Blog Article
Dallas County like much of Texas has very real problems with our current voting systems. After three years of diligent effort, we strongly believe that our current generation of voting equipment and processes have failed to win the trust of a large part of the public. We have tried to work with these systems but no longer think that these can be made trustworthy.
We strongly believe that we can’t put our votes at risk any further.
We simply must get opaque voting systems (those that are not transparent) out of our election systems. That means no machines with modems or internet connections of any kind.
All opaque voting systems must go. Counties all over Texas, particularly in the large counties, embraced these new machines and merely accepted their opaque aspects because of the rush to get away from the “hanging chad” situation of the very old punch card systems. Unfortunately, we threw the baby out with the bath water. Counties that used hand-marked paper ballots and OCR scanners did not have the punch-card issues but were changed anyway. In the rush to get rid of hanging chad possibilities, we got rid of transparency by embracing opaqueness. That was not a good trade, and it is time to correct it.
Correcting the problem likely means going back to hand-marked paper ballots that are counted and reported in the precinct. It also means returning to precinct voting using paper pollbooks. At the end of the evening, hang up a results report for that precinct on the front door of the precinct so everybody can see. Take the voting media (ballots and USB drives) to central count to be accumulated and reported from a simple tabulator that is only connected to electricity and that is open and can be inspected. We can even keep 462 Election Day polling locations in the county if desired just as long as everything is transparent. We would continue to have representatives of each political party in each location to provide the needed checks and balances.
The results would be an entire system that is air gapped. Nothing in the voting system should have any connectivity at all.
For years, in the recent past, we have done this and had completed counts by the end of the evening on Election Night. Entire countries such as France and England use systems much like this and are able to timely report results.
The Dallas County Republican Party is calling for the 88th Session of the Texas Legislature to consider and pass legislation to make transparent and trustworthy voting happen again.
We think we have a good case for this position. It is measured and reasonable. The core of the argument is that the current voting system lacks trust, lacks transparency, is highly complex and has poor performance.
Our Case for Removing Opaque Voting Systems
Our current generation of voting systems is called black box voting. The name “black box” derives from a common concept used in engineering, science and computing. Black boxes are processes that happen in a box (which can be both physical and software) that apply programmed logic to what is put into the box. Black boxes are described solely in terms of their input and output without any knowledge of their internal workings. You input something into the black box, the black box whirs for a moment and the black box outputs something,
The inner workings of such boxes are completely opaque and therefore called black. We don’t know what goes on inside the boxes. It is un-knowable without access to the internal logic.
When the term “black box” is applied to voting systems (“black box voting”) the input into the box is cast ballots. The output of the box is the election results.
Being opaque does not lend itself to trust since we don’t know how the votes are counted. We also don’t know about the current system's resistance to cyber tampering and interference.
What gets us into trouble is that the companies that sell voting systems use propriety technology of their own inventions to build these systems. Along with patents, they also make copious use of “trade secrets” to protect their software and firmware from disclosure to their competitors (and us) and loss of competitive advantages in the marketplace. Yes, it is reasonable as far as their commercial interests go but it also, some would say conveniently, denies voters knowledge of what happens inside the black box.
Inherently, opaqueness and secrecy are not good things in voting. Voters are asked to trust something as important as voting to vendors who assure us that their machines are safe but cannot openly demonstrate it. "Trust us" no longer plays well with voters for election matters.
In 1923, Soviet strongman Joseph Stalin famously said, “I consider it completely unimportant who in the party will vote, or how; but what is extraordinarily important is this—who will count the votes, and how.”
Good point, Joe.
Black boxes, with their internal operations that are kept secret from voters, do not engender trust beginning at the very start. The vendors who make these systems submit their work to one of several national testing organizations. However, the test process itself isn’t fully disclosed so we don’t know the rigor used in their inspections; the use of trade secrets blocks full disclosure. The testing lab writes reports of their findings within the non-disclosure of the trade secrets involved and usually opines that the systems are safe. To sell the voting systems in Texas, the vendors are then required to have their offerings reviewed by the Texas Secretary of State and approved. But the Secretary of State mostly relies on the summary reports of the testing labs and reviews of the vendors’ operational manual.
In the end, we are forced to take the word of only third parties that the internal workings of these black boxes produce faithful and unmanipulated results.
Stalin would approve!
The output of these black box voting systems requires us to put a lot of trust into the internal working of the boxes and because of opaqueness, regular voters like you and me can’t see how they work. Even more troubling, neither can our election professionals in our departments of election; they too are required to take the word of other people, mostly the vendors, and can only parrot the standard answers they are given. They too don’t get to inspect what goes on in the black boxes either.
In a county as large as Dallas County with hundreds of ballot styles and 1.4 million registered voters, the functions of the black box are complex as is the whole system that accumulates the results of our elections. From each Voting Center, voting results are transferred to Central Count at Dallas County Elections via USB drives. The USB drives are supposed to be completely air-gapped from networks and the Internet which is assuring. But, in turn, the contents of the USB drive are input into a computer running the vendor’s accumulator software at Central County which are connected to a vendor’s Election Management system that is based in the cloud. Yep, more black boxes talking to other black boxes and most critical systems above the USB drives are Internet-connected. All are equally opaque. We now are forced to accept that the information security used to protect the vote is better than the hackers and bad actors who would want to manipulate or interfere with the vote. That is a bit much to ask based purely on faith.
As for output from the black box, all that most people see is only a summary report for each race. You can drill down and get a precinct-by-precinct report broken out by ballot style. However, that’s it; that is all we get.
One voter who is a critic of the system recently told us that all he knows is that he puts his voted ballot into the tabulator and then waits for the government to tell him who won. Basically, that is a realistic and accurate view of what happens.
For many of us, there are too many unanswered questions about these black boxes and their operations that even our election departments can’t answer. The voting systems we have now are also far too complex; configuring and operating these systems and their cloud component, even complying with information technology best practices, can be technically challenging. Black boxes talking to other black boxes with almost total opacity offer too many points of failure and too many opportunities for security to be compromised. We don’t see proper checks and balances disclosed.
The new Section 127 Randomized County Audits that SB-1 added to the Texas Election Code was a political compromise in the Texas Legislature 87th Session in a well-meaning effort to build confidence that the black boxes could be trusted. Unfortunately, the process as it was implemented after all the various interpretations of the new law, is completely inadequate for the stated purpose. The sample sizes of the audits were far too small and the technique by which they are conducted is questionable as well as partially opaque. That was unfortunate.
It was a noble effort, but sadly, it didn’t provide the trust that was intended and so desperately needed. We are still just as unsure of the black boxes now as ever.
Further, as if using black boxes in marking and casting ballots wasn’t bad enough, in Dallas County we tried county-wide voting at the same time we implemented black box voting. Rather than voting in our home precinct as we have for decades, any Dallas County voter can walk into any of our 52 Early Voting Centers or 462 Election Day Voting Centers and vote. To implement the concept, network-centric county-wide pollbooks are needed that contain all of the people in Dallas County that are registered to vote. The new e-pollbooks are more black boxes.
Unfortunately, even the best of the current e-pollbook system has not been up to the job. Our current e-pollbook is the second system we have tried. The first e-pollbook system was replaced rather quickly. In the three years that we have experimented with county-wide voting with e-pollbooks, they simply don’t work as desired or as advertised.
One of the functions of e-pollbooks is to prevent one possible scenario in county-wide voting where a person votes in one Voting Center and drives to another Voting Center and votes again (repeaters.) In theory, e-pollbooks are all networked to the Dallas County Elections Department central database. When a voter checks in and is issued a ballot, it is recorded in the central database for the record of that voter and that voter can’t be issued a repeat ballot. All well and good so far. One of the real-world problems is that the e-pollbooks won’t stay online all day. If they drop offline, they have a built-in feature that allows them to still operate as a self-contained island disconnected from the central database. While they are offline, they can’t catch the repeating voter issue. In theory, when the e-pollbook reconnects, it will resynch with the central database but if a repeating voter has voted again while offline, how can anyone find the already-cast secret ballot and cancel it?
Too many e-pollbooks won’t stay consistently online because their connectivity fades in and out all day long. The connectivity brownouts don’t entirely behave like the problems are entirely network issues but possibly within the e-pollbooks themselves. At the times one of the e-pollbooks drops offline, it can be sitting right next to other fully-functional e-pollbooks. This behavior doesn’t add to our confidence. Trust is further eroded because too high a percentage of e-pollbook simply are D.O.A. as we set them up before voting. They never get online. On election days, the overworked technicians of Dallas County Elections can’t get to us to fix them.
I might consider saying, “At least when they are working, they work well” but I can’t even say that. This year, we had multiple well-documented cases where the number of checked-in voters fluctuated at the end of the day. We are supposed to check the number of voters that checked in and were issued ballots on the e-pollbook. Those numbers should match the number of voters recorded on the paper check-in roster. The total of the checked-in voters should match the number of cast votes on the tabulator. This check is very basic. Not being able to perform it shakes the faith of our Election Workers and should alarm us.
If the e-pollbook numbers show the number of checked-in voter float, sometimes widely, it greatly erodes our confidence in the system.
These black boxes, particularly poorly functioning black boxes, do not engender trust in voting.
Ironically, e-pollbooks that contain all registered voters have surfaced another issue: dirty voter rosters. When an Election Clerk checks in a voter and their Texas Driver License doesn’t scan, we must do a manual search for the voter. When we enter their name, there is a disconcerting number of times that of multiple records are being found for the same voter, cases of multiple records with the same full name, address, and date of birth.
There is a little exercise we’ve done with this issue across several elections. Five elections ago, we found a voter with four records in the e-pollbook for the same person. All four were the same complete name and at the same address. Two had the month and day digits of their date of birth flipped (month and day) from what looks like a simple typo. Each of the four records had its own VUID (voter unique identification number). Since we found this in the first election, we check his name in every election just to see what happened. Although these duplicates have been reported, his multiple records still appear in the e-pollbook in duplicate. I’m happy to report that finally in the November 8th election, he was down to only two duplicate records instead of the usual four. Progress, I guess.
We see enough of these situations in voting operations that it begs the question, “Just how clean is the Dallas County Voter File?” and “Does the Dallas County Voter File that we can download via a FOIA request match (adjusting for very recent changes) the database in the e-pollbooks?”
The voter roster is, in essence, also a black box process; we put in a name search and get out multiple duplicate records. We don’t fully know what happens inside the black box. Yes, we know the desire is to broaden the base of voters and energetically support voter registration efforts. But at what point does the database get cleaned for of dupes, dead voters, people who have moved out of the jurisdiction and phantom voters? Clean voter rolls that keep all legal potential voters intact, is the first line of defense against phantom voters.
Cleaning voter rolls should not use voter suppression techniques. But I am talking about using legal, fully transparent to all parties and computationally-valid ways (coupled with proper conformational fieldwork), to clean the voter role and keep it clean.
All black box voting must go. It would be nice to think that we can make these highly opaque voting systems transparent and safe, but their opaqueness is just too ingrained and fundamental to the way these vendors function. After three years of trying to work with this equipment, it is time to say “Enough!” and move to something much simpler and fully transparent.
The opposite of a black box is a system where all its internal components and logic are available for inspection and testing by anybody who cares to spend the time to do it. Rather than “black box” systems, these are called “glass box” systems because they are totally transparent.
This blog focuses entirely on the black box portion of the current voting system. So, you might be thinking, “What about these pre-numbered sequential ballots we have been so proud to have obtained?” They would be great and a complete check of the election – if we had an election contest in which a candidate was able to secure a court order from a judge of competent jurisdiction to examine and count those ballots. Yes, that is what it would take. And, for Dallas County candidates (not state or federal), that means a Dallas County District Court (and thus, the significance of an all-blue judiciary – stayed tuned for a blog soon about the difficulty in recruiting judicial candidates!). Do not get me wrong. The pre-numbered sequential ballots remain an important part of election integrity. But without transparent processes that eliminate all darkness in between, they are not enough
It is time to embrace glass box voting.
| 5 Comments | Add Comment |
