Touchscreens raise questions

Pima County staff responds to community debate

Opinion by Ann Brown

ARIZONA DAILY STAR

"The accurate counting of all votes is absolutely fundamental to our democracy," local attorney William J. Risner said in a July 26 letter to the Pima County Board of Supervisors.

Risner is right.

Voting is a sacred privilege that must be honored and respected. And every vote must count and be counted.

The opportunity for fraud and manipulation in the way some votes might be cast and counted has sparked a contentious debate in our community.

Risner is among opponents of the use of Diebold TSX touchscreen voting equipment who question Pima County's methodology and competence in the testing and validation of equipment. The Board of Supervisors will be considering authorization of the machines for the upcoming elections at a special meeting Friday morning.

On June 6, the Board of Supervisors approved the purchase of 409 Diebold Elections Systems machines, one machine for each precinct. The board directed its staff to study the security and reliability of the equipment before it approved use of the machines.

The county purchased the equipment because it had to spend $2 million in federal money to be in compliance with the Help America Vote Act. The Diebold product was picked because it is compatible with the company's optical scanners, which the county uses.

On July 19, County Administrator Chuck Huckelberry issued a memo to the board that outlined security steps and recommended authorization of the touchscreen devices for the primary election, with early voting beginning Aug. 10.

In Monday's editorial, the Star supported the authorization of the machines, which drew questions from readers and criticism from groups and individuals opposed to the equipment's use.

John R. Brakey of Americans United for Democracy, Integrity & Transparency in Elections told us that he and others who oppose the equipment's use plan to challenge the accuracy and merit of the recommendation at Friday's meeting.

In an e-mailed list of questions and concerns, he said the report did not adequately address possible hacking and other security breaches, or the Diebold software's vulnerability, nor did it respond to reports and analyses citing equipment flaws. He also took exception to the memo's inclusion of positive reports that followed Utah's use of the equipment.

We culled and consolidated critics' comments and readers' questions and asked Huckelberry, Elections Director Brad Nelson and John H. Moffatt, of the county's Office of Strategic Technology Planning, to answer specific questions about the equipment and related processes.

Who was involved in the evaluation and what are their credentials? What were the protocols and objectives of the tests? Has Pima County consulted with an independent computer security specialist to examine the operations of the Diebold touchscreen machines? Has or will Pima County allow an independent examination of the Diebold machines by a credentialed computer security expert or analyst?

County staff: Prior to the sale of any election equipment to a jurisdiction in Arizona, the vendor must have submitted and passed national certification testing. This national certification is performed by independent testing authorities that review election systems to ensure that the systems meet the standards set by the federal government and required by law in the state of Arizona.

After receiving national certification, the equipment must then meet Arizona certification standards prior to approval of its use in the state. This state-level certification is performed by a three-member committee appointed by the Arizona secretary of state: a member of the engineering college at one of the universities, a member of the State Bar and one person familiar with the voting process in the state. This committee investigates and tests the various types of election equipment that may be used in Arizona. The committee submits its recommendation to the secretary of state, who makes the final adoption of the types of election equipment certified for use in the state.

At the local level, a logic and accuracy test is publicly conducted prior to each election to test the accuracy of all the election-related hardware and software. These local logic and accuracy tests are performed by state-certified election officers.

This test is scheduled for Thursday, Aug. 3, for early-voting equipment. The public is invited to view this test; call 740-4280 for a location and time to attend.

In short, all election equipment used in Pima County has been tested and approved by three separate and independent entities prior to use in an election. [This response fails entirely to answer the question presented. It does not disclose any security test protocol conducted by Pima County, who conducted it, whether the county is accredited to perform such test or whether the individual conducting the test was credentialed to perform the test. It does not disclose whether an independent testing authority was consulted, or whether one will be permitted to examine the machines. It appears to rely entirely on federal testing standards, which have been called into question in several recent reports]

The Brennan Center for Justice, a New York City-based think tank, identified 120 security threats to the three most commonly purchased electronic voting systems. Have the security risks identified by this study been addressed with the county's new equipment?

County staff: Yes. [How? See above] The 120 threats identified in the NIST (National Institute of Standards & Technology) Voting Systems Threat Analysis Workshop in 2005 covered all three of the touchscreen voting systems (and many of them addressed functions or features not present in the Diebold TSX model planned for use in Pima County).

The nine categories of threats ranged from insertion of corrupt software and miscalibration of the machines to actions by corrupt poll workers and vote-buying schemes. The Summary of Findings section of the report indicates that while there were vulnerabilities, "the most troubling vulnerabilities of each system can be substantially remedied if proper countermeasures are implemented at the state and local level."

It is these countermeasures of security, control, chain-of-custody and formal procedures that are being employed by Pima County. [These countermeasures have not been disclosed to the Board or the public. We have a right to know.]

The report did not take into consideration the environment in which the units would be used. Most computer and security experts would agree that any information system, when removed from its technical and procedural support structure, is much more vulnerable.

Many of the security recommendations in the report were already standard procedure for the optical-scanning voting system and so were simply extended to incorporate the Diebold or touchscreen system. Recommendations for increased audits have been addressed by the Legislature as well as locally. [SB 1557 is not yet cleared by USDOJ; what "local" audits? Bill Risner said his request was refused by Brad Nelson]

Wireless capability is not implemented on the units, and the port into which a wireless card could be inserted is sealed with a tamper-evident seal. [There are seals, and then there are seals. We need to know that the best security tape is in place.] Parallel and random testing, local control and implementation of procedures to address evidence of fraud or error are already standard procedures. [What are these procedures, and have they been shared with the Board and the public?]

Among the Diebold software's security vulnerabilities is a "back door" allowing modification to the software without technical safeguards in place to ensure that only authorized people can make changes. How can Pima County ensure a malicious individual could not alter the software? Are there technical safeguards in place to ensure that only authorized people can make changes?

There are no "back doors" to the system. [ABSOLUTELY FALSE! See numerous security reports, especially Hursti] There is a standard method to update the software that requires access to the system through physical barriers and strict chain-of-custody procedures. Passwords to the systems are changed from those shipped by the manufacturer, and are changed on a regular basis. The servers are not connected to outside networks by direct hard wire or wireless connectivity. [How can we know this, since we were not allowed to inspect the equipment?]

If the physical chain-of-custody is broken and seals indicate tampering, then the standard security procedure is to reinstall the software onto the touch screen using a trusted install file. [AFTER votes are recorded on the machine? That machine needs to be quarantined for an election fraud investigation, and only the paper ballots, if any, counted.]

One of the security risks involved with the Diebold is the "on and off" switch. Turn it off and the data is erased. Leave it on and there is considerable access to the machines. How is the physical security of data and equipment ensured?

County staff: Cycling the power on either the touch screen (AccuVote-TSX) or optical scan (AccuVote-OS) does not affect the data storage or the security of the system. Data storage is done on non-volatile memory. Cycling the power on the unit when it is in the Election Mode resumes the ballot casting process. Votes are not lost. The machines are password-protected as well as having access ports and memory-card ports sealed with tamper-evident seals [see above note] so physical access to machines is blocked or detected if access does occur. [The question we presented was about the power button being located next to the memory card slot and Brad Nelson drilling a hole in the equipment to gain access to the power button. The question was presented in a way to avoid addressing this specific security issue.]

What measures are in place to prevent fraud after the vote is final and very close votes occur?

County staff: Total-vote report tapes are printed at the precinct level before the system is ever allowed to upload the results via modem or directly to the GEMS central computer.

With the optical-scanning system, the ballots are contained within a locked ballot box and the ballots themselves can be audited during the canvassing period. With the touchscreen system, the paper audit records are sealed in a canister that will not allow the paper to be removed without breaking the seal.

Machines are transported to and from voting locations to the Election Center in ballistic nylon cases locked in a steel cart with the cases and the cart sealed with serialized tamper-evident security seals. This protocol prevents tampering with vote-tabulating devices post-election and during transport to a secure storage area. [What about a malicious election worker at the central tabulation location? What about public observance of the vote counting system, especially by party observers, and what about procedures for the hand counts required by SB 1557?]

How can the county consider the electronic ballot verification to be secure? Electronic images, however they may be displayed to the voters, are simply electronic data. Once viewed and verified, can they be tampered with or altered?

County staff: Touchscreen votes are recorded electronically as well as simultaneously on a voter-verified paper record. This voter-verified paper record will be compared to the electronic tally from the touchscreen voting devices and forms the basis of an audit trail.

Based on new Arizona law, this audit of voter-verified records will be performed on random precincts for random contests, with the participation and observation of the four recognized political parties in Pima County. This random paper-record audit is a powerful method of detecting tampering or vote-tabulation errors. [Misleading answer; SB 1557 has not been cleared by USDOJ, so this security is not in place. See next question.]

The recommendation memo included mention of the new state law which mandates that 2 percent of the precincts in each county will be selected at random and the ballots in three races will be hand-counted. However, this measure might not be in place in time for the primary election, because the U.S. Justice Department must first approve the measure and the election guidelines to be adopted by the Secretary of State's Office. The new guidelines might not be approved for the primary or the general election. Will this law be a practical safeguard for this upcoming election?

County staff: Pima County will notify the U.S. Department of Justice of our plan to perform the vote verification sampling in accordance with Arizona law. Assuming we are not prohibited from implementing the process by the Department of Justice, we will conduct the vote verification audit required by recently passed Arizona law. [Secretary of State Jan Brewer will not permit Pima County to do this absent USDOJ clearance.]

Is a voter-verified audit trail the same as a paper trail? Will there be a paper trail?

County staff: Yes. There is a printed record of each voting transaction and each vote cast. [A physical ballot is NOT the same thing as a transaction record on a roll. It is misleading to equate the two as being the same.]

How will the new equipment deal with printer jam?

County staff: When the touchscreen voting terminal detects a jam in the printer or a paper-low condition, a message will notify the voter to contact a poll worker for assistance. Paper jams can be cleared by a poll worker. [What training will poll workers receive for the Diebold machines? Or are we really talking about roving Diebold technicians. We need to know this.] A paper-low notification is given well in advance of the paper running out. Voters will still be able to complete their ballots and the system will not allow additional ballots to be cast until the paper is replenished.

Is there the possible use of wireless modems in the machine and wireless ports that allow the machines to be hacked from a distance?

County staff: There are no wireless devices inside the Diebold voting terminals. There is a port into which a wireless card could be placed, but the port is sealed with a tamper-evident seal, [Again, see above] and Pima County has no intention of installing any wireless devices in the voting terminals at any voting precincts or the central counting facility.

Who will have access to the Diebold machines? What type of security checks are in place for Diebold technicians and others who come in contact with the machines?

County staff: Pima County Elections staff (five people) who have direct access to the critical components of the system, such as servers, memory cards, ballots, voter-verified paper audits, undergo a security background check. Poll workers, voters, logic-and-accuracy board members, receiving boards, equipment delivery personnel and Election Day troubleshooters will be in close proximity to the equipment, but access to these devices will be behind locks and/or tamper-evident seals.

Diebold employees are asked for identification upon arrival at Pima County Elections to work on equipment and are observed by qualified Pima County personnel. [This appears to directly contradict the above statement that only five people have "direct access" if Diebold is working on equipment. And why is a background check only required for the five County employees and not Diebold employees? That is a serious LACK of security.]

Are the Diebold machines compliant with the Help America Vote Act requirements for disabled accessibility? How do the physically disabled (i.e, dexterity or mobility limitations) use the machines? How can a blind person verify his or her ballot?

County staff: HAVA requires that a voting device be available in each election precinct that is accessible for voters with disabilities, including the blind and visually impaired, and that these accessible voting devices provide the same opportunity for access and participation (including privacy and independence) as for other voters.

There are no voting devices, by any vendor, that can universally serve all disabled voters, such as a voter who is deaf, blind and has manual dexterity challenges. The Diebold touch screen does have the ability to read the ballot to a vision-impaired voter through the use of headphones. Voters may also use the headphones to verify their votes prior to casting their ballots.

What are the projected long-term maintenance and operation costs of these machines? How long will they be used?

County staff: The service life of the products is between 15 to 20 years. Maintenance costs vary per product type. As the TSX devices are new to Pima County, we do not have any specific operating costs at this point in time. [There are cost comparison studies from other jurisdictions available]

Should Pima County voters feel confident that these machines wouldgive valid, accurate results?

Voting systems are evaluated and independently certified according to stringent rules at both the federal and state levels. [Again, federal testing standards have been called into question.] The systems are also tested locally to ensure compliance with the certified levels of hardware, firmware and software. [Again, they do not reveal the testing protocol that Pima County allegedly performed on these machines.] Detailed operational protocols are developed by the secretary of state, extensively reviewed and published, and the counties are checked as to compliance.

There have been many issues surrounding the use of the touchscreen voting devices.

Pima County has listened to the concerns raised and exhaustively reviewed many of the pertinent publications, articles and Web sites in an attempt to understand and address appropriate solutions to the issues. Many of these concerns are legitimate, necessitating enhanced security processes, audits and continued close control through chain-of-custody of the voting equipment.

Many of the security recommendations made by studies such as the Brennan Center for Justice have been implemented by Pima County. With the introduction of Direct Recording Electronic (touchscreen) voting devices, additional protocols have been implemented by the Legislature, the secretary of state and Pima County to enhance security controls as well as implement countermeasures to address vulnerability concerns and to ensure confidence in the outcome of an election using these devices.

Anything else you'd like voters and Star readers to know about the equipment?

County staff: It is important to note that the optical-scan ballots used in Pima County for nearly 10 years are not going away. Voters will still be able to enter the polls and mark their ballots by filling in the ovals on a paper ballot. The addition of the touchscreen equipment is being provided for the exclusive use of disabled voters. [ABSOLUTELY FALSE! Anyone can use these machines.]

Just as you would not inappropriately park your car in a spot designated for the disabled, on Election Day please keep the touchscreen devices available for those voters who truly need to use the equipment. [Nice try!]

We take election integrity very se

riously and continue to ensure a fair and accurate election using the voting devices authorized for use by the National Association of State Election Directors as well as the secretary of state.

Read more online

John R. Brakey, co-founder of Americans United for Democracy, Integrity & Transparency in Elections, wrote a guest opinion opposing the touchscreen voting machines in the June 11 Opinion section. Read Brakey's opinion at http://www.azstarnet.com/sn/opinion/132967

Critics of touchscreen voting machines frequently cite two sources of information about the security and reliability vulnerabilities of the equipment:

• The Brennan Center for Justice at New York University School of Law's June analysis "The Machinery of Democracy: Protecting Elections in an Electronic World," which is available at www.brennancenter.org

• The consumer group Black Box Voting, http://www.blackboxvoting.org/ , has an evaluation of the Diebold equipment. It was released in May. voting machines up close

Only disabled voters would use the touchscreens in this year's primary and general elections [Representative Ted Downing: please address this to Ann Brown and the Board]

special meeting Friday

The Pima County Board of Supervisors will tackle whether to authorize use of the Diebold touch-screen voting machines for early voting and the primary and general elections at a special meeting at 9 a.m. Friday in the hearing room of the County Administration Building, 130 W. Congress St. To contact board members, go to http://www.pima.gov/bos/bos1.html