Central tabulator monitors: How to create your own audit log

From http://www.blackboxvoting.org -- and many thanks to the security guys who parked themselves at our office until the wee hours to work on this, after perusing audit logs missing 3 hours of entries, and gagging on the clear FEC violations used in our voting systems.

We need your help. You don't need to be a computer person. And lest you feel this how-to-monitor list is overwhelming, let me reassure you: Watching the central tabulator (at the county office) is boring. You'll be glad we suggested all these excellent things to do.

Get there early -- they only allow a handful of people. Plan to stay late. Don't doze off, that's when the interesting stuff happens. Ok, here we go:

MONITORING THE CENTRAL TABULATOR

Black Box Voting developed these guidelines to help you create an audit log, which can then be compared with the FEC-required computer-generated audit log inside the computer.

Yes, this is a lot of stuff, and it might feel overwhelming, but whatever you can do -- just do what you can. Thank you very much.

THINGS TO BRING WITH YOU
- A notebook and pen. Preferably a notebook with a sewn binding, if you can find one. Do not take notes on a computer.
- A cell phone
- Binoculars
If you can, also bring these:
- A camera
- A small tape recorder
- A video camera, with a zoom lens if possible

Note that some counties will require you to turn off your video camera during the entering of passwords, a valid request. You should, however, be able to videotape the rest. Don’t pull your camera out right away. Avoid confrontation by leaving your video camera in the bag -- better yet, a purse. Pull it out only when there is an event of significance.


HUMAN FACTORS
You can’t be effective if you make assumptions or let others intimidate you.
- Don’t let others make you feel dumb.
- Make no assumptions about security. It might be worse than you expect.
- Don’t count on the accuracy of anything other people tell you, even if they work for the county or the vendor.
- About party observers, techies, or lawyers: Remember that they have not examined the actual software or setup, and they are operating on assumptions, hearsay, or in some cases, may be trying to misdirect your attention.
- Vendor contracts prohibit county officials from examining their own software. Elections officials may just be repeating what someone else (the vendor) has told them.

YOUR ROLE AS AN OBSERVER: CREATE YOUR OWN AUDIT LOG so it can be compared to the real audit log.

Write down the following. For every event, write the date, time, including minutes.

1. NAMES & AFFILIATIONS: Get the names of everyone there. Find out affiliation.

2. WHERE ARE THE COMPUTERS: Establish the number and location of all vote tabulation computers. They call them different things: tabulators, servers. What you want is the computer that adds up all the votes from everywhere in the county.
- Some counties have only one. If there are more than one, find out where each one is. If there is more than one tabulator, ask if they are networked together and find out if any of them are in places you can’t observe.

3. SYNCHRONIZE YOUR WATCH with the central vote-tally computer. Ask officials to tell you the time on the computer. If more than one, ask for the time of each and the ID number of each.

log the date and time, to the minute, in this format:
Nov 02 2004 11:25 p.m.
Nov. 03 2004 01:15 a.m.

CREATE A LOG FOR THE FOLLOWING:

People: Ask names and affiliations for, and log the START and STOP time for:

a. Who accesses the terminal (the keyboard and screen)
b. Who sits at the terminal
c. Who accesses the server (the computer the screen is hooked up to)
d. Who enters and leaves the room

COMPUTER ACTIVITIES: Log the START and STOP time for the following events and write down the name of the person involved:

a. Putting disks, CDs, or any other item in the computer
b. Taking disks, CDs, or any other item out of the computer
c. Uploading disks, CDs, or any other item
d. Viewing a preview of a report
e. Putting a report on the Web, even if this is done from another computer
f. Printing a report

g. NOTE WHAT’S ON THE SCREEN: Use binoculars to view the screen.
- Note upload icons.
- Use binoculars to read and record error messages. Note the time.
- Note indicators of processes, when a status bar shows how much is left to do

h. PROGRAM CRASHES:
- Watch to see if the program suddenly disappears from the screen (a program crash) or any system error message appears. If so, note the time and other details, and see below for how to record system crashes.
- Get the date and time and note who was at the computer
- Note whether any results were being transmitted or uploaded at the time the crash occurred.
- Did the crash take down the whole computer or did it just close the tabulator program unexpectedly.
- Log all activities and conversations that occur just after the crash. If have a tape recorder, leave it in your purse, now is the time to turn it on. But keep making notes regardless of whether you have tape, and trust your gut. What you think might be important is probably important.

WRITE DOWN EVERYTHING YOU CAN FIND OUT ABOUT MODEMS.

i. Note when, where, and who feeds ballot data into the computer in the central office. Describe what they are feeding the cards into, where the items are located, who does it, and when.

j. DISK MANAGEMENT:
- Note what kind of data storage device is used to move data around. You are looking for floppy disks, CDs, USB keys (about the size of a pack of gum).
- Note where they get the disk from originally (whether it was from the machine, meaning it could have a program or data on it already, or out of a package of new disks).
- Track the chain of custody: Where it is taken, and have someone watch it when taken to any other machine, note what programs you can see on the other machine
- Note whether (and what time) it comes back and if it is put into the machine again.
k. Moving the results: They have to move the results somehow. Ask questions about their procedures.
- Is someone coming and going every hour or so with paper results?
- Are they moving results to the Internet with a floppy or CD or USB key (looks like a little piece of plastic, about the size of a piece of gum)
- If no one is leaving the machine to post the results, chances are they are doing this at the computer, meaning they are probably hooked up to a network or the Internet. Ask questions about the details and record what they say, and the name of the person who says it.
l. If you see somebody open a web page or they do something that lets you know there has been Internet access, write it down.

m. BEHAVIORAL CUES:
- Note whether people look worried or stressed. Log the time it begins and the time it ends and who they are.
- A now a word about “wranglers.” Some elections offices appoint a person -- sometimes a party observer they are chummy with -- to act as “wranglers.” They identify any person who might ask troublesome questions, and if an event occurs that could cause embarrassment, the appointed wrangler then goes over to distract the observers. Really. This is an elections procedure in some jurisdictions. They actually call it a wrangler.
- If someone comes over and engages you in conversation, look around, and see if officials have suddenly congregated into an office or people are huddling over a computer. See if you can find out what you are not supposed to see.
- Log behavior that is distracting, noting the time and person.
- Log time and people involved in other distraction events, for example: The lights suddenly go out; a fire alarm goes off; someone spills something, loud noises, someone knocks something over.

RECORDS TO REQUEST:
Each state has a public records act, but in most cases, you can get records you ask for if you are nice. Here are important records you’ll want:

1. Get a copy of each INTERIM RESULTS REPORT. Stand guard over what you have. If someone comes in to remove or “replace one with a better copy” hang onto the first and take the replacement, marking it. Make sure all interim reports are time-stamped by the computer. If they aren’t, note the exact time you see them appear.

2. Request the COMPUTER AUDIT LOG for Oct. 29-Nov 2 (actually, it is important to get the printout BEFORE YOU LEAVE that night. It will only be a few pages, and can be printed from the vote-tally program’s menu.

3. Ask for a copy of all the POLLING PLACE RESULTS SLIPS. These are sent in with the results cartridges. Try to get copies before you leave that night. If they won’t give copies to you then, put in a public records request and ask how soon you can pick them up.

Ask for a copy of THE UPLOAD LOGS. These are on the computer and can be printed out on election night. They list each polling place and the time results were uploaded.

5. There are ADDITIONAL LOGS in the Diebold GEMS programs you can request: From the GEMS folder “data”, ask for the poster logs. There may be folders in the GEMS “data” directory titled “download”, “log”, “poster” and “results”. Ask for copies of these logs.

6. Here’s a report that is very long but incredibly important and valuable. Ask if you can have the ELECTION NIGHT DETAIL REPORT -- the precinct by precinct results as of the time all memory cards are uploaded from all precincts. Depending on the system, they’ll call it different things -- in Diebold, it is called the Statement of Votes Cast (SOVC) report.

7. Let us know which REPORTS THEY REFUSE to give you on Election Night. We can then put in Freedom of Information (public records) requests formally.

Once we have your observation log, and the records you obtain on Election Night, we can start matching up events and data to audit for anomalies.

# # # # #

Post information on problems in the county and state at BlackBoxVoting.ORG.
If the site is hacked out, come back as soon as it is up and post the information.

Thank you, and let’s have an orderly election.

:kick:

My county courthouse had some pretty rude types working there in '02 election.

If I start asking a lot questions and asking for names and who employs them.. Are they required to give me this information?

If your county officials are rude, bring the phone numbers for local media with you. If they refuse to tell you names and employers, call the press and ask if they can come down and get those names with you.

What county are you in, by the way?

Bev

I think it also emailed it to you, sorry if theres a dupe.

Have em tell the camera you can't have that information. That should make interesting film.

I'm hoping it wont get ugly like that, but if it does.. you have a good point, people DO tend to act a little different with a camera rolling.

.....The elections Sup. has already referred to me as a conspiracy theorest so this should be entertaining.....Maybe I'll take along "Crossing The Rubicon" just for kicks.....Best of Luck to everyone across the country and our shared concerns.....

In the GD 2004 forum too.

Actually it would probably be more relevant their anyway.

:dem:

:kick:

worry if ALL is "open" for inspection

:kick: