Can we trust the machines that record our votes in local polling places?
That’s the gist of the question that listener Ryan McIntyre submitted to Curious City. Like many people across the country, McIntyre is worried that election results could be manipulated by today’s electronic voting machines. Here’s how he phrased his question:
“After watching the HBO documentary, ‘Hacking Democracy,’ I find using the electronic voting machines, usually by the corporation Diebold, very frivolous since they can so easily be tampered with. Entire elections can be manipulated, vote totals, everything. Before I make my vote I demand that I use the paper ballot. What is being done to eliminate these machines from use in the city of Chicago, a city known to be ravaged by dirty politics anyways? My question can include the entire state of Illinois, not just Chicago.”
The simplest answer to McIntyre’s question is that elections officials in Chicago, suburban Cook County and other local jurisdictions are likely to stick with the machines they’re using now, at least for the foreseeable future. And for what it’s worth, Diebold, which is now called Premier Election Solutions, didn’t make any of the voting machines used anywhere in Illinois, according to a database maintained by The Verified Voting Foundation, a nonpartisan, nonprofit group based in California.
Officials at the Chicago Board of Election Commissioners and the Cook County clerk’s office, which oversees elections in suburban Cook County, say they test their machines frequently. They secure them with locks and tamper-proof seals. And they check a sample of paper ballots against the machine totals. They say these safeguards make it highly unlikely that anyone is tampering with votes — anyone at the companies that made the machines, or any local saboteurs.
“To attempt to tamper with the machines, without getting caught, is in our opinion unlikely — although, we have to recognize, not impossible,” says Courtney Greve, spokeswoman for Cook County Clerk David Orr. “But that’s why we have all these procedures in place.”
Not everyone is satisfied with precautions
Roger Johnston, the head of the Vulnerability Assessment Team at Argonne National Laboratory, tested two voting machines, figuring out ways of opening them up and changing the way they record votes.
“Basically, what we’re doing is just conveying the wrong information between the voter and the smarts of the machine,” Johnston says. “So if you wanted to vote for Smith, we might tell the computer you wanted to vote for Jones."
Johnston did not test the specific machines used in Chicago and Cook County. However, he believes many voting machines have vulnerabilities similar to the ones he discovered on the two models that he did test.
“We kind of suspect, having looked briefly at other machines, that this is kind of a universal problem,” he says. “Basically, if you can get physical access to the machine for typically between 15 and 60 seconds — very easy for an insider, a little more challenging for an outsider but not much — then you basically own the machine. ... It’s easy to turn the cheating on and off as needed.”
Jim Allen, spokesman for the Chicago Board of Election Commissioners, says Johnston’s hacking experiments don’t have any relevance to the voting machines in local polling places. “He hacked an old machine that's never been used in Chicago, or any jurisdiction that I’m aware of in Illinois, that does not have a voter-verifiable paper trail,” Allen says. “It’s not even apples and oranges.”
Even Johnston acknowledges that Illinois does have one important safeguard in place that makes it harder to tamper with votes: The state requires a paper record of every vote — a paper record that voters can verify as they cast their ballots. In addition, state officials randomly pick 5 percent of the precincts in each county for a recount after every election. During these recounts, county officials make sure the paper ballots match the totals tallied by the machines.
“No matter what the computer does, no matter how the computer records it, that paper trail is the official ballot,” Allen says. Recounts have shown that the machines are working, he says. “Every time, everything has come out 100 percent,” he says.
And Greve points out that suburban Cook County polling places have been using the same equipment for six years now without any problems.
Johnston also recommends that local elections officials should try to bribe poll workers to see whether they’re honest — an idea that Allen describes as “from the planet goofy.” Johnston says workers who turn down the bribes would get to keep the money as a bonus. “It’s a very inexpensive way to basically highlight security to your employees, to show the outside world you’re taking security seriously, and to take away bribery as an effective tool of a would-be vote hacker,” he says.
“That is the most moronic, illegal, asinine suggestions that I've ever heard in my entire life,” says Allen, who questions whether Johnston has political motives.
Johnston says the nonprofit group Defend the Vote hired Argonne’s Vulnerability Assessment Team to provide technical consulting on election security issues. Defend the Vote calls itself nonpartisan, but the group is led by Sharon Meroni, a suburban resident who has spoken at tea party events. Johnston insists his motives are simply to ensure election security.
“I get a little uncomfortable when people attribute partisan motives to wanting to have fair elections,” he says. “I would hope we could all be in favor of fair elections, where everybody gets one vote, all the votes get counted and that kind of thing.”
Blame the hanging chads
The way Americans vote changed as a result of the 2000 presidential election, when razor-thin results in the decisive swing state of Florida called into question who had won: George W. Bush or Al Gore. Florida officials ended up scrutinizing punch-card ballots, trying to figure out whether “hanging chads” counted as votes.
Back then, Chicago and Cook County were using punch cards, too. The flaws with this system were growing more obvious. Nearly 2 million Cook County residents voted in November 2000, but 120,000 of them either punched no hole for a presidential candidate, or accidentally punched holes for two candidates.
The uproar over the Florida recount led to a new national law in 2002, the Help America Vote Act. To get federal funding for their election systems, states with punch-card ballots were forced to drop that system. The law also requires each polling place to have at least one voting system accessible to people with disabilities, including the visually impaired, that lets them vote with the same sort of privacy as everyone else.
Since 2003, Chicago and suburban Cook County have used a combination of touch-screen voting machines and optically scanned paper ballots. On Election Day, most voters mark their choices with a pen on a paper ballot, which is then scanned by a machine called the Optech Insight. Voters may also choose to use a touch-screen machine, the AVC Edge2Plus.
The machines are not connected to the Internet, preventing cyber-hacking. “Even our central computer system is not hooked up to the Internet. It’s totally segregated,” Allen says.
When the polls close, memory storage devices containing the electronic data from both the scanner and the touch-screens is transferred into another machine, which is called the Hybrid Activator, Accumulator and Transmitter — or HAAT, for short. The HAAT combines all of the votes from all of the machines at a polling place.
The touch-screen machines are designed to accommodate voters who are disabled, as well as voters who need a ballot in a language other than English. And during early voting, they’re the only machines. Fewer polling places are open for early voting, so each location handles voters from many different precincts. Using paper ballots for all of those voters from various parts of the city wouldn’t be feasible, Allen explains, but the touch-screen machines can handle it.
The touch-screen machines keep a paper record of each vote. “So, before a person hits the ‘cast ballot’ button on the touch screen, they actually have a chance to review all of their choices on a piece of paper that stays with the machine behind a glass screen,” Allen says.
Johnston praises Illinois’ requirement for a paper record as “a very good law.” But he also says it doesn’t solve every problem. “It’s not really a silver bullet for election security,” he says. For example, Johnston suggests that a saboteur could rig a machine to print information matching voters’ choices, while electronically recording something else. But those discrepancies would show up in a recount, he says. Another possibility would be to rig the electronic votes and then swap out the paper at the end of the day, substituting fraudulent paper records, Johnston says.
Greve says these kinds of tampering are unlikely. Voting machines, ballots and paper records are securely locked when they’re transported to and from polling places, she says. “All of the machines’ data ports and access points are sealed, either with a little plastic seal that you have to cut to get off, or with a seal that has a hologram,” she says. “When anyone tries to peel it off … a ‘void’ pops up so you know it’s been tampered with. We have at least five seals on every piece of voting equipment.”
And Greve says it’s doubtful anyone could tamper with the machines while they’re voting at a polling place. “All voting is conducted in a public space,” she says. “There are no curtains anymore. The voting is done within eyesight of the election judges and voters and poll watchers.”
The Cook County clerk’s office goes a step beyond what’s required under Illinois law, conducting an extra “forensic audit” of suburban Cook County votes after each election. “We literally take snapshots of the software before Election Day, on Election Day and after Election Day, to make sure no malicious code has been entered into the system somehow,” Greve says.
The city does not take this step. “It’s something we could explore later, but we haven’t seen any value in it,” Allen says.
A future in paper?
All of these machines used in Chicago and suburban Cook County are manufactured by Sequoia Voting Systems, which is part of the Canadian company Dominion.
The Verified Voting Foundation says Sequoia’s touch-screen voting machines have “significant security weaknesses.” The Verified Voting website points to a 2007 study that the University of California, Berkeley conducted for the California secretary of state. The study looked at two machines, the AVC Edge and Edge2 — which are similar to the Edge2Plus that’s used locally. The study found flaws in data integrity, cryptography, access control and software engineering.
“The nature of these weaknesses raises serious questions as to whether the Sequoia software can be relied upon to protect the integrity of elections,” the Verified Voting website says.
Allen says the current Sequoia machines have all-new software, which he describes as “more robust and secure.”
“You can’t hold up the 2007 study of a totally different machine and software against this system,” Allen says.
In spite of Verified Voting’s concerns about Sequoia voting machines, the group gives Illinois a good overall grade for election security. Verified Voting’s president, Pamela Smith, praises Illinois for requiring a voter-verified paper record of every vote.
“As long as there have been elections, there have been people tampering with elections, right?” Smith says. “And it doesn’t matter what kind of technology is being used in the election. Somebody knows how to tamper with it. … What you want is a system that provides you with the necessary evidence that you can use to go back and reconstruct the correct outcome, even if something went wrong, even if someone tried to tamper with your system, even if there’s a malfunction where the electronic memory lost votes or something along those lines.”
And that evidence, she says, is a paper record like the one Illinois requires. “Could Illinois do more?” she says. “Probably. But they’ve been going in the right direction for a long time and there really are a number of good safeguards in place.”
Smith contrasts Illinois with other states that don’t require a paper record. One of those states is Indiana. According to Verified Voting, only seven Indiana counties keep a paper record for every vote. Porter County uses a paper ballot, but Lake County uses electronic voting machines without any paper record.
Smith says, “I’d feel much more confident in a close contest in Illinois that had to have a recount than in a close contest in Indiana or Virginia or Pennsylvania or Georgia or a number of other states where they either have some or all of their polling places are completely paperless. ... Unless you have that full-scale evidence trail ... things can go wrong.”
In the end, there’s no simple answer to McIntyre’s question for Curious City and — since we couldn’t reach him for comment — we don’t know whether he’s reassured by local election officials’ accounts of how they prevent tampering with voting machines. Illinois law does make it difficult to pull off election sabotage by requiring paper records and a 5 percent recount, but that hasn’t quelled the concerns of some critics.
Perhaps their skepticism would soften a bit if they took account of Chicago’s choice of future technology, however. Allen says the Chicago Board of Election Commissioners wants scanned paper — not the touch screen — to play a bigger role in future elections.
“We’re looking for a new generation of scanners,” he says.