Tag Archives: election

Non-attended 24-7 election dropboxes

Blog, , , , , , , , ,

Review of election specific non-attended 24-7 drop boxes Harvie Branscomb 3/25/2021
(an election quality advocate from a mail ballot state with outdoor drop boxes- Colorado)

1. Most Colorado voters drop off their precious ballot in an unattended ballot drop box. They do not see how the election is processed and officials do not observe that they have voted. Many states have started or increased using drop boxes during the 2020 election season because of the pandemic.


Unattended drop boxes allow unaccountable casting of ballots that may not be eligible or may be eligible but not countable. Several mistakes or flaws in casting are introduced by non-attended drop boxes:

  1. An otherwise eligible ballot sheet dropped into the drop box lacks the enclosing envelope or attestation of eligibility. In this case it is either unlikely or illegal for the election officials to locate the voter to obtain a cure.
  2. An otherwise eligible ballot sheet dropped into the drop box may be enclosed in an envelope for the wrong election. In this case the voter identity is known, but statute will determine the disposition and possible cure.
  3. An otherwise eligible ballot in its ballot-return envelope is dropped into the wrong drop box. State law will determine if there is a cure such as moving the ballot packet to the appropriate jurisdiction. (A ballot packet includes the voted ballot sheets plus secrecy device plus envelope—one of which contains the signed attestation of eligibility.)
  4. An otherwise eligible ballot packet may be dropped without the appropriate signature. There is usually a remedy for this flaw via a cure process, but the necessity of a cure could be avoided with an attended or intelligent (“smart”) drop box.
  5. The drop box may fill and be unable to accept additional drops.
  6. The drop box may be breached or otherwise interfered with or emptied by unauthorized persons.
  7. The authorized pickup team may fail to remove all ballot packets or may selectively return only some of them because there is insufficient oversight or accounting for casting.
  8. Too many eligible ballots may be returned by one person when unaccountably dropped. There is little or no recourse or obstacle to this flaw and it is available by other methods as well.

For the above reasons, it is preferable to arrange physical bipartisan attention for all open drop boxes or to implement “smart” drop boxes for ballot return. Appropriate funds should be allocated to make one or the other solution available and to mandate implementation throughout states with substantial amounts of remote voting.


The “best practices” drop box described in sections A to E below would contain the technology of one or at most two smart phones and a solenoid to lock the drop box when higher integrity accessible ballot casting is available nearby. It is not a complex design challenge.


A. By “smart” drop boxes I mean that at a minimum they contain a communication device with GPS positioning to report status and location to the election office, a scanner or camera to pick up the barcode on the return envelope, and one or more cameras to record activity in the vicinity of the drop box. Also very valuable would be an information display that could contain text about how to cast a voted ballot and possibly a streamed video channel. A smart drop box could be attended by a virtually present team who are in fact in a remote location.


A minimal implementation would simply advise the state voter registration database and the county clerk or election director that the ballot packet associated with a voter has been cast. This single improvement initiates the chain of custody for a ballot and facilitates tracking of the ballot envelope through the eligibility check.


The flag that prevents another attempt by the voter to vote (“credit for voting”) should be raised when the envelope is approved to be counted after passing the eligibility check. Nevertheless, the voter can initially be advised by text or email that the ballot envelope has been cast even before it is received at the election central count facility if the drop box scans and detects the voter identity on the ballot envelope.


B. Another check that the scanner could do is “look” for a signature in the signature area. If no signature is present there, the smart drop box could signal to the voter that the signature is missing. If the signature is missing, the drop box can report to the person casting that the packet is not suitable to be cast. If the person persists to drop the packet, they can be informed that a cure process will be activated.


C. A well-designed smart drop box ought not divert a person casting a ballot away from an open, staffed polling place. If the drop box is located next to an open clerk’s office or other voter service and polling center, the voter could be instructed to take the envelope inside and have a staff member (who would check for the presence of a signature) receive it into a secure ballot box. This practice would promote healthy observation of both the person casting and the officials performing activities related to the election. And the chain of custody for the ballot is initiated.


D. In the best of all possible worlds, an attending staff member could check the voter’s ID and signature and then, if there is a match, allow the voter to drop the ballot sheet without enclosing identifying envelope into the ballot box designated for anonymous ballot sheets destined to be counted. This extra service performed in the voter’s presence would allow the cast ballot to escape the hazards of signature verification and a potentially imperfect cure process. In the long run, this is the approach that would add the most election integrity to the in-person return of mail ballots.


E. The expected number of ballot envelopes to be picked up from a drop box would be known by the clerk’s office. Thus integrity is increased in that no ballot envelopes can undetectably go missing between the time of casting into the drop box and the next time the ballot packet envelopes are scanned in the central count facility. Envelopes left in the drop box will be discovered as discrepancies in the chain of custody. In 2019, Mesa County CO missed counting over 400 ballots left in the drop box in front of their central count facility.


Below are recommendations if the best-practices drop box for returned remotely voted ballot packets described above isn’t practical or feasible yet.


F. If indoors, the drop box must be sealed with numbered, tamper-evident seals and an externally visible seal log signed by two workers who enter the seal number each time a seal is added or removed. The drop box may be made of cut-resistant fabric or hard material if the material cannot be opened or breached without leaving evidence. An indoor drop box must be within sight of election officials, and two officials should observe each deposit of a ballot packet into the drop box. Ideally the envelope will be barcode scanned by these officials at the time of deposit to start the chain of custody, after attending officials check the envelope for authenticity and for appropriate placement of signature.


G. Outdoor drop boxes must be made of welded steel and fastened to concrete foundations by tamper-resistant fastenings. The drop boxes shall generally be placed in strategic locations remote from the central election office. A 24/7 open drop box need not be located outside the door of a polling place or voting center. A basic drop box’s design will be selected to accommodate retrofitting of cameras and scanner as described above. The drop box’s opening shall be designed to accommodate a single ballot envelope at a time. The drop box shall bear insignia to explain its purpose and to indicate locations and times during which in-person voting and ballot replacement services are available. Specific instructions shall include the necessity of dropping a signed and sealed, privacy-protected envelope containing the ballot sheet or sheets.


If located near the door to a staffed polling location, the drop box shall indicate that the opening hours of the drop box are the closing hour of the polling location and that the drop box shall be closed while the polling location is open.


Either the drop box shall be equipped with a communication facility and internal cameras or be subject to streamed security video with positioning and resolution adequate to recognize faces.


Drop boxes that are not attended must be located on public property where there are personnel present 24 hours.


Reports must be made of all counts of items left in the box including those that are not able to be counted.

Addendum – comparative benefits offered by use of USPS to return ballot packets:

  1. USPS boxes are provided in a large and diverse set of locations
  2. USPS boxes are not election specific and therefore not subject to election interference
  3. USPS has a very effective investigation and prosecution team of inspectors who monitor the honesty of both the system and users of the system, as needed.
  4. USPS visits the home in many cases providing extreme level of customer service for return of ballot packets for persons who are alternately abled or otherwise unable to visit either a polling place or a drop box.
  5. USPS has tracking of mail and this can be used to provide early accounting of cast ballot packets before they are returned to the election facility – including the potential to give credit for casting upon first detection of the envelope.
  6. Only on election day or one day prior is the special purpose box likely to provide better timeliness of service if postmark or barcode tracking insulates the voter from delays past the deadline caused by slow delivery to the election facility.


I believe the drop box deserves more careful consideration and Colorado is the correct state to improve upon what it has already pioneered.


Harvie Branscomb 3/25/2021 harvie [at] electionquality.com

Critical improvements for 2021-S.1

Blog, , , , , , , , , , , ,

TO: Honorable Senator Schumer,
Honorable Senator Merkley,
Honorable Senator Klobuchar,
Senate Rules Committee

FROM: State Audit Working Group c/o Luther Weeks Luther ‘at’ CTVotersCount.org

RE:  H.R.1/S.1 Critical Suggested Improvements                                                            3/21/2021

We write as members of the “State Audit Working Group (SAWG), an ad hoc group of individuals concerned about election integrity issues in general and election audits in particular. The SAWG has been meeting regularly via teleconferences since 2008, and has worked on recommendations from time to time such as the Principles and Best Practices for Post-Election Tabulation Audits and the EAC’s Voluntary Voting Systems Guidelines.

We write to request critical changes to H.R.1, as passed by the House, along with suggested improvements. Without a few key changes, we believe the bill might degrade election integrity and miss opportunities for improvement, rather than meet its well-intended, laudable goals. Our comments are restricted to election administration and integrity issues pp78-407 of the bill.

Attached to this letter is a list of detailed comments. Here we summarize the most critical items:

  • Requirements for grants should be stronger, to help ensure effective Risk Limiting Audits (RLAs). We suggest specific improvements to the HR1 grant requirements. Grants should be available to audit compliance and eligibility which are crucial for valid RLAs.
  • Poll books should be part of the Federal certification program, as proposed. So should other systems used to determine the eligibility of voters or ballot packets. They however, should be tested and certified separately from the voting system. Competition will be stifled if pollbooks are only tested as part of an entire voting system. Election officials will end up with fewer and less innovative purchase choices.
  • Ballots cast by an in-person voter by hand marked paper ballots may be rejected later under the current text. When a voter appears in person they must be offered an opportunity to be authenticated and, upon authentication, vote on a hand marked paper ballot  without further eligibility checks.
  • Voter Privacy / Ballot Secrecy. Ballots should never be associated with voters, thus compromising ballot secrecy There should be no unique identification numbers on some ballots for voters with disabilities. Voters should not be able to waive ballot secrecy, a collective right.
  • Voting over the internet is not secure and does not protect the secrecy of the ballot. For security and integrity, votes should not be transmitted over the internet or by other electronic means such as email or fax.

Sincerely,

Note:  All affiliations are for reference only and do not constitute an endorsement

Luther G. Weeks, Moderator, State Audit Working Group, Computer Scientist and Executive Director, Connecticut Citizen Election Audit

Harvie Branscomb, Publisher, https://electionquality.com, Coloradans For Voting Integrity

John L. McCarthy, Computer Scientist (retired), Lawrence Berkeley National Laboratory

Paul Burke, VoteWell.net

Timothy White, Election Transparency advocate, WA

Philip B. Stark | Associate Dean, Division of Mathematical and Physical Sciences | Regional Associate Dean (Interim), College of Chemistry and Division of Mathematical and Physical Sciences (ChaMPS) | Professor, Department of Statistics | University of California

Ronald L. Rivest, MIT Institute Professor

Duncan Buell, Chair Emeritus — NCR Chair in Computer Science and Engineering, Dept. of Computer Science and E, University of South Carolina

Mark Halvorson, Citizens for Election Integrity Minnesota

Rebecca Wilson, Co-Director, SAVEourVotes.org

Candice Hoke, Founding Co-Director, Center for Cybersecurity & Privacy Protection, Cleveland, OH

Celeste Landry, MS in Operations Research, voting methods researcher

Donna Price and Donna Curling, Director, Georgians for Verified Voting

Debra McDonough, PhD. Election Security Advocate, Maine

Jan BenDor, Statewide Coordinator, Michigan Election Reform Alliance

Attachment-Comments on HR1 and SR1 by the State Audit Working Group

The format of this document is to give our concern about each topic, then dotted paragraphs show relevant sections of the bill. Proposed deletions are stricken out and additions are underlined.

CONCERN: Implementation deadlines in 2022. Deadlines written in HR1 are impractical, especially with so many changes all required by 2022. Time needs to be allowed after enactment for issuing regulations, designing and certifying equipment, local budgeting, soliciting vendors, negotiating contracts, manufacturing for thousands of customers, acceptance testing with possible rejection and re-delivery, training staff and educating voters. These will be very challenging especially for states without no-excuse absentee voting and early voting, with local election management, such as the New England States. Examples of the many deadlines in 2022:

  • 10/2022* Election Day Registration for elections and every day of early voting
  • 10/2022 Early voting 15 days prior and Election Day
  • 10/2022 Processing and scanning of early voting ballots and absentee ballots must start by 14 days prior to election day.
  • 10/2022 Previous two requirements all but mandate connected ePollbooks
  • 10/2022 Absentee changes to allow all to vote by mail, no ID but signature, prohibiting notarization/witness signature, due process of signature verification, permanent absentee registration, notice and opportunity to cure. Insuring delivery of ballots requested 5 days prior to election day.
  • 10/2022 Website and tracking program for mail-in ballots.
  • 10/2022 Absentee applications, absentee ballots, and related materials accessible to individuals with disabilities.
  • 11/2022 Accepting absentee ballot post-marked by election day, for at least 10 days after election day.
  • 10/2022 Online system for requesting absentee ballots

* H.R.1 says for 11/2022 Federal elections, yet that means many of these must be in use by 10/2022 or perhaps in some cases by 9/2022

Title I—Election Access, Subtitle B—Access to Voting for Individuals With Disabilities

CONCERN: Having a unique ID on a ballot endangers ballot secrecy, but having a unique ID on the ballot return envelope is appropriate. Ballot secrecy is a cornerstone of democracy. It impedes vote buying, vote selling and coercion.  The voter can be mailed a ballot envelope with a unique ID so that the voter can return the ballot in that envelope and the Election Officials can easily know who the envelope is from and log it in. Large efforts have been made to make sure voters with disabilities can vote privately and independently. Putting an ID on a ballot would be counter to this progress.

  • SUGGESTED REVISED HR1 LANGUAGE:
  • 1101(a)(2) creates HAVA 305(d)(3) APPLICATION OF METHODS TO TRACK DELIVERY TO AND RETURN OF BALLOT BY INDIVIDUAL REQUESTING BALLOT.—Under the procedures established under paragraph (1), the State shall apply such methods as the State considers appropriate, such as assigning a unique identifier to the oath or ballot envelope, to ensure that if an individual with a disability requests the State to transmit a blank absentee ballot to the individual in accordance with this subsection, the voted absentee ballot envelope which is returned by the individual is the same blank absentee ballot envelope which the State transmitted to the individual. (p.117)

Title I—Election Access, Subtitle I—Voting by Mail

CONCERN: Voting over the internet is not secure and does not protect the secrecy of the ballot.. For security and integrity, votes should not be transmitted over the internet or by other electronic means such as email or fax.

  • SUGGESTED REVISED HR1 LANGUAGE:
  • 1621(a)(2) creates HAVA 307(d) ACCESSIBILITY FOR INDIVIDUALS WITH DISABILITIES.—The State shall ensure that all absentee ballot applications, absentee ballots, and related voting materials in elections for Federal office are accessible to individuals with disabilities in a manner that provides the same opportunity for access and participation (including with privacy and independence) as for other voters. Nothing in this subsection prevents States from requiring physical return of voted ballots. (p.198)

Title I—Election Access, Subtitle F—Promoting Accuracy, Integrity, and Security Through Voter-Verified Permanent Paper Ballot

CONCERN: Ballots cast by an in-person voter by hand marked paper ballots may be rejected later under the current text. When a voter appears in person they must be offered an opportunity to be authenticated and, upon authentication, vote on a hand marked paper ballot without further eligibility checks.  Providing an absentee ballot package that may or may not pass signature review is not sufficient; it must be a regular ballot that is offered.

  • SUGGESTED REVISED HR1 LANGUAGE:
  • 1502(a) amends HAVA 301(a)(2)(A)(i)(1) For purposes of this subclause, the term ‘individual, durable, voter-verified paper ballot’ means a paper ballot marked by the voter by hand or a paper ballot marked through the use of a nontabulating ballot marking device or system, so long as the voter shall have the option to mark by hand a ballot pre-printed with the contests and candidates, and it shall be tallied like other in-person ballots. (p.163)

CONCERN: Voter Privacy / Ballot Secrecy. Ballots should never be associated with voters compromising ballot secrecy. This bill suggests voters can waive that right. Primaries of small parties have few voters. Ballots in some languages have few voters. Some small overlapping special districts have few voters. Ballots marked by machines or by hand can be rare, depending on local choices. The election system tracks all these factors, so it could identify some voters who were the only ones casting that ballot at a particular location on a particular early voting day. Some voters sign their ballots or write themselves in as a write-in candidate; which some election officials have taken as a reason to remove transparency from vote counting, at high cost, even though any voter can put any other voter’s name on a ballot (Pat can put Kim’s name on Pat’s ballot). Options for election officials to minimize association of ballots with individuals include:

  1. Ballots do not need to identify precinct, voting location or date or voting method (e.g. provisional or absentee).
  2. English can be on the same ballot with each of the less common languages and enough English-speakers can use these ballots so users of the less common language cannot be identified.
  3. Special districts which have different boundaries can be printed on separate sheets which are scanned separately to reduce the need for rare ballot styles.
  4. Machines can mark ballots so they look the same as hand-marked ballots.
  5. Ballots with a signature or unique write-in can be recognized as not necessarily from that voter, and handled according to local law.

The clause about voter consent is a separate issue. We do not see a reason to let voters consent to changes in normal procedures or to violate secret voting. We re-word it to refer to voter’s stray marks.

  • SUGGESTED REVISED HR1 LANGUAGE:
  • 1502(a) amends HAVA 301(a)(2)(A)(i)(III) The voting system shall not design, handle or preserve the voter-verified paper ballots in any manner that makes it possible, at any time after the ballot has been cast, to associate a voter with the record of the voter’s vote; without except this prohibition shall not apply to marks made by the voter’s consent. (pp.163-164)

CONCERN: Counting by hand. “Count” is an ambiguous term. It is used for the enumeration of ballot sheets as well as the tabulation of vote counts on those sheets.  To make it clear what is meant, we suggest ‘interpreting’ ballots or votes rather than ‘counting’ them when interpreting marks or votes on individual ballots is meant. The original wording required counting ballots in all audits, but some audits do not involve counting or interpreting ballots, such as process audits including security audits.

  • SUGGESTED REVISED HR1 LANGUAGE:
  • 1502(a) amends HAVA 301(a)(2)(A)(iii)(I) Each paper ballot used pursuant to clause (i) shall be suitable for a manual audit, and shall to be counted interpreted by hand in any recount or audit conducted with respect to any election for Federal office. (p.164)

Title I—Election Access, Subtitle I—Voting by Mail

CONCERN: Permanent absentee status, and online and phone requests, are convenient and can seem to remove barriers in getting ballots. However, they create other barriers and issues: Lack of a recent signature means either lax review when their VBM envelope arrives, or high initial rejections of these voters’ ballot envelopes. Old signatures disproportionately harm people who have changed names, developed a disability in their hand or eyes, normally use non-Roman characters or print. Options for permanent absentee status include 6-year status, to cover three federal general elections, with reminders sent before expiration; or obtaining a recent signature, required or optional; or dropping the proposed federal requirements so states continue to  experiment. Since signature matching is imperfect, exploration of other ways to check eligibility is important.

Changing “paragraph” to “section” in HAVA 307(a) conforms with Sec. 1101(a) (p.31) which skips signature at registration, if it is obtained before voting. The original word paragraph allows signature requirements for 307(a)(2)(A), while changing it to section allows signature requirements also in the subsequent wording so 307(a)(3) and 307(c), which are all in the same section, though not the same paragraph.

When an application produces access to absentee ballots for all future elections, states should not be prevented from having a means to regularly update and authenticate the reference material used to authenticate the identity of the voter in each election, such as a stored image of a signature.

Besides creating barriers to actual voters, permanent VBM status lets ballots of the recently deceased pile up at nursing homes and assisted living, where unscrupulous people can harvest them anonymously. States need to remove dead voters promptly, such as by using the Social Security Death Index, though with due process.

  • SUGGESTED REVISED HR1 LANGUAGE:
  • 1621(a)(2) creates HAVA 307(a)(2)(A) A State may not require an individual to provide any form of identification as a condition of obtaining an absentee ballot, except that nothing in this paragraph section may be construed to prevent a State from requiring a signature of the individual or similar affirmation as a condition of obtaining an absentee ballot. (p.186)
  • 1621(a)(2) creates HAVA 307(a)(3) APPLICATION FOR ALL FUTURE ELECTIONS.—At the option of an individual, a State shall treat the individual’s application to vote by absentee ballot by mail in an election for Federal office as an application for an absentee ballot by mail in all subsequent Federal elections held in the State, and shall promptly remove deceased voters. (p.199)
  • 1621(a)(2) creates HAVA 307(c)(1)(A) State shall permit an individual— (i) to submit a request for an absentee ballot online; and (ii) to submit a request for an absentee ballot through the use of an automated telephone-based system (p.196)

 

CONCERN: Time frames before and after general elections need to be changed and/or the safe harbor day postponed. Mail service is not fast enough to ensure ballot delivery within five days. Eight or nine days would be safer. Allowing 10 days to accept mailed ballots, then 10 days to cure means audits, certifications and recounts could start after 21 days, or November 29 when election day is November 8. Furthermore these long periods put high burdens on public observers who try to monitor compliance, postmarks are not always present or readable, and dates on signatures are not always correct. Options include accepting ballots for a shorter period after election day, and providing a shorter cure period for the last ballots.

  • SUGGESTED REVISED HR1 LANGUAGE:
  • (C) ENSURING DELIVERY PRIOR TO ELECTION.—If  an  individual  who  is  eligible  to  vote  in  an  election  for  Federal  office  submits  an  application  for  an  absentee  ballot  in  the  election,  the  appropriate  State  or  local  election  official  shall  ensure  that  the  ballot  and  relating  voting  materials  are  sent to received by the  individual  at least 14 days before the election or within 48 hours of receipt, whichever is later prior to the date of the election so  long  as  the  individual’s  application  is  received  by  the  official  not  later  than  5  days  (excluding  Saturdays,  Sundays,  and  legal  public  holidays)  before  the  date  of  the  election,  except  that  nothing  in  this  paragraph  shall  preclude  a  State  or  local  jurisdiction  from  allowing  for  the  acceptance  and  processing  of  absentee  ballot  applications  submitted or received after such required period. (p.197)
  • 1621(a)(2) creates HAVA 307(e)(1)(A) the ballot  is  postmarked  or  otherwise indicated  by  the  United  States  Postal  Service  to have  been  mailed  on  or  before  the  date  of  the election,  or  has  been  signed  by  the  voter  on  or  before the date of the election; (p.198)
  • 1621(a)(2) creates HAVA 307(e)(1)(B) the ballot is received by the appropriate election official prior to the expiration of the 10-day period which begins on the date of the election. (p.197)
  • 1621(a)(2) creates HAVA 307(b)(2)(B)(i)(II) provide the missing signature or cure the other defect prior to the expiration of the 10-day period which begins on the date the official notifies the individual, or 14 days after the date of the election, whichever is first. (pp.190-191)

Title I—Election Access, Subtitle N—Promoting Voter Access Through Election Administration Improvements

CONCERN: Hotline will be a good way to collect actionable reports of fraud, machine problems and other errors as well as voter suppression.

  • SUGGESTED REVISED HR1 LANGUAGE:
  • 1905(a)(2)(C) may report information to the Attorney General on problems encountered in registering to vote or voting, including incidences of fraud, illegal or improper actions, ballot and machine issues, voter intimidation or suppression. (p.260)
  • 1905(d)(2) a compilation and description of the reports made to the service by individuals citing instances of voter intimidation or suppression, together with a description of any actions taken in response to such instances of voter intimidation or suppression; (p.264)

 

CONCERN: 30-minute waiting period is a good maximum. Officials cannot control how long people wait before polls open, but they need to open on time and have enough staff and equipment to handle those lines within 30 minutes of opening. People often come early because they have other deadlines like work.

  • SUGGESTED REVISED HR1 LANGUAGE:
  • 1906(a)(2) creates HAVA 310(a)(1) IN GENERAL.—Each State shall provide, and shall report publicly within 3 months how well it succeeded in providing, a sufficient number of voting systems, poll workers, and other election resources (including physical resources) at a polling place used in any election for Federal office, including a polling place at which individuals may cast ballots prior to the date of the election, to ensure, by written capacity plans, aside from extraordinary situations—

(A) a fair and equitable waiting time for all voters in the State; and

(B) that no individual will be required to wait longer than 30 minutes to cast a ballot at the polling place while the polling place is scheduled to be open. (p.266)

CONCERN: Drop Boxes have numerous failure modes. Examples are fake drop boxes, overflowing drop boxes, failed pickup, vandalism, picked locks, misplaced ballots, missing envelopes etc.

Security video is helpful though not sufficient to provide integrity. Ideally eligibility could be determined as ballots are dropped in the drop boxes if they are attended by election officials or if the drop boxes are intelligent. The law could be improved by grants to study improvements for smarter drop boxes that can report casting of ballot packets.

  • SUGGESTED REVISED HR1 LANGUAGE:
  • 1907(a)(2) creates HAVA 311(a) REQUIRING USE OF DROP BOXES.—In each county in the State, each State shall provide in-person, secured, and clearly labeled drop boxes at which individuals may, at least 12 hours per day any time during the period described in subsection (b), drop off voted absentee ballots in an election for Federal office, and report issues with them, and the number and types of items dropped including those that are accepted and those not eligible or not properly formatted for counting. (p.271)
  • 1907(a)(2) creates HAVA 311(g) TIMING OF SCANNING AND PROCESSING OF BALLOTS. __For purposes of section 306(e) (relating to the timing of the processing and scanning of ballots for tabulation), a vote cast using a drop box provided under this section shall be treated in the same manner as mailed in ballots received by election day any other vote cast during early voting. (p.253) Accounting of the casting of the ballot packet dropped in a drop box shall be performed at least as timely a manner as for ballot packets received from the USPS. (p.275)

 

Title III—Election Security, Subtitle A—Financial Support for Election Infrastructure

CONCERN: Vendor requirements. HR1 3001(a) adds HAVA 298A(b)(2) which assigns new equipment review roles to the Technical Guidelines Development Committee. The committee does not have enough cybersecurity and infrastructure expertise to do a thorough job. Traditionally the EAC has focused on HAVA-defined voting systems, but there are many election technologies outside of the traditionally defined voting systems. These systems are critical to the delivery of our elections and also create significant vulnerabilities to U.S. elections. The new functions in 298A(b)(2) should be assigned to CISA or NIST, which have the expertise, rather than the TGDC and EAC.

CONCERN: Grants for audits. We believe requirements for grants should be stronger, to help ensure effective RLAs.  Election compliance, and decisions on voter eligibility, are necessary for effective Risk Limiting Audits (RLAs), grants should cover them. Well-designed RLAs can determine if there are significant flaws, and convince the public that these flaws exist or don’t, as the case may be.

  • SUGGESTED REVISED HR1 LANGUAGE:
  • 3011(a) creates HAVA 299(a) AVAILABILITY OF GRANTS.—The Commission shall make a grant to each eligible State to conduct risk-limiting audits as described in subsection (b) with respect to the regularly scheduled general elections for Federal office held in November 2022 and each succeeding election for Federal office. Grants for related audits, such as compliance audits and eligibility audits, are also available. (p.421)
  • 3011(a) creates HAVA 299(c) REQUIREMENTS FOR RULES AND PROCEDURES.—The rules and procedures established for conducting a risk-limiting audit shall include the following elements:

(1) Rules for setting the predetermined percentage chance of replacing an incorrect outcome, ensuring the security of ballots, publishing initial results, publishing digital signatures that authenticate electronic records and documenting that prescribed procedures were followed and observable by the public and records used are published prior to certification.

(2) Rules and procedures governing the format for and ensuring the accuracy and security of chain of custody records, ballot manifests, and ballot images and cast vote records, produced by election agencies, and for authenticating true copies, such as by digital signatures, of subsets of this data as they are produced and before data release.

(3) Rules and procedures for governing the format of ballot manifests, cast vote records, and other data involved in the audit.[merged into 2 above]

(3) Methods to ensure that any cast vote records or other subtallies subject to selection usedby the voting system to tally the election results sent to the chief State election official and they in the audit, must be made public before sample selection.

(4) Procedures for the publicly observable random selection of ballot sheets to be inspected manually during each audit. The sample of paper ballots shall be drawn from and represent all ballots lawfully cast in the election. (p.441)

(5) Rules for the calculations and other methods to be used in the audit and to determine whether and when the audit of an election is complete and when and how to transition the audit to a full hand-to-eye tabulation.

(6) Procedures to conduct full, hand-to-eye tabulation when needed, and measuring and reporting its accuracy.

(7) Procedures and requirements for testing the public to independently replicate results from any software used to conduct risk-limiting audits  including to aggregate the cast vote records or other applicable subtallies to check the correctness of the reported outcome. (p,441)

(8) Separation of Responsibilities: Neither the policy and regulation setting for the audit, nor the authority to judge whether an audit has satisfied those regulations, shall be solely in the hands of any entity directly involved with the tabulation of the ballots or the examination of ballots during the audit. 

RELATED AUDITS:

(9) Compliance audits: Procedures and documents to evaluate security, authenticity and accuracy of ballot management including a reconciliation of numbers of voters, ballot sheets and contest tallies, by ballot style if applicable. The evaluation and electronic copies of the documents used shall be published before certification of the election.

(10) Eligibility audits: Procedures to review random samples of accepted and rejected ballot envelopes, and report publicly on accuracy rates of eligibility processing. These reviews may include contacting voters.

(11) Voter registration audits: Procedures to review random samples of voters registered as of this election and voters removed from voter rolls since the last federal election, and report publicly on their accuracy rates. These reviews may include contacting voters.

  • 3011(a) creates HAVA 299(d). Add: (5) The term ‘full hand-to-eye tabulation’means hands and eyes are used to interpret paper ballots, but machines can be used for addition.

 

CONCERN: Coverage of RLAs. It would not be helpful to audit only a few higher margin federal races with wide margins. When a state gets a federal grant, it needs to audit all Federal contests within 5 years, though in the interim, they may start small.

Requiring State rules within a year of enactment is unnecessarily fast, since even federal implementing rules will take time. It is enough to have  rules within a year of getting a grant.

  • SUGGESTED REVISED HR1 LANGUAGE:
  • 3011(a) creates HAVA 299A(1) a certification that, not later than 5 years after receiving the grant, the State will conduct risk-limiting audits of the results of elections for all Federal offices contests held in the State as described in section 299;
  • (2) a certification that, not later than one year after grant approval the date of the enactment of this section, the chief State election official of the State has established or will establish the rules and procedures for conducting the audits which meet the requirements of section 299(c); (p.443)

Title III—Election Security, Subtitle D—Promoting Cybersecurity Through Improvements in Election Administration

CONCERN: In addition to poll books, other systems used to determine the eligibility of voters or ballot packets should be tested and separately certified.  Signature verification systems deal with personally identifiable information (PII), so certification may have an important role. These systems have very different issues than voting systems and need to be handled separately. It is often appropriate for eligibility systems to be connected to the internet, sometimes with wireless connectivity, unlike certified voting systems, which should not be connected to the internet nor have wireless connectivity.

To reduce barriers to entry and enhance competition, poll books and other extensions to the voting system should not be considered part of the “voting system” and should each be tested and certified separately.  Currently, voting systems are tested as a whole; in other words the EAC tests the ballot marking devices, scanners and election management systems as one integrated package, rather by component. This prevents small companies from entering the market – – they cannot enter with only one component, like a ballot marking device, so the barriers to entry are huge. This reduces competition in the industry and purchase choices for election officials. Election officials seeking a federally certified system currently can only replace a component of a voting system with a component from the same manufacturer that has been certified with that same voting system. (For those over a certain age – – imagine having a stereo system and only being able to replace the turntable with a turntable from the manufacturer that made the receiver and speakers.)  Including poll books as part of the voting system would preclude smaller, innovative companies just selling poll books, precluded from their pollbooks from being certified and, thereby, from entering the market.

Some states have requirements related to EAC certified voting systems, which should not automatically apply to these extensions, and vendors should be able to sell these extensions separately.

  • SUGGESTED REVISED HR1 LANGUAGE:
  • 3302(a)(4) creates HAVA 301(b)(2) any electronic poll book and other systems used to determine the eligibility of  voters or ballot packets, including signature verification systems, used with respect to the election. All such  components should be considered extensions of the voting system. The EAC will test and certify such extensions separately, not as part of a voting system (as originally defined in HAVA).  Such extensions are to be tested and certified separately and can be selected by States separately. The EAC shall separately test and certify components of voting systems (such as ballot marking devices, scanners and election management systems) as well as entire voting systems and shall require that components are interoperable. and (p.468)

Title III—Election Security, Subtitle E—Preventing Election Hacking

CONCERN: Bug Bounties are crucial for election security, since no company can find all its own bugs. Therefore election system manufacturers need to participate. The Defense Department’s bug bounty programs have found thousands of bugs, including “more than a hundred highly critical flaws”, so the bugs could be patched. Bug bounties have been widely used by computer companies for at least a decade, while election system manufacturers have had slow and uneven efforts.

  • SUGGESTED REVISED HR1 LANGUAGE: 3402(b) Voluntary participation by election officials and election service providers and mandatory for election system manufacturers
  • …(3) Participation in the Program shall be mandatory for election system manufacturers (p.472)