eVoting Flawed : A GAO Review

About USPolitics   13 November 2005

Despite spending untold millions on new voting equipment, the 2004 election had both real and potential error, according to a recent GAO report. Moreover, due to January deadlines and little government guidance for localities, the situation is unlikely to improve for 2006, because local governments are required to have an electronic voting machine at every polling place after 1 Jan 2006, according to ComputerWorld.

Word of the 21 October GAO report about security problems surrounding electronic voting in the 2004 election is slowly making its way through the blogosphere, having been thoroughly ignored by the mainstream media. GAO - in a damning but understated manner - reports that in 2004 "[c]ast ballots, ballot definition files, and audit logs could be modified" (p 2). Specifically (p 7):
(1) some electronic voting systems did not encrypt cast ballots or system audit logs, and it was possible to alter both without being detected; (2) it was possible to alter the files that define how a ballot looks and works so that the votes for one candidate could be recorded for a different candidate; and (3) vendors installed uncertified versions of voting system software at the local level.
Specific instances of error included operational error (systems unavailable), voters being presented with the wrong ballot, and an undervote of 80 percent in one Pennsylvania county (the result of improper programming). In Maryland, a tabulation computer was connected directly to the Internet without security patches.

Whether or not you are still fuming over the 2004 election, this is a must-read document: "Federal Efforts to Improve Security and Reliability of Electronic Voting Systems Are Under Way, but Key Activities Need to Be Completed" (pdf, abstract - html).

From the ComputerWorld story:
"The [GAO] report buttresses what we've been saying," said Ion Sancho, supervisor of elections in Florida's Leon County, which uses optical scan devices that have to be supplemented with e-voting machines under the HAVA law. "There are concerns [that] need to be addressed," he said, citing both potential electronic and human errors.

The government is forcing a rush into e-voting without having established adequate technological guidelines, said Matthew Zimmerman, staff attorney at the San Francisco-based Electronic Frontier Foundation, a civil rights advocacy group that focuses on technology issues.
PC World has a similar reaction: "Questions about the security and accuracy of electronic voting systems are likely to continue into the 2006 national elections, because the federal government has not yet completed work on electronic voting guidelines, according to a new government report."

Electronic Voting Systems
Local election officials - often with little guidance from the state, in general, and with almost no guidance from the feds on security - are spending millions of dollars on electronic voting equipment.

According to The Free Press, "The United States is the only major democracy that allows private partisan corporations to secretly count and tabulate the votes with proprietary non-transparent software."

The most troubling voting technology used in 2004 was a Direct Recording Electronic (DRE) System; this electronic voting system usually has no paper trail. GAO reports that only about 12 percent of us used DREs in the 2000 elections, but almost one-third of us did in 2004. In other words, almost one-third of Americans cast a ballot in the 2004 election with little, if any, way to determine if the vote recorded (or counted) was the one cast.

As the GAO reports, in 2004, these systems were vulnerable: "vendors installed uncertified versions of voting system software at the local level."

Before the fiasco that was the 2000 election, most local governments that had an "electronic" voting system used optical scan technology. Not unlike standardized tests, with optical scan, technology is used to count paper ballots. About 31 percent of us cast votes in this manner in 2000. Even though this system is far less expensive than DREs, the money that the federal government threw at local governments did little to boost its use: only an estimated 35 percent of us cast votes like this in 2004. (p 13-15)

Bi-Partisan Concern
In an unusual show of bipartisan support and concern (that alone was newsworthy), the US House Committee on Government Reform issued a joint statement:
?It is certainly disappointing that, despite the recommendations from federal organizations and non-governmental groups, many states still have not made progress to make sure their electronic voting systems are safe from fraud and can be relied on to accurately count votes,? Chairman Tom Davis (R-VA) said...

?The GAO report indicates that we need to get serious and act quickly to improve the security of electronic voting machines,? said Rep. Henry Waxman (D-CA). ?The report makes clear that there is a lack of transparency and accountability in electronic voting systems ? from the day that contracts are signed with manufacturers to the counting of electronic votes on Election Day. State and local officials are spending a great deal of money on machines without concrete proof that they are secure and reliable. American voters deserve better.?
HAVA and EAC
The September GAO report was not released publicly until late October, due to an arrangement with the US Election Assistance Commission (EAC). The EAC was established as part of the October 2003 Help America Vote Act (HAVA). HAVA was designed to provide states with money and other resources for improving federal election administration.

In 2003, Congress appropriated $1.5 billion for HAVA; most was to be administered by EAC. However, the funds languished because President Bush did not make nominations until October, and the Senate did not confirm nominations until December 2003; the law had required that EAC be in place by 26 Feb. 2003.

EAC commissioners are Gracia Hillman, chair, former executive director of the League of Women Voters of the United States; Paul DeGregorio, vice chair, International Foundation for Election Systems; Ray Martinez, an Austin lawyer; and Donetta Davidson, formerly Colorado Secretary of State, who replaced (no date given on the EAC website) DeForest Soaries, the former New Jersey Secretary of State who is also a Baptist minister who endorsed the administration's "faith-based initiatives."

EAC was hobbled by the delay in its organization and underfunding (FY2004 budget: $ 1.2 million). Congress had asked for a report on human factor research including usability and human-computer/machine interaction, that could be applied to voting products and system design to ensure usability and accuracy not later than one year after the date of enactment of the HAVA [October 29, 2003]. This deadline was not met; EAC issued a report on 29 April 2004.

Also, in its 2004 budget, Congress again allocated $1.5 billion to fund HAVA. By mid-January, 2004, the EAC had no permanent offices or budget, even though it must publish state election reform plans in the Federal Register before being able to disburse money for new voting equipment to the states.