computer vote counting is a radically different trust model

Computer vote counting is a radically different trust model than a hand-counted election.

Instead of a vote counted in public by known individuals, with observers, you have a third-party for-profit vendor counting the vote in private, with testing by the election authority, but no meaningful observation.

If an elections authority proposed to pay a vendor’s employee to count votes in private, even with a complete background check of the employee, I have the feeling that not many people would go for it.

But in what is essentially the same scenario, except with the employee replaced with a “machine”, people don’t seem to have a problem.

I thought about why this might be the case, and it seems to one primary and one secondary thing.  Primary is the idea that a person has unlimited freedom of action, but a “machine” does not.  Secondary is the confusion that because the vote tabulator itself is in public, somehow the vote count is still “in public”, even though it’s taking place inside the literal black box of the tabulator.

This is I guess a 20th Century collision with 21st Century realities.  If you have an assembly line with a machine that makes pins, if you turn your back, it won’t suddenly decide to secretly make hammers.  Because the vote tabulator looks like some sort of machine, and is described usually as either “electronic” or “machine”, people think it is a single-function device.  But it’s actually a general purpose computer.  Which means that not only does it have a wide range of freedom of action, just like a human being, it can lie to you about what it is doing, just like a human being.

It would be interesting to see a polling station set up with a giant human-sized black box that the ballots go into to be counted, and see how people reacted to that.  Because there really is no difference between that and the computer vote tabulator.  Basically you’ve taken a very limited trust in known people you can watch in public, and changed it to a very extensive trust in unknown vendor employees and in the elections organisation itself operating in private.

If you have a very complicated count and very high expectations of a fast count, then there is some justification in using a vote counting computer, as long as you don’t trust the computer.  You have to audit the paper, not the computer.  You can test the computer as much as you want, it can always lie.  This is exactly what happened in the Volkswagen diesel emissions scandal, where the car’s computer could detect when it was being tested and would change its behaviour accordingly.  So when you use a computer to count paper, you have to audit the paper with a manual count (a risk-limiting audit).  Unfortunately as far as I know, no Canadian jurisdiction follows a computer ballot count with a risk-limiting audit.

In any case, Canadian federal and provincial elections are trivial to count.  You literally just sort the ballots into a few piles.  And because the count is simple it is also fast.

The Ontario provincial switch to vote counting computers is wrapped with PR about technology, but it’s actually about staffing.  (The underlying concept is literally called "Proposal for a technology-enabled staffing model for Ontario Provincial Elections".)  Basically it’s hard to get people to staff elections now, and they’re tired by the end of the day which means they are sometimes not in the best shape to do a bunch of precise counting.  There are many many ways to address elections staffing.  For example, you could simply bring in people, e.g. High School students, to do the count at the end of the day.

Addressing a staffing problem by completely changing the counting trust model wouldn’t have been my choice.  And I would assert that the only reason it’s even possible is because people don’t realise the trust model has been radically changed.

In any case, online voting is a much much worse problem that vote counting computers, so this is about all I have to say about the vote tabulators issue.

Previously:
May 11, 2018  2018 Ontario Provincial Election to use vote counting computers

2018 Ontario Provincial Election to use vote counting computers

The 2018 Ontario Provincial Election taking place on June 7, 2018 will for the first time use vote counting computers province-wide.  This replaces hand-counting of ballots.

The computer vote tabulators use optical scan technology to read hand-marked paper ballots.

This is the least-worst use of computer technology for vote counting as the hand-marked ballots are still available to be counted.  However, these are still computers that have to be programmed, which means there is always the potential for errors or malicious code.

UPDATE 2022-06-02: The 2022 Ontario Provincial Election will also use vote counting computers.  Elections Ontario has created an Advisory Committee on Standards for Voting Technologies but they have not yet produced a report.  END UPDATE

Key Questions

Fundamentally in elections, you don’t trust anyone.  That means you don’t trust the computer vote tabulator either.  Use of computer vote tabulators introduces the following key questions:

• Will there be a public hand-counted risk-limiting audit following every election, to test the computer count?
• In the case of a recount, will the ballots be hand-counted under judicial supervision, or will the ballots be run through the computer vote tabulators again?  (It appears that the legislation requires a hand count of the recounts to use a manual hand-count of the paper ballots.)

The new voting procedures were launched with a May 9, 2018 press release (PDF) and accompanying media event.

Elections Ontario is modernizing the voting process and putting the needs of electors first by introducing technology in the polls. Election officials will be using electronic poll books (e -Poll books) and vote tabulators across the province for advance voting. On election day, 50% of the polls will have vote tabulators and e-Poll books … serving 90% of electors.

There was a Canadian Press story by Liam Casey, see e.g. CBC News – Ontario to use electronic voting machines for first time in spring election – May 9, 2018.

The tabulator is a Dominion Voting ImageCast® Precinct computer optical scan vote tabulator.

The history is buried in the post-event reports for two byelections that tested the technology:

• Post-Event Report: Whitby-Oshawa By-election / Proposal for a technology-enabled staffing model for Ontario Provincial Elections (PDF) – undated – By-election was on February 11, 2016
• Post-Event Report: 2016 Scarborough – Rouge River By-election / Additional testing of the proposed technology-enabled staffing model (PDF) – undated – By-election was on September 1, 2016

It is very clear from the Proposal that the key issue is staffing; the technology is being introduced to address poll staffing issues.

Additional Questions and Considerations

Disclaimer: I am not a lawyer.

Additional questions raised by the use of computer vote counting equipment:

• Are there provisions for erasing the digital copies of the ballots stored by the vote counting equipment? (I see no procedures described in law. Organisations often do not consider the security implications of digital copies of scans, see e.g. CBS News – Digital Photocopiers Loaded With Secrets – April 19, 2010.)
• What are the security implications, in particular the chain-of-custody implications, of sharing computer vote counting equipment with other jurisdictions (e.g. Ontario municipalities)?  Doesn’t the risk of computer code alteration increase with each new jurisdiction that has access to the machine?
• What are the procedures for transmitting the results of the computer count to Elections Ontario?  Is the count based on printouts from the vote tabulators, the vote tabulator memory cards, or transmission over a network?  What are the security implications of permitting the computer vote counting equipment to be connected to a network in order to transmit the count?  See e.g. Freedom to Tinker – Are voting-machine modems truly divorced from the Internet? – February 22, 2018.
• What are the procedures for handling the vote tabulator memory cards?

In the March 22, 2018 Guelph Mercury article Ontario’s voting system secure, chief election official says the following statement is made by the Chief Electoral Officer:

“The Ontario government has hired a cybersecurity team to assist any of the ministries with private security — and we’ve been working with that team over the last year, year and a half, and they’ve been working with all of our systems,” he said.

“They’ve been doing penetration testing, vulnerability testing … to ensure that our systems are up-to-date and secure. There have been some slight alterations based on their recommendations, and we are very confident and we take security very, very seriously.

“I want to make sure that all the systems and all the personal information that we have is protected.”

• Will these tests be made available to the public?  Including both the test procedures and the results?
• Why doesn’t the Ontario Election Act section 4.5 (3) 3. include independent security and integrity testing for computer vote tabulators, in addition to logic and accuracy testing, as is required for accessible voting equipment in 44.1 (5)?
• Will the independent security and integrity reports required by 44.1 (5) be made available to the public?
• Will the machines be made available for independent expert testing, by Canadian academics who are computer security experts?
• Will the machines be made available for independent expert testing by hackers, e.g. in DefCon Voting Village or at e.g. Canadian Hackfest?
• As the computer vote tabulators stack ballots in sequence in a bin, in theory it is possible to de-anonymise the votes by carefully tracking voters as they cast ballots.  Is there any provision for randomising the stacked ballots in order to prevent this potential risk?

For more about what it means to change from public hand-counted ballots to ballots counted by a computer from a private for-profit company, see computer vote counting is a radically different trust model.

Governing Legislation

The governing law is the Ontario Election Act, R.S.O. 1990, c. E.6

The relevant sections, modified in 2016 (Election Statute Law Amendment Act, 2016, S.O. 2016, c. 33 – Bill 45) and in force as of January 1, 2017 are:

• Authority to share equipment and resources – 4.0.3 (1) The Chief Electoral Officer may make equipment, advice, staff, or other resources available to other electoral authorities in Canada.
• Use of vote counting equipment – 4.5 (1) The Chief Electoral Officer may issue a direction requiring the use of vote counting equipment during an election and modifying the voting process established by this Act to permit the use of the equipment.

Next section blockquoted due to complexity:

Restrictions re equipment

4.5 (3) The following restrictions apply with respect to the use of vote counting equipment:

1. The equipment must not be part of or connected to an electronic network, except that the equipment may be securely connected to a network after the polls close, for the purpose of transmitting information to the Chief Electoral Officer.

2. The equipment must be tested,

i. before the first elector uses the equipment to vote, and
ii. after the last elector uses the equipment to vote.

3. For the purpose of paragraph 2, testing includes, without limitation, logic and accuracy testing.

4. The equipment must not be used in a way that en­ables the choice of an elector to be made known to an election official or scrutineer.

• Recount conducted manually – 74.1 A recount that is made from the actual ballots shall be conducted manually, even if the original count was done by vote counting equipment. 2010, c. 7, s. 31.

The only section that speaks about voting equipment security appears to apply solely to section 44.1 Accessible voting equipment

Accessible voting equipment, etc.

44.1 (1) At an election, accessible voting equipment and related vote counting equipment shall be made available in accordance with this section and in accordance with the Chief Electoral Officer’s direction under subsection (2). 2010, c. 7, s. 24 (1).

…

Condition

(5) Despite subsection (1), accessible voting equipment and related vote counting equipment shall not be made available unless an entity that the Chief Electoral Officer considers to be an established independent authority on the subject of voting equipment and vote counting equipment has certified that the equipment meets acceptable security and integrity standards. 2010, c. 7, s. 24 (1).

There is no analogous section under 4.5 vote counting equipment.  Disclaimer: I am not a lawyer.

Canada’s Chief Electoral Officer wants electronic counting option

The Chief Electoral Officer has made his Recommendations following the 42nd General Election.  Buried in it is recommendation A3, which would in my opinion open the door to unaccountable experimentation with Canada’s (federal) vote-counting system, a system that is currently extremely fast and high-integrity.  In particular it opens the door to introduce electronic counting (vote counting computers).  I don’t know why one would want to fix something that is not broken, and why Canada would want to give the sole authority to make that change to the Chief Electoral Officer (CEO).

Recommendation A3: Subsection 283(3) should be replaced with a general provision that allows the ballot-counting process to proceed according to the CEO’s instructions.

These recommendations are being discussed in closed sessions of the Parliamentary PROC (Procedure and House Affairs Committee).  It is not clear how the public can provide input into the discussions, other than by contacting PROC.

PROC@parl.gc.ca

At the time of this writing, the next closed meeting will be meeting 42, November 24, 2016.  You can find the list of all PROC meetings for the current Parliamentary session at

http://www.parl.gc.ca/Committees/en/PROC/Meetings?parl=42&session=1

Recommendations Report

An Electoral Framework for the 21st Century: Recommendations from the Chief Electoral Officer of Canada Following the 42nd General Election

From Table A—Recommendations Discussed in Chapters 1 and 2

Issues with Vote Counting Computers

The only way to be sure that votes have been counted is to

1. Vote on paper
2. Count the paper

If you have very complex counting, with either many positions being voted upon at once, or with an indirect allocation of results based on calculations, then you might choose vote counting computers that scan the paper ballots.  But be aware that you then MUST

• extensively test vote counting computers before and after the election
• remove voting computers from service during the live election and test them (in order to test under true voting conditions)
• conduct risk-limiting audits of the paper ballots
• keep the computers secure at all times, including between elections
• keep the computers well-maintained at all times, including between elections

Which is to say, using vote counting computers may be faster for complex elections, but it is definitely not cheaper when done with proper risk management.

It is possible to take a hybrid approach, although no jurisdiction I know of does so.  In a hybrid approach, particularly important votes would be separately hand marked and hand counted (e.g. in the USA it would make sense to separate the Presidential ballot and count from all other vote casting and counting).

Note that in Canada we don’t (yet) have complex elections, meaning there is literally no justification for computer counting of ballots.  You’re introducing greater security risk, along with the need to continuously warehouse, maintain and secure the voting computers.

And note I said voting computers not some incorrect term like “voting machines” or “electronic counting devices” or “electronic tabulators” or “optical mark-sense scanners”.  These are full-fledged computers with optical scanners attached.  Computers that are vulnerable to all the regular and routine sorts of attacks and errors that happen every day.

Now think about this concept of “efficiency”.  How often does an election take place?  Once every four years?  And how long does it take to do the count?  With a simple ballot, you might save a few minutes on the entire count.  And then what do you do with the computers?

To save a few minutes every four years, you have to spend millions of dollars to warehouse and maintain vote counting computers.  And warehouse them securely, if you care about elections security.  And technology goes obsolete quickly.  So basically you’re paying for computers to sit in warehouses going obsolete, in pursuit of some illusory time and efficiency savings.