TGDC Meeting, Jan 2011 Evaluating risk within the context of the voting process Ann McGeehan Director of Elections Office of the Texas Secretary of State

TGDC Meeting, Jan 2011 The Challenge Create voting system standards that are secure and accessible, but that are realistic within the context of the voting system. Standards should meet or exceed the level of risk currently tolerated within the voting process Software standards must also be assessed within the framework of external factors and human involvement: access to software; policies, procedures, and laws.

TGDC Meeting, Jan 2011 Voting Process Tolerates Some Risk Voter registration Ballot certification, printing, and programming Mailing ballots/ Qualifying Mail Ballots Counting ballots and Certifying Results Recounts/Contests

TGDC Meeting, Jan 2011 Voter Registration Risks State/county fails to register qualified applicants (mismatch of validation numbers) State/county registers ineligible persons (felons, persons registered in multiple jurisdictions) State/county fails to keep rolls clean (felons, deceased, moved voters) State/county register voters in wrong precinct Unreliable voter registration lists (online poll books, incorrect voter annotations)

TGDC Meeting, Jan 2011 Certification/Printing/Programming Certify ineligible candidate to the ballot Omission of candidate’s name or misspelling of name Incorrect coding of precincts (wrong race associated with a precinct) Accessible audio does not pronounce candidate’s names properly

TGDC Meeting, Jan 2011 Mailing Ballots/Qualifying Ballots Mail out ballots after 45 day MOVE deadline Mail out ballots with unclear instructions to voters Mistakes in accepting/comparing voter signatures Ballots overlooked in ballot can or file cabinet Ballots marked by someone other than the voter

TGDC Meeting, Jan 2011 Software Independence Stalemate Interesting discussion about risk Keep hitting the brick wall of accessibility and security Accessible solutions are primarily electronic and thus far computer scientists do not trust a paperless system

TGDC Meeting, Jan 2011 Security of Electronic Voting What level of risk is permissible? Software Independence seems to tolerate no risk—no trust in the process “Evil programmer” scenario Black Box Tabulations – proprietary software limits transparency

TGDC Meeting, Jan 2011 Risks with traditional paper Confusing ballot design Votes could be altered by a poll worker or other involved person Ballot box can be “stuffed” (Ballot Box 13 in Jim Hogg County –LBJ 1948 US Senate race (202 ballots added to the box after polls closed) Voter intent may be misinterpreted by counting team Human counting errors

TGDC Meeting, Jan 2011 Safeguards with paper ballots Ballot design should be reviewed by candidates/parties/voters Ballot box should be locked with seals Poll workers should be from different political parties Observers should be present

TGDC Meeting, Jan 2011 Risks with paper ballots that are electronically counted Confusing ballot design (“Butterfly Ballot”) Opportunities to tamper with ballots (Harris Co Punch Card example) Possible that voter intent not interpreted correctly by humans or by tabulator

TGDC Meeting, Jan 2011 Safeguards with Paper Ballots Electronically Counted Ballot design should be reviewed by candidates/parties/voters Ballot box should be locked with seals Poll workers should be from different political parties Observers should be present Checks and balances with precinct count and accumulated count

TGDC Meeting, Jan 2011 Risks with Electronic Voting Confusing ballot design (2006 Sarasota, FL Congressional race) Limits on votes stored (North Carolina votes lost) “Evil programmer” (How realistic is this scenario – how many people would need to conspire and under what conditions?)

TGDC Meeting, Jan 2011 HAVA Silent on Security HAVA mandates that a voting system: Provide the voter an unambiguous way to vote (no over voting, notification of undervoting, review vote selections) Provide an audit capacity Must be accessible to voters with disabilities HAVA silent on level of security

TGDC Meeting, Jan 2011 Next Steps Evaluate the 2.0 VVSG within the context of a real world risk/benefit analysis Involve a larger community of election officials and voting experts in addition to the IT Security and Accessibility Specialists to conduct the evaluation Strike the right balance with accessibility and risk

TGDC Meeting, Jan 2011 Discussion Page 16