Voting Systems Are as Transparent as Your Government Is
Adventures in Observing Elections in the Digital Age
On March 28, 2023, Shasta County Supervisors voted 3-2 to do away with voting systems altogether and return to hand counting of ballots. In 2019, a mass replacement of voting systems took place, with the Dominion ImageCast 5.10A, Hart Verity 3.1, and ES&S EVS 6.0.4.2 DS450 being purchased by counties up and down the state in preparation for the 2020 elections. While Shasta County used a Dominion Voting system, Nevada County uses Hart Verity 3.1.
Voting Systems have become the subject of much public scrutiny since the November 3, 2020 election, with Dominion taking most of the headlines. After many requests for public records pertaining to Nevada County’s voting system, and after much research, computerized voting systems are only as transparent as the government allows.
Let’s look at the software upon which the voting systems run. According to California Elections Code section 20622,
“‘Ballot tally software program source code(s)’ or ‘source code' consists of the computer program or programs used to translate or otherwise recognize votes, accumulate the total of those votes, and store that accumulated total to a storage media for later retrieval and reporting, and includes the version of a computer program in which the programmer's original programming statements are expressed in a source language.”
The source code used in voting systems currently in use in California is private and proprietary to the voting system manufacturer and not subject to public disclosure. California Elections Code section 20611 provides that “Ballot tally software program source code(s) . . . shall be placed in escrow.” The Legislature believes having the voting system software in escrow will safeguard it from manipulation. In contrast, voting system source code is available to the public for review in the Philippines. Section 12 of Republic Act No. 9369 provides that “the Commission shall promptly make the source code of that technology available and open to any interested party or group which may conduct their own review thereof.” In addition, “[t]he objectives of the review are to ensure that the AES functions as it should or as expected and that the code is clean and without any embedded malicious code.”
It only takes a few lines of code to make significant changes in the final result. Election officials may argue that the Logic and Accuracy testing done before every election guarantees that the results of a particular election are accurate, but a software engineer would counter that the system could hypothetically run one code for the Logic and Accuracy testing different from the code that is responsible for tallying votes in an actual election. The fact is that the public has no way to independently verify what the source code executes.
The Legislature did intend the Secretary of State to adopt a more transparent voting system when they enacted section 19006 (c) of the California Elections Code which mandates that “The Secretary of State study and encourage the development of voting systems that use non-proprietary source code and that are easy to audit.” Moreover, the Legislature meant to encourage local jurisdictions to use voting systems with publicly disclosable source code in enacting subsection (f):
It is the intent of the Legislature that a local jurisdiction may use available public funds to research and develop a nonproprietary voting system that uses disclosed source codes, including the manufacture of a limited number of voting system units, for use in a pilot program or for submission to the Secretary of State for certification.
In placing the source code away from public view, the Legislature has effectively given the people of California a voting system with zero transparency. In fact, the Arizona legislature just passed Senate Concurrent Resolution 1037 which requires source code for voting systems to be publicly available.
Physical observation of the entire election has become administratively impossible. Before elections were widely computerized, voting occurred on one day, people voted in their precincts in person, and paper ballots were counted by hand. Observers could view every aspect of this process. Today’s elections are run in stark contrast, but observers are still limited to what they can view on-site and in person. Between early voting, mail-in voting, and the post-election day canvass of the votes, election day has become election season. An observer wishing to view the entire election must be present for early voting, which begins almost one month before election day. The observer must also be present in multiple vote centers and the central counting facility where signed vote-by-mail ballot envelopes are opened and the ballot itself is extracted by an election worker (thus connecting the anonymous ballot to the identity of the voter) then scanned. At this point, the paper-based system is transferred to a digital one, wherein a computer counts votes from digital ballot images, and not paper ballots. How the computerized system counts the votes from the ballot images is dictated by the source code as discussed above.
Now let’s look at other aspects of voting system transparency namely, obtaining data and reports from the voting system. Unable to be present at all voting locations for multiple weeks, an observer can ask for records from the voting system after the election. For example, all voting systems must produce an audit log for every component, which as Greg Diaz stated, is a record of “who, did what, when.” The voting systems produce a variety of reports based on the data collected during the election that can serve as a way for the public to observe the election after the fact and have confidence in the reported results. All data generated during the election should serve to confirm the results, not deny them.
The three main manufacturers – Dominion, Hart InterCivic, and ES&S – have some differences in what types of reports their system will produce, but the contents of the reports are governed by the California Voting System Standards. The audit log report, for example, “shall not contain information that, if published, would violate ballot secrecy or voter privacy or that would compromise voting system security in any way.” Indeed, Hart InterCivic designed their Verity system to be transparent in order to instill confidence in the public. In a letter to the New Hampshire Secretary of State, Hart InterCivic CEO Phillip Braithwaite remarked that “Hart intentionally designed and developed transparency into our Verity Voting system” and described transparency features which include user-friendly audit log review which improves “audibility, transparency, and voter confidence in the integrity of elections.” Mr. Braithwaite’s remarks seem to be in keeping with the original intent of our Legislature, that is, voting systems should allow for easy auditability.
At this point, the question becomes how transparent is your local government? Is your local government willing to provide full transparency and share all non-identifying data from the election? San Francisco county, for example, is very transparent, posting many detailed election records online for the past seven elections including ballot images, voting system logs, cast vote records, and more. San Francisco voters enjoy a level of transparency in public records that the rest of the state does not, thanks to a local “Sunshine Ordinance.” Indeed, San Francisco voters can comb over a massive amount of election records and verify the election results for themselves – effectively observing all aspects of the election in a digital age.
The California Public Records Act, unfortunately, provides no appeals process for a member of the public who believes she has been incorrectly denied a public record. The remedy is to take the denial to court via a Petition for Writ of Mandate. Most people don’t have the personal and financial resources to hire an attorney, if they can even find one who is willing to take on the case, so denials are often the end of the road for Joe Public. No special knowledge or credentials should be needed to verify any level of the voting process. Elections are the people’s business.