Securing the vote: How 'paper' can protect US elections from foreign invaders
| Washington
When Logan Lamb visited the website of Georgia鈥檚 Center for Election Systems in Aug. 2016, what he found left him speechless.
Although the cybersecurity researcher had no password or special authorization, he was able through a Google search to download the state鈥檚 voter registration list, view files with Election Day passwords, and access what appeared to be databases used to prepare ballots, tabulate votes, and summarize vote totals.
He also discovered a vulnerability that would allow anyone to take full control of a server used for Georgia鈥檚 elections.
It was everything a Russian hacker 鈥� or any malicious intruder 鈥� might need to disrupt the vote in Georgia.
鈥淗ad the bad guys wanted to just completely own the central election system, they could have,鈥� Mr. Lamb told the Monitor in an interview.
It remains unclear how many months or years these vulnerabilities existed prior to the 2016 election. Even more alarming, say computer and election security experts, had a hacker exploited the website鈥檚 vulnerabilities, it might have been impossible to detect.
That鈥檚 because voters in Georgia cast their ballots on electronic touch-screen voting machines that produce no paper record of each vote. Without such a record, there is no way to verify that a computer hacker didn鈥檛 reprogram the vote-counting software to systematically assign more votes to one candidate or another.
More than 20 percent of voters nationwide in the 2016 presidential election cast their ballots on voting machines that did not produce a verifiable paper trail.
Aside from Georgia, four states 鈥� New Jersey, South Carolina, Louisiana, and Delaware 鈥� also rely entirely on paperless touch-screen voting machines. In addition, paperless machines were used in at least some jurisdictions in 10 other states, including Pennsylvania, Texas, and Florida.
To a hacker such voting methods are an open invitation to mischief or worse, security experts say. To officials and experts concerned with securing the accuracy of the US election process, the methods represent a gaping vulnerability.
Mindful of the US intelligence assessment that Russian-backed hackers sought to meddle in the 2016 presidential election, 海角大神 set out to examine key vulnerabilities in the election system. In two previous stories, we touched on the potential for manipulating voter rolls and the tensions between minimizing fraud and protecting voting rights. In this story, we conclude our series with a look at measures that could help secure the accuracy of the vote count.
Only a matter of time
In 2016, officials detected repeated attempts to gain access to voter registration databases, but they say they found nothing to suggest vote totals were manipulated.
鈥淎lthough there is no evidence that any past election in the United States has been changed by hacking, it is 鈥� in my opinion 鈥� only a matter of time until one is,鈥� says J. Alex Halderman, a computer science professor at the University of Michigan. 鈥淔or that reason, the US needs to urgently reform and upgrade its voting infrastructure.鈥�
Professor Halderman made his comments during a recent panel discussion in Washington sponsored by the Brennan Center for Justice.
Until the 2016 election season, few Americans contemplated the possibility that a hostile nation-state might launch a concerted attack against the essence of American democracy. Suddenly election security became a matter of national security.
鈥淭his threat is serious and real,鈥� says Matthew Masterson, chairman of the US Election Assistance Commission. 鈥淚t is going to take a coordinated effort from state and local officials, the federal government, and private-sector partners to respond.鈥�
The US election infrastructure is a dizzying patchwork of grassroots America, with 52 different types of voting machines counting ballots in 187,000 precincts across the country.
Local officials who actually conduct the elections do not hold the necessary security clearances to obtain the latest intelligence briefings on foreign-source hacking trends and innovations.
Many rely heavily on the expertise of a small number of voting machine manufacturers, on election-service vendors, and on their own generally underpaid IT professionals.
In addition, it is not clear that the nation鈥檚 political leaders are fully committed to responding forcefully to address widespread election vulnerabilities. Resources and attention in Washington are currently directed more at politically explosive allegations that the Trump campaign colluded with the Russians than at efforts to fortify American democracy against foreign threats.
鈥淚t is not the all-hands-on-deck kind of response I would have expected after an attack on one of the key institutions of the country,鈥� says Walter Mebane, an election forensics expert at the University of Michigan.
For many years a group of leading computer scientists and statistics scholars have been urging local, state, and national leaders to confront America鈥檚 election vulnerabilities. They have even identified an efficient and inexpensive way to address it.
Their solution boils down to one word: paper.
No matter what type of voting machine is used, a person鈥檚 vote should be recorded on a paper ballot, election security experts advise.
By preserving and protecting every paper ballot cast in an election, officials are safeguarding evidence that can later be used in an audit to verify genuine votes cast by real people.
It isn鈥檛 just the threat of hackers. A computer glitch or programming mistake could swing a close election or render electronic results useless.
The good news is that an estimated 77 percent of American voters cast ballots on voting machines that either use or create a paper record of each vote.
In addition, 31 states have passed laws authorizing post-election audits to help verify election results.
The bad news is that the vast majority of these states either aren鈥檛 conducting robust post-election audits or they are auditing the performance of the voting machines rather than verifying that the correct candidate was declared the winner.
Who won?
鈥淭he question that was being asked and answered is not the question that we really want to have asked and answered,鈥� says Susannah Goodman, director of the national voter integrity campaign at Common Cause.
鈥淭he question is: Did the winner win? Is the right person in office?鈥� she says. 鈥淭hat鈥檚 the question, but the question we were asking was, 鈥楢re these machines working?鈥� and let鈥檚 check that by checking some of the machines.鈥�
Audits that check the machines are not useless. They can verify that the tabulator counted the ballots properly. And they can detect a machine miscount, particularly by using a different type of machine with different software that might better interpret certain kinds of marks on a ballot.
But a machine recount will not tell officials anything about whether a computer hacker reprogrammed a voting machine to steal an election.
鈥淭hey test hard drives, but what鈥檚 on the hard drives?鈥� asks Neal McBurnett, an election security consultant working with election officials in Colorado. 鈥淲hat鈥檚 on the hard drives is whatever some Russian attacker put there, or some Iranian, or North Korean, or whoever.鈥�
The key to conducting a robust audit is that it relies on the ability to compare machine-counted vote totals against voter-verifiable evidence 鈥� actual paper ballots, Mr. McBurnett says. That is the solid foundation upon which a trustworthy audit must be built, experts say.
There are only a handful of states in the US that are currently performing audits that start with a voter-verified paper record. Many counties in California have conducted pioneering work with such audits. New Mexico hires an independent CPA to oversee an audit of a few key races in that state. And Rhode Island recently enacted a law to develop a voter-verified audit system.
But the single most important development in this area is about to take place in Colorado.
'All eyes are on Colorado'
The election in Colorado is today, Nov. 7. More important for election security experts who will be watching closely from across the country, the key dates for the audit are Nov. 16, 17, and 18.
鈥淎ll eyes are on Colorado. It is immensely important,鈥� says Marian Schneider, president of the election integrity group, Verified Voting.
鈥淭his is going to be a blueprint for the rest of the country, hopefully,鈥� adds Susan Greenhalgh, also of Verified Voting.
鈥淎 cool thing about Colorado is that we are going to gather evidence about every contest,鈥� McBurnett says. That means that races and issues on the ballot in Colorado, large and small, will be subject to what is called a 鈥渞isk-limiting audit.鈥�
Such an audit is a systematic post-election comparison between actual paper ballots and the computerized vote totals that are produced by Colorado鈥檚 machine tabulators.
Colorado conducts its elections exclusively with mail-in ballots. The ballots are collected at the county level and organized into batches for counting.
The basic concept behind a risk-limiting audit is that it is not necessary to perform a full hand-count of all the ballots to reliably verify an election outcome.
The 鈥渕agic鈥� in this process 鈥� based on the science of statistics 鈥� is in the calculation of how many randomly selected ballots must be inspected to guarantee an acceptable level of certainty.
The advantage of a risk-limiting audit is that it sharply reduces the number of ballots to be counted and speeds up the process of election verification.
Here鈥檚 how it works:
First, election officials must set the parameters of the audit by deciding on an acceptable risk limit. The risk limit reflects the level of risk officials are willing to tolerate that the election process identified the wrong person as the winner during the initial uncertified tabulation of votes.
For example, a 9 percent risk limit would mean that election officials were willing to accept a 9 percent chance that the election result is incorrect. Put differently: If there is a discrepancy in the election process, the resulting audit could be expected to detect it 91 percent of the time.
Once the risk limit is agreed upon, officials must determine the margin of victory in each contest.
McBurnett uses the 2016 Clinton-Trump race in Colorado to illustrate the process. He calculates Hillary Clinton鈥檚 margin of victory as 4.77 percent.
Assuming a risk limit of 5 percent, factoring in the margin of victory, and using a unique algorithm, McBurnett concludes that auditors would need to compare 131 randomly selected ballots (out of more than 2.78 million votes) with 131 corresponding vote records from the computer tabulation to reliably confirm the outcome.
Moment of truth
This is literally the moment of truth in any audit. It is the point where the auditors would begin to notice any discrepancy between the paper ballots and the vote totals reported by machine tabulators. If a discrepancy is found, it would lead auditors to compare a larger sample of ballots against the corresponding electronic vote records.
If all goes well, it may also be the moment when skeptical voters watching this procedure begin once again to trust an American election process.
鈥淲e鈥檒l have contests like this in real time. Anyone can watch 131 pieces of paper pulled out and verify that it was random and see that they just entered what the paper said and that it matches,鈥� McBurnett says.
He calls the process a 鈥渘ew and complicated miracle.鈥�
In addition to reassuring American voters, such an audit is likely to send a clear warning around the world.
鈥淲hat Russian is going to say, 鈥榃ow, there is a 91 percent chance I will be found out. Even if I do everything perfectly, they will still actually notice this,鈥� 鈥� McBurnett says.
But there鈥檚 a catch. Any deterrent benefit may not extend beyond Colorado. 鈥淚t [also] says go hack Pennsylvania or Georgia where they don鈥檛 have voter verifiable paper ballots,鈥� the security consultant adds.
Hackers tasked by a foreign power aren鈥檛 the only threat challenging election integrity.
McBurnett says audits like that in Colorado can also help deter election fraud in a small, rural county. He uses the example of someone who stands to benefit from a $100 million bond issue. The person may be tempted to employ a hacker-for-hire to guarantee the bond issue is approved at the polls.
A risk-limiting audit would likely expose the plot, he says, or deter it in the first place.
On the other hand, election security experts emphasize that an audit alone will never be enough to fully protect the election process.
For instance, a risk-limiting audit is powerless to detect old fashioned ballot stuffing. If someone fraudulently obtained and voted a large number of absentee ballots, the finest risk-limiting audit would misread the fraudulent ballots as genuine ballots since there would be no discrepancy between the paper ballots and the computerized cast vote totals.
Since audits aren鈥檛 a panacea, experts say, election officials must also upgrade their cybersecurity defenses by restricting administrative privileges, updating firewall protections, maintaining data backups, and performing regular risk analysis and penetration testing to anticipate an attacker鈥檚 next move.
There is also a broader threat to American democracy if voters embrace the suggestion that we cannot trust that the 2016 election wasn鈥檛 hacked.
鈥淭hat cannot be the standard,鈥� says David Becker, executive director and co-founder of the Center for Election Innovation and Research.
鈥淲e could never be sure that any election wasn鈥檛 hacked,鈥� he says. 鈥淲hat we can be is pretty darn sure that the election results were accurate and counted as cast.鈥�
He adds: 鈥淭his is probably the most investigated election in history.鈥�
In many cases an audit alone won鈥檛 be enough to investigate elections. That鈥檚 where Professor Mebane enters the picture.
The election detective
Mebane is a professor of political science and statistics at the University of Michigan and a specialist in an emerging academic discipline called election forensics, which uses statistical analysis to identify potential manipulation of voting processes.
鈥淢y expectation is that forensic analysis might be able to tell you stuff like if voters were intimidated or had their votes bought or were paid to stay home,鈥� he says.
These are election discrepancies that would not be detected by an audit. Mebane is hopeful that his brand of post-election sleuthing can help uncover such problems and ultimately help restore confidence in the democratic process.
Last year, Mebane and Matthew Bernhard, a PhD candidate in computer science at the University of Michican, used their expertise to investigate whether a computer hacker might have played a part in President Trump鈥檚 narrow victory in Wisconsin and Michigan.
In Michigan, Mr. Trump won by a 10,702-vote margin (.22 percent), and in Wisconsin by 22,748 votes (.76 percent).
An attempt to force a total recount of votes in both states was undertaken at the request of the Jill Stein campaign, but the counting was halted in the courts before it could be completed. Although they only had data from a partial recount in both states, Mebane and Mr. Bernhard set out to see what they could find.
鈥淲e were checking to see whether the original count and the re-counted count varied across different types of [voting and tabulation] machine technology being used in the particular jurisdiction,鈥� Mebane explains.
鈥淭he idea was if the machines had been hacked then presumably they would have shown asymmetry in the way the two candidates were treated,鈥� he says. 鈥淭hat could have been shown in the re-counted tallies versus the original tallies.鈥�
If someone had hacked into the voting or tabulation machines during the election, there was a chance that the recounts might help expose it. But it would only show up if the recount was conducted by hand. In other words, a machine recount of hacked ballots would show no discrepancy.
鈥淥f course there could have been hacks that were not picked up by that difference because they were not all manual tabulations of the paper [ballots],鈥� Mebane says.
Their conclusion: They found no evidence that a hacker contributed to Trump鈥檚 victory in Michigan or Wisconsin.
鈥淚t was totally imperfect as a body of evidence,鈥� Mebane concedes. 鈥淏ut it was better than nothing.鈥�
Mebane鈥檚 research in the aftermath of the 2016 election illustrates the utility of having a uniform, protected voter-verified record of ballots in every election.
Nonetheless, there are other, more traditional ways to guarantee election security than risk-limiting audits or election forensics.
Counting by hand
In Columbia County, New York, voters fill out paper ballots that are fed into an optical scan voting machine. The ballots are tabulated by the machine, but then after the election county officials organize a small army of workers to manually count every vote cast in every contested election.
Columbia County is southeast of Albany on the east side of the Hudson River. It has about 40,000 registered voters out of a population of 63,000 people.
In the 2016 general election, 27,725 ballots were cast on Election Day. Election workers hand-counted nearly 21,000 of those ballots encompassing 65,000 separate votes for various candidates and issues.
Columbia County has been hand counting its ballots since 2010.
Virginia Martin is a commissioner on the Columbia County Board of Elections. She says she and her Republican counterpart on the board were concerned about allowing election results to be determined inside a computer.
鈥淚 can鈥檛 see inside a computer. I don鈥檛 know how a computer counts votes,鈥� Ms. Martin says. 鈥淏ut I know exactly how our races are counted by doing this.鈥�
Since paper ballots were already part of the voting process, they decided that they would simply hand count the ballots after they had been scanned into the voting machines.
The elections board reaches out to the community and creates bipartisan counting teams of two Democrats and two Republicans. Each team counts one precinct at a time. It took about a week to finish the count for the 2016 general election, well within the deadline to certify the results.
Martin says hand counting offers several advantages over relying exclusively on a machine. In some cases, the machines are unable to detect a vote because the voter placed their mark outside the bubble or wrote outside the designated area for a write-in candidate.
If the election results were based solely on the machine鈥檚 reading of the ballots, those votes would not be counted. Martin says when human eyes examine the ballot they can see the clear intent of the voter and count the vote.
鈥淲e want to make sure our local candidates get every vote they are entitled to,鈥� she says.
This level of care in the counting is appreciated not only by the election鈥檚 winners, but more importantly by the losers.
鈥淚sn鈥檛 that the point,鈥� Martin says. 鈥淵ou want the losers to feel the result is accurate. The winners always feel the result is accurate, it is the losers you have to satisfy.鈥�
Columbia County isn鈥檛 alone in its fidelity to hand-counted accuracy. According to the Pew Research Center about a million paper ballots in 2016 were hand-counted in 1,800 small counties, cities, and towns across the country.
Most of them were in New England, the Midwest, and the mountain region of the West, according to Pew.
A civic duty
Sheila Parks of the Boston-based Center for Hand-Counted Paper Ballots, calls the process 鈥渄emocracy in our hands.鈥�
鈥淪itting and counting ballots isn鈥檛 so hard,鈥� Ms. Parks says. 鈥淚t feels like a civic duty to me. Why wouldn鈥檛 somebody want to do it?鈥�
But there can be a downside to hand counts. 鈥淰irtually every study on this will tell you that hand counting something is always much less accurate than machine counting,鈥� says Mr. Becker. 鈥淧eople get tired and it is really hard to look at bubbles on a sheet.鈥�
On the other hand, there is also a tangible upside.
Last year when allegations emerged that Russia might be trying to hack the US election, unlike many other election officials Martin felt confident.
鈥淭here would be no point in anybody trying to hack our voting machines because we count the paper and we keep our paper very secure,鈥� she says.
Some analysts see the issue of election security as an investment, a kind of down payment on the ideal of representative government in America.
鈥淚 put this in the hands of the American people,鈥� says McBurnett. 鈥淚f you care about democracy, it only costs a little bit to do it right.鈥�
Goodman of Common Cause agrees. 鈥淚f you think about it as just an administrative function it probably costs some money. If you think about it as protecting our nation and preserving our democracy, it is not expensive at all,鈥� she says.
鈥淚f you think about what we spend on our national defense, this wouldn鈥檛 even make a blip on the radar screen.鈥�
Part 1: Could Henny Nelson, age 131, help Russia rig an election?
Part 2: How efforts to prevent fraud, and voting rights, collide
