Tag Archives: Internet Voting

Risky internet voting

CO SB21-250 merits enhancement

Colorado Senate Bill 21-250  Elections and Voting

Comments by Harvie Branscomb – 5/4/2021

There are numerous sections  of the bill that provide beneficial enhancements to Colorado Revised Statutes not mentioned here. This is a request to amend the bill to address the following 8 topics, the first 7 of which are improvements sought within the bill.

This bill is up for public comment in the Colorado House State Civic, Military and Veterans Affairs Committee Monday May 17, 2021 at 1:30 PM Mountain time. The link to the bill status and text is here: Elections And Voting | Colorado General Assembly

The link to listen to the testimony is here:
https://leg.colorado.gov/committee/audio/2038946

The page to use to sign up to testify or submit testimony is found here (remember the bill number and date and time of the hearing before you click):
https://leg.colorado.gov/testimony
  1. Signatures incomparable to envelope signatures may be uploaded to the signature database over the internet by a person registering to vote
  2. Precinct caucuses and party assemblies may be voted in via risky email or internet apps
  3. Emergency voting with electronic return for out of state and temporarily located voters expands risky electronic return
  4. A questioned signature may not be the sole basis for a challenge – ending challenges of voter authenticity by citizen watchers
  5. Vacancy committees for county commissioner and state legislator may be voted in by risky email or internet app without the sunset just enacted in HB 21-1001.
  6. Drop boxes are being treated like polling places- open until the line dissipates – but without any of the accountability- please review alternatives to add integrity
  7. Recount language still has a loophole such that voter errors are not corrected in a recount
  8. SB-250 is an ideal platform to add SOS-created quality assurance and certification and reporting requirements for the new internet remote electronic voting technologies – see text for amendment here: https://electionquality.com/internet-voting-quality-controls

Details for each point follow:

1) The bill allows for electronic return (internet upload) of original (first time collected) signatures for the Colorado signature database in SCORE as follows:

SECTION 3. In Colorado Revised Statutes, 1-2-202.5, amend
 1-2-202.5. Online voter registration – online changes in elector
 information.

(7.5)(b) SEND TO THE ELECTOR’S ADDRESS OF RECORD, BY NONFORWARDABLE MAIL, NOTICE THAT THE ELECTOR HAS BEEN REGISTERED TO VOTE, A POSTAGE PAID PREADDRESSED RETURN FORM BY WHICH THE ELECTOR MAY RETURN A SIGNATURE, AND INFORMATION ON HOW THE ELECTOR CAN UPLOAD A SIGNATURE ELECTRONICALLY.

and once again in (7)(a)(II) (B) and again in SECTION 9. 1-2-502.5, amend

(4) (c) Provide a signature if, at the time the elector applied for medical assistance, the person did not use a Colorado driver’s license or identification number and did not provide an electronic copy of their signature. THE FORM MUST INCLUDE INFORMATION ON HOW THE ELECTOR CAN UPLOAD A SIGNATURE ELECTRONICALLY.

And again in (7.5) (b)

The authors seem bent on digital electronic transmission of the crucial authentication data – the signature. These four changes signal the end of any hope for preserving the authentic wet signature as a reference for the eligibility check. Colorado’s eligibility determination depends entirely upon voter authentication based on a signature match from an electronic file to a signature made on a paper envelope. If the signatures in the database are faulty, the eligibility decision will be faulty and could either approve a ballot for counting incorrectly or reject a ballot incorrectly. The validity and quality of the original signature provided as a reference is crucial.

We already know that the pad collected signatures from DMV offices are deficient and problematic in comparison to envelope signatures. Uploaded signatures may be enough more convenient that SCORE will be overflowing with multiple signatures from voters, who find it valuable to have several instances of signature recorded in their file. Allowing the upload suggests that the data is presumed safe traveling over the internet, despite the risks including the risk of failed privacy of the signature. All the testimony regarding security of election data traversing the internet suggests that caution would be preferable to convenience. The concern about security applies to these four intended changes to Colorado law. Please amend to remove the references to upload a signature electronically.

2)More addition of internet voting opportunities:

SECTION 11. 1-3-102. Precinct caucuses.

(5) NOTWITHSTANDING ANY PROVISION TO THE CONTRARY, A PARTICIPANT AT A PRECINCT CAUCUS MAY PARTICIPATE REMOTELY, INCLUDING CASTING THE PARTICIPANT’S VOTE BY E-MAIL, MAIL, TELEPHONE, OR THROUGH AN INTERNET-BASED APPLICATION IF ALLOWED BY THE PARTY’S RULES.

And the same for election of delegates to party assemblies SECTION 15. 1-4-602 (7).

These opportunities to attend caucuses and party assemblies and vote by email and internet based app seem extremely premature and unwise given warnings provided to Colorado from experts in election security, including the Senate Intelligence Committee, the National Academies, MIT, ACM, AAAS, Verified Voting and Common Cause.

3) Heading in the same misguided direction, two new allowances are added to statute to substantially widen emergency use of electronic ballot delivery, marking and return (doubling down on the SB-188 permission of electronic return for disability voters). It appears that there is insufficient concern for security when involving the internet in Colorado elections.

SECTION 40. 1-7.5-115. Emergency voting – replacement ballots – electronic transfer – rules. (1) (a) AN ELIGIBLE ELECTOR MAY REQUEST AN EMERGENCY REPLACEMENT BALLOT FROM THE COUNTY CLERK AND RECORDER OR DESIGNATED ELECTION OFFICIAL IF: (I) THE ELECTOR OR A MEMBER OF THE ELECTOR’S IMMEDIATE FAMILY, RELATED TO THE SECOND DEGREE BY BLOOD, ADOPTION, MARRIAGE, OR CIVIL UNION PARTNERSHIP, IS CONFINED IN A HOSPITAL OR PLACE OF RESIDENCE ON ELECTION DAY; (II) THE ELECTOR IS UNABLE TO VOTE IN PERSON DUE TO EMERGENCY CONDITIONS, INCLUDING BUT NOT LIMITED TO A NATURAL DISASTER, THAT AROSE AFTER THE DEADLINES BY WHICH BALLOTS ARE MAILED;  (III) THE ELECTOR’S MAIL BALLOT DID NOT ARRIVE AND THE ELECTOR IS OUT OF THE STATE ON ELECTION DAY; OR (IV) THE ELECTOR HAD ARRANGED TO RECEIVE THE ELECTOR’S MAIL BALLOT IN A TEMPORARY LOCATION AND THE ELECTOR DID NOT RECEIVE IT

The emergency excuse for internet voting really must be controlled at a minimum by requiring a statement signed by the voter that no more secure means of return of the ballot is available to them.

4) It is surprising given the much increased interest in potential flaws in eligibility especially for mail ballots, that this Colorado bill calls for an effective end to signature verification challenges. The language says that signature may not be the sole basis for the challenge, but of course it is trivial for the voter name and address to be absolutely correct when someone other than the voter signs the envelope. Thus the idea that signature alone cannot be used to challenge completely dismembers the check and balance about eligibility for 95% of Colorado’s votes.

This is a big mistake and will focus attention on Colorado’s somewhat less than best practice eligibility system. All but one of Colorado’s large counties use software signature comparison followed by human verification employing all signatures coming from every envelope that has ever been returned in an election. Colorado has no mechanism for cleaning up the signature database where 20 signatures might be recorded for one voter. Election judges are required to examine each signature during a potential rejection – a process that slows down more in each election. Colorado deserves attention paid to its signatures and how they might fail to efficiently authenticate remote voters. I ask for a removal of this Section 45 from SB-250.

SECTION 45 1-9-207. Challenges of ballots cast by mail.

(2) A MAIL BALLOT MAY NOT BE CHALLENGED UNDER THIS SECTION SOLELY ON THE BASIS OF THE SIGNATURE THAT APPEARS ON THE MAIL BALLOT. SIGNATURES ON MAIL BALLOTS MUST BE REVIEWED IN ACCORDANCE WITH SECTION 1-7.5-103

C.R.S. 1-7.5-103 is an incorrect citation. It is the definition section.

5) The bill removes the sunset clause that was just passed and signed in HB21-1001 that permits insecure remote voting for vacancy committees ( very small committees appointed by parties that actually replace powerful elected officials with almost no oversight). This is another example of a Colorado foray into internet voting, not just for 2021 as originally intended, but forever if SB-250 passes as expected.  If vacancy committees are voting by email or app, one faulty or lost vote can easily change the outcome. The fact that it is the party’s election hardly makes it less important. Vacancy committee votes substitute for an election of an entire House or Senate district.

Please amend to remove Sections 66 and 67 as follows:

SECTION 66. 3 1-12-203. Vacancies in general assembly. (Sunset removed by SB-250)

SECTION 67. 1-12-206. Vacancies in the office of county commissioner.

(FYI here is the text of signed HB 21-1001)

1-12-203. Vacancies in general assembly – repeal.
(6) (a) NOTWITHSTANDING ANY PROVISION TO THE CONTRARY, A MEMBER
OF A VACANCY COMMITTEE FILLING A VACANCY PURSUANT TO THIS SECTION
MAY PARTICIPATE IN A VACANCY COMMITTEE MEETING REMOTELY,
INCLUDING CASTING THE MEMBER’S VOTE BY E-MAIL, MAIL, TELEPHONE, OR
THROUGH AN INTERNET-BASED APPLICATION IF ALLOWED BY THE PARTY’S
RULES.
(b) THIS SUBSECTION (6) IS REPEALED, EFFECTIVE DECEMBER 31,
2021. <- sunset eliminated by SB-250

and ditto for the county commissioner vacancy committee meetings:

1-12-206. Vacancies in the office of county commissioner –

6) Drop boxes collect naked ballots that cannot be counted. We need to prevent drop boxes from disenfranchising voters. There is a document about risks and potential remedies for drop boxes here: https://electionquality.com/dropbox.

SECTION 31. 1-7-101. Hours of voting on election day. (1.5) EACH DROP BOX MUST BE OPEN UNTIL 7 P.M. ON ELECTION DAY. EACH DROP BOX MUST REMAIN OPEN AFTER 7 P.M. UNTIL EVERY ELIGIBLE ELECTOR WHO WAS IN LINE AT THE DROP BOX AT OR BEFORE 7 P.M. HAS BEEN ALLOWED TO DEPOSIT ALL BALLOTS THE PERSON BROUGHT IN THE DROP BOX…

7) Recount language actually avoids the extra accuracy that will be needed to compensate for rare instances of machine inaccuracy

SECTION 49 1-10.5-102. Recounts…

(b) If the results of the comparison of the machine count and the
manual count in accordance with the requirements of SUBSECTION (3)(a) OF THIS SECTION are identical, or if any discrepancy is able to be accounted for by voter error, then the recount may be conducted in the same manner as the original ballot count.

The brief test of machine counts of ballots prior to a recount should be very sensitive to any error and refuse to allow the machine to be used to recount if any discrepancy arises- including one accounted for by “voter error”. Colorado is a voter intent state, meaning the voter does not have to comply with instructions intended to make sure the machine will interpret voter marks correctly. It is obvious that the bold text above should be removed from statute and now is the time to do it. Please amend to remove both references to “voter error” in the above section 49. Please amend the bill to remove “or if any discrepancy is not able to be accounted for by voter error,” and “or if any discrepancy is able to be accounted for by voter error,”

8) Internet voting quality controls. This bill and SB-188 are both expanding the scope of remote electronic voting methods without providing for quality assurance of the technology, methods and vendors involved. While the majority of votes in Colorado are voted on verified paper ballots and tabulated via certified equipment that is  tested prior to use and audited afterwards and never connected to the Internet, the votes and processes conveyed by electronic transmission methods are only marginally regulated without transparency and largely unreported even concerning usage.

Colorado must establish an equivalent set of criteria with tests implemented to reassure Colorado voters that all votes are treated with integrity, privacy and accuracy and transparency, and are adequately protected from error and any form of malevolence such as intrusion illegal influence or denial of service. SB-250 is this year’s obvious opportunity to resolve this dark cloud over Colorado’s otherwise sunshine filled election.

SB21-188 for Colorado legislators

Dear Member of the Colorado General Assembly and Governor Polis;

Key points about Senate Bill 21-188 (April 25, 2021):

All voters deserve privacy, security: Voters with disabilities deserve access to a practical voting method that provides accuracy and privacy and integrity as well as reasonable convenience and independence. The conventional return envelopes for all voters offer ballot secrecy after the paper ballot is sealed inside. At a minimum all voters ought to be able to control to whom they will be sharing their private information. SB-188 will not give them the chance to control who sees their voter intent.

No real privacy: Remote electronic voting using current systems including Democracy Live in Colorado can’t provide a guarantee of privacy and therefore require a signed affirmation of awareness of the risk to ballot secrecy. At the receiving end of these electronic transmissions privacy is not perfectly maintained even if the software at the voter’s computer and the network communication software does succeed to maintain privacy in spite of the risks of intervention.

Hard to use, assistance likely needed anyway: Navigation through Colorado’s currently available electronic voting portal is complicated enough to ensure that whomever succeeds must be competent with computers or have expert assistance. The idea that many already disenfranchised disability voters will because of this bill be able to vote without needing privacy invasive help is optimistic.

Hundreds of thousands of users: Substantive need is real but relatively rare and other solutions exist such as curbside voting. Many voters can claim disability and honestly fit the definition shown in the ADA but do not need electronic return because they have printers and sufficient knowledge and mobility to use them. In addition, there are individuals with no disability who will choose to click on the disability button on the portal. Voters who choose the portal and will find themselves using electronic return at the risk of incorrect election outcomes if SB-188 is signed. Opportunistic users could easily number in the hundreds of thousands in a Colorado statewide election.

The ADA defines a person with a disability as a person who has a physical or mental impairment that substantially limits one or more major life activity. This includes people who have a record of such an impairment, even if they do not currently have a disability. It also includes individuals who do not have a disability but are regarded as having a disability.

Open to misuse: SB-188 is the bill that opens up an unpopular electronic return for voters who self-identify as affected by disability (by simply clicking on the appropriate checkbox in the online portal seen above). Many voters with a disability will likely not find electronic return accessible to them. But many who do not have a print disability may find the electronic method more accessible than the vote by mail or drop off that they would otherwise use.

Not to be proud of: Uncertified software that collects votes and delivers them electronically isn’t the voter verifiable non-internet paper ballot that Colorado is proud of. Neither Democracy Live nor Secure Ballot Return software are subject to certification and other typical oversight. The two electronic methods receiving little oversight are not even reported on adequately. SB21-188 could be amended to add reporting and certification requirements or require the SOS to promulgate them by rule.

Experts agree electronic return creates unreasonable risk: The National Academies of Science, Engineering and Medicine have warned about risks of internet voting, https://www.nap.edu/read/25120/chapter/1, as has the US Senate Intelligence Committee.  Common Cause is opposing SB21-188 as is Verified Voting as seen here: https://verifiedvoting.org/statement-colorado-sb21-188-internetvoting/ and the ACM and American Association for the Advancement of Science expresses concerns here: https://electionquality.com/acm-aaas-co-sb21-188/.

Wrong year: Congress seems to be favoring the Colorado model with our all-voter-verifiable (and almost all verified) paper. I would hope that the Colorado legislature will not be attempting to legislate in the opposite direction – towards unverified internet voting. With all the extra consternation about accuracy of eligibility and even tabulation from the 2020 election, now is not the time to expend huge resources on serving a small population that has real needs that can be served better other ways.

Extra work: County clerks will need to prepare for a spectacular increase in ballot duplication onto ballot stock if word gets out about the screen shown above from the portal.

Emergency voting fulfills many needs: If the voter is or will be “confined in a hospital or place of residence on Election Day”, the emergency option with electronic return is available. Also the voter may use the emergency ballot option if a member of the “immediate family related to the second degree” is similarly confined.

SB-188 is not the best idea: Colorado is already much respected nationwide for a verified paper ballot voted at home and cast from the hands of the voter. SB-188 allows instead intangible electronic images of ballots to traverse the internet to become unverified paper for tabulation. Perhaps later these unverified paper ballots printed far from the voters’ eyes and accessible verification devices will be sampled for audit. In that case there is little or no reason for confidence that the voter knows what is on the paper that presumably represents their vote.

It is at best regrettable that Colorado’s SB21-188 is attempting to add low confidence ballots to our elections at the very moment that confidence is at an all time low and respect for the Colorado model is at an all time high.

(additional material can be found on this page: https://electionquality.com/2021/04/amend-or-oppose-co-sb21-188/)

(a proposed amendment text is located here: https://electionquality.com/text-for-amendment-of-co-sb21-188/