http://avirubin.com/judge2.htmlMy experience as an Election Judge in Baltimore County on November 2, 2004
by
Avi Rubin
On March 2, I served as an election judge in the Super Tuesday primary. When I got home that night, I wrote up my thoughts and published them on my web site. Yesterday, I worked as an election judge again for the general election, and I wanted to write down my thoughts the same way, but when I got home, I was too tired. My precinct had a 91% turnout, not counting absentee ballots, and I was quite busy most of the day. I woke up this morning at around 5:00 a.m. and tuned in to see if we had a President yet. The news said that it was still hanging on four states that were too close to call. I couldn't fall back asleep, so I'm up now at 5:30 a.m., writing about my experience yesterday.
Election judges in Baltimore County report to work at 6:00 a.m. The precinct where I was assigned, in Timonium, MD, is about 15 minutes from my house, so I set my alarm for 5:05 a.m., but I woke up at 4:30 pretty wired and ready to go. It was finally Election Day, and it seemed like the drama of the past year and a half since Adam Stubblefield, Yoshi Kohno, Dan Wallach and I wrote a paper about security problems in Diebold's voting machines was coming to a head. I was completely awake at that early hour, and I felt nervous and apprehensive about several things. One of my concerns was that something might go very wrong in the election. All of the polls indicated a virtual dead heat, and thus any glitches or disruption in a key state could mean the difference in the outcome.
However, I was worried about something else as well. In the past week, the media coverage of potential problems in e-voting has been unbelievable. I spent most of the week doing media interviews and appeared recently on the Today show, on 60 Minutes, on the cover of the Baltimore Jewish Times, in several major national newspapers, and on quite a few radio shows. The media was setting up the election as potentially marred by e-voting. There was a problem with this. The biggest threat posed by the current crop of electronic voting machines is a software problem, either malicious or due to an unintentional bug, that affects the outcome of the election in an undetectable way. The media, however, focus on detectable problems. To some extent, I felt that the election was going to be viewed as a referendum on electronic voting, despite the issue not appearing on any ballot. However, even if the election were viewed as "successful," it would not alleviate the vast majority of my concerns with the machines. Voting machines that are vulnerable to wholesale rigging can still perform perfectly normally. It is possible that nobody exploited the vulnerabilities this time around, and it is also possible that there was fraud or serious error, but that they went undetected. Electronic voting will be judged on the noticeable failures, and the unnoticeable ones are the most serious.
With these thoughts running through my head, I drove to my precinct before sunrise and prepared for a long workday. Election judges are not permitted to leave the poll site during the day, so I packed food for breakfast and lunch and arranged for my wife, Ann, to bring me dinner in the evening.
For the most part, my co-workers were the same judges as last time. The older Sandy was missing, as was Joy, the former trainer of chief judges. I learned yesterday that the reason why Joy was such an expert was that she had actually worked for Diebold before that election. There was also a new judge named Terry. This time, my fellow judges greeted me very warmly. Most of them had read my Op-Ed in the Baltimore Sun after the primary and were very pleased with my description of our shared experience. They had also seen the Op-Ed that I published last week. Chief judge Marie was quick to point out to me very proudly that Diebold had not set up the machines this time, but that she and her husband Bill (also an election judge in our precinct) had come in the night before to open them up. I asked her who was guarding the machines overnight, and she replied that the room in the church had been locked.
Before I go on, I should mention that I believe that all of the judges who worked with me are upstanding citizens, and I am sure that their only interest yesterday was to run our election smoothly and get the right outcome. I did, however, observe a vulnerability that I do not think would exist with non-DRE voting. It turned out that the new judge, Terry, was the security manager for the church where our election was held. He carried a large keyring to all the doors in the building. He was also in the same political party as chief judge Marie and her husband. One of the reasons why we have election judges from both major parties at each station at the polling center is to provide checks and balances. The night before the election, there was an imbalance. Two judges from the same party had set up the machines alone, and that night, someone from the same party had access to the room where the machines were left unguarded. Why is that a problem? The Diebold Accuvote TS machines were shown to be highly vulnerable to tampering. With physical access to the machines, for example, one could change a few bytes in the ballot definition file and votes for the two major Presidential candidates would be swapped. In that case, none of the procedures we had in place could detect that votes were tallied for the wrong candidates. At the end of the election, we packed up the machines and left them in the same room with the door locked. Any malicious changes that had been made the night before could have been undone then. Each machine had a plastic seal on it, but the seal did not look like something that would be impossible to find. In fact, our supply packet contained a number of extras. This is just an example; there are many other ways someone with unfettered access to the machines could tamper with the election. Clearly it would be easy to make it so that the machines did not work at all, e.g. using a hammer. Such attacks exist regardless of the voting technology. The big difference with DREs is that tampering that is undetectable can change the vote count. Again, let me stress that I do not have any reason whatsoever to believe that my fellow judges did anything untoward. In fact, I believe strongly that they did not. My only point here is to observe that there are vulnerabilities in the system, vulnerabilities that someone could exploit someday and that ought to be eliminated.
The lines started forming outside of our precinct at around 6:40 a.m. At 7:00, once again chief judge Jim cast the first vote to our applause. We opened the outside doors, and within a couple of minutes, a policeman who was guarding our precinct had to keep people outside and only let them in as people left. The lines of people zigzagged across the room. People were polite but seemed rushed for the most part. I worked as an A-K book judge once again and tried to check people in as efficiently as possible. From 7:00 - 8:00 a.m., the crowd did not let up, and I wondered if we would be that busy the whole day. During the end of that first hour, we had processed over half the number of people who had voted in the primary on Super Tuesday. Luckily, everything went smoothly, and eventually the pace slowed down. By noon, more than half of the registered voters in the precinct had voted. We had several minor glitches. Some of the smartcards did not work very well, and voters got unusual error messages on the screen. I did not see them, but one of the other judges told me they looked like "strange computer messages."
In the afternoon, when we were not as busy, I paid attention to the voters' reactions to the machines. We were required to post a sign on the wall that said that anybody who was eligible to vote on the machines was not allowed to cast a provisional ballot. A voter asked me about the sign, and I explained that if someone's name appeared in our registration book, they had to vote on the machine. He asked me why anyone would not want to vote on the machine, and I explained that some people preferred a paper ballot. He laughed and said, "People need to get a grip and join the 21st century. The world is about computers. Those machines make it so easy." As an election judge, I did not feel it would be proper to respond, so I just nodded. Several people commented on how much they enjoyed the voting experience. However, one couple tried to give me the third degree. The husband asked me in a very annoyed tone why he should have any confidence that the machine was actually recording his vote. Before I could figure out how to respond, his wife said that she felt the machines were susceptible to fraud. I told them that the machines were what we had, and that if they did not like them, that I strongly recommend that they write to their representatives. Ironically, I found myself wincing and hoping that none of the other voters had overheard them. As an election judge helping to run the operation, I did not want any disruptions. Yes, I believed that using these machines was a terrible way to conduct an election, but we were using them, and it was not the right moment for me to voice that concern. The only other related comment came from a voter who pulled something out of his pocket that he claimed was a large magnet, and he asked if I was worried that he could accidentally erase the hard drive on the machine with this powerful magnet. He then laughed and winked at me. I think he may have known who I was. He had already voted and was having some fun with me so I just replied, "I hope not!"
When I worked the primary, some of the press wanted to speak with me over chief judge Marie's objections, and the situation became unpleasant. However, this time, there was no media and very little presence of Diebold and the board of elections. A Diebold representative stopped by a couple of times just to ask how things were going. We told him that everything was fine.
At 8:00 p.m., we closed the polls and locked the outside doors. This time we did not have to call security because Terry had the keys. Every hour we had counted the number of people who had voted and posted the turnout on the door of the polling place. When we closed the doors, there had been 725 digital ballots cast, and the chief judges decided not to modem in the results because it would be too much of a hassle. Instead, when they left the precinct later that night, they drove the memory cards with the totals to the board of elections office. I stared at the five machines. Inside them were the little memory cards, not unlike the one in my digital camera at home, with 725 votes stored on them. One by one, we removed the memory cards from the machines. I held them in my hand as chief judge Marie was ready to load them into one of the machines that we designated as the accumulator. How fragile. All of the votes from the entire precinct in my hand. Substituting those cards with five identical looking cards, one could replace all of the ballots that were cast with bogus ones. Surely nobody in Maryland would try something like that. The outcome here was certain before the election. However, what about states like Ohio and New Mexico? 725 paper ballots would be much harder to swap than 5 small memory cards. In larger precincts, the cards could hold thousands of ballots, but they would be the same size.
My day at the polls was quite different than the first time I was a judge back in March. On Super Tuesday, I was in awe of the whole situation and the role that I was playing in our democracy. I was very emotional, and my only disappointment was that my precinct seemed a bit staged. We had nine judges in a precinct that totaled 199 votes. The president of Diebold Election Systems stopped by a couple of times, and the media kept showing up. By contrast, everything yesterday was more natural. There was no super judge so we had to figure everything out ourselves. We had many voters and were so busy that the day was about keeping up and providing the best customer service possible to the voters, while making sure everything ran smoothly.
When I arrived home last night, I had several email messages from reporters asking me about my experience. One of them really disturbed me: "After being an election judge, have you changed your opinion at all about these DREs?" I suppose it disturbed me because it implied that somehow my opinion on DREs was based on some superficial measure that could change when I saw them in action. I think the question ignores the expertise of computer scientists, including me, with respect to computer security. It is like asking a surgeon who states that a particular medical procedure is risky whether he might change his opinion because there was a successful operation using that procedure somewhere in the world. Imagine if, universally, all of the heart surgeons in the world said that a new medication was dangerous and could lead to heart attacks but that the drug's manufacturer claimed that it was safe. Would people feel comfortable taking the medication? Would doctors be asked whether they changed their opinion on the medication because somebody took it and did not die? It is a common problem. The press likes to simplify the issue and boil it down to sound bites from each side to produce what they consider "balanced" stories.
Well, for the record, here is my answer to questions like the ones emailed by that reporter: If we continue to use the kind of insecure DREs that were used in this election, it is only a matter of time before somebody exploits them. And the worst part is that we may never know it.
As I am writing this, CNN is reporting that Bush has 254 electoral votes and Kerry has 252. Three states are still up in the air, Ohio, Iowa, and New Mexico. Who knows when a final determination will be made. I worry that whenever we have close elections, paperless DREs will produce a cloud of uncertainty over the election. Without the capability for recounts, there will be little to do to satisfy t
Printer-friendly format
Email this thread to a friend
Bookmark this thread
(398 posts)
Send PM |
Profile |
Ignore
