Post-Election Audits | CTVotersCount.org

Just a step in the right direction: Merrill meets with Homeland Security

“Yesterday, along with representatives from the state’s information technology and public safety departments, I met with regional officials from the United States Department of Homeland Security to discuss how we can work together to ensure that Connecticut elections are safe from outside interference or manipulation. We had a productive meeting and I look forward to working together in the months and years to come to protect our elections, the bedrock of our democracy.” – Denise Merrill, Connecticut Secretary of the State

We applaud this step in the right direction. Last year as leader of the National Association of Secretaries of State, Merrill opposed the designation of elections as critical infrastructure, leading in expressing the concern for a Federal take-over of elections. We were critical of that stand then and remain so.

Secretary Merrill met with Homeland Security on Thursday:

Merrill Statement on Meeting with DHS Officials Regarding Election Cybersecurity

“Rosenberg, Gabe” <Gabe.Rosenberg@ct.gov>: Oct 27 04:57PM

“Yesterday, along with representatives from the state’s information technology and public safety departments, I met with regional officials from the United States Department of Homeland Security to discuss how we can work together to ensure that Connecticut elections are safe from outside interference or manipulation. We had a productive meeting and I look forward to working together in the months and years to come to protect our elections, the bedrock of our democracy.” – Denise Merrill, Connecticut Secretary of the State

Gabe Rosenberg
Communications Director
Connecticut Secretary of the State Denise Merrill

In our opinion this is just a step. There are several aspects to election security/integrity that should be addressed,. This step may assist in those that are under direct control of the of the the State, yet less so those under local control. It’s not an issue of a State take-over of local elections, but the impossibility of every town in the State doing what even the NSA has failed at – protecting their most sensitive systems from attack. Yet, like the NSA, the State is capable of doing ever better.

We need to protect our Centralized Voter Registration System (CVRS) from corruption and denial of service attacks on election day.
We need to protect the CVRS from incremental loss or corruption of data over time. That means independently logging of every add, change, and delete of the file, balancing, and auditing those changes against the database regularly, and especially in the days and weeks before an election.
Making sure that if we use electronic pollbooks that there is a usable paper pollbook in every polling place and a copy of that in the Registrars’ Offices during every election. We want to avoid the disaster that occurred in a NC county in the last election

Cybersecurity from “outside interference or manipulation” is insufficient. We must prevent insider attacks. We must be able to recover from “interference and manipulation”, since complete prevention is not possible.. As we have said before, database and election integrity depends on Prevention, Detection, and Recovery.

We have paper ballots everywhere in Connecticut. Yet, they need to be protected better. In the majority of Connecticut municipalities they can be accessed by either Registrar for hours, undetected. In many, they can be accessed by any official in the Registrars’ Offices, sometimes by other officials. Without paper that we can trust there can be no detection or recovery from insider attack.
We need to have sufficient audits of results we can trust, from the accurate counting/adjudication of paper ballots to the totals reported by the State. Where necessary those audits ending in full recounts to determine and certify the correct winners.
We also need process audits to verify various aspects of the election process: Comparing checkoffs to ballots counted; verifying ballot security; verifying the integrity of checkoffs to actual legal voters; the integrity of the absentee ballot process, from application integrity, mail delivery. signature verification, counting etc.

Rhode Island poised to lead New England in Post-Election Audits

Press Release: Rhode Island Takes Important Step to Secure Elections with Post-Election Audits – Adopts New Procedure to Check Election Results as Threats Increase

“Post-election audits are the best safeguard to making sure that votes are being counted as cast,” said Representative Edith Ajello (D-Providence), the House sponsor. “My community saw a simple administrative error almost turn into an incorrect election result,” added Senate sponsor, Senator James Sheehan (D-North Kingstown), “and this legislation will help assure voters that a system is in place to catch and correct future problems.”

The audits will begin as soon as September 2018. Rhode Island becomes the 32nd state to require post-election audits, and only the second state to require risk-limiting audits.

Press Release: Rhode Island Takes Important Step to Secure Elections with Post-Election Audits – Adopts New Procedure to Check Election Results as Threats Increase <read>

“Post-election audits are the best safeguard to making sure that votes are being counted as cast,” said Representative Edith Ajello (D-Providence), the House sponsor. “My community saw a simple administrative error almost turn into an incorrect election result,” added Senate sponsor, Senator James Sheehan (D-North Kingstown), “and this legislation will help assure voters that a system is in place to catch and correct future problems.”

The audits will begin as soon as September 2018. Rhode Island becomes the 32nd state to require post-election audits, and only the second state to require risk-limiting audits.

Passage came after two Rhode Island communities suffered from administrative errors in the November 2016 election that led to incorrect machine counts on election night. Because the results were obviously wrong, election officials reprogrammed the scanners and recounted the ballots. The correct results were reported, but the situation demonstrated the need for a manual check on the results of machine-counted ballots.

Connecticut was the first New England State with post-election audits. Unfortunately we are among the vast majority of states with post-election audits that do not provide sufficient public confidence. Connecticut’s audits suffer from an insufficient design, poor execution, and ll but no oversight. <See the Citizen Audit Reports>

To be fair, most experts only regard the post-election audits in two states, Minnesota and New Mexico, as adequate. Yet, the Risk Limiting Audits to be implemented this year in Colorado and over the next couple of years in Rhode Island are likely to lead the Nation in deserved confidence and efficiency.

PS: I have played a minor supporting role working with other advocates and computer scientists in assisting the development of rules in Colorado and in honing the Rhode Island law. From that ongoing experience it is clear that it takes a lot of detailed work, patience, commitment and participation to create good laws and see them through. Participation from willing and reluctant officials, legislators, advocates, and scientists. Expect some bumps along the way as these new laws are implemented – patience will be required over several election cycles to smooth out those bumps.

The United States should make ballots verifiable—or go back to paper.

Article in The Atlantic: The Case for Standardized and Secure Voting Technology

It’s time to fix the voting process.

American voting systems have improved in recent years, but they collectively remain a giant mess. Voting is controlled by states, and typically administered by counties and local governments. Voting laws differ depending on where you are. Voting machines vary, too; there’s no standard system for the nation.

Accountability is a crapshoot. In some jurisdictions, voters use machines that create electronic tallies with no “paper trail”—that is, no tangible evidence whatsoever that the voter’s choices were honored. A “recount” in such places means asking the machine whether it was right the first time.

We need to fix all of this.

Article in The Atlantic: The Case for Standardized and Secure Voting Technology <read>

It’s time to fix the voting process.

American voting systems have improved in recent years, but they collectively remain a giant mess. Voting is controlled by states, and typically administered by counties and local governments. Voting laws differ depending on where you are. Voting machines vary, too; there’s no standard system for the nation.

Accountability is a crapshoot. In some jurisdictions, voters use machines that create electronic tallies with no “paper trail”—that is, no tangible evidence whatsoever that the voter’s choices were honored. A “recount” in such places means asking the machine whether it was right the first time.

We need to fix all of this. But state and local governments are perpetually cash-starved, and politicians refuse to spend the money that would be required to do it.

Among many other needed measures promoted by nonprofit and nonpartisan Verified Voting, Congress should require standardized voting systems around the nation. It should insist on rock-solid security, augmented by frequent audits of hardware and software. Recounts should be performed routinely and randomly to ensure that verified-voting systems work as designed. The paper ballot generated by the machine should be the official ballot.

What Congress should emphatically not do is allow or encourage online voting. The sorry state of cybersecurity in general makes clear how foolhardy it would be to go anywhere near widespread “Internet voting” in the foreseeable future…

As we have long said in Myth #9, paper alone is insufficient: “Myth #9 – If there is ever a concern we can always count the paper.”

May Post-Municipal Election Audit Drawing

A few municipalities conduct elections in May rather than November. We joined Deputy Secretary of the State Scott Bates, Assistant Secretary Peggy Reeves, and SOTS Office Interns for the drawing. Sadly, due to last year’s reduction in the audit, only one district will be audited.

We strongly object to the official press release’s characterization of Connecticut’s Post-Election Audit as “Comprehensive”. A comprehensive audit would not exempt ballots from selection for audit, it would audit the totaling of votes, and include compliance audits of all aspects of the election such as checkin lists, voter roles, and ballot security.

Here is the official Press Release<read>. We strongly object to the official press release’s characterization of Connecticut’s Post-Election Audit as “Comprehensive”. A comprehensive audit would not exempt ballots from selection for audit, it would audit the totaling of votes, and include compliance audits of all aspects of the election such as checkin lists, voter roles, and ballot security.

Random drawing issues in the Nutmeg State

Connecticut is known as the “Nutmeg State” based on the legend of Yankee Peddlers selling wooden nutmegs to unsuspecting New Yorkers and Pennsylvanians. True or not, there is little reason to trust anyone here when it comes to random drawings. Recent history leaves us with little trust in officials and random drawings.

The Secretary of the State’s Office has improved the integrity of the post-election audit drawing, yet two problems remain.

As CTVotersCount readers know, Connecticut is known as the “Nutmeg State” based on the legend of Yankee Peddlers selling wooden nutmegs to unsuspecting New Yorkers and Pennsylvanians. True or not, there is little reason to trust anyone here when it comes to random drawings.

Lets start with the Lottery and the Lotto game. You could say it is a glitch in the system that allowed vendors to cheat. You would be correct, yet that is not the whole story. Lotto officials knew about the glitch for some time without disclosing or addressing it. But don’t feel bad for officials who are likely “draw” a healthy pension. <read>

Then there are the publicly funded charter schools led by the miraculous Capitol Prep, led at the time by the self-proclaimed “America’s most TRUSTED Educator”, Steve Perry. It seems the miracle may well be due more to lottery prep than trust in the drawing itself (although we have no reason to trust the drawing itself) <read> Then again you don’t need a phony lottery and any preparation to get ahead in Connecticut education – you can wait and cheat on the tests. To avoid proclaiming yourself, let NPR do it: <read>

Which brings us to elections and the Connecticut random audit drawing. What could possibly go wrong?

Up until this point the Connecticut post-election audit drawing has essentially used a barrel with slips of paper to draw districts for the audit. Unfortunately, it could be that officials use an inaccurate list of districts to make the slips. It has happened Post-Election Audit Flawed from the Start by Inaccurate List of Election Districts <read> Fortunately that problem has been addressed <read> Perhaps they can be eliminated completely if the new Election Night Reporting System is used as a basis for the district list in the future.

Yet two problems remain. First, the drawing list is not publicly verifiable. In the Bysiewicz Administration, advocates were solicited to arrive before the drawing and check that every district listed was actually placed in the barrel. Somehow that was dropped by the Merrill Administration. Second, drawing from a barrel is not all that random – observed by the public it may be completely above board, and yet not be random. It is difficult to shuffle/mix slips of paper such that they are actually random – slips printed together tend to stay together and thus there is a correlation where some, say from the same municipality, tend to be selected or not selected.

There are better ways of selecting districts in a more transparent way. Last year the Citizen Audit suggested solutions to the Secretary of the State’s Office based on a request by former Deputy Secretary, James Spallone:

Post-Election Audit Drawing Transparency and Randomness

We have concerns with the transparency and the randomness of the random drawing. There is a single effective solution that would improve the credibility of the drawing, the audit, and our elections.

Concerns – Transparency: We don’t mean to suggest a lack of integrity in the drawing or of any person, yet there is now a hole in the transparency of the drawing which precludes public verification. When the drawing was initiated in 2007 and for several years thereafter, observers were invited to come early and check each and every ticket placed in the raffle barrel to make sure the tickets in the barrel matched those on a list of districts provided. Once the drawing changed from business cards to strips of paper, that part of the process was also dropped.

Concerns – Randomness: Statisticians have concerns with the actual randomness of drawings from a raffle barrel. Strips of paper representing districts for the same town tend to stay together, thus increasing or decreasing their odds of being selected. From past drawings that the variation in the number of districts in towns selected in each drawing it seems from experience may have been way out of proportion (high or low) than would have been likely the case with a truly random selection.

A Single Solution: Change to a random selection, by numbering districts sequentially on a list from 0 to the number of districts (about 730). Then select the districts for audit by throwing three 10-sided dice, or a system similar to the CT Lottery drawing. A 5% audit would entail about 50 casts of the three dice, given that there is about a 70% probability that each cast would provide a useable unique selection. An example of doing this method is from the San Francisco Department of Elections, in the following videos:
Side view video: https://www.youtube.com/watch?v=sdWL8Unz5kM
Overhead view video: https://www.youtube.com/watch?v=Sufb7ykByWA

What can we learn from a jurisdiction in NY that hand-counts every vote?

I recently attended a presentation by Columbia County, NY, Election Commissioner Vivian Martin on the post-election audit/recount performed after every election. It should be of interest to every citizen concerned with trust in elections and every election official: “You Can’t Count Paper Ballots” Want to bet?

After every election (using optical scanners) they count every ballot a second time by hand. What can we learn in Connecticut, “The Land of Steady Habits?

We are not necessarily convinced that we need to go as far as Columbia County. Yet, Connecticut needs a much stronger, more comprehensive, transparent audit; we need a stronger more transparent chain-of-custody; a more uniform, higher quality recanvass. There is no reason, other than “we have always done it this way”, for our current post-election schedule. We could perform rigorous automatic recounts rather than recanvasses; we need more to declare and perform recounts/recanvasses. We could emulate other states and perform audits shortly after the election, delaying rigorous/adversarial recounts to later and providing weeks for their completion.

After every election (using optical scanners) they count every ballot a second time by hand. Here are some of the high points:

They do more than just count the ballots and votes. They day after the election they review the paperwork and checkin lists.
In the next week or so they count every vote and adjudicate voters’ intent. They do this before certification, so that they can certify the actual results with voters’ intent.
They have a simple, yet strong chain-of-custody. Two people transport the ballots. There are two locks with opposing officials holding the keys. Every step is well documented.
They recruit citizens to participate in the process, who learn about elections and enjoy the process and pay.
It costs a “whooping” 1% of their budget. In our opinion, a small price to pay for insuring democracy.
They demonstrate that they can count accurately with the rigorous 4-person hashmark methods they use. (Very similar to the methods used in Connecticut for the Bridgeport Citizen Recount)
They are careful that any questions posed by counters are heard by leaders of both parties simultaneously and answers are determined jointly.
They do not count uncontested races. Other races where they see lopsided, expected results, the losing party official gets consent from their party or candidate not to count a race.

What can we learn in Connecticut, “The Land of Steady Habits?”.

Most of all we can learn that what we do and think in Connecticut is not the only way possible. (It is human nature to assume that the way we have always done it is the only way; human nature to point to other state practices to justify what we want to change, yet ignore them when we don’t.)
No municipality could do this counting, exactly the same way legally in Connecticut. It is questionable that it would be legal to open and count ballots by the choice of election officials at any time. Right after the election we have the potential for a recanvass. It would likely be questioned if similar methods were used for recanvasses, rather than the Secretary of the State procedures for rescanning.
We could use these methods for performing manual audits. Where they have been used, the Citizen Audit has shown that accuracy has been much better than when the more common, in Connecticut, ad-hoc and two-person teams have been used..
Perhaps, if Connecticut officials used better methods and learned from Columbia County, they would stop believing and arguing that “People cannot count votes accurately”.
For a low cost, Connecticut could have a credible and trustworthy chain-of-custody.
We could actually verifiably check our checkins and ballot counts.

Controlling Voting Algorithms is Critical

A short op-ed in the Courant from Bloomberg View, by Cathy O’Neil describes the risks of artificial intelligence algorithms used by the likes of Facebook and Google: Controlling A Pervasive Use Of Algorithms Critical

We should have concerns with algorithms beyond Artificial Intelligence. The same concerns apply to any algorithm (computer code/manual process), such as voting machines. We have no access to the code in our AccuVoteOS optical scanners. Yet we know from studies such as the California Top-To-Bottom-Review, Hacking Democracy’s Hursti Hack, and studies by UConn that the system is vulnerable to attack. We do not know and cannot know for sure if the software running on a particular AccuVoteOS and its memory card is correct and accurate.

Humans are gradually coming to recognize the vast influence that artificial intelligence will have on society. What we need to think about more, though, is how to hold it accountable to the people whose lives it will change…

In short, people are being kept in the dark about how widely artificial intelligence is used, the extent to which it actually affects them and the ways in which it may be flawed. That’s unacceptable. At the very least, some basic information should be made publicly available:

Scale: Whose data is collected, how, and why? How reliable are those data? What are the known flaws and omissions?

Impact: How does the algorithm process the data? How are the results of its decisions used?

Accuracy: How often does the algorithm make mistakes — say, by wrongly identifying people as criminals or failing to identify them as criminals? What is the breakdown of errors by race and gender?

Such accountability is particularly important for government entities that have the power to restrict our liberty. If their processes are opaque and unaccountable, we risk handing our rights to a flawed machine.

The best defense is a comprehensive, sufficient Post Election Audit.

Yet now Connecticut audits with the UConn Audit Station with undisclosed software. Even if we knew the software and tested it, there still would be no assurance that we missed something in our tests, there was a hardware error, or the software was compromised. As we wrote in a recent op-ed in the CTMirror and as covered in the most recent Citizen Audit Report the only defense is a manual audit of that Audit Station, every time it is used.

Covering the items in the Courant Op-Ed:

Scale: Whose data is collected, how, and why? How reliable are those data? What are the known flaws and omissions?
Our voting data is collected. It is only as reliable as the optical scanner as deployed. The system is vulnerable to attack in a variety of ways.

Impact: How does the algorithm process the data? How are the results of its decisions used?
It is supposed to be a straight-forward interpretation of marks to vote counts, provided the scanner is properly configured and programmed. The results are used to determine who leads our democracy AND if our votes actually determine that.

Accuracy: How often does the algorithm make mistakes — say, by wrongly identifying people as criminals or failing to identify them as criminals? What is the breakdown of errors by race and gender?
Here this is, how often does in inaccurately count votes? Did it count them accurately enough in this election? If we had trustworthy audits of the voting machines and the Audit Station we could answer these questions.

Report: Presidential Election Audit: Suffers Two Blows to Credibility

Citizen Audit: Two Blows to Connecticut Election Audits
Leave Them Weaker, Less Credible

From the Press Release:

In spite of growing national concerns about election integrity, election credibility in Connecticut has suffered two devastating blows:

The Connecticut General Assembly cut post-election audits in half from 10% to 5% of voting districts, and failed to fix glaring weaknesses in the state’s audit law.

Shockingly, Connecticut has become the first state to replace verifiable hand-count audits with unverifiable electronic audits. Now the public can’t verify audit results.

“It need not be this way. Electronic audits can be manually verified without sacrificing efficiency,” said Luther Weeks, Executive Director of Connecticut Citizen Election Audit. “Because audits are conducted by the same officials responsible for conducting elections, audits must be transparent and publicly verifiable,” he said.

The Citizen Election Audit also found continuing problems with how municipalities conducted audits. “The Secretary’s Office should take the lead in ensuring that audits are complete, credible, and publicly verifiable,” Weeks said. “The public, candidates, and Secretary Merrill should expect local election officials to organize audits that produce accurate audit reports,” he said.

Citizen Audit: Two Blows to Connecticut Election Audits
Leave Them Weaker, Less Credible

From the Press Release:

In spite of growing national concerns about election integrity, election credibility in Connecticut has suffered two devastating blows:

The Connecticut General Assembly cut post-election audits in half from 10% to 5% of voting districts, and failed to fix glaring weaknesses in the state’s audit law.

Shockingly, Connecticut has become the first state to replace verifiable hand-count audits with unverifiable electronic audits. Now the public can’t verify audit results.

Electronic audits were conducted for six municipalities, while 22 towns conducted manual audits. Post-election audits are required by law.

We respond to Secretary Merrill’s testimony opposing audit transparency bill

Last Monday we testified for S.B. 540, a bill that would increase audit transparency and public verifiability.

Later we noticed that Secretary of the State, Denise Merrill, submitted testimony opposing one provision of the bill and therefor recommending against the entire bill. Her testimony misinterpreted our bill, recommending against it based on something we did not ask for and was not part of the bill.

In response we wrote a follow-up letter to the GAE Committee.

Last Monday we testified for S.B. 540, a bill that would increase audit transparency and public verifiability. The bill would:

Set common sense minimal standards for ballot security.
Set common sense prior public notice requirements for all aspects of the audits which should be transparent and publicly verifiable.
Based on sound science, make the recently implemented machine audits, manually verifiable, transparent, and publicly verifiable.

Our testimony <read>

Later we noticed that Secretary of the State, Denise Merrill, submitted testimony opposing one provision of the bill and therefor recommending against the entire bill. Her testimony <read>

Her testimony misinterpreted our bill, recommending against it based on something we did not ask for and was not part of the bill:

My main objection is that it potentially jeopardizes the sanctity of ballot secrecy. Some people do initial or sign a ballot if a mistake is made. In smaller towns, deducing identity from these details is actually possible.

Creating images of ballots that anyone can take home and study could result in people’s ballots being posted online, something that we are already contending with vis-à-vis the voter file.

She went on to suggest a solution similar to the one actually proposed in the bill.

If there is public uncertainty about our new audit equipment or there is a desire to “audit the audit equipment”there areless intrusive ways to ensure accurate results such as a random sampling of ballots that can be compared to computerized result s while at the audit session. These types of simple solutions could be implemented at no cost and with much less intrusion to the sanctity of our voted ballots.

In response we wrote a follow-up letter to the GAE Committee. Our letter <read>

The Secretary’s testimony incorrectly stated that the S.B. 540 requires the posting of ballot images online. In fact, S.B. 540 bill does not require the release of ballot images to the public and does not require the posting of ballot images online.

S.B. 540 requires the release of Cast Vote Records (CVRs) to the public present at a machine audit, with no requirement for online posting. CVRs are not ballot images. They do not include stray marks by voters. They are data records, one record for each ballot that contains the digital interpretation of the votes on the ballot i.e. numbers indicating which bubbles on the ballot were filled in. They are totaled to determine the votes for each candidate or question in the audit

In the paper included in my testimony, CVRs are described:

“In a machine-assisted audit, the retabulation system produces an interpretation of votes on each ballot (a Cast Vote Record, or CVR) that can be matched with that ballot. The CVRs are exported from the retabulation system. Observers verify that these exported CVRs produce the same electoral outcome(winners, etc.) as the voting system. Then observers compare a random sample of actual ballots against the corresponding CVRs.”

There is no law in Connecticut exempting CVRs from the Freedom of Information Act. A quick survey of election officials and advocates indicates that CVRs for entire elections or audits are regularly provided to requesters in the states of AZ, NY, CO and SC. In SC, they are published online.

In addition to correcting the her misinterpretation, we also pointed out our stand that voted ballots are, in fact, subject to Freedom Of Information requests in Connecticut.

PS: Although it is irrelevant to S.B. 540 we disagree with the Secretary’s interpretation that voted ballots or ballot images are exempt from Connecticut’s Freedom of Information Act (FOI). We are not aware of an explicit exemption in Connecticut statutes. To our knowledge, FOI of ballots has never been tested before the FOI Commission or in court. We are aware of several states where allots and ballot images are subject to FOI.

Testimony on bill to improve election audits, transparency, and security

Yesterday, we testified in support of our bill to improve the post-election audits, audit transparency, and ballot security.

Common sense reforms to require all aspects of audits to be transparent and open to the public.
Common sense reforms to establish minimal standards for ballot security.
Electronically Assisted Manual Audits that are transparent and publicly verifiable, based on sound science.

Yesterday, we testified in support of our bill to improve the post-election audits, audit transparency, and ballot security.

Common sense reforms to require all aspects of audits to be transparent and open to the public.
Common sense reforms to establish minimal standards for ballot security.
Electronically Assisted Manual Audits that are transparent and publicly verifiable, based on sound science.

Here is our testimony <read>