The year was 1977, and my friend Gail was in the market for a cheap used car. One of the guys in our apartment building, Chuck, wanted to sell his Pinto.
“No, Gail, no,” I told her. “Safety experts say the Pinto’s gas tank can explode in even low-speed rear-end crashes. There’s talk of recall and lawsuits. If you buy this car, you will be in danger, and you won’t be able to resell it.”
Gail dismissed my concerns. “Ford wouldn’t be selling the car if it was a problem,” she said. “And besides, Chuck said the car has seat belts.” She thought for a second and couldn’t come up with any more ways to dismiss or minimize the risk. “I have faith it’ll be okay.”
My roommate backed me up. “Gail, I saw a Datsun B210 for sale on Johnson Street. The B210 does everything the Pinto does, without the risk. Forget about the Pinto.”
The more we tried to reason with her, the sillier her arguments became. She told us Chuck had done a good job cleaning his trash out of the car. She promised us she would minimize the risk by never filling the gas tank more than a quarter full.
She had turned off her brain when it came to hearing anything negative about the Pinto. Chuck seemed to have her under some sort of spell.
Gail came to mind during the Wisconsin Elections Commission meeting last week. The Commissioners were meeting to decide whether to approve an updated version of a risky piece of elections equipment, called the ExpressVote. They were listening to the manufacturer, ES&S, as Gail had been listening to Chuck, with doe-eyed admiration, treating words of wisdom from anyone else like flies to be swatted away.
The ExpressVote is a type of ballot-marking device (BMD). Voters use BMDs to mark their ballots when they cannot, or do not want to, use a pen. BMDs don’t count votes; they just print out marked ballots. But (like any computer) they can be misprogrammed to print a ballot that contains different votes than the ones the voter intended.
Safe BMDs manage this risk by printing ballots that look just like regular hand-marked paper ballots. Each vote is recorded once, as a marked oval beside some candidate’s name. The voter can see the mark is next to the correct name. The tabulator looks at that same marked oval, verified by the voter, when it counts the vote.
The Pintos among the BMDs—that is, the unsafe ones—print ballots on which the votes are encoded, in either QR or barcodes. Encoded ballots record each vote twice—once in human-readable text, and once in computer-readable code. Voters can verify only the votes printed in the text. The tabulator counts only the encoded votes. If the BMD is programmed to print one vote in text and a different vote in the code, the voter cannot notice. The ExpressVote is one of these machines.
When a state election authority meets to approve voting equipment, they should invite the manufacturer, of course. But a truly rational, responsible commission would want all the reliable information they could get. So they would also invite independent experts to sit at the table to answer any questions that might arise and to comment on the manufacturers’ claims.
The mission of the responsible commission’s meeting would be to determine what is best for that state’s elections. The commissioners’ conduct—particularly their follow-up questions—would demonstrate that they wanted nothing less than complete, unbiased facts about the equipment.
But the June WEC meeting was not that.
We’d organized people to write to the Commission the week before their meeting, to explain the security risks and to pass along the independent security experts’ assessments. We explained the importance of voter verification and how encoded ballots prevent it. We told them of the gathering storm of litigation and prohibiting legislation. We explained that encoded ballots bring no benefit to balance the risk. We pointed out that other systems have all the same benefits and without the risks.
I reiterated that information in person, during the brief five minutes that the Commission allows for public comment at the beginning of each meeting. I asked the commissioners to protect our elections by turning away this pointless risk. They appeared to listen politely, but asked no questions.
Then for the next two hours, everyone in the room was required to listen silently as the salespeople gave their pitch–no time limit for them! If the vendor stretches the truth, dissembles, or lies, the meeting rules provide the commissioners with no opportunity to obtain correction or rebuttal from an independent source. If the salespeople omit any important information, the rules of the meeting allow no opportunity for anyone else to provide it.
In short, the vendor, the commissioners, and staff all come to the meeting with a single, shared goal: to minimize or refute concerns about the security of the voting equipment and to approve it for sale in Wisconsin.
One example: The issue of voter verification. ES&S designed a feature into the ExpressVote that allows a voter to reinsert the encoded ballot back into the machine, and have the BMD display the votes on a computer monitor for a second time. ES&S wants everyone to believe that this feature provides voter verification.
But of course it doesn’t. Everyone in the room—commissioners, staff, and company reps included—was intelligent enough to know that if a hacker ever programs a BMD to print the wrong votes in the barcode, the hacker will also program it to display only the voters’ selections back to the voter.
But the commissioners asked no skeptical or challenging follow-up question. None even bothered to wonder out loud why anyone would encode votes in the first place. A few even repeated ES&S’s claim of verifiability back to them, like my friend Gail, as if repeating illogic somehow makes it logical.
Another example: ES&S’s pitch regarding the safety of barcodes. Be forewarned: Don’t worry if you cannot see a connection between the following information and any security concern. There is none. The vendor claimed encoded ballots are safe because:
- The programmer assigns each candidate a unique numeric code, based on that candidate’s location on the paper ballot. For example, the candidate whose oval is located in the 2nd column, 15th row, first side, first page of the ballot will be Candidate 021511.
- When the tabulator looks at a hand-marked ballot and sees a marked oval at that position, the tabulator will count a vote for Candidate 021511.
- When that same tabulator looks at a barcoded ballot and sees a barcode that translates into “021511,” the tabulator will count a vote for Candidate 021511.
Backed up with a glossy, illustrated, full-color brochure, the ES&S salespeople presented those facts as if they explained why hand-marked and encoded ballots are equally secure. But those facts answer a question that no one is asking and that no one cares about. The problem isn’t what the tabulator ‘thinks’ when it reads a barcode or a hand-marked oval. The problem is that when given an encoded ballot, the tabulator reads and counts marks the voter cannot read or verify, unlike when the voter and tabulator look at the same marked oval.
Distracting the customer by talking about something else and pretending it addresses the concern is a time-honored marketing ploy. It works, too. Like gullible customers everywhere, the commissioners just smiled and nodded.
I wish I knew the causes of this smile-and-nod approach to approving voting equipment. I do know the commissioners are capable of being tigers when it comes to security of their own WisVote system, which handles our voter registrations. I’ve witnessed the commissioners asking intelligent, challenging follow-up questions—really engaging their critical faculties—when working through security issues involving WisVote.
Had our security concerns about something in the WisVote system, I’m confident the commissioners would have soberly instructed their staff to resolve the issue. If we’d been talking about voters’ ability to verify their registration information, I cannot imagine any commissioner shrugging and telling me, “Well, it does take a leap of faith.” But that’s precisely how, during a break, one commissioner ended a conversation with me about voters’ inability to verify the votes printed on their ballots.
Yes, it certainly does take a leap of faith. And when it comes to security of our voting systems, that’s a very unwise way to do business.
