Bad grades for a voting-machine exam

Riverside County, Calif., invited citizens to observe a test of its computerized voting systems. One participant was not impressed.

By Farhad Manjoo

Oct. 15, 2003 | Over the past several years, as computer scientists began expressing concerns about the security of touch-screen electronic voting machines, elections officials across the nation have reassured the public with a simple answer: Testing.

Elections officials maintain that before they are ever used in an election, electronic voting systems are put through a battery of tests, the culmination of which is the "logic and accuracy" test that counties perform a few weeks or days prior to an election. This examination is billed as a simple, straightforward way of telling whether a machine is working as it should. A predetermined number of ballots are fed into the machine, and then the votes are tabulated. If the system spits out the results you expect, the system is deemed fully functional.

But Jeremiah Akin, a 28-year-old computer programmer who recently observed one of these tests in Riverside County, Calif., says that what he saw did nothing to mitigate his concerns about electronic voting -- indeed, the whole thing made him more worried than ever.

Akin, who observed the test as a representative of the Peace and Freedom Party, says that representatives of other parties who were there signed off on the test without waiting to see the complete results. In fact, he says, nobody else seemed concerned that anything could go wrong with touch-screen machines. In a 22-page report Akin wrote recording his observations of the test, he says that "statements made by the Registrar of Voters indicated to me that she is not qualified to assess the reliability and security of such systems, and that she misunderstands some essentials of computer programming and operation. Her deputies refused to answer some important questions. Some statements made by officials at the Registrar's office, and found on the contractor's Web site, I learned on the test day were misleading or inaccurate. Further research after the test day has turned up several other reasons to doubt the reliability, security and accuracy of the system."

Riverside County was one of the first places in the nation to employ touch-screen machines -- the county used them in the 2000 election, before anyone had ever heard of the problems with older, punch-card machines. After that race, Mischelle Townsend, the county's registrar of voters, was celebrated in the national media, held up as a visionary who'd seen the promise of voting with computers.

Since then, however, some of the world's most respected computer scientists have highlighted serious problems with electronic voting machines. In July, scientists at Johns Hopkins and Rice found alarming security holes in voting machines made by Diebold, which provides election systems in 37 states. On its Web site, Sequoia Voting Systems, which makes the machines used in Riverside County, insists that its machines are safer than Diebold's. But technologists say that because Sequoia's systems don't produce a voter-verifiable paper trail -- some physical evidence that the voter's choice has been accurately rendered -- they're no better than most of the other electronic machines on the market.

Now that such machines are under fire, Akin says that Townsend went out of her way to defend electronic voting during the logic-and-accuracy test, which was held on Sept. 9, in anticipation of California's Oct. 7 gubernatorial recall race.

The story Akin tells of that test indicate serious shortcomings with the machines as well as the process used to verify them. He spoke to Salon on Tuesday from Riverside.

From what you write about what happened at this test, it seems that the elections officials were trying to reassure everyone about electronic voting machines. Was this whole exercise to prove that these machines work?

Well, before an election there's a legal requirement to run logic-and-accuracy testing, so that's what the purpose of the test was, and we were brought in to observe that. But it did have more of the feel of a sales pitch than of a test.

You write that the elections officials were specifically addressing some of the concerns that people have with these machines.

Yes, they were, and before and after the meeting Mischelle was going after people who don't support these types of machines, especially Bev Harris and also the computer science community. She was saying computer scientists don't know about how elections are run -- she didn't name any specific computer scientists. But just lumping everybody together and labeling them as ignorant isn't very convincing.

Can you tell me about the other people who were there? You say that it seemed to you that most of the people who were observing didn't understand or didn't have the same questions you did about the technology.

Yeah, that's true. There was one who said, "This is like 'Star Trek'!" He was talking about how one day voting over the Internet would be possible. He really was not technically proficient. He didn't understand some of the limitations of working with computers. People who work with computers a lot know that they have bugs and know that they crash and there's no real way to get all the software bugs out of a complex system. These people didn't have any experience with that and so they could be easily convinced otherwise.

There was somebody from the Libertarian party who was there, and somebody from the Republican Party who showed up late and played with his phone a lot. So I don't know how technically proficient he was.

Describe to me how the test was run.

Well, I was picturing that people would go up and touch the touch screen and verify that what they had pressed was registered as a vote. But the way it's run is, they have a test cartridge that they pop into the back of the machine, and it runs a script -- it runs several hundred different voters, like some type of emulation.

Sort of a simulation of what would happen during a day of voting.

Yeah. But the touch screens themselves weren't actually pressed. Nobody got to touch those. So we didn't see what was on them, and we didn't see the input that was put into the machine. All that we saw was the output that came out later. And, I mean -- that's like telling somebody that your calculator can add 2 plus 2, then pressing some buttons behind a screen, and then showing them that it says 4.

Next page: No production testing, no real paper trail, and a reliance on insecure Windows software