Democratic Underground Latest Greatest Lobby Journals Search Options Help Login
Google

Vermont's Vulnerable Election System

Printer-friendly format Printer-friendly format
Printer-friendly format Email this thread to a friend
Printer-friendly format Bookmark this thread
Home » Discuss » Topic Forums » Election Reform Donate to DU
 
garybeck Donating Member (1000+ posts) Send PM | Profile | Ignore Sat Nov-15-08 11:46 AM
Original message
Vermont's Vulnerable Election System
Vermont Commons recently published my article outlining Vermont's election system and our dismal Secretary of State

-----------------------------------------------------

Vermonts Vulnerable Election System
by Gary Beckwith, Vermonters for Voting Integrity
http://www.vtcommons.org/journal/2008/10/gary-beckwith-...

Begin by asking yourself this simple question: Who counts the votes?
The counting of votes used to be done by people, in public view,
as required by the 1965 Voting Rights Act. Representatives from
both major parties, the press, and federal election observers could
watch the counting process. The reasons for this seemed obvious:
you cant cheat when people are watching.

But what would you think of a plan to take all the ballots on
election night, and give them to a private corporation which would then
count them behind closed doors, where no one can see?
Crazy, most people would say. Yet most Vermonters are unaware
that this is much more than an idea or a plan. It is happening
right here and now in our state, every November. This secret
vote counting began in 1994, when Vermont started using a
vote-counting system made by Diebold Election Systems, one of a very
small number of private corporations in the so-called vote-counting
business nationwide.

Every election, voters in Vermont mark the ballots by hand.
Thats good. But then we citizens feed them into the Diebold
optical-scan machines that count the ballots. Election officials
read the numbers printed out by the machine, and announce the election
results. But the answer to the question who counts the votes?
requires us to go deeper. Since the machines count the votes, it
is the people who make and own the machines who actually do the
counting. We just trust that theyll do it accurately.

What most of us dont realize is that vote-counting computer
programs can be written to cheat in just about every way imaginable
they can flip votes, change vote totals, even trick those who test the
machines to think theyre counting properly, when in fact theyre not.
And heres the final sucker punch: even software experts are not
allowed to review these vote-counting programs because the programs are
considered proprietary information.

In a democracy, no person or company is supposed to be counting
votes behind closed doors, no matter how trustworthy they may be.
Thats why the law calls for election observers.

Diebold: What do we know?

Back up for a moment. If youre going to trust a corporation to
count your votes behind closed doors, you ought to pick a company with
a strong reputation of being open, unbiased, fair, and
trustworthy. But Diebold is none of these. Just a few
eyebrow-raising facts from Diebolds shady history:

The company has been sued by its own shareholders for fraud.
It is under investigation by the Securities Exchange Commission.
The Secretary of State of California fined Diebold millions of dollars for using untested software and lying to officials that it was tested.
Diebold employed five convicted felons as senior managers.
Diebold's former senior vice-president and senior programmer was convicted of 23counts of felony theft, among which was planting back doors in his software.
In 2004 the president of Diebold promised to help get George Bush re-elected.
A review of the software in 2005 found illegal code that could be used to manipulate vote totals without detection.
The secretary of state of Ohio has sued Diebold for breach of warranty, lying to state officials, and fraud.

Diebolds reputation is so bad that the company had to change its name
(it is now called Premier Election Solutions, but we all know its the
same old Diebold). You have to ask yourself: This is the company were
trusting to count our votes?

The 2004 election: Guess again

Four years ago, Democratic presidential candidate John Kerrys exit poll numbers clearly showed
him winning, yet Mr. Bush appeared to triumph at the end of the day.
Statisticians reported the odds were astronomical that the polls could
be off by that much. Conspiracy theorists questioned the results of
the secret vote counters. Blogs and alternative news agencies
warned of the problems of the voting machines.

But now, the tinfoil hatters are not the only ones sounding the alarm.
The worlds most respected computer-security experts have come together
with a litany of reports and independent studies that call attention to
the numerous problems with our national vote-counting system. The most
comprehensive is the Brennan Report , which was conducted by a task
force of computer-security experts including the heads of security at
Microsoft and Lawrence Livermore Labs, as well as expert computer
professors from Yale, Berkeley, NYU, Stanford, and other
universities. It concluded, All three voting systems have
significant security and reliability vulnerabilities, which pose a real
danger to the integrity of national, state, and local elections
(emphasis added). Many other independent studies have raised the
same concerns about the voting machines. And get this: not a single study has concluded the machines are safe.

The secret vote counting by private companies is not the only
problem. These studies have also shown that its fairly easy for
a third party to hack into a voting machine and change the election
results without being detected. Just affecting one machine can
spread to others and affect large elections. Even without intentional
fraud, a simple error or bug in the code could enable a mistake that
could go undetected. Whether its rigging by the companies,
hacking by a third party, or just plain errors, our national voting
system is vulnerable.

Green Mountain vote countin

In Vermont, we do have the advantage of having paper ballots. We could hand count our votes
if it seemed like there was a problem, and this process would tell us
the real results. Some other states still use touch-screen
machines that dont afford that capability. There, the voters
original intent disappears into oblivion the moment the vote is cast,
and along with it any chance of doing a recount or verifying the
results in any way. Thankfully, this isnt allowed in our state,
but the national picture is scary, as a large portion of the coming
presidential elections votes will be on invisible ballots that can
never be recounted or verified. There is reason not to trust the
results, whatever they are.

Although our state law demands paper ballots that can be
recounted, we have been lulled to sleep, thinking this Diebold
optical-scan system is the answer to all the problems. When the
mainstream press does focus on the voting machine problem, its usually
on the touch-screen machines. But as the Brennan Report concluded, the
paper ballot, by itself, is of questionable security value. The paper
ballot has significant value only if an automatic, routine audit is
performed.

The expert studies have found numerous vulnerabilities with the
scanner-based systems. One study at the University of Connecticut
focused exclusively on the exact system we use in our state. It
concluded:

...we demonstrate that it is to strengthen
known attacks ... so that they become undetectable prior to elections,
or to conditionally bias the election results to reach a desired
outcome.

...we demonstrate a "time bomb" attack in which the bytecode checks
the date and time in order to decide whether the election has begun.
retain proper behavior in pre-election testing, while behaving
improperly during the actual election.

..if the Optical Scan printouts are the sole means of reporting the
election results (as it is the case in fact in many jurisdictions) then
one can write quite complex malicious reporting functionalities that
get triggered in specific cases (when e.g., the number of votes of a
certain candidate are below a certain percentage) and perform arbitrary
vote transfers between the candidates.

The now infamous demonstration called the Hursti Hack featured in
HBOs film Hacking Democracy showed that an easily removed memory card
on the Diebold scanner can be programmed to change the election
results, and none of the pre-election testing done on the machines can
detect any problems whatsoever. When the Secretary of State of
Pennsylvania saw this, he banned the use of the Diebold scanners
completely.

Debra Bowen, secretary of state in California, expressed similar
concerns, commissioning an independent top-to-bottom review of the
voting machines. After the study she concluded our machines to be
unacceptable or defective, and put significant restrictions on their
use restrictions we do not follow here in Vermont.

Meanwhile, when Jennifer Brunner, secretary of state for Ohio,
found a bug in the vote-counting software that caused the machines to
count incorrectly, and determined that Diebold knew about it and lied
when they sold the system, she sued them for fraud.

Whither our secretary of state?

While Vermont Secretary of State Deb Markowitz continues to defend the security of the
vote-counting machines, in spite of numerous studies like these, she is
starting to find herself in the minority. There are proactive
steps citizens and our secretary of state could take, but unfortunately
Vermont does not currently follow several of the recommendations
outlined by the studies and reports.

The most important recommendation in virtually all of the
reports is to conduct random audits on every election. This means
to randomly sample some of the ballots, count them by hand, and compare
them to the machine count. The more you sample, the greater your
confidence level that the machine count was right.

Many other states are following the expert advice and taking
this preventative action. Connecticut now randomly samples 10
percent of the ballots and counts them by hand. Ms. Bowen in California
has mandated audits on all elections. New Jersey now hand-counts
a portion of the ballots of every election. In New Jerseys example,
the size of the sample to be hand-counted is determined by a
statistical analysis of each election, with a goal of providing a
99-percent level of confidence in the results. As of 2007,
thirteen states had passed laws requiring regular audits of the
machines. Here in Vermont, we have no audit law we have just one line
of text in the statutes giving the secretary of state the power to
conduct an audit if he or she chooses but no specific rules or
guidelines on how or when to have one.

Instead of using her power to implement recommended safeguards,
Deb Markowitz has gone on the record many times saying our electoral
system is safe. On numerous occasions she has been questioned about
voting machine security, but always responds by mentioning that the
machines are tested before every election and these tests would detect
any problems or fraud. This explanation stands in complete defiance of
the studies, all of which state clearly that no testing can detect the
kinds of problems that are possible.

Mistakes were made?

Our secretary of state has even made
misleading statements to the public concerning the system. When
WDEV radios Mark Johnson once asked her about the Brennan Report, she
responded that the report demonstrated why our system is safe, because
we are already following all the recommendations in it.
Sadly, this could not be further from
the truth. At the time Vermont had never conducted a random audit the
very first recommendation of the Brennan Report. Several other
clearly marked, bulleted recommendations continue to be ignored (see
list at the end of this article). We can only wonder if she
actually read the report, if she made a mistake, or if she deliberately
misled the audience into thinking our system complies with the
recommendations.

On another unfortunate occasion, Markowitzs associate Kathy
DeWolfe, the states director of elections, was asked about the Hursti
Hack (the test that demonstrated how vulnerable our system is to
third-party hacking. DeWolfe responded by saying she called up
Ion Sancho, the supervisor of elections for Floridas Leon County, who
set up the demonstration. She said that Mr. Sancho told her that
as long as the memory cards are kept secure, our system is safe.
However, when questioned about the phone call, Mr. Sancho said he never
would have said such a thing because it isnt true, and in fact keeping
the memory cards secure only prevents one of many types of
vulnerabilities with the system. Why would Ms. DeWolfe
misrepresent Mr. Sanchos remarks and mislead us to thinking the system
is safe when it is not?

Each time a new report comes out, which is fairly regularly now,
the Secretary of States Office responds with unsubstantiated criticism
of the report and unwarranted defense of Diebolds system. Who
understands the machines better the heads of computer security at
Microsoft and Lawrence Livermore Labs, or our secretary of state, Deb
Markowitz? Whose advice should we listen to?

A wake-up call

In 2006, due to pressure from concerned citizens, Secretary of
State Markowitz used her power to conduct an audit for the first
time. But the details of the audit raised concerns and did not
conform to several of the recommendations. This year again,
the secretary has indicated there will be an audit, but again there are
concerns. The 2-percent sample size is too small (Connecticut
hand counts 10 percent). When asked what our confidence level
will be this November (recall that New Jersey law aims at providing a
99-percent confidence level), the secretarys office responded that
they do not know what the confidence level is.

Another concern is that only two races will be audited. This means that
out of all statewide races president, congressional representative,
governor, lieutenant governor, treasurer, secretary of state, auditor,
attorney general only two will be checked for accuracy and the rest
will be left in the blind trust of Diebold, open to fraud, hacking, and
errors.

During the past few months, Markowitz showed a genuine interest
in election rights by instituting a program to deliver absentee ballots
to disabled citizens. But her concern for the accurate counting
of the ballots once they are cast is unfortunately lacking.
How can we protect Vermonts elections?

There are several simple steps Vermont could take to increase
the security, reliability, and integrity of our election system.
We could start by following the recommendations of the experts,
outlined in the Brennan Report and another titled Principles and Best Practices for Post-Election Audits.

These are the recommendations Vermont does not currently follow:

Conduct automatic routine audits comparing
voter-verified paper records to the electronic record following every
election. Vermont only audits some elections, based on the secretarys
discretion. This year only two out of eight statewide races will
be audited. Zero county and local elections will be audited.

Use a transparent and random selection process for
all auditing procedures. Theres a reason why they pick the lottery
numbers on TV so there is no question that they were chosen
randomly. Similarly, the precincts to be hand-counted in an audit
must be chosen randomly and in public view. In 2006 the Secretary
first planned to choose the audited precincts behind closed doors
certainly not transparent. Due to pressure from concerned citizens, she
allowed a member of the public to choose half of the precincts by
picking a number out of a hat. The other half she chose, but not
randomly. The secretarys office has indicated it will be the same this
year only half the precincts will be chosen, using a transparent and
random process.

Ensure decentralized programming and voting system
administration. Where a single entity, such as a vendor or state or
national consultant, performs key tasks for multiple jurisdictions,
attacks against statewide elections become easier; all of the
programming, configuration, and upgrading of our system is centralized.

Have clear protocols for addressing discrepancies,
evidence of fraud, or error. Protocols should clearly state that if an
audit finds a discrepancy, and it exceeds a certain amount, a specific
action will be taken like auditing a larger sample, or going to a
full recount. Vermont has no standard procedures for addressing
discrepancies in an audit, and we could be caught like a proverbial
deer in the headlights if it happens.

Allow public scrutiny and input. The secretary has
attempted to discredit those who speak out in favor of following these
recommendations.

Conduct risk-limiting audits. The size of the
audit should not be a flat number of precincts to hand count. The
most effective audits are risk-limiting, meaning that statistical
factors determine the size of the audit. For example, a smaller
margin of victory calls for a larger sample size to be checked.
Also, the number of voters in the various precincts should be taken
into account. Vermont does not look at these factors, and does not
conduct risk-limiting audits.

Binding on official results. Audits should be
completed prior to finalizing official election results. In 2006,
the election results were certified on November 15 and the audit took
place the next day. Imagine if they had found a significant
discrepancy, after the results were certified! For obvious
reasons, Vermont must conduct the audit before the official results are
certified.

Our states most fundamental democratic process is too important to
leave it to the secretary of state to decide, for each election,
whether or not to have an audit and how to conduct it. We implore
Vermont citizens to urge Secretary of State Markowitz to implement all
of the recommendations outlined in the Brennan Report to make our
system secure and reliable.

Ultimately, Vermont needs to enact a robust law mandating these
practices. Until then, we are left to wonder, and to hope that on
election day our votes are counted accurately.
Refresh | +8 Recommendations Printer Friendly | Permalink | Reply | Top
GreenPartyVoter Donating Member (1000+ posts) Send PM | Profile | Ignore Sat Nov-15-08 11:48 AM
Response to Original message
1. Great post
Printer Friendly | Permalink | Reply | Top
 
Wilms Donating Member (1000+ posts) Send PM | Profile | Ignore Sat Nov-15-08 01:59 PM
Response to Original message
2. Nice stuff, Gary.
A small note. I don't think New Jersey is yet implementing it's new audit law as they're still trying to get rid of the paper-less DREs.

Printer Friendly | Permalink | Reply | Top
 
garybeck Donating Member (1000+ posts) Send PM | Profile | Ignore Sat Nov-15-08 02:13 PM
Response to Reply #2
3. my understanding is...
Edited on Sat Nov-15-08 02:15 PM by garybeck
the law is in effect, but the DREs are exempt, temporarily. I'm not positive on whether they're going with VVPATs or trashing them for opscans. but yes you are correct, their audit law is not 100% in effect yet because they still have paperless DREs that don't apply. still as the audit law is written, i think it's pretty decent and could be used as a model for other states (like vermont!).

by the way can you believe that shit our SoS is putting out... basically lying to us, sounding like a diebold salesperson... how long can she keep it up?
Printer Friendly | Permalink | Reply | Top
 
Wilms Donating Member (1000+ posts) Send PM | Profile | Ignore Sat Nov-15-08 06:39 PM
Response to Reply #3
4. The audit law is probably the nation's best.
It's risk-based.

But it'll have to wait. The DREs NJ uses are PAPERLESS. :puke: They're supposed to add printers or change systems, but it hasn't yet happened.

Still, the absentees could be audited, and there's some grumbling that that hasn't occured.

Printer Friendly | Permalink | Reply | Top
 
garybeck Donating Member (1000+ posts) Send PM | Profile | Ignore Sat Nov-15-08 08:32 PM
Response to Reply #4
5. I agree, it should be used as a model for national legislation
nt
Printer Friendly | Permalink | Reply | Top
 
Wilms Donating Member (1000+ posts) Send PM | Profile | Ignore Sat Nov-15-08 09:12 PM
Response to Reply #5
6. This calls for my first use of the latest DU emoticon.
:fistbump:



:P

Printer Friendly | Permalink | Reply | Top
 
Bill Bored Donating Member (1000+ posts) Send PM | Profile | Ignore Sat Nov-15-08 11:46 PM
Response to Reply #6
7. JERSEY SUCKS! (Good audit law though.) nt
Printer Friendly | Permalink | Reply | Top
 
Wilms Donating Member (1000+ posts) Send PM | Profile | Ignore Sat Nov-15-08 11:52 PM
Response to Reply #7
9. Wrong.
For one thing. the waves are BETTER on the Jersey shore.




Printer Friendly | Permalink | Reply | Top
 
Bill Bored Donating Member (1000+ posts) Send PM | Profile | Ignore Sun Nov-16-08 01:08 AM
Response to Reply #9
10. Maybe so, but when I think that the future of our democracy rests somewhere in the SWAMPS of
JERSEY, it just makes me cringe!



Printer Friendly | Permalink | Reply | Top
 
garybeck Donating Member (1000+ posts) Send PM | Profile | Ignore Tue Nov-18-08 01:25 PM
Response to Reply #10
15. New Jersey has a decent energy policy plan
they have one of the best audit laws, and also one of the best energy portfolios (I think they're aiming at 30% renewables)

so while they might be considered the armpit of the country in some circles, at least they're doing something about it.

people think Vermont is so progressive, but we have NO audit law and NO renewable energy portfolio, compared to NJ which has both.
Printer Friendly | Permalink | Reply | Top
 
Bill Bored Donating Member (1000+ posts) Send PM | Profile | Ignore Sat Nov-15-08 11:48 PM
Response to Original message
8. Where does the Voting Rights Act say counting has to be in public view?
If that's the case, our problems are solved!
Printer Friendly | Permalink | Reply | Top
 
garybeck Donating Member (1000+ posts) Send PM | Profile | Ignore Tue Nov-18-08 12:30 PM
Response to Reply #8
14. It talks about "examiners"
the federal examiners can be sent to observe any time there is a question about whether the votes are being counted properly.

google the voting rights act of 1965 and then do a search on "examiners."

it follows logically that if examiners can be sent, there must be something for them to examine.
Printer Friendly | Permalink | Reply | Top
 
GuvWurld Donating Member (1000+ posts) Send PM | Profile | Ignore Sun Nov-16-08 01:54 AM
Response to Original message
11. I like this framing talking point
"Theres a reason why they pick the lottery numbers on TV so there is no question that they were chosen randomly."

I never heard that one before. :thumbsup:
Printer Friendly | Permalink | Reply | Top
 
demodonkey Donating Member (1000+ posts) Send PM | Profile | Ignore Sun Nov-16-08 07:39 AM
Response to Reply #11
12. And even the On-TV lottery has been rigged -- in Pennsylvania!
Printer Friendly | Permalink | Reply | Top
 
Stevepol Donating Member (1000+ posts) Send PM | Profile | Ignore Sun Nov-16-08 08:17 PM
Response to Original message
13. This is a tremendous article!
Printer Friendly | Permalink | Reply | Top
 
garybeck Donating Member (1000+ posts) Send PM | Profile | Ignore Tue Nov-18-08 01:26 PM
Response to Reply #13
16. thanks, I appreciate it! n/t
Printer Friendly | Permalink | Reply | Top
 
DU AdBot (1000+ posts) Click to send private message to this author Click to view 
this author's profile Click to add 
this author to your buddy list Click to add 
this author to your Ignore list Sat Aug 23rd 2014, 11:51 AM
Response to Original message
Advertisements [?]
 Top

Home » Discuss » Topic Forums » Election Reform Donate to DU

Powered by DCForum+ Version 1.1 Copyright 1997-2002 DCScripts.com
Software has been extensively modified by the DU administrators


Important Notices: By participating on this discussion board, visitors agree to abide by the rules outlined on our Rules page. Messages posted on the Democratic Underground Discussion Forums are the opinions of the individuals who post them, and do not necessarily represent the opinions of Democratic Underground, LLC.

Home  |  Discussion Forums  |  Journals |  Store  |  Donate

About DU  |  Contact Us  |  Privacy Policy

Got a message for Democratic Underground? Click here to send us a message.

© 2001 - 2011 Democratic Underground, LLC