Next Steps for Mercer County Following Voting-Machine Failure

Hand-marked optical-scan paper ballots are the most secure form of voting: with any other method, if the computerized voting machines are hacked, there’s no trustworthy paper trail from which we can determine the true outcome of the election, based on the choices that voters actually indicated.  Even those voting methods that appear to have a paper trail, if it’s a computer that created the paper trail, it’s less trustworthy.  And that’s the case even if the human voters have an opportunity to look at the paper, as I will explain below.

Mercer County, NJ uses hand-marked paper ballots in its election-day polling places.  That’s good.  But after the system-wide voting-machine failure in Mercer County, some county officials are thinking of abandoning hand-marked paper ballots, and using Ballot Marking Devices (BMDs) in polling places.  That would be a bad idea: BMDs can never be as secure as hand-marked paper ballots.   The use of BMDs can lead to unrecoverable election failures.  In  contrast, Mercer County’s failure was recoverable:  Even though the voting machines failed to work on election day, voters could (and did) hand-mark the same paper ballots that they would have fed into those voting machines, and the Board of Elections could (and did) count those ballots with their high-speed central-count optical scanners.

Although Mercer uses hand-marked paper ballots for election-day precincts, the county uses BMD-marked paper ballots for  early vote centers.   I voted at an early vote center in Princeton (Mercer County) on November 2.  I was checked in on a Tenex e-pollbook and sent to a Dominion ICX touchscreen ballot-marking device (BMD) where I selected candidates on a touchscreen; then the BMD printed out a double-sided optical-scan ballot with the ovals filled in.  I reviewed my ballot to make sure they were filled in as I had indicated on the touchscreen.   Then, as instructed, I fed that into a Dominion ICP2 optical-scan voting machine, which tallied the votes and dropped my paper ballot into a ballot box, available for recounts or for audits.

Voting with BMDs is a bad idea.   Like any computerized voting machines, ballot-marking devices can be hacked to make them cheat.  In fact, we know for sure that Dominion ICX machines can be hacked; see this advisory from the U.S Cybersecurity and Infrastructure Security Agency. (But I expect that BMDs sold by other companies such as ES&S or Clearballot likely have similar vulnerabilities.)

When a BMD is hacked, that means that the attacker can make it cheat by changing some proportion of Candidate Smith’s votes into votes for Candidate Jones.  Since that fraudulent vote is printed on the paper ballot, this fraud cannot be corrected by a recount.   In contrast, with hand-marked paper ballots, if a voting machine is misconfigured or hacked, the paper ballots still contain the marks that the voters actually indicated with their pens (or Sharpies, which work just as well, in fact).

You might think, the paper ballot produced by a ballot-marking device (BMD) is a record of the actual votes that the voter marked – but it’s not, if BMD has been hacked.  That’s because if the BMD cheats by marking different votes on the paper than what the voter indicated on the touchscreen, then 90% of voters wouldn’t notice if a vote was changed.  That’s been measured in studies of actual human beings.  And if a few voters do actually notice, then they can get their own ballot voided and recast it correctly, but they can’t correct the ballots of all their neighbors who (being human) didn’t notice.  You might think, “our BMDs don’t encode votes with barcodes, so they’re safe;” but avoiding barcodes does not make BMD ballots safe (though it’s true that barcode BMDs are even more insecure).  All this is explained in more detail here.

Two years ago, Mercer County officials chose hand-marked paper ballots for election-day polling places.  This was the right decision, and it is still the right decision.  However, the November 2022 election-day screwup brought several problems to light:

• Mistakes in handling paper ballots can compromise the chain of custody.  But handling paper ballots in the polling places is not so simple, and yet it must be done by hundreds of hired-for-the-day poll workers who only work one or two elections per year.  Some of them will make mistakes, such as leaving paper ballots in the voting machines instead of transferring them to the red ballot-transfer bag, or forgetting to put the security seal on the red bag, or sending the red bag to the municipal clerk’s office instead of to the county Board of Elections office.
• The Dominion ICP voting machine is equipped to handle brief periods of unavailability, but we’ve now seen that a long outage causes an unforeseen problem: the emergency ballot box is too small.  That is, if an optical-scan voting machine fails to operate for an hour or two (until the County can send a repairman to unjam it or whatever), voters can put their ballots through the “emergency slot” into the emergency ballot box, and those ballots can be counted later.  But this year the Dominion ICP voting machine was down all day long while hundreds of ballots were deposited, the emergency ballot box wasn’t big enough, and poll workers had to take the top off the machine to allow ballots to be deposited in the main bin.  This led to confusion at the close of the polls, because workers had to remember to collect the ballots from both bins.
• It feels uncomfortable and expensive to print enough ballots for the voters who might show up, only to have to discard the extras when turnout is low.  Sometimes that’s a lot of paper to recycle.
• Chain-of-custody accounting must include unused ballots as well as voted ballots. Preprinted ballots come in packets of 100; election workers have the task of opening up new packets (as needed) and accounting for how many unopened packets are left, and how many unused ballots in opened packets.  This can get messy.

Mercer County officials are correct that these problems must be fixed. But switching to ballot-marking devices would significantly compromise ballot integrity, and wouldn’t solve these problems.

• Ballot-marking devices produce paper ballots, which need to be preserved for audits and recounts.  Any sloppiness in the chain of custody will be just as much a problem for recounts as it was in November 2022 for the first vote count.  As difficult as it is to train poll workers in ballot-handling and chain-of-custody procedures, it will still have to be done even if we use BMDs.
• If the BMDs fail to operate on election day, then the problem is much worse than what Mercer County experienced in November 2022.   The usual safeguard is to have a supply of (about 30) “emergency ballots” that voters can mark by hand.  But if there’s a system-wide failure, those emergency ballots will run out, and people won’t be able to vote at all.
• It may seem wasteful to print 800 ballots when only 250 will be used.  But it’s actually less expensive than using a ballot-marking device.  Professor Duncan Buell of the University of South Carolina did a cost study of preprinted ballots versus the maintenance cost of BMDs,  and found that preprinted paper ballots were cheaper even if you have to print more than actually get used.  The basic reason is that, in addition to the upfront cost of a BMD, Dominion charges about $300 per year per machine for warranty and license, you’d need at least two of these in each polling place, and that can pay for a whole lot of ballots.

There are several steps that Mercer County should consider:

• Improved administrative procedures and improved “logic and accuracy” testing to make sure the paper ballots always match what the voting machines expect.  At the November 21st County Commissioners’ meeting, Dominion Vice President Robert Giles said they are working on that now.  An important improvement will be using some real preprinted ballots (from the printing company) in the tests; and Mr. Giles mentioned that improvement.
• County Executive Brian Hughes (speaking at the County Commissioners meeting November 21) has proposed to consolidate the offices of Superintendent of Elections and Board of Elections, as permitted by New Jersey law and as done in several other counties.  In this model there would be a professional Administrator working for the Board of Elections.  This would reduce the fragmentation of responsibility and might reduce the opportunities for screwups.  It might save money, too, if a savvy Administrator can bring more functions in-house and/or negotiate better prices on service contracts and ballot printing.
• Perhaps ballot-on-demand printers (for hand-markable optical-scan paper ballots) can be used instead of BMDs and instead of preprinted ballots.  This avoids wasting a lot of paper (and money to pay for ballot printing).   When Dominion quoted prices to New Jersey counties, they outrageously overpriced their ballot-on-demand printers, which made BMDs seem like the cheaper option – I haven’t seen Dominion’s Mercer quote but Dominion’s 2021 quote to Camden County charged $20,000 apiece for ballot-on-demand printers.  This year, Camden got a bid of $1,965 apiece for Tenex ballot-on-demand printers compatible with ES&S optical scanners – a factor of ten less. That makes ballot-on-demand look a lot more attractive. Or maybe the Dominion ICX BMDs that the county already owns can be used as ballot-on-demand printers instead of as BMDs.
• Chain-of-custody procedures for paper ballots need to be improved whether or not the ballots are hand-marked or BMD-marked.

Many improvements can be made, and should be made.  But let’s also recognize that Mercer County election officials are doing a pretty good job already.  Even in the face of the November 2022 county-wide voting-machine failure, within a few hours they had a backup plan, they executed that plan successfully, they counted all the ballots, and they got the election certified within the period set by state law.  This demonstrates the resilience of preprinted, hand-marked paper ballots:  the computers may have failed, but the pens did not fail, and the election got counted.  And on the other hand, with computers marking the ballots for us, then mistakes (or deliberate hacks) can sneak by unnoticed; and system-wide failures would mean people couldn’t vote, not just that the counting would take an extra three days.