Reply #21: source code [View All]

Diebold gave California their source code a long time ago, when they asked for it. Pretty typical business, it actually happens a lot. They also have escrow requirements for whatever software they eventually deliver there, and will surely comply with those requirements like they do pretty much everywhere else.

California's an interesting place right now, and not especially for good reasons. But it's certainly interesting to watch.

California's actually painted itself into a pretty stupid corner, all things considered.

First they decertified all the touchscreens. Not just Diebold, all of them. Most (including all of Diebold's existing ones) have since been re-certified, but they made re-certification of the new TSx unit dependent on the addition of a voter-verified paper audit trail. No problem (well, except for Diebold, which now has to build a VVPAT unit for the TSx in order to receive the $40 million they're owed for equipment they built and delivered more than two years ago).

Then they passed a law saying all DREs had to have a VVPAT by January 2006, or they'd be de-certified (again) at that time. They even published a long series of requirements for the VVPAT hardware. The main DRE vendors in California are Diebold (which was already working on a VVPAT for their TSx because of the special condition described above) and Sequoia (which already had a VVPAT unit they'd rushed out to New Mexico before California's requirement). No problem, right?

Well, it was a problem because the California VVPAT requirements were kind of poorly thought out. It had to be "machine readable", but couldn't include any ballot-identifying markings (like the kind you'd actually use to make the thing machine-readable). It had to print the ballots in English for English-speaking voters, and in English + the voter's selected language for non-English voters... including ideogram-based languages like Chinese, Korean, Japanese, etc. which are hard to print on a typical line printer. It had to have an independent processor with open-source software to interpret the actual text sent to the printer and play it back as computer-generated audio for blind voters -- even though there's no way to do that while accomodating Chinese, Korean, Japanese, etc. The list went on and on. No problem though... California dictates the requirements and it's the vendors' problem to comply.

Except not really. Sequoia last year was mired in difficult financial times and was up for sale at the time California dictated their requirements. Sequoia brought their unit in for certification, and California said "no, this doesn't meet our requirements... you have to make the following changes and additions to it." Sequoia's response was (literally) "yeah, whatever... we're a little busy with trying not to go out of business, so good luck with all that." California's response was "uhhh, that's not how that was supposed to go." So they called up Diebold, who replied with "Sequoia's your problem, we're a little busy right now trying to build the world's stupidest device to meet your requirements... let us know how all that turns out." Not really what the secretary of state was hoping for.

So California blinked. They removed the "machine readability" clause and scrapped the independent audio processor requirement and made some other changes, then went back to Sequoia and said "OK, we dropped most of the requirements... all you have to do now is make it print in multiple languages." Sequoia's response was "didn't we already tell you 'yeah, whatever'? Seriously, we don't care about your requirements." California called up Diebold and asked "multiple languages?" and Diebold said "yeah, whatever it takes.. also please stop changing the requirements, how the hell are we supposed to hit a moving target?"

Faced with all of this, California realized Sequoia wasn't going to make any changes at all so they just granted them a "provisional certification". Which means Sequoia's DRE+VVPAT is certified in California "for now" even though it (still) doesn't meet all the state's requirements.

In the meantime, Diebold finished their own VVPAT that did purport to meet California's (current) requirements, but state certification was held up for political expediency (raucous meetings with 200 angry activists will sometimes do that, lol :D ). They decided to hold an unprecedented "volume test", where they cast 10,000 votes on 100 or so DRE machines and record the result. In 10,000 votes they recorded around 20 instances of paper jams, and around 20 cases where a previously-undetected software bug caused a firmware crash. This was variously reported as "a 20% failure rate", even though no votes were actually lost and the math is subject to interpretation (i.e. 20 machines out of 100 had a problem, which equates to 20% failure rate, or 20 ballots cast out of 10,000 had a problem, which is a 0.2% failure rate -- it depends entirely on your outlook).

So Diebold went back and looked into the problems. They found the software problem that caused the sporadic crash, and they made some mechanical adjustments to the printer mechanism to minimize and better detect jam conditions. The big volume test was conducted again, and everything passed. Diebold re-applied for certification, and another raucous public meeting was held (although only about half as raucous as the first one).

In the meantime the counties went to the secretary of state and said "will you please stop f*cking around? we have actual elections to run!" (It's an ongoing problem in the election industry, particularly in places like California. Counties have to actually run the elections. The state doesn't run elections at all, but they get to make all the rules about how to conduct the election. Traditionally they don't care whether the rules they come up with are stupid or unworkable or even make sense -- that's the counties' cross to bear, since the state doesn't have to deal with the problems of actually running the election. :eyes: )

Which leads us up to the present day. All indications were that the secretary of state probably was going to re-certify the TSx in the near future. Whether we agree with it or not (and I'll assume we don't ;) ), he really has no grounds not to: it's passed all required federal certifications, it has a California-compliant VVPAT (the only one, in fact), it's counted the votes correctly in every test, it passed a massive volume test that no other vendor's been subjected to, and it's already been used successfully with the same VVPAT in two other states. Moreover, in around two weeks half of California's counties are going to be unable to conduct elections at all: HAVA requires some ADA-compliant machines as of January 1 and California's VVPAT law is going to decertify all the state's ADA-compliant machines on the same day. Like I said, it's a pretty stupid corner.

In one last inexplicable bit of political pandering, the secretary of state announced a new hurdle to TSx certification: Diebold would have to pass a security test of its optical scan system based on claims made by Bev Harris and her unsavory crew. Why the certification of the DRE+VVPAT hinges on a security test of the optical-scan machine is beyond the comprehension of either me or any of my sources in California, and the (unconfirmed) suspicion is that it's a political ploy to delay Diebold certification until some other vendors are ready too. Unfortunately, Bev Harris turned the whole thing into a big Bev Harris publicity stunt, demanded that they only test the old machines, demanded lawyers, a court recorder, the media, observation by the public, a bowl of M&Ms with all the brown ones removed, a panda and an edict from the SoS that nobody is to look her directly in the eye. (OK, that's partly exaggeration, it's true up till "M&Ms"). The secretary of state's office, realizing its error, has since rescinded its invitation to BBV to participate in the testing, and has extended it directly to Harri Hursti in the hope that he's not tainted with Bev Harris' crazy stink. Bev in the meantime is still pretending that she's involved, negotiating terms and posting threatening letters from her lawyer to the SoS etc. on her web site, but the sad truth is that the SoS office is pretty much just ignoring her and has stopped responding to her entirely.

So that's where things stand today. Presumably Hursti will be invited to test the optical scan unit sometime soon (he's in the country right now, based on the reports out of Florida, so it's conceivable that the test is already underway). And if the optical scan tests pass, then maybe they'll re-certify the TSx DREs (and yes, that whole logic is incomprehensible). But my guess is no... I suspect they want to delay certification until other vendors (i.e. Sequoia) can pass California's VVPAT requirements, just for the sake of appearances. They also have a headache because of problems with ES&S equipment miscounting votes in the last couple of elections -- with the big, public "volume test" precedent they set with Diebold they're almost compelled to make other vendors do the same kind of test, and they're afraid of what'll happen if they run it with ES&S machines until they can get them fixed. So the strategy appears to be to defer certification as long as possible, under whatever pretext is convenient.

And in the meantime, counties are pissed off because they have to run an election in a little over 3 months. They don't know what equipment they're going to be allowed to use, or what they're allowed to buy, or whether to print optical scan ballots, or what happens when they're unable to meet HAVA requirements or what. San Diego and San Joaquin counties have warehouses full of TSx units they want to use, but can't. Riverside county just bought $6 million worth of VVPAT units that don't meet CA requirements and have only a provisional certification and have never been through a large-scale test. Alameda county was going to upgrade their existing Diebold DREs to TSx units with VVPAT to meet all the new requirements, and had negotiated an extremely favorable price on the upgrade. Because of the delays they've backed away from that and will now probably buy an optical-scan system with an ADA unit (AutoMARK or DRE)at around double the price. Diebold mostly just wants to get paid for the equipment they already sold and get away from the protracted craziness in California for a while.

Meanwhile Sequoia's facing a lawsuit because their DRE+VVPAT has been used in California already, even though it doesn't actually meet state requirements. I don't have many details on that at this time. Maybe something will come of it, maybe not.

So I'm not sure if that answers your original question, lol. :D Mostly I think Diebold and Sequoia will both get their units certified in time for next year's March primary, but who really knows with California. It'll be tough for Diebold if they have to go back and make changes to something, since the turnaround time for code changes, testing, federal certification and state testing is so long. At some point you'd think the state would have to be a little pragmatic and let the counties know what's going on so they can prepare. But who knows?


Neil