 |
CAMBER |
|
|
|
HAVA complaint against HART eSlate certification
Case No.: SOS-HAVA 01-06-0001
Wrongful certification of HART InterCivic eSlate Direct Recording Electronic (DRE) voting equipment
Al Kolwicz 2867 Tincup Circle Boulder, CO 80305 303-494-1540 www.users.qwest.net/~alkolwicz www.coloradovoter.blogspot.com Plaintiff
vs.
Colorado Secretary of State 1700 Broadway Denver, CO 80290 (303) 894-2200 Defendant
Dated this May 24, 2006
______________________________ Al Kolwicz 2867 Tincup Circle Boulder, CO 80305
SUMMARY
The Colorado Secretary of State has the authority and duty to certify voting equipment for use in Colorado elections. Included is the authority and duty to certify that voting equipment complies with:
The Colorado Secretary of State has wrongfully certified the HART InterCivic eSlate Direct Recording Electronic (DRE) voting equipment. As will be detailed below,
When certified voting equipment is found to be non-compliant, the Secretary of State is required to decertify the equipment.
Every voter is disenfranchised when their vote is overridden by an ineligible vote. We ask the Secretary of State to stipulate items 1, 2, and 3 above; we ask the Secretary of State to decertify the eSlate voting equipment; we ask the Secretary of State to repair the damage that has resulted from the wrongful certification of the eSlate voting equipment.
ANONYMOUS VOTING The eSlate does not provide for anonymous voting. Anonymous voting is protected by the Colorado Constitution[1].
“All elections by the people shall be by ballot, and in case paper ballots are required to be used, no ballots shall be marked in any way whereby the ballot can be identified as the ballot of the person casting it.”
The language of the Constitution has been tested and decided by the Colorado Supreme Court in Taylor v. Pile[2].
The district attorney of Arapahoe county was granted leave to file a brief in this action and he has limited his presentation to two propositions, to-wit:
"I. An election wherein ballots are numbered in such a manner that the vote of any person thereafter may be determined by comparison with the number on the ballot and the poll registration book is contrary to the state of Colorado's constitutional and statutory guarantee of a secret ballot and, therefore, void ab initio." and
"II. A voter who has cast his ballot in good faith cannot be compelled, under the existing law of the State of Colorado, to disclose how he voted, particularly [***10] when the voter's name appeared on the registration books and when the voter was not challenged by the election judges."
We agree with each of these statements and will not lengthen this opinion with citations of authorities, which are plentiful, on propositions so fundamental to our system of government. The use of "marked ballots" by which the vote of every elector could be ascertained resulted in a void election.
Anonymous voting is also protected by the Colorado Statutes which prohibit the Secretary of State from certifying any electronic or electromechanical voting system unless the system “provides for voting in secrecy[3]”
Colorado election rules also protect anonymous voting:
There are strong reasons for anonymous voting. Voter intimidation and vote selling are made possible when anything or anybody, including the voters themselves or election officials, marks ballots “in any way whereby the ballot can be identified as the ballot of the person casting it”.
The constitutional requirement for anonymous voting is not permissive. It prohibits ballots from being identifiable even if election officials promise to try to keep secret the vote of any particular voter.
The eSlate violates the requirement for anonymous voting. (1) The eSlate prints each voted ballot, sequentially by voter, on a continuous roll of paper. The second voted ballot follows the first voted ballot, etc. (2) Poll watchers, election officials, and others may compile a sequential list of the names of people who voted at a particular eSlate. The second voter’s name is listed after the first voter’s name, etc. Compilation of voter lists is explicitly authorized under the Colorado Statutes which describe the compilation of a list of voters as one of the functions performed by a poll watcher[4]. Also, based on the HART Secure and Auditable brochure[5] it is possible that a programmer, using “time-stamped transaction logs”, “activation code assignment data”, and “audit logs” could construct a sequential list of voters for each eSlate machine. The HART brochure says:
“The eSlate System includes both physical and electronic intrusion detection controls, such as standard election seals and time-stamped transaction logs that record every system action related to the voting process.“
“Each eSlate is activated by the voter using a randomly generated four-number code;”
“All components of the eSlate System create an audit record anytime they are accessed or information is changed. All audit records can be extracted and printed in hard copy.”
(3) By combining a sequential list of voter names with the sequential printout of voted ballots, it is trivial to learn each individual voter’s choices. The first name voted the first ballot; the second name voted the second ballot, etc.
Election officials say that they will attempt to prevent this from happening. This is not good enough. Bad things happen despite the best of intentions; therefore, the voter’s votes can potentially be learned. Just yesterday, for example, it was reported that a disk containing 26 million identities was stolen from the home of an analyst who had taken it home without authorization. The law prohibits creating the opportunity for associating a voter and their votes.
Even the threat that an election official or other insider or outsider could discover a specific voter’s votes would be sufficient to persuade some voters to succumb to the demands of an intimidator or temptations of a vote trader. Some voters would vote differently than they wish out of self-imposed fear of retribution or embarrassment.
HART clearly understands the requirement for anonymous voting. See University of Maryland Study[6] posted on the HART website which says, “The Help America Vote Act (HAVA) requires that every voter be entitled to vote a ballot in secret, without assistance.”
The eSlate’s sequential recording of voted ballots is a direct and clear violation of the Colorado Constitution and Statutes. According to election rule 45.9.1, the eSlate must be immediately decertified.
VOTER-VERIFIED VOTING
The eSlate does not permit blind voters to verify that their votes are correctly printed before they are cast. Voter-verified voting is protected by the Federal Help America Vote Act (HAVA):
Voter-verified voting is also protected by the Colorado Statutes:
Colorado statutes require that “On and after June 6, 2005, a political subdivision shall not acquire a voting system unless the voting system is capable of producing a voter-verified paper record of each elector's vote[7].
C.R.S. 1-1-104 (50.6) describes a "voter-verified paper record" as an auditable paper record that is available for the elector to inspect and verify before the vote is cast, and is suitable for a manual audit or recount.
The definition of “cast” is not included in 1-1-104, however the requirements are specified in C.R.S. 1-5-704(1)(n) as follows:
(XI) The voting system shall require a clear, identifiable action from the elector to cast the ballot. The voting system shall explain to the elector how to take this action so that the elector has minimal risk of taking the action accidentally, but when the elector intends to cast the ballot, the action can be easily performed.
(XII) After the ballot is cast, the voting system shall confirm to the elector that the ballot has been cast and the elector's process of voting is complete.
(XIII) After the ballot is cast, the voting system shall prevent the elector from modifying the ballot cast or voting another ballot.
Election rule 45.5.2.9 requires that every electronic voting record shall have a corresponding paper record; the paper record shall be considered an official record of the election available for recounts; the V-VPAT device shall be designed to allow every voter to review, and accept or reject his/her paper record in as private and independent manner as possible for both disabled and non-disabled voters; the V-VPAT system shall be designed to allow each voter to verify his or her vote on a paper record in the same language they voted in on the DRE.
There are strong reasons for voter-verified voting. (1) Nobody other than the voter can ever verify that the votes recorded on their ballot are the votes intended by the voter, and then only before the ballot is cast by the voter, because votes must be anonymous and secret. No other person can detect incorrect votes, or votes not printed at all. (2) The paper ballots printed by the eSlate may be used to decide the outcome of an election. Therefore, it is imperative that every voter be given the opportunity to verify the votes recorded on their paper ballot. (3) Votes recorded on the digital records are not verifiable. Machines and software make errors. Electronic media may be accidentally or intentionally changed after the voter has cast their ballot. The paper ballot is the only record of votes that is verifiable, indelible, and trustworthy.
The eSlate violates the Federal and Colorado requirements for voter-verified voting. (1) It does not permit a [blind] voter to verify (in a private and independent manner) the votes selected by the voter on the ballot before the ballot is cast and counted. (2) It does not give a blind voter an opportunity to change the ballot or correct any error before the permanent paper record is produced. (3) It is not accessible for individuals with disabilities, including non-visual accessibility for the blind and visually impaired, in a manner that provides the same opportunity for access and participation (including privacy and independence) as for other voters. (4) It does not give a blind voter the ability to verify that the physical or vocal inputs given to the voting system have selected the candidates that the elector intended to select, since the paper record is not accessible to a blind voter. (5) It does not enable a blind voter to review the candidate selections that the elector has made on the paper ballot. (6) It does not give a blind voter the opportunity, before casting the paper ballot, to change any selections previously made and confirm a new selection.
Alternatives to the eSlate exist – systems that are fully accessible to blind voters, federally certified, and that are being deployed by many states across the nation. HART has published documents that show that the company understands the requirement for voter-verified voting. In its brochure, HART Voter Verifiable Paper Audit Trail,[8] HART states that the eSlate:
However, HART failed to implement these required capabilities.
The lack of a means for blind voters to verify their votes on the paper ballot is a clear violation of HAVA and Colorado requirements. According to election rule 45.9.1, the eSlate must be immediately decertified.
INADEQUATE TESTING
Testing of the eSlate was inadequate; it failed to report that: (1) the eSlate does not provide the required anonymous ballot, and (2) the eSlate does not provide the required means for blind voters to verify their votes on the printed ballot. Election rule 45 requires:
45.3.2 For a voting system to pass certification the voting system provider shall successfully complete all phases of the certification process that shall include: submitting a complete application, successful review of the documentation to evaluate if the system meets the requirements of this rule, successful demonstration of the system, followed by successful completion of items determined mandatory in the functional testing section of this rule
In response to a request for test documents, the Secretary of State on May 19 replied:
“However, if you are requesting just those records of the Secretary of State relating specifically to testing “to verify that a blind voter can verify the votes recorded on the paper record of votes (the audit trail in the case of the eSlate voting equipment), and to verify that the eSlate provides anonymous voting" (the phrase used in your original request), then you are advised that there are no such records.”
The Secretary of State’s procedures[9] for certification say that it is mandatory that the V-VPAT “allow verification on paper before the ballot is cast” and documentation must show “how the V-VPAT device allows the voter to review, accept or reject his or her paper record privately and independently”. The procedure must verify whether a voter has “a chance to verify privately and independently and allow correcting the ballot before the ballot was cast”. The procedure must verify that “the V-VPAT process is as close to the normal voting process as technically feasible for both able and disabled voters of all types”.
The Secretary of State has written[10] that there are no records indicating that these tests were performed, and that there is no record indicating that these tests were not performed. The lack of “anonymous and verifiable voting” test documents can mean only that no such tests were performed. If true, this would suggest negligence on the part of the Secretary of State; negligence that can result in the disenfranchisement of voters. Election rule 45.6.3 requires that voting systems shall successfully complete all of the requirements in this rule [45], and any additional testing that is deemed necessary by the SOS. If no testing was conducted, then it is not surprising that no defects were discovered, and that testing was inadequate.
Efforts to gain access to the “anonymous and verifiable voting” test documents of the Independent Testing Authorities (ITA’s) were not successful. The Secretary of State claims no knowledge about these tests, has never reviewed these tests or test results, and is therefore negligent in its duty to verify that voting equipment certified by ITA’s for use in Colorado does in fact meet Colorado’s laws.
The testing of the anonymous and verifiable voting features of the eSlate was inadequate. An independent investigation into this dereliction of duty is called for. The eSlate does not permit anonymous voting, and does not permit blind voters to verify votes on their paper ballot. It should not have been certified, and according to election rule 45.9.1, the eSlate must be immediately decertified.
UNFAIR PREFERENTIAL TREATMENT
Unfair, preferential treatment was given to eSlate multiple ballots per voter voting equipment over alternative federally certified voting systems that use a single paper ballot per voter. A competitor to the eSlate, the AutoMark was awarded federal certification on May 9, 2005[11], but was denied Colorado certification on January 10, 2006[12]. Colorado’s reason for denial of certification was:
“This letter is to inform you that the Colorado Department of State has received your application for certification of the ES&S Voting System for AutoMARK and AIMS. Unfortunately at this time we are unable to certify the AutoMARK and AIMS ballot marking devices for use in the State of Colorado as to our knowledge, this type of device does not meet the requirement of Colorado Revised Statutes Title 1, Article 5 Section 704, specifically paragraph (1)(n)(I).”
C.R.S. 1-5-704(1)(n)(I) requires, “After the initial instruction from an election official, the elector shall be able to independently operate the voter interface device through the final step of casting a ballot without assistance.”
The eSlate uses multiple ballots per voter: (1) one or more digital cast vote records that cannot be verified by a voter, (2) a printed paper text record that can be verified by a voter, (3) a printed bar code that is not verifiable by a voter, and (4) possibly additional backup and audit trail copies that could be used to resolve disputed ballots. When these different recordings disagree, the printed paper text record is the final authority.
The AutoMark uses a single pre-printed paper ballot – the same ballot as used for absentee voting. The un-voted ballot must be inserted into a voting machine before the voter makes selections. Once the voter has made and verified their selections, using appropriate voter interface devices, the equipment prints the votes onto the ballot. To verify the votes printed on the paper, the marked ballot may be visually inspected, or the marked ballot can be re-inserted into the voting equipment and the equipment will scan the document. It will then use the user interface features to tell the voter what choices have been made. Once the voter approves the ballot, the voter casts the ballot by placing it into a secure ballot box.
The Secretary of State’s denial of AutoMark certification was based on a single disability type. The AutoMark does not provide a way for a voter with a certain disability to complete all voting functions without assistance -- a voter who can physically not insert the paper ballot into the scanner/printer/ballot box. A blind voter can do this; a paraplegic voter might not be able to accomplish this task without assistance.
The Secretary of State did certify the eSlate despite the fact that it too does not provide a way for a voter with certain disabilities to complete all voting functions without assistance -- a blind voter cannot independently verify the votes on the paper record. (It is not obvious that all paraplegic voters can verify the votes on the eSlate V-VPAT without assistance.)
There is no defensible explanation for why the Secretary of State denied certification to the AutoMark while it did certify the eSlate. Efforts to obtain such an explanation using the Colorado Open Records Act failed, because the Secretary of State says there are no relevant records.
Why is this important?
A significant number of Colorado electors are working hard to have accessible, anonymous, verifiable paper ballot voting systems adopted in their home county. The Secretary of State has improperly used its office to block paper ballot voting systems. The Secretary of State has wrongfully denied certification to paper ballot voting systems.
Some Colorado counties, including Boulder County, would almost surely evaluate and perhaps adopt the AutoMark or VotePAD voting systems if they were certified for use in Colorado.
The Secretary of State has an obligation to repair the damage it has done to Boulder County electors through its wrongful denial of certification to the AutoMark.
The Secretary of State should immediately decertify the eSlate. Under election rule 45.7, the AutoMark and VotePAD voting systems should be immediately certified on a temporary use basis. The Secretary of State should plead with the AutoMark and VotePAD vendors to agree to supply voting equipment for the 2006 elections. The Secretary of State should rescind approvals for purchase and void contracts for eSlate voting equipment.
When certified voting equipment is found to be non-compliant, the Secretary of State is required to decertify the equipment. Election rule 45.9 says:
45.9 Decertification
45.9.1 If after any time the SOS has certified a voting system, it is determined that the voting system fails to meet the standards set forth in this rule, the SOS shall notify any end users in the State of Colorado and the voting system provider of that particular voting system that the certification of that system for future use and sale in Colorado is to be withdrawn.
45.9.3 Any use of a decertified or uncertified voting system for any jurisdiction in the State of Colorado shall result in possible loss of future and other existing certifications within the state, at the discretion of the SOS.
Although it has been certified by the Colorado Secretary of State, the eSlate “fails to meet the standards set forth” in election rule 45. (1) The eSlate does not provide for anonymous voting. (2) The eSlate does not permit blind voters to verify that their votes are correctly printed before they are cast.
The Secretary of State is obliged and authorized to “notify any end users in the State of Colorado and the voting system provider of that particular voting system that the certification of that system for future use and sale in Colorado is to be withdrawn.” [1] Colorado Constitution, Article VII, Section 8. [2] Taylor v. Pile, 154 Colo. 516; 391 P.2d 670; 1964 Colo. LEXIS 468; April 27, 1964, Decided
[3] C.R.S. 1-5-615(a) [4] C.R.S. 1-7-108(3) [5] HART Secure and Auditable brochure, 2005, http://www.hartintercivic.com/files/secure.pdf
[6] University of Maryland Study http://www.hartintercivic.com/innerpage.php?pageid=100 [7] C.R.S. 1-5-801 Acquisition of voting systems - voter-verified paper record.
[8] HART Voter Verifiable Paper Audit Trail brochure, 2005, http://www.hartintercivic.com/files/Voter_Verifiable_Paper_Audit_Tr.pdf [9] Procedures for Certification of Voting Systems, November 15, 2005 http://www.elections.colorado.gov/DDefault.aspx?tid=501 [10] Williams to Kolwicz, May 19, 2006, by e-mail. [11] SysTest Labs to ES&S, May 9, 2005. [12] Colorado Secretary of State to ES&S, January 10, 2006. |
|
CAMBER is a dedicated group of volunteers who are working to ensure that |