Tuesday, March 09, 2004

Sidra Vitale, Election Official

This post is archived here and here.


San Diego County

SI = System Inspector
ASI = Assistant System Inspector
PI = Precinct Inspector
API = Assistant Precinct Inspector

Voting devices are a PC-tablet of approximately 14 inches in height by 8 inches in width, placed in a larger plastic holder atop a tripod-like affair. Voters use a touchscreen to cast their ballot. The plastic holder for the tablet has small closing doors that are sealed with a plastic tie until the poll is ready to open. A printer (much like a cash register printer) is behind a locked panel adjacent to the tablet. It is used to print two reports: one at opening, one at closing. A PCMCIA card and the device's power button is behind a second, smaller, locked panel on the side of the device. Every precinct had between 4 and 8 of these devices.

The Precinct Control Module is a small monitor with a card key burner at its base. Navigation is performed using a stylus (very similar to the use of a palm pilot, PDA, or other handheld computer). Using the PCM application, the type of ballot (by political party) is specified, and a key for that ballot is issued. That key is then used to activate -- display and permit vote casting -- the desired ballot on any of the six voting devices in use in the polling place. Every precinct had one Precinct Control Module.

(Note: We were assigned a high school student intern as a Clerk, but she never arrived.)

1. Set up (pre-7 am):

Precinct Control Module application not auto-starting upon boot. Proceeded (upon troubleshooter's instruction) to open application on installed PCMCIA card by Windows standard method ("click on 'My Computer', click on "Storage Cards", select application by name). I was told by this roaming troubleshooter (who visited our precinct and others periodically over the course of the day) that 'everyone was running into this'. (Click here to see a Windows CE desktop screen, and not the PCM software that should have auto-started.)

There were two applications to choose from on the PC card: PCM (an executable) and PCM500LA (another executable). I was instructed to start PCM500LA and did so.

At the time of startup, a popup error box appeared, stating, "Transaction log discrepancy between card and machine memory" and asking if it was "OK to override". Instructed to OK the override.

Proceeded to log in precinct and opened poll at 7am.

2. 8:33 am

Noted that the PCM application is displaying the wrong date, 6/1/2002, and the wrong time, 1:50 pm. Asked troubleshooter about it later in the day and was told it's "OK", and to ignore it. (Click here to see a picture of the Issue Ballot Key screen. Look in the lower right hand corner for the timestamp.)

3. 8:30 - 9:00 am

System Inspector reported that an incomplete "Zero Report" had been printed, but SI and PI had signed off on it and continued with normal poll opening at 7 am.

4. 9:00 am

22 ballots cast (20 standard, 2 provisional).

PCM application frozen.

Called various troubleshooter hotlines and contact phone numbers until speaking with Eugene Dominguez. Instructed to reset machine and re-start the application. Reset, re-started, and re-opened the poll. The PCM showed 22 ballots cast, (20 std, 2 prov).

5. 12:15pm -12:30pm

Unit #4 knocked over. Tablet (actual voting device) ejected from cradle and unresponsive. Closed unit doors and removed tablet from use.

Five voting machines now in use at this precinct.

6. 2pm (approx)

PCM application frozen.

Did not call in for instructions. Reset machine, re-started application, logged in using same user name (my last name), password, precinct ID, and (re-)opened poll.

80 votes cast: 77 standard, 3 provisional.

7. (unknown time, afternoon)

Ballot 100 +/-2, voter reported pre-marked "Yes" votes on his electronic ballot in Unit #3, that "took several tries to change to 'No'".

Removed #3 from service and discussed with SI. Decided to ask a voter to volunteer to use that unit and report any problems (precinct board members having already voted, none of us could be guinea pigs).

Voter (acquaintance of SI) voted and reported no difficulties.

8. 5:49 pm

Unit #2 Voter reported that the 'Ballot Summary' page displayed no data. (User #32 +/-1 on that unit.)

Screen was white (instead of populated with ballot section names and voter's selections).

Cancelled ballot. Removed unused ballot key card.

Inserted cancelled key card into Unit #1. Card read successfully (not flagged as used or in any other way unusable).

Voter proceeded to view and cast ballot in new unit. Voter reported Ballot Summary page successfully displayed and they completed casting their ballot. (Ballot #42 on that unit.)

9. (later)

Told in later afternoon that if there were any problems with printing out the "Summary Reports" upon poll closing (a vote summary of ballots cast on each machine - thus, 12 reports in all, one zero and one summary total for each unit at the precinct), to continue with poll closing procedures and get cards and equipment to the collection center on time.

10. Smoke and Rumors:

Heard from the troubleshooter that a flash card (PC card) was missing from one precinct's PCM when they were trying to open the poll. They had to keep the poll closed until a replacement could be brought to them.

11. Additional Notes:

  1. All the keys to the printer and PC card slots were the same for all the precincts.
  2. The password to run the election-closing reports on the voting tablets was the same for each precinct.
  3. The password to log into the precinct control module (PCM) was the same for each precinct.
  4. I could see, any time I wanted to, everything a voter was selecting at one of the units, simply due to the placement of my chair at the check-in table.
  5. The above means a voter standing at the right place in line at the check-in table across from me, could have done the same, if so inclined, for the unit opposite the one visible to me.
  6. Every time I got up to help a voter, I had to look at the partially voted, or completely voted, ballot.


Item #1, though it seems trivial, was actually one of the most worrying of the day from a control standpoint as well as raising concerns regarding the transaction log.

Why were there two applications on that PC card in the first place?

The fact that I and many other SI/ASIs had to start it 'by hand' meant every single one of us had the opportunity to select the wrong one. This would have resulted in our precincts using the wrong software for the election.

Since my precinct rebooted twice, that was 3 opportunities over the course of the day for an error of this nature to occur.

The transaction log discrepancy means that the copy of data on the machine's local memory, and the data on the machine's PC card, did not match. We were using the machine for the first time that morning, after receiving it sealed in a case 2 weeks prior. The overwrite I OK'd made them identical again. It did not, however, guarantee they were both initialized properly, if any initialization was required.

Item #2 (wrong date)

Why was it wrong? Are there dates hardcoded in the application? If so, for what? Why do the CE devices (both voting units 'tablets' and the precinct control module were running Windows CE) think it's two years ago?

Item #3 and Item #9 together tell us these reports are window dressing and useless. There is no real connection between them and any count or recount procedure(s), they're only present to make us (SD County, voters) feel better. Otherwise, they'd be vital, and we wouldn't be getting this instruction.

Item #1, #4, #6 (multiple applications, system reboots)

I've already touched on the opportunities for the wrong software to be activated for a given precinct. In addition, the two reboots are very telling. Less than 100 ballots were generated on this machine in order to cause an error. Less than 25 the first time.

Where is QA? What quality assurance were these systems put through? How many ballots were issued using this version of the PCM software on each of these PCM machines during testing?
What error caused the system to hang, twice? Unlike a hanging chad, I can't *see* the source of the problem and diagnose it in the field. Neither can anyone else, voters and county officials alike.

Item #11

This one's obvious.

Item #7, while distressing to hear the report, was unverifiable (voter had completed his ballot and cast it) and unreproducible (subsequent voters reported no problems, and we made a point of asking). The report of "pre-marking" may have been:

  • the voter accidentally selecting 'previous' instead of 'next' during the balloting process, and reviewing a page he'd already visited and marked;
  • a software bug;
  • genuine tampering;

There's really no way to tell.

And that's what brings us to the key point.

San Diego County, the Registrar of Voters, and the California Secretary of State have ceded control of the ballot counting process, and the voting process, to a for-profit company in Ohio.

This means my election officials can no longer recount votes with confidence. They cannot sit looking at a giant stack of electronic "punch cards" and count them, one at a time, because there is no equivalent for the punch card.

They do not control the software itself. They cannot examine it. They cannot provide voters with a transparent process that is open to the public.

Voters are legally permitted to stay in the polling place and observe the poll closing procedure. Last year, that would have meant watching officials such as myself count up all the signatures on the Roster of Voters, and count up all the punch cards, provisional ballots, and absentee ballots, and perform a reconciliation.

This year, they would have watched the SI print out a report and initial that it printed complete, after poll closing. They would have watched me look at a screen on the PCM and say "the computer says, 219 standard ballot keys were issued, and 11 provisional ballot keys".

If, and in our case, when, this did not match the results of the Roster signature count, I could not count through the ballot keys again, because there was nothing for me to count the first time. No log, no physical match of any kind between the number of ballots "handed" to voters (because they weren't), and the number of voters actually signed in, and the number of ballots actually cast.

As I did not go to the collection center or to the registrar's office, my report ends here where it began: at the precinct polling place.

No comments: