BLOG

The Election Guard we need isn’t one that Microsoft can provide. It’s human.

In brief:  Microsoft’s ElectionGuard is sophisticated technology that gives the public (e.g., voters, parties) the ability to detect signs of electronic vote tampering. This essay describes that product and its live-election test in Fulton, Wisconsin in February 2020. There are two take-away points.
First: Even if ElectionGuard successfully alerts its users to signs of trouble, election officials are unprepared to respond to those signs. We must disabuse ourselves of the fantasy that more or newer or shinier technology, by itself, can compensate for vulnerabilities that exist when no human takes managerial responsibility for the accuracy of the certified results.
Second: The trial run in Fulton created a rare circumstance: On this one day, in this one polling place, the managers in charge were truly committed to producing results of unquestionable accuracy—with no excuses, no whining, no blue smoke or mirrors. And they did, using two simple methods. The critical lesson of Fulton is this: When election managers truly want to, they can produce verified accurate results with minimal additional work and no new technology.


Captain Chesley (Sully) Sullenberger became the face of technology mastery when in January 2009 he safely landed 155 people in the Hudson River after his aircraft did not, shall we say, perform as expected. Later he commented:

“What we have learned is that automation does not decrease problems. It changes the nature of problems. As we use more and more technology in the cockpit, we must always make sure that humans are in complete control of the aircraft and its flight path.”

When it comes to election automation, Americans have not yet learned that lesson. On that future Election Night when the voting machines deliver incorrect vote totals, the election will crash and burn, because our officials are not prepared to take effective control to save it.

It’s a sign of America’s deep-seated desire to trust technology that many readers will dismiss this message unless I remind them of three basic and irrefutable facts.

  • First, any computer can be deliberately misprogrammed. Therefore, all voting systems are hackable, either by outsiders or by corrupt insiders. Insiders include the employees and contractors working for voting equipment vendors, service companies, and the local election offices.
  • Second, there is no surefire way to prevent all misprogramming, no matter how big the company or how lush the security budget. Computer systems of global corporations as big as Sony and as focused as the US Department of Homeland Security have been compromised. 
  • Finally, American voting-machine companies and our local election clerks have nowhere near the security resources of Sony or the DHS. Not even close. Knowing that malefactors found their way into those systems, it is delusional to imagine voting-equipment companies and town clerks can keep them out of our voting machines forever.

Therefore, responsible citizens accept the inevitable: Sooner or later, American voting machines will be deliberately programmed to miscount on Election Day.

And when that happens, as with US Airways Flight 1549, it will be human actions, not technology, that can save the election. If local officials quickly detect the miscounts and decisively correct them before certification, the election will be saved. If they do not, the election will be a total loss.

However, in most states including Wisconsin, election officials trust the voting machines and the programmers. Full stop. They make no effort to detect outcome-altering miscounts; they have no plans in place to correct the results if miscounts make themselves known. Occasionally, Wisconsin officials check a few randomly selected voting machines’ tallies against the paper ballots, but even if those audits notice one miscounting machine, the officials do not expand the audit to verify the outcome and do not claim to.

In short, we have no Captain Sullenbergers in the cockpit of our elections.


Josh Benaloh, Ph.D., Senior Cryptographer for Microsoft, thinks he has an antidote to the officials’ managerial passivity: Technology that will enable other people to detect miscounts. Staying with the Sullenberger analogy, he wants to enable each passenger independently to monitor the plane’s engine power and altitude.

It’s easy to trust Benaloh’s motives and his expertise. With boy-next-door good looks, Benaloh’s face carries a natural smile that disappears only when he frowns—and sometimes not even then. As whip-smart as they come, Benaloh has degrees from Massachusetts Institute of Technology and Yale, and his credentials as a forward-thinking innovator are impeccable: He wrote his doctoral dissertation on verifiable secret-ballot elections in 1987, more than a decade before computerized vote-counting was common, and three decades before election security came into public view as a serious concern. Ask anyone in the field to name the top 10 US experts, and Benaloh’s name is likely to be on their list.

Benaloh and I were among those present in Fulton, Wisconsin last February when a small election (only two races on the ballot) allowed the Microsoft team to demonstrate ElectionGuard, an election-security product Benaloh helped to develop with the company’s Defending Democracy program.  He and I spoke in total for more than two hours that day, during which he explained to me the purpose of ElectionGuard and the basics of how it works.

ElectionGuard is not a voting machine itself, but a program that can be installed on other voting systems, to work in parallel with them. In brief, ElectionGuard will enable voting systems to print a receipt for each voter.  The voter will cast the ballot as usual and leave with the receipt, which contains a ballot-tracking code. Later, they can visit a website, enter the code, and get a message: “Your vote was counted!” In addition, because Microsoft is providing the tabulation software free to the public, it will allow others—most likely, candidates’ campaigns—independently to verify the vote totals if they can get the electronic ballot files from the local officials. 

Benaloh convinced me that ElectionGuard’s use of advanced encryption methods will make it impossible for anyone to alter the digital record of the votes without leaving obvious evidence, which voters will be able to detect when they enter their ballot-tracking codes.

What he did not convince me of, to his polite but visible frustration that day, was that ElectionGuard will secure our election results or build voter confidence. (See note #1, at the end of this post.) But that’s nothing Benaloh’s inventions or Microsoft’s products can do, any more than Flight 1549’s cockpit dials could have landed that plane safely in the river if Captain Sullenberger not been ready and able to take charge.


To understand the types of miscounts that ElectionGuard is designed to detect, we need to understand voting-machine systems’ programmable components.

For the Fulton demonstration, equipment was provided by VotingWorks, a young nonprofit, open-source election-equipment vendor based in San Francisco. Benaloh told me that ElectionGuard can be used with hand-marked paper ballot systems, but for the Fulton set-up, voters used touchscreens, rather than pen-and-ink, to indicate their selections. The system included three main components:

  • A ballot-marking device (BMD) is a computer that displays the races and candidates to each voter on a touchscreen monitor. As voters make their selections by touching the display, the BMD translates those touches into digital data, which is transferred to…
  • A printer that produces a paper ballot. The paper ballot used in the Fulton demonstration was of the type that prints votes two ways—once in encoded data (in this case, a QR code) that will be counted, and separately in human-readable text that will not. The voter takes the printed ballot and inserts it into…
  • A tabulator—which reads the votes encoded in the QR code, and records them in a digital file, along with all the other ballots it has read. At the end of the day, the tabulator will tally the votes for each candidate and print the totals on a poll tape. The tabulator might also transmit the vote totals to a central computer to be compiled with results from other polling places.

In normal use (though not in the Fulton demonstration), that whole set-up is managed through:

  • A central elections management computer, which in Wisconsin is operated by the county clerk. As the conduit for the software that is installed in the polling-place equipment, these central computers are the most attractive target for malicious interference. For example, if a malefactor bribed a technician to install remote-access capability on Milwaukee County’s election management computer at some time in the past, that malefactor could alter the software on any or all of the hundreds of pieces of voting equipment in that county.

What types of hacks is ElectionGuard designed to detect?

Malefactors have two high-level options: They can create chaos with obvious malfunctions, or they can alter results while trying to postpone or escape detection.

Chaos-seeking malefactors might do things such as prevent the equipment from powering up on Election Day; make the BMDs print ballots the tabulators cannot read; or make the tabulators produce nonsensical results on Election Night. When the malefactor has already made sure the problem will be obvious, ElectionGuard’s detection is not needed. Nor does ElectionGuard give managers any new options for responding to chaos.

But what if the malefactors try to postpone or even escape detection? In that case, ElectionGuard might or might not help. It depends on whether the malefactor hacked the BMD or the tabulator.  

Because ElectionGuard relies on the BMD’s digital interpretation of the votes, it cannot detect hacks that made the BMD misinterpret input (that is, the voters’ touches.) If the BMD misinterprets a touch on Alexander Hamilton’s name as a vote for Aaron Burr, ElectionGuard will, too. (Benaloh disagrees with this statement. See note #2.)

However, if the malefactor works with the tabulator rather than the BMD, ElectionGuard can enable detection.

When a voter inserts the paper ballot into the tabulator (with or without ElectionGuard), the tabulator interprets the votes recorded on that ballot; internally creates a digital record of each vote; and uses that record to tally results at the end of the day.

One of the ways a malefactor might intervene is this process is to make the tabulator look at the ballots with votes for Hamilton and record some of them, in its own memory, as votes for Burr. Then when the machine tallies the votes at the end of the day, Burr would be credited with some of Hamilton’s votes.

Without ElectionGuard, hand-counted audits are the only way to detect that problem. But when BMDs are equipped with ElectionGuard, each voter gets a separate, printed receipt with their ballot, as shown below. The ballot has a unique ballot ID number, and the receipt has a unique ballot tracking code, allowing ElectionGuard to match the two.

When the voters inserted their ballots into the tabulator, the tabulator worked as it normally would have without ElectionGuard, while ElectionGuard created a separate electronic record of the votes, in encrypted form, tagged with the unique tracking code.

Later, after Election Day, the voters are able to visit a website, enter their tracking code, and see a message. (Benaloh’s thoughts about who should host this website are in Note #3.) If the ElectionGuard record of that ballot matches the tabulator’s, the voter will see “Your vote was counted!”  (That is all it will tell them; it does not reveal even to the voter which candidate received the votes.) If the tabulator’s interpretation of the votes did not match the votes that ElectionGuard recorded, the voter would not receive the confirmation message.

And then what?

Well, that’s up to the election officials. Voters will start reporting problems the day following the election. Your guess is as good as mine about how many such reports each clerk will need before he or she stops assuming voter error and starts to question whether the equipment might be at fault. There is nothing in Wisconsin law or practice that requires clerks to take voters’ reports seriously.

Nor does anyone know what the clerks will do if they believe the voters’ reports of trouble—not even the clerks. Captain Sullenberger knew what to do when he realized his plane had lost its engines. But our election ‘pilots’ trust their voting equipment so completely that they fly without emergency procedures.

Another way a malefactor might intervene would be to allow the tabulator to record the individual votes correctly in its own memory, but cause it to produce incorrect vote totals at the end of the day. That is, if 60% of the ballots contained a vote for Hamilton, the tabulator would correctly record each individual vote in its memory, but at the end of the day produce vote totals showing 60% of the votes going to Burr. In that case, ElectionGuard would tell every individual voter “Your vote was counted!,” which is, I suppose, true-ish.

But ElectionGuard could reveal that problem in a different way, to anyone who looks for it. Its open-source code enables anyone with programming skills to create their own verification tool. So if campaigns or political parties can get the election’s digital ballot files from the election officials, they will be able to tabulate the votes themselves. Microsoft will provide, free of charge, the source code needed to write those tabulation programs, even while the votes remain encrypted.

Currently, no one in Wisconsin verifies computer-generated vote totals, so ElectionGuard would be an improvement.

But will independent tabulation using ElectionGuard ever save a miscounted election–even if it detects the problem? Probably not. At most, it will provoke expensive but futile lawsuits. The miscount won’t be corrected for at least two reasons, neither of which can be solved by Microsoft.

First, it is highly unlikely election officials will allow access to the ballot files until after the results have been officially and finally certified, at which point no corrections are legally possible. And because there is no chance that a re-tabulation would lead to a correction, campaigns will be unlikely to bother. Benaloh agrees: “There would be minimal value in using ElectionGuard in a situation in which the election record is not made public until after certification.”

Second, even if clerks do release the ballot files immediately following Election Day, unofficial audits have no standing. Citizens’ reports of miscounts are ignored. When such groups have documented miscounts in the past, officials did nothing; the press yawned; and the results were not corrected. Our election laws and our election officials do not recognize that voters have any standing to question the results.

If one of the candidates’ campaigns used ElectionGuard to detect a miscount, there might be more sound and fury than if citizens used it, but still no correction. Imagine, for example, that the Trump campaign had been able to use ElectionGuard in November 2020. If they had announced they’d found a miscount, officials would have issued statements saying that the campaign must have done it wrong. The Biden campaign would not have done their own re-tabulation; there is no reason why an Election-Night winner ever would. Instead, the Biden campaign, the officials, and the press would have insisted, correctly, that the Trump campaign’s only legal recourse was to demand a recount.

Unlike most candidates, Trump was able to force a partial recount, but that’s a rare situation. Recounts in Wisconsin are available only to second-place candidates who lose by less than a 1% margin, and even they must be able to pay the full estimated (and inflated) cost of the recount upfront in cash, unless they lost by less than 0.25%. Wisconsin Republicans will remember that, as close as the 2018 governor’s race was, and as widespread as concerns were about the City of Milwaukee’s atypical reporting, Scott Walker’s 1.1% loss margin prohibited him from even petitioning for a recount. ElectionGuard cannot change that.

In addition, a Wisconsin recount would be performed by running the ballots back through tabulators that have been ‘reprogrammed’ only to prevent them from printing out results for any but the recounted race. The tabulators’ second count would agree with the first and be accepted as confirmation, and the ElectionGuard results would be dismissed. When the buzzer sounds for the certification process, the victory will go to the malefactors.

So, sure, yeah. We can install ElectionGuard on America’s voting systems, and it will do no harm. When an election is hacked, it will be as helpful to voters as a set of cockpit dials on each seat back would have been for the passengers on Flight 1549: “Notice: This plane has lost all engine power.”

On that day, as with the Miracle on the Hudson, the only way to save the election will be for the professionals in the cockpit to take decisive, competent, manual control and bring the thing in for a safe, if atypical, landing.

Captain Sullenberger was prepared to do that. Our election clerks are not.

Fortunately, that is not the whole story. The Fulton demonstration did show how American election officials can make sure only correct winners are certified. It showed us what happens when those in control of the voting equipment really, truly, desperately, and sincerely want accurate election results. And that is the most important lesson of the Fulton demonstration.

When running a normal election (that is, when they are not demonstrating or testing new technology), officials need only to produce credible results. Notice I did not say accurate results. Fact is, they don’t normally have to prove accuracy to anyone, not even themselves.   

In that respect, the Fulton demonstration was a unique situation and uniquely instructive. Microsoft spent years and hundreds of thousands of dollars, drawing upon some of the best cyber-talent in the nation to develop ElectionGuard. For its first public demonstration, the organizers could not simply say “We believe the results are accurate because we trust the computers and you should, too.” In Fulton, they knew they had to prove accuracy. Otherwise, the whole thing would have been an embarrassing waste of time.

So they managed the polling place in a way that produced rock-solid results of unimpeachable accuracy. Such a thing is possible, and election officials know it.

That effort required only two easy safeguards—one that verified BMD performance, and one that verified the tabulator. Neither used any new technology.

I’ll let Microsoft tell you about the safeguard that checked the tabulator’s accuracy:

“One of the things we wanted to do was … to make sure that the voters would never have to question that the results were accurate. There would be a hand-count of the paper ballots at the end of the day as the officially certified result. It took the poll workers maybe only 15 minutes to actually count the votes. We compared all three results (the voting-machine poll tape, the ElectionGuard tabulation, and the hand count) and all three matched, which was exactly what we were going for.”

Yes, when Microsoft the Global Tech Giant knew it had to produce accurate election results—leaving no shadow of a doubt—they hand-counted paper ballots. Or, more precisely, they counted the votes using two different methods and compared the results to make sure they matched.

It took them only 15 extra minutes. In larger elections, officials would not need to count every vote to verify the correct winner: Election authorities have developed methods that allow officials to confirm the right winners by hand-counting only a small sample of ballots—much like an exit poll that looks at ballots instead of interviewing voters.

But what about the BMD? How did the Fulton demonstrators ensure that the computer-generated ballots were accurate records of the voters’ selections?  

Verifying ballots’ accuracy is not an issue when voters mark their own ballots with a pen. If no vote is recorded as the voter touches pen to paper, the voters notice and tell the poll workers that the pen is out of ink. And if a voter touched a pen to one oval and a different oval turned black, the voters would positively flip out.

But when voters make their selections by touching a display on a computer monitor, it’s possible that the printed ballot could be missing votes or contain votes printed for the wrong candidate. Auditors and recounters are helpless to detect misprinted ballots because they have no way to know what the actual selections were. Only the voter can notice if that happens.

But touchscreen-using voters don’t review their printed ballots naturally, as hand-marking voters do. They need to be instructed or they will not do it. For example, both the cities of Madison and Milwaukee make heavy use of BMDs, but neither city instructs voters to verify the ballots. During the November 2020 election in those cities, I observed around 200 voters at six polling places as they used BMDs in early voting. Not one verified their printed ballot. If misprogramming or malfunction caused those BMDs to print any incorrect votes, no one will ever know and the true votes are lost forever.

To ensure that all Fulton ballots were voter-verified, organizers set up a ‘verification station’ between the printer and the tabulator, where a poll worker intercepted every voter and reminded them to read their ballot and make sure it was correct. With only two races on the ballot, every one of the 398 voters was willing and able to do that. 

But even with 100% voter verification, the Fulton event showed how election officials might allow voters to use a hacked BMD all day in a Wisconsin polling place. Four of the Fulton voters—slightly over 1 percent—noticed and reported incorrect votes. In each case, the voter and poll worker immediately assumed it was voter error—with no effort to rule out machine malfunction. But was it? Probably, but no one will ever know for sure.

Managers with a passing level of quality-assurance expertise would not simply assume voter error, but would always be alert for misprinting BMDs. They would keep track of the number of voters reporting misprinted ballots; they would have decided ahead of time how many misprints would be considered indicative of a malfunctioning machine; and they would be prepared to take that BMD out of service.

But few real-world election officials are acquainted with real-world quality-assurance principles. Wherever BMDs are used in Wisconsin, the assumption is as it was in Fulton—to blame voter error for every noticed problem. If ever, say, 10% or more of the BMD-using voters at a polling place report misprinted ballots, election officials have no backup or recovery plans. Managers can choose to respond to signs of trouble; they can choose to respond in an improvised ineffective way, or they can choose to ignore them.

No technology, including ElectionGuard, can fix that. It’s not a problem with the technology; it’s a problem with the management practices.

A separate issue, which this blog has covered before, is the risky practice of encoding votes in a way that prevents voters from verifying them no matter how closely they study their ballots. ElectionGuard cannot help with that, either. That problem can be corrected only by redesigning the ballots so that the tabulators count the same recorded data that the voters verify, and vice-versa.

The tabulator will count the votes based on the information encoded in the QR code,
not the text the voter is able to verify. If an audit or recount using the votes recorded in the text produces different results than the results the tabulators produced using the votes recorded in the QR codes, and voter verification was not witnessed and documented by poll workers, no one has any way to tell whether the text or the QR code is correct.

We will not be able to secure election results until American voters and officials recognize that it is the officials’ responsibility—not Benaloh’s, not the vendors’, not the voters’, not the candidates’, not the lawyers’—to detect and correct any miscounts. 

But it will not be easy to get election officials to accept that responsibility. Whether from naivete or a willful desire to avoid buck-stops-here responsibility, election officials are happy to accept the vendors’ vision that technology can, all by itself, protect elections.

At the Fulton demonstration, I asked both the county clerk and the town clerk why they were willing to cooperate with Microsoft in demonstrating ElectionGuard. What did they see as its potential benefits?  

Like election officials everywhere, neither attempted to hide her faith that the voting equipment will always produce accurate results—they will make it clear that they consider such faith a virtue. As a result, they are uninterested in solutions that allow them to detect and correct electronic miscounts because, in their eyes, those miscounts cannot happen.

Instead, their answers focused on two other things: First, encouraging voters to trust the computers as unwarily as they do, and second, reducing their workload. County Clerk Lisa Tollefson told me her reason for hosting the demonstration was that she is “always interested in changes that might make the clerk’s job easier.” Not the answer you’d get from County Clerk Sullenberger.

What about voter confidence? For better or worse, security and voter confidence are separable. True security does not always create voter confidence, and voters can be confident even when security is weak. Both are necessary for well-run elections.

ElectionGuard might increase confidence among those voters who say: “Just give me a receipt for my ballot, and I will believe the election is secure.” They are likely to find it fun to visit a website, plug in a personal ballot-tracking code, and receive the confirmation message “Your vote was counted.”

But the voters’ confidence might fall back to baseline when they realize that ElectionGuard won’t confirm for whom the vote was counted. The stated reason for that is to prevent coercion and the buying and selling of votes, quaint considerations in an age of growing reliance on absentee ballots. (Benaloh shared some good thoughts on ballot privacy – see Note 4.)

Technicians like Benaloh who understand why ElectionGuard is trustworthy will believe the confirmation message is reliable, but they are not the ones for whom such reassurance is intended.  Everyone else will be in the same boat they are in now, having to trust the technology and the programmers. My guess is that once ElectionGuard’s novelty wears off, we will be right back where we are now, with skeptical voters being skeptical and trusting voters trusting.


When America finally decides that it really, truly does want secure elections–not just the appearance of security, not just voter confidence–we will stop piling technology upon technology and will instead make sure that that the humans in the election cockpit are responsible and accountable. This is what we will do:  

  • On Election Day, every voter who can use a pen will create a reliable record of their selections by hand-marking a paper ballot.
  • Those ballots will be quickly counted by computers and preliminary results released as soon as possible, just as they are now.  
  • Promptly following Election Day, the officials will conduct outcome-verifying audits by hand-counting enough of a sample to confirm that the voting machines identified the correct winners. They will be prepared to move quickly to full hand counts in the unlikely event the audit finds the machines were wrong. Only when the computers and the hand counts agree on the correct winners will final election results be certified.

With that simple system—for which our election officials already have all the technology they need—any would-be malefactor will need two entirely different sets of means and opportunity to mess with the results—one to hack the voting machines and the other to manipulate the hand-counted audits. That will deter 99.9% of any manipulation and will detect and correct the rest before the wrong person is sworn into office.

(I’ll give Benaloh the last words; see note #5.)


Notes

#1 – Josh Benaloh graciously and carefully reviewed three drafts (3!) of this blog post, and provided detailed, constructive feedback. I am very grateful. Of course, any remaining errors are mine. There are a few areas where I did not make changes in response to his comments, either because we disagree or because his valid comment didn’t fit into the flow of the argument I wanted to make. These comments provide the basis for the following notes.

#2 – Benaloh wrote: “It is not the case that ElectionGuard ‘cannot detect hacks that made the BMD misinterpret input (that is, the voters’ touches).’ In Fulton, human-readable ballots were produced.  Any recording or counting of ballots that was inconstant with this human-readable ballot was detectable.  I do not disagree that, in the Fulton instantiation, a voter may fail to notice a misinterpretation that results in a printed ballot that does not match the voter’s selections, and I fully agree that this is a legitimate concern.  However, I think that there is an important distinction between “undetected” and “undetectable ” – especially in this context.”

#3 – Regarding the hosting of the website that voters would visit to use their verification codes, Benaloh wrote: “I see minimal value in an individual voter going to an official election website to confirm a verification code.  Instead, I would envision third parties such as political parties, media, and watchdogs hosting copies of the election record against which voters could query.  There is far more value to me in having my preferred candidate or media outlet confirm that my vote is correctly included in the tally than for me to receive that assertion from an election official whom I may not trust.  Of course, if I trust no one, I can confirm the entire record – including my vote – entirely on my own.  In the small Fulton pilot, we had no leverage to encourage independent entities to establish such services; so the only verifier available was the one hosted by the town.”

#4 – Benaloh wrote: “I see not revealing individual vote contents as far more than a ‘quaint‘ notion.  Secret ballots were not introduced in the U.S. until the late nineteenth century, and before that time elections were rife with vote selling and coercion.  It would be easy to provide verifiability if we were not concerned about ballot privacy.  We could just post verification codes and voter selections without bothering with any encryption.  Although it is very difficult to quantify, I’ve seen numerous anecdotes of coercion (especially spousal coercion) associated with routine vote-by-mail and absentee voting.  Of course, voting without the benefit of a poll is preferable to not voting at all; but I believe that the protections offered by in person voting are critical to election integrity.  Just as you see audited HMPBs as your gold standard, I view verifiable in-person voting as mine.”

#5 – Benaloh wrote: “I agree wholeheartedly with your general thesis – that ultimate control and responsibility should be in the hands of people.  ElectionGuard is not intended as a solution but rather as a tool that can be used by election officials and the public to help achieve accurate outcomes.  To push on your Sullenberger analogy, when his engines failed he was not devoid of technology and left entirely to his own devices; instead, he was able to exploit other technologies to help him bring his plane a safe landing.  A human was, and should be, in ultimate control; but the availability of tools and technologies helped the human in control to overcome adversity.  I regard ElectionGuard as nothing more than a tool that can – depending upon the people who use it – be an effective aid or a superfluous nuisance.
“As such, I would posit that your ideal election design – HMPBs followed by a rigorous human audit – is only enhanced by the inclusion of ElectionGuard.  This is not just a pointless inclusion in a process that is already as strong as possible.  We have a crisis of confidence in U.S. elections today.  We have millions of voters who do not believe election results.  They do not believe their election officials (e.g.., Brad Raffensperger) and they do not trust their equipment vendors (e.g., Dominion and Smartmatic).  As such, they will not trust the results produced by your ideal scenario.
“While I share few of the views of these detractors, I am somewhat sympathetic to the reason for their suspicion.  From their perspectives, they gave their ballots to people they don’t trust who used equipment they don’t trust to produce results they don’t trust.  If ElectionGuard had been included with the systems they used to vote, they would have had means to confirm the accurate counting of their votes – despite their lack of trust in the people and systems (potentially including a lack of trust in the ElectionGuard component).  I’m old enough to remember Reagan’s overused “trust but verify” admonitions.  With ElectionGuard, voters can verify without trust.  Without it, voters who do not trust their officials and equipment are left with nothing.”

If votes are misprinted on the ballots, election officials don’t want to know

In brief: During the past nine years as I’ve advocated for better security for voting machines and the vote-tabulation process, I’ve observed a reflexive resistance by election officials to any suggestions for improvement. On matters relating to the voter-registration system, where federal pressure has been greater, they are reasonable. But when it comes to counting votes, they listen only to each other and to voting-machine vendors, and ignore authorities and cybersecurity experts. They seem particularly deaf to any suggestions from voters regarding security safeguards.

I’m testing that observation now, with a safeguard that is, undeniably, a no-brainer. The City of Madison currently puts thousands of early voters’ ballots at risk by neglecting a safeguard that is effective, easy, not controversial, very low cost, has no substitute, and is unanimously recommended by authorities. Madison could largely implement this safeguard with one memo to its poll workers. Will Madison even consider it? Will WEC even consider ordering it? I don’t know yet. This blog post explains the issue and my effort so far. I’ll update it as events unfold.


BMDs (ballot-marking devices) are computers that mark ballots for voters who cannot, or who are not allowed to, mark their ballots with pens.

Using computers to mark the ballots necessarily introduces some risks: Computers can be misprogrammed, and printers can malfunction. So there is always a possibility that votes might be omitted from the printed ballots; the wrong votes recorded; and that ballots could be misprinted in a way that makes the votes illegible to the computers that will count them (the ‘tabulators’).

There is a simple, cheap safeguard: Before each ballot is cast, review it to make sure it was printed correctly. That’s called ‘verification.’ Only the voter can verify because no one else knows what votes were supposed to be printed.

However, voters don’t verify unless they are instructed to do so. And in some cases (when the votes are printed in barcodes), voters need access to a barcode reader, and need to be told how to use it. It sounds complicated, but typically takes less than a minute.

It’s obviously careless to let computers print thousands of votes with no one checking to make sure they are printing them correctly. So I’m sure you won’t be surprised when I tell you that every professional election authority, plus the voting-machine manufacturers themselves, recommend routine voter verification.

But that’s not what Wisconsin does.

(Note: In an earlier post, this blog inventoried the pros and cons of general use of BMDs. This post will focus only on their management once a city has decided to put them into general use, not the overall wisdom of doing away with hand-marked ballots.)

WHY DO WE NEED VOTER VERIFICATION?

The problems we need to watch out for are:

  • votes that aren’t recorded at all;
  • votes that are recorded for the wrong candidate; and
  • votes that are recorded in ways the tabulator cannot understand.

When voters use pens, these problems either don’t exist or are easily corrected. When a pen fails to record a vote, the voter tells the poll worker “This pen is out of ink,” and the problem is fixed before it ruins any ballots. If when a voter touched their pen to one oval, a different oval turned black, that would be magic, not malfunction, and we don’t need to worry about it.

Voters using pens sometimes record votes the tabulators cannot read, for example by circling the candidate’s name instead of filling in the oval. But that problem cannot systemically ruin hundreds of ballots. In fact, only a tiny fraction of ballots are mismarked so badly modern tabulators cannot read them. In addition, the voter’s selection is usually obvious to a human recounter or auditor, and so not a problem even in close contests.

But when voters select their votes from a touchscreen and a computer prints the paper ballot, voters must make an extra effort to notice any problems while they still have an opportunity to fix them.

Wisconsin’s early voters, in particular, need to make this effort because they will not be present to mark a new ballot if their ballot is rejected by the tabulator. And because early ballots are not cast for days or even weeks after they are printed, misprinting BMDs could ruin thousands of ballots before the problem is noticed unless the early voters verify.

When only a small percentage of ballots are printed by BMDs, problems are less likely. BMDs used by only a few voters are not an attractive target for hackers. But heavily used BMDs are at greater risk of both hacking and malfunction, and voter verification becomes essential. If no one notices when a heavily-used BMD starts misprinting ballots, an election could be seriously disrupted or even ruined.

Therefore, when a city replaces its ballot-marking pens with ballot-marking computers for large numbers of its voters, it needs to add the step of voter verification to its polling-place procedures.

HOW IS VOTER VERIFICATION DONE?

When security-minded election officials use BMDs, they set up a ‘verification station’ near the BMD. As the voters carry their ballots from the printer to the table or machine where they will submit them, a poll worker invites each voter to pause, read the ballot, and tell the poll worker if it accurately recorded their selections.

Some BMDs print ballots on which the votes are encoded so that the voters cannot read them. (See an example below.) When votes are encoded, the verification station must be equipped with a reader, so that the ballot can be quickly inserted and the encoded votes displayed to the voter. (Yes, everyone knows the voter will still be unable to verify that what the barcode reader is telling them is truly what the barcodes say. But using the reader might catch at least printer flaws that could make the encoded votes unreadable. It’s better than no verification at all.)

Polling places with these procedures can successfully get most, or even all, of the voters to review their BMD ballots.

If at the end of their shift, the poll worker then signs an affidavit that they observed the voters verifying the ballots, the computer-generated ballots can be accepted as reliable evidence of the voters’ selections in even the most professionally conducted audits and recounts.

WHAT DO MADISON AND MILWAUKEE DO?

In November 2020, election-security advocates around the nation were worried about Wisconsin. Mark Shipley, an activist from California, came to Wisconsin shortly before the election to help out with any election-security efforts that voters might be doing here.

As early voting started, I told him what I’d been told: that Madison and Milwaukee normally use a barcoding BMD, the ExpressVote, in early voting but were not going to use it in November’s election because of pandemic worries related to touchscreens.

But after one day of observing in Milwaukee, he told me I was wrong. Not only were all the early voters using the barcoding BMDs, not a one had verified their ballot. I quickly called Madison and found they were using the BMDs, too.

So Mark and I met in Milwaukee to observe at two more polling places. It was as he’d reported. We spoke with the person in charge at each location. Not only were the poll workers failing to instruct voters about verification, no one had instructed the poll workers themselves about either the ballots or verification.

The next day, I observed at four polling places in Madison, and saw even worse. In some locations, poll workers were standing beside the BMD, pulling the ballot out of the printer before the voter could, and folding it before handing it to the voter, in a way that assertively prevented the voter from seeing their own ballot.


This is a sample ballot from a Georgia election, generated by the type of machine used in Madison and Milwaukee early voting. When the tabulator counts this ballot, it will look at only the barcodes, where (we hope) votes that match those printed as text are encoded. Notice that one of these barcodes is flawed, and may or may not be readable by the tabulator. The voter will be able to detect this by inserting the ballot into a barcode reader before submitting it.
Also, as an exercise in understanding the challenges of this type of BMD ballot, do you think you would be able to verify each of the last eleven votes if this was your ballot? What were Constitutional Amendments 3 and 4, anyway? Does this ballot record a ‘no selection made’ for the right one?

In Madison, I was able to chat with more poll workers, including those in charge, during lulls in the action. All told me the same thing: They had never been instructed about the need for voter verification and they did not know what the barcodes were for. A few didn’t even know there were barcodes on the ballots. None knew how a voter could check to make sure the barcodes were readable, so if a voter had asked, they wouldn’t have been able to answer. (The ExpressVote has a built-in barcode reader; the voter just re-inserts the printed ballot.)

I saw a few voters who glanced at their ballots before folding them and as they left, I asked what they had been looking for. They told me they were looking to make sure it was the ballot, and for ‘fold here’ instructions. None had checked whether all their votes had been recorded or whether any had been recorded incorrectly.

Failing to tell BMD-using voters about verification is a violation of even elementary safeguards when using the machines. When I described what I’d witnessed to a national Zoom conference shortly after the election, I could see the other participants’ jaws drop. Outside Wisconsin, officials understand the need for voter verification.

SO WHAT’S TO BE DONE?

Mark and I compared notes over the next few days, and I filed a formal complaint with the Wisconsin Elections Commission. Only I signed the complaint because Mark lives in California. The complaint focuses only on Madison’s practices, for two reasons:

  • Our notes were more detailed from the second day of our observation and therefore, in my opinion, a better foundation for a formal complaint, and
  • I had corresponded with Madison election officials several times in the past few years regarding their use of BMDs, but had never written to Milwaukee. Therefore, I knew Madison officials were knowingly ignoring the dangers because I myself had informed them. In contrast, I realized Milwaukee officials might still be naive, and a formal complaint didn’t seem to me to be the right way to start to educate them.

I didn’t want to file the complaint so close to Election Day, knowing the problem couldn’t be fixed in time to protect any of the early ballots and that the officials were busy. But I went ahead and filed it promptly anyway, because I hate it when people wait until after they know who won to complain about election practices. So, apparently, do the courts.

My complaint requested that in future elections Madison implement these common-sense and expert-recommended safeguards:

  • Give voters the option of hand-marking their own paper ballots, which could most easily be done by purchasing a blank-ballot printer for each early voting location. These machines can print ballots appropriate for any ward in the city, but allow the voters to record their own votes, AND
  • For those voters who choose to use the BMD, have poll workers inform them about the barcodes, instruct them to read the human-readable text after their ballot is printed to make sure it’s correct, and encourage each voter to use the barcode reader to verify as much as they can.

The City’s response was written by City Attorney Michael Haas (formerly administrator at the WEC) on behalf of City Clerk Maribeth Witzel-Behl. They did not deny anything we had observed, and did not offer any reason why they believe it’s a good practice to keep poll workers and voters in the dark about verification and barcodes.

Instead, the response can be summarized: “You’re right. We don’t train our poll workers about the ExpressVote ballots or to answer questions about them. The State approved the ExpressVote for use in Wisconsin, so we can use it any way we want. We do other safeguards that statutes require of us, but because the State doesn’t explicitly require us to enable voter verification, we don’t.”

The next step for me was to submit my comment on Madison’s response, which I did. I addressed my remarks to the Commissioners because I’ve heard them have a sensible discussion about the issue, while the Madison officials don’t seem to understand either the problem or the solution. For example, they seem to believe that telling voters about a barcode reader supplied by the manufacturer specifically for the voters’ use requires “in-depth familiarity with the inner workings of the equipment.”

I’m not sure what’s next. I haven’t been notified of any specific timeline for resolution. But there’s no urgency. The next election is about a month away (February 16), and Madison could mostly correct the problem with a memo to its poll workers. The memo would tell them about the barcodes and tell them to instruct each BMD-using voter to read the human-readable votes printed on their ballot and to re-insert the ballot so that the machine can confirm the barcodes are readable. Other steps, such as giving voters the option of hand-marked paper ballots, will take longer.

I don’t know if the whole Commission will discuss the issue in an open meeting, or when that would be scheduled if they did. I’ve never seen them discuss complaints in open meetings. I haven’t received an invitation yet, or any indication they will invite me, the complainant, to come talk to them (not that I expect one — speaking directly with the voters is not their style).

Milwaukee and Madison voters: It will help if you contact your city election clerks and tell them you want them, at a minimum, to educate their poll workers and voters about the barcoding BMDs and to introduce polling-place procedures that enable BMD-using voters to verify their ballots. Madison: 608-266-4601; Milwaukee: 414-286-3491.

Voters who live in other cities should call their municipal clerk to ask about local use of BMDs (the two most common are called ‘ExpressVote’ and “ImageCast Evolution”, or ICE) and about whether or how they instruct voters to verify their computer-generated ballots.

If any Wisconsin voters want to organize any stronger actions, I can consult with you. Email me at kmk@wisconsinelectionintegrity.org.

Will your absentee ballot be counted? The risk depends on where you live.

Summary: Even absentee ballots that arrive on time can legally be rejected and not counted. In the April election, Wisconsin officials reported they rejected 1.8% of the ballots they received on time. Officials blame voter error (most commonly, missing signatures). Voting-rights advocates are trying to reduce the problem with voter education.
However, rejection rates varied widely among municipalities in a way that indicates local administrative practices play a big role in determining each ballot’s risk of rejection that is, absentee voters in some municipalities face a much greater risk of disenfranchisement than voters in others.
This post explains some of the reasons why rejection rates vary and what could be done to make them more consistent in November and in future elections. It argues that we MUST start paying attention to administrative practices and stop placing the blame wholly on voters. It argues that the easy, critical starting point is for the Wisconsin Elections Commission to routinely calculate local rejection rates following each election.

* * *

I’ve been studying absentee-ballot processing in Wisconsin and in other states for several months now and our state’s increasing reliance on it scares me to my bones.

Here’s why: Absentee voting is necessary for a few voters, but any ballot submitted in an envelope faces a gauntlet of risks that don’t endanger ballots that are marked and cast at the polling place. It is unavoidable. While polling-place ballots go directly from the voter’s hand into the tabulator, absentee ballots are not cast until days or even weeks after they leave the voter’s hand. During that time, those ballots face multiple risks. It is inevitable that some will never be counted.

But how many? And whose?

Voters who are very careful and diligent can reduce some of these risks, but that doesn’t help the rest of the voters. Other threats are beyond any voter’s control.

If someone was taking bets now, I’d put my money on something a little north of a 3% loss rate (from all causes) for absentee votes in Wisconsin next November. That is, for every 100 early or absentee ballots marked, the votes on 3 of them will never be counted. Three percent might seem insignificant to some (not you, I hope), but if 80% of Wisconsin’s voters submit absentee ballots in November as expected, tens of thousands of votes will be lost.

That sort of shrinkage could alter the outcome if the electorate is fairly evenly divided; if the voters for the more popular candidate lose 3% of their votes by putting their ballots in envelopes; and if the voters for the less popular candidate lose none of theirs, by going to the polls and putting their ballots directly into the tabulator with their own hands. That’s the situation shaping up in Wisconsin as I write this. I can give myself nightmares if I let myself imagine the chaos and recriminations that will ensue if uncounted absentee ballots determine who gets Wisconsin’s electoral votes.

What are the risks for absentee ballots? They start the moment an unmarked ballot arrives in a voter’s home. Some absentee ballots get lost in the home before they’re even marked; some get misplaced or misdirected in transit or after they arrive at the elections office; some arrive too late; and yes, some could be lost to undetected fraud. No matter how badly we wish otherwise, fraud is a risk whenever marked ballots leave the voters’ hands long before they are counted. My Illinois friends have conniption fits when they learn Wisconsin has no measures in place that could detect the problem if a municipal clerk was to go in after hours, remove some ballot envelopes submitted by voters, and replace them with ballot envelopes containing ballots he or she had prepared. (Illinois poll workers compare the signatures on the ballot envelopes with on-file signatures just before they cast the ballots, which deters substitution.) Wisconsin voters, however, are proud of their capacity for trust, and they are not going to listen to the Illinois voters’ worries about insider fraud. So there’s no point in me talking any more about fraud.

Instead, this blog post will focus on only one risk: legal rejection of on-time absentee ballots. Based on my study of 14 municipalities, I estimate that this one problem alone will disenfranchise more than 40,000 Wisconsin voters in November if absentee voting reaches 80%. My estimate is based on 3 million ballots cast, 80% of them absentee, and a 1.7% rejection rate for those ballots — the April rejection rate I found in those 14 municipalities (8 larger cities and 6 smaller ones). (Note: the official figure is 1.8%, but I’ll use my sample just to be consistent.)

Legal rejection of on-time ballots could disenfranchise more than 40,000 Wisconsin absentee voters in November —- 1 in every 59.

Voters might be surprised to learn that so many absentee ballots are rejected, but election officials already know. The Wisconsin Elections Commission has the data and calculated the statewide rejection rate. What the Commission hasn’t done — and does not intend to do, at this writing —– is to calculate the individual municipalities’ rejection rates.

As a result, Commissioners will be as surprised as anyone to learn that individual municipalities reject ballots at rates ranging from 0% (that is, none) to at least 3.7% (that’s 1 in every 27 on-time absentee ballots!). The true top end of that range is higher unless the strictest municipality in the state luckily made it into my small sample.

In addition, Commissioners will be surprised to learn that even within a single city, rates can vary dramatically among the wards. An individual ward can have a rejection rate three times larger than that of other wards— and again, the range is probably even bigger unless I fortuitously picked the worst city in the state for my sample.

Madison rejects 1 in every 126 on-time absentee ballots. The City of Racine rejects 1 in every 27.

From my reading of studies done in other states, I knew that variable local rejection rates are a recognized problem. So when I noticed that a grant application from five of Wisconsin’s largest cities contained raw data on rejection rates (not percentages), I calculated their rates. I was shocked to discover that an on-time absentee ballot in Racine was 4.7 times more likely to be rejected than an absentee ballot in Madison!

I assumed the Wisconsin Elections Commission would be similarly concerned. I called and asked for the rejection rates for all 1,850 municipalities. I learned the WEC has the data to calculate the rejection rates, but has not done that and has no plans to do it.

So I requested the data files. Volunteers with Wisconsin Election Integrity could do the definitive statewide analysis ourselves. WEC’s response: “Hand over $24,000 and the data are yours.”

So … what you are reading right now is an analysis done at my kitchen counter with data I collected directly from only 14 municipalities by email and phone. That’s the best monitoring of Wisconsin’s absentee-ballot rejection rates you can find on this planet. None better.

That is not how it should be. Without knowing comparative rejection rates among Wisconsin’s municipalities, even the local officials cannot know which municipalities are out of line, and no one can identify realistic targets for improvement.

So if anyone from the Wisconsin Elections Commission wants to argue with my observations or estimates, I challenge them — no, I beg them — to do their own calculations of municipal and ward-by-ward rejection rates and release the results.

If the Wisconsin Elections Commission has any question or problem with the information in this blog post, they should DO THEIR OWN analysis and release the results. Prove me wrong; you have the data.

For readers who believe Wisconsin elections deserve better: The Wisconsin Election Commissioners can be reached at elections@wi.gov. Put “Message for the Commissioners” in the subject line, and tell them you think their staff should be monitoring local rejection rates more diligently than an old lady in Waunakee.

Anyway, here’s what I found out …

* * *

How and why are on-time absentee ballots rejected? Talk to any election official and you will be told voter error is the sole cause of all legal rejections. But the extreme variation in local rejection rates within even my small sample indicates that administrative practices play a big role in deciding which absentee ballots are counted, and which rejected. City of Spooner voters are simply not 8.5 times more intelligent or more careful than voters in the City of Green Bay. Something else is going on that causes Green Bay’s ballots to be rejected at more than eight times the rate of Spooner’s.

City of Spooner voters are not 8.5 times more intelligent or careful than Green Bay voters. Something else is causing Green Bay’s ballots to be rejected at more than eight times the rate of Spooner’s.

After absentee ballots arrive at the local election offices, clerks are required to review each to make sure it fulfills the requirements for a count-able ballot. First, of course, the name and address must be that of a registered voter. Some requirements are unambiguous, including those that cause most rejections: Both the voter and a witness must have signed the envelope and provided their addresses. When that information is missing, the ballot can be rejected.

But even unambiguous requirements can be applied either strictly or leniently. For example, the witness might have written their address in the wrong spot, or smeared the ink. Some municipalities, some reviewers, might reject those ballots; others might accept them.

And a high rate of voter errors cannot be blamed entirely on the voters: the root cause of poor voter compliance can be administrative. Municipalities are free to design their own ballot envelopes, as long as they contain the required elements. They are free to write their own instructions. They can pre-print more or less of the required information on the envelope. Good forms design and instructions minimize voter error; bad design and instructions encourage it. More pre-printed information fosters fewer voter errors. If I was doing a serious study of the causes of rejection-rate variation, this is where I’d look first.

Inconsistent interpretation of more subjective requirements could be another cause. Here’s an example where you can be the judge: Officials are to reject envelopes that show signs of tampering. Consider an envelope that’s been unsealed and then taped shut. Would you accept it, assuming the voter sealed the envelope before inserting the ballot, realized the mistake, and fixed it? Or would you reject it on the grounds that the envelope shows signs of tampering? Clerks and election workers are sure to will make both decisions while reviewing ballots in November.

Other things are completely outside the voters’ control. If the ballot envelope was damaged in transit in a way that could be interpreted as a sign of tampering, it can be rejected. If the glue fails and the envelope comes open, it will usually be rejected. (But before you double-seal your ballot with tape, remember tape can be interpreted as a sign of tampering.)

Clerks’ errors can also invalidate an absentee ballot. Those who observed during the 2016 Presidential recount know that absentee ballots can be rejected if the clerk neglected to write his or her initials on the envelope, but often are not. Savvy voters know to double-check for the clerks’ initials before they submit an absentee ballot, but most voters are unaware of that risk.

The next step is deciding whether, when, and how to contact the voter if a ballot is reject-able. If the voter fixes the problem before polls close, the ballot is called ‘cured’ and the votes are counted. I did not find any clerk who keeps a record of how many ballots were cured, so we do not know how many absentee voters are merely inconvenienced, rather than disenfranchised, by absentee-ballot problems.

Contrary to popular assumption, Wisconsin clerks are not required to contact the voter when they determine a ballot is flawed. Clerks sometimes just reject the ballot without telling the voter. Other times they just fix it. For example, if the witness address is missing but the signature is legible, some clerks will look up the witness’s address on other city records and fill it in without notifying the voter. I suspect it’s practices like these that explain much of the very low rejection rate in rural communities. My sample included six municipalities with populations around 2,500, four of which rejected no absentee ballots. The other two both had rejection rates under 0.6% (1 in every 167 ballots). In contrast, the bigger cities in my sample rejected 1.7% of their on-time absentee ballots (1 in every 59).

Most clerks, however, try to contact most voters who submit reject-able ballots. Again, municipal clerks have several choices:

  • Putting the reject-able ballot in an envelope and mailing it back to the voter, with instructions to correct the problem and resubmit it;
  • Sending the voter a letter telling them of the problem and inviting them to come in to the office or go to the polls on Election Day to correct the problem;
  • Invalidating the ballot and sending the voter a replacement;
  • Looking up the voter’s phone number or email on the voter-registration record (not always there), and telling the voter about the options for curing the ballot; and
  • Making only one or several attempts to contact the voter.

You can see how these practices would have different effects on the ultimate rejection rate. They offer the voters more or less time to fix the problem, and they place more or less additional workload on the voter — and one municipality will do it differently than another.

By now, I hope you’re starting to see not just how ballots in different cities face different levels of risk, but how ballots within one city could easily be treated differently, depending on the voter. Studies in other states consistently find higher rejection rates for low-income, young, old, and minority absentee voters. Election workers don’t have to make deliberately biased decisions. If they are normal humans with a normal amount of implicit bias, they have to deliberately try not to.

Janesville Municipal Clerk Dave Godek helped me understand that the problem might not be just that low-income, minority, and younger voters make more mistakes, or that election workers are biased against ballots that come from the ‘wrong’ neighborhoods. He explained that his city’s Ward 3 (7% rejection rate, or 1 in every 14 ballots) is a younger, poorer neighborhood where voters may not have the time to cure their ballots even when notified of problems. In contrast, Ward 15 voters (2.31% rejection rate) are older and more affluent, and more likely to be able to make the additional effort to cure their ballots when notified of a problem.

Another variation is how often and when the clerks perform the reviews. All the clerks I spoke with said they try to review every ballot on the day it arrives. However, if others delay review until Election Day, voters will not be able to cure their ballots.

In addition, every clerk said that even if the ballot passes its first review, it will be reviewed again later, such as when the ballots are sorted by precinct or alphabetized, and might be rejected then. If the poll worker who is opening the envelopes on Election Day notices a problem, the ballot will be rejected then.

Finally, when we allow variation to go unmonitored, we create circumstances that allow for partisan advantage. Consider this: The City of Milwaukee reliably contributes a large proportion of the state’s Democratic votes, and Wisconsin’s Republican Party is reliably front-and-center promoting strict enforcement of voting requirements. If the Republican Party does nothing more than send observers to monitor the actions of Milwaukee’s election workers to make sure that every reject-able ballot is rejected, while no one makes any similar effort in the Republican suburbs, it is likely that the same ballot will receive harsher scrutiny if it is submitted by a city voter than by a suburban voter.   

***

A functioning democracy cannot tolerate rejection rates as high or as varied as these. And the variation is almost certainly more extreme than I could observe. The likelihood that my sample (only 14 out of 1,850 municipalities) captured the most extreme examples is practically nil.

So what can be done? The problem cannot be solved by telling WEC to issue guidance in absentee-ballot review practices. They already do that. If municipal clerks reliably followed their guidance, rejection rates would not show the variation they do. The fact is that we can never expect all municipalities to honor any guidance that WEC is unable to enforce.

What we need is transparency.

1) The Wisconsin Elections Commission needs to crunch its data. Given what I know of the work ethic of most local election officials, the WEC needs only to give them accurate metrics about their performance, and most local clerks will seek to improve it. So even if the Commission does nothing more than calculate rejection rates by municipality and ward, they will help our municipal clerks to manage those rates.

After each election, the WEC should routinely provide municipalities with metrics about local rejection rates around the state. Our clerks need to know whether their own performance is normal or extreme.

2) If the Commission will not do this, the state Democratic Party should purchase the data; do the analysis themselves; and intervene before November with the municipal clerks who had the highest rejection rates in August. Considering their vigorous promotion of early and absentee voting, I believe it’s the Democrats’ moral obligation to take steps to protect the ballots of the voters they’ve convinced to forego the option of going to the polls. And given what that party is spending to get out the vote, $24,000 is a small price tag to protect the votes that they get out.

3) In addition, voting-rights groups and civic organizations must realize the problem cannot be solved with voter education alone. They should be in the lead on this issue, working to ensure that WEC provides municipal clerks with the management information, and that individual voters can know their local situation in order to make an informed choice about whether to vote absentee or at the polls.

4) Finally, individual voters can contact their municipal clerks — soon! — and ask about August’s local rejection rate for on-time absentee ballots. If the clerk does not know or cannot produce the data, the voter should recognize a trouble sign of inattentive management and assume the rate is high. If the clerk can provide the information, and the rate is over 1.7%, the voter should inform the clerk that the local rate is above the statewide average. This will likely be news to the clerk. Voters should then discuss with the clerk what will be done to bring the rejection rate into line with the average.

If you try this and do not get a cooperative response from your municipal clerk, go to your municipality’s executive, the governing body, or the newspaper. Votes are at stake here, and if on November 4, Wisconsin sees a upset victory margin that was less than the number of rejected absentee ballots, you do not want to know you sat on your hands in September.

And again: The Wisconsin Elections Commissioners do not now realize that extreme variation in local rejection rates exists, because their staff have never calculated those rates. The Commission has the data; they could analyze it. Their email address is elections@wi.gov; put “Message for the Commissioners” in the subject line.

Sitting here at my kitchen counter in Waunakee, I cannot develop any better recommendations than those. I do know this: To protect future elections, WEC’s monitoring of local absentee-ballot rejection rates must become routine. When WEC makes the information public, people and groups who have more influence and insider connections than I do must examine local absentee-ballot processing practices; objectively identify the causes of high, localized rejection rates; and develop corrective measures.

All you need to know about hand-marked paper ballots vs. computer-marked ballots

Short summary: Computer devices that enable voters with disabilities to mark paper ballots are indispensable–for those voters. BMD use by all voters puts everyone’s votes and entire elections at risk. Here’s why.

For the next few paragraphs, imagine yourself to be a municipal elections clerk–a particularly conscientious one who understands that “trust” is one thing a manager cannot do with computers. You know the cybersecurity mantra: Protect; detect; correct. After you do everything you can to protect the system, you routinely audit its business-day performance so that you can quickly correct any fraud or malfunctions that got through despite your efforts.

You are responsible for two pieces of computerized election equipment in each polling place. The first is a tabulator that reads paper ballots and counts votes. You have little problem verifying the tabulator’s Election-Day accuracy. You do a quick audit, and if that reveals a possibility that the wrong winner was identified on Election Night, you will do a full hand count to correct that error before you declare the election results final.

The second is a machine that was developed for voters who cannot hand-mark their ballots, called a ballot-marking device, or BMD. With a BMD, a voter can touch a screen, speak, or puff a tube to indicate their choices, and the computer prints a ballot for them.

Most BMD users cast the printed ballots without reading them. This bothers you because if they don’t, you have no way to verify the machines’ accuracy. For you, the paper ballot is evidence only of what the computer printed, not what the voter touched on the computer monitor.

You cannot watch over voters’ shoulders while they vote. You could ask poll workers to stand between the BMDs and the tabulator to remind each voter to read the printed ballots carefully and tell you if anything is wrong. But even if the voters look at their ballots, you don’t know whether they are actually reading them or just pretending to while thinking “I came here to vote and leave, not to get nagged. I just want to get home to supper.”

You cannot abolish the BMDs. If you do, voters who need them will have to ask a trusted friend to mark their ballots. Besides, federal law requires them.

So there’s only one thing you can do to protect your city’s election results: Get as many voters as possible to mark their paper ballots with a pen. Then, even if the machines are hacked, it won’t ruin enough ballots to change the outcome.

End of fantasy. You can stop imagining you’re a clerk now. You were not very typical anyway. In the real world, most clerks don’t worry much about computer security, and nowhere is this more obvious than in their growing love affair with BMDs.

Why is anyone pushing these machines on all voters?

At the manufacturers’ urging, election officials nationwide are purchasing more of these machines and urging–or even forcing– all voters to use them. It’s obvious why vendors are pushing $5,000 machines that come with annual service contracts to replace twenty-cent pens. But why are election officials buying?

In other states, election-security advocates suspect vendors are making campaign contributions or appointing clerks to corporate “advisory committees” that meet in Florida or Vegas. I don’t suspect that in Wisconsin. Here, local officials make the purchasing decisions, and vendors don’t need to spend any money to manipulate them. Sample quotes from real-life Wisconsin clerks who are still on the job:

  • “We must not inspect the equipment for unauthorized remote-access capability, because that would void the manufacturer’s warranty.”
  • “If the voting machines could be hacked, the State wouldn’t let us use them.”
  • “I’ll believe there is a problem when I see actual evidence of a hacked election.” (In other words: Every system gets one freebie stolen election before this clerk will audit its performance.)

The City of Madison, Wisconsin, says it needs BMDs for everyone because early voting sites like libraries need to serve voters from wards all over the city. With a BMD, a library poll worker needs only to enter a code for each voter to get the computer to display and print the correct ballot for a voter’s ward. With regular paper ballots, the library would need to stock potentially dozens of different versions of the ballot.

That would be a good reason for using BMDs, if not for another fact. Manufacturers also offer machines that print blank ballots on demand. If Madison bought these, early voters could be allowed to mark their own ballots instead of having the computer do it.

Disability advocates sometimes argue that BMD users lose privacy when most ballots are marked by hand. In this, they are being cynically manipulated by the vendors. Companies could make BMDs that print ballots nearly indistinguishable from hand-marked paper ballots, even down to marking the ovals in ways that mimic the work of the human hand. Some companies do. But other companies’ BMDs print ballots that look nothing like hand-marked ballots. They create the privacy problem and then want election officials to solve it by buying enough machines for everyone. See how that works?

Another argument is that voters with disabilities are ‘segregated‘ when other voters are allowed to mark their ballots by hand. But this, too, seems to be more of an excuse than a reason. Accessible voting machines do not create segregated elections any more than accessible parking stalls create segregated parking lots or accessible stalls create segregated public restrooms. They enable everyone to participate in the same election.

But most importantly, disability advocates need to realize–in their own interest–that the best way to secure the BMD machines is to keep the number of users small. Officials cannot check the BMD machines’ accuracy regardless of how many voters use them, but hackers are less interested when they can mess with only relatively few ballots.

Other arguments in favor of BMDs-for-all have even less basis in reason or fact.

Some clerks claim voters cannot be trusted to mark ovals unambiguously, but this argument has several problems. It’s simply wrong–slanderous, even–to accuse voters of being unable reliably to mark pen-and-ink ballots. Every recount or audit confirms they can, with only an insignificant error rate. In addition, modern scanner/tabulators are very good at interpreting marks and returning ballots with overvotes and other ‘fatal’ flaws to the voter for correction.

Finally, when comparing BMDs with hand-marked paper ballots, we have to keep in mind that a very small number of voters will find a way to mess up a BMD ballot, too. One Wisconsin municipal clerk recently told me he had to instruct poll workers to watch for voters walking away with the BMD ballots, thinking them to be receipts.

Why universal BMD use puts entire elections at risk

But personally, my biggest concern is that when BMDs are used by a significant number of voters, the election results overall cannot be verified. The risk of chaos increases dramatically. Let’s walk it through…

BMD advocates point out that individual voters can, if they choose, take the time to review the printed ballot before they cast it. This might make those individual voters feel okay about their own ballot, but voter-verifiability cannot effectively secure elections.

The problem getting most attention is voters’ inability and unwillingness to verify their printed ballots. I won’t summarize the research, but basically it backs up what we all suspect: Voters don’t like to take the time to review the printed ballot carefully, and even when they do try to review it, are unreliable in noticing incorrect or missing votes.

But the problem I consider to be even worse is much less discussed: Even if voters do notice misprinted ballots, the poll worker are not going to be able to do anything about it. Think it through: What would happen on a real Election Day with real voters and real poll workers?

For the sake of easy arithmetic, let’s assume that half the voters want Adams and half want Baker, and that half choose to hand-mark their ballots and half mark their ballots by hand. Finally, assume it’s a very clumsy, obvious hack and that every second Adams vote is printed on the paper ballot for Baker.

Only one in every eight ballots are affected. Let’s generously assume that one in four of them will notice–or one in every 32 voters.

The first several voters who report the problem will be told to re-make their ballots, because poll workers have no way to distinguish voter error from machine malfunction. When they remake their ballots, the BMD will print their votes correctly.

The poll workers cannot know that the problem is affecting only Adams’ voters, because they cannot ask or look at the ballots. All they can see is that 31 in every 32 BMD users seem to be having no problem at all.

But how long do you think the poll workers would let this go on before they suspect the machine? How many votes will be cast before they take the machine out of service? How long before word gets out on social media that the machines are “flipping votes?”

Whatever happens, the hackers will win. In one scenario, their hack gets dismissed as voter error, and Baker ends up getting three-quarters of Adams’ votes. In another scenario, chaos breaks out because something is wrong with the machines; no one knows how to fix it; and no one knows how many ballots were affected.

Generally accepted auditing standards require auditors to use “competent” evidence–that is, evidence that they can know to be a true record of whatever it is the auditor is looking to know.

A hand-marked oval is pretty much a definitive illustration of competent evidence of voter intent. When a voter indicates a choice by touching pen to paper, he creates a durable physical record of that action. If the elections clerk looks at the ballot later during an audit or a recount, she can see exactly what the voter saw as he touched the ballot; she can see the same marked oval that the voter saw as he lifted the pen.

But how do you check whether the BMD worked accurately? You cannot see what the voter saw as he touched the screen. You cannot know whether the voter took the time carefully to read the printer ballot and to report the problem if she saw one.

Further, you cannot know if, when a voter reported a problem, the poll worker did anything other than help the voter cast another ballot. Poll workers cannot watch over voters’ shoulders as they touch the screen. When voters report misprinted ballots, poll workers can do nothing but tell the voter how to print another one. (Remember that hackers would not flip every vote. Even a hacked machine might print the second ballot correctly.)

But manufacturers, too, see an enormous benefit in replacing each 20-cent ballot-marking pen with a $5,000 computerized ballot marking device that comes with an annual service contract costing a few more thousands.

In every state, America’s process for selecting elections equipment is pretty much a closed-loop discussion between the vendors and the election officials. So no one with any power to influence these decisions seems to have noticed their stunning choices.

Election officials like to demand that voters should trust the voting machines. One of these days, if they stop defending the machines long enough to give it a minute’s sensible thought, they will realize: Voters would trust the machines a lot more if the election officials trusted them a lot less.

Absentee and vote-by-mail: What you need to know before you put your ballot in an envelope

Summary: The pandemic has created much giddy enthusiasm for absentee and mail-in voting, but little sober assessment of its risks and benefits. In fact, evidence of better turnout is unclear, while evidence of rejected ballots and uncounted votes is undeniable. Generally, we can predict that for every 100 voters we convince to give up polling-place voting in favor of absentee, we will lose at least two ballots. This article makes the case that putting your ballot in an envelope for an election official to cast at a later time is inherently less secure than casting your own ballot and that voters should vote absentee only when truly necessary.
This blog post is a condensed version of a more comprehensive paper, which provides additional in-depth explanation, references, and examples.


Let’s start with a quiz—just two easy questions.

1.             Imagine a polling place where voters mark their ballots by hand but instead of inserting the ballots into a tabulator, they give them to a poll worker. The poll worker puts 1 in every 110 ballots into a reject pile and casts the rest. 
Would you:
a) Be happy with that practice, or
b) Run screaming to the district attorney to report intolerable interference with voting rights?

2.             The State of Washington conducts elections entirely by mail and rejects 1 in every 110 submitted ballots. Rejection rates vary among cities, however, so a voter’s odds of being disenfranchised depend on where they attempt to vote.
Would you like your state’s elections to be like Washington’s? 
a) Yes.
b) No.

If you answered “b” to both questions, you’re with me and the good folks of Washington State, who would like to reduce their ballot-rejection rate and make rejection practices more consistent.

There are two ways you can vote: you can cast your ballot yourself (in-person voting), or you can submit your ballot in an envelope, expecting it to be cast later by an election official (absentee voting.)

In-person voting is simple and transparent. You go to a neighborhood polling place on Election Day. A poll worker places a paper ballot directly into your hand. You mark the ballot privately, and with your own hand insert it into a tabulator. This is done in one visit, which typically takes less than ten minutes except at the busiest times of day, in the busiest elections. For what it’s worth, I timed my polling-place visit on April 7—it took me 3 minutes and 47 seconds between entering the building and casting my ballot. My son took 8 minutes because he also had to register.  

Voting at a polling place is simple and transparent.
Photo credit: Tom Gralish, Philadelphia Inquirer

Once the ballot is placed in your hand, any interference would be extraordinary, obvious, and illegal. If you spill coffee or mark too many candidates in one race, you can re-do your ballot. The risk that an in-person ballot will not be counted is close to zero.

Absentee voting is a dicier proposition. It is necessary for some voters but requires more steps over a longer time. More things can go wrong. The problems are harder to prevent; sometimes undetectable; and sometimes impossible to correct in time.

Voting from home involves more steps,
many of which are outside the voter’s view and control.

We can think of an absentee ballot’s travels, from voter request to ultimate processing by a computer tabulator, as a long pipeline. Charles Stewart III of the MIT Election Data and Science Lab estimated that for every 100 requests for absentee ballots that enter the pipeline, 79 ballots will ultimately be counted. Some of the lost 21 ballots will be those of voters who chose not to submit the absentee ballot. Many other ballots will be lost to accident, interference, or rejection. In Wisconsin’s April 2020 election, conducted during pandemic stay-at-home orders, for every 100 voters who requested an absentee ballot, almost 89 ballots were counted while more than 11 were not.

To begin to understand these leaks, let’s start near the end of the pipeline, with the marked ballots that have made their way back to election officials. Deliberate rejection is one of the leaks that is easiest to quantify because officials keep track of how many ballots they reject.

In Wisconsin, an absentee ballot envelope must contain the voter’s name, address, and signature, plus a witness’s signature and address, plus other information usually filled out by the clerk. You can view the form here. Absentee voters can be disenfranchised if any of this information is missing, incorrect, or illegible. Absentee ballots are rejected if the envelope glue has failed so that the envelope is no longer sealed when it comes time to count the ballot.

Understandably, this makes voters nervous. Washington State went to all-mail elections in 2005. Seven years later in 2012, their voters were among the least confident in the nation. Only 52% were willing to tell surveyors they felt “very confident” their votes would be counted.

Washington voters are perceptive, not paranoid. Their votes are the least likely to be counted. About 1 in every 110 Washington voters’ ballots were rejected—the highest rejection rate in the nation. Oregon was about the same—0.86%, and neither of the other two vote-by-mail states that year (Utah and Colorado) had much to brag about, either. 

A missing signature is Wisconsin absentee ballots’ biggest problem, but there are other reasons for rejection. Records of Wisconsin’s 2016 recount contain evidence of frequent local differences of opinion over the grounds on which an absentee ballot could be rejected. The Wisconsin Elections Commission (WEC) did its best to answer the local clerks’ many questions but finally could do no better than to tell local officials they were on their own in many cases to figure out which absentee ballots to reject.

The danger of subjective inconsistency is bias and sadly, it shows up in the hard data. Researchers followed 2.6 million absentee ballots in Florida’s 2018 elections, 1.2% of which were rejected. They could see that minority voters’ absentee ballots were twice as likely to be rejected as those from non-minority voters. Researchers wrote: “younger voters and voters needing assistance are disproportionately likely to have their mailed ballots rejected.  We also find disproportionately high rejection rates for out-of-state and military dependents.”

In addition to the thousands of disenfranchised voters, thousands more are inconvenienced. When election officials decide to reject an absentee ballot, they often try to contact the voters, who can sometimes with quick extra work correct the problem before the deadline. Those voters must run down to city hall to correct a flaw on an envelope or submit additional paperwork by mail—unless they just give up on having their votes counted.

But they don’t always get that chance. Pat Haukohl was a Waukesha County Board Supervisor for 18 years and is a regular voter. She voted absentee for the first time in April, and her ballot was rejected because the witness (her husband) did not include his address. She did not learn of the problem until after Election Day, from a reporter.

An absentee ballot is not yet safe once accepted. Here, again, records of Wisconsin’s 2016 Presidential recount contain revealing evidence. In Dane County alone, recounters found 66 valid absentee ballots that had been misplaced and left in their envelopes, accepted but not cast, in addition to 644 wrongly rejected absentee ballots.

At the very end of the pipeline, officials feed the ballots, now removed from their envelopes, into computer tabulators. These machines reject ballots they cannot read (e.g., smeared ink) or cannot understand (e.g., too many marked votes). Polling-place machines also reject flawed ballots, but polling-place voters are there to fix whatever’s wrong. Absentee ballots are not only more likely to be damaged (kitchen-counter coffee stains; wrinkles and ink transfer from being folded; and being torn when removed from the envelope), but absentee voters are unable to complete a replacement ballot.

Election workers cast ballots using a high-speed bulk tabulator in Duval County, Florida, in November 2018. Photo credit: Brendan Rivers, WJCT News, Jacksonville, Florida

Election workers are supposed to ‘remake’ the unreadable absentee ballots—that is, copy the votes onto machine-readable ballots and cast those instead, if they can tell what the voter intended. But elections are run by an army of temporary workers, lightly trained and supervised, who get no more than four days’ on-the-job experience every year. They don’t always know or remember all the rules. Very often, they instruct each other, and in doing so, make incorrect practices standard.

Again, the 2016 recount revealed the problems. Several Wisconsin counties discovered poll workers had on Election Day failed to remake thousands of rejected but human-readable absentee ballots. Instead, the poll workers had been pushing an override button to force the machine to count the absentee ballot even when it could not count the votes. In this way, poll workers saved themselves work but sacrificed the absentees’ votes. Election officials rarely perform routine quality-assurance reviews, so such problems go undetected and uncorrected in elections that are not recounted—that is, most of the time.

The problems I’ve described to this point affect only those ballots that successfully made it back to the election offices. But one big leak is right in the voters’ homes. Ballots might be mistaken for junk mail and thrown away. They might be misplaced; damaged; buried in a stack of bills; or set aside until too late. Among the states that report complete data on absentee voting, 36.3 percent of uncounted absentee ballots went uncounted because they arrived too late at the elections office.

Coercion may be the most intractable—and heartbreaking—cause of absentee disenfranchisement. Journalist Rebecca Solnit recounted a story like many she heard as she studied this issue. A campaign worker told her:

I can’t stop thinking about this woman I met while door-knocking for Beto O’Rourke in Dallas. She lived in a sprawling low-income apartment complex. After I knocked a couple of times, she answered the door with her husband just behind her. She looked petrified and her husband looked menacing behind her. When I made my pitch for O’Rourke, her husband yelled, ‘We’re not interested.’ She looked at me and silently mouthed, ‘I support Beto.’ Before I could respond, she quickly closed the door.”

When absentee ballots arrive in that household’s mailbox, what are the chances the wife is going to be able to mark her own ballot, in peace, with her own choices? According to the American Association for Marriage and Family Therapy, 20% of American marriages are affected by abuse, and 90% of the targets of controlling abuse are women. If those facts are true, mailing ballots to every registered voter could be undetectably disenfranchising thousands of women.

Fraud is more of an illicit tap into the pipeline than a leak—and it does exist. In a practice known as ballot harvesting, political operatives collect absentee ballots from voters and deliver them to election officials. Honest operatives may provide a genuine service to voters, such as reviewing the envelopes to make sure they are filled out correctly. But the practice can just as easily be corrupt. Ballot collectors can supervise the voters while they are completing their ballots to dictate, coerce, intimidate, or pay them for their votes. Once out of the voter’s sight, collectors can spoil the ballots to make them uncountable or dispose of them. In Wisconsin, simply opening the envelope is enough to get an absentee ballot rejected. Democrats who say fraud doesn’t happen are shooting themselves in the foot. It may already have cost them a congressional seat.

Another opportunity for fraud created by large-scale absentee voting is the possibility of providing voters with faulty or fraudulent materials. This has already happened twice to me. Before an election several years ago, I received an unsolicited blank ballot and return envelope—with the envelope addressed to the wrong municipality. Had I been inattentive or naive, I might have mailed it and skipped going to the polls on Election Day. Shortly before the April 7 election this year, I received a form for requesting an absentee ballot, also unsolicited. It was addressed to the correct municipality, but my preprinted name was incorrect: Kim, rather than McKim. In a recent Georgia incident, the Secretary of State mailed materials that gave absentee voters the incorrect date for a rescheduled election—the ballots said May 19 and the election was scheduled for June 9.  

Those incidents might have been honest mistakes, rather than deliberate attempts to interfere. But accidents demonstrate things that could be done deliberately and may provide cover for them.

Earlier leaks in the pipeline prevent ballots from even reaching the voters. I will skim over this information because in May the Wisconsin Elections Commission issued an excellent 24-page report that described those leaks well, with solid data and description of real-life problems that affected absentee voters in the April 7 election. The report describes only the first segments of the pipeline because those are the only parts for which WEC has responsibility.

The April election marked Wisconsin’s first, sudden, foray into large-scale vote-by-mail, but many of the snarls illustrate problems that could crop up in any vote-by-mail election. WEC Technology Director Robert Kehoe explained at the Commission’s May 20 meeting that staff will correct the problems they can, but he would not promise no others would arise: “Until those things happened, they were unanticipated, so other unanticipated things can happen.”

Among the problems: The City of Milwaukee submitted a large batch of 8,607 approved absentee ballot requests to the WEC computer so that mailing labels could be printed. The batch was still running when state staff shut down the system after midnight for maintenance because they believed all batches submitted during the workday had been completed. This caused the system to indicate that the requests had been processed when they had not.

Those are some of the risks. So what about the benefits? Proponents believe early, mail-in, and absentee voting increases turnout. That belief persists even in the face of evidence to the contrary. Here, for example,  is reporter Jesse Opoien, commenting soon after the November 2016 election: “The decline (in turnout) — down nearly four points from 2012 and three points from what state elections officials projected — was all the more stunning as it followed record-high early voting numbers.”

Reporters like Opoien don’t seem to realize the possibility that heavy early voting could be nothing more than dedicated eager voters doing their dedicated eager thing, while the less-engaged marginal voters (the ones whose conduct makes the difference between high and low turnout) are unexcited by the opportunity to submit a ballot a month before Election Day. Or worse, that the low-enthusiasm voters read the news about thousands of eager early voters; concluded the election was already decided; and chose not to vote.

Academic studies show mixed turnout results at best, and none find large effects in either direction. Unfortunately for researchers, states rarely make one change to their election laws at a time, so we cannot know which might have affected turnout. For example, Colorado’s vote-by-mail law was adopted in 2013 as part of a comprehensive package that included same-day voter registration at the polls, expanded in-person voting to several days; added provisions that reduced deactivation of registered voters who miss several elections and included a ‘less onerous’ Voter ID requirement.  

The most frequently offered explanation of why absentee voting might increase turnout is convenience. The home page of the National Vote At Home Institute, an organization that promotes voting by mail, explains that voters:

don’t have to take time off work, drive to a polling place or stand in long lines. Vote-by-mail equally serves everyone from seniors and disabled voters, who might have trouble getting to the polls, to rural voters a long way from one, to a single parent working two jobs, a busy family, sick kids, or someone with an unexpected business trip.”

But what is convenient? The rural voter might like an excuse for a quick visit into town and nobody—nobody—finds absentee paperwork pleasant or convenient.

Absentee proponents cite other problems with in-person voting that could be solved in ways that don’t expose ballots to additional risks. For example, some vote-by-mail proponents say absentee voting gives them an opportunity to understand what races and candidates are on the ballot before they arrive at the polling place, although that opportunity is not denied to them now.

Some mail-in voters imagine absentee ballots are hand-counted. In fact, absentee ballots are counted by computers from the same few companies that provide polling-place equipment. Their software is just as vulnerable to hacking at the source or before it reaches the computers. Absentee voting does require hand-marked paper ballots, and that’s a good thing. But paper ballots’ security benefits are obtained only when the ballots are used in routine outcome-verifying audits of the type recommended by national election-security authorities—and Wisconsin officials still won’t do those.

Another touted benefit of absentee voting is avoiding long lines at polling places. However, the waiting-line problem is often exaggerated. In real life, few voters encounter Election-Day lines in excess of 10 minutes.  And if voters demanded their election officials follow accepted best practices, even that could be improved. Long lines would form only on rare occasions such as power outages.

Knowing what we know about benefits and risks, how would large-scale absentee voting affect Wisconsin’s November 2020 election?  Unfortunately, no signs point to good results in Wisconsin if voters rely on absentee ballots at the rate they did in April. 

The law of diminishing returns presents Wisconsin with one enviable barrier to increased turnout. Wisconsin turnout is already reliably high compared to other states. In the 2016 Presidential election, Wisconsin voters turned out in greater numbers (69%) than those in three of the four states that conducted all-mail elections that year: Oregon (68%), Washington (66%), and Utah (58%). In fact, only four states had better turnout than Wisconsin, only one of which was a vote-by-mail state, Colorado (72%). None of the top three states—Minnesota (75%), Maine (73%), and New Hampshire (73%)—were vote-by-mail states.

Further, the states that claim positive effects all have absentee-voting procedures that are easier and simpler than Wisconsin’s. In particular, absentee voting amplifies the vote-suppressing effects of Wisconsin’s strict Voter ID law. Voters must not only possess the right kind of ID, but must also have a way to submit it electronically.

Things don’t look any better on the risk side of the equation. The WEC report described what can go wrong in the part of the pipeline managed by a professional, full-time election staff. The rest of the pipeline, in Wisconsin, is managed by 72 county clerks, 1,850 municipal clerks, and thousands of poll workers, without oversight by the WEC. It is unrealistic and unfair to expect them in a few months to develop and practice reliable procedures for processing a flood of absentee ballots.

Giving the United States Postal Service a key role in November adds another layer of risk. The USPS just isn’t set up to be a critical moving part of the elections machine: Witness the US Supreme Court’s ruling that ballots postmarked by Wisconsin’s April 7 Election Day could be counted, only to have it come to light that the USPS does not put postmarks on all the mail. And with the current administration’s stated intent toward both the USPS and voting by mail, reliable operation of the USPS is far from a sure bet for November.  

We take the neighborhood polling place for granted. It is too plain, too obvious, too old-school to have many enthusiastic advocates. It has no novelty value. It doesn’t fit with our modern individualistic lifestyle. Even before the pandemic, we were shopping online instead of visiting local retailers. We were socializing on Facebook, not on the sidewalk. Voting from a kitchen counter is compatible with our e-lifestyle in a way that visiting with our local officials and neighbors at the town hall is not. 

If absentee voting becomes standard, as I fear it will, there are a few things responsible voters can do, collectively and individually, to minimize the damage.

First, we must expect professional-caliber management from our local election officials and hold them accountable. Take a look at that May 2020 report from the Wisconsin Election Commission. That is what it looks like when officials hold themselves accountable: 1) The WEC collected solid data on performance; 2) They performed solid investigation into things that went wrong; 3) They made a public commitment to measurable improvement.

Expect the same of your local election officials. Give it a try: Call your municipal clerk and ask about the absentee-ballot rejection rate in the most recent election; what the performance target is for the next election, and what he or she is doing to meet it. A clerk who is actively managing his or her operation will know those things. If your clerk doesn’t, arrange a meeting between the clerk, you, and other local voters to figure out how to make absentee ballots more secure in your community.

And don’t encourage any other voter to vote absentee until you do.

As an individual, here’s a checklist of what you should be prepared to do if you plan to vote absentee. However, be aware that even if you follow each of these steps, some risks are outside your control.

Personally, I am not going to bother with any of the extra work required for absentee voting, nor am I going to accept the extra risks. I will look at my local ballot ahead of time and research my options.  I will then visit my neighborhood polling place on Election Day and follow any public-health advice then in effect. I will say “Hi” to my neighbors and “thank you” to my municipal clerk and the poll workers; mark my ballot privately; and cast it with my own hand directly into the tabulator.

Simple. Easy. Convenient. Secure.


  • Vote-by-mail has not yet been discussed in any meeting among participants in Wisconsin Election Integrity. This article reflects only the references cited and my own observations, not the consensus of the group.
  • Thanks to reviewers Dr. Barry Burden, Director UW-Madison Elections Research Center; Charlotte Goska, Coalition of Voting Organizations of Brown County; my husband Keith Nelson; and Rebecca Alwin. Their suggestions and corrections were valuable; any remaining flaws are mine. The Wisconsin Elections Commission was also provided with a draft; this post will be updated if they offer any comments.


Next November, know this: Wisconsin election officials were warned and could have been prepared.

Summary: Wisconsin’s election officials have been informed of adversaries’ desires to sow chaos in American elections. And they have been informed of vulnerabilities in the voting-machine system that they cannot secure. And they have been informed of modern canvass practices capable of detecting and correcting any hacked results. And yet eight months before the Presidential election, Wisconsin’s election security plan still contains no mention of, or funding for, results-securing audits. This blog post is a last-ditch effort to motivate election officials to action by making sure that, if Wisconsin wakes up on November 4 to electoral chaos and no way to fix it, our election officials cannot claim they were not warned and could not have been prepared.

In 2012, former municipal clerk Jim Mueller spoke extemporaneously to a priority-setting conference of the Wisconsin Grassroots Network. I was there, but at the time naïve about election security.

Mueller told us that, as a local election official, he was required to sign a statement after every election attesting that the results were correct. He felt panic and despair when he realized Wisconsin’s election-administration procedures gave him no way to know whether that was true.  

He explained that the voting-machine companies legally prohibit independent review of the vote-counting software. He told us that although the ballots are public records and local clerks their legal custodians, state election officials aggressively discouraged clerks from hand-counting the votes before they certified results. He described the blow-back from his fellow clerks when he proposed responsible review procedures. They didn’t want him to contradict their favorite labor-saving myth: Trust in the voting machines is a Good Thing.

Mueller’s passion led to the formation of Wisconsin Election Integrity. And for eight years, we’ve been pressuring the state elections agency—first the Government Accountability Board, now the Wisconsin Elections Commission—to promote canvass procedures that verify the correct winners before officials declare results final.

None of us present at WEI’s founding were aware of a growing national movement for secure elections. At that time, however, the federal Elections Assistance Commission was already funding pilot tests of an efficient, practical method of using paper ballots to quickly verify the correct winners, known as risk-limiting audits.

In 2020, awareness of the threats is fully mainstream. We’re no longer “conspiracy theorists” for acknowledging that no one can truly secure the voting machines. Vendors have testified under oath before Congress that the machines all contain programmable components manufactured in China, and that their technicians can and have installed unauthorized remote-access software on the county computers used to program the voting machines. It is those who deny the existence of vulnerabilities who are now considered irrational, not those who point them out.

Solutions have also become mainstream (at least outside Wisconsin). Federal agencies including the Department of Homeland Security are unanimous in promoting protective election audits. Groups as esteemed as the National Academies of Sciences promote routine outcome-securing audits. The House of Representatives has passed legislation that would require them. (It’s being blocked in the Senate by Mitch McConnell.)

As a result, this November officials in all or parts of as many as 20 other states will conduct audits that verify the correct winners. It’s unlikely any will detect hacked results because the protective audits’ primary value is deterrence: Why bother to mess with a state’s voting machines if officials are going to calmly detect and correct your handiwork before they declare the results final?

But in Wisconsin, if nothing changes between now and November, election officials will once again certify only unverified ‘winners’.

Sadly, half-measures have even made Wisconsin more, not less, attractive to chaos-seeking hackers. If WEC follows the same playbook in November that they have in the past, they will order municipal clerks to audit a few hundred randomly selected voting machines. But if those audits reveal a miscount, WEC has no plans for response and recovery before the certification deadline. They’ve developed no procedures capable of verifying the true winner. They’ve never said that the results of the hand-counted paper-ballot audit should be binding on the certified results.

Audit practices like those—designed only to reveal but not to correct any hacked results—make Wisconsin catnip for adversaries who want only to disrupt. Those adversaries want their handiwork to be detected. Then they want the system to freeze up, to be unable to regain its legitimacy, and collapse in recriminations and vicious legal battles. And it will. No matter how obvious the hack, attorneys for the Election-Night ‘winner’ are not going to smile and nod if WEC decides to prescribe novel canvass procedures only after seeing the Election-Night results.

The reason for this blog post is the same reason I testified yesterday at the WEC meeting, and it’s not a pretty one. I’m publishing this so that, if things go south next November, there is public proof that the Commission was warned. Because of the Commission’s resistance to giving voters a seat at the table during its deliberations, a ham-handed warning like this is the best a voter can do to motivate improvement.

WEC’s election-security plans contain no provision for results-securing audits because those plans are formulated inside a tightly closed feedback loop between local officials and WEC staff.

But local clerks are not knowledgeable about any security measures WEC does not teach them. For example, Commissioners spent significant time at yesterday’s meeting focusing on security education for the local clerks and expressing frustration with some who have not yet embraced even basic safeguards.

Yet nearly every page of the materials staff prepared for that meeting contained reference to local clerks’ input, opinions, surveys, and preferences—and none to voters’ or experts’. In one breath, the Commission was bemoaning the local clerks’ naivete and lack of commitment. In the next, they were relying on them as their exclusive source of security guidance.   

For eight years, I and other WEI participants have written letters and testified in the five-minute blurbs the Commission allows. Last year, Chair Dean Knudson did ask me for a letter about risk-limiting audits, but because public input is the thing-they-must-not-admit, I received no response or even acknowledgment that they’d received it. In fact, I cannot remember ever receiving the Commission’s response to anything but legal open-records requests.

So, it comes to this icky way to try to get WEC to exercise leadership for truly results-securing audits, after eight years of polite requests. This blog post is evidence: If Wisconsin election officials still have no orderly procedures in place to detect and correct hacked results, and we wake up on November 4th to find that Trump has carried Wisconsin on the basis of enormous support in Milwaukee County, or that Sanders carried the state thanks to Waukesha County, the Wisconsin Elections Commission cannot say they were not warned, and could not have been prepared.

Marking Wisconsin’s ballots: Pens vs. computers

In brief: Vendors are promoting and officials are buying the idea that voters should give up their pens and mark ballots with computers known as ballot-marking devices, or BMDs. Why? How is that better than hand-marked paper ballots?
As with many election-administration issues, the debate features strong opinions and little objective data. Much of the relevant research is conducted by people with a financial or professional interest in promoting BMD technology. Little is conducted by independent unbiased researchers, and only local print shops have a financial interest in promoting hand-marked paper ballots.
In this blog post, I’ve tried to present the best arguments for BMDs and to cite unbiased data (I’ll edit it to add more as I find it.)
Bottom line up front: BMDs are necessary for voters with disabilities, but when used by a majority of voters, they address only insignificant problems while introducing serious risks for both security and voter confidence, plus additional cost.

Everyone knows how to fill in an oval. We’ve completed standardized-test ‘bubble sheets’ since we were kids. And most of us understand that computers tabulate the results by reading (techies say ‘interpreting’) the marked ovals. So we understand, basically, how hand-marked paper ballots work.

Ballot-marking computers are less familiar. Originally promoted in the early 21st-century to enable voters with disabilities to mark ballots privately, manufacturers have more recently promoted ballot-marking devices (BMDs) for all voters. They used to call these machines ‘accessible’ machines; now they call them ‘universal’ machines. Voters select their candidates on a computer touchscreen or other electronic input device, and the computer prints a marked ballot. They then insert the ballot into a tabulator, sometimes archaically called an ‘opscan,’ which reads and tabulates it. BMDs used in Wisconsin include the ES&S ExpressVote and the Dominion ICE.

Many of the BMDs’ drawbacks are obvious, so I’ll skim over them in just five paragraphs:.

1) More risks; more types of risks. Anytime you replace any manual task with a computer, you introduce possibilities for new types of error, malfunction, and manipulation–and the need for new security practices to address those risks. Misprogramming could cause the BMDs to print votes for candidates other than those the voter selected, or to print no vote even though the voter made a selection. As with other elections technology, risks include mistakes or corruption by any of the many people within voting-machine companies and local election offices who have authorized access. If any of their operations are compromised, unauthorized people might get access, too.

2) Longer lines. In addition to the risks of misprinted ballots, there’s no debate that voting takes more time when each voter has to scroll through several screens; review their selections once on the touchscreen; and review them again after the ballot is printed. Add that to the fact that election clerks cannot quickly or cheaply increase the number of ballot-marking stations during heavy turnout elections or times of day, and you have a recipe for longer Election-Day lines.

3) Voters do not, maybe cannot, verify that the right votes are marked on their ballots. But the most heated debate is over whether voters are able and willing to verify their computer-printed ballots. Elections must start with correctly marked ballots. With hand-marked ballots, voters reflexively verify the correct marks. As we lift our pen from the paper, it would take effort not to notice whether the pen made the mark we intended it to make. But when a computer marks our votes, verification requires the voters to make a separate, deliberate effort to check the computer’s output. BMDs place this critical security responsibility entirely on the voters: if the BMD starts misprinting votes, only voters—not poll workers, not auditors, not recounters—can notice.

4) Officials reflexively blame problems on voter error and do not investigate. Election officials must be prepared to act on voters’ reports of problems if the election is to be safe from misprinting BMDs. You cannot think of any other business or government function where managers rely solely on customers to report computer malfunctions, and then when customers do, the managers have no way to know whether the problem was with the computer or the customer. No one has yet demonstrated that voters can reliably verify computer-printed ballots in real-world elections, and several studies indicate they cannot.

5) Less obvious but just as unalterable is the fact that BMD-printed ballots cannot be used in the most critical type of election audit — that is, one that seeks to verify which candidate was selected by most voters. BMD-printed ballots preserve no direct evidence of either the voters’ selections or their verification. (For a visual explanation of this point, see the image at the end of this post.) When BMD-printed ballots make up only a small proportion of the total ballots, an audit might still be able to confirm the correct winner. However, if a large proportion of the ballots provide no evidence of either the voters’ selections or their verification, anyone working to established professional audit standards must throw in the towel.

The benefits of BMDs are quickly evident only to those who have better-than-average knowledge of elections administration. Cynics say the manufacturers’ motive is simple. As states replace paperless machines, vendors see a revenue-enhancing opportunity of the sort that other companies might brag about in their annual stockholders’ reports. (“We’ve found a way to sell $5,000 computers instead of pens!“) But America’s major voting-machine companies are privately owned and have no stockholders, so even if this is their strategy, we can’t confirm it.

In public, BMD proponents usually point to a few legitimate problems they believe BMDs solve: Badly hand-marked ballots; the need to store multiple ballot versions at some polling places; and the needs of voters with disabilities. Officials and voters need to ask: “How serious are these problems, and do BMDs solve them better than less risky or less costly solutions?”

Arguments in favor of BMDs, Round 1:
MESSY VOTERS

BMD proponents will tell you that messy hand-marked ballots are intolerable. My own county clerk is outspoken on this point. I don’t have a ready quote but if you ask him to share his thoughts on voters’ oval-marking abilities, his answer will make you ashamed that you ever imagined your careless, stupid, sloppy fellow voters were capable of such a task.

Pen-wielding voters do get messy. They write random comments on their ballots and mark Xs over ovals instead of filling them in. Others get confused and mark too many candidates in one race. That’s called an overvote and if not caught, it disenfranchises the voter in that race. Hand-marking voters might accidentally skip a race, particularly if ballot design is poor. Finally, I’ve had a BMD proponent tell me that voters sometimes accidentally fill in the wrong oval, but I have no idea what sort of evidence could prove that or why that problem wouldn’t also occur with touchscreens.

I’ll come back to ballot design, but individual voters’ sloppiness does not threaten election outcomes. Only a tiny number of hand-marked votes are ruined in a way that could be prevented by using BMDs, and those errors affect all candidates randomly.

Yes, individual voters can be sloppy, but the truth is that tabulator technology (not BMDs) has already reduced this problem to insignificance. When a voter casts an overvoted ballot, the tabulator identifies the problem and gives the in-person voter a chance to correct it or cast it. (Mail-in voters are not present to fix overvoted ballots rejected by the tabulators, but BMDs can’t help them anyway.)

The tabulators’ ability to interpret idiosyncratically marked ovals has also become impressive in recent years. (There’s data on this; I’ll add it when I locate it.) Modern machines have no trouble reading any color or composition of ink. Professor Douglas Jones of the University of Iowa Computer Science Department told me he tests machines with everything up to and including glitter pens, and they perform well.

But most importantly, the problem of ambiguously or incorrectly marked ballots is very small to start with. Anyone who has participated in a hand count can tell you that probably only one hand-marked ballot in every 250 or so is oddly marked. Of those, only a tiny fraction are marked so badly as to render the vote uncountable.  The Dane County Clerk (the one who so disdains voters’ ability to mark ovals) posts digital images of the ballots online, so if you have the storage space on your computer and the time, you can examine thousands of real ballots yourself. Try it: how many hand-marked ballots (on those linked files, the individual files ending in “i” for ‘image’) do you need to examine before you find one that is overvoted or mismarked in any way? Preventing that small a number of errors cannot possibly be worth the cost and risk of making everyone use a computer to mark their ballots.

Recount data are objective and can help us quantify the problem. In 2008, the state of Minnesota performed a recount of a US Senate race in which 2.9 million ballots were hand-counted. Advocates for both major candidates aggressively looked to find votes they could challenge. They found plenty of officials’ errors—misplaced ballots, mishandled absentee ballots, and more. But by the time they were done, they could find only 14 marked ovals that had to be adjudicated by the state elections board. That’s one fatally mismarked vote in every 206,111 votes, or 0.000485%. That is nowhere near enough to justify taking on the risks of computer-marked ballots.

Wisconsin’s 2016 recounters found many of the same problems. They did not record their findings as thoroughly as Minnesotans did, but not one of the 72 counties’ recount reports noted encountering even one ambiguously marked oval. The WEI hand count of 4,580 ballots in Racine County found no fatally mismarked ballots, either (other than carbonless ink, which is not a problem for modern tabulators.) So whatever Wisconsin voters’ error rate is, it is less than 0.022% (22 thousandths of one percent)–again, not enough to justify the risk of universal BMDs.

What little data BMD proponents have offered me to quantify the hand-mismarking rate has been irrelevant. David Becker, Executive Director of the Center for Election Innovation and Research (CEIR, a voting-equipment company) tweeted me a list of recounts he claimed had found decisive rates of voter error. I looked into each. None found even minor levels of ballot-marking errors. As in the Minnesota and Wisconsin recounts, the significant causes of miscounts were officials’ errors, not voters’. When I gave him one more chance to provide data showing that voter errors have affected outcomes, he replied: “Facts are stubborn things … but still, there are many, many elections where ambiguous (hand-marked votes) exceeded the margin. Not even arguable. I think we’ve reached the end of the constructiveness of this convo.

That’s not the reply of a man who has evidence to prove his point.

If anyone were to compile data about hand-marking error rates to inform this debate, they would need to exclude mail-in ballots. Any poll worker knows mail-in ballots are prone to mishaps like soaking up coffee stains and getting fouled with envelope glue. But that’s not relevant to the advantages of BMDs because BMDs cannot help at-home voters anyway. I’ve also had BMD proponents refer me to data about error rates on standardized tests’ bubble answer sheets. But I see no reason to assume the error rate in marking ballots (where ovals are directly beside candidates’ names) is similar to the error rate in taking standardized tests (where ovals and questions are on separate documents.)

Aside: Speaking of an analogy with standardized testing, imagine that the ACT and SAT companies switched to having students select their answers from a touchscreen; printing out the answer sheets with bubbles already marked, and telling the students they must verify the printed answers because managers have no way to tell if the machines accurately recorded their selections. On what planet do you think that might be acceptable?

In contrast to individual errors, poorly designed ballots are a more serious problem. Poor design can systematically disadvantage one candidate or favor another for every voter — not just the careless ones. It is, therefore, more likely to affect an outcome.

But poor design is a problem for both printed ballots and those displayed on a computer screen. Officials have designed printed ballots that ‘hid’ a race under a column of multilingual instructions, and have also designed BMD displays that forced voters to scroll onto additional screens to see the entire list of candidates. Printed ballots arguably have a small advantage because they can be printed in newspapers before the election, a practice that has, on occasion, enabled voters or candidates to identify design errors officials had overlooked. Either way, officials must learn and follow established guidance on ballot design.

Score so far: Preventing voter error gives a microscopically detectable advantage to BMDs. Mismarked ballots have been mostly resolved by tabulator technology except for some of the problems with mail-in ballots, which BMDs cannot help with anyway. Poor ballot design can be a serious threat but gives hand-marked paper ballots only a microscopic advantage, from the increased opportunity to detect problems before Election Day.

Arguments in favor of BMDs, Round 2:
MULTIPLE BALLOT STYLES

For better or worse, both officials and voters have begun to embrace early offsite voting. Election officials want to set up voting sites several weeks before each election in places like libraries, to which voters can come from all over the city to cast their ballots. These are called ‘multi-ward sites.’

In any city, in any election, it’s possible that several different ‘ballot styles’ will be needed. Different areas of the city might be voting on different city council races. In gerrymandered states like Wisconsin, congressional district boundaries can cut through even the smallest municipality.  When those municipalities set up multi-ward voting sites, each site must stock several different ballot styles. This creates more work for the poll workers at those sites, both in handing out the correct ballots and in keeping track of the ballot inventory (an important security practice.)

BMDs address that problem by electronically storing several different ballot styles. When the poll worker enters the voter’s ward number, a correctly programmed BMD will display the correct ballot for that voter.

However, every BMD manufacturer also sells blank-ballot-on-demand printers. These cheaper computers store multiple ballot styles, but they don’t mark the votes before they print the ballot.

Score for this round: No advantage for either. Multi-ward voting sites are a challenge with pre-printed blank ballots. But there’s a solution that doesn’t force us to accept the risks and cost of universal BMD use.

Arguments in favor of BMDs, Round 3:
VOTERS WITH DISABILITIES

Spoiler: BMDs win this round, for people with disabilities. No other solution, even on the horizon, enables voters with vision or movement impairments to mark their ballots privately at the polling place.  For this reason, BMDs are as indispensable as accessible parking spaces and public restroom stalls.

And there’s no disagreement that we need to make BMDs available to everyone even when we don’t encourage their use. Impairments can be temporary so it wouldn’t work to force BMD users to prove a disability, as we do with accessible parking spots. I once left my reading glasses behind when I went to vote and appreciated the opportunity to be able to enlarge the ballot so I could read it more confidently.

Some disability groups argue for universal BMD use out of a concern for what they call segregation. That argument falls apart when we consider how we handle all other public accommodations. We don’t rip out curbs and stairs when we accommodate wheelchair users with curb cuts, ramps, and elevators. Ripping out all the smaller stalls to give everyone an accessible stall would increase cost and lengthen lines, just as it does with BMDs. If we handle polling-place accommodation the same way we handle other public accommodations, we can protect disability rights without degrading election security.

Another complaint, however, is confirmed when we compare it with other types of accommodations: Unreliable set-up of the BMDs. As with the occasional unshoveled accessible parking spot or curb cut, voters sometimes discover that the BMD hasn’t yet been turned on when they arrive at the polling place. But again, the problem could be addressed with less extreme measures, such as improving poll workers’ training and oversight. The League of Women Voters incorporates BMD set-up into their observation program (volunteer here!), as do disability groups. Voters who don’t use the BMD can help. If you have an extra five minutes to spend at the polling place, look to see whether the BMD is set up and ready to go. If not, ask to use it. It’ll take a few extra minutes of your time, but you will strike a blow for disability awareness.

BMD promoters also argue that users have more privacy when everyone uses the BMDs. Privacy is a genuine issue when only one or two voters use the BMD and the BMD prints ballots that contain only the voter’s selections, rather than full ballots with marked ovals. But some BMDs print ballots that are nearly indistinguishable from hand-marked paper ballots. Anyone trying to identify the sole BMD user’s ballot after poll closing would have to carefully examine every ballot cast that day, and even then could not be sure of finding the printed ballot.

On the other hand, BMD users’ ballots are more secure when there are only a few. When only one or two people in each polling place use the BMD, malicious actors could neither swing an election nor create chaos by tampering with the lightly used equipment. In contrast, widespread use makes BMDs a more attractive target for mischief.

Score for this round: BMDs must be preserved to accommodate people with disabilities. To preserve users’ privacy, only BMDs that print full ballots should be used. But for universal use, the advantage goes to hand-marked paper ballots. To bolster BMD security, their use should not exceed a small percentage of the voters.

RELATED ISSUES: ENCODED VOTES AND HYBRID MACHINES

I hope I’ve demonstrated that when discussing BMDs in general, we can logically examine actual problems, seek relevant evidence, and assess the costs and benefits of possible solutions. But for two specific types of BMDs—hybrid machines and encoding BMDs —there is no well-reasoned pro-and-con debate.

Proponents identify no consequential problems that justify the existence of these machines, even if they added no risk. But they do create new, and serious, risks.

Hybrid machines combine ballot-marking devices and tabulators in one machine. Only their manufacturers are comfortable with the fact the machines are able to print votes on the ballots after the voter has cast them. Neither voters nor officials have any way under any circumstance to detect the alterations or to recover the true votes if they could detect the altered ballots. That’s unacceptable. Full stop.

As of August 2018 (WEC’s most recently updated inventory), hybrid machines (Dominion’s ImageCast Evolution) were in use in Door, Fond du Lac, Green, Ozaukee, Racine, Trempealeau, Vilas, Walworth, Washington, Waupaca, and Winnebago Counties.

Encoding BMDs record each vote twice on each ballot, once in barcode or QR code, and separately in a list of names for the voter to review. The tabulators count only the encoded votes, while voters can verify only the text. Encoding gives voters no choice but to trust that the countable votes were recorded correctly.

Encoding BMDs are in use in the counties listed above, plus those that use the ES&S ExpressVote: Columbia, Dane, Dodge, Douglas, Eau Claire, Jefferson, Kenosha, Lafayette, Milwaukee, Outagamie, Pierce, Sauk, St. Croix, and Waukesha, and perhaps more. Because the City of Madison encourages BMD use by early offsite voters, it is likely that more than 30% of Madison’s votes are now encoded.

The critical risk is obvious: How do either voters or officials know that the BMDs correctly encoded the voters’ Election-Day selections? The machines’ proponents will cavalierly tell you officials can detect any incorrectly encoded vote in an audit or recount (assuming the text vote was not also mis-recorded). Yes, they can. But they won’t. In this state, election officials do not routinely audit, and recounts are conducted mostly by running the ballots back through the tabulators.

Keep going with this train of thought, and envision what would happen if a post-election audit did detect that some encoded votes were different than the text-readable votes. Aside from the chaos that could have been avoided had voters been able to detect and report the misprints on Election Day, who is going — legally — to determine which of the two conflicting votes is valid?

Encoded-vote proponents naively assume lawyers, judges, and combative candidates will passively agree the text votes should be counted. But Wisconsin’s law explicitly allows ‘recounting’ by machine, and contains nothing that provides for counting one set of votes (the encoded ones) on Election Day and a different set (the ones in text) in a later audit or recount. I doubt any other state’s law does, either.

And if there was such a law, what would it say? Perhaps: “Only votes printed in voter-verifiable text may be counted in post-election reviews because audits and recounts must be convincing and decisive.” But encoded votes are good enough for Election Day because … ?

In my experience with encoding proponents (emails, Twitter, and at WEC meetings), I’ve encountered none who could both describe and quantify any problem that encoded votes are designed to solve. Without that information, neither they nor we can assess whether the added risk is justified.

I shredded the vendors’ arguments put forth at WEC meetings in an earlier post. Since then I’ve had several discussions with encoded-vote advocates who put forth better arguments.

Ben Adida, Executive Director of VotingWorks, a nonprofit voting-equipment company, explained two reasons for encoding votes. First, it is “easier to get to a high level of reliability” in the tabulators’ interpretation of the marks when they are recorded in QR. In the context of our discussion, I understood him to mean that it’s easier for developers, and that he is speaking about QR codes in comparison to machine-printed ovals.

To assess whether this additional ease or reliability is worth sacrificing voter verification, we would need to compare data on tabulators’ error rate with marked ovals to their error rate with encoded votes. QR codes reduce the error rate from what to what? My sense, however, is such information is not worth digging for. If the tabulators were making any noticeable level of oval-reading errors, any real-world recount of marked-oval ballots would have detected it. None has. It is not a problem.

Adida’s second reason was: “More importantly … (if you) want voters to check (a BMD-printed ballot), a summary ballot is going to be much easier to check than a multi-page bubble ballot. And we really want voters to check their BMD ballot.

In my opinion, that’s the best argument for ballot slips I’ve encountered (once you’ve accepted universal BMD use, that is.) However, we still need evidence before acting on it. I’ll keep an open mind, but my sense is that objective study would show that, regardless of the length of the ballot, voters’ reviews are more accurate when they can see the names of both the candidates they did and did not vote for. In particular, voters need to see the whole question to review their referendum votes.

Adida added that developers are working on the possibility that BMDs could print votes only once, in human-readable text, for tabulators that can reliably use optical character recognition (OCR) to count the same votes that voters are able to verify. When that technology is ready, in my opinion, the question of ballot slips’ safety could be revisited–though it still would not establish a need for ballot slips in place of full ballots.

Aside from Adida, encoding proponents with whom I’ve engaged rely heavily on motivated reasoning. For example, proponents often reflexively deflect discussion of BMDs’ undeniable flaws (e.g., voters cannot verify encoded votes) by tossing out irrelevant facts. For example, many have pointed out that voters cannot read the timing marks at the edges of printed paper ballots, either. That’s true but irrelevant: the timing marks are not the input that voters need to verify; that’s something that officials can do. And if the tabulator misreads the timing marks, that’s a problem with the tabulator, not the ballot.

Also irrelevant is the fact that just as BMDs could be misprogrammed to print the wrong votes, paper ballots can be misprinted to put candidates’ names in different spots than the tabulators are programmed to find them. Again, true, but the risks are far from comparable. A misprinted-ballot fraud would have to involve or originate with the local printing company and involve several layers of conspirators to avoid detection during pre-election testing and distributing the misprinted ballots to polling places. It would, therefore, be limited to individual counties or municipalities. It is not comparable to a BMD hack that could originate in Omaha or Pyongyang and affect up to 55% of the BMDs in Wisconsin (the market share of the most popular model.)

People argue by tossing irrelevancies into the discussion only when they have no truly solid points to make. It’s not earnest problem-solving discourse.

SO WHY DO OTHERWISE SENSIBLE PEOPLE SUPPORT THESE THINGS?

I’m not ready to say all, or even any, encoding proponents have corrupt motives. My most charitable guess is that the technology developers are like the proverbial children with hammers who perceive everything needs pounding. Where you and I see only minor blemishes, geeks perceive possibilities for major fun and profit. Intensely focused on bringing cutting-edge technology to the election-equipment market, they don’t pause to think about real-world issues such as the chaos that will blossom when litigious parties to a recount realize they can fight over which vote to count on each ballot.

I also suspect that developers, accustomed to working with private-sector businesses, overestimate the likelihood that local election officials will implement security practices the developers consider obvious and necessary. Elections are run by a small army of lightly trained, minimally supervised, part-time, temporary employees who get no more than four days on-the-job-experience every year. The officials who manage that army often exhibit a child-like trust in voting equipment that, in their own words, makes them reluctant to implement recommended security measures. The following are real quotes from real Wisconsin county clerks, which I’ve collected from newspaper articles, emails, and phone conversations over the past two years:

  • “I don’t need to audit to be very confident the results are accurate.”
  • “Honestly, I am not concerned about any kind of hacks into our system. Everything is hardwired.”  
  • It’s an “irrational belief that Wisconsin’s highly decentralized and secure elections infrastructure is vulnerable to the kind of meddling that might overturn the will of the voters. All our software and hardware has been federally certified.”
  • “Why pay $8000 and more for a voting machine if you have to (check its accuracy)?”
  • Auditing “would defeat the purpose of having the voting machines.”
  • “Why should we audit? Things work well and when something works well, you don’t mess with it.”

Accustomed to working with private-sector executives who might lose their jobs if they did not implement manufacturer-recommended security measures, it’s quite possible that developers don’t understand they are selling equipment to officials who genuinely perceive no need to manage it professionally.

And why do election officials buy and promote the encoding BMDs and hybrid machines? As I write this, Pennsylvania officials are in court defending their decision to force encoding BMDs on all voters there. If I can get a copy of their briefs, I’ll know definitively what they put forth as their best arguments.

Based on what I already know — for both this and other issues — my most charitable guess is that election officials rely exclusively, even mindlessly, on vendors for information about the products’ risks and benefits. With little IT expertise of their own, they cannot ask sophisticated questions or notice what the salesperson is not saying. Example: for years, vendors were telling them the equipment was not connected to the internet, and election officials believed them, even as they instructed poll workers on how to wirelessly transmit election-night results to the county elections-management computer. Local election officials have no relationships with unbiased elections-technology professionals and no Consumer Reports-type counsel to inform voting machine purchases — pr at least none that the election officials accept as authoritative. Finally, they are too pressured by time and money do much other than grab the hand of the friendly voting-machine vendors and follow where they lead. The problem is exacerbated by the nature of the voting-machine market.

WHAT VOTERS CAN DO.

  1. Encourage your local clerk to purchase only the minimum number of BMDs needed to ensure accessible polling places and to refrain from encouraging voters to use BMDs in situations like early voting.
  2. Pressure your local clerk to adopt policies that:  1) enable poll workers to take voters’ report of misprinted ballots seriously; and 2) describe an effective response when voters report malfunctioning BMDs. The policies must be in writing and must be specific. They won’t help if all they say is: “if poll workers receive more than a few reports of misprinted ballots, they should report to the municipal clerk.” How many is more than a few? What will the municipal clerk to determine the nature and extent of the problem, and what will the clerk do if the BMDs are misprinting?
  3. Mark your own ballot with a pen whenever you can. If you must use a BMD, be prepared to spend extra time at the polls to review it carefully. Ask for a copy of a regular paper ballot against which to check your BMD-printed ballot. (That will help you remember all the races and candidates.) If you find an error, don’t just assume you did something wrong. Insist the poll worker report it to the municipal clerk.
  4. Join with others to get encoding and hybrid BMDs out of Wisconsin entirely. Email info@wisconsinelectionintegrity.org, and I’ll contact you when we get enough people interested to start action through formal complaints or a lawsuit.   
Computer-printed ballots can be used in audits that seek to confirm only whether the tabulators operated correctly, but are not “competent evidence” of the voters’ selections per generally accepted standards for government auditing. Therefore, the proportion of BMD ballots must be kept to a minimum if officials want to be able to perform an audit that can verify which candidate was selected by most voters.

Everyone calm down. No one is voting twice. No one is being purged.

The Wisconsin Elections Commission is working on a project to contact voters who have more than one home address on state government databases. If the voter has moved within Wisconsin, the WEC wants them to register at their new address. If they haven’t moved, WEC wants only to confirm their voting address.

In our current political climate of eager fearfulness and lunging-at-each-others’-throats, this is causing controversy, even a lawsuit. But the facts are neither as the partisan Republicans or the partisan Democrats fear or want you to fear.

Last October, the WEC checked the addresses on the voter registration database against other State of Wisconsin databases and found 234,039 mismatches–mostly with the Department of Transportation. They sent postcards to the voter-registration address to make sure the voter was registered to vote at the right address. Everyone involved–the WEC, the voters, the local clerks–has plenty of time to resolve this before the next election. That’s why the cards went out in October, when there was a long lull between elections.

The practice of checking registration rolls for people who have moved is widely recognized as prudent maintenance. It’s routine and useful for preserving election integrity and WEC is going about it as carefully as any other state.

Personally, I don’t think it adds value to election integrity beyond appearances, but I won’t go to the mat to defend that belief. It has no effect on voter fraud because the voters are registered to vote at only one address. If they are attempting fraud, they are being so clumsy we don’t need to worry that they will succeed. Slightly inaccurate voter-turnout statistics is the only drawback I see to leaving movers on the rolls until they register someplace else or fail to vote for four years.

For Republicans: NO ONE IS REGISTERED TO VOTE TWICE. In addition, no one has voted twice. There’s not even any evidence that any of them are trying.

There are plenty of non-fraudulent reasons why people have different addresses for their vehicle registration and their voter registration. Small business owners might register their car from their business address. Same for people who own two homes–don’t we want them to vote? Tax evaders who live in cities that levy wheel taxes might register their cars at their relatives’ homes. (Okay, that might be fraud, but it’s not voter fraud.)

And give a thought to those individuals’ freedoms. Why shouldn’t a man who owns a home in Waukesha and cabin in the Northwoods be able to choose which he’ll use to register his cars and which he’ll use to register to vote? Leave the guy alone. If you force the WEC to remove people like him from the registration list every time they register a new car, you’re causing him trouble and causing the WEC to divert effort from real problems.

And now that we’ve resolved that, Republicans, consider this. A law firm is spending donations from people like you to force the State of Wisconsin to spend your tax dollars to respond to a frivolous lawsuit that won’t have any effect on voter fraud even if it succeeds. Surely there are better things to do with both the donations and the tax dollars.

For the Democrats: NO ONE IS BEING PURGED. In fact, the postcards might be preventing problems for some voters.

Since the postcards went out, 13,267 of the voters registered to vote at their new location. That’s 13,267 voters who won’t have to clear this up the next time they go to vote.

Another 1,666 responded to the postcard saying that they hadn’t moved. Their voter registrations were confirmed. No harm, no foul, good to go.

As of mid-November, 54,234 postcards had been returned as undeliverable, confirming the voters no longer lived at the address where they were registered. In the future, if any of those voters show up at a polling place anywhere in Wisconsin, they will be able to re-activate their registration right then and there and cast a regular (not provisional) ballot. That’s not a smidgen more work than they would have had to do if WEC had not removed them from the voting rolls.

The remaining 164,873 voters have been flagged on the registration database. If in 2020 they show up to vote at their old polling place, they will be told they have two home addresses listed with the State and asked to clarify the right address for the voter-registration database. If they say, “This is my voting address. I’m in the right place,” they will be allowed to sign the poll book and vote. It’ll take them maybe five seconds longer to vote than it would have taken them had the computer not flagged them.

If they show up at some other polling place or if the court decides to force the WEC to remove them from the registration rolls right now, the next time they show up at a polling place, they will be able to re-activate their registration right then and there and cast a regular (not provisional) ballot. It’ll take them maybe five minutes longer to vote than it would have taken them had the court not ruled against them.

And now that we’ve resolved that, Democrats, consider this. Imagine you’re a marginal, disenchanted would-be voter. What will you feel when you see social media spreading the message: “Lawsuit could affect the ability of 234,000 Wisconsin voters to cast ballots”? Suspecting you might be one of them isn’t going to make you any more eager to show up at the polls to find out.

Spreading fear of routine election-administration practices can be nearly as effective at suppressing votes as actual purging would be. When there really is nothing to fear, use your words and energy to spread that message instead. There are other alarms to be raised about the real threats to our democracy.

Verifying a statewide election could be this easy and cheap.

Photo: Michigan election officials assess the results of a manual count of a sample of ballots for a risk-limiting audit in 2018. Photo credit: Berkeley Institute for Data Science, UC-Berkeley


Think of “risk-limiting audits” as low-effort exit polls.

Exit polls determine who won by asking randomly selected voters “Who did you vote for?” Risk-limiting audits work on the same principle to confirm the correct winners, but they do not involve talking to voters. Instead, RLAs pose the question directly to randomly selected paper ballots.

Either way, a small sample can provide statistical proof of who really won the election, independently of the vote-counting computers.

No one in Wisconsin now does risk-limiting audits. Sometimes local officials spot-check a few randomly selected voting machines, but to any sensible risk manager’s horror, none have any specific plans for what they will do if any of those random voting-machine audits ever detects a serious miscount. Risk-limiting audits, in contrast, always resolve any problems they detect.

The Wisconsin Elections Commission has shown some mild interest in the possibility of using outcome-verifying audits to secure our elections. Every sensible Wisconsin voter should be pressuring them to do more. Here is the memo I submitted to WEC in December 2019, to help them understand how very practical this effective safeguard could be.

There’s no one correct way to do a risk-limiting audit. Our election officials could sample individual ballots (less work) or entire polling places (more work). They could do nothing more than confirm the correct winner in one race (less work) or they could answer other questions at the same time (more work).

A risk-limiting audit of a statewide election in Wisconsin could be this easy and cheap:

1) After they close the polls on Election Night, poll workers would record how many ballots they seal into each bag. Using this information, the municipal clerk would create a “ballot manifest” (e.g., City of Abbotsford: Bag #1 – 234 ballots; Bag #2 – 122 ballots).

It’s unlikely anyone has ever counted, but a fair guess is that a big election produces around 4,750-5,000 sealed ballot bags statewide. One bag can contain a maximum of around 300 ballots but might contain fewer than 10.

2) The day after the election, every municipal clerk would send their ballot manifest to the Wisconsin Elections Commission. The WEC could create an online reporting form to make this task easy and quick. It wouldn’t need bullet-proof security if the municipal clerk also mailed a hard copy of the manifest to WEC, and WEC staff later verified them against each other.

3) The WEC would then assign a number to every ballot in the state. For example, ballot numbers 1-234 would be assigned to the first bag from the City of Abbotsford; numbers 235-356 to the second bag, all the way up to the last bag from the Town of Yuba, which might be assigned the numbers 2,673,149 – 2,673,308.

4) WEC staff would examine the preliminary election results for the statewide races and enter the results for the closest race into a statistical tool that has been endorsed by the American Statistical Association, tested, and used in other states. This would generate a sample size for the audit.

The size of the sample depends upon the Election-Night margin of victory. If the margin is large or normal, the sample size will be small. For example, the 2018 contest for the US Senate was neither close nor a landslide: 55.4% to 44.5%. A risk-limiting audit of that race would have needed an initial sample size of only 401 ballots across the entire state. However, officials could choose to select a larger sample to provide voters with ’emotional’ confidence in addition to statistical confidence.

An extremely close election such as the 2018 Governor’s race (49.5% to 48.4%) would have needed an initial sample of 37,841 ballots (out of almost 2.7 million cast). But it’s these races that officials legitimately need to be most careful about, and it’s the very close races that, when left unaudited, provoke the most candidate resentment and voter suspicion.

Wisconsin election officials have already demonstrated they can handle larger sample sizes. For comparison, the voting-machine spot-checks conducted after the November 2018 election required officials to count votes from 135,712 ballots — more than 3.5 times the number of ballots they would have needed for a risk-limiting audit. But because of the way WEC selected that sample and their instructions that auditors ignore voter intent, that effort did not confirm the correct winner in any race.

Wisconsin election officials counted 135,712 ballots in the random voting-machine spot-checks after the November 2018 election, but used a method that did not confirm the winner in any race.
A risk-limiting audit of the same election would likely have verified the correct winners in the statewide races with only 37,841 ballots.

And because races from the same ballot (as those two races were) do not need separate samples, a risk-limiting audit could have verified all the statewide contests on the ballot in that election–an accomplishment of enormous value to election security and voter confidence.

5) WEC would randomly select ballot numbers and then use the statewide ballot manifest to identify the bag in which each of the selected ballots is stored. For example, if ballot #284 turned up in the random sample, the WEC would know it is in the second bag from the City of Abbotsford. If the random selection turned up ballot #2,673,193, they would know it is in the last bag from the Town of Yuba.

6) At this point, WEC could ignore the hypothetical numbers they assigned to each ballot and tell the municipal clerks only the number of ballots to be randomly selected from each bag.
For example, the WEC would tell the City of Abbotsford clerk to randomly select one ballot from the second bag. The instructions for random selection could be something like: “In the presence of observers, pull the ballots out of the bag, set them in a stack on the table, let an observer from each political party cut the stack several times like a deck of cards, cut the stack two more times, and select the ballot at the bottom of the last cut.”
Other methods could be prescribed for jurisdictions that use machines that print flimsier forms of paper ballots.

7) The municipal clerk would display the selected ballot to the observers; fax it to the WEC; mark it with red ink indicating it was the ballot selected for the audit; put it on the top of the stack of ballots; and reseal the bag.

8) The WEC would conduct a publicly observed manual count of the faxed ballots and enter the results of that count into the standard risk-limiting audit formulas. If the proportion of votes for the Election-Night winner in the manual count is close enough to the proportion reported on Election Night, the result is confirmed. The audit would be concluded and the county canvasses could conduct their certification process as normal.

If the proportion of votes for the Election-Night winner differed too much, an additional sample would be drawn and counted. That process would be repeated until statistical confidence in a winner was established.
The WEC would need to adopt policies to govern what will happen in the rare event that the sample has to be expanded more than twice, or if the confidence level declines as the sample is enlarged. Likely, WEC would stop the audit, declare a lack of confidence in the preliminary Election-Night results, and order a full recount on its own initiative.

Other states’ election officials think their voters’ right to self-government through secure elections is worth at least that much time and effort.

If you think Wisconsin elections are worth the effort it takes to conduct a genuine risk-limiting audit, contact your county clerk and the Wisconsin Elections Commission to tell them so.

Wisconsin’s Election Security Council sees the gorilla.

The first meeting of the Wisconsin Elections Commission’s new Election Security Council was both reassuring and scary.

First, the good news. I’m genuinely not sure whether WEC created the council more to promote belief in security or to promote security itself. But whatever WEC’s intention, the members of the new council are there to promote security.

They uniformly exhibited a desire for actual security. Understandably, they showed some legitimate interest in appearances, but their primary concern seemed to be for real security.

Hang on to that idea as I describe the bad news. I do think intention matters.

The second piece of good news is that the members did not seem to share—even slightly—WEC’s hesitance to include voters on the council. (See note at the end of this post.)

A bit of background: the state election agency’s longstanding attitude toward citizen participation is not normal. After 30 years working as a state bureaucrat in three agencies and auditing dozens of others for the legislature, I know “normal.” Even agencies running unpopular programs like septic-tank regulation or state-forest timber harvest seek citizen participation as a routine matter of course.

In contrast, the WEC runs a popular function—people like elections—and yet they hide under their desks when someone mentions voter participation. I’ve never understood why; it makes no sense. I sincerely think that, overall, their objectives are in line with those of the voters.

Fortunately, the council members know normal. When WEC administrator Meagan Wolfe asked whether they wanted to add voter representatives to the council, the members’ brief discussion can be summarized: “Well, duh.”

The representative from the Wisconsin Counties Association, whose name I didn’t catch, pointed out that legislative advisory councils routinely include representatives from citizen groups. Then, after Wolfe said she would bring a detailed proposal for selecting voter representatives to the next meeting, Governor Evers’ representative, Jenny Dye, said that would be too late. The council’s work was “already short on public input,” she said, and it wouldn’t do to have the public members miss the first two meetings. WEC agreed to work out the details and get voters’ representatives to the table by the council’s December meeting.

Okay, now the bad news.

The level of naivete in the room was frightening. Among the utterances that made me shudder:

  • In the limited discussion of specific threats to election security, I heard reference only to external hackers. I detected no awareness that insider corruption (e.g., a rogue employee of a voting-machine company) is the single greatest threat to vote-counting security—one that our election clerks have no reliable defense against. When a representative from the Wisconsin Statewide Intelligence Center listed the threats to look for, he described only external threats. Later, WEC Assistant Administrator Richard Rydecki explained to me that was because external threats are the only ones WSIC has noticed. Well … yes … that is why the other threats are more serious. Wisconsin officials don’t have any way to detect unauthorized remote-control software in the county election-management computers or dicey Serbian programmers working for Dominion.
  • Hearing Mike Davis from the League of Wisconsin Municipalities open his question with “I don’t know much about elections administration, but…” Yikes! Municipalities run Wisconsin’s elections! (On the other hand: his ‘but…’ led into a question about what we do with our paper ballots—displaying that he has good intuitive sense about how we could be securing our elections from that rogue programmer or service technician.)

Ignorance doesn’t have to be a problem. No one was born knowing this stuff. They can learn.

However, WEC’s conduct of the meeting gave me some concern that the council members will not get the education they need.

Put it this way: If you convened a new council to get advice on election security, how would you have opened the first meeting? If it had been me, I would have started by describing the basic elements of a secure election system. Then, I would have given the council a quick overview of Wisconsin’s strengths and weaknesses vis-a-vis these elements–which are covered, and where are the weak spots or holes?

Instead, WEC staff presented a rosy overview of all the good things. When they were done, I’m guessing some council members were wondering why they were there, given that things are already as good as can be.

Wolfe wasn’t making stuff up–a lot of good security measures are already working. She was leaving stuff out—specifically, stuff relating to voting machines.

One fact is critical to understanding election security: Two separate systems must be secured. (See the chart below). These two systems have practically no overlap. They have different creators and different owners. They operate on different computers, managed by different agencies. They face different threats and require different safeguards.

WisVote–the voter-registration system–is secure, thanks to the good, hard work of the state elections agency. I wouldn’t trade our voter-registration system for any other in the nation.

Security for the vote-tabulation system–that is, our voting machines–is closer to an honor system.

Yet Wolfe danced over the tabulation system so lightly I’m not even sure she said the words “voting machine.” For example, one of her Powerpoint slides listed the steps in an “End-to-end Election Administration System.” The list went right from “prepare the poll lists” to “report results to the State.” I wonder whether any of the council members noticed the missing step: “Count the votes.”

I’ve seen this tunnel-vision focus on WisVote security from WEC staff many times before. Whenever they are asked about “election security” (with or without specific reference to voting machines), they respond by describing safeguards that protect only the WisVote system. Dozens of reporters have failed to notice.

But for some reason, I didn’t expect it to be on full display in the meeting today. Perhaps I was thinking that creating an advisory council was something like going to a therapist. You want help, right? So be honest about the problems that bring you there.

(Spoiler alert. If you’ve never taken the selective perception test where you watch a brief video and count the number of times a white-shirted team passes a basketball, do that before reading further. I don’t want to spoil anyone’s opportunity to experience this phenomenon firsthand.)

I’m not a mind reader and so cannot say how much of this relentless tunnel vision on WisVote security is strategic, and how much stems from the fact that tabulation-system security is simply not the WEC’s job.

But as I listened, I started to see WisVote as WEC’s white-shirted basketball team. They are so intently focused on it—absolutely, fully engrossed—that they cannot see the gorilla that is the tabulation system.

Here’s my best hope, and I think it’s a real possibility: I think this council might be able to provide WEC staff with more guidance and education than they realize they need.

After WEC staff had shared all the lovely information about WisVote security, they turned the microphone over to the council members. They asked each member to say a few words about their organization and describe how they see their role in election security over time.

The county clerks went first—and promptly ignored the instructions. Instead, they immediately started to talk about voting-machine security and the fact that they are not getting the IT support they need. Then the League of Municipalities representative popped in with his question about the role of paper ballots in securing election results.

The WEC staff may not see the gorilla, but it was the first and only thing council members wanted to talk about.

In summary, this seems like a good bunch of sensible people. In addition, on my way out, I had a quick but solid discussion with Rydecki about some nuts-and-bolts details regarding the sort of risk-limiting audits that could work to secure Wisconsin election results.

So progress is underway, and I’m okay with that.

* * *

NOTE: After reading this blog post in mid-November, Assistant Administrator Richard Rydecki reached out to explain what had appeared to me to be WEC’s hesitance to include members of the voting public on the new Election Security Council. Our conversation was easy and pleasant and provides a window into WEC’s thinking about its various stakeholders.

The idea to form such a council is not new. In early 2019, the WEC created its first election-security advisory committee, limiting membership to county and municipal clerks. So in March, both Wisconsin Election Integrity and the League of Women Voters of Wisconsin publicly urged the WEC to seek election-security advice from additional stakeholders. We suggested that they either expand that committee to include public representatives (particularly those with security expertise), or to form a separate election-security advisory group with broader membership.

I cannot speak for the LWV-WI, but WEI received no response. If the WEC gave the proposal even momentary consideration, it was quickly forgotten. Rydecki made no mention of it when he explained that the idea for this new election-security advisory council arose in June, in discussion among government officials at a Department of Homeland Security training exercise.

Apparently, the officials who proposed its creation did not mention anything at the time about public members. Nevertheless, Rydecki said, WEC staff did consider how public input might be handled. Some clerks “were not terribly enthused” about having public members on the Council and might not have agreed to participate if public members were included.

One option, according to Rydecki, was that officials’ trepidation might be accommodated by allowing a short period for public comment at the beginning of each meeting, as the Elections Commission itself does.

But ‘professional courtesy’ required WEC staff to refrain from making a ‘unilateral decision’ on how or whether anyone who is not a government official would participate. So WEC formed the council exclusively with government officials and then presented it with the question of how or whether it would have public participation.

I’ll let the reader decide whether that information supports or contradicts the observations I made, above, about WEC’s attitude about citizen participation.