If it takes a leap of faith…

The year was 1977, and my friend Gail was in the market for a used car. One of the guys in our apartment building, Chuck, wanted to sell his Pinto.

“No, Gail, no,” I told her. “People are saying the Pinto’s gas tank can explode in even low-speed rear-end crashes.  There’s talk of recall and lawsuits. If you buy this car, you won’t be able to resell it.”

My roommate backed me up. “Gail, I saw a Datsun B210 for sale on Johnson Street.  The B210 does everything the Pinto does, without the risk. Forget about the Pinto.”

Gail believed us but dismissed the concerns. “Ford wouldn’t be selling the car if it was a big problem,” she said. “And besides, Chuck said the car has seat belts.” She thought for a second and couldn’t come up with any more ways to dismiss or minimize the risk. “I have faith it’ll be okay.”

The more we tried to reason with her, the sillier her arguments became. Chuck had done a good job cleaning his trash out of the car. She could probably minimize the risk by never filling the gas tank more than a quarter full.

Gail had turned off her brain.

Gail came to mind during the Wisconsin Elections Commission meeting last week. The Commissioners were meeting to decide whether to approve an updated version of a risky piece of elections equipment, called the ExpressVote. They were listening to the manufacturer’s sales representatives the way Gail had been listening to Chuck, while treating words of warning like flies to be swatted away.  

The ExpressVote is a type of ballot-marking device (BMD), which voters use to mark their ballots when they cannot, or do not want to, use a pen. BMDs don’t count votes; they just mark ballots. But they can be misprogrammed to print a ballot that contains different votes than the ones the voter intended.

Safe BMDs manage this risk by printing ballots that look like regular hand-marked paper ballots. Each vote is recorded once, as a marked oval beside some candidate’s name. The voter can verify that the mark is next to the correct name. The tabulator looks at that same mark when it counts the vote.

The ‘Pintos’ among the BMDs—that is, the unsafe ones—print barcoded ballots. Barcoded ballots record each vote twice—once in text, and once in barcode. Voters can verify only the votes printed in the text. The tabulator can count only the votes inside the barcode. If the BMD is programmed to print one vote in text and a different vote in the barcode, the voter cannot notice. The ExpressVote, manufactured by elections-technology giant ES&S, is one of these machines.

When a state elections authority is aggressively looking for the best, most secure solutions for their state’s elections, they would want all the relevant, reliable information they could get. They would invite a presentation from the manufacturer, of course, but they would also invite other trusted people to answer questions that might arise and to comment on the manufacturers’ claims. The commissioners would ask tough questions, demonstrating that they want nothing less than the full, unbiased facts. They would interpret every gray area in favor of security, not in favor of the manufacturer.

But the June WEC meeting was not that. These staff and commissioners were looking for ways to justify approving the machine.

As usual, uninvited members of the public could speak for five minutes at the beginning of the meeting. As usual, I took that opportunity. I explained the risks of barcoded ballots. I warned the commissioners of the gathering storm of litigation and legislation. I told them barcoding has no benefit to justify the risk. I told them they have other options. I asked them to protect our votes by avoiding this pointless risk. The commissioners listened politely but asked no questions.

For the next two hours, I and everyone else in the room was required to listen silently as the salesmen demonstrated their product and gave their no-time-limit pitch. The meeting provided no opportunity for independent correction or rebuttal if they made any unjustified claims. If they omitted any important information, the meeting presented no chance for anyone else to provide it.

The one cautious interlude was when Commission Chair Dean Knudson led a responsible line of questioning into whether municipal clerks test the BMDs before each election. This was no challenge to the vendor, but to its credit, the commissioners voted to promote municipal testing before future elections.

But other than that, ES&S, the commissioners, and staff all acted in concert with one shared goal: To minimize or refute concerns about the security of the ExpressVote and approve it for sale in Wisconsin.

One example: The issue of voter verification.  To quell concerns about voter verification, ES&S designed a feature into the ExpressVote that allows a voter to reinsert the barcoded ballot back into the machine, and have the BMD display the votes on a computer monitor for a second time. 

But of course that does not provide true verification. Everyone in the room—commissioners, staff, and salesmen included—was smart enough to know that if a hacker ever programs a BMD to print the wrong votes in the barcode, the hacker will also program it to display only the right votes to the voter. 

But the commissioners’ BS detectors were turned off. Not one commissioner asked a skeptical or challenging follow-up questions. None bothered to wonder out loud what purpose barcoding serves anyway. (Answer: None. It’s all risk, no reward.) Both staff and commissioners repeated ES&S’s claim of verifiability in their own words, like my friend Gail, as if repetition of a silly argument could make it convincing.

Another example: ES&S’s pitch regarding the safety of barcodes. Barcoded ballots are safe, the sales pitch went, because:

  • The programmer assigns each candidate a unique numeric code, based on that candidate’s location on the ballot. For example, the candidate whose oval is located in the 2nd column, 15th row, first side, first page of the ballot will be Candidate 021511.
  • When the tabulator looks at a hand-marked ballot and sees a marked oval at that position, the tabulator will count a vote for Candidate 021511.
  • When that same tabulator looks at a barcoded ballot and sees a barcode that translates into “021511,” the tabulator will count a vote for Candidate 021511.

In summary (ES&S says), hand-marked and bar-coded ballots are equally secure because the tabulator uses the same numeric code, whether it is reading from a marked oval or from a barcode.

This information—presented in a glossy, illustrated, full-color brochure—answered a question no one had asked and no one cares about. The problem has nothing to do with the numeric codes the tabulator uses to interpret ovals and barcodes. 

The problem is that when counting a barcoded ballot, the tabulator looks at information no voter has verified, unlike when the voter and tabulator both look at the same marked oval.

Neither staff nor commissioners gave any sign they noticed the well-known marketing ploy: Distract the customer by talking about something else and pretend that addresses the concern. Gullible, eager-to-say-yes customers smile and nod.

This smile-and-nod process for approving voting equipment is hard to understand. I know the commissioners are capable of being tigers when it comes to security — of a different system. I’ve witnessed the commissioners asking serious, challenging follow-up questions—engaging their critical faculties—when working through security issues involving WisVote, our state’s voter-registration system.

During the weekend before their Tuesday meeting, Wisconsin Election Integrity participants had emailed the commissioners warning them of the security issues and asking them to stop certifying barcoding BMDs. Had we been raising security concerns about an issue with the WisVote system, I’m confident the commissioners’ response would have been to tell their staff to resolve the security issue.  

But we were raising an alarm about tabulation-system security. So the commissioners’  response was to tell their staff to reassure voters there is no problem.

During a break, I tried briefly to engage one of the commissioners in a quick but serious discussion about voters’ inability to verify barcoded votes. The Commissioner ended the conversation with: “Well, it does take a leap of faith.”

I cannot imagine any of the Commissioners making a similar comment regarding voters’ ability to verify their registration records. Nor can I understand why they accept ‘leap of faith’ as sufficient for tabulation-system security.

If something requires a leap of faith, it’s not a good idea.

Quick facts about Ballot-marking devices

By Karen McKim

First: No, I’m not making this up. Vendors really are promoting $5,000 computers to replace pens for marking ballots. Yes, election officials really are buying them.  

And on Tuesday, June 11, the Wisconsin Elections Commission is set to certify an updated model of one of these systems already in use in this state—without seriously considering the risks. (Discussion starts on page 25 of that linked document.)

Originally designed in response to federal disability-rights laws, ballot-marking devices (BMDs) allow voters to select candidates by touching a computer monitor. Visually impaired voters can listen through earphones and vote by speaking their choices.

Because BMDs only mark paper ballots, but do not count votes (the votes must be counted either by hand or a tabulator), they do not create the same set of security risks as touchscreen machines that tabulate results.

However, all BMDs create risks that do not exist when a voter marks a paper ballot with a pen. The worst types of BMDs create security problems so serious they rival paperless voting.

When hand-marking a ballot, voters can notice and correct any problem—perhaps the pen slips or runs out of ink.  And when the voter casts the ballot, he or she can be certain that the marks accurately record the voter’s intent because, well, the voter recorded them.

The same is not true when a computer records the votes. Hardware sometimes develops problems because of poor maintenance, wearing out, or just plain random malfunction. Software sometimes develops glitches. Human programmers sometimes make mistakes. Being human, even authorized programmers can deliberately manipulate the system so that it does what they, not the voters, want.  

And those are the risks before we even mention the hackers who so thoroughly dominate media imagination and public comprehension of election security issues.

Local election officials, lacking superhero powers, cannot prevent every glitch or malfunction. They have no control of security before the software comes into their possession.  Even the most rigorous pre-election testing cannot detect malicious code written to operate only on Election Day.

One risk—that the BMD can omit some votes or record the wrong ones—could be eliminated if voters were willing and able to review the printed ballots and re-mark their ballots if they saw a problem.  But voters are neither willing nor able.

Voters prefer to vote quickly, and few take the time carefully to review their printed ballot.  This problem is more serious than it seems, because only voter-verified ballots qualify as auditable records of voter intent.  Without proof that the voters verified the ballots, the best that auditors can do is confirm that the voting system produced the results it was programmed to produce—but they cannot confirm the results reflect the will of the voters.

On top of that, voting machine companies have found a way to make sure voters are not able to verify. Take a look at the BMD-printed ballot reproduced below, from an ES&S demonstration of their BMD, the ExpressVote.  Election officials say—and many even believe—that voters can verify their votes by reading the text.

But that human-readable text is merely decorative; it serves no function. The real votes—the only votes the tabulator will see and count—are encoded in those bar codes

And no voter can verify those. So to complete the decorative effect, the voting-machine company provides an additional feature: a barcode reader that voters can use if they want to take additional time to see a read-out of the votes. That is like asking the computer programmer, “You’re not lying to me, are you?”  

The very worst type of BMD is used in a few places in Wisconsin, and is making more headway in some other states. When you understand what’s known as a “hybrid machine,”  it’s easy to think that, for some reason, voting companies are actively trying to undermine voter confidence.  

Hybrid machines combine a BMD with a tabulator, in one machine. The voter uses a touchscreen to select his or her votes, and tells the computer to print the ballot.  When the voter inspects the printed ballot (or not; it’s the voter’s choice), the ballot goes back into the same machine to be tabulated.

But in doing that, the ballot passes back under the same printer heads that marked it in the first place!  If these machines malfunction or are mis-programmed, they could make additional marks on the ballots that the voters did not intend and cannot know about.

There’s more I could say about BMDs and the management practices necessary to minimize the risk whenever they are used.  For one, voters need to insist on adequate public pre-election testing.  Right now, I know of no Wisconsin municipality that publicly pretests the barcoding function before allowing early voters to use BMDs. I know of one (City of Madison) that conducts early voting by BMD for weeks before the public pre-election tests. That practice is unnecessary, careless and, if widely known, would be seriously detrimental to voter confidence.

And some good news: A group of US Senators (16 as of June 8), led by Ron Wyden of Oregon and including Tammy Baldwin of Wisconsin, are sponsoring federal election-security legislation that, among other safeguards, bans BMDs that do not “mark votes in such a way that vote selections can be inspected and verified by the voter … without the aid of any machine or other equipment.”

WEC can be contacted by email at elections@wi.gov.  Before close of business Monday, June 10, contact them with “Message for Commissioners” in the subject line. Tell the Commissioners to understand and resolve the security issues before they certify any more BMDs.

While you’re at it, you can contact Senator Baldwin to thank her for co-sponsoring the PAVE Act.

Quick facts

Ballot-marking devices are computers that mark ballots, but do not count votes.

Benefits of BMDs:

  • Accessible independent voting at the polling place for voters with certain types of disabilities (but they don’t need barcodes for that);
  • BMDs that print ballots on blank paper (as opposed to those that mark pre-printed ballots) have the following benefits: 1) Early, off-site voting locations (such as public libraries) can serve multiple wards without having to stock each ward’s unique ballot; 2) Polling places can never run out of printed ballots, unless they run out of plain paper; 3) Unused ballots can be kept to a minimum or eliminated, reducing opportunity for ballot-box stuffing or other mix-ups.
  • Potentially fewer ballot-marking errors that might invalidate votes or ballots (but tabulating machines also identify mismarked ballots and return them for voter correction).

Drawbacks and dangers of BMDs:

  • Increases election costs (A computer costs more than a pen, and one whole computer is needed to replace each voting booth)
  • Slows down the voting process, because it takes longer to scroll through a computerized menu and make selections than it does to view and mark a paper ballot;
  • Barcoded ballots eliminate voters’ ability to verify their ballots contain the correct votes;
  • Even when barcodes are not printed, no auditable record of the election is created, because there is no way to know whether every voter paused to review the printed ballot and was willing and able to re-mark a ballot if they noticed a problem;
  • When used to replace hand-marked ballots, BMDs reduce the ability of polling places to expand to accommodate high-turnout elections or avoid long lines when many voters appear at the same time.