Doing Post-Election Audits of Paper Records in California Right

berkeley

As part of my dissertation research and the research agenda of our NSF ACCURATE center, a number of us have been working with two California jurisdictions to design the procedures for their post-election manual audit. This audit, required under California election law, involves comparing manual tallies of paper records with electronic totals.

In this post, I'd like to discuss some existing practices seen in other California jurisdictions that are not ideal and how California's Election Code could be strengthened to address these shortcomings. I hope this brief post about our larger body of work gives some insight into these issues to those that may be interested. We'll be publishing more on this in coming months.

Summary of Current Problems

Briefly, the problems cluster around the following issues:

  • The strain on jurisdictions due to increasing numbers of absentee voters drastically compresses the time available for audit activities during the canvass process.
  • Many jurisdictions conduct the Random Selection of precincts to be included in the manual audit weeks before the actual audit activity.
  • The Random Selection process is very often not random, independent or publicly-verifiable.
  • Selection of additional precincts to audit in order to cover all contests on the jurisdiction's ballot is not required to be done randomly.
  • All paper records or ballots that are tallied by computerized or electromechanical equipment should be included in the audit.

The Increasing Strain with a Fixed Canvass Time-Period

According to California Law (15372. et seq.), the official canvass must be completed and certified the 28th day after the election (December 5 for this cycle). The reconciliation and tabulation of absentee ballots takes the most time during the canvass process. Absentee ballots require reconciliation -- where the signature and information on the ballot envelope is checked against registration data -- and some jurisdictions sort absentee ballots by precinct either by hand or with sorting equipment (which can cost upwards of $500k). Not only do they take quite a bit of time to count and sort but there are a lot of them -- outgoing Secretary of State McPherson has estimated that 44% of voters cast absentee ballots in the 2006 election.

The increasing amount of voters casting absentee ballots has compressed the amount of time available for other activities that need to happen before the statement of vote is certified. One of those activities is the 1% manual audit tally; the tally must happen during the canvass process, no matter how much time a jurisdiction may have to do it.

Other audit activities that a jurisdiction might want to perform cannot be done or have to be done very quickly. For example, if a jurisdiction wanted to do a "hash-test" of software running on their voting systems -- where they compare a cryptographic checksum to official checksums kept by NIST's National Software Reference Library -- they'd either have to wait to do such a test until after the vote was certified or do it on a very limited basis. Once the election is certified, there's not much a jurisdiction can do if they find a problem afterward, short of filing a contest to the election in court. The situation is the same for any audit activity that is not required by law to happen during the canvass. Other audit activities a jurisdiction might want to perform include machine-level audits, using vendor-provided anomaly reporting tools and reviewing event and audit logs from voting systems.

What is the solution? The canvass time needs to be increased to accommodate the increasing amount of time that it takes to count absentee ballots. (Note: Provisional ballots actually take longer to count on a per-ballot basis, but their are many times fewer of those.) As a stop-gap, it could be as easy as specifying that it's 28 business days after the election, but something more forward-thinking should really be enacted. To give you an idea of how hard this is, many elections staffers in California have been working 5 weeks straight without a single day off. And some will work Thanksgiving.

The Timing of Random Selection of Precincts

Many jurisdictions chose to do the Random Selection of precincts weeks before the manual audit takes place. From a security perspective, this trivializes the entire manual audit process. The manual audit is meant to be a cross-check where the paper records for a precinct are manually tallied and compared with the electronic tallies. The reason the audit is done on a random sample of precincts is to make any malicious vote fraud that much harder to do. However, if it is known weeks before which precincts will be scrutinized, an attacker need only not commit his frauds in those precincts to escape detection.

Although there's much more to our work, the theoretical ideal would be that the random selection of precincts and manual audit only happen after all the votes are counted and that the manual audit happen immediately after the random selection. All the votes should be counted before the selection takes place so that an attacker can't modify vote data in incompletely-counted precincts that aren't chosen. The manual audit should happen very soon after the random selection so that the same observers can plan to be present for both activities and so that these observers can witness the retrieval and unsealing of paper records. Of course, this ideal may not currently be practical for a number of reasons, but the closer to the ideal, the better.

The Nature of the Random Selection Process Itself

Some jurisdictions use vendor-supplied software-based random selection algorithms. However, software can be modified and is very hard to verify, especially when proprietary. We don't lack good, publicly-verifiable sources of randomness in the real world. Fellow ACCURATE colleagues, Arel Cordero, David Wagner and David Dill, have come up with a selection protocol that uses ten-sided dice to choose precincts for random auditing (See: "The Role of Dice in Election Audits -- Extended Abstract"). A number of jurisdictions in California will be using this method, and others have decided to simply draw lots -- although they should understand that the lots should be of a uniform size, shape and color and should have numbers from 0-9 on them instead of explicit precinct numbers.

Opportunistic Selection of Additional Precincts

The California Election Code statute that dictates how the manual tally happens, EC 15360, requires that additional precincts on top of the 1% selection have to be selected in order to cover all the contests on ballots in the jurisdiction:

In addition to the 1 percent count, the elections official shall, for each race not included in the initial group of precincts, count one additional precinct. The manual tally shall apply only to the race not previously counted.

However, this statute doesn't specify that these additional precincts be chosen randomly. What we have seen is that some election officials choose these additional precincts opportunistically. That is, they choose as few precincts as possible in order to cover all the contests on the ballot and they choose very small precincts in order to reduce the work required in the manual audit. These additional precincts should be chosen randomly in the manner specified in the Cordero et al. work.

What Records Should be Covered?

Finally, jurisdictions have in the past not included ballots not cast in the precinct in the manual audit. With 44% of ballots cast being absentee ballots across California as well as many people casting ballots on voting systems in early voting locations, many ballots were not being included in the manual audit. The recently passed SB 1235 (sponsored by Secretary of State-Elect Bowen) closes this loophole for absentee and early voted ballots (this law goes into effect starting in 2007). However, it should be made clear that any ballots cast on voting systems, required by law to produce a paper record, should be covered by the manual audit process.

Bush protects us from "eye tack"

wtf?, politics, photos

I caught this funny mistranslation of Bush by the closed captioning... he said "attack" and the CC thought it was "eye tack". I'm not even sure I know what "eye tack" is...

http://www.youtube.com/watch?v=tMeZjCnPXpc

"The election has changed many things in Washington but it has not changed my fundamental responsibility, and that is to protect the American people from eye tack."

Electioneering in the Polling Place

elections, wtf?, chilling effects, policy, legal

So, as a poll worker, we were instructed to tell anyone in the polling place that wearing pins or t-shirts, etc. that represented a candidate or measure on the ballot was electioneering under California Law (and caselaw). I didn't see anyone doing this, although we did require people to close their newspapers and put them away (as the front pages occasionally had endorsements). I've heard of other CA counties doing things like including a large white t-shirt or hospital gown in the election supplies that people with such things on have to wear while they're in the polling place.

However, check out this picture taken in a polling place in Concord, where Kevin Veliz is clearly wearing a Governator shirt (from a story in the Contra Costa Times, "Some East Bay voters might have used wrong ballots"). Sounds like the poll workers were either ignorant of the electioneering statute or just turned a blind eye to this blatant form of electioneering:

Kevin Veliz wearing a Governator shirt while voting

The General Election at Precinct 225400

elections, accessibility, news, privacy, policy

Me and a DRE I have always wanted to volunteer for an election and see what it's like to be on the ground, especially since election policy is a key part of my PhD thesis. Avi Rubin, the director of our ACCURATE grant, recently volunteered as a poll worker in a number of elections in Baltimore, MD. This inspired me to take the plunge and volunteer myself this time around. This past Tuesday, November 7, 2006, I was a poll inspector at Alameda County, California's precinct 22540 in Oakland, CA.

The day was long, from 6:00am to 10:00pm -- 16 hours. Naturally, a blog post about such a long day is going to also be long, so forgive me ahead of time.

Full story »

SacBee Op-Ed: "Counting on security"

elections, certification/testing, standards, news, berkeley, problems, friends, research, policy, legal

Deirdre Mulligan (PI on NSF ACCURATE grant), Aaron Burstein, David Snyder and I wrote this piece for Sunday's Sacramento Bee. -Joe

http://www.sacbee.com/110/story/71365.html

Counting on security

The transition to electronic voting without tough standards for security, reliability and accessibility is a serious mistake.

By Deirdre K. Mulligan - Special to the Bee
Published 12:00 am PST Sunday, November 5, 2006

The election system voters will encounter Tuesday is, in many ways, untested. Voters will be facing new technologies and policies in the first national election since Congress approved the Help America Vote Act in 2002 to reform the system. And there are troubling signs that the transition will be anything but smooth.

...

Contact / Help. (cc) 2021 by Joseph Hall. blog software / hosting.
Design & icons by N.Design Studio. Skin by Tender Feelings / Evo Factory.
And a few words about the structure of the eye . Everyone " retina ". Especially often we hear it buy clomid online in the phrase " retinal detachment ." So what is the retina ? This - the front edge of the brain, the most distant from the brain part of the visual analyzer. The retina receives light first , processes and transforms light energy into irritation - a signal that encodes all the information about what the eye sees . The retina is very complex and in their structure and function . Its structure resembles the structure of the cerebral cortex. The shell of the retina is very thin - about 0.14 mm.