ELECTRONIC VOTING'S HIDDEN PERILS
By Elise Ackerman
Mercury News
Poll workers in Alameda County noticed something strange on election night in October. As a computer counted absentee ballots in the recall race, workers were stunned to see a big surge in support for a fringe candidate named John Burton.

Concerned that their new $12.7 million Diebold electronic voting system had developed a glitch, election officials turned to a company representative who happened to be on hand.

Lucky he was there. For an unknown reason, the computerized tally program had begun to award votes for Lt. Gov. Cruz Bustamante to Burton, a socialist from Southern California.

Similar mishaps have occurred across the country since election officials embraced electronic voting in the wake of the Florida vote-counting debacle of 2000.

When Californians go to the polls next month to choose a presidential candidate, many voters will cast a virtual ballot by pressing a computer touch screen that records their votes digitally. The only tangible proof that a citizen has voted and how he voted will be fingerprints left on the machine's screen.

Electronic voting removes the risk of election officials misinterpreting hanging chads. But it raises another electoral peril: that a digital ballot box might miscount votes without anyone noticing.

As the black box replaces the ballot box, concern is growing that local officials are becoming dependent on a handful of corporations to guarantee the integrity and accuracy of elections.

Counties, including Santa Clara County, rely on these voting-equipment companies to manage the software that runs digital voting machines and counts electronic votes and to fix things when they go wrong on election night. The companies, however, consider such software a trade secret, making independent confirmation of contested elections difficult, if not impossible.

To guard against error and fraud, the state requires that the companies only install approved software on electronic voting machines. But in California, one of the biggest voting-equipment companies, Diebold Election Systems, provided 17 counties with uncertified software that was used in recent elections.

Review of practices

County election officers remain responsible for overseeing electronic voting systems, but a review of past elections and current practices raises questions about how closely they're monitoring voting-equipment companies.

``My biggest concern is the lack of accountability,'' said David Dill, a Stanford University computer-science professor and a leading expert on electronic voting.

Election officials and company representatives dismiss concerns about computerized voting as overblown, citing safeguards designed to ensure the reliability of computerized voting systems.

``We have the best system available on the market. It is secure and reliable and the voting public had a wonderful experience,'' said Jesse Durazo, the registrar of voters for Santa Clara County, which uses touch-screen machines from Sequoia Voting Systems.

Alameda County officials still don't know why the computer program failed on election night. In fact, they only discovered the malfunction because they could compare the paper absentee ballots the software was counting to the computer's tally. The rest of the county's voters cast electronic ballots. Nor were election workers aware at the time that their touch-screen machines were running unauthorized Diebold software in violation of California law, as a state investigation later discovered.

``There was something in the software,'' said Elaine Ginnold, assistant registrar of voters for Alameda County. Alameda County officials refused to allow the Mercury News to review the software code used to test its electronic voting system, saying it was a Diebold trade secret.

``At no time were incorrect vote totals released,'' Diebold spokesman David Bear wrote in an e-mail. ``The system is safe, secure and accurate.'' He attributed the malfunction to a computer-server error and the large number of candidates on the recall ballot.

``The counties are in over their heads,'' said Kim Alexander, founder of the California Voter Foundation, a Davis-based election watchdog group. ``People are left depending on the vendors to tell them who won the elections.''

That is especially the case on election night, when mechanical mishaps and buggy computer code could create crises only company employees could resolve.

For instance, in Riverside County during the 2000 presidential election, a computer from Sequoia began ping touch-screen ballots from the vote tally. A Sequoia salesman who was on hand intervened and fixed the problem.

Unnoticed error

Two years later in Bernalillo County, N.M., neither local election officials nor a Sequoia representative noticed on election night that a programming error was causing a computer running Microsoft SQL server software to 25 percent of ballots cast by early voters. Three days later, a Democratic Party lawyer spotted a discrepancy between the number of voters who signed in at the polls and the number of digital ballots counted. Sequoia then managed to recover the lost votes.

``They messed up,'' said Mary Herrera, the Bernalillo County clerk, of Sequoia.

Responded Sequoia spokesman Alfie Charles: ``It was just a bug in Microsoft that required an additional step in converting data into the database format. There was a patch that was later applied by Microsoft.''

Alexander of the California Voter Foundation worries that such incidents mean the machines could miscount ballots or fail to register votes without anyone realizing.

Critics are alarmed that touch-screen voting systems do not create a paper record that allows for a physical recount of ballots. Rather, the machines record votes on digital memory cartridges. When the polls close, the cartridges are removed from the touch-screen machines and plugged into a computer which downloads and tabulates the voting data.

In November, California Secretary of State Kevin Shelley ordered that by July 2006 all touch-screen machines must print paper receipts so an election can be independently audited. To meet that mandate, the voting-equipment companies must manufacture new state-approved hardware and software.

Computer scientists acknowledge a paper trail will help ensure the accountability of electronic voting systems. However, they say such a requirement does not resolve concerns over counties' dependence on voting-equipment companies and the security of computerized voting.

Until voting machines produce paper receipts, the only way a candidate can investigate questionable election results is by examining the voting systems' software code.

But there's a catch: Election companies consider such software a trade secret not open to public scrutiny or subject to challenge from losing candidates, as Emil Danciu found out.

Danciu ran for city council in Boca Raton, Fla., in March 2002. A popular former mayor of the seaside town in Palm Beach County, Danciu expected to win in a landslide but lost by 16 percentage points.

After some voters complained that Sequoia's touch-screen machines appeared to have recorded ballots cast for Danciu as votes for his opponents, Danciu sued to obtain the Sequoia software code.

But Palm Beach County didn't have the code. ``All of this stuff that they are asking for are all proprietary items owned by the manufacturer,'' a county attorney told the judge hearing the case. The attorney argued that even if the county did have the documents, it would be a felony to disclose ``trade secrets.''

The judge denied Danciu's request for the software code.

U.S., state inspectors

County election officers and voting-equipment company executives stress that voting machines and software are carefully examined by federal and state inspectors before receiving approval. Furthermore, they say, pre-election testing ensures ballots are counted correctly.

``There are checks and balances to ensure nothing has been compromised,'' said Charles, the Sequoia spokesman.

The goal of the government certification process is to make sure proprietary voting systems are accurate, reliable and secure. The certification process is crucial because it provides the only safeguard voters have that the machines are performing the way the election companies promise.

``Every single piece of hardware and software that is used in an election is certified by our office,'' state election official John Mott-Smith reassured the Santa Clara County Board of Supervisors last year. ``Every modification to those systems has to come back for certification and testing if necessary.''

Yet eight months later, a state audit revealed that voters in 17 California counties had cast ballots in recent elections on Diebold systems that were running software not approved by the state, according to a December 2003 report. The Diebold software is used to count both touch-screen electronic ballots and paper ballots read by an optical scanner. Three of the counties, including Los Angeles, the state's largest, were using Diebold software that had not been submitted for federal review.

Assurances by vendor

The audit also found that county election officials had not independently verified they were using certified software, as the law requires, but relied on assurances by Diebold it was complying with state regulations.

Even tech-savvy counties like Santa Clara can have difficulty tracking exactly what their voting-equipment company is doing for them. Computer scientists argue that a failure to keep close tabs on modifications to the machines or their software opens the door to tampering or the introduction of errors that might show up on election night.

Following November's election in Santa Clara County, Sequoia sent over a group of blue-coated technicians to make adjustments to voting machines that experienced battery problems. For three weeks, the workers, employed by a Sequoia subcontractor, took apart the machines, removing their circuit boards and making adjustments.

Nevertheless, Santa Clara County officials didn't know the name of the subcontractor and hadn't verified the identities of the workers it hired when the Mercury News made an inquiry. They also hadn't documented the changes being made to the machines.

To find out such information, ``you'd have to contact Sequoia,'' said Assistant Registrar of Voters Elaine Larson.

In interviews with the Mercury News, registrars defended their close relationship with the companies. The world of elections administration is a small one, and the revolving door between state, federal and county elections departments and the voting-equipment companies has spun for years.

``I have a hundred percent confidence in Sequoia in their integrity and honesty and their ability to keep us compliant with the law of California,'' said Cathy Darling, assistant registrar of Shasta County.

That attitude bothers Dill, the Stanford computer scientist and electronic-voting expert. ``From a computer-security perspective, handing over control of an important part of the election, I think, is not a good idea,'' said Dill. ``I'd prefer to see that kind of control in the hands of local officials who are accountable to elected representatives.''
Contact Elise Ackerman at eackerman@mercurynews.com