Indonesia: Cyber Challenge in Focus with Looming 2019 Elections | The Diplomat

Late last week, Indonesia’s military chief issued a call to the country’s security forces to upgrade their digital skills to confront a range of challenges. His comments were just the latest in a long string of similar statements issued by Indonesian officials highlighting the country’s cyber challenges as it prepares to head into presidential elections in April. As I have noted before in these pages, along with other Asian states, Indonesia has been taking steps to confront some of the cyber challenges it has long faced. Indonesia is one of the world’s most vulnerable countries to cyber attacks, and the challenge has grown at an alarming rate over the past few years including under President Joko “Jokowi” Widodo, with the full spectrum of challenges including not just national security or e-commerce, but also in the distribution of so-called fake news and even issues related to e-voting.

Philippines: Ballots to have additional security features | The Philippine Star

The Commission on Elections (Comelec) is adopting additional security features in the ballots to be used in the coming May 2019 midterm elections to ensure their integrity and credibility. “The ballots will have the normal security features like marks, barcodes and a few others,” Comelec spokesman James Jimenez disclosed in an interview over the weekend. One of the additional features is machine-readable ultraviolet (UV) markings on the ballots, he said. “UV marks can be read by machine and if not readable it will then be rejected,” Jimenez said. He declined to discuss the other features for security reasons.

Switzerland: Government invites hackers to penetration-test its e-voting system | ZDNet

The Swiss government will make its future e-voting system available for a public intrusion test and is now inviting companies and security researchers to have a go at it. "Interested hackers from all over the world are welcome to attack the system," the government said in a press release. "In doing so, they will contribute to improving the system's security." … A mock e-voting session is planned on the last day of the testing period, on March 24, but participants can attack the e-voting system before that, as well. To participate, companies and security researchers will have to sign up in advance of the PIT session's official start. Signing up will give participants the legal permission to attack the system, will ensure the cash rewards will reach those who first report an issue, and it enforces a set of rules and restrictions on participants.

Thailand: Princess disqualified from prime minister bid | CNN

Officials have disqualified a Thai princess from running for prime minister in next month's general election after her brother, King Maha Vajiralongkorn, said her nomination would be "inappropriate." Thailand's Electoral Commission announced on Monday that the "monarchy must remain above politics." In a shock announcement on Friday, Princess Ubolratana Rajakanya, 67, said she would stand as the prime ministerial candidate for the Thai Raksa Chart Party (Thai Save The Nation, or TSN) aligned with populist former leader Thaksin Shinawatra, who was ousted by the military in a 2006 coup.

Verified Voting Blog: No to Online Voting in Virginia | Electronic Frontier Foundation

This article originally appeared on Electronic Frontier Foundation’s website on February 4th, 2019

Experts agree: Internet voting would be an information security disaster. Unfortunately, the Commonwealth of Virginia is considering a pair of bills to experiment with online voting. Pilot programs will do nothing to contradict the years of unanimous empirical research showing that online voting is inherently vulnerable to a variety of threats from malicious hackers, including foreign nations.

EFF strongly opposes Virginia H.B. 2588 and S.J.R. 291, and all online voting. Instead, EFF recommends that absentee voting, like all voting, be conducted with paper records and risk-limiting audits, the current state-of-the art in election security.

Media Release: Verified Voting Calls on Governor Tom Wolf and the Pennsylvania General Assembly to Appropriate Funding to Replace Vulnerable Electronic Voting Machines

Marian K. Schneider: “Verified Voting calls on the Pennsylvania legislature to appropriate additional funding to subsidize the cost of replacement.”

The following is a statement from Marian K. Schneider, president of Verified Voting, formerly Deputy Secretary for Elections and Administration in the Pennsylvania Department of State, following Gov. Tom Wolf’s budget address to the joint legislative session on Tuesday morning. 

“The security of Pennsylvania’s elections is at a crossroads. In 2018, 83 percent of Pennsylvanians have voted on unverifiable direct recording electronic (DRE) systems. The state already recognizes the need to replace aging and vulnerable electronic voting machines with ones that have a voter-verifiable paper ballot or record of votes cast before the 2020 election. Governor Tom Wolf committed to this nearly a year ago, yet his budget address to the joint legislative session today falls short of providing the resources counties need to implement best election security practices. In light of the inadequacy of the funding request and the timing of the directive, the Governor should allow the 17 counties that already vote on paper ballots to keep their systems until more resources are available.  Regardless, the remaining counties who do not have a plan to replace their systems are risking another presidential election in which the reported outcome cannot be verified.

Media Release: To Enhance Election Security, Rhode Island Tests A New Way to Verify Election Results

Rhode Island is making good on its promise to road-test risk-limiting election audits, following 2017 passage of legislation by the Rhode Island General Assembly, requiring them. Beginning with the presidential primary in April 2020, Rhode Island will become the second state to require these audits to verify election results. A “risk limiting” audit checks if the election result is correct. Specifically it checks the counting of the votes. A “risk-limiting” audit limits the risk that the wrong election result will be certified. It can catch errors which change the result and correct a wrong result.

For more background on the legislation, visit here: and here.

To prepare for next year’s full implementation, the Rhode Island Board of Elections will conduct three pilot audits on January 16 and 17 at 50 Branch Avenue in Providence, Rhode Island beginning at 9:30 a.m. These pilot audits will be conducted with local election officials from Bristol, Cranston and Portsmouth, Rhode Island.

Editorials: Nancy Pelosi’s H.R. 1 election reform bill could save American democracy. | Richard Hasen/Slate

The Democrats’ first order of business as they took control of the 116th Congress was introducing H.R. 1, the colossal “For the People Act.” This 571-page behemoth of a bill covering voting rights, campaign finance reform, ethics improvements, and more was a perfect reminder of just how much power the Constitution gives Congress to make elections better in this country and, sadly, of how partisan the question of election reform has become. By beginning with election reform as “H.R. 1,” Democrats signaled their priorities as they took over control of the House of Representatives. The bill now has 221 co-sponsors, all Democrats, including almost every Democrat in the House. It’s disheartening that bipartisan movement on election reform is no longer possible and that few of the significant improvements in the bill stand a chance of becoming law until Democrats have control of the Senate and the presidency. Even then some of its provisions could be blocked by a conservative-leaning Supreme Court. But if and when Democrats ever do return to full power in Washington, H.R. 1 should remain the top priority. Though there is room for some improvements, the “For the People Act” would go an enormous way toward repairing our badly broken democracy.

Kansas: Kobach grand jury process to begin next week in Douglas County | Lawrence Journal-World

Grand jury proceedings to investigate former Kansas Secretary of State Kris Kobach’s office will begin next week in Douglas County District Court, according to the judge presiding over them. Judge Kay Huff said that the proceedings would begin in her courtroom on Jan. 22, a Tuesday, following Martin Luther King Jr. Day. Grand jury proceedings are closed to the public. Huff mentioned the grand jury during a hearing for a murder trial she had been scheduled to preside over this week, noting that the grand jury matter was a priority that could not be moved despite other proceedings in her courtroom.

Ohio: 275,000 residents get ‘last chance’ to stay registered | Dayton Daily News

The Ohio Secretary of State’s office is sending “last chance” notifications to some 275,000 inactive voters across the state, giving them a final shot at keeping voting registrations active on county rolls.
In Montgomery County, some 17,918 residents should receive the notices, according to the secretary’s office. They will also go to 6,912 Butler County residents and 5,273 residents in Warren County. The secretary’s office says voters get six years to respond to county boards of elections to confirm registrations. If residents don’t respond or don’t vote in at least 12 elections, don’t request absentee ballot applications in even-numbered year general elections or don’t have their information automatically updated in transactions with Ohio Bureau of Motor Vehicles offices — if voters “ignore” those attempts to keep them on the rolls, they are sent a “last chance” notice, said a spokesman for the secretary of state’s office, Matthew McClellan.

Nigeria: Opposition Slams Trial of Nigerian Chief Justice Before Vote | Bloomberg

The trial of Nigeria’s top judge got underway in a case that’s prompted lawyers and opposition parties to accuse the government of trying to oust him and spark a constitutional crisis before next month’s presidential election. Chief Justice Walter Onnoghen didn’t attend the opening Monday in Abuja, the capital, where the Code of Conduct Tribunal is charging him for not properly declaring his assets. The trial was adjourned until Jan. 22, and the Federal High Court in Abuja later said it will hold a hearing on Jan. 17 into whether it can continue, Lagos-based Punch newspaper reported.

National: Incoming NASS leader rejects Democrats’ election security bill | Politico

The next president of the NASS has strong words for House Democrats considering a range of election security measures: Butt out. H.R. 1, a Democratic grab-bag bill with election security provisions, “seems to be a huge federal overreach,” Iowa Secretary of State Paul Pate told POLITICO. “No matter how well-intentioned, the provisions of the bill give the authority of overseeing and conducting elections and voter registration to the federal government.” (In fact, the bill would not do this.) Pate’s remarks, first reported by National Journal, mirror comments by former Georgia Secretary of State Paul Kemp in August 2016. Pate cited NASS’s long-standing opposition to federal mandates for election procedures — in October, the group warned against tying federal funds to regulations — and said state election offices like his are “better prepared than the federal government to determine what is right for their residents.” Despite Pate’s suggestion that “our country’s legal and historical distinctions in federal and state sovereignty” invest states with the exclusive authority to regulate elections, Article I Section 4 of the Constitution empowers Congress to “at any time by Law make or alter” election processes.

National: Trump has hidden details of his encounters with Putin from White House officials | The Independent

President Donald Trump has gone to extraordinary lengths to conceal details of his conversations with Russian President Vladimir Putin, including on at least one occasion taking possession of the notes of his own interpreter and instructing the linguist not to discuss what had transpired with other administration officials, current and former US officials said. Mr Trump did so after a meeting with Putin in 2017 in Hamburg that was also attended by then-Secretary of State Rex Tillerson. US officials learned of Mr Trump's actions when a White House adviser and a senior State Department official sought information from the interpreter beyond a readout shared by Mr Tillerson. The constraints that Mr Trump imposed are part of a broader pattern by the president of shielding his communications with Mr Putin from public scrutiny and preventing even high-ranking officials in his own administration from fully knowing what he has told one of the United States' main adversaries.

Editorials: Congress ignored its election duties for years. That ends now. | Matthew Weil/Roll Call

House Democrats have waited eight years to regain the speakership, and now that they hold the gavel, they will clearly seek to move on pent-up priorities. For their first act out of the gate, they rolled several into one. The “For the People Act” — or H.R. 1 — runs just over 500 pages and includes proposals the Democrats have pursued during their time in the minority, such as ethics reforms, campaign finance changes, and a well-publicized section requiring presidential candidates to hand over their tax returns. But the bill also lays out a vision for election administration in 2020 and beyond, putting the voter at the center of the process instead of focusing on what is easier for government. Congress taking the lead could cause some heartburn at the state level.

Maine: Republicans may seek to overturn ranked-choice voting | Lewiston Sun Journal

After ranked-choice voting helped Democrats defeat two-term Republican U.S. Rep. Bruce Poliquin in November, it’s perhaps no surprise that GOP leaders are eyeing the possibility of wiping away the new voting method. “We must go after this bad precedent,” former Gov. Paul LePage wrote recently to members of the Republican state committee. The two GOP leaders in the state Senate and the state House urged Republican officials to pick former state Sen. Garrett Mason of Lisbon as the next party chair in part because he can raise the money necessary to “directly assist with campaigns, such as the repeal of ranked choice voting.”

South Carolina: How often do South Carolina’s voting machines mess up? New election report details count problems | The State

In the last election, some votes in South Carolina got counted twice. Others were credited to the wrong candidate. Also, one observer thinks, the state’s 14-year-old voting machines are starting to show their age, producing other errors. Those are some of the conclusions in a report released last week by the League of Women Voters of South Carolina. On Jan. 22, the league will host a public forum at the Richland County Public Library on ways to improve the state’s election system. The group is backing efforts in the S.C. Legislature to require a paper ballot system. “Over the years, they’ve made upgrades, and it’s still flawed,” Lynn Teague, vice president of the league, said of the state’s existing voting system. “They’re still counting votes wrong ... and all this without someone deliberately trying to mess with the system.”

South Dakota: Bill aims to fix June election problems | Rapid City Journal

Newly proposed state legislation would implement a safeguard against the voter check-in problems that afflicted Pennington and other counties during last June’s primary election. The legislation is House Bill 1027, which was filed Jan. 6 by the House Committee on Local Government at the request of the state Board of Elections. If passed into law, the bill would require county auditors to provide paper voter-registration lists and bound paper poll books as backups at polling places where electronic poll books are used. The legislation aims to avoid a repeat of the problems that the Secretary of State’s Office said were encountered during the June 5 primary election in Pennington and seven other counties: Brookings, Brown, Hughes, Hyde, Potter, Sully and Yankton.

Bangladesh: Opposition and Democracy Activists Criticize Election Coverage in Bangladesh | VoA News

In the wake of Bangladesh's recent general election, opposition coalition and pro-democracy activists expressed disappointment with alleged episodes of vote manipulation going largely unreported in the local media. But several journalists argue that fear of government reprisals led many media outlets to avoid publishing stories about the alleged wrongdoing. "The level of vote robbery in the December 30 general election was unprecedented in world history. Ahead of conducting the massively rigged election, the government introduced some black laws, like the Digital Security Act, to shackle the media," BNP senior joint secretary Ruhul Kabir Rizvi Ahmed told VOA.

Thailand: Protesters in Thailand Rally Anew Against Risk of Election Delay | Bloomberg

Demonstrators took to the streets in Bangkok for the third time in a week to criticize the looming postponement of the general election due next month in military-run Thailand. About 200 people on Sunday held placards and chanted slogans calling for an end to delays in the schedule for voting. A group called "We Vote" said it organized the protest in the capital as well as in other cities across the country. "The objective for today is to secure a date for the election after five postponements," Nuttaa Mahattana, one of the leaders of the group, said on her Facebook page.

Verified Voting Blog: Verified Voting Recommends Hand-Marked Paper Ballots for Georgia to SAFE Commission

Verified Voting sent a letter to the Secure, Accessible, Fair Elections (SAFE) Commission on Friday, January 4 with their recommendations for a new voting system in Georgia. Read the letter below or download it here

Verified Voting submits the following statement endorsing hand-marked paper ballots that are scanned as the primary voting method for voters. Verified Voting respectfully requests that this statement be shared with the entire SAFE commission in advance of the next meeting scheduled for January 10, 2019.

Recommendation. In light of the pervasive security vulnerabilities of all electronic voting systems, including Ballot Marking Devices (BMDs), as well as the considerable cost of BMDs, Verified Voting Foundation endorses the use of hand-marked paper ballots as the best primary method for recording votes in public elections. BMDs do play an important role for some voters, including voters with disabilities, that prevent them from hand-marking paper ballots. However, the primary voting method for most voters should be hand-marked paper ballots.

Rationale. Hand-marked paper ballots offer better voter verification than can be achieved with a computerized interface. A paper ballot that is indelibly marked by hand and physically secured from the moment of casting is the most reliable record of voter intent. A hand-marked paper ballot is the only kind of record not vulnerable to software errors, configuration errors, or hacking. With hand-marked paper ballots, voters are responsible only for their own errors, while with a BMD, voters are responsible for catching and correcting errors or alterations made by the BMD. Consequently, well-designed hand-marked paper ballots combined with a risk-limiting post-election tabulation audit provide the gold standard for ensuring that reported election results accurately reflect the will of the people.

Media Release: Verified Voting Welcomes Colorado Secretary of State Wayne Williams to its Board of Advisors

Wayne Williams: “I’m excited to share my expertise so that we can continue to strengthen our nation’s election systems and voters’ confidence in those systems.”

Verified Voting, a leading national organization focused solely on making our voting technology secure, welcomes Wayne Williams to its Advisory Board. Williams, while serving as Colorado Secretary of State from 2015 to 2019, adopted new voting standards requiring voter-verifiable paper ballots and implemented the nation’s first statewide risk-limiting audit (RLA) in Colorado.

“Voter confidence in elections is critical for Americans’ faith in our democratic republic. The election reforms we adopted in Colorado, including paper ballots and the nation’s first full risk-limiting audit, helped encourage Coloradans to vote in record numbers. I’m excited to share my enthusiasm and election expertise on the Verified Voting Board of Advisors so that we can continue to strengthen our nation’s election systems and voters’ confidence in those systems,” said Williams.

Media Release: Election Security Experts Applaud City of Fairfax, VA and Orange County, CA for Leading in New Election Integrity Methods

New Reports from Verified Voting Show How Risk-Limiting Audits in California and Virginia Can Improve Election Security and Public Confidence

Robust post-election audits are changing the election security landscape and the City of Fairfax, Virginia and Orange County, California are leading the way. Risk-limiting audits (RLAs) of voter-marked paper ballots can promote election security and public confidence by providing rigorous statistical evidence that election outcomes match the ballots — and a means to detect and correct outcomes that don’t match. If the method is widely adopted it will bolster confidence in elections. In the months leading up to the midterms, the City of Fairfax and Orange County implemented pilot projects that, as documented in two new reports by the Verified Voting Foundation, with funding support from Microsoft, demonstrated the benefits of risk-limiting audits.

The “Pilot Risk-Limiting Audit” reports, released today at the MIT Election Audit Summit, detail how Orange County and the City of Fairfax conducted pilots — in June and August 2018, respectively — and how these pilots provide lessons for election officials and policymakers around the country.

Verified Voting Blog: Why voters should mark ballots by hand | Andrew Appel

Because voting machines contain computers that can be hacked to make them cheat, “Elections should be conducted with human-readable paper ballots. These may be marked by hand or by machine (using a ballot-marking device); they may be counted by hand or by machine (using an optical scanner).  Recounts and audits should be conducted by human inspection of the human-readable portion of the paper ballots.”

Ballot-marking devices (BMD) contain computers too, and those can also be hacked to make them cheat.  But the principle of voter verifiability is that when the BMD prints out a summary card of the voter’s choices, which the voter can hold in hand before depositing it for scanning and counting, then the voter has verified the printout that can later be recounted by human inspection.

But really?  As a practical matter, do voters verify their BMD-printed ballot cards, and are they even capable of it?  Until now, there hasn’t been much scientific research on that question.

A new study by Richard DeMillo, Robert Kadel, and Marilyn Marks now answers that question with hard evidence:

  1. In a real polling place, half the voters don’t inspect their ballot cards, and the other half inspect for an average of 3.9 seconds (for a ballot with 18 contests!).
  2. When asked, immediately after depositing their ballot, to review an unvoted copy of the ballot they just voted on, most won’t detect that the wrong contests are presented, or that some are missing.

This can be seen as a refutation of Ballot-Marking Devices as a concept.  Since we cannot trust a BMD to accurately mark the ballot (because it may be hacked), and we cannot trust the voter to accurately review the paper ballot (or even to review it at all), what we can most trust is an optical-scan ballot marked by the voter, with a pen.  Although optical-scan ballots aren’t perfect either, that’s the best option we have to ensure that the voter’s choices are accurately recorded on the paper that will be used in a recount or random audit.

Voting Blogs: Florida is the Florida of ballot-design mistakes | Andrew Appel/Freedom to Tinker

This article was originally posted at Freedom to Tinker on November 14, 2018.

Well designed ballot layouts allow voters to make their intentions clear; badly designed ballots invite voters to make mistakes.  This year, the Florida Senate race may be decided by a misleading ballot layout—a layout that violated the ballot design recommendations of the Election Assistance Commission. In Miami, Florida in the year 2000, the badly designed “butterfly ballot” misled over 2000 voters who intended to vote for Al Gore, to throw away their vote.  (That’s a strong statement, but it’s backed up by peer-reviewed scientific analysis.) In Sarasota, Florida in the year 2006, in a Congressional race decided by 369 votes, over 18,000 voters failed to vote in that race, almost certainly because of a badly designed touch-screen ballot layout. In Broward County, Florida in the year 2018, it appears that a bad optical-scan ballot design caused over 26,000 voters to miss voting in the Senate race, where the margin of victory (as of this writing, not yet final) is 12,562 votes.

Media Release: Verified Voting Outlines Steps Voters Can Take to Report Problems on Election Day

Recent reports of possible threats to voting systems and registration databases are alarming, but voters should not be deterred from voting this Election Day. Election officials at the state-level are more prepared for cybersecurity threats or problems with computers than they were two years ago.

“The only way to ensure your vote doesn’t count is if you don’t vote,” said Marian K. Schneider, president of Verified Voting.

Verified Voting urges voters who notice anything wrong with their voter registration or at their polling place to call the Election Protection Hotline: 866-OUR VOTE / 1-888-Ve-y-vota or check out 866OURVOTE.org. Voters should also report any problems to their local county board of elections or to the Secretary of State’s office or both. Doing so will allow officials to understand how widespread the issue is and assist in efforts to pinpoint the cause.

For statewide information about polling place equipment, please visit the Verifier.

Media Release: Verified Voting Calls on Texas to Investigate Straight-Ticket Voting Issues; Voters Should Carefully Check Choices

Marian K. Schneider: “Verified Voting urges Secretary of State Rolando Pablos to move Texas toward reliable, verifiable voting systems that include a voter-marked paper ballot statewide.”

The following is a statement from Marian K. Schneider, president of Verified Voting, in response to reports that voters in six counties in Texas (Harris, Montgomery, Fort Bend, Travis, Tarrant, and McLennan) experienced straight-ticket voting issues using the Hart eSlate voting machines. At a minimum, 5.1 million Texas voters in six of the largest counties in Texas that use Hart eSlate voting machines may be affected by this issue. For additional media inquires, please contact aurora@newheightscommunications.com

“Verified Voting calls on Secretary of State Rolando Pablos to launch a broader and more robust statewide public information effort to advise voters to carefully check their choices as displayed before submitting them on direct recording electronic (DRE) voting machines manufactured by Hart InterCivic.

“Verified Voting appreciates that the Secretary of State issued an advisory warning voters to check their choices carefully before submitting the ballot. More work needs to be done to ensure that all voters in the affected counties are equipped to cast their votes as they intend.

“The reported problems underscore the design flaw in voting systems that do not incorporate a voter-marked paper ballot. Paper ballots that are retained can be later sampled to check if the software is correctly reporting the voters’ selections. Without such a safeguard, public confidence in elections diminishes. Verified Voting urges Secretary Pablos to move Texas toward reliable, verifiable voting systems that include a voter-marked paper ballot statewide.

“Verified Voting also calls on Secretary Pablos to investigate the reports of voting problems, determine the root cause of the issue and publicize the results of such an investigation. Voters should be instructed to report any problems to their local county board of elections or to the Secretary of State’s office or both. Doing so will allow officials to understand how widespread the issue is and assist in efforts to pinpoint the cause.

“Verified Voting also urges voters who experience problems to call the Election Protection hotline at 866-OUR VOTE / 1-888-VE-Y-VOTA.

Verified Voting Blog: An unverifiability principle for voting machines | Andrew Appel

This article was originally posted at Freedom to Tinker on October 22, 2018.

In my last three articles I described the ES&S ExpressVote, the Dominion ImageCast Evolution, and the Dominion ImageCast X (in its DRE+VVPAT configuration).  There’s something they all have in common: they all violate a certain principle of voter verifiability.

  • Any voting machine whose physical hardware can print votes onto the ballot after the last time the voter sees the paper,  is not a voter verified paper ballot system, and is not acceptable.
  • The best way to implement this principle is to physically separate the ballot-marking device from the scanning-and-tabulating device.  The voter marks a paper ballot with a pen or BMD, then after inspecting the paper ballot, the voter inserts the ballot into an optical-scan vote counter that is not physically capable of printing votes onto the ballot.

The ExpressVote, IC-Evolution, and ICX all violate the principle in slightly different ways: The IC-Evolution one machine allows hand-marked paper ballots to be inserted (but then can make more marks), the ExpressVote in one configuration is a ballot-marking device (but after you verify that it marked your ballot, you insert it back into the same slot that can print more votes on the ballot), and IC-X configured as DRE+VVPAT can also print onto the ballot after the voter inspects it.  In fact, almost all DRE+VVPATs can do this:  after the voter inspects the ballot, print VOID on that ballot (hope the voter doesn’t notice), and then print a new one after the voter leaves the booth.

Verified Voting Blog: Continuous-roll VVPAT under glass: an idea whose time has passed | Andrew Appel

This article was originally posted at Freedom to Tinker on October 19, 2018.

States and counties should not adopt DRE+VVPAT voting machines such as the Dominion ImageCast X and the ES&S ExpressVote. Here’s why.

Touchscreen voting machines (direct-recording electronic, DRE) cannot be trusted to count votes, because (like any voting computer) a hacker may have installed fraudulent software that steals votes from one candidate and gives them to another. The best solution is to vote on hand-marked paper ballots, counted by optical scanners. Those opscan computers can be hacked too, of course, but we can recount or random-sample (“risk-limiting audit”) the paper ballots, by human inspection of the paper that the voter marked, to make sure.

Fifteen years ago in the early 2000s, we computer scientists proposed another solution: equip the touchscreen DREs with a “voter verified paper audit trail” (VVPAT). The voter would select candidates on a touchscreen, the DRE would print those choices on a cash-register tape under glass, the voter would inspect the paper to make sure the machine wasn’t cheating, the printed ballot would drop into a sealed ballot box, and the DRE would count the vote electronically. If the DRE had been hacked to cheat, it could report fraudulent vote totals for the candidates, but a recount of the paper VVPAT ballots in the ballot box would detect (and correct) the fraud.

By the year 2009, this idea was already considered obsolete. The problem is, no one has any confidence that the VVPAT is actually “voter verified,” for many reasons:

  1. The VVPAT is printed in small type on a narrow cash-register tape under glass, difficult for the voter to read.
  2. The voter is not well informed about the purpose of the VVPAT. (For example, in 2016 an instructional video from Buncombe County, NC showed how to use the machine; the VVPAT-under-glass was clearly visible at times, but the narrator didn’t even mention that it was there, let alone explain what it’s for and why it’s important for the voter to look at it.)
  3. It’s not clear to the voter, or to the pollworker, what to do if the VVPAT shows the wrong selections. Yes, the voter can alert the pollworker, the ballot will be voided, and the voter can start afresh. But think about the “threat model.”  Suppose the hacked/cheating DRE changes a vote, and prints the changed vote in the VVPAT. If the voter doesn’t notice, then the DRE has successfully stolen a vote, and this theft will survive the recount.  If the voter does notice, then the DRE is caught red-handed, except that nothing happens other than the voter tries again (and the DRE doesn’t cheat this time). You might think, if the wrong candidate is printed on the VVPAT then this is strong evidence that the machine is hacked, alarm bells should ring– but what if the voter misremembers what he entered in the touch screen?  There’s no way to know whose fault it is.
  4. Voters are not very good at correlating their VVPAT-in-tiny-type-under-glass to the selections they made on the touch screen.

Verified Voting Blog: Design flaw in Dominion ImageCast Evolution voting machine | Andrew Appel

This article was originally posted at Freedom to Tinker on October 16, 2018.

The Dominion ImageCast Evolution looks like a pretty good voting machine, but it has a serious design flaw: after you mark your ballot, after you review your ballot, the voting machine can print more votes on it!. Fortunately, this design flaw has been patented by a rival company, ES&S, which sued to prevent Dominion from selling this bad design. Unfortunately, that means ES&S can still sell machines (such as their ExpressVote all-in-one) incorporating this design mistake.

When we use computers to count votes, it’s impossible to absolutely prevent a hacker from replacing the computer’s software with a vote-stealing program that deliberately miscounts the vote. Therefore (in almost all the states) we vote on paper ballots. We count the votes with optical scanners (which are very accurate when they haven’t been hacked), and to detect and correct possible fraud-by-hacking, we recount the paper ballots by hand. (This can be a full recount, or a risk-limiting audit, an inspection of a randomly selected sample of the ballots.)

Some voters are unable to mark their ballots by hand–they may have a visual impairment (they can’t see the ballot) or a motor disability (they can’t physically handle the paper). Ballot-marking devices (BMDs) are provided for those voters (and for any other voters that wish to use them); the BMDs are equipped with touchscreens, and also with audio and tactile interfaces (headphones and distinctively shaped buttons) for blind voters, and even sip-and-puff input devices for motor-impaired voters. These BMDs print out a paper ballot that can be scanned by the optical scanners and can be recounted by hand.