BLOG

Five Fatal Flaws in Dane County Election Audits

May 20, 2016 at 2:21am

Summary: Once again, something we hoped would be an improvement is much less than it appears. Dane County Clerk Scott McDonell has been saying that he now conducts voting machine audits after every election. But what might look like an audit to a casual observer is at best only a spot check. The county’s efforts follow neither GAB instructions for voting-machine audits nor national recommendations for election audits.  

The inefficiency of the county effort is astounding. The Wisconsin Election Integrity Action team, with only two hours of active vote-counting, completed our audit confirming the countywide April 5 outcomes in both the Supreme Court race and the Democratic primary (because we followed national authorities’ recommendations.) In contrast, McDonell’s idiosyncratic process kept his auditors counting for 7.5 hours in an effort that, at best, could confirm output from only two machines.

Worse, McDonell’s insistence on declaring election results accurate first and checking later means that the process cannot protect Dane County’s final election results from undetected miscounts. If such a delayed spot-check was to detect an electronic miscount, it would cause only chaos, unnecessary controversy, and possible legal action.

The following explains five of the flaws in McDonell’s process.


1 – The big problem–TIMELINESS

Certification of election results needs to mean something. We cannot issue certificates of election to candidates only to ask for their return two weeks later if we find an error. Statutes provide the county board of canvass with two weeks or so following every election for a very good reason: to make sure the results are accurate because they won’t be able to change them later. Final is final.

On April 13, 2016, Dane County Clerk Scott McDonell and the county board of canvassers certified the April 5 election results as final by signing their names to a statement declaring that they had reviewed the results and found them to be ‘true and correct.’ On April 20, McDonell asked several experienced poll workers to check to see whether or not they were.

What exactly is the point of auditing if results have already been certified? You cannot fix any errors you might find. And you won’t convince any suspicious citizens of the election’s integrity: No one is reassured when a public official checks information he has already sworn is accurate. 

Accuracy needs to be established during the canvass process, as part of that process. 

“Post-election audits must be completed prior to finalizing official election results.” Principles and Best Practices for Post-Election Audits

2 – Too few machines; miscounts might not be detected -VALIDITY

Spot-checking the accuracy of only two machines is good enough if the audit’s purpose is to create an appearance of careful management for casual observers. It also works if the purpose is limited to detecting malfunctions that uniformly affect every one of the 150+ machines in Dane County.

But if the purpose is to make sure that the voting machines identified the correct winners,* two machines isn’t enough. Election outcomes can be altered even when some machines count correctly. Overheating, dust and dirt, loss of calibration, and other malfunctions can affect some voting machines and not others. A corrupt insider with access to the voting machines’ memory sticks can tamper with some and leave others alone–in fact, some forensic experts say that not-everywhere-at-once fraud is the most likely kind.

That’s why national election-administration authorities, including the Presidential Commission on Election Administration, recommend risk-limiting auditing, a method developed by members of the American Statistical Society specifically for the purpose of confirming election outcomes–that is, who won. I won’t bore you with the details, but if you come to any of the Wisconsin Election Integrity Action Team’s Citizen’s Audits (the next one is scheduled for September 10, 2016), you can see it demonstrated.

Briefly: A random sample of either whole precincts or individual ballots is selected that is large enough so that the manually counted sample results can be compared to the electronically tabulated results and, with the application of a statistical formula, reveal the probability that the two counts accurately represent the same thing–the verdict of the voters. The sample size will vary depending upon how many ballots were cast and the reported margin of victory. (Closer races need larger samples than landslides.) If the probability is 99% (or whatever level of certainty you’re aiming for), the audit is complete. If the manual count of the sample does not produce 99% probability of accuracy, the sample size is expanded until the electronically tabulated outcome is confirmed as either correct or incorrect.

The point is to make sure that the audit confirms the election results, not just the output of a few  machines.

“The Commission endorses both risk-limiting audits that ensure the correct winner has been determined according to a sample of votes cast, and performance audits that evaluate whether the voting technology performs as promised and expected.” Report of the Presidential Commission on Election Administration

3 – No one can tell whether the auditors are accurate or inaccurate, honest or cheating – TRANSPARENCY

To provide confirmation that elections have integrity, the audits must also be confirmed to have integrity. Outside elections, auditors often provide that confirmation by being independent–having no stake in the outcome of the audit. But for election audits, no truly disinterested auditor exists because we all have a stake in the outcome. For that reason, election audits need full transparency. People other than the auditors need to be able to tell–for themselves–that the audit is being conducted honestly and correctly. 

Transparency means having written procedures (so that observers can tell the auditors are not just making steps up as they go along); secure internal control of the audit documents (to prove to observers that no one had an opportunity to alter or replace the audit records without being detected); and a way for observers to see that the tasks are honestly and accurately performed during the audit. 

The Dane County audits have none of those.

“Any election where all post-election activity is done in secret or in a manner that doesn’t support oversight and accountability will engender zero confidence in the electorate.”Transparency in Post-Election Audits 

No written procedures. With regard to written procedures, we can cut the Dane County auditors some slack. McDonell didn’t hire the chief inspector who is helping him develop the audit procedures until late December 2015, and they have conducted audits after only two elections–February and April 2016. They’re still working out the kinks, so I wasn’t surprised when observers at the April audit were given nothing in writing to help them know what the auditors were supposed to be doing. The auditors themselves weren’t provided with any. The reports that followed both the February and April audits contained after-the-fact written descriptions of what had happened, but both reports also contained recommendations that the procedures change before the next audit. 

Weak internal controls.  Professional auditors know that “internal controls” are those measures that ensure the records used in an audit can be proven to be true and complete. Most election workers in Wisconsin–at least those with no management or audit experience–know internal control only as “chain of custody.” Using what Joseph Hallof the Center for Democracy and Technology calls a “dotting the i’s and crossing the t’s” mentality,” audit-naive election workers consider that they achieve adequate internal control simply by following a prescribed ritual involving security bags and seals. Election records are placed in security bags, closed with numbered seals in such a way that the records cannot be taken from the bag without breaking the seal. Comparison of the seal number to a paper record upon opening the bag is intended to ensure that the seal has not been opened and replaced with another. Some commercial seals used are difficult but not impossible to defeat, but in Wisconsin little care is typically taken to make sure no one ever has solitary access to the sealed records during the time they are stored. I don’t know what security is provided to the paper record of the seal numbers.

McDonell’s amateurish appreciation of internal control shows in how he allowed his auditors to handle the records. In the February audit, which relied on digital ballot images, the chief auditor documented that he took the sealed bag containing the audit records home with him overnight, documented that he opened the bag and worked alone with the ballot images all night, documented that he resealed the bag in the morning, and then at the next day’s audit, the seal was ceremoniously broken in compliance with the ritual. This is Keystone Cops internal control: The auditor wasn’t documenting that he had no opportunity to tamper with the records; he was documenting that he had and in fact did. 

At the April audit, the naivete about internal control took another form. Observers were carefully informed that the paper ballots (no digital images in this audit) had been transported from Stoughton, where they were being stored, by two of the auditors. In states more knowledgeable about standard audit precautions, transportation is usually handled in a way that precludes any opportunity for the clerk’s employees to alter or substitute the records, such as by having representatives of opposing political parties accompany the ballots. Any citizen who was skeptical about McDonell’s motive for doing the audit would have just rolled his eyes when told the clerk had sent two hand-picked employees to retrieve the ballots, with no one to watch whether they switched out the ballot bags as they did.

Observers’ inability to observe. The first big violation of transparency came the day after the election, when the county clerk and the chief auditor selected the precincts in the privacy of the clerk’s office–randomly, they assure us. I don’t need to explain what’s silly about that.

Then, at the audit, the auditors insisted all observers stand at least three feet away at all times, and they employed no technology, such as document projectors, to make anything they were doing visible to anyone other than themselves. It’s not as if county election officials don’t know the importance of observation–Wisconsin recounts are conducted with members of the opposing parties viewing each ballot as it is counted. which ensures that no one has an opportunity to cheat or make mistakes. But the Dane County audits made no provision for anyone other than the auditors to see anything of consequence. To his credit, the lead auditor for a while turned his back to me as he held each ballot just above his head to read it. In this way he was allowing me, from three feet away, to discern where the votes were, even if I couldn’t read any of the names. No way could either he or I have kept that up for the entire 7.5-hour duration of the hand count.

But it wasn’t just observers who couldn’t observe enough to tell whether votes were being counted accurately–it was most of the auditors themselves! One vote-reading auditor would read the votes aloud as two other auditors made hash marks on a tally sheet, without ever seeing an actual vote themselves. The obvious flaw in this method is that it requires everyone to trust that the reading auditor is reading the votes honestly. Another danger (the one most often cited as the need for having more than one set of eyes on each ballot) is that the reading auditor can misspeak so that both tallying auditors record the the same error. That brings us to the fourth weakness….

4 – Insufficient safeguards to make sure it’s done right – RELIABILITY

When only one auditor sees each ballot, the audit becomes less of a test of the voting machines’ accuracy than a test of the one auditor’s ability to read votes aloud for hours and the tally-makers’ ability to keep hash marks accurately. And because the ‘votes’ that the tally-makers were recording were nothing more than spoken words, there is no way at the end of the audit to determine the source of any errors if the hand-count totals mismatch the machine-count totals. In fact, the auditors’ report from the April audit confirms what any experienced hand-counter would have predicted: Most candidates’ hand counted totals mismatched the machine counts (by only a little) and the auditors could only guess at the reasons.

THIS IS BASIC: A redundant count–having at least two people, if not more, read every ballot–is a standard feature of any reliable hand count procedure, including the one recommended by GAB for voting-machine audits.  

5- It takes much more time than it needs to – INEFFICIENCY

Auditors at the Citizens’ Audit, 10 days after the county audit, clocked themselves accurately counting votes at a rate of 100 ballots every 4 minutes. The auditors at the county audit didn’t time themselves, but you can calculate it from their report. In 7.5 hours of active counting, the faster of the two teams counted 1,186 ballots–a rate of 100 ballots every 38 minutes.

The difference is the citizens’ ability to use digital images instead of paper ballots, something the county auditors cannot do because McDonell insists on using impractical ballot-viewing software.

Now couple that with McDonell’s refusal to consider using the risk-limiting audit method recommended by the Presidential Commission. Following those recommendations, the citizens’ audit determined they needed to count 216 ballots, randomly selected from across the entire county, to confirm the outcome in the Supreme Court race and 524 ballots to confirm the Democratic primary result. In contrast, the county auditors set out to count 2,504 ballots. But because those ballots came from only two precincts, the county’s relatively extravagant effort could not have confirmed the countywide outcome in either race.

The combined effect of the two audits’ differences (digital images versus paper ballots, and statistical sampling versus whatever you want to call the county’s sample) is astounding. The citizens completed their audit of the Supreme Court race in approximately 30 minutes and the Democratic primary result in approximately 90 minutes. performing both random selection and vote-counting during that time. Having done the random selection weeks earlier, the county auditors spent 7.5 hours in active counting, and still did not confirm anything beyond the accuracy of two individual machines. To match the citizens’ audit result–confirmation of the countywide outcomes–using the county’s method would have required county auditors to count at least 6 more randomly selected precincts, likely taking them three more days.

How much of a problem is this inefficiency? If the county has enough money to pay a team of six auditors for 4 days’ work rather than two hours’, is that a fatal problem? Looking back at timeliness, validity, transparency, and reliability, I’m going to say it is.

  • Timeliness: It’s important to complete the audit during the two-week county canvass period, which places a premium on speed. 
  • Validity: You need to audit a sample big enough to confirm the election outcome, so excessive time-per-precinct makes validity more difficult in a limited amount of time;
  • Transparency: You want volunteer observers to show up to confirm the audit’s integrity, which means you cannot place too big a burden on them; and
  • Reliability: After two hours, human errors begin to creep in, and become more frequent as auditors tire.

The final report of the Dane County election audit can be found here.

The final report of the Citizens’ Audit is here.

 —————————————————————–

* The only purpose for the county audits I’ve heard McDonell articulate is to see whether the voting machines can count votes marked in different color inks. That’s naivete from any angle:

  • Unaware of the capabilities of his equipment? The DS200 machine was designed and manufactured to count any color ink, a capability that has been confirmed in testing for years, and does not change over time or among machines.
  • Unaware that Dane County’s municipal clerks do a reliable job of publicly demonstrating the machines’ capabilities in pre-election tests before every election? It doesn’t need his “double-checking.” Almost all the municipal clerks take care to mark their test ballots with a variety of different inks.
  • Unaware of what his own auditors are doing? If he did, in fact, instruct them to make note of the ink color in which votes were marked, they didn’t follow his instructions. Their methods wouldn’t have allowed them to detect the causes of any miscounts (ink color or anything else),  and their final report contains no mention of the question.

A Field Guide to Wisconsin Election Officials

State elections officials and their staff

In 2015, legislation was passed to abolish the nonpartisan Government Accountability Board and in 2016 to give its elections-administration responsibilities to a new commission appointed by the legislature, the Elections Commission. Many don’t realize, however, that the abolition legislation was aimed very directly at the Board itself and at the GAB director–and even then, the intention was more to weaken their ethics-watchdog responsibilities, not their election-administration responsibilities.  When the WEC replaced the GAB, it inherited its election-administration responsibilities pretty much intact. The new Elections Commission is designed so that it will more easily deadlock–its members are appointed to represent partisan interests, where the old board was selected for nonpartisanship to represent the public interest. But so far (March 2017), the new Commission has largely conducted itself well.

It’s helpful to distinguish between the Board or commission and its staff. The board’s authority over local election administrators, particularly elected county clerks, is much more limited than most citizens assume, and as a result it does not take initiative to investigate the quality of Wisconsin elections or to propose improvements.  

However, because its staff provide training to local election officials, those officials often turn to them for guidance about elections administration. This gives the staff more control over elections administration than is apparent by reading the state statutes.

The state agency’s statutory duties for elections include a lot of forms development—basic requirements for ballots, reporting forms, etc.—and responsibilities like certifying which candidates have completed the requirements to be on the statewide ballot. No voting machines may be used in Wisconsin unless the manufacturer and model have been reviewed and approved by the state agency. The WEC certifies statewide election results as final, but does not check accuracy before certification.  

One big state responsibility—one WEC does generally well—is educating voters about the elections process and results. Visit their website, follow links from that page, and you will be able to find the name and contact information for your local elections officials; read through all the instructions manuals that clerks use to run elections; find precinct-level results for recent elections, and more. One caution: detailed information such as the list of types of voting equipment used in each municipality can be outdated.

County clerks (and their sidekicks, the County Board of Canvassers)

County clerks are elected officials who serve four-year terms. It’s a partisan office, but do not assume that any individual clerk is an active partisan until you get to know him or her. Although clerks can be pressured by their political parties, their job is not the sort of policy-making position that tends to attract ideologues. Most county clerks just want to do a good job—one that includes making sure elections are honest and fair.

County clerk is a full-time job. Elections administration is one of the clerks’ biggest jobs, though their responsibilities vary among counties. County clerks have surprisingly little responsibility on Election Day itself. Their work comes mostly before and after Election Day—things like getting the local ballots approved by WEC and getting them printed. After municipalities have sent in their election results, county clerks send the results to the WEC. Most municipalities also rely on the county clerk to store elections equipment and records such as marked ballots and registered voters’ voting records between elections.

Because of their responsibilities related to ballots and election set-up, county clerks have developed the lead role in selecting the voting machines for the municipalities within their county, although the municipalities purchase the machines.

The Board of Canvassers consists of the county clerk and two qualified voters from the county selected by the county clerk, one of whom must be a member of a political party other than the clerk’s. The county board of canvassers has the only statutory responsibility assigned to anyone for making sure votes were counted accurately, and even that isn’t as clear as it should be. The county board of canvassers must, at some time during the week following an election, meet and “open and publicly examine the returns” from the municipalities. If the board notices that “any of the returns received are so informal or defective that the board cannot intelligently canvass them,” they must return the election reports to the municipality to be cleared up.

Municipal Clerks (City, Village, or Town)

Municipal clerks DO MOST OF THE WORK!  They are nonpartisan elected officials (usually in the towns and smaller villages) or employees appointed by the municipal board. Only in the cities and larger villages is the position full-time, so many municipal clerks—particularly in the townships–have other day jobs and do the municipal work in their spare time.

Municipal clerks have most of the rubber-on-the-road responsibility for running our elections. They handle voter registration; recruit and train poll workers (called ‘chief inspectors’ and ‘elections inspectors’). They choose the polling places; purchase the voting machines and store them between elections; and distribute absentee ballots. The municipal clerk is responsible for making sure the voting machines are tested, set, adjusted, working correctly, sealed, and certified at the start of Election Day.

With their inspectors, municipal clerks set up the polling places and operate them all day. They make sure the events on Elections Day that might affect the vote-count are documented; oversee the counting of the votes; complete a ‘canvass report’ describing how the election went; secure the ballots; and transmit the canvass report and election returns to the county clerk on election night.  Municipal clerks also appoint boards of canvassers, but the tasks of the municipal board of canvassers are relatively limited and often carried out on election night right at each polling place.

Despite their substantial statutory responsibility for the entire elections process—including the counting of votes—municipal clerks tend to defer to county clerks’ leadership and advice, and county clerks defer to WEC staff. However, if a local election official knows you as a local voter with an ongoing interest in accurate, transparent elections, chances are that any request you make to view election records (including ballots) and to observe procedures (even those that are not specifically identified in statute as an opportunity for public observation) will be sincerely considered and frequently agreed to.

Further reference

Wisconsin election statutes –  Don’t be intimidated. They are not bedtime reading, but people with less intelligence than you have read and understood them. 

That link goes to Chapter 5, General Provisions; Ballots and Voting Systems. Change the ‘5’ in that website address to read the other chapters:

  • Chapter 6, Electors (who may vote, voter registration, the voting process, etc.);
  • Chapter 7, Election Officials and Boards;
  • Chapter 8, Nominations, Primaries, Elections;
  • Chapter 9, Post-election actions; Direct Legislation  (recounts, recalls, and referenda);
  • Chapter 10, Election Dates and Notices;
  • Chapter 11, Campaign Financing; and
  • Chapter 12, Prohibited Election Practices

Election Administration Manual

This manual is the main reference document for all local elections officials and citizens who want to know how elections are run in Wisconsin.

Election Day Manual

This manual is the clerks’ step-by-step instructions for Election Day. If you observe at the polls, print this out and take it with you.  You can also find this document by going to http://gab.wi.gov/elections-voting and clicking on “Legal resources,” then clicking on “Click here to access the Election Day Manual,” then scrolling down until you can click on “Election Day Manual.pdf”

Information and instructions for citizen observers

Read these instructions before you observe at any polls, and follow them. They are not difficult or complicated.




Follow Wisconsin Election Integrity on Facebook!

Report on the Dane County Canvass: 99.6% unverified

April 14, 2016 at 1:29pm — I observed Dane County’s post-election canvass of the April 5 election results from start to finish this year–all 19 hours over 4 days.

No surprises: As usual, both the municipal and county canvasses checked and double-checked to make sure the right number of BALLOTS had been counted. However, the Board of Canvass (County Clerk Scott McDonell, Democratic Party representative Gretchen Lowe, and Republican Party representative Joyce Waldrop) certified Dane County’s election results at around 3:30 PM on Wednesday, before any one had done anything to verify that the correct number of VOTES had been counted.

The votes of 234,681 Dane County voters (99.6% of the total) were certified based only on unaudited computer output. Vote totals are now no longer subject to change or correction.

The other 859 ballots were late-arriving absentee ballots and approved provisional ballots, which had been publicly hand-counted by the municipalities. The last two days of the county canvass were devoted to making sure the votes from those 849 ballots were added to the correct candidates’ totals.

Got that? Half the canvass effort to ensure the accurate counting of only 0.4% of the votes.

Over four days, County Clerk McDonell maintained the minimum transparency required by law. Any observers who were already familiar with the statutes and GAB guidance for county canvasses (that would be me) could follow along reasonably well, but anyone else would have been out of luck in terms of understanding what the canvassers were doing or why. McDonell provided no written procedures or standards–not even to the members of the board. Neither did he explain what they were doing as they went along; allow questions from observers; or provide observers with copies of anything the canvassers were looking at, or make it visible to them in any way such as by projecting it on a screen.

“Just guess” was the unspoken message to the public. Finally, he restricted any public comment to five minutes at the end of the four-day-long meeting. 

It got this bizarre: At the end of the four days, I asked if I could ask a question and was told I could make a five-minute statement and that was it.  (McDonell claimed that to answer a question for the public would be a violation of open meetings law.)

So the official public comment at the county canvass started with this awkwardness coming out of my mouth: “I noticed an agenda-less canvass meeting on the county calendar for 10 AM on April 20. I assume that is the digital-image audit you’ve been promising. I hope you will let me know if I am right or wrong in that assumption.” 

I’m not making this up: McDonell didn’t even nod yes or no.  And when Waldrop wanted to respond to my comment, he wouldn’t allow that, either. 

This created something of a Mad-Hatter-Tea-Party feeling to the event, since it was basically just four of us sitting around a table in a conference room in the City-County building, sharing Girl Scout cookies from McDonell’s daughters. The canvassers and I would chat whenever McDonell left the room, but when he was present they had to pretend I wasn’t there, as McDonell himself did.

I left them with a letter, which I’ve uploaded here.  It’s kind of wonky–I wanted to address them as professionals who know and care what words like ‘risk,’ ‘prioritize’ and ‘verification’ mean. I could see that at least Lowe was reading it carefully, and she asked me a few sensible questions after the meeting adjourned. The main points of the letter are:

  • they spend most of their time addressing risks that are much more remote than the risk of electronic miscounts, or that address no risk at all–such as reviewing vote totals in uncontested races for which it would be impossible for them to certify the wrong winner; and
  • they also spend time on tasks that don’t need to be completed before they certify the election results, such as discussing individual municipalities’ Election-Day practices for keeping track of the number of voters.

And yet they tell us they have no time to check the accuracy of the computer-generated vote totals–which cover 99.6% of the votes.

My request to them wasn’t anything dramatic: I simply urged them to consider risk and timeliness when they decide what to do during the canvass, and told them if they thought about it that way, it would be obvious that verification of the computer output is more important than most of what they are doing now.



As I sat listening to them recite numbers for four days, I visualized the following graphic, which shows:

  1.  The steps by which our votes are turning into final election results;
  2.  The parts of this process that are verified by the current county canvass procedures; and
  3.   The parts of the process that are verified by the type of audit we’ve been demonstrating in our citizens’ audits.

Results from Citizens’ Audit of Feb. Supreme Court Primary

March 14, 2016 at 12:20pm — Just a quick post to share the results from Saturday’s Citizens Audit of Dane County’s voting-machine output in the February 16 primary for Wisconsin Supreme Court.

I’ll expand this blog post later with more detail (post any questions in the comments section if there’s something specific you want to know about), but right now I’m in a hurry to get the summary report out and get to work on the more detailed report.

One of the things we are trying to do is to demonstrate what a good, transparent, public post-election audit would look like–and that includes prompt and thorough public reporting of the findings. (Something the Dane County Clerk does not do. He says he routinely performs post-election audits, but if you’ve even seen him publicly report any findings from those audits, I’m afraid you were hallucinating. Hasn’t happened.)

Anyway, here’s our report of what we did and what we saw in Saturday’s audit, and now I’m back to work writing the more thorough report. 

Report on the Development of Procedures for Verifying with Digital Ballot Images

January 14, 2016 at 1:46am — It’s time to start gearing up for the citizens’ audits that will verify the electronically tabulated results of the 2016 elections, in Dane County and any other Wisconsin counties where people want to join the effort to improve management of Wisconsin’s elections technology.

Almost all large Wisconsin counties now use voting machines that automatically, immediately preserve a digital image of every ballot.

In any of these counties the county clerk or involved  citizens could choose to use the images in astoundingly efficient, transparent manual counts to verify the accuracy of the voting-machine output.

The Wisconsin Election Action Team demonstrated the method after the February and April elections in Dane County last year, and will be conducting similar public demonstrations after the 2016 elections. 

We have released a report that describes the procedures, benefits and risks of Using Automatically Created Digital Ballot Images to Verify Voting-Machine Output in Wisconsin. (Catchy title, that!)  In this report, you will find: 

  • A technical description of the digital ballot images created by the ES&S DS200 and a picture of one of the images;
  • A layperson’s description of ‘risk-limiting auditing,’ the technique that allows audits to count just a sample of the ballots while still achieving statistical certainty that the correct winners were identified (or not);
  • A step-by-step description of an efficient, transparent process for conducting a citizens’ audit; and
  • A frank discussion of the limitations and risks of using digital ballot images for this purpose.

Please pass this along to your friends who live in Dane County and encourage them to mark their calendars for Saturday, March 12, to attend a public, transparent post-election audit that will verify Dane County’s results in the February 16 Supreme Count primary and perhaps a few other races. The location wil be announced later–follow Wisconsin Election Integrity on Facebook.

Residents of other Wisconsin counties, please read this report and consider whether you could help to organize a similar citizens’ audit in your own county, particularly if you live in one of Wisconsin’s larger counties that use optical-scan voting systems. If you can, please contact us at WiscElectionIntegrity@gmail.com, and we can provide you with the necessary software, instructions, and pointers.

How do good people go so wrong? What can we do about it? Lessons from the Volkswagen fraud

December 31, 2015 at 3:13pm — Dozens if not hundreds of Volkswagen employees must have known of the recently detected emissions software fraud  that continued for six years and affected 11 million cars around the world.

And yet the fraud was not revealed by a whistle-blower; it was discovered by outsiders.  How could Volkswagen management have coerced so many otherwise reasonable, ethical people into silent cooperation over so long a time?  Or did they deliberately hire only crooks?

I’m writing about the Volkswagen fraud in this blog because it raises two big questions relevant to elections: First, is it plausible that voting machine companies could perpetrate a similar sort of fraud?  Second, is it plausible that their customers, local election officials, wouldn’t notice?

Now, I don’t run around claiming fraud I cannot prove. I have a natural-born skeptic’s aversion to making accusations without conclusive evidence. Years working at Wisconsin’s Legislative Audit Bureau—an investigative and oversight agency–only sharpened that instinct.  At the same time, my hard-wired respect for hard facts also makes me dubious about election officials’ claims that they can ensure 100% correct results every time without routine verification. No other computer-dependent manager makes such an extraordinary demand on my trust.  I am acutely aware that when it comes to electronic elections fraud, the only elections we are sure were not miscounted (arguably) are the very few that were recounted. Considering what is at stake, that is a very serious problem.

Back to the questions. First, with regard to the voting-machine companies, the Volkswagen affair clearly demonstrates the plausibility of systemic fraud by companies that manufacture, sell, or service computerized equipment, whether it’s cars or voting machines. Fraud is particularly feasible when they demand proprietary secrecy for their software, and when they sell their product to consumers who have no particular information technology expertise–like local government election officials.  

For example, a voting-machine company could routinely install clandestine wireless communications capability on each of its voting machines, in case the company ever feels the need to fix a bug (or an election) without the knowledge of local election officials. The vendors know that local officials never inspect the equipment in any way that might discover the chip, because they don’t want to appear to be ‘tampering with the machines.’ (See footnote.)  And IT experts tell us that is only one of several ways voting-machine company insiders could alter election results if they chose to.

With regard to the second question—the local election officials’ willingness to allow possible fraud to go undetected: That’s readily answered. We know they are willing.  They grant vendors proprietary secrecy for their software, so no election official ever inspects the vote-tabulating software loaded into any machine. And yet, knowing they did not and cannot inspect the software, the vast majority of jurisdictions—including all Wisconsin counties—routinely neglect to verify the accuracy of electronically tabulated results. My previous post in this blogdescribed the puzzling refusal of many officials even to learn about their practical options for detecting miscounts.

But why?

In a well-researched and well-written article in the most recent Atlantic Magazine, What Was Volkswagen Thinking?, business journalist Jerry Useem provides insight into both the corporations and their customers.

Using examples of actual corporate conduct both good and bad, the article explains how otherwise ethical employees of a company, such as a voting-machine company, could go for years without saying anything about their machines’ hack-ability, and why otherwise responsible election officials could choose to trust the machines’ Election-Day accuracy based on nothing more than a determined will to believe.

People within an organization, Useem explains, fall prey to “a cultural drift in which circumstances classified as not okay are slowly reclassified as okay.” In response to pressures and expectations in their workplace, otherwise competent people come to see careless conduct as admirable flexibility. They begin to tolerate excessive risk-taking as if it was creative experimentation. Withholding damaging information starts to feel like prudent discretion. Actual fraud is mentally redefined to be practical adaptation to circumstances.

The derailment usually starts at the top. Useen notes the obvious: in many cases, management is simply dishonest, as seems to have been the case with Volkswagen, and as many election-integrity activists fear when they point to voting machine companies owned by active partisans.

But management might be honest and just as genuinely self-deluded as their employees. Upper-level management might have made ‘fantastic commitments’ without being aware that the company’s employees could not fulfill them without cheating. From my own experience with contracting and procurement, I also suspect impetus to cheat can arise from customers’ demands.

For example, one Wisconsin county clerk has written he does not allow updates or patches to that county’s voting-machine software. If this is true, it’s easy to see how the vendor would be tempted to install wireless communications capability in that county’s voting machines. And why not? The company needs occasionally to update and patch the software, and the county clerk will never discover the communications chip. It would be the only way the company could keep the machines up to date without upsetting the clerk. And once that chip is there, every employee who knows about it is on nothing stronger than an honor system not to alter the election results, because output isn’t routinely verified in Wisconsin.

Once expectations are clear, employees will try to conform their behavior. And that behavior is comfortable only when they also bring their perceptions and beliefs into compliance.

For example, an in-depth study following the Challenger space-shuttle explosion found that engineers had observed O-ring failure–the cause of the disaster–in many previous tests; had reported it; and had repeatedly been pressured to endorse more risk as acceptable. Compliantly, they had rewritten their reports to approve looser and looser standards. Then, just before the fatal flight, freezing temperatures convinced the engineers to issue a “No Launch” recommendation. However:

“The data they faxed to NASA to buttress (their no-launch recommendation) were the same data they had earlier used to argue that the space shuttle was safe to fly. NASA pounced on the inconsistency. (Faced with the) script they themselves had built in the preceding years, (the engineers) buckled. The “no-launch” recommendation was reversed to “launch.”

Useem explains that the engineers and managers “were not merely acting as if nothing was wrong. They believed it, bringing to mind Orwell’s concept of doublethink, the method by which a bureaucracy conceals evil not only from the public but from itself.”

That could explain why so many otherwise responsible election officials seem to shut down when you try to talk to them about examining voting-machine output for accuracy. We look at them and think, “You’ve got so very much invested in the elections—all those security measures, all those pre-election tests–how could you not want to check to make sure everything came out right on Election Day?”

But they look at all their hard work and think, “I promised everyone it would work. My career will be over if it doesn’t work. It’s got to work. I’m sure it worked.” Useem explains what happens next:

Even without stress, people tend to underestimate the probability of future bad events. Put them under emotional stress … and this tendency gets amplified. People will favor decisions that preempt short-term social discomfort even at the cost of heightened long-term risk.

So how do we help election officials break out of this mindset? How do we increase their fear of a ‘future bad event’ that could cause them ‘short-term social discomfort’?

Oddly enough, it is not the risk of a miscounted election occurring that causes their fear; it is the risk of a miscount being detected. Most computer-dependent managers–not election officials–realistically expect that if they do not catch a computer error, someone else will. For them, routine audits reduce fear. But miscounting voting machines don’t blow up like space shuttles, and candidates cannot take voting machines out for test drives between elections. Therefore, in the absence of post-election verification, election officials have no realistic fear of anyone discovering a miscount. The idea of an audit has the opposite effect on them: their fear goes from nothing to, well, something.

That’s why transparent, high-quality citizens’ audits are critical. Even if they cannot be completed before the identified winners are sworn into office, they will still serve a useful purpose of increasing election officials’ realistic expectation (okay, fear) that any miscounts will be detected—if not by them, by someone else.  That will create for them the same discomfort felt by bankers, city treasurers, grocery store owners, and all the other computer-dependent managers who fear embarrassment or worse if they don’t notice the computer error and correct it before someone else does.

Note:   I know of no requirement that anyone inspect Wisconsin’s voting machines to verify they have no wireless communications capability. Over the years, I’ve asked several Wisconsin election officials if they inspect the machines anyway and have not had any tell me that they do. If anyone reading this has any first-hand knowledge of any local officials’ inspection practices that include checking for wireless communications capability, please email me at WiscElectionIntegrity@gmail.com.

Local clerks’ excuses for not talking about election audits

December 20, 2015  — Before I retired, I worked in quality assurance for a program that delivered health care in clients’ homes. It was a human-services government program, so the provider agencies never had more than a a shoestring budget. Rarely was there only one right way to do anything.

Whether because of or in spite of that, most managers were willing to think and talk about quality improvement.

But there were always a few mangers who reflexively insisted, “Everything is already as good as it can possibly be, and I don’t need any new ideas.” 

Now that I’m working in election integrity, I’m seeing a lot more of that second type of ‘manager’.

Verifying computer output shouldn’t be a novel idea. Wisconsin statutes require clerks to keep an ‘auditable’ paper record of every ballot, not a ‘decorative’ one, so we can safely infer that legislative intent had something to do with checking accuracy. No sensible person doubts the need to check accuracy, whether the output is our property tax bills or our election results. 

Responsible election officials can converse about the practicalities: How many ballots do we have to examine before we can be confident we’ve identified the right winners? How can we do that in the time available? If I innovate, what opposition can I anticipate and who is willing to back me up?

Those managers’ conversation focuses on reasonable problem-solving, not excuses for inaction.

But there are many election officials who, when they catch even a gentle breeze of change, batten down the hatches as if expecting a hurricane.

Late last month, I sent a for-your-information letter to each of the 61 municipal clerks in a county where we’re working on raising awareness of the need for verification and its practical solution.

Because many are sensitive to any hint of criticism, the letter made it clear that we were asking for change in only county procedures, not municipal ones. In describing what we would be asking of the county, I chose the most respectful, non-threatening, benign words possible without misleading them about the fact that we are asking for improvement.

The letter ended with an offer to visit the municipal clerk, at his or her convenience, to talk more about the issue.

Two weeks later, I found one response in my email inbox. After a few comments that revealed significant naiveté about the inherent limitations of the local clerks’ IT security measures, the municipal clerk wrote:

I tire of these subtle (and sometimes blatant) indictments of a system where it is obvious that no one has taken the time to confer with the clerks first. Instead, they pattern advice on what is assumed to be true.  Also, I get the impression someone is prepared to sell us some proprietary software to “fix” a non-problem.

Well, at least he responded. That put him ahead of the other sixty municipal clerks.

The devil on my shoulder wanted to respond by calling the writer’s bluff by pointing out that if he was genuinely willing to confer, he could have accepted my offer to meet rather than complain that we’d never met. 

But I shushed that suggestion. In my actual response, I explained some of the basics of prudent IT security as briefly as I could.

I did not bother to reiterate my offer to meet with him, and I don’t expect to hear back. When someone has boarded up all his mental doors and windows, my guess is that the best thing is to let him calm down in silence until he realizes there won’t be a hurricane.

The disheartening thing is that the people who are open to the breezes of change are not those who are in a position to implement improvements.

Voters and poll workers, to start with, are very interested when they learn that election results could be made safe from electronic miscounts. They know how much they have invested in elections, and how tragic it would be to lose it all to a computer glitch, when such a loss could easily be prevented. 

State and national officials are interested, too. It’s the national authorities’ recommendations that we’re trying to get local elections officials to heed.

Last July, when we gave a public demonstration of an efficient new verification method, attendance at the event included the director of the state Government Accountability Board and his chief elections manager; the director of the state League of Women Voters; and a nationally-renowned, federal-government-advising expert on election technology and computer-science professor from a neighboring state.

From within a 30-mile radius, we had also invited 3 county elections officials, 37 county board supervisors, and 61 municipal clerks. Not one of them showed up. Not one.

Among the I-have-a banana-in-my-ear responses I’ve received from local officials over the past few years:

  • Every professional version of “I’m planning on washing my hair that night.” If an election is coming up within two months, they are too busy preparing to talk. If an election is more than two months away, they will be willing to talk about election administration issues when they are more timely.  The City of Madison municipal clerk begged off attendance at one public meeting by saying she’d be too busy registering voters—at 8:00 PM. (She has a staff of seven.)
  • They’re just so busy with everything else all the time, they cannot even read the invitation. One county board supervisor told me not to expect a response from any other county board supervisor because “We get so many emails we don’t read them.”
  • It’s not my job: “You don’t need to talk to me because I’m (not on that committee; not in the majority; from a neighborhood too affected by Voter ID…).”
  • And, of course, silence.

This cannot go on forever. We will get their attention somehow. For all our sakes, I hope it’s before the next serious electronic miscount gives us cause to shout “I told you so!”

What cardboard skeletons teach us about voting-machine security

December 12, 2015 at 8:24pm — Our local election officials do the best they can with voting-machine security–really, they do. They might or might not understand the dangers of illicit installation of wireless communications chips or software tampering, but they all know they need to keep those machines safely locked up between elections in town hall storage rooms, village police garages, and various other secure compartments.

I cannot count the times that local elections officials have earnestly reassured me of their diligence about that, and I sincerely believe every word. It seems rude to remind them that no matter how hard they try, they cannot count on having complete control, so I try to be gentle when I tell them that they still need to check the output for accuracy, just in case.

But one Connecticut town clerk got the message loud and clear when she went to retrieve the voting machine for an upcoming election and, to her great dismay, found it festooned with crepe paper and cardboard skeletons. One of the town board members had accommodated a local high school club’s request to use the town hall for a Halloween haunted house evening and had borrowed the janitor’s key ring for the event. The dusty, dark storage room made a perfect place for the skeletons.

That Connecticut elections clerk retired to Wisconsin, and I ran into her at a party tonight. Her story was the most humorous I’ve heard, but it’s unusual only in its colorful details. A Wisconsin county clerk once told me of returning from vacation to find the door to the room where the county election-management computer room hanging wide open. The county executive told her the cleaning crew had decided to take her vacation as an opportunity to clean that room. He apologized that they’d neglected to close the door when they left, but neither he nor the county clerk had realized the cleaning crew’s master key worked on that door, too.

Towns, villages, and cities are run by normally competent and well-meaning people who generally do the very best we can expect of them. But management tasks are frequently handled by part-time employees or even volunteers, and executive oversight is provided by local elected officials who often have even less training and experience.

We cannot imagine we can protect our voting machines from tampering simply by demanding local elections officials maintain fool-proof security programs. It’s just not within their power.

Transparent, rigorous post-election verification of voting machine output remains the only way local elections clerks, candidates, and voters can be sure that the machines performed accurately on Election Day–or discover if they did not in time to correct the output.

Reality Bites: Election Officials’ Remarks on Voting Machine Reliability

October 15, 2015 at 1:24pm — If some genie were to happen by and offer me three wishes, I fear that before world peace, I’d ask to understand our election officials’ lack of interest in verification, when I’m sure they all have the sense to know why banks audit to make sure their computers credited deposits to the correct accounts. It puzzles me deeply. 

Yesterday. The chairman of Wisconsin’s elections authority, the Government Accountability Board, was testifying before a legislative hearing to defend the agency’s continued existence. One of his Republican executioners confronted him with the fact that the GAB had, for many years, neglected to perform statutorily required post-election audits. How could the Board, the questioner badgered, assure Wisconsin residents that their voting machines had counted correctly if they never did post-election audits?*

GAB Board Chairman Judge Gerald Nichol responded–right out in public, on the record, and apparently without embarrassment, “It is true we did not do the audits, but I don’t find that too worrisome because our staff thoroughly tested the systems before they were approved for use in Wisconsin.” 

And–I’m not making this up–that answer appeared to satisfy his questioner. 

Imagine what Judge Nichol or the legislator would have said if a banker testified, “We never audit, but I don’t find that too worrisome because when we bought those computers, we tested one to make sure it was capable of counting correctly.”

The over-the-top ridiculousness of that statement would be immediately evident to either of them in relation to a bank’s computers, but neither seemed to think it in any way remarkable when the output in question was our election results.


Today. I went to a large-group training where about two dozen municipal clerks were in attendance. I had several opportunities for one-on-one chats, and I used them to feel a few officials out about their level of awareness of voting machine accuracy. I’ve learned to start such conversations with praise for their efforts in double-checking that the machines counted the right number of ballots–which they do quite well.

“I’m conducting sort of an informal survey about clerks’ thoughts on voting machine accuracy,” I would start. “I know you know for a fact that the machines always count the correct number of ballots–you’ve got that nailed down. But what’s your level of trust that the machines counted the right number of votes?”

Most conversations go one of three ways from there. The worst conversations don’t even get started (two tonight, but I’ve gotten this reaction on other occasions). The question explodes some landmine: “Our voting machines are accurate! We test and double test and maintain the very best security. Our election results are always accurate, I’d bet my life on it.” Any follow-up question (e.g., Can you tell me what gives you that confidence?) will be met with only more anger, and the clerk or poll worker will walk away. The Topic Must Not Be Raised.

The second typical response is less emotional, but no more productive: Some election officials will be unable to understand the question no matter how you phrase and rephrase it. It’s as if you are asking “What do you do when the sun comes up in the west?” They mentally rephrase the question into something that makes sense to them and start talking about that. The elections official will describe the process for checking that the machines counted the right number of ballots, and I’ll politely wait until she is done, and then ask the question again more specifically: “Yes, but how often do you think the number of votes–that is, the number of votes for Jones, and the number for Smith–are correct or incorrect?” The elections official will repeat the explanation about verifying the number of ballots, or tell you how the machines reject over-votes, or how they check their addition during the municipal canvass, or some other thing. I’m usually the one that ends these conversation, because I start to feel I’m being mean.

The third most typical response is that they ‘correct’ the question rather than answering it. In a you-should-know-this tone, they will say something like: “The machines cannot miscount,” or “Accuracy is the county canvass job.”  I had two of these conversations tonight. They don’t go anywhere, either. Once this type of election official has decided you are just naive, they switch to an all-talk-no-listen mode. 

Of seven or eight conversations I started tonight, only one unfolded into a genuine exchange of information. The clerk responded to my question with, “I would say I’m pretty close to 100% confident, but it does bother me we don’t know for sure. I’ve never discovered any miscount in the pre-election test–that’s what gives me confidence–but I know that doesn’t guarantee they’ll count right on Election Day.”  Wow. Town of York voters, you’re in sensible hands. 

For the life of me, I cannot understand this mental block. It would be easy to say “People are naive about computers,” but this level of blindness affects their thinking about only voting machines–no other computers. 

Some sort of reflexive emotional-defense denial is a possibility–the thought of incorrect election results is just so horrifying that they cannot permit its presence. Maybe, but most of an elections official’s work is dedicated to preventing various mistakes and frauds. It’s simply not believable to me that they could not already have accepted the idea that something could go wrong.

Different officials probably have different reasons. For example, it seems that those who react immediately with anger, taking offense that you would even ask about electronic miscounts, are at some level aware that they might be certifying inaccurate totals–otherwise, why would they be so defensive?

But the others–I genuinely cannot guess.

—-

* Just for the record, with the audit procedures the Board uses, final Wisconsin election results are unprotected against electronic miscounts whether the Board does the audits or not. Even if they had done them, their procedures are not designed to detect and correct incorrect election outcomes. Among other problems, they use a too-small sample size and have no provision for expansion of the audit beyond a single precinct if a miscount was discovered. The audits are performed after election results are certified as final, so unaudited voting-machine output determines the ‘winners’ regardless.

Abnormal psychology? No, just normal human foibles.

June 07, 2015 at 10:55pm — This weekend, the Wisconsin Grassroots Network allowed Wisconsin Election Integrity to use part of its booth at the annual state Democratic Convention. With a colorful pamphlet titled “How to Steal Wisconsin Elections” on one side, and “How to Protect Wisconsin Elections” on the other, I was able to start good conversations with more than 100 people, a large number of them involved in local elections administration in some capacity—mostly as poll workers or board of canvass members.

In general, the Democrats were skeptical whenever I offered the pamphlet with the “How to Steal” side up asking, “Want to know how to hack voting machines? The Republicans know, so you should, too.”

 But when I turned the pamphlet over to reveal the “How to Protect” side, they were  receptive, confirming my sense that people are tired of being told about problems they cannot solve, while they are ready to welcome constructive information about solutions. 

Their reactions, after I’d given them the election-integrity elevator speech, confirmed that politically active people, like everyone else, typically assume our election results are routinely checked for accuracy and are shocked to learn they are not. Like all other sensible digital-age people, they immediately grasp the carelessness of that practice.

During the entire two days I staffed the booth, all but one of the conversations went very well, often ending with the person asking for more literature and promising to talk to their county clerk when they got home.

I ran into only one person who vigorously argued with me, and I hope you’re as disturbed as I was by who it was—or might have been.

After taking the pamphlet with a frown, one man listened to my short speech and flatly told me I was wrong. Voting machines are reliably accurate, he said, and he should know: Before he retired, he tested voting machines for the Wisconsin Government Accountability Board and for the State Elections Board before that.

I realize he could have been misrepresenting himself, but he might not have been. I recognized the GAB staff attitude toward citizen input and the talking points.

As he argued, he revealed either that he was painfully ill-informed about voting machines and IT security, or that he thought I was and could be distracted with misinformation.  It was hard to tell.

For example, when I explained that the hacking information in the pamphlet was based on the findings of a national panel of voting-machine security experts, he said something along the lines of “The national experts’ findings are not applicable to Wisconsin. Wisconsin’s voting machines are programmed individually for each county—no hacker could get to all of them.”

I gently laid out the obvious logic for him: “A hack wouldn’t need to affect all the machines everywhere. Mathematically, you could change a statewide outcome merely by making one big county already likely to go for your candidate go even more decisively. Pundits will simply say, “Oh, wow. That party did a great get-out-the-vote effort in that county!” 

“And besides, the national experts says that the most likely, most dangerous hack would affect the source code, not the set-up for each election. It’s the set-up that is done separately for each county–mostly by a few vendors. And the source code is programmed exclusively by the vendors.” 

But he doubled down and insisted the source code is programmed individually into each voting machine by the counties.

We had drawn a few witnesses by now, so even though I suspected he knew it, I gave the basic explanation of the difference between programming the voting machine and setting it up for each election. (“When you get a new cell phone, it comes with lots of programming deep inside that neither you nor the salesperson touch as you set the phone up with your phone number and contacts.”)  

I reminded him that the source code must be tested by independent laboratories and approved by the federal government and that once it is approved, no one is allowed to make changes.  If the voting machines’ source code is being “programmed individually,” as he claimed, someone is breaking the law. The speed with which he gave up that line of argument indicated to me he knew that all along.

He then tried the recount defense—claiming that if anyone suspects election results are wrong, they can demand a recount. Again, not knowing whether he was genuinely naïve or was hoping I was, I explained Wisconsin recount law to him. He finally conceded, “Well, yes, they would have to pay for the recount.” 

When I asked, “Would you trust a bank that refused to audit until someone suspected a problem, and even then, demanded that the person who suspected a problem paid for the audit?”, he moved on to his next point. We then danced through a set of well-worn arguments.

He: Local election officials store their machines securely.

Me: Local election officials have no control over the security of the software while it is with ES&S, Dominion, and Command Central, where it is most at risk.

He: But those companies have wonderful, effective security.

Me: Wisconsin election officials have no way to know what sorts of security those companies maintain. We do know they would be in the IT-security consulting business if they could do IT security better than Anthem, eBay, Target, and Sony.

He: There are no miscounts.

Me: (StoughtonMedford.)

He: Well, those should have been caught in pre-election voting machine tests.

Me: Correct, but they were not. That’s why every human language has a word for ‘mistake,’ and why we need routinely to check Election-Day output for accuracy.

He: But it makes no sense to assume the computers are miscounting.

Me: Correct, in the same way that it makes no sense to assume they are counting accurately. And if we decide it’s not a good idea to assume, we need to verify. Your municipal treasurer does not assume she’ll find errors when she routinely spot checks the computer-generated property-tax bills before putting them in the mail. But she does it anyway because that’s what prudent managers do.

He: There’s not enough time or money for full recounts.

Me: No one is talking about full recounts. If you’ll stop arguing for a moment, I can tell you about sampling and risk-limiting auditing.

He: But you cannot assume any sample is representative.

Me: Correct. That’s why you calculate probability.

Of course, the conversation ended before he accepted the common-sense national consensus on routine verification of voting-machine output—but that was what I expected. You can tell when someone is engaging in sincere let’s-share-what-we-know conversation and when they are simply staking out a defensive position and reflexively contradicting everything you say. He was clearly doing the latter, so I let him leave when he ran out of breath. Who knows—maybe he went to his hotel room that night, gave the matter some sober thought, and moved slightly toward acceptance.

After he left, the handful of people who had been entertained by the exchange asked a few sincere questions and stayed for more information, so it turned out to be a useful exchange even if my antagonist never finds his way to common sense.

He might have been lying about having formerly tested voting machines for GAB, but I’m not lying when I say this sort of reaction is common (though far from universal) among Wisconsin elections officials from the state level on down. I had a very similar encounter with a municipal clerk just about a week before.

There’ s no need to condemn elections officials for this intellectual obstinacy, because psychological denial is a universal human foible. These men and women have likely certified dozens of elections without verifying accuracy, so it must be a real kick in the gut when they first realize how dangerous that is. When you introduce the notion they might have inadvertently certified hacked voting-machine output, I’m sure it feels to them as if you just suggested their spouse might be unfaithful.

In all but extraordinary human beings, that sort of unwelcome news creates an intolerable amount of cognitive dissonance and pretty much shuts down logical processing, at least for a while. None of us can process new information when our brain is fully occupied generating any possible excuse why the information might not be true.

So we need to be patient, to a point. I suggest that point will arrive sometime before November 2016, when we will need to insist on the resolution of our own cognitive dissonance, which comes from being forced to trust our sacred right to self-government to unaudited computer output.