Los Angeles County Registrar Says “No” to Internet Voting, but “Yes” to Unverifiable Touch-Screen Voting for New Election System

Nation’s largest voting jurisdiction plans to design system for L.A., sell it to other counties in state, country.

The good news: When the largest voting jurisdiction in the nation gets its new voting system, perhaps as early as 2015, it will notincluding Internet Voting, according to Dean Logan, Registrar-Recorder/County Clerk of Los Angeles. The bad news: It will very likely include touch-screen computers and, with them, 100% unverifiable voting.

I interviewed Logan last week on my KPFK/Pacifica Radio show [full audio interview is at the bottom of this article], and we had a very informative discussion about what voters in Los Angeles may have to look forward to in the coming years, as well as many of you in the rest of the country, since the new system is being designed with an eye towards selling it to other counties in California as well as in the rest of the country.

So this is not just a local L.A. story. It’s likely to affect the way that votes are cast and tallied in much of the nation. It’s well worth paying attention to, even if, unlike me, you don’t live here.

Los Angeles County alone “has more voters than 42 of the 50 states,” according to Logan’s office. It features nearly 5,000 precincts. Well over 3 million votes were cast in this one county alone during the November 6, 2012 Presidential Election. When Logan took over the job of Registrar after our previous one resigned, suddenly, just months before the 2008 President Election, he had a monster of a job to take over. It’s still a monster. And it may soon get even more gargantuan as he attempts to re-work, re-design and, indeed, re-think how voters vote here, and as we move from our current publicly-owned voting system to our next publicly-owned voting system. (L.A. is one of the very few jurisdictions in the nation which owns, maintains and designs its own system. Most similar systems in the rest of the state and nation are proprietary, owned by the private companies which make them, and don’t allow even the election officials in those jurisdictions access to their “trade-secret” software and source code.)

While, happily, Logan offered me some assurance that we won’t be casting votes over the Internet with his new system —- an assurance that should bring some measure of relief to both Election Integrity advocates as well as the consensus of computer science and security experts who are also experts in voting systems —- there is still much cause for concern, as this still-unknown voting system begins to take shape…

OUT WITH THE OLD?

Logan began the process of finding a new voting system back in 2009. At the time he said he was open to any and all types of voting and tabulation systems, and wanted to find out what it was that voters of L.A. wanted from such a system. He formed the Voting System Assessment Project (VSAP) to work with “stakeholders” of all sorts, hold discussion forums, survey voters, establish focus groups, review various ideas and even open up the process to design ideas submitted from the Internet.

I was invited to participate in some of the early meetings of the VSAP, but I asked him during our conversation on last week’s show why he felt our current system —- known as InkaVote Plus, a variation of the old punchcard system, now modified to use inked bubbles instead of punched chads, producing ballots which are then optically-scanned by a computer tabulator —- needed to be replaced. He described the system and its software as “outdated.”

“Similar to the parts on the physical equipment, it’s hard to find people with the skill level or the background to make modifications to that software if and when it’s necessary,” he explained. “So, we end up being in a situation where we’re really one regulatory or legislative change away from being obsolete.”

“We came close to that when California switched to a ‘top-two’ primary system,” he told me, referring to the 2010 state-wide ballot initiative which did away with our partisan primaries. All party candidates run in the same race now in our primaries, and the “top-two” vote-getters of any party end up going on to compete head-to-head in the general election. (The new system, sometimes referred to as a “Cajun Primary”, has a number of undemocratic features that can adversely affect Democrats, Republicans and third-parties to boot, as The BRAD BLOG has detailed in past articles. None of those failings, however, are Logan’s fault, of course.)

That change, he said, “required some modification to the system in order for the votes to be tabulated correctly. We almost were unable to accommodate that on the current voting system.”

Nonetheless, the county was able to modify the source code on the system in order to accommodate the mandated change after all, because L.A. owns its own hardware and software. “It’s one of the unique things about L.A. County,” he said. “It’s one of the things that important to us.”

If a bill proposed by state Senator Alex Padilla (SB 360) now pending in the state Senate is adopted this year, it would remove California’s long-time restriction against contracting and testing new voting systems before they are federally tested and certified. That would allow L.A. County to create its own system again. No federal testing would be required for it at all. But more on that in a moment.

‘TRANSPARENCY, SECURITY, ACCURACY, VERIFIABILITY’

Logan explained that the principles for his new system were developed after focus groups, surveys and stake-holders described what was most important to them in a voting system. He says it has been a “user-driven project.”

“We wanted to know what voters thought, rather than just what we thought,” he said, explaining that they have now hired a design firm, IDEO, to help implement the ideas. He describes the firm as “a human-centered design firm which has done some incredible work in both the public and private sector.”

IDEO will work to build a system based on the input received via the VSAP to date. That input includes the main principles Logan says voters, and his own office, were most concerned about: “Transparency, security, accuracy, verifiability. All of the things that those of who care about the integrity of elections value highly.”

In a recent piece by KPCC on Logan’s new system, the idea of voting with smartphones was said to be a popular idea among those submitting ideas to an open “design challenge” process that was part of the VSAP.

The idea may send shudders down the spines of those who understand the inherent insecurities of casting votes by the Internet, as well as Election Integrity advocates who understand the necessity of all citizens being able to oversee and authenticate the recording and tabulation of ballots.

So what is Logan beginning to see as the basis for this new voting system? I asked if it will involve computers and/or cellphones. Mostly, I wanted to know if we were talking about a computer-based system of some sort, since, depending on how such systems are designed, it can be very difficult and frequently impossible to verify if even a single vote has been cast and tabulated as per any voter’s intent on such systems.

“I think there certainly will be computer-based or electronic-based components of the system,” he told me. “Now what that looks like and where that plays into the final output of the ballot and how the ballot is tabulated, I think, remains to be seen.”

“When it comes time to build the machine,” he said, “it’s gonna have to meet those standards” of “transparency, security, accuracy and verifiability”.

Well, that sounds good, at least.

NO INTERNET VOTING FOR L.A.

We have long detailed the madness of Internet Voting. Among our coverage, we’ve documented a number of disastrous attempts at Internet Voting systems and the many dangers they pose to security and oversight, as well as the warnings against them by computer science and security experts, and Election Integrity experts.

One need only look back to Washington D.C.’s disastrous experiment in Internet Voting, which almost went live in 2010 for overseas and military voters. The plans to use the system were scrapped at the last minute after it was hacked and completely taken over by “white hat hackers” (University of Michigan computer students and their professor), who had gained such total command of the system in mere hours that they were not only able to change every vote already cast on it during a mock election, but inserted a script into the system to change all future votes invisibly as well. They even modified all of the system’s main passwords to thwart similar attempts to hack the system that they discovered to be ongoing by computers from both Iran and China.

There have been many other disasters in Internet Voting —- from a 2012 online Canadian election attacked by some 10,000 computers, to a 2012 CA State University student body election that was hacked by one of the candidates in order to gain control of an annual salary and the student government’s $300,000 budget, to this year’s embarrassment by the Academy of Motion Picture Arts and Sciences which attempted to use Internet Voting for the first time this year, to disturbing and questionable effect.

The non-partisan election integrity group, VerifiedVoting.org posted a “Statement on the Dangers of Internet Voting in Public Elections,” signed by nearly a dozen top computer science and security experts with backgrounds in electronic voting systems. The letter explains that “Cyber security experts at the National Institute of Standards and Technology and the Department of Homeland Security have warned that current Internet voting technologies should not be deployed in public elections,” as they “cannot be properly protected and may be subject to undetectable alteration.”

“We conclude that the evidence does not exist to support casting ballots online in public elections,” the scientists note. “There are too many unsolved security challenges that have yet to be overcome. In fact securing networks from cyber attack is a major national security concern that is as yet unresolved. Financial institutions, the FBI, the White House, the Department of Defense have all been breached. Major corporations like Lockheed Martin, Sony, Google, Adobe, Microsoft, and Northrop Grumman have also been breached. It is unreasonable to assume that any Internet voting system vendor today can repel a well funded partisan operative or nation state determined to manipulate, disrupt, or violate voter privacy in an online public election.”

After the infamous Washington D.C. hack, the scientists who testified about it to a D.C. Elections Committee unanimously agreed that the technology simply doesn’t exist at this time —- and likely will not for a decade or more —- to even consider voting over the Internet.

J. Alex Halderman, the University of Michigan computer scientist who led the team that took over the D.C. Internet Voting systems (not long after her also hacked a touch-screen voting system, replacing its voting software with Pac-Man), testified that “the scientific consensus is that Internet Voting is just too dangerous today based on the limits of today’s security technology,” adding: “Indeed, it will probably be decades, if ever, before the technology is at a level where we can perform voting safely, purely over the Internet.”

Verified Voting’s Jeremy Epstein testified similarly at the same D.C. hearing: “What we found in forty years of experience is you can penetrate and patch, and then you penetrate again and you patch again, and you penetrate again and you patch again and you penetrate again and you patch again and it never ends. If it ended, Microsoft would have succeeded. We wouldn’t all be having to reboot our computer and install patches once a month for the past ten years. … This isn’t a solvable problem that way.”

From an Election Integrity standpoint, it’s even larger than an issue of mere security. The fact is that even if such a system were 100% secure, it is impossible for citizens to know that it was 100% secure and that all votes were both recorded and tabulated as per the voters’ intent.

Despite all of that, many elected officials, including, disturbingly enough, a number of misinformed Democrats in California, continue to call for Internet Voting in the state.

With all of that, I was very pleased with Logan’s unambiguous answer to my direct question as to whether he has ruled out Internet Voting for L.A. County’s new system, given the long-documented dangers and concerns.

“Yeah. I would say that Internet Voting, as it has been attempted and discussed in this country and outside of this country, would not fall within —- would not meet the standards that we’ve adopted for this project,” he said.

“The principles that we’ve adopted, like paper-based ballots that are available for auditing and verifiability, and the security standards that are embedded in our principles, and the value of a secret ballot that allows for independence in voting, are outside the scope of any Internet Voting project that’s been attempted at this point.”

So that, at least, seems to be very encouraging news.

From there, however, our discussion became a bit more troubling…

UH, OH —- TOUCH-SCREENS AND COMPUTER-PRINTED BALLOTS

Long time readers of The BRAD BLOG will recall my own disastrous experience in L.A. County some years ago when I attempted to use the disabled-accessible part of the InkaVote Plus system to cast my vote in the June 2008 state primary. The system allows blind voters to use audio prompts to select their favored candidates and then the computer allows the voter to confirm the selections before printing out a paper ballot with the voters’ selections marked for them on the paper. That ballot is then optically-scanned like all of the other hand-marked paper ballots in the election.

As I’m not blind, I was able to check to make sure the computer had printed my votes properly before dropping it into the ballot box.

I discovered —- after some 15 or so minutes studying the printed ballot, attempting to make sure I was reading it correctly —- that the computer system had misprinted 4 out of 12 of my own votes!

So, it was with that troubling experience in mind —- and Logan’s own familiarity with it (his team did a terrific forensic job determining what had gone wrong to cause the error) —- that I asked him if we were looking at the possibility of computer-, rather than hand-marked paper ballots for L.A.’s future voting system (and, perhaps yours too!)

His answer was not encouraging.

“I think that it’s likely that what we end up with will allow for hand-marked ballots, but that there very well could be some electronic interfaces for marking the ballot. But the key component there is the verifiability. Making sure that the voter has the ability to verify that the mark that they made electronically matches up to their choices.”

A computer that marks the ballot for you, the way the current voting system’s computer (mis)marked it for me, back in 2008, would seem to be stretching the idea of a “hand-marked ballot”.

“How would I, as an Election Integrity advocate,” I asked him, “how would I look at those ballots and know that the voter had approved them and approved them correctly, since we have studies showing that 80% of the people don’t check the paper trails that are printed off by computers? Other studies show that, even when they do check them, they don’t notice vote flips. So how would I, after the election, know that I was actually looking at the voter intent on a computer printed ballot?”

Logan’s answer did not offer much me much confidence: “I think that there are a couple of different ways to address that, and that could be a whole show. But I would say that one fundamental thing that I hope we look at in this, is actually separating the front-end from the back-end of that. So, in other words, you might have a [computerized] ballot-marking device that you use some sort of interface, whether it be touch-screen or a keyboard where you make your selections. That prints out a ballot that’s human readable, so you can see that I’ve made my selection for ‘Brad Friedman’ and for ‘Yes on Measure J’, and blah, blah, blah and you can actually physically see that. And then you take that and deposit that into a back-end system that does the actual tabulation, that is totally separate and independent from the marking system.”

His answer didn’t speak to my point about studies by MIT and Caltech that found most voters do not bother to check their computer printed votes, and that two-thirds of those who do look at the summary at the end of the computer voting process, according to a study by Rice University, don’t notice when the computer has flipped one or more of their votes.

The biggest problem, however, is that even if voters do check their computer-printed ballots (and most don’t) and even if they do notice if a vote has been flipped by the computer (and most don’t), it is strictly impossible for anybody after the election to know that they did!

The result: 100% unverifiable voting.

Hand-marked paper ballots, presuming chain of custody is secure, are known, by their very definition, to be a reflection of the voter’s intent. But with computer-marked ballots, it simply can’t be known if they reflect the voter’s intent or not after the ballot has been cast. A computer Ballot Marking Device (BMD) system would ultimately be equally as unverifiable as any of the touch-screen or similar electronic voting systems already in use —- often to disastrous affect —- across the country.

Adding to my worries that such a system of computer Ballot Marking Devices is in our future is the fact that Sen. Padilla’s bill —- being deceptively sold to the public as a bill to allow L.A. to develop a publicly-owned voting system —- actually encourages the development of touch-screen computer voting systems like the one described by Logan. [NOTE: We requested comment from Padilla’s office on this matter, and other concerns about the bill, but they have yet to respond. We hope to cover more about the troubling details in the current version of his bill in a future article.]

In a follow-up email after our interview, in which I wanted to verify whether Logan meant that all voters would always have the option, somehow, of hand-marking a paper ballot at the polling place, or whether his comment about a system that “will allow for hand-marked ballots” meant that a voter would have to use an absentee ballot, for example, if they wanted to hand-mark their vote, he responded:

Not to get ahead of the design outcomes and the iterative review and vetting process that will follow, but the focus on flexibility, adaptability and usability as important elements of a voting systems design —- grounded in security and accuracy, of course, would suggest that the voter will have options in the voting experience. I do not foresee hand-marking or other options limited to certain groups of voters or options that are exclusive to either a poll voting experience or a vote by mail voting experience. The full principles document, adopted by consensus with our Voting Systems Assessment Advisory Committee is available at www.lavote.net/Voter/VSAP/

Your interpretation of his response there is likely as good mine. In truth, I’m not sure if that means all voters will be able to vote by hand-marked paper ballot at the polling place or not. But I suspect we’ll be revisiting the issue as his new system begins to take more physical shape.

NO FEDERAL TESTING?!

Given that Padilla’s bill, if passed and signed as currently written, is set to remove California’s requirement that all voting systems be federally certified by the U.S. Elections Assistance Commission (EAC), I asked Logan if he had planned to have the new system follow current state law requiring both independent federal testing and independent state testing before voting systems may be used in the state.

He made it clear that he would like to avoid federal testing, explaining that dysfunction at the EAC makes federal testing something to be avoided.

“The federal infrastructure for providing that certification or approval for voting systems is completely broken right now,” he explained, somewhat inaccurately. “It’s governed by the Election Assistance Commission which has no members right now. It’s mired in the partisan political dynamic on Capitol Hill.”

It is true that the EAC is a mess. Currently is has no Commissioners at all, and no Executive Director. (Without going into great detail here, this is thanks to Republicans refusing for several years to nominate any Commissioners for the two seats they control, holding up the confirmation of the nominees named by the Democrats in the process. Yes, we went through the 2012 Presidential election year with no Commissioners on the federal body created to oversee and assist with the nation’s election systems.)

Nonetheless, even without Commissioners and an Executive Director, the EAC’s testing and certification regime is still operating as per usual.

“We continue to test and certify voting systems uninterrupted by our lack of Commissioners,” Brian Hancock, the EAC’s Director of Testing and Certification confirmed via email after my interview with Logan.

Jessica Myers, an EAC Certification Program Specialist also confirmed that point as well, when asked if they were still up and running as usual. “Yes, that is correct,” she wrote. “We are still testing and certifying voting systems. We post a weekly update of the progress of the test campaigns on the EAC blog.”

Indeed, the EAC’s website posts documentation of testing performed in January, February and March of 2013, as well as in recent years prior, and last week’s EAC blog update included information on the newly published “Voting System Test Laboratory (VSTL) Program Manual, version 2.0”.

When I followed up with Logan after the interview, explaining that I was confused about his response on this point, given that the EAC was, indeed, still testing new voting systems as normal, he responded as follows:

You are correct that the EAC testing and certification process is still in place; although with limitations. The current process is expensive and time consuming and is limited to testing and certification under dated (some would argue outdated) standards that cannot be updated without a quorum of EAC Commissioners to adopt them. None of the systems that have recently been certified or that are seeking certification —- all of which come from the limited commercial market —- are scalable to the needs of Los Angeles County. Additionally, the federal standards, as they exist, are voluntary. Several states have adopted state-based systems in lieu of reliance on or to augment the federal process. I believe the agency is similarly limited in contracting with any additional testing laboratories beyond those with which they are currently engaged and that their staffing capacity is depleted as well. The federal testing and certification process, as it exists today, contemplates a voting systems design that is end-to-end —- supported and marketed by a single vendor. We see exclusive reliance on the federal system both as insufficient for a new model of voting systems development and a process that doesn’t have the capacity to meet the timelines and demands of the county’s voting system needs. The Padilla bill continues to make reference to the federal process and to the EAC (or its successor), but provides for the possibility of a more robust and efficient state-based testing and certification process.

There are a number of question I have about a number of the details offered by Logan’s response. I have asked the EAC to respond to some of those question in kind. If they do, I will update here with that information.

For now, and for whatever reason, Logan seems interested in avoiding the federal testing and certification process entirely. The provisions in Padilla’s current bill, as I read them, appear to grant sole authority to the CA Sec. of State to approve voting systems, even without any testing whatsoever, if he or she so chooses. That makes all of this additionally disturbing.

UPDATE: The EAC’s Hancock responded to my follow-up query via email. He says that “In simple terms, [Logan is] correct that we cannot test to updated Standards until we have a quorum of Commissioners. That said, we have made great progress in the past 2-3 years in the time and cost of testing and certifying voting systems. Please feel free to ask the manufacturers or VSTLs [Voting System Test Laboratories] and I believe they will agree with this statement.”

More to the point, he also goes on to note that there is an “extensions clause” [PDF] to the EAC’s current testing standards that Logan refers to as “dated (some would argue outdated)” above. Hancock explained that the clause allows for the testing of non-traditional systems, that do not meet the “end-to-end” design Logan referenced above as a reason why the EAC would not be an appropriate body to test LA’s new system.

Finally, Hancock says he is a member of Logan’s VSAP Technical Advisory Committee and, as such, is “continuing to talk at length with Dean regarding how certification might work when we eventually get a system in LA County.”

While we have spent no small number of pixels here at The BRAD BLOG, and even in books, detailing the enormous problems and dysfunctions of the EAC, including in their testing and certification regime, it remains our opinion that more testing, rather than less, by more independent bodies, is a good and necessary thing. Skirting those requirements altogether is troubling, to say the least, and it remains unclear to me why a system of this size, put together over this many years, with an eye to voter confidence, would serve the voters better by not being federally certified in addition to state certified, before being used in an actual election.

WHY NOT “DEMOCRACY’S GOLD STANDARD” —- HAND-COUNTED PAPER BALLOTS?

As I explained at the beginning of this article, Logan began his search by stating that he was open to any and all types of voting and tabulation systems. I had asked him, several years ago, if he intended to look into what we regard around here as “Democracy’s Gold Standard” —- hand-marked paper ballots, publicly hand-counted at the precinct on Election Night, with all members of the public, political parties and even video cameras watching, with results posted decentrally at the precincts before ballots are moved anywhere.

Such a system is used (and much beloved), for example, by 40% of the towns in New Hampshire.

While we ran out of time to go into detail at the end of our interview on my KPFK show last week, Logan stated in the seconds we had left that hand-counting “has been part of the research that we’ve done.”

I promised to follow up with him for more details on that point afterward. He responded to my post-election email query with the following:

Hand marked, hand counted ballots was among the existing voting systems included in our assessment documents and data collection. Hand counting was also included among the voting systems referenced in voter surveys and focus groups early on in the project; which are summarized in our July 9, 2010 project report available on the VSAP web page. Additionally, our team has reviewed books and reports on the New Hampshire hand count process and we looked at a 2012 study out of Rice University on various hand-count methods for ballot tabulation. I don’t have immediate access to that study, but I am sure you can access it through a search engine.

The July 9, 2010 report [PDF] Logan references describes telephone and online surveys commissioned by the county to try and determine what sort of voting system voters in L.A. County would most like to use. Most respondents, according to those results, would like to use Direct Recording Electronic (DRE, usually touch-screen) voting systems, despite the fact that they are 100% unverifiable —- a point that was not explained to respondents taking the survey.

The fewest percentage of respondents wanted a hand-counted paper ballot system, though that number, like those supporting DREs, varied among different demographic groups in the survey. It should also be noted that, of all the voting systems from which respondents were asked to choose, hand-counted paper ballots was likely the one they were least familiar with, as it is the most rarely used among our 50 states. Moreover, when hand-counting is seen by voters, it is usually in the event of post-election recounts, where all of the ballots in a race are counted at once in a central location, versus the type of precinct-based, publicly-overseen counting done in the aforementioned New Hampshire towns and a few other jurisdictions around the country, as described in Nancy Tobi’s Hands-On Elections: An Informational Handbook for Running Real Elections, Using Real Paper Ballots, Counted by Real People.

But that too is a topic I suspect we will be returning to in some detail in the days ahead, as Logan’s plans take shape, and as we do our best to keep an eye on it —- and as hopefully the Registrar-Recorder/County Clerk of the world’s largest voting jurisdiction will see fit to continue the discussion with us on his progress in the not-too-distant future.