I wrote yesterday about discrepancies in the results reported by Sequoia AVC Advantage voting machines in New Jersey.
Sequoia issued a memo giving their explanation for what might have happened. Here’s the relevant part:
During a primary election, the “option switches” on the operator panel must be used to activate the voting machine. The operator panel has a total of 12 buttons numbered 1 through 12. Each party participating in the primary election is assigned one of the option switch buttons. The poll worker presses a party option switch button based on the voter authorization slip given to the voter after signing the poll book, and then the poll worker presses the green “Activate” button. This action causes that party’s contests to be activated on the ballot face inside the voting booth.
Let’s assume the Democrat party is assigned option switch 6 while the Republican Party is assigned options switch 12. If a Democrat voter arrives, the poll worker presses the “6” button followed by the green “Activate” button. The Democrat contests are activated and the voter votes the ballot. For a Republican voter, the poll worker presses the “12” button followed by the green “Activate” button, which then activates the Republican contests and the voter votes the ballot. This is the correct and proper method of machine activation when using option switches.
However, we have found that when a poll worker selects the lower of the two assigned selection codes, followed by pressing an unused selection code and then pressing the green “Activate” button, the higher numbered party on the operator panel has its contests activated instead while the selection code button for the original party stays active on the operator panel.
Using the above example with the Democrat Party as option switch 6 and the Republican Party as option switch 12, the poll worker presses button 6 for Democrat. The red light next to button number 6 lights up and the operator panel display will show DEM. The poll worker then presses any unused option switch. The red light stays lit next to option switch 6 and the display still says DEM. Now the poll worker presses the green “Activate” button. The red light stays lit next to button number 6, but the operator panel display now says REP and the ballot in the voting booth will activate the Republican party contests.
In each and every case where a machine displays the party turnout issue at the close of the polls, this is the situation that would have caused it, and it can be duplicated on any machine. In addition, for this situation to have occurred, the voter that was in the voting booth at the time of the poll workers action would have voted the opposite party ballot instead of telling the poll worker that the incorrect ballot was activated and the machine would not allow them to vote the party they intended. If they had informed the poll worker, they could have made the party selection change and the voter would have then voted the correct ballot style.
Several points are in order.
First, it’s obvious from this description, and from the fact that this happened on so many machines across the state, that even if Sequoia’s explanation is entirely correct, there was some kind of engineering error on Sequoia’s part that caused the machines to misbehave. Sequoia has tried to paint the anomalies as poll worker error, but that’s not plausible in light of Sequoia’s own explanation.
Consider the scenario described above: there is a moment when the red light next to the DEM button is lit, the operator panel displays DEM, then the poll worker presses the Activate button – and the Republican ballot is activated. No competent engineer would design a system to work that way.
No competent engineer would design this system to ever display REP in the operator panel while simultaneously lighting only the DEM light.
No competent engineer would design this system to ever activate the Republican ballot when the poll worker had pressed the DEM button but had not pressed the REP button.
Sequoia’s own explanation makes clear that they made an engineering error that caused the voting machine to behave incorrectly.
Second, this doesn’t look like fraud, only error. A malicious attacker who had access to a machine would have had much more powerful, and much less detectable, options at his disposal.
Third, Sequoia seems to avoid saying that what they describe is the only possible cause of such errors. Note the careful wording, “In each and every case where a machine displays [an error], this is the situation that would have caused it …” (emphasis added). They don’t say this “did” cause the errors; they say it “would have”. The sentence is either clumsy or artfully worded.
Fourth, Sequoia’s explanation involves a voter seeing the wrong party’s ballot being activated, and not complaining about it. Assuming (as press accounts say) that the problem happened about sixty times in New Jersey, one would expect that many voters noticed and complained. And one would expect that in at least one of those cases, a poll worker would have noticed that the operator panel was displaying REP and DEM at the same time. Yet there don’t seem to be reports of such behavior.
Fifth, Sequoia doesn’t characterize fully the cases where this problem might occur, so election officials don’t know, for example, which past elections might have been affected.
The bottom line is clear. An investigation is needed – an independent investigation, done by someone not chosen by Sequoia, not paid by Sequoia, and not reporting to Sequoia.
I don’t think that we need to re-hash and pick apart each sentence of Sequoia’s memo. I think we can all agree that we have issues with the results from their machines. If the machines are not 100% accurate and Sequoia will not allow independent verification and testing of their machines than the county’s have a right and duty to their citizens not to use them until these issues are completely corrected.
If a I buy a computer that can’t add up a column of numbers correctly each and every time then I won’t have any confidence that any of the numbers it gives more are correct.
bbuc hits the nail on the head.
This is the sort of thing that Hari Seldon must have noticed, shortly before he started setting up the Foundations.
Like a rotted-out oak tree, the US establishment still looks solid and strong from the outside, but the next even fairly minor storm may suffice to topple it.
Great job Ed. One more well done and studious article pointing out what apparently must not be said in the mainstream. After 6 years and this is as far as the news gets. Only in forum and websites like this and VoteTrustUSA do we see these stories. There are dozens of these articles stretching back to 2002… professional, mannerly, but never quite saying anything too assertive… making conclusions just obvious enough for nonpartisan peerage and a disengaged faculty to get it, but what’s next? Outrage? Investigations? Indictments? Not on your life. What’s next always seems to be nothing.
-As far as the public knows there are no confessions from distraught programmers or manufacturers’ employees who see what they’ve done to the country with their mischief and mis-design.
-No fraud to address in all those precincts in Ohio in 2004.
-No one has stepped forward with evidence of any election misbehavior.
-And after all this work by so many, amazingly no conclusive evidence to prosecute malfeasance by government chartered vote machine manufacturers who have reaped billions in revenue from federal and state funds with machines which repeatedly fail in election after election.
-No wholesale vote fraud.
-And no prosecutors or crusading newspapers or broadcasters willing to act.
So we are to believe there is nothing that most of the mainstream news media or hundreds of purportedly independent federal and state law enforcement authorities around the country feel deserves a closer official look.
And when the rare few who notice what’s happening write or say something, it’s as if their story disappears into a black hole and they’re regarded as kooks… as if they claimed to see a UFO or think they’ve found some far fetched conspiracy. And then they’re ignored, like Lou Dobbs and Dan Rather.
After years of responsible work, the best the vote integrity movement can get is a steamed xenophobic Lou Dobbs, hooked into the scandal because Venezuelans owned the machines. In two dozen separate reports by his excellent staff at CNN they blew the story wide open, but nothing happened after that. No one else picked up the story. And a year later Dan Rather, now at HDNet, exposed the truth about questionable punch cards in 2000 directed to Palm Beach County, and he exposed ES&S shoddy manufacturing. Nothing happened again. Even comedians make jokes about the machines and get knowing chuckles from audience members… it’s that obvious, but nothing happens. It’s as if all governmental and reporters’ eyes are averted from the hot steaming load in front of them. They can’t bring themselves to dig into it, or they just don’t dare.
And so it looks like years of serial felonious audacity on a national scale may continue.
And amazingly, the sort of thing that can put a prosecutor or reporter in the history books continues to be officially ignored. And year after year, still no authority has the nerve or feels safe enough to investigate or pull the prosecutorial trigger.
And so we make an even bigger discovery than the fact that our voting systems have been massively manipulated. We’ve discovered that huge segments within whole American institutions such as Justice and the news media know it, and are apparently willing to let it pass. And that’s the worst news of all.
My God how far we’ve fallen.
I don’t find this defect description credible. The function of a voting machine does not exceed the complexity of the census tasks accomplished with Hollerith’s Type I Tabulator from 1906. One would think 100 years of engineering practice later, it would no longer be considered miraculous if such a simple mechanism worked as intended.
If designers of electronic voting machines would focus on keeping them simple, they could provide some improvements over paper ballots in terms of reliability, accessibility, and fraud-resistance. Paper ballots are subject perpetually to physical attack. By contrast, an electronic voting machine could provide members of both parties with complete digital records immediately after close of polls. If each party digitally signs its copy of the record and gives the signature to the other, both parties could confirm that they had the same data. If suitable measures were in place to protect the equipment and media during the election, the post-election opportunities for physical attack would be largely negated.
Hello, I was wondering what the error rate was for the machines that they replaced. Some of this isn’t clear like someone else stated. If a democrat switch is on and another democrat goes in after does it count? if so, how would it know? Tally or what.
The error could be even more simple. Using the example of 6 for democrat and 12 for republican, the election judges presses the 6 button, and their finger slips sideways and presses the 7 key also. Based on the explanation given, democrat party ballot will display in the booth and the option counter will default to 12 and count a republican voter while displaying a democrat ballot.
That doesn’t explain why the two printouts shown yesterday don’t even add up – 415 and 422. Shouldn’t those be the same, if you follow the explanation given?
Open Source voting is badly needed in the US. Take a look at this Linux based open voting system!
http://www.openvotingconsortium.org/
There have been several comments about “holding multiple elections at the same time” but this is the essence of a primary election. Almost always all the parties who have candidates will hold their elections at the same time to save expense (and wear and tear on election judges like my wife and me.) But different states have different rules about who can vote. Some have “open primaries” in which any registered voter can vote for either party. Others, like Maryland, have “closed primaries.” If you register as a Republican then your “smart card” will be coded for the Republican party and only a Republican ballot will appear. If you are a Democrat, you can only receive a smart card coded for the Democratic party. If you registered “Independent” or “Unaffiliated” you cannot vote in the primary at all! The poll workers do not handle the machine itself, only the little coder which sets up the smart cards. To further reduce the chance of the type of error found on the Sequoia machines, Maryland now has the entire state registered voter list on “E-Poll” machines at each precinct rather than the old paper list of just that precinct’s voters. Once the voter has confirmed their identity and party affiliation, the smart card is inserted in the E-poll and activated for a single use. What can happen and did in the Feb. 12, 2008 primary, is that for some reason the party the voter wants to select does not agree with the party for which their record shows them registered. In this case the voter is given a paper provisional ballot and can argue their case with the board of elections in their county.
The reason for this tangled web they weave is that they are practicing to deceive. And why should we take the Pennsylvania primaries seriously if their machines will be used to count the votes?
The [6]+[9] = [69] inside the machine was just that guy’s guess. Since we don’t know much about the internals of the machine we don’t really know. Could be that [6] then [9] leaves a [9] in the appropriate variable and different functions are rounding differently (why they are rounding at all instead of going “Invalid choice choose again” is beyond me.) Still horrible engineering. I would hope at least in testing that there would be an assert the option is valid.
Watching this from Europe, I don’t quite understand why this process is that complicated. Why assign “6” and “12” to parties, instead of “1” and “2”?
And why are there 12 buttons, if the machine can handle multiple buttons anyways? From previous comments it seems, that [6]+[9] will count as 69. Why have a seperate [12] button instead of [1]+[2]?
I wonder what the error rate was for the systems they replaced…
Their letter is definitely a description / documentation of a bug; however I have a simple question related to the original problem:
Do the switch count totals tally only the changes?
For example, if the switch is in the Democratic position, and the next voter is Democratic, is the switch pressed at all? If not, then the number will not reflect the number of voters and can’t be compared to the vote total.
The best thing that could come from this that legislators wake up to the fact that software makers try to deny any (financial) responsibility for bugs their software may have. Do the primary over and have Sequoia pay for it, then we might (in the future) get software that costs more to buy but costs less in time spent making up for bugs etc. These could be bright times for IT security professionals.
I don’t find this defect description credible. The function of a voting machine does not exceed the complexity of the census tasks accomplished with Hollerith’s Type I Tabulator from 1906. One would think 100 years of engineering practice later, it would no longer be considered miraculous if such a simple mechanism worked as intended.
Consider if the software had been written by a certified accountant. Either the accountant would now be facing loss of license to practice, or Sequoia would now be facing a defamation suit. There are plenty of accountants who took a few courses in programming who could have programmed this function without introducing such an outrageous failure mode.
In fact, I doubt *any* accountant who has enjoyed a long career in corporate auditing would be witless enough to have designed this system as Sequoia claims one of their “qualified” software engineers has done. Does anyone really believe there is an engineer who ever worked for Sequoia going “dang, how did that one slip past me? Maybe I was still suffering from that concussion from that ball-hockey game the previous week.”
I’m not hugely in favour of introducing the professional standards of accounting and law into the software engineering discipline, but considering this stupidity, it would go a long way in eliminating the “just another strange bug” defense where competence was integral to the original enterprise.
Maybe some CS professor could assign a two week voting machine design (the UI/logging part that Sequoia has so badly screwed up) to a class of seniors and survey how many of the assignments are less defective than Sequoia’s submission to the halls of democracy. Supposing the students don’t reject the assignment as beneath consideration for lack of any real challenge.
Indeed, it would surprise me if this task were assigned to introductory programming class for accountants to not have one student submit code superior to Sequoia’s professional effort as they choose to depict it.
Ask yourself this: having read Sequoia’s description, would you buy a traffic crossing light from this company? This bug is equivalent to showing “walk” for EW pedestrians while showing “green” for NS traffic, in the situation where a car triggers the magnetic sensor for advance left in between NS and EW crossing request from the adjacent street corner.
Reminds me of a quip about the competence of the secretive: “The only secret at Area 51 is the tremendous squandering of public funds.”
It’s not about “computer geeks”. Historically these voting machines didn’t resemble computers. They only have a computer inside them now because everything has a computer inside, it’s the 21st century.
Americans have always loved machines. Not even particularly “gadgets” but machines of any kind. Importantly, they love machines even when they don’t work. Most countries have a few scammers with machines that claim to fix all manner of diseases ailments and problems. But in America there are many times more of them than everywhere else in the world combined. As soon as electricity became available in homes around the country, American scammers were selling machines that would store this “vital energy” in your body, by electrocuting you! And these machines sold very well, despite the injuries and deaths – until they were banned. In America they still use the (utterly worthless) “lie detector” machine in police departments and even the secret intelligence agencies. While the rest of the civilised world was doing away with capital punishment, Americans invented any number of machines which kill criminals in horrible, and often unreliable ways. Any problem Americans have, they trust a machine will fix it.
So when Americans find that counting votes is a tedious necessity of their republic’s democracy, they instantly seized upon the idea of building a machine instead.
“Democrat Party”
That tells us right off the bat, one of two things:
1. That 100% of the authors information comes from Rush Limbaugh and the like, and he really is stupid enough to not recognize that he’s using an epithet for the party or…
2. He’s actually dumb enough to pronounce his political leanings in a public memo.
Either way, since 95% (there was 1 exception in ’06) of the issues with these machines seems to be in benefit of Republicans, I’m pretty much convinced by this memo about Sequoia.
Tony Lauck,
There are three forces at work. First, gearheads think that because computers make some things fast and easy, they make all things fast and ease. A sizable percentage of computer geeks want everything computerized because they think computers are cool. They advocate computer voting.
Second, the news media loses money on election night. They want the vote counted fast so they can get off the money losing election coverage and back to commercials. They advocate computer voting.
Third, corporations, consultants and lobbyists don’t profit when people count paper ballots. They only profit when a government spends million on computers. They advocate computer voting.
The good news is that with computer voting comes a lack of confidence in the system. The people know the machines are rigged and so they will stop participating in elections. This will lead to a collapse and revolution.
Ok…perhaps that is a 3 next to Edwards in Cranford? Which would make things consistent again: 168 individual votes for Democrats + 57 individual votes for Republications = 225 total, which matches the 170+55 votes on the option switch total.
But one further observation: it looks like all of the tapes are off by exactly 1, except the Cranford one. This also seems odd to me.
dmc – The extra three votes may not have been cast in the race. You don’t need to vote for every contest on the ballot before you submit. For example you were voting against a tax increase yet were undecided about who you wanted for the presidential nominee.
At my polling place we had a third ballot (paper) for issues only; does the electronic machine not allow for this option?
Correct me if I’m not understanding something here, but it looks to me like this explanation implies that mis-cast votes should not affect the voting totals. A voter who intends to vote for party A gets their vote assigned to party B. Party B’s total goes up (and I’m curious which candidate gets the vote, but that’s a different investigation), and Party A’s total goes down correspondingly.
HOWEVER
Looking at some of the other ballots Ed’s provided (http://citp.princeton.edu/njvotingdocuments/), it seems like even this isn’t the case.
I see, for example, that in Cranford, a total of 165 Democrat votes are are recorded for individual candidates and 57 Republican votes are recorded for individual candidates, making a total of 222 votes altogether. But for the Option Switch Totals, we have 170 Democrat and 55 Republican, which adds up to 225 votes cast.
Where’d those extra 3 votes come from (or go, depending on how you look at it)?
I don’t see how the ballot switch explanation covers this.
Charlie Strauss, your analysis posits a believable scenario as to why a ballot might have been changed, but there are two issues with it:
First, to get the observed behaviour, the voter must be a Republican, and the poll worker activates the Democrat ballot by mistake, but in the end, the voter does vote Republican, so the Democrats get one more tally in the summary (since the Democratic switsch was used) and the republicans get one more vote.
However, for this to occur, the operator needs to press “Activate” after pressing Option key 6, or the voter shouldn’t see any ballot at all, or can he see the ballot before it is activated? If that is the case, the sequence is as follows:
1) Vern the Republican voter steps up to the polling booth.
2) Otto the operator press option key 6.
3) Vern shouts out, “Otto, I’ve got the wrong ballot! I’m no Democrat yet!”
4) Otto presses another option key, e.g. 9.
5) The polling machine software reads “69”.
6) The “best fit” algorthm determines that the active poll that best fits 69 is 12 (since the difference is smallest) and displays the Republican ballot.
7) Vern shouts, “Thanks, Otto!”.
8) Otto presses “Activate”.
9) Vern votes for Giuliani (or some other Republican candidate).
The option key logger logs that key 6 has been pressed, but does not log that key 9 has been pressed since it is unused in this election (as is option 69). This raises the question how logging and assigning ballots work when 6 and 12 are pressed in sequence.
If Sequoia asserts that other option switches have been used, then the numbers in the “Option Switch Totals” on the tape are wrong, since they give a count of 0 for options switches that actually have been used.
Falilure to properly log events in a system designed to faithfully log votes throws a very bad light on the engineering processes used in the design of this system. From sequoia’s explanation it becomes very clear that some of the assumptions that have influenced the design of this machine have never been made sufficiently clear, and they haven’t been reflected on very well.
Nick,
Let me clarify the procedure. A poll worker stands next to the voting booth, but outside it. This poll worker has an external “operator panel” connected by a short cable to the voting machine.
The voter approaches the poll worker and presents a voting authority slip (a small piece of paper saying, in words and by color coding, which party the voter belongs to). The poll worker presses buttons on the operator panel to activate the voting machine for the voter’s party. The voter then enters the voting booth and casts a secret ballot.
Some background on U.S. presidential elections:
This is a primary election, which means that each political party is holding a separate election to choose its own candidate for president. (But the different parties’ logically separate elections are held simultaneously, for convenience.)
In a primary election, the voter declares his political party, and then casts a secret ballot for one of that party’s candidates. The votes of all Republican voters across the country are combined, by a complex process that I won’t even try to explain, to choose the Republican candidate for president; and likewise for the Democrats; and likewise for other parties. In New Jersey only the Republicans and Democrats held primaries.
In November we’ll have a general election for president, in which each party puts forth one candidate, and voters can cast a secret ballot for any candidate.
Secret ballot, yes. But, the polling stations are usually small and local, and staffed by volunteers (mostly retirees) who tend to be your neighbors. They won’t know HOW you voted, but they will frequently recognize your name or face.
Not an American voter, confused by the poll worker knowing who the punter is voting for. Do you not have a secret ballot?
It’s all well and good to analyze the failure, but the basic, inescapable point is still that THESE MACHINES ARE NOT TRUSTWORTHY. If the summary receipt for a given machine doesn’t even add up within itself, it is IRRELEVANT what the proximate cause is; the system doesn’t meet the requirements for a trustworthy voting system.
This is especially serious in the absence of paper ballots (hopefully verified by each voter at voting time), as there is NO WAY to know what votes were actually cast.
Look to the state’s response to this debacle to see whether you can trust ANY election in that state, ever again.
I am not a US voter and I echo the sentiment of ‘Tony Lauck’.
This is a classic example of replacing something simple with a complex solution. No wonder it has bugs and confusing users.
To me, why isn’t there a clear (start again) button provided that you have not confirmed your vote. Why isn’t there a select which party button to display the party candidate? Any airport e-ticket kiosk has a better UI than this.
I can’t imaging the price of one of these machines but surely as many said, it should have a lot more intuitive user interface.
Also I am puzzled why these machines, so critical to a country’s democratic election, has not been thoroughly independently tested before they are used in the field for real? Is there any certification for them?
With regards to Mr. Roe above:
“…It’s the kind of bug that doesn’t get found when programmers do their own testing (e.g. they’re careful, and know they mustn’t push any of the unused buttons) and only gets found when you do beta testing with real users (who do things like accidentally push the wrong button)”
If this were the way that these machines were tested, that’s a huge mistake–to assume that the end user will not make an error is a huge misstep, as no human is perfect, and certainly no group of humans will be either. In testing, they should have (at the very least), tried different failure scenarios to determine what affect such errors would have in the outcome, especially with regards to an election. Leaving the use of the machines as a beta test to flush out any errors is downright irresponsible.
Let’s say that there was awareness of this issue, though, and there just simply had not been time to flush it out of the system, and it was known that the situation that we have here could happen (or would happen in the instance described); with Sequoia’s statement above, a fairly simple failsafe to decrease the overall margin of error could be implemented–set 50% of the machines one way (#6 for Republican ballot, #12 for Democratic ballot), and the other 50% the opposite way–such a setup would ideally cause this same error to occur in both directions, and the overall totals would be closer to even all told (for example, 3 extra entries showing for one side, and say, 4 for the other, a difference of only one as opposed to 7 if these errors would have occurred regardless). This, of course, leaves the assumption that this had not been done, lacking an example that it had; if this had been done and these tallies are showing up in only one direction, then there is a more serious problem at hand that would need examining, either for the election officials, Sequoia, or both.
Yes, thirding the observation of Sequoia’s jarring use of the term “Democrat Party. It really is a lightly-coded epithet, and I’d be very surprised if the author of Sequoia’s memo didn’t mean it mean-spiritedly.
How many idiots does it take to obfuscate the obvious?
Researchers can gather reliable data about choices by
lab rats, selecting peanuts or walnuts. It is not rocket science.
‘One voter – one vote’ does not need Rube Goldberg to lash up a cluster of crappy switches.
The voter is handed a coffee bean. The voter enters a booth displaying an elephant or a donket, and drops the bean in a plastic container under the picture and name of his choice.
Later, before witnesses, the containers are weighed, and the total divided by the weight of an individual bean, using a trusted pocket calculator. Then, the containers are emptied into funnels, channeling the beans into a single-file sequence, sliding past dual redundant optical sensors, which record each passing bean, thereby soothing both the gadget freaks and the bean counters.
One voter cannot deposit a bean more than once, and if he prefers, he can stick the bean in his, um, ear, so it won’t be counted at all.
The total beans counted cannot exceed the total issued.
Afterward, the coffee beans can be ground, and brewed, to
fuel a long unecessary debate. Cream and sugar, optional.
Verbiage aside, it’s a bug — the intended meaning of the “options switch totals” number
is different from the actual meaning. Sequoia’s response amounts to a recipe for replicating
the bug. So far so good.
An important question is whether Sequoia believes its work is done; if they consider
simply listing one (of possibly many) set of steps that will cause the error to fulfill their
engineering obligations.
If they believe this, they lose all credibility. If they do not believe this and are dealing with
it in a responsible manner, they will have already filed a problem report in their internal
tracking system, they will have had both an engineering and management review of the
problem, and will have set a target date or release for deployment of the fix.
With an open source system, the bug tracking number and probably even the results of the
reviews would be a matter of public record. Anyone seriously considering a Sequoia solution
should determine how difficult it is to get similar information from Sequoia.
It’s interesting that a voting machine company would use the term “Democrat party” in a public memo. The term has been an epethet used by the party’s opponents since 1890.
http://en.wikipedia.org/wiki/Democrat_Party_(phrase)
I think the more troubling question is why is the the system so complicated? I didn’t really follow that description. Are elderly pool volunteers supposed to follow these complicated instructions?
This is not even close. I’m trying to imagine a programmer who would be stupid enough to write code that would produce the results Sequoia is claiming, and then trying to imagine a QA department that wouldn’t catch something that blatant before shipping.
I’m going to make a prediction: if litigants, investigators or reporters ever get to the bottom of this, they’ll find that Sequioa’s QA policy classifies as “not a bug” any anomalous behavior that results from the pressing of an unexpected button or that could be discovered and rolled back by a sufficiently alert voter or poll worker.
(In the early early days of aircraft design there was a tendency to attribute lots of crashes to “pilot error”. Designers discovered that if they wanted to actually have fewer crashes rather than just be able to blame pilots for the ones that occurred, they had to improve control placement, make different kinds of controls easily distinguishable and so forth.)
I’ve now spent a couple of hours working through variations on this and largely concur with analysis upthread. So I won’t belabor all that again.
Instead,l I’ll echo Reinout Heeck (in part) by pointing out that it’s not our job or Princeton’s job or the state of New Jersey’s job to identify, diagnose, and repair these problems. This is work that has already been paid for and should have been done by the vendor prior to deployment.
Also, and this might be a reflection of my own ignorance vis-a-vis election day procedure: shouldn’t the people who signed off on these pieces of paper have taken a few seconds to use a pocket calculator and sanity-check them before they signed? (If they did that and noticed an error, what are they supposed to do?)
The explanation sounds plausible. It’s the kind of bug that doesn’t get found when programmers do their own testing (e.g. they’re careful, and know they mustn’t push any of the unused buttons) and only gets found when you do beta testing with real users (who do things like accidentally push the wrong button)
It is a failure of usabilty: a likely input error (pushing one of the unused buttons) puts the machine into an inconsistent state, and it’s not obvious to either the voter or the poll worker that the machine is in an inconsistent state. (Also – possibly – it’s a failiure to properly test the system before deploying it).
As a side note I want to point out that Sequoia did something right here:
they showed tallies of two different input signals instead of just calculating one tally from the other. Without this design decision the error wouldn’t have been visible.
Well, you know, even if the engineers *were* insane, the fact that the machine generates an output including totals that don’t add up means that it’s *still a bug*.
@Highly Concerned:
“Since we’re talking about […] votes in an election that has already happened, it makes a very real difference if this is a simple error that was overlooked, a simple error that was known but allowed to go through anyway, or an intentional function of the machines. ”
That is only tangentially interesting, the real issue is that the election officers have egg on their face, an election got screwed up big time (even if the final tally turns out to be correct). They are the ones that should be beat over the head with a clue-by-four.
“[…] so that we can determine if Sequoia is incompetent, willfully negligent, or outright malicious.”
Here I think you are going off the rails again, Sequoia lures you into a side skirmish that is entirely irrelevant. Even if you manage to beat Sequoia here you will still not have fixed your election officers.
You are pulling the wrong tooth.
A few points:
1. I think you have to take their letter as written. There is a lot at stake here for them, so it is unwise to assume they are careless in what they write.
2. When you vote, you look for the name of the candidate you want to vote for. If that name did not appear, you would alert someone and insist it be fixed before voting. Forget any explanation that is based on an honest person accidentally casting a vote in the other party’s election.
3. This is a unique situation in that there are two elections going on simulateously and being processed by the same machines. If a voter was presented with the other party’s ballot, they would have an opportunity to impact the opposition’s voting result (by casting a vote in their election).
If I read things correctly, this is another possible outcome of this design flaw (if the buttons were pressed in a certain sequence). I’m not suggesting that it happened, just that there seems to be a possibility of it happening and that should be a serious concern in this situation. The machines should be dedicated to one party and not be changeable by any operator. Legislation should required that machines only be able to process one election, after all, how many situations arise where you are holding multiple elections at the same time?
4. I can’t believe a state’s lawyers would accept a contract that prohibited third party validation of the machine’s functionality. The lawyer who missed that should be fired and the federal government should pass legislation overriding any such clauses.
5. Further to point 3 … We use paper ballots here that are optically tallied based on the position of the voter’s X. There are verifiers who collect a random sampling of unused ballots from multiple clerks in multiple polling stations (during the vote) and ensure that the names appear in the same position on all ballots (so people cannot be tricked into putting their X into the wrong spot).
In thinking about electronic voting machines, I am very concerned about a machine that lets ANYTHING about the options be altered during the voting process. All options should be fixed and sealed before the machines are delivered and should not be changeable by anyone during the voting process. The integrity of the seals should be verified at the source office before the counts are officially added to the results.
I voted in the (Vermont) primary a few weeks ago. The official asked me which ballot I wanted and gave it to me. If I had wanted the other ballot, I would have gotten it, and it would have been a different color. I went in the booth, marked the paper with a pen, went to the second official, and then put the completed ballot in the box. End of story.
What purpose these machines, except to bilk taxpayers or steal elections?
Even an insane engineer, such as myself, would not implement a system with such confusing feedback to the operator. It’s hard for me to even guess at the team of other insane engineers, insane testers, insane PM’s, insane customers, and insane auditors that would also agree such operation was likely to lead to confidence in the result.
Charlie Strauss said, “I think this sentence is being misinterpreted (by everyone but me :-). Sequoia is ineptly saying that voter did notice something was wrong, reported it, and then did vote the right ballot in the end.”
I’m not sure I agree with you, I still think they are claiming the voter didn’t bother to report that the wrong ballet was up, but either way it doesn’t really change the situation much. Furthermore, I wonder if Sequoia was deliberately confusing in their phrasing, both here and in the whole document.
Reinout Heeck, I totally agree with you, in so far as regardless of the details, this clearly tells us there are significant problems with these machines and they’re not ready for use, especially since so much is at stake.
However, that’s not to say that detailed scrutiny of the issue and Sequoia’s reaction to it isn’t warranted. Since we’re talking about, not only our votes, but votes in an election that has already happened, it makes a very real difference if this is a simple error that was overlooked, a simple error that was known but allowed to go through anyway, or an intentional function of the machines. That, at least to my thinking, is why we should get more information and get to the bottom of the issue, so that we can determine if Sequoia is incompetent, willfully negligent, or outright malicious. Regardless, however, yes, like the bad calculator, these things should be chucked just based on these errors alone, no matter how minor they turn out to really be.
They are saying it is a user error instead of a user interface error. The user interface they have is defective enough to generate unacceptable results, and the users of the machine shouldn’t need to know about the inherent defects of the system in order to avoid it.
In fact, wouldn’t that be the worst case? If the poll workers know about this defect, could they not use it to stack votes? If you know this issue exists, can they use the voting machines in a test scenario to show staggeringly incorrect results?
You stated in the article that this doesn’t look like fraud. My issue with that statement would be that if they have a known design error that opens the system up to fraud and they don’t fix it immediately, and issue a clear statement that the design flaw could invalidate previous polls taken then they are part of the fraud process.
I’m taken aback by this discussion.
If this were a pocket calculator that cannot add you’d throw it away and replace it.
But here we have a voting system that cannot add and you all start parsing press communiqués that have nothing to do with the process of throwing it away.
Sequoia is playing you like a fiddle.
There is clearly a software defect here. Sequoia points to an operator error; but that sort of error should not be allowed to affect operation of the machine. It would (one hopes) be a relatively unusual error.
I would not count on voters necessarily reporting that they have the wrong display. A small number of voters barely understand what’s going on at all. I speak as an election judge of of over 25 years’ experience.
This is an argument for open-source in all electronic voting systems.
On your fourth point, I think you’re overestimating the vigilance of both poll workers and voters. Even if a voter does complain, it’s likely that the poll worker will merely adjust the machine so that the proper ballot shows up. Problem solved, at least from the POV of the people at the precinct. Obviously, further investigation is required to determine what happens to the tallies when such an adjustment is performed.
At this point, I think it’s too early for a final judgment to be reached as to whether Sequoia’s explanation of the discrepancy is valid. Of course, even if it is valid, it is nevertheless an admission that their product has gone through woefully insufficient testing procedures before being sold to the taxpayers.
Let me restate what I think is the mechanism of action:
1) Democratic voters enters front of booth
2) pollworker is in rear and mistakenly pushes “Republican (12)” and walks away.
3) After a minute or two , Democratic voter goes, “hey I got the wrong ballot”
4) Poll worker comes back. Before he can re-activate it to allow the voter to revote, he needs to confirm the voter did not actually cast a ballot yet so he enters the voting booth from the front. Sees the voter is indeed voting in progress but not cast on a republican party ballot.
5) poll worker, still standing in front of the machine, reaches around without looking to press what he thinks is “button 6” and then “activate”. Only he gets mixed up and presses button 7.
6) Due to the software bug Sequoia described, the machine now displays a Democratic ballot as desired, even though the poll worker pushed the wrong button.
7) poll worker mumbles “Sorry” and leaves.
8) Due to software engineering errors, the machine records what light was on, not what ballot was filled out.
This explanation wis consistent with the observation that all the type-2 errors were always republican. And why it might only affect some machines.
—
Sequoia says ““In addition, for this situation to have occurred, the voter that was in the voting booth at the time of the poll workers action would have voted the opposite party ballot instead of telling the poll worker that the incorrect ballot was activated and the machine would not allow them to vote the party they intended.”
I think this sentence is being misinterpreted (by everyone but me :-). Sequoia is ineptly saying that voter did notice something was wrong, reported it, and then did vote the right ballot in the end.
> I can only think of perhaps two plausiblilities. One is that some how the order of
> the buttons on the panel induce this systematic mistake in only one direction.
If you read the article more carefully, you would know that that’s exactly what Seqouia claims.
That kind of bug would scream “insufficient user testing” for a website, let alone a voting machine. They didn’t test what happens if you press the wrong button? Unbelievable.
Quoted from the memo: “In addition, for this situation to have occurred, the voter that was in the voting booth at the time of the poll workers action would have voted the opposite party ballot instead of telling the poll worker that the incorrect ballot was activated and the machine would not allow them to vote the party they intended. If they had informed the poll worker, they could have made the party selection change and the voter would have then voted the correct ballot style.”
Charlie, this does make it sound like they require someone to vote for the opposite of their intended party in order for this error to occur.
Now, I’m sure there are people out there who vote and who are in no condition to understand what they’re doing. But I have to think the vast majority of voters would notice it if they went in to vote for a Democrat and a Republican ballot came up, and I have to think that no one in a clear mental state would say, “Oh, hell, I’ll just vote for the other party then.” Obviously not everyone is going to be in a clear mental state, but I would think it’d be a pretty rare occurance.
Their explanation does make a certain amount of sense, as far as explaining how the counts could always be off in the same direction, but even fully accepting their story, it does sound like a lousy design at best. I’m inclined to think there’s some truth to this but that there’s more to the story… the idea of it defaulting to a lower number under certain conditions rings true and matches what we’re seeing, but the circumstances they cite as leading to that event seem unlikely to happen, given what we know.
@Charlie Strauss (2:38): Sequoia does explain why the discrepancy is one-sided: parties are arbirarily ranked (assigned numbers between 1 and 12) before the election. The anomalous situation can only arises with a lower-ranked party. The poll worker presses the correct button, but then also presses (by mistake) an assigned button. The log then shows the lower-ranked party’s ballot being accessed, but also a vote for a candidate from the higher-ranked party.
Their description is a little incomplete. Knowning what happens when there are three parties on to choose among would go a long way into explaning their design errors.
I’m working through this explanation with a paper-and-pencil mockup, but meanwhile I’ll note Sequoia’s use of the right-wing code phrase “Democrat Party” instead of “Democratic Party”. It seems to have become fashionable of late among some to use this term as a thinly-veiled insult, then deny that it’s intentional. Given how carefully [at least some portions of] this explanation seem to be worded, I don’t for a moment believe this is a mistake.
Felton said
“Fourth, Sequoia’s explanation involves a voter seeing the wrong party’s ballot being activated, and not complaining about it. ”
Ed I think you misread Sequoia’s statement. They are saying that the voter did get the right ballot. That’s why they did not complain.
So what is happening is the voter is a democrat. The poll worker presses the Republican button (12, the lower one) and then says “oopsie” and then mysteriously presses button 4 instead of pressing button 6 (democrat). The voter is then presented with the desired democratic ballot. But the light stays on the republican (12) and the Option logger, records the light (12) not the ballot(6).
That’s their explanation. Clearly if one believes that it’s still a humungous engineering blunder for it to behave that way. One can just as easily believe that if they are logging the wrong thing (lights not ballot type) then they might just as simply be logging the wrong button presses for selecting candidates.
But lets stipulate that yes indeed this bug does exist. Let’s stipulate that pollworkers sometimes press the wrong button and then notice their error.
Does the explanation make sense? no. Why after noticing the error would they press another button other than “6”. If they simply made a second mistake or were perhaps trying to “clear” the selection with some null choice, then they would notice that the republican light was still lit. It wound stay lit until they pressed “6” so why stop pressing buttons till the light came up.
All I can think is that what happens is this. The poll worker and voter are in the booth. The pollworked pushes (12) republican and pays no attention to the light. then the Voter notices she got the wrong ballot and asks for a fix. The poll worker enters the booth from the font side instead of the back to confirm the problem. Then he reaches blindly around back and presses some button. He sees the Democratic ballot pop up, and never bothers to look at the lights.
Here’s another thing that seems improbable. If you look at the votes you can divide the anomolies into two piles.
1) attempts > cast votes (not a problem I think)
2) cast votes > attempts (problem!)
All of the type-2 anomalies occur on the Republican race and never on the the democratic race. Is there a reason to believe the poll workers would persistently make the same error in one direction?
I can only think of perhaps two plausiblilities. One is that some how the order of the buttons on the panel induce this systematic mistake in only one direction. The other is that the turnout for the democrats was higher than that of the republicans and the number of people who attmepted but did not cast votes (type-1 anomolie) is higher on the democrats. When a type-1 error occurs in masks the incidence of a type-2 error. Thus this masking might be slightly higher on the democrat side.
As a final commnent I note that Seqouia’s explanation makes no sense to me. Since I should hope that the counters recorded what actually happened (what ballot was voted) not what “light” was lit. I could imagine an anal logging program actually tracking what light was lit, but why would you report that on the print-tape and not the former (what ballot was attempted)??
This seems like a serious engineering error and given their failure to explain it well one suspects there’s more lurking.
I’m not registered (or even eligible) to vote in US elections, and I may be a little slow… but isn’t the process of choosing who you want to vote for on one of these machines ridiculously complicated?
At best, Sequoia is guilty of awful UI design… at worst it looks like they are attempting to interfere in a democratic election through obscurantism.
I am not seeing the connection between what sequoia said and the incrementing of the option counter on the printout.
If the poll worker does this and the REP ballot shows instead of the DEM is the DEM counter still increment or does the REP Counter get incremented. I guess another way to put it does the option counter get incremented when you hit the option button or the green activate button.
I think it would be pretty dumb to do the option increment when you hit the option button.
In either case does anybody know what happens if a person just walks away from a ballot along with can they complete the ballot process without voting?