The year was 1977, and my friend Gail was in the market for a cheap used car. One of the guys in our apartment building, Chuck, wanted to sell his Pinto.
“No, Gail, no,” I told her. “People are saying the Pinto’s gas tank can explode in even low-speed rear-end crashes. There’s talk of recall and lawsuits. If you buy this car, you won’t be able to resell it.”
Gail believed me but dismissed the risk. “Ford wouldn’t be selling the car if it was a big problem,” she said. “And besides, Chuck said the car has seat belts.” She thought for a second and couldn’t come up with any more ways to dismiss or minimize the risk. “I have faith it’ll be okay.”
My roommate backed me up. “Gail, I saw a Datsun B210 for sale on Johnson Street. The B210 does everything the Pinto does, without the risk. Forget about the Pinto.”
The more we tried to reason with her, the sillier her arguments became. Chuck had done a good job cleaning his trash out of the car. She could probably minimize the risk by never filling the gas tank more than a quarter full.
She had turned off her brain when it came to hearing anything negative about the Pinto. Chuck seemed to have her under some sort of spell.
Gail came to mind during the Wisconsin Elections Commission meeting last week. The Commissioners were meeting to decide whether to approve an updated version of a risky piece of elections equipment, called the ExpressVote. They were listening to the manufacturer, ES&S, the way Gail had been listening to Chuck, treating words of warning like flies to be swatted away.
The ExpressVote is a type of ballot-marking device (BMD), which voters use to mark their ballots when they cannot, or do not want to, use a pen. BMDs only print ballots; they don’t count votes. But they can be misprogrammed to print a ballot that contains different votes than the ones the voter intended.
Safe BMDs manage this risk by printing ballots that look just like regular hand-marked paper ballots. Each vote is recorded once–as a marked oval beside some candidate’s name. The voter can see it’s next to the correct name. The tabulator looks at that same marked oval, verified by the voter, when it counts the vote.
The Pintos among the BMDs—that is, the unsafe ones—print barcoded ballots. Barcoded ballots record each vote twice—once in text, and once in barcode. Voters can verify only the votes printed in the text. The tabulator can count only the votes inside the barcode. If the BMD is programmed to print one vote in text and a different vote in the barcode, the voter cannot notice. The ExpressVote is one of these machines.
In my dreams, whenever a state election authority meets to approve voting equipment, they would invite the manufacturer, of course. But because the commission would want all the relevant, reliable information they could get, they would also invite other trusted people to sit at the table to answer any questions that might arise and to comment on the manufacturers’ claims.
The mission of the meeting would be to determine what is best for Wisconsin elections. The commissioners’ conduct—particularly their follow-up questions—would demonstrate that they wanted nothing less than the full, unbiased facts.
But the June WEC meeting was not that.
As usual, uninvited members of the public could speak for five minutes at the beginning of the meeting. As usual, I took that opportunity. I explained the risks. I warned of the gathering storm of litigation and legislation. I told them barcoding brings no benefit to balance the risk. I told them they have other options. I asked them to protect our votes and turn away from this pointless risk. The commissioners listened politely but asked no questions.
Then for the next two hours, I and everyone else in the room was required to listen silently as the salespeople gave their pitch without time limit and demonstrated their equipment. The Commissioners had arranged for no provision to receive correction or rebuttal from an independent source if ES&S misled the Commission in any way. If the salespeople omitted any important information the commissioners might need to know, the meeting presented no opportunity for anyone to provide it.
The one exception was when Commission Chair Dean Knudson led a responsible line of questioning about whether the municipal clerks test the BMDs before each election. To its credit, the commissioners voted to promote that testing before future elections.
But other than that, everyone’s conduct indicated that ES&S, the commissioners, and staff came to the meeting with one shared goal: to minimize or refute concerns about the security of the ExpressVote and approve it for sale in Wisconsin.
One example: The issue of voter verification. ES&S designed a feature into the ExpressVote that allows a voter to reinsert the barcoded ballot back into the machine, and have the BMD display the votes on a computer monitor for a second time. ES&S wants everyone to believe that this feature provides voter verification.
But of course it doesn’t. Everyone in the room—commissioners, staff, and company reps included—was intelligent enough to know that if a hacker ever programs a BMD to print the wrong votes in the barcode, the hacker will also program it to display only the right votes to the voter.
But the commissioners asked no skeptical or challenging follow-up questions. None even bothered to wonder out loud what good barcoding does anyway. (Answer: Nothing. It’s all risk, no reward.) A few even repeated ES&S’s claim of verifiability back to them, like my friend Gail, as if repetition of a silly argument could make it convincing.
Another example: ES&S’s pitch regarding the safety of barcodes. Barcoded ballots are safe, the sales pitch went, because:
- The programmer assigns each candidate a unique numeric code, based on that candidate’s location on the ballot. For example, the candidate whose oval is located in the 2nd column, 15th row, first side, first page of the ballot will be Candidate 021511.
- When the tabulator looks at a hand-marked ballot and sees a marked oval at that position, the tabulator will count a vote for Candidate 021511.
- When that same tabulator looks at a barcoded ballot and sees a barcode that translates into “021511,” the tabulator will count a vote for Candidate 021511.
In summary (ES&S says), hand-marked and bar-coded ballots are equally secure because the tabulator uses the same numeric code, whether it is reading from a marked oval or from a barcode.
This information—presented in a glossy, illustrated, full-color brochure—answered a question no one had asked and no one cares about. The problem isn’t that the tabulator might use different numeric codes when interpreting ovals and barcodes.
The problem is that when counting a barcoded ballot, the tabulator looks at information no voter has verified, unlike when the voter and tabulator both look at the same marked oval.
The commissioners gave no sign they noticed the time-honored marketing ploy: Distract the customer by talking about something else and pretend you have addressed the concern. Gullible and eager-to-say-yes customers smile and nod.
I don’t know what accounts for this smile-and-nod process for approving voting equipment. I do know the commissioners are capable of being tigers when it comes to security — of a different system. I’ve witnessed the commissioners asking serious, challenging follow-up questions—really engaging their critical faculties—when working through security issues involving WisVote, our state’s voter-registration system.
During the weekend before their Tuesday meeting, participants in our group (Wisconsin Election Integrity) had emailed the commissioners warning them of the barcoding BMDs’ security issues and asking them to stop certifying them. Had we been raising security concerns about something in the WisVote system, I’m confident the commissioners’ response would have been to tell their staff to resolve the security issue.
But we were raising an alarm about the tabulation-system security. So the commissioners’ response was to tell their staff to reassure voters there is no problem.
I cannot imagine any commissioner shrugging and telling me, “Well, it does take a leap of faith,” to end a conversation about voters’ ability to verify their registration records, as one did to end a conversation with me about voters’ inability to verify barcoded votes during a break in Tuesday’s meeting.
“Leap of faith” doesn’t cut it with any of them when it comes to voter-registration records. I cannot understand why they vote as if they see that as an acceptable standard for the tabulation system.
If something requires a leap of faith, it’s probably not a good idea.