Earlier this month I was in a Vietnamese restaurant near my office. As the waiter brought water, napkin, and chopsticks, he dropped the chopsticks (still in their paper wrapper) on the floor. So he picked up the chopsticks, returned them to the bin with all the other chopsticks ready for setting tables, and picked up a different pair from the same bin to bring to my table. I didn’t say anything to the waiter; presumably this happens all the time, and there was a paper wrapper on them anyway.
Also this month, a resident of Key West, Florida noticed that an early voting site (Big Pine Community Park) had been left unlocked and unattended with the voting machines inside. The Supervisor of Elections removed those voting machines from the polling place, replaced them with other voting machines kept in reserve. And of course, the unattended voting machines will be “set aside as back-ups if needed”. Reminds me of those chopsticks.
Seriously, there is nothing surprising here. It’s long been known that voting machines tend to be left unattended in unlocked rooms before elections. Professor Ed Felten used to regularly visit regularly visit polling places before election day and photograph unattended voting machines. He wrote about it in 2006, 2008, 2008 again, 2009, and 2010.
Voting machines need to be delivered to polling places (early vote centers and election-day precincts) before the elections. Those polling places are distributed through the community: elementary school gymnasiums, church basements, community centers, town halls, public libraries. None of those places are owned by the Board of Elections, so the Supervisor of Elections has little control over who has keys to them.
This has serious cybersecurity implications. A hacker with unsupervised physical access to a voting machine could modify the data on the (removable) memory card to change votes, they could modify the election definition so that future ballots are counted incorrectly, or they modify the firmware so that the machine cheats in future elections. They might even be able to modify the data file that will be read by the county’s central Election Management System (EMS) so that the EMS becomes infected with malware that spreads to machines throughout the county in the next election cycle.
Some models of voting machine are more resistant to these attacks than others. Key West uses are Dominion voting machines, which are not very secure in this regard.
This is why we don’t (or shouldn’t) rely entirely on the cybersecurity of voting machines, for the trustworthiness of elections. Yes, voting machines do have some protections against tampering by people who obtain unsupervised physical access to them; but those protections are often weak. The best protection is the paper ballot, marked by the voter with a pen that’s difficult to cyber-hack; counted by an optical-scan voting computer that retains the paper ballot.
But for the paper ballots to provide meaningful security, there must be procedures that go with them, standard in elections for well over 100 years: ensure the ballot box is empty just before voting starts; keep count of how many authorized voters deposit ballots, and check that count against the number of ballots in the box at the end of the day. The voting machine’s “public counter” (showing the number of ballots scanned, according to the computer) should also match that number.
With vote centers open over multiple days, additional protections are needed for the paper ballots. Witnesses should record the public counter (on paper!) at the close of each day before the machines are locked away, and compare it to the public counter when they’re unlocked the next morning. If it’s grown by a few hundred, that would suggest ballot stuffing. (The public counter is shown on the optical-scanner’s display, continuously throughout the election. It’s also available on the printed poll-tape, but that poll-tape is available only after the polls close, so it’s not useful for this purpose during the election.)
And what about tampering with the paper ballots in the (supposedly sealed) ballot box while it’s stored overnight in the Community Center? What some election supervisors do is to empty out the ballot boxes each night at the close of polling, in bipartisan teams of pollworkers, putting those ballots into sealed pouches and transporting them to the Board of Elections vault. That way, one can verify each morning that the ballot box is empty, as it’s supposed to be.
And finally, paper ballots sitting in a vault, transported there by careful chain of custody procedures, don’t do any good if nobody ever looks at them. That’s why Risk-Limiting Audits are essential: that is, statistically sound methods (by examining a well-chosen random sample of the paper ballots) that provide a quantifiable guarantee that the election outcome claimed by the computers is the same as you’d get by an accurate hand count of the paper ballots.
These are just a few examples of procedures used by security-conscious election administrators to ensure that vote centers and precinct polling places produce trustworthy results. I would like to think that these methods are used everywhere.
Leave a Reply