aim at Sequoia's touch by industry standards." They were working at the Univer- portant software security mechanism sereens, now used in Palm Beach They had time to closely examine sity of California, Berkeley, in a secure is wlnerable," they wrote. County pri�narily by disabled voters. only a sliver of the code, they added. room rigged with its own alarm sys- At the same time, a second group, But it also found deep problems with As such, "it's possible that the issues tem. Janitors weren't allowed inside. called the "red team," was trying to the paper-ballot scanners that the identified .in this report might repre- The code was kept on external hard � break into the system in a lab, hunting counry was purchasing, as well as the sent only `the tip of the iceberg,"' they for a way ta take over the machines. central software that compiles results wrote. Continued on next page ► S ome roblems exist `ver de� 1 in the s stem's desi ri p Y pY Y g ► Continued,�"rom pyevious page � The PaC -Man experiment � Readers are kept in Bucher's ware- didate and give them to another. � house, she said, though on election That they succeeded wasn't surpris- At a 2010 security symposium, two drives. At the end of the day, the hard nights, they may be distributed across ing, Kemmerer said. But some of the drives went into a safe. The code never scientists took criticism of vote-counting the county to 17 sites, as part of a new mistakes they exploited were surpris- left the room. software into cartoon territory. effort to report results more quickly. ingly obvious, he said. But quickly, .the researchers real- The duo had been given a In an interview, Blaze said some of "Some of the things that were done, ized the software they were reviewing ��, ��. touch-screen voting machine the mistakes were simple program- anybody who knows anything about was not nearly so secure: `�� :. = used in Virginia's 2008 ming errors that could be fixed easily. security, you don't do," he said. "I don't ■ The code was littered with com- � ��'� elections, a similar type of But others were "architectural deci- think they thought about us getting mon mistakes, includin� many that : �' Sequoia AVC Edge touch-screen sions thatwere made very, very deeply into the software:" are well-known among even amateur ��'�� ,� machine used now in Palm in the system's design," he said. ro rammers for creatin securit �'� �� Beach County for disabled In an ideal world Blaae added, vot- Opening eode to publie p g g y ��?��. voters. ' allows best bri htest to check it holes. Sometimes, notes m the code ��-�. �: ing systems would be designed to limit + g — programmers call them comments They found the software coUltl how much of a system needs to be se- The security of voting systems is — were simply wrong, claiming the be replaced without ever breaking the cure — so if an attacker gets into one mostly reduced to guarding access code did things that it did not. tamper-proof seals, "simply by removing piece, it's not a problem. But thaYs not to . equipmert and maintaining the ■ To protect the system's secrets, its screws and opening the case." how theyre built. secrecy surrounding the software's programmers relied on cryptography, They then reformattetl the election software "The attack surface is very, very, source code. using complex math to either encrypt system to play Pac-Man. large," Blaze said. "Compromising any The code is held by the state and data or ensure it hadn't been tampered part of the system anywhere can be not released to the public. "We could have reprogrammetl it to steal I � with. leverage for getting everything." Although counterintuitive, open votes," the team wrote on a website, but But the programmers often picked ing source code to scrutiny — which "Pac-Man is more rur." A few screws out, outdated techniq�tes, or ones that were i —Pat Beau , Dominion s'ays it supports — actually . wrong for what they were trying to do. � I and red team s leader is in enhances security, experts say. That's And instead of using free, proven-to-be- I ' As Blaze read code in Berkeley, red because it allows others to examine it correct code written by experts, they � ', team co-leader Richard Kemmerer for vulnerabilities and provide ideas to usually decided to write their own — use an infecteri memory pack to mak� I was in Sacramento, going at the equip- strengthen it. then bungled it, the researchers said. the scanner miscount or °selectively ' ment with a screwdriver. "I think secret code is basically a Not once was cryptography .used in reject" ballots, the report said. He knelt beside a high-speed vote way of hiding mistakes," said David a way that made the machines more In spite of this, the scanner and counter the size of a squat bookshelf. Dill, a computer science professor at secure, the researchers wrote. memory-pack software were checked It was controlled by a simple Windows Stanford University who founded the The researchers linked the mis- for tampering only once — by the PC. nonprofit Verified Voting Foundation. takes to at least 15 ways to attack scanner itsel£ The researchers com- If Kemmerer could get to the PC, he And hi�ing mistakes may not help. the system. Five of those applied to pared the system to "asking patrons at could make the system do anything he "The high stakes of many elections high-speed ballot-readers, like those a bar to check their own IDs." wanted. But it was locked in a cabinet can provide rich incentives for illegal that count absentee ballots in Palm With the count�s current system, behind a metal door. abuse," Blaze's team wrote. "The re- Beach County; the rest applied to memory packs are still a security issue. He eyed the lock. It was small but sources of this study were quite small touch screens. In 2007, the Florida Division of Elections sturdy - hard to pick. Keys for it are compared with those that might be ■ As votes moved through the sys- warned that transferring memory packs tightly controlled. available to an organized criminal con- tem, each piece of equipment didn't between the count}�s optical scanners A 36-year computer-security veter- spiracy to commit election fraud." check for errors, even obvious ones. could spread viruses from machine to an, Kemme.rer leads the University of With such resources, an attack on In one test, the main vote-tallying machine. Every memory pack should California, Santa Barbara's Computer the Sequoia system they examined software accepted 50,000 votes from be tightly controlled and always used Security Group, which, is often hired would likely succeed —"even without a precinct with 100 voters. In another, with the same scanner, it said. to break into computer systems to find open access to source code," the team researchers were able to feed it nega- In Palm Beach County, before an � wlnerabilities. He knew� exactly what wrote. tive numbers of votes. The software, election, memory packs are wiped to do: "If the front duor'slocked, you go Bucher, though, said there are dif- WinEDS, was partly blamed for the clean and sealed inside the scanners, in the back." � ferent protections. Wellington screw-up. Bucher said. When voting is complete, He could reach a piece of sheet met To fake results, she said, you would ■ Every part of the system as- the packs are removed from the ma- al that formed fhe side of.the computer ha�e to know secret information about sumed that other parts had not been chines by poll workers, who break the casing. It was held in place by about 16 how the office set up the election — tampered with — while doing little to seal and bring them to central tabula- screws. He had them out in minutes. for example, which memory pack and prevent such tampering. i tian areas. Then it was less than 40 seconds to scanner is assigned to which precinct. For example, Sequoia's paper-ballot ■ The device that reads result� the computer, Once he was inside, the "I'm sure I could get around it," scanners are split in two parts — the from memory packs — called a mem- front door lock popped right off. Kemmerer retorted. scanner itself, and a removable memo- ory pack reader — also was controlled Palm Beach County uses the same He would attack the system by re- ry pack, which holds the results. by a removable, reprogrammable chip. machine for absentee ballots and programming one of the machines, he The scanner was controlled by a That chip, however, wasn't protected keeps them in the warehouse. said, which could y�nk the supposedly � small chip, protected only by a simple by even a simple lock, just four screws. For Kemmerer's team, breaking secret information off the memory lock. The chip could be pulled out and By changing the chip, a hacker could into the scanner was aimost an after- pack even as it flipped votes. reprogrammed, the researchers found. alter vote totals. thought. The researchers had focused "That response is exactly the naive Anyone with access to it "can replace The memory pack reader examined on hacking into Sequoia's touch-screen response that you get from these folks," the chip and change the behavior," in 2007 runs the same software as the machines, similar to those now used in he said. `And they have this fake feel- their report noted. one used in Palm Beach County today; Palm Beach County for disabled voters. ing of safety, because of those things Likewise, software on the memory the reader was not changed in the up- In fewer than 21 days, the researchers that aren't really protecting you." pack had complete control over the, grades between the California review created a speci�l virus that made the O pat_beall@pbpost.com scaY,ner — meaning a hacker could and the Florida certification. touch screens steal votes from one can- O adam_Piayford@pbpost.com + + � / F + THE PALM BEACH POST REAL NEWS STARTS HERE • SUNDAY, i�IAY 6; 2012 19A . & ,; ��xl;/, .�i; � � �� .h:.`. " :� � � INSFRTBAliO7t4E1� 6 t• �� , � _.___, � � � � � � � � � � • . � � Ex su erv�sor recall� red fla s d f n �- e e ds urchase p g� p . By PAT BEALL and ADAM PLAYFORD = Palm Beach Post Staff Writers � �� '. ' �`° s�*� �`` �^ � � rt, � �,y�� s. , �� s�� 1i�� t .� i Four separate times in 2007, Palm " 4 �� .. �� i� ��s��„ �� Beach County commissioners debated > �� ' :� �'. � m r.,:' the merits of buying Sequoia Voting `� °� �- -�" µ�" ""�" k �,�� , � -� � �, �� a� � Systems' optical scan system, logging ;� , , � , Y , ' ' a� � ��-� ��,�� s.� ,,�� more than two hours of discussion. ; � �� ,. Not mentioned once: the security �� F� ��;� �" � �,. % review that prompted California's seo- �A,`� �� '�� ' ,r =� _ � w , .y retary of state to rule a recent version �"' � p& ��'� ; F' ,� ,--� / of the system "defective" and "inad- �"` � � � �'; � ,,� �'" � �, � .� �- equate," even though the review's find- ��'� �; ' °' `'�= ' �` "� ��"' " -�.�.�.0 � -- � � � � � � ings had been posted online months '�� ' ` � � �'=r�� ` �� earlier. � � r � �� , � .' � �;°�," �� " < . �� -. . � �, _. Then-�upervisor of Elections Ar- 3 - `'��_ ' ' _ __- . � � �� , � � � —_ ,. � � � ..�„- =x thur Anderson now says he knew of � ° -� �� '� � _�� p ��'�_� . . , . « � :� ;� �, � .---�`� ` �� i�� a the Califorma review at the time, yes, & : � '� � � � � ; � �� but that's pretty vague at this point." � �° � � Y � � �� .� .� � � � . .� �� , Other systems were equally flawed, he� � ; ; ` � �' � �� ` � � � said, and a committee of residents and �, ,, :"� �� ",� �� ° ``� �� ; � ' �`,.'�� , _: ��,; experts considered the options and ° '��: � �,�,�;- ' �. �� i+��. recommended sticking with Sequoia, � ,:, � ,�� ` ,� ;,�"�� , , � � ;, �� u '° , : the county's touch-screen vendor. � � � �� " ��^�� The county's purchase was spurred ,�' -;, �� ;,'-� � � , � � � � . �� `� � � . � . by a deadline in state law, requir- � �� ., , o- �; �� '�� °`�� . � �� „ ing the counry to switch from touch � � -- `'� ,��,� t� screens to a paper-ballot system. '� � ��` ' � � ° �' �; `� �v ' � -� � e � � ��'- , � � � r �� , The commission debate revolved � � ; � � w � ' �, � � �� - � � � � around whether the county should give �'�" t �� " ,�, �, w�� ` '�� Sequoia a no-bid contract, as Anderson �; � �� '�` ' � ;`�,.� �' , ,,,� r � � �� , � �� .., ; , �� , , urged, and also whether Sequoia would �� :�,� „ � ,�� ;'x� ;� �� ,,�': � " � �� ' � ��l r'�� , �,� `;�" be able to meet a state requirement to � � i� �`� �� ,�';��'�'� � � have a voting system that let the blind ':' .�� C�, j,. ;; �� r ,,�� , vote on paper ballots by 2012. � � r �_ � '"�,� �'� � `r � � ��; ,� � � .� � • .� `, Andersoninitiall toldcommission- �.�� ..� �� `�� n �� ers that staying with Sequoia would � �� 4 � � �� k �� . y � 04 save him time needed to prepare for sRUCE R. sEr,NErrizoos starr;��e P ho�o the 2008 elections. It also would save i her-S;�per✓�s�� ' =�a�iiQ��s ,4rthur Anderson watches as employeeJony �nos uses tabulating equipment in 2008. Despite a California report that the county millions of dol�ars, be- cited security rlaws, Anderson in 2007 urged Palm Beach County commissioners to approve a no-bid contract to stay with Sequoia Voting Systems. cause they wouldn't have to buy new � vote-tabulating software. He cited a derson to stay with Sequoia. Sequoia ' route, she says. Since then,. she has ! ing quarterback. That doesn't win any letter from then-Secretary of State had no plan for disabled voters, he called the equipment antiquated. games," he said. "Sequoia did not have Kurt Browning, which Anderson said added: "That concerns me." Today, the Sequoia equipment is in any more marks against it than other 'told counties to stay with their cur- Still, after all the discussion, com- use in just two of Florida's 67 counties equipment that was in the market at rent vendors. missioners ultimately deferred to An- — Palm Beach and Indiari River. The that time." Other v�ndors begged the county derson, noting that he was elected to 2U12 deadline for disabled voters was People should not be deterred from to put the deal out to bid. Dominion pick the system, whereas their job was pushed to 2016; what the county will voting, he added. "If you cast your vate, Voting Systems, which later bougr�t to approve the money. The vote passe�l do for disabled voters remains unclear. there's a high probability that it will Sequoia, told commissioners the sys- � 6-1, with then-Commissioner Bob Kan- Anderson "really resisted" putting count," he said. "If you do not, you tem was "obsolete." They're "selling � jian dissenting. i the project out to bid, Kanjian said. know definitely it will•not count." old technology to you,'° a Dominion � Anderson ultimately lost a re- There was more ineptness than Asked if he thinks every vote is salesman said. � election campaign to term-lirnited corruptness on this issue, but neither counted every time, Anderson re- Eventually, Browning himself spoke i Democratic state Rep. Susan Bucher. one is excusable," Kanjian said. sponded: "It's not a perfect world." before the commission, clarifying that At the time, she lobbied behind the Anderson defended the deC1S10ri. ppat_beall@pbpost.com his letter wasn't intended to direct An- scenes for the county to go a different "You can always play Monday morn- padam_piayrord@pbpost.com � Election fumbles Four times since 2008, local ballot counts have gone awry using Palm Beach County's Sequoia system. Human error played a role in some instances, but critics say poorly designed systems make human errors more likely. � JUNE �+��DB ��'� � ~ �. �'�� ° �' � � AUGUST 2008 � , `� �.,� � �"Vd�fyW �` 1� ` Election: West Palm Beach City Commission special � ""'� M ��:��';: Election: Indian River County presidential primary. election: Kimberly Mitchell, Gregg Weiss, Rebecca Young. r �� y ;�'��" Error: More than 10,000 votes were counted twice. Error: On election night, 697 votes from three precincts, �'� ,�„• �! " � Tallies were garbled when more than one vote tabulating 14 percent of the ballots cast, were not counted. � ,,� t �' `r machine at a precinct used its r�odem to transmit results. Memory cartridges had been read by machines twice �,� ,�� :<> �� -��; �� The system lacked a feature that could have alerted instead of once tluring pre-election testing. So when actual `� ` elections officials to the problem. votes were entered, a tabulating system prevented them r� ��t�as from being counted, placing them in a special file. � IVIAR��{ 2012 Election staff did not know to look at the special file. �; �, �� Elections: Two Wellington village council seats antl Outcome: The extra ballots did not change the winner of the '��: �'�,�"�; Wellington mayor's race. election; Mitchell won with 59 percent of the vote. ��-: ,� �,r �'` °� >� `� ��' Error. Results were swapped among three races, causing ,,�� -, -r� =, two village council seat losers to be declared winners. 14UGUST 2008 The elections supervisor blamed the software; the software Election: Palm Beach Countyjudicial election: Richard ?: makerdenied responsibility. �1 Wennet vs. William Abramson. Outcome: A state review traced the blame to ballot ALLEN EYESTONE/2008 staff file photo changes made by the elections office as well as a nearly Error: Two voting machines counted the same number of yyEST PALM WINNER: Kimberly Mitchell, flanked by her incomprehensible software system and operating manual, paper ballots and came up with different totals. mother, Anita, and supporterTony Plakas, reacts on election which might have alertetl officials to the error. On election night, Abramson led by 17 votes. After a night in June 2008. Tabulation errors didn't change the result. Dominion Voting Systems, the manufacturer antl machine recount, though, Wennet led by 60 votes. owner of the Sequoia system, admitted it has seen similar • Election observers said machines rejected clearly marked roblems in ast test results, but the were alwa s cau ht ballots as invalid. nearly 3,500 ballots that'disappeared' after election day. A P Y Y g A memory cartridge failed to count ballots, which, along with Outcome: The votes were later found and counted. before election day. human error- ballots had been misplaced - contributed to Abramson was tleclared the winner by 61 votes. —PatBeallandAdamPlayfon� ♦ * —�-�-� --� . ,� ,,. :;. � �� c First ed�tion ' One dollar Monday, May 7, 2012 � ' , .� � ° °� "°° � �� ,: , � � � � � � �� 11NSERT6n__ �-_A ,� I I ' I � , I I � � ` Y ■ �,�. z�ugs tyip up voting technologies of all none is nearly good enough." MORE COVE� �: � kinds despite efforts to pyevent them. In tact a decade's worth of Florida vote `Slapped': � Stalled: counting has been tripped up by technology Official who ,,� � Federai By PAT BEACL and ADAM PLAYFORD of all makes and models, despite a state cer- challenged � oversight � Palm Beach Post Staff Writers tification process designed to guard against system says '+ �-�-� � panel kept arri Hursti rnay be the bestknown such problems. Nationally, studies of the he paid a in limbo 10 . hacker you've never heard of. Largely secret code underpinning election software price. 6A - i= years. 6A . unknown to the voting public, the have uncovered an array of troubles. �'; Finnish computer programmer gained The stakes are high. "These are funda- SECONb OF THREE PAR35 national notorie amon elections officials in mental constitutional rights," said Candice �', ty g SUNDAY: Election errors antl flawetl design 2005 when he broke into voting equipment in Hoke, associate law professor at Cleveland- raise questions about reliability. . Leon County — at the supervisor of elections' Marshall College of Law and a founding invitation — just to show it could be done. director of the Center for Election Integrity. TODAY: Batl voting machines are - Hursti i�as since gone on to examine vot- "It's not a matter of `oh well, the technology everywhere, so can security be ensured? �� ing systems for other states. His conclusion: TUESDAY: Floritla law prevents the best ., "Some systems are better th�n others, but See MACHINES, 6A ►' option for ensuring accuracy. 'r + + 6A THE PALM BEACH POST REALNEWSSTABTSHERE • MONDAY, MAY 7, 2012 ' ,� . .__ c ; ,r� � .: � � � � � a �' �' � � IN�EK �M_�y I I I I I � I I . J � . � - � � � stem ltc es can sta 1 en or ears � MACHINES�rom IA ` �°��'�� '' =' � ��'a y � . . � �� :, 7 � f > .k A 3tiR�' Sv� i= , '' c: � �didn't work this time.' The right to vote , 8� � � � � � � �' �� ° �� : � � is not participation only; it also is th'e �� `� ,,. -.�,�� s �� ;: �� :'�� .� � ��, � s � right to ha�e the vote counted as cast." ��" � � �. � �� r�, Time and time again, that hasn ��' � ` ` f .� �� r� ` � � �,��. �� .� �. �� _ � happened: � � � � z��` � ■ In Union County in 2002, voting �� ' � � '� � �� machines read both Democratic and ' �'� ��ry V Republican ballots as Republican. The � error was caught. The vendor paid for ,,.,�„ �r �„�; ,;� . '�' a recount. � ' �a� � � �_ u � �� € �� k ■ In Broward County in 2004, under i� , '" '� � �� ,�� . � ,.�� certain circumstances, equipmentfrom 4 �� ` � Elections Systems & Software. could � � "� • � ` � �� c unt be ond about 32 000 votes ° not o ,�� , � Y �w: . �' � � � �, . in a precinct. After hitting that total, it �� . �' � � � e ckward. . �.. ed countin ba ,� n . �. � start � _. , g � �� ,. , � . . _ � �' � � � � _ �, �� ■ In Sarasota County in 2006, ap- � �� '�� , proximately 17,800 undervotes, in � � � � � � _:�_ � � d � �� ' ' " � � which voters had not made a selection � � ` -� �� in a tight congressional race, triggered �' '� � V V � �� .�..�.»�..�,�� ,�' allegations of problems with ES&S' �-�-� ` � � ` �.:.�,.. � : � � � �� . iVotromc machines. Investigations � � � -'- �F # $ ` � followed, and some critics say the �, �� '- " �� incident never has been adequately � =��"" �"" °:� �� !r� �� ` explained. ' , ;. ■ In Hillsborough County in 2008, � � " _ °y � � : ; :'� a Premier Elections Solutions system ' �� '"�"� �°-� �� `` ,�, � �� computer server crashed when early � " voting results were fed into it. In 2010, � �� ' � � � � �::.� ��`""��h � � � . �. _ memory cards there failed; a spokes- ' � y` � man for the supervisor of elections � -- � said the company admitted error in sRUCE R. s�n ��-r �c:� ��rrr��e phoco that instance. S tate-cer�'rfied system helps bungle Wellington tallies "The best software written by the Palm Beach County Supervisor of Elections Susan,Bucher (center) oversees a machine recount of Wellington's March elections after wrong wealthiest companres is buggy be- vote totals were found. The state blamed the error, in part, on confusing software and instructions, both of which it hatl certified. cause software is really hard to get right," said Douglas W. Jones, a profes- " sor of computer science at the Univer- `� . , ,..,,�: ��;�° In the recent Wellington snafu, the sity of Iowa and co-author of Broken Division of Ele�tions blamed problems Ballots: Will Youy Vote Count? � �� ' in part on a confusing software system �"'� �"' i �� with nearly incomprehensible instruc- "It's not the kind of thing you blame #� j; �`"��, �,. , , ori one vendor." �.' � �.�:�;, ; �: �,: tions. Both the software and the in- �' � �-�° structions were certified. Vulnerabilities abound � ,' � ��-f j��.' Two other parts of the counry's �� : '�u A �' � s stem also assed certification but Researchers ha�e unearthed bugs � : r.°- _ y p almost ever here the look. A Uni- =� ` '� °• :, , °� � .� ' don't work, said Palm Beach Counry Y�' y � , 7 ,v ? versity of Pennsylvania review of an M �;,�-. - -� � .,yx: � Supervisor of Elections Susan Bucher: ES&S product used in Ohio found "� `' `�� the system's modems, which she says ,:. "numerous exploitable vulnerabilities '� �; ��:- are unusable, and the high-speed scan- in nearly every component," enabling �� ' , R t ;"�°` _ �' ners' ability to read multipage ballots attacks that could falsify precinct �� ;;� � �. �; " h.' during recounts. The latter delayed results and erase audit records that � :� r �� ' results in a tight school board race for might catch problems. ��;� � �� ti � "� 8 � 2 � ;L , �� '°"'� � � � � :� days in 2010. � 4�ws�,�, F 6 p� �' 1 !' f ,ro , ,� Y o �� .mt ?� ,� , �� ,. A Florida State University review of �',� �, �` �� ,„� �� r �..�.� ��; ,� � � � � �� -� Alarming discoveries ' a Diebold elections system found that, ° '��;��,�„ ` { �- � � � � � � , � ; even after upgrades, "many document- �r��"° �` �� oA� � :,_,�� Further, problems deep within a I ed vulnerabilities remain. The system �?�"` �`� R � ` system can remain hidden for years. � retains significant weaknesses." ,. �� California's Humboldt County ran its Princeton and Lehigh University � ��`e state-certified computer software sys- I professors found that Sequoia's AVC ��'" g° `' " tem, known as GEMS 1.18.19, without ' " Advantage vote-counting system was utahcountvotes.org incident through multiple elections. , easily hacked by replacing just one Hired `haeker' tests vote maehines' SeCUrlty Then, in 2008, the system deleted computer chip. "This `hack' takes Harri Hursti (left), a computer programmer who hacked into Leon County's state-certified 197 votes. It was a small number, but just seven minutes to perform," they Registrar of Voters Carolyn Crnich no- wrote. " The fraud cannot practically Diebold vote machines in 2005, checks a Diebold system in Emery County, Utah in 2006. tified the California secretary of state be detected." • � Q who sent a two-man team to look more Florida's tou h certifieation s stem But neither independent testing nor tested many of the nation's electronic closely at the software. g Y the state's stamp of approval is a sure- voting systems. What they found was alarming. Making sure voting machines work . fire way to spot trouble. In what is now known as the Hursti Atnong other things, it was easy to correctly in Florida falls to the state In 2007, for inszance, federal au- Hack, Leon County Supervisor of erase the trail of votes. The manu- Division of Elections, which certifies thorities temporarily barred indepen- Elections Ion 5ancho points out that facturer had known about software equipment as sound before it can be dent lab Ciber Inc. from testing voting the vulnerable Diebold equipment had � errors for four years without notifying used by counties. systems after finding flawed quality- been certified by the state. Tallahas- anyone. "I will tell you that Florida is one control procedures; Ciber already had see, said Sancho, "didn't find the bug." The California secretary of state of the toughest states to get a voting � decertified the entire system on the system certified in, and we make no grounds it couldn't be trusted. In 2009, apologies for that," then-Secretary of Florida's Division of Electioris strongly , State Kurt Browning told Palm Beach � �� How we got the story encouraged counties using GEMS County commissioners in 2007. ` "^ ��------------------- — ------ --- ----" 1.18.19 to upgrade their system. That means an extensive battery of ` �� Investigative reporter Pat Beall, curious about what caused the Wellington By then, a version of GEMS 1.18.19 tests, most of which are more about �. � election mistakes started digging. She found a California study highly critical had counted votes for at least five . reliability than security: Does the sys Beau of the basic design of Sequoia voting equipment, published months before Florida counties in 2008. I� currently ' tem work when exposed to cold? Heat? Palm Beach County bought its system. counts votes in Glades and Polk coun- Humidity? State elections officials Investigative reporter and computer programmer Adam Playford teamed with ties, where, supervisors of elections even lift every piece of equipment the Beall to discoverwhat this meant for major election errors seen in our area report, there have been no problems. length of a ruler, then drop it eight ��" since 2008. They pored over documents and contlucted dozens of interviews It remains certified in Florida. times�, once on each corner, to make p�ayford to uncover a lurking danger that,may be jeopardizing your right to vote. O pat_beaii@pbpost.com sure it still works. � p adam_playford@pbpost.com • � ' Panel formed after e�ection Sl�.e tic sla ed around for tes� p pp . . . of 2000 reinaln� ln limbo LeOn COUnty off2C2Cll SClys StCZte already certified that equipment �. In fact, Sancho said CObb Uri2XpeCt- � By PAT BEALL and ADAM PCAYFORD riOlTllrilted, bUt 110 one has �`X° "" w been confirmed and it has SZC�2l� 2172tj'G SySt2YYl�S ve121�0Y. Palm Beach Post StaJf Writers edly called him to a meetirig that he believes was the first step in removing P� VVk�en it comes to vulner- been almost a year since the By PAT BEALL and ADAM PLAYFORD h11T1 fT'Om Off1Ce. The P23SOri: f1l�lrig t0 � able vote-counting systems, confirmation hearings. It Patm Beach Post StaffWriters secure voting equipment required to "this is not a Florida prob- has only an acting executive Tallahassee has not always rolled meet federal disability standards. � lem; this is a national prob- director. Its budget has been out the welcome mat to challenges of But that was suddenly difficult to do. lon Sancho lem," said Ion Sancho, Leon slashed by roughly 35 per- state-certified voting systems. The only three voting vendors allowed to Leon County County's longtime supervisor cent and Rep. Gregg Harper, Take Leon Counry Supervisor of do business in F'lorida now refizsed to sell supervisor of elections and a nationally R Miss., still dec: ies it as Elections Ion Sancho and what came to him election equipment. "He definitely of elections known critic of election sys- "bloated." be known as the "Hursti Hack." In 2005, got slapped around pretty good," said � tem security. The House last year voted Sancho agreed to allow Finnish com- Bev Harris, founder of Black Box Voting. When It `The insecurities and prob- to eliminate it. The Senate puter programmer Harri Hursti and According to Sancho, itwas only after lems are pertinent to every ven- hasn't taken action on the security consultant Herbert Thompson Charlie Crist, then the attorney general, COIfleS dor ar.d every technology used House bill. to try to break into elections software issued subpoenas to the voting compa today, and there is no political Federal certification of . made by Diebold. - nies, imp�ying antitrust violations, that to voting will to do anything about it." equipment isn't mandatory, It turned out that votes counted one of the companies relented. SyStetllS, The failure of political will and just a few systems have by a central tabulator could eas- Sancho got his equipment... He re- starts in Washington. been green-lighted. One of the ily be corrupted and the audit trail re- mains in office. ` have The U.S. Election As- ones still waiting on approval: programmed to provide false results. And he still has qualms about vot- sistance Commission, put the roughly $117,000 update to � "A house with an unlockable revolv- ing systems. "I have the best technical SOPt Of in place two years after the Palm Beach County's system. ing door," summed up Hursti in a staff in the state of Florida and that adopted disputed 2000 presidential But Washington's bless- ` white paper for Black Box Voting Inc., still is no � guarantee° the equipment election, oversees federal cer- ing won't be needed. Florida, an election watchdog group. will work as promised, he said. t X Files tification of voting equipment. which has its own rules on Far fmm being alarmed, then- When it comes to voting systems, hI�OSO- The commission is sup- certifying voting equipment Secretary of State Sue Cobb accused "I have sort of adopted the X-Files phi- p posed to have four members, before it's sold to counties, Sancho of undermining voter confidence, losophy: Trust no one." phy Trust appointed by the White House doesn't require EAC approval. he said. "They sided with the vendor," � pat_beali@pbpost.com , and confirmed by the Senate.� o pat_beaii@PbPost.com � he said, "partly because the state had O�d am_playford@pbpost.com n0 O�.le It has none. Two hav �° beeri , p adam_playford@pbpost.com + • + Tuesday, May 8, 2012 �EAL HEWS STARTS NER Final eaition One dollar f : - �. �" �y�, �,�,r �;°� � ; , � .:^ , �'»v .s' � ��.�� INSER7 � 6' ��:�h . _.� . � I � � 1 ' � � � � - � � or�aaw �n�rsv oeau �s Defanged'rules allow erroys Hoke, founding director of the after an election — typically no LAST OF THREE PAF��'S to slip thyough Czn expe�'ts[lys. Cleveland-based Center for Eleo- more than `L percent of precincts SUNDAY: Election errors tion Integrity, — and only after the winners are and flawed tlesi n raise ` By PAT BEALL and ADAM PLAYFORD said a ballot � Two companies formally declared. g Palm Beach Post Staff Writers cdunt after controt tallies. 6A "In defense of the legislature . 4uestions about reliability. Candice Hoke votes, but with the election is ■ Simple ways to in Florida and elsewhere," Hoke MONDAY: Bad voting some skepticism: "There's truly one key way reduce errors, 7A said, "they are not trained in � machines are everywhere, no leg'itimate basis for trusting to sidestep vul- software; they have often been so can security be this election software when we nerabilities in technology. told software and computers can't ensuretl? know it is erratic, that it some But there's a problem. make mistakes." TODAY: Floritla law times produces valid results and Under Florida law, supervisors prevents the best option sometimes not." can audit only a tiny slice of ballots See ELECTIONS, 7A ► for ensuring accuracy. • • _, �ertaint , not s eed, should be N e� a u d l t m e t h o d c o u l d �� y p • � � state s to concern- activist sa s detectlon of f laws - and f ix thern p ' y By PAT BEALL and ADA�vt PLAYFORD for laige statewide races than for small ► ELECTIONS�rom 1A selected race. P«tf�t t3�a��r Post st�,fftit�Ytters municipal races. To addr that, Stark For example, if there are five races In California, 13 million people developed a version that relies on fewer In fact, Palm Beach County uses a for county commissioner, only one voted in the 2008 presidential race. I3ut ballots, But it also requires elections of- vei•sion of an elections software sys- race can be audited. So elections offi- double-checking the result could have ficials to know how their vote-cotmting tem sharply criticized for a myriad of cials may wind u� choosing a race that been as sirnple as looking at the right equipment interpreted eveiy ballot they vulnerabilities by a group of California had no problems, while missing a race 96 ballots. look at — something most current sys- scientists who got a rare glimpse at its that had off kilter vote counts. Post-election audits in Florida are tems don't provide. underpinnings. It has been linked to Given those rules, finding prob- done with hand recounts of a sliver In the long term, that likely will � four local errors in four years, includ- lems like those in Wellington "is al- of ballots, taken from a few raridom change, Stark said. Voting systems ing double-counting more than 10,000 most like blind luck," said Ion Sancho, precincts. They help identify wide- under development will allow ballot by- votes in Indian River County. Leon County's supervisor of elections. spread problems, as one did recently ballotreviews. But a strong audit — a hand re- "Unless you actually pick the race in Welling when it caught the fact Meanwhile, elections officials have count of paper ballots — can foil even with the problem, you will not find a that results for three i had been found a work ai — electronically the most determined hacker, said problem." accidentally switched by Palm Beach scanning every ball.ot, then recount- 36-year computer-security veteran Hoke agrees. "Florida audit law is County's vote-counting software, ing them with a computer program , Richard Kemmerer, who has broken designed not to catch any problems But they tell you nothing about what that gives them the information they � into voting equipment at the request with machine counts unless they are of two secretaries of state. Equipment huge," she said, "a sort of caveman- appened in precincts that weren't >>eed. As long as their program's win- could be hacked, he pointed out. Paper quality tool." checked. In theory, a huge problem ner matches the one produced by the could go undetected. , county voting system, they can check audits can't. "I don't have a way around Others are more critical. A new method of audit — developed its results and be statistically confident that," he said. The audit law is "desigrted to pre- by Philip Stark, statistics department the election was decided correctly. In Wellington, it was an audit that vent embarrassment," said Philip vice chairman at the University of Cali- Essentially, this means the shortei• fotmd two losing candidates had been Stark, vice chairman of statistics at fornia, Berkeley — gets around that. form of audit could be done in coun- named winners. It took a judge s ruling the University of California, Berkeley, , Stark's method woi like an ties, like Palm Beach, that use older to straighten out the mess. and an expert on auditing election opinion poll, by looking at a random voting systems. , Thats backward, said Dan McCrae, results. sample of ballots from across the race. Using risk limiting audits officially president of the nonprofit Floricla Vot- Stark described it as "deliberately The key word is random: The ballots in Florida would require changes in ers Foundation and a contributor to a defanged": It can stop someone from have to be picked with precision, from state law In California, where most of national "best practices" white paper knowing for certain that a problem a master list of every ballot cast. Once the experimentation is taki�g place, on audits. occurred, he said, sparing elections picked, only that ballot will do. the legislature passed a bill requiring Winners should be declared only officials unwelcome criticism. The number of ballots reviewed de- that risk limiting audits be tested, he after an audit makes sure there are no "Florida could be a, leader here pends on the margin of victory. Ti�hter said. problems, he said. Otherwise, its like by coming to terms with election races need more ballots. In California Still, one advocac i•ou the Veri- closing the barn door after the horses software in a realistic manner and in 2008, Barack Obama won with 61 fied Voting Foundation is pushing to � have left." working with some of those who have percent of the vote, so 96 ballots would persuade states around the country It might take more time, McCrae dedicated years to developing audit do. If Obatna had won with 52 percent, to use the method to double-check � said, but "lawmakers have to decide tools," Hoke said. the state would have needed to check November's presidential race. Last I if the intent of the law is to find Prob- What state lawmakers should not about 3,900 ballots, Stark said. month, the MacArthw Foundation Unlike Floricia's audit s stem, lems, or if it is to draw some kind of do, she said, is "defer to the machine. Y -- known for its "genius grants" and line somewhere and just put an eleo- That's worse than an ostrich with its which doesn't specify how to fix any its onetime aast Palm Beach County tion to bed." head in the sand." problems it finds, Stark's includes a land holdings — announced a$300,000 Further, the law states post-election � pat_beall@pbpost.com built-in fix for ei•rors. As elections of- grant to Verified Voting, which Stark audits can involve only one randomly p adam_playford@pbpost.com ficials count, they do simple math to said will help the group explore such make sure the results they're finding methods. make statistical sense, based on the "For margins down to a couple of �� , H�w we got the story original result. If the results are too far percent in a state, we're only talking ^� _ _ — from what was expected, officials keep about looking at a few thousand b�l- � counting until the statistics s nc u ��" Investigative reporter Pat Beail, curious about what caused the Wellingtan � � Y p— lots, drawn from the entire state;" �` „� e�ection mistakes, startetl digging. She found a California study highly criticai oi; if the equipment failed completely, Stark said. "We could really have� a lot until they've counted every ballot. more confidence in the outcome with a Beail of the basic design of Sequoia voting equipment, published months before Palm Beach County bought its system. "It's an intelligent, incremental re- relatively small investment — without Investigative reporter and cc,mputer programmer Adam Playford teamed with count that stops as soon as i�s clear that having to change the voting systems, � its pointless, Stark said. `Youre going to without having to rescan the ballot I BeaU to discover what this meant for major election errors seen in our area count until you have strong evidence that without having to do anything fancy • ,�,, �, since 20d8. They pored over documents and conducted dozens of interviews you'�e wasting your time." at all." Piayford to uncover a lurking danger that may �e jeopardizing your right to vote. , Because the audit is based on the mar� O pat_beaii@Pbposc.com ; �gin of victoty, the system is mare usefu O adam_playford@pbpost.com , � , + + � THE PALM BEACH POST REAL NEWIS STARTS HERE • TUESDAY, MAY 8, 2012 7A ____ `� , z �` k � , INS� r�� I I � I� ' I I . � • J lm e ste s cou catc tec n�ca al ures . L p By PAT BEALL and ADAM PLAYFORD �� w x- ,,,�_ �.. , nia who studies computer security. � Paam aea�h Post std�wy�ter� ' __, �� ` �',� "The only thing we really have," Carolyn Crnich likes to be second- `� " ,� i, � Blaze said, "the only technique that guessed: The registrar of voters in -�,,,� �°,. , ,, �� e�_ •� seems to work at all, is inviting as Humboldt County, Calif., scans every � -�` �� "� wide a range of people as possible � r : _° � ��"�'�- ' � � � { � � �� to poke holes in it before its actually ballot and makes the election results "' �� ,.� .-�--u ' available, online or on disk, so that � '�" ��` �,. '��'� used, and hope they have the incentive anyone, anywhere, can count them. _ �� ,�: to tell you about it rather than to steal Community activists do just that. �� ,� the election." T he resu l t: 1 0 0 percen t au di ts o f t he �." supervisor's results, a sharp contrast �,=� �._ � Florida law restric#s access to Florida, which limits vote counts to a '� �'`" ' ■ Look at every ballot — twice. �� W - small number of ballots in a single race. , Humboldt County got it right, said "I don't like saying to my constitu- Bev Harris, founder of the advocacy < > » �� id,' '�`i! ents, Hey, just trust me, Crnich said. �„;�,� �� : group Black Box Voting Inc. Easy pub- "Now, I don't have to. Count them your- � f', � ��' '�� lic access to ballots from its roughly se l f, an d i f you fin d an y t hing ou t o f t he � �_` 7 5, 0 0 0 voters, an d t he resu lting in de- ordinary, I want to know" � .� �'� pendent count, "is brilliant, simple ' In 2008, the Humboldt County Elec- �: �,,,� T'�� ;' �. ,;,�° " and inexpensive. It gets to the core tion Transparency Project did find LL °�. ` � ,kr� , problem, of the public being able to something out of the ordinary: 197 Photo �o�rtes or � oN� P�NTOiN�mbo��t co�� E�e�t�o� T�a�spa�� P�oJe�� authenticate elections results." ballots dropped by machines. . , In Palm Beach County, which has That led to an examination of the Emphas�s on transparency 832,000 registered voters, ballots are elections software used in Humboldt Carolyn Crnich, registrar of voters in Humboldt County, Calif., scans ail ballots and invites the available for review only in person, a�out 200 miles north of San Fran- public to check results. 'I don't like saying to my constituents, "Hey, just trust me," ' she says. and state law requires they be handled cisco. So many problems were found, only by elections personnel. the system was decertified for use in ■ Create a national publicly avail- Why is source code secret? However, an experiment similar to California. It continues counting bal- able database where elections officials ■ Open up the source code, the the Humboldt County pmject is under lots in two Florida counties without and voters alike can compare notes on largely unseen underpinnings of elec- way in six Florida counties. There, in incident, although a state Division of what technology worked, what didn't, tion system software. what is known as the Florida Election Elections advisory urged counties to and possible fixes. . Right now, manufacturers typically Verification Project, all ballots also are get an upgrade. "The same failures occur with the consider such code a trade secret. scanned — but instead of posting them But elections supervisors shouldn't same machines, in one jurisdiction or "Releasing source code is a pretty online, the Florida project limits the task get too comfortable with any system, another, election after election," Law- good idea, starting with the fact that of counting votes to special software. experts say. rence Norden wrote in a 2010 report companies would try to clean it up to Created by Clear Ballot Group Inc., "You don't want to be dependent for the Brennan Center for Justice at make it presentable," said David Dill, a Boston firm, the software's lightning- on software or machines, really," New York University Schaol of Law a professor of computer science at fast ability to recount ballots — and its said Ronald Rivest, a pioneering MIT 1VIost of the elections officials inter- Stanford University who founded the ability to spot problem ballots where computer science professor. "You need viewed by researchers "claimed to Verified Voting Foundation. marks for a candidate may be confus- some process that a�oids that necessi- have had no prior warning." The current practice of keeping ing — won the enthusiastic endorse- ty. Because machines can have errors A case in poinf: Diebold had known source code secret may seem wise ment of former Secretary of State Kurt or bugs in them." about f laws in one of its systems for — a way of making it harder for crooks Browning, in part because the process Solutions call for trans arene four years before it miscounted votes to know how the system works. But it provides a 100 percent audit. "I stood p y in a California election. runs contrary to decades of computer- there with my mouth hanging open, There are solutions to high-tech ■ Public disclosures of problems security wisdom, which ridicules the thinking, `You can really do this?"' trouble. But first people have to get should be maridatory, said Norden, practice as "security through obscu- Browning said. �past the notion that elections systems deputy director of tfie Brennan �Cen- rity." Before the pilot program ends this are somehow safer and more reliable ter's Democracy Program and author Publicly available code can be ex fall, it will have recounted more than than any other technology, said Doug- of nationally recognized papers on vot amined by a wider field of experts, 2 million Florida votes. State elections las W. Jones, professor of computer ing technology. dramatically increasing the odds that officials have been intrigued, said science at the University of Iowa and As it stands, elections system manu- problems wi11 be found. Open-source Leon County Supervisor of Elections co-author of Broken Ballots: Will Youy facturers aren't necessarily obligated to programs are used on the Internet for Ion Sancho. Vote Count? report problems to supervisors of elec- many areas where security is crucial. � There's a hitch, though. Even Google got hacked, Jones tions or state voting officials. For example, popular Web browser The software can recount ballots pointed out. "Why would you expect "We keep track of problems with ga- Firefox is open-source, as is the heart within a matter of hours. It spots prob- cash-strapped county elections officers rage door openers, toys and the safety of competitor Google Chrome; both lems and could find flaws before results to be able to afford expertise to stand of lawn mowers," Norden said. are counted on millions of times a are final. But it can't be used to officially up to those kinds of threats?" he asked. "My argument is that we treat vot- day to securely transmit credi� card double-check all elections results. Yet there's no shortage of ideas, ing machines the same as we do other information. State law forbids it and would need many of them simple, to increase the products, with some regulatory over- Secrecy doesn'f work, emphasized to be changed. likelihood that ballots will be counted sight and somebody keeping track of Matt Blaze, a professor of computer O pat_beall@pbpost.com accurately and safely. Among them: problems." , science at the University of Pennsylva- p adam_Piayford@PbPost.com