3 ms·

I've done election clerking, which I highly encourage everyone to do. Here in SF, it's an entirely paper election, and at every precinct there is a ballot scan

I've done election clerking, which I highly encourage everyone to do. Here in SF, it's an entirely paper election, and at every precinct there is a ballot scanner. As people fill out their ballots, it gets scanned, tabulated (aka "counted"), then deposited in a locked box that's part of the machine. Your ballot has no personally identifying markings, and is now lost in a pile of other ballots. That is how ballot secrecy works in practice. At the end of the night, the electronic tabulation is removed from the machine (CF cards), then given in a security sealed bag to a deputy officer who takes it to city hall to be summed up for the results. The paper results are organized, and put in security sealed bags, and given to a sheriff (person with gun), and locked into a van to be transported back to city hall. So now we have the best of both worlds: fast results, and paper audit trail. Any precinct can be retabulated - just run all the cards thru a machine again. The mail-in ballots are processed separately, and once the envelopes have been verified, the ballots are put thru a tabulation machine as well. My understanding is city hall has a ballot tabulator for every precinct mail-in, and as they process mail they drop them in the appropriate machine. If a mistake was made - it's easily correctable because each ballot has the precinct number printed on it. It's a very easy to understand system, that requires only basic elements of computer security. Cross checking a ballot tabulator for accuracy is easy. Recounting is easy. And finally, for accessible voting, people use a tablet to choose their selections, then their ballot is printed out, which contains the summary of the vote, and a QR code the ballot machine scans. Oh yes, and the ballot machine scans and keeps image files of every ballot. I'm not sure what they do with that, but there we go. It's fascinating, and my experiences in the SF elections department gives me high confidence that the SF election, and any run like it, are very secure, and accurate.

adolph 6y ago
From the interview a story about paper ballot tabulation problems: With fill-in-the-bubble ballots, a typical error would be printing the ballot with the candidates in one order but programming the scanner with the candidates in a different order. There was a famous incident of this happening [in] Pottawattamie County, [Iowa], in 2006 in its June primary. The net result was that the numbers that came up were pretty nonsensical and bore no relationship with anyone’s expectation of the outcome of the race. The election officials noticed. They did a hand count, and that completely resolved the problem. And they could because they had paper ballots. I think like most things there are tradeoffs and the qualities most needed in the system run counter to one another--speed can cause errors to be missed, security reduces access, etc.
- jcrawfordor 6y ago
  Many jurisdictions do, and all jurisdictions should, test every machine with a reference set of ballots and verify the correct output as part of commissioning. This is intended to detect errors of this type.
  - mshook 6y ago
    Right but it seems some machines are connected to the internet (seriously). And it's probably easy in the firmware to check if you're being tested (ask Volkswagen). And even if it's not, you could write a firmware you could trigger with a specific ballot. The bottom line is firmware for these things should and must be open so they can be audited by experts. And hackers must be given access to them so they can try to do their worst. As long as you treat it as a black box, I'm afraid to say you aren't trusting the device, you are just having faith in it.
    - jcrawfordor 6y ago
      While they do exist, internet-connected machines are relatively rare. Unfortunately guidance has been inconsistent. Some states have qualification standards that prohibit network connections on tabulators, some states have standards that allow it, and some states don't have standards at all. In non-binding recommendations, the NIST is against network connectivity but the FEC takes a softer line on the topic. This is a great area to lobby state governments, all state standards should prohibit internet connectivity. Generally, from a network security perspective, electronic pollbook systems are a much greater concern as they are connected over the internet as a matter of standard practice, and it's difficult to avoid this while preserving functionality. There are also more, smaller vendors for EPBs and they receive significantly less scrutiny or security review than tabulators.
mauvehaus 6y ago
I can't speak to the particulars, but this is basically what MA and VT do. I can't see any good faith reason to do anything else. Ohio, the only other state I've voted in (many years ago) had electronic machines that produced a paper audit receipt. The problem I see with that is that now you have two sources of truth, and no easy way to count one of them to reconcile them.
- jcrawfordor 6y ago
  There is no two sources of truth - the paper trail (VVPAT) is the single truth. It is generally used for a sample-based audit of the machine tallies and depending on recount procedures can be used for up to a complete recount if necessary. Where VVPAT and machine tallies disagree, the VVPAT is correct.

adolph 6y ago

From the interview a story about paper ballot tabulation problems: With fill-in-the-bubble ballots, a typical error would be printing the ballot with the candidates in one order but programming the scanner with the candidates in a different order. There was a famous incident of this happening [in] Pottawattamie County, [Iowa], in 2006 in its June primary. The net result was that the numbers that came up were pretty nonsensical and bore no relationship with anyone’s expectation of the outcome of the race. The election officials noticed. They did a hand count, and that completely resolved the problem. And they could because they had paper ballots. I think like most things there are tradeoffs and the qualities most needed in the system run counter to one another--speed can cause errors to be missed, security reduces access, etc.

jcrawfordor 6y ago
Many jurisdictions do, and all jurisdictions should, test every machine with a reference set of ballots and verify the correct output as part of commissioning. This is intended to detect errors of this type.
- mshook 6y ago
  Right but it seems some machines are connected to the internet (seriously). And it's probably easy in the firmware to check if you're being tested (ask Volkswagen). And even if it's not, you could write a firmware you could trigger with a specific ballot. The bottom line is firmware for these things should and must be open so they can be audited by experts. And hackers must be given access to them so they can try to do their worst. As long as you treat it as a black box, I'm afraid to say you aren't trusting the device, you are just having faith in it.
  - jcrawfordor 6y ago
    While they do exist, internet-connected machines are relatively rare. Unfortunately guidance has been inconsistent. Some states have qualification standards that prohibit network connections on tabulators, some states have standards that allow it, and some states don't have standards at all. In non-binding recommendations, the NIST is against network connectivity but the FEC takes a softer line on the topic. This is a great area to lobby state governments, all state standards should prohibit internet connectivity. Generally, from a network security perspective, electronic pollbook systems are a much greater concern as they are connected over the internet as a matter of standard practice, and it's difficult to avoid this while preserving functionality. There are also more, smaller vendors for EPBs and they receive significantly less scrutiny or security review than tabulators.

mauvehaus 6y ago

I can't speak to the particulars, but this is basically what MA and VT do. I can't see any good faith reason to do anything else. Ohio, the only other state I've voted in (many years ago) had electronic machines that produced a paper audit receipt. The problem I see with that is that now you have two sources of truth, and no easy way to count one of them to reconcile them.

jcrawfordor 6y ago
There is no two sources of truth - the paper trail (VVPAT) is the single truth. It is generally used for a sample-based audit of the machine tallies and depending on recount procedures can be used for up to a complete recount if necessary. Where VVPAT and machine tallies disagree, the VVPAT is correct.