WEC to voters: Voting machines use binary code, so you don’t need to be able to decipher your ballot.

No, you’re not crazy. It doesn’t make any sense.

Today the Wisconsin Elections Commission once again took up a voting-machine vendors’ request to market a new product here. Once again, the Commission confined voters to five-minute comments and then invited voting-machine vendors to sit down at the table with them to pitch their products.

Once again, the Commission discussed the voters’ concerns only for the purpose of asking the vendor to refute them.

And then the Commission once again approved a ballot-marking device (BMD) that records our votes as barcodes we cannot read.

The machine in question today is called the ExpressVote. Designed primarily for voters who cannot use a pen, BMDs require voters to use a touchscreen to indicate their votes. The computer then prints a marked paper ballot. Increasingly, BMDs are being promoted to voters without disabilities, particularly early voters.

Some BMDs print ballots that are nearly indistinguishable from hand-marked paper ballots, so that ballots cast by voters with disabilities look just like everyone else’s. Both voters and tabulators look at the same input to read the votes.

Bad BMDs, like the ExpressVote, print ballots that look like large cash-register receipts. On these ballots, votes are recorded as barcodes. This prevents voters from verifying that their votes were printed correctly. In addition, these machines violate voters’ privacy when a polling place has only one or two voters with disabilities. (More about barcoding BMDs here.)

But why?

You might ask (as most people do) why anyone would build such a feature into a machine.

You might ask, but the Wisconsin Elections Commission doesn’t.

Commissioners never asked the vendor: “Why? Why are you offering us a machine with this weird feature, when we know you can manufacture machines that perform all the desirable functions and none of the dicey ones?”

Whatever the answer is, it must not make the barcoding BMDs look good.

The vendor’s defense attorney

At one point, Chair Dean Knudson sympathetically acknowledged that voters who use barcoding BMDs can independently verify their votes only if they bring a barcode reader to the polls. He wisely noted that’s too much to expect of voters.

But beyond that, the commissioners’ questions could all be paraphrased: “How can we refute the voters’ stupid concerns?”

“Motivated reasoning” is the chop-logic that appears when people pick a conclusion first and go looking for reasons to justify it afterwards. For example, commissioners and staff repeatedly reminded each other: “We saw no problems when the barcodes were tested/audited/recounted. Therefore, we conclude the system is safe.”

That’s a textbook case of motivated reasoning. People whose brains are engaged know that hackers don’t avoid a system simply because it worked well during the manufacturer’s demo or the customer’s test, that computers do not earn magical immunity from future problems by working well on a previous occasion.

They know it’s a bad idea to give every questionable voting system one freebie botched election before rejecting it.

Commissioner Mark Thomsen, in particular, took it upon himself to play defense attorney for the vendor. He acted insulted that voters had implied the barcoding BMDs are “hackable.” But that wasn’t the voters’ point. Of course the barcoding BMDs are hackable; all computers are. If Thomsen had been listening to understand rather than listening to refute, he would have understood the issue was not “hack-ability,” but that barcodes remove voters’ and officials’ ability to detect hacking.

Most bizarrely, Thomsen repeatedly reiterated one laughable argument made by the vendor. The argument is this: Because the tabulators read all votes as binary code, voters have no reason to object when the printer makes their votes indecipherable to humans.

Thomsen has more than enough intellect to understand that users need to be careful to feed computers only accurate information, so he understands why voters need to be able to tell whether their intended votes were correctly recorded on their paper ballots.

The voter registration system, like the voting machines, processes information as binary code, but I have no doubt Thomsen would immediately see the problem if anyone suggested that WisVote render each voter’s registration record unreadable to the voter.

But for some reason he pretended he didn’t understand.

Thomsen even went on to argue in favor of another type of BMD that WEC staff had wisely recommended rejecting. This machine combines a ballot-printer and a tabulator in one machine, creating a feature that independent elections-technology experts ridicule as the “permission to cheat” feature. Fortunately, the other commissioners acted as a wise jury, so the notion of overriding the staff recommendation to reject that component went nowhere.

Voters shouldn’t give up.

The commissioners are neither stupid nor crooked, as far as I can tell. For example, when they’re working on security for WisVote (the voter-registration system), they do a fabulous job.

It’s only when the questions involve the tabulation system that they devote their energy to making excuses for security flaws rather than fixing them. They suspend their common sense only when the voting-machine vendors sweet-talk them. But whatever the reason, siding with the voting-machine vendors against the voters is something of a habit.

As voters who want to protect our own votes and our communities’ elections, we’ve got work to do. We need to show up and object every time the Commission considers idiotic equipment. I see too much common sense on that commission to believe they will keep these particular blinders on forever.

The other suggestion on the table is a lawsuit. Wisconsin law requires that voting systems “permit an elector to privately verify the votes selected by the elector before casting his or her ballot.” If the WEC admits the barcodes are the only marks ever counted as votes, they will be admitting that the BMDs don’t comply with the verifiability requirement. On the other hand, if the WEC argues that the voters can verify the human-readable text on each barcoded ballot, they will be stuck with no explanation of why that text is never counted as votes. Therefore, if we can find a lawyer willing to defend election security and voters, we could make an argument that barcoding BMDs are already illegal in Wisconsin. If the Commission wants to build voter confidence and enhance security, it will adopt this line of reasoning even without a lawsuit.

Voters ask for security. The Wisconsin Elections Commission gives only reassurances.

Summary: The WEC are pressuring voters to accept insecure election equipment, when they should be pressuring vendors to improve it. 7-minute read.

* * *

June 27, 2019 – Imagine two friends walking down the street when a masher starts to hit on the woman—even tries to get her into his car.   

The woman’s friend doesn’t need to throw any punches. But he should at least say: “Hey, buddy. You’re out of line. Move on.”

The last thing you expect him to do is to tell the woman: “You need to trust. This guy’s offer sounds legit. He’s got a nice car. Go ahead; get in.”

That’s like what’s happening with WEC (the should-be friend); voters; and voting-machine companies (the masher). Voting machine companies are offering risky equipment, and WEC is pressuring voters to get in the car:

  • Some models of ballot-marking devices (BMDs) print ballots with the votes recorded in barcodes, rather than in marked ovals beside candidates’ names. BMDs are necessary for people who cannot mark their own ballots. The problem is that barcoded votes make it impossible for voters to verify which candidates will get their votes. Even a voter carrying a barcode reader wouldn’t be able to tell whether 02060101 was the right candidate. The barcoded ballots also print the candidate’s names as text, but the computers count only the barcoded votes.  The Commission has approved two barcoding BMDs:  the ES&S ExpressVote and the Dominion ICE.
  • Hybrid voting machines combine a ballot-marking device and tabulator in one machine, which sounds okay until you know that, after a voter has inspected the ballot and inserted it back into the machine for counting, the machine passes the ballot back under the printer head. As a result, the machines can be mis-programmed to print additional votes on the ballots or to make marks that invalidate the ones the voters made.  Like barcoding, that makes voter verification impossible. Dominion ICE is the only hybrid voting machine currently in use in Wisconsin.

 

Manufacturer ES&S recently asked the Commission for permission to sell an updated voting system that includes both a safe BMD (the Automark) and a risky, barcoding BMD (the ExpressVote).  The Commission took the matter up at their June meeting.

In advance of that meeting, dozens of voters contacted the Commission, asking them to deny approval to the barcoding machine. After reading the voters’ emails, the commissioners saw a problem, but it wasn’t the security flaw. The problem they saw was voter resistance to the security flaw.  (With one exception–see the footnote)

When they met on June 11, neither staff nor commissioners were coy about the purpose of the meeting. Administrator Meagan Wolfe introduced the staff who “conducted the campaign to approve the voting equipment.” (Staff are campaigning to approve the equipment? Shouldn’t they at least be impartial?) (At 11:30 in this video recording of the meeting.)

Commissioner Mark Thomsen was equally clear about what he wanted from the meeting:  “I’d like to be reassured about any security issues and that the public knows that we don’t have a problem there.”  (38:38 in that video) (Shouldn’t he instead like to be educated about the security issues? And want the public to be well-informed?)

Were these mere figures of speech? Did Wolfe and Thomsen instead mean to say that they wanted to conduct a rigorous assessment to reduce or eliminate the risks?

No, they did not. Watch that video and you will see staff, commissioners, and ES&S sales representatives working together with shared and very limited purpose: To convince each other and the voters that all is well.

Had commissioners come to the meeting ready to grapple with and resolve the security issues, they would quickly have posed the obvious first question, given the controversy: Why are barcodes used at all? Particularly when it is demonstrably possible to manufacture a machine with all the desirable features of the ExpressVote but without the barcodes? What benefit do the barcodes provide, to whom, that justifies degrading voter verifiability like this?

But no one asked. So no one answered.

That wasn’t the only important question unasked and unanswered. Tony Bridges, the Commission’s Election Security lead, reassured the commissioners that the votes recorded as text, rather than the barcodes, will be counted in recounts and audits.  (Starts at 48:12 in the video linked above.)

The Commissioners know — even if Bridges does not — that in 2016 the Commission testified in court that statutes give counties, not the Commission, authority to decide whether to recount by hand or by machine. The judge agreed. So Commissioners know they cannot require the recount method Bridges described. Yet no one corrected him. The stated purpose of the meeting was to increase confidence in election security — and Bridges’ misstatement did that.

Several commissioners are lawyers. If they had been engaged in assessing risks rather than excusing them, they surely would have also noticed that no Wisconsin statute anticipates that votes will be recorded twice on the same ballot. That creates a rat’s nest of legal questions around barcoded ballots: Which is the ‘real’ vote?

What does it say about the validity of results in un-recounted races when the Commission insists, as Bridges suggests, that only those votes recorded as text are reliable enough to decide a recount? One of the candidates in the next contested recount might suspect he or she got more votes from the barcoded ballots. When that candidate challenges the hand-counting counties, what legal argument will the Commission suggest to those clerks to defend Bridges’ method against pressure to recount by machine?

Bridges’ proposal is just as problematic for voting-machine audits. For years, the Commission has repeatedly asserted that this state’s audit law, s.7.08(6), Wis. Stats., requires auditors to read the votes the way the machines are designed to read them. Reading only the text votes from barcoded ballots cannot fulfill that requirement, because the tabulators don’t use those votes. So Bridges’ proposed audits do not qualify as s.7.08(6) audits. Yet those are the only audits the Commission has authority to order.

None of that came out in the meeting, however, because the commissioners were wholly fixated on defending the barcoding BMD. Having built up the illusion that officials will routinely check the barcodes for accuracy, Bridges’ testimony was on script.

The manufacturer’s claims were also accepted without question. None, however, stand up to even simple critical examination.

  1. The manufacturer’s first argument is: “The voters can verify the votes that are printed as text.”
    If any commissioners had been working to protect voters, they would have said: “We cannot consider something that’s never counted to be a ‘vote.’ So we don’t see the value in verifying the text. It’s the votes that will be counted that must be verifiable to comply with the law that says that voters must be able to privately verify the votes selected.”  
    No commissioner said that.
  2. The next argument is: “Audits and recounts will notice if the barcoded votes differ from the printed text.”
    If any commissioners had been working to protect voters, they would have told the manufacturer that is irrelevant in Wisconsin. Here, very few races are protected by recounts because recounts are allowed only when preliminary results are too close to have been hacked (Manipulated results will surely have a victory margin larger than 0.25%.) Audits protect even fewer races because the Commission has no authority to correct election results even if an audit detects a problem in the sampled machines.  
    No commissioner brought that up.
  3. Manufacturers offer a third defense when they are forced to admit the votes printed as text are merely decorative. They have built a feature into the BMDs that allows a curious voter to reinsert the ballot into the machine that printed it, which will read the barcode and display the votes on a monitor.
    If any commissioners had been working to protect voters, they would have pointed out that’s not verification. It requires a voter to trust the machine once to print the correct votes, and then trust it again to read back the correct votes. If a barcoding BMD is programmed to print the wrong votes in the barcode, it will also be programmed to read the right votes back to the voter.
    No commissioner pointed that out.
  4. For their final line of defense, ES&S falls back on obfuscation. The manufacturer explains that the tabulator uses the same set of codes to interpret both marked ovals and barcodes. For example, the code assigned to a candidate whose oval is located in the second row of the sixth column on the first side of the first page of a printed ballot would be 02060101. The barcoded votes for that candidate contain a reference to that same spot—02060101.
    If any commissioners had been working to protect voters, they would scoffed and said, “If the voter hasn’t verified it, we don’t care how the tabulator reads it. Stop yammering about irrelevant technicalities and bring us a BMD with the good features of the ExpressVote and voter-verifiable ballots.”
    None of the commissioners scoffed.

Staff contributed additional weak arguments to help ES&S sell their machines: 

  • Staff pointed out that they found no problems with the barcodes when they tested the systems. They did not mention that the machines used by Election-Day voters will be at risk of mis-programming, while the machines provided by ES&S for testing were not.
  • Staff said that previous recounts and audits found no problems with incorrect barcodes in past elections. They did not explain how that protects future elections.
  • Staff told commissioners that local officials often test the machines before each election. They did not explain that pre-election tests provide no security against malicious code, which would be designed never to reveal itself before Election Day.

No surprise: After this discussion, the Commission voted unanimously to approve the machine, and instructed its staff to reassure the voters.  A few days later, every voter who had urged caution got an email from Public Information Officer Reid Magney.  Following the commissioners’ instruction to convince voters that barcoded votes are “a perceived problem, not a real one,” (43:32), Magney uncritically repeated the manufacturer’s claims and even used the opportunity to distribute an ES&S marketing brochure.

So here’s a direct plea to the Wisconsin Elections Commission and their staff: Stop seeing it as your job to make the companies’ case to the voters. Start making the voters’ case to the companies.

When you hear manufacturers’ claims, make skepticism your default attitude. When you hear voters’ concerns, default to curiosity.

When a law or regulation can be interpreted either way, go with the common-sense interpretation that favors the voters’ interests. Don’t devote extra effort to wresting out an interpretation that favors the voting machine companies’ interests. (I’m looking at you, Staff Attorney Michael Haas—1:27:00.)   

Demand security from them, not trust from us.

In short, WEC, come over to the voters’ side where you belong.

Footnote: Chair Dean Knudson’s line of questioning, which starts around 50:00, was responsive to concerns about pre-election testing. However, to be fair, that line of questioning challenged only election officials to reduce the risks of barcodes. He did not challenge the manufacturer to eliminate them.

* * *

Note to the media:  Voters could use your help in getting the WEC to work on tabulation security, rather than to continue working on reassurance.
The security problems with barcoding and hybrid BMDs are being taken very seriously outside Wisconsin. Federal election-security legislation has been introduced that would prohibit their use. Senator Tammy Baldwin is co-sponsoring the Senate bill, SB 1472; Representative Mark Pocan voted for the House bill, HR 2722.
If you ever ask WEC about election security, be prepared to receive a list of measures they have taken to protect the voter registration system, WisVote. The list will not explain–unless you press–that those measures don’t protect the tabulation system.
The WEC might also list some things they have done related to securing the tabulation system. Before you file your story, notice which are guidance rather than binding requirements, and notice that none resolve the risks created when voters cannot verify their ballots, such as in barcoding BMDs or a hybrid voting system. 

Quick facts about Ballot-marking devices

By Karen McKim

First: No, I’m not making this up. Vendors really are promoting $5,000 computers to replace pens for marking ballots. Yes, election officials really are buying them.  

And on Tuesday, June 11, the Wisconsin Elections Commission is set to certify an updated model of one of these systems already in use in this state—without seriously considering the risks. (Discussion starts on page 25 of that linked document.)

Originally designed in response to federal disability-rights laws, ballot-marking devices (BMDs) allow voters to select candidates by touching a computer monitor. Visually impaired voters can listen through earphones and vote by speaking their choices.

Because BMDs only mark paper ballots, but do not count votes (the votes must be counted either by hand or a tabulator), they do not create the same set of security risks as touchscreen machines that tabulate results.

However, all BMDs create risks that do not exist when a voter marks a paper ballot with a pen. The worst types of BMDs create security problems so serious they rival paperless voting.

When hand-marking a ballot, voters can notice and correct any problem—perhaps the pen slips or runs out of ink.  And when the voter casts the ballot, he or she can be certain that the marks accurately record the voter’s intent because, well, the voter recorded them.

The same is not true when a computer records the votes. Hardware sometimes develops problems because of poor maintenance, wearing out, or just plain random malfunction. Software sometimes develops glitches. Human programmers sometimes make mistakes. Being human, even authorized programmers can deliberately manipulate the system so that it does what they, not the voters, want.  

And those are the risks before we even mention the hackers who so thoroughly dominate media imagination and public comprehension of election security issues.

Local election officials, lacking superhero powers, cannot prevent every glitch or malfunction. They have no control of security before the software comes into their possession.  Even the most rigorous pre-election testing cannot detect malicious code written to operate only on Election Day.

One risk—that the BMD can omit some votes or record the wrong ones—could be eliminated if voters were willing and able to review the printed ballots and re-mark their ballots if they saw a problem.  But voters are neither willing nor able.

Voters prefer to vote quickly, and few take the time carefully to review their printed ballot.  This problem is more serious than it seems, because only voter-verified ballots qualify as auditable records of voter intent.  Without proof that the voters verified the ballots, the best that auditors can do is confirm that the voting system produced the results it was programmed to produce—but they cannot confirm the results reflect the will of the voters.

On top of that, voting machine companies have found a way to make sure voters are not able to verify. Take a look at the BMD-printed ballot reproduced below, from an ES&S demonstration of their BMD, the ExpressVote.  Election officials say—and many even believe—that voters can verify their votes by reading the text.

But that human-readable text is merely decorative; it serves no function. The real votes—the only votes the tabulator will see and count—are encoded in those bar codes

And no voter can verify those. So to complete the decorative effect, the voting-machine company provides an additional feature: a barcode reader that voters can use if they want to take additional time to see a read-out of the votes. That is like asking the computer programmer, “You’re not lying to me, are you?”  

The very worst type of BMD is used in a few places in Wisconsin, and is making more headway in some other states. When you understand what’s known as a “hybrid machine,”  it’s easy to think that, for some reason, voting companies are actively trying to undermine voter confidence.  

Hybrid machines combine a BMD with a tabulator, in one machine. The voter uses a touchscreen to select his or her votes, and tells the computer to print the ballot.  When the voter inspects the printed ballot (or not; it’s the voter’s choice), the ballot goes back into the same machine to be tabulated.

But in doing that, the ballot passes back under the same printer heads that marked it in the first place!  If these machines malfunction or are mis-programmed, they could make additional marks on the ballots that the voters did not intend and cannot know about.

There’s more I could say about BMDs and the management practices necessary to minimize the risk whenever they are used.  For one, voters need to insist on adequate public pre-election testing.  Right now, I know of no Wisconsin municipality that publicly pretests the barcoding function before allowing early voters to use BMDs. I know of one (City of Madison) that conducts early voting by BMD for weeks before the public pre-election tests. That practice is unnecessary, careless and, if widely known, would be seriously detrimental to voter confidence.

And some good news: A group of US Senators (16 as of June 8), led by Ron Wyden of Oregon and including Tammy Baldwin of Wisconsin, are sponsoring federal election-security legislation that, among other safeguards, bans BMDs that do not “mark votes in such a way that vote selections can be inspected and verified by the voter … without the aid of any machine or other equipment.”

WEC can be contacted by email at elections@wi.gov.  Before close of business Monday, June 10, contact them with “Message for Commissioners” in the subject line. Tell the Commissioners to understand and resolve the security issues before they certify any more BMDs.

While you’re at it, you can contact Senator Baldwin to thank her for co-sponsoring the PAVE Act.

Quick facts

Ballot-marking devices are computers that mark ballots, but do not count votes.

Benefits of BMDs:

  • Accessible independent voting at the polling place for voters with certain types of disabilities (but they don’t need barcodes for that);
  • BMDs that print ballots on blank paper (as opposed to those that mark pre-printed ballots) have the following benefits: 1) Early, off-site voting locations (such as public libraries) can serve multiple wards without having to stock each ward’s unique ballot; 2) Polling places can never run out of printed ballots, unless they run out of plain paper; 3) Unused ballots can be kept to a minimum or eliminated, reducing opportunity for ballot-box stuffing or other mix-ups.
  • Potentially fewer ballot-marking errors that might invalidate votes or ballots (but tabulating machines also identify mismarked ballots and return them for voter correction).

Drawbacks and dangers of BMDs:

  • Increases election costs (A computer costs more than a pen, and one whole computer is needed to replace each voting booth)
  • Slows down the voting process, because it takes longer to scroll through a computerized menu and make selections than it does to view and mark a paper ballot;
  • Barcoded ballots eliminate voters’ ability to verify their ballots contain the correct votes;
  • Even when barcodes are not printed, no auditable record of the election is created, because there is no way to know whether every voter paused to review the printed ballot and was willing and able to re-mark a ballot if they noticed a problem;
  • When used to replace hand-marked ballots, BMDs reduce the ability of polling places to expand to accommodate high-turnout elections or avoid long lines when many voters appear at the same time.