Podcast Episode: Securing the Vote

U.S. democracy is at an inflection point, and how we administer and verify our elections is more important than ever. From hanging chads to glitchy touchscreens to partisan disinformation, too many Americans worry that their votes won’t count and that election results aren’t trustworthy. It’s crucial that citizens have well-justified confidence in this pillar of our republic.

Technology can provide answers – but that doesn’t mean moving elections online. As president and CEO of the nonpartisan nonprofit Verified Voting, Pamela Smith helps lead the national fight to balance ballot accessibility with ballot security by advocating for paper trails, audits, and transparency wherever and however Americans cast votes.

On this episode of How to Fix the Internet, Pamela Smith joins EFF’s Cindy Cohn and Danny O’Brien to discuss hope for the future of democracy and the technology and best practices that will get us there.

This episode is also available on the Internet Archive.

In this episode you’ll learn about:

• Why voting online can never be like banking or shopping online
• What a “risk-limiting audit” is, and why no election should lack it 
• Whether open-source software could be part of securing our votes
• Where to find reliable information about how your elections are conducted

Pamela Smith, President & CEO of Verified Voting, plays a national leadership role in safeguarding elections and building working alliances between advocates, election officials, and other stakeholders. Pam joined Verified Voting in 2004, and previously served as President from 2007-2017. She is a member of the National Task Force on Election Crises, a diverse cross-partisan group of more than 50 experts whose mission is to prevent and mitigate election crises by urging critical reforms. She provides information and public testimony on election security issues across the nation, including to Congress. Before her work in elections, she was a nonprofit executive for a Hispanic educational organization working on first language literacy and adult learning, and a small business and marketing consultant.

Music:

Music for How to Fix the Internet was created for us by Reed Mathis and Nat Keefe of BeatMower. 

This podcast is licensed Creative Commons Attribution 4.0 International, and includes the following music licensed Creative Commons Attribution 3.0 Unported by their creators: 

• Klaus by Skill_Borrower 
  http://dig.ccmixter.org/files/Skill_Borrower/41751
• commonGround by airtone
  http://dig.ccmixter.org/files/airtone/58703
• Chrome Cactus by Martijn de Boer (NiGiD)
  http://dig.ccmixter.org/files/NiGiD/62475

Resources

Voting Security:

• The Verifier, Verified Voting 
• Election Security
• If It Doesn’t Have Paper Backups and Automatic Audits, It’s Not an Election Security Bill
• What to Do When Voting Machines Fail
• E-Voting Machines Need Paper Audits to be Trustworthy
• NSW’s online gamble: why internet and phone voting is too risky, The Conversation
• No to Online Voting in Virginia
• Election Security Is a Matter of National Security, Scientific American
• Elections Are Partisan Affairs. Election Security Isn’t 
• Voter Privacy: What You Need to Know About Your Digital Trail During the 2016 Election, EFF 
• Hacking the D.C. Internet Voting Pilot, Freedom to Tinker

Security Through Obscurity

• Code Review Isn’t Evil. Security Through Obscurity Is
• Podcast Episode: Making Hope, with Adam Savage

Transcript

Pam: It’s not like banking and shopping, and it’s not like banking and shopping online and other things that don’t require secrecy and disassociating the identity of the person doing the transaction from the content of the transaction. And that’s why internet voting is so challenging. If you were to send in your ballot from remotely and then call the election official and say, “Hey, it’s Pam. I sent my ballot, I voted for candidate A, is that what you’ve got?” That’s not how elections work first of all. But if it were, why not just do that and not do the send. Just say, “Hey, I want to vote for candidate A, could you mark that down for me?” That would actually be safer. It wouldn’t be private, but neither is internet voting.

Cindy:  That’s our guest, Pam Smith. She’s the CEO of Verified Voting. And today she’s going to be joining us to explain how digital technologies can help secure elections but we are also going to talk about how we need to keep a clear separation between our actual votes and the internet. 

Danny:  Pam’s going to spread some light and tell us how we can protect the entire process, from voter registration to vote verification through to a risk limiting audit. She’ll tell us how to build a system that lets everyone feel comfortable that the candidate with the most votes was actually the one chosen.

Cindy:  I’m Cindy Cohn, the executive director of the Electronic Frontier Foundation.

Danny:  And I’m Danny O’Brien, special advisor to the EFF. Welcome to How to Fix the Internet, the podcast where we explain some of the biggest problems in tech policy and examine the solutions that’ll make our lives better.

Cindy:  Hi, Pam. You and I go way back and I currently serve on the board of advisors of Verified Voting.  And I’m so excited to have you here today so we can dig into these things. 

Pam:  It’s great to be with you again.

Cindy:  So we find ourselves in a very strange situation, you and me and others who care about election integrity, where some of the arguments that we have been using for many, many years to try to make our elections more secure are being picked up and used by people who I would say don’t have that same goal. 

Pam:  Well I think people legitimately want to know that elections are righteous, why wouldn’t they? But I think the undermining of the public’s ability to trust and to know how to trust in elections is really one of the more severe dangers to democracy today. As long as there have been elections, there have been problems, issues, challenges, and even tampering with elections, that’s not new. Those issues are different at different points in history. Starts out with who gets the vote and who doesn’t. But also back in the day, communities used hand count votes with the whole public watching. And it was very transparent, it was low tech, no problems, but it was also not private, not secret, and there were very few voters. 

Now elections are carried out with software and computerized systems in most aspects of elections and things can be hacked and tampered with and can have failures and bugs and glitches. People need to understand technology touches their elections in many places. How do we know that it’s secure? So what we do is look at what are the basics in securing elections. It’s the same as securing anything computerized, it’s keeping systems up and running, it’s protecting data from both malfeasance and malfunction, and it’s being able to recover when something goes wrong, having that resilience.

Cindy:  Could you give us an example of one of the things that people were very worried about, that election officials could easily explain? 

Pam:  Well, probably the biggest one, and this was anticipated, was the fact that not all the votes are going to be done being counted on election night, they’re just not. And especially in 2020, where you add one more layer of complexity called a pandemic. So it made a lot of things different. When the ballots come in, if they came in before election day, my county prepares them for counting and runs a tally. First thing after the polls are closed, they can report out those absentee ballots. But those are just the ones they’ve already gotten in, that’s not the polling place ballots, that’s not the ones we allow to arrive late as long as they were postmarked on time.

So there’s many more ballots to be added into that count, that’s just the initial count. I think people don’t know that the initial count is not the official count, and that’s important to know. It takes a while for all of the ballots to be processed and counted, even to make sure that they were legitimate ballots and included properly in the count. And that end part is called certification of the election. When we certify in each jurisdiction, that’s the final count.

Cindy:  And this is the difference between elections in the United States in elections in a lot of places around the world, we vote on a lot of things.

Danny:  It’s true.

Cindy:  And we have complicated ballots that might change across the street depending on what precinct or whatever that you’re in. Even in a place where people live very close together, there are different kinds of ballots because people are voting for their very local representative as well as all the way up to the federal level. And elections are generally governed as a legal matter locally as well. So the US constitution guarantees your right to vote, but how that happens varies a lot. One of the things that Verified Voting created a long time ago, but which I still think is a tremendously useful tool, is something called The Verifier, which is a website that you can go to and type in where you live and it will tell you exactly what counting technologies are used. 

Danny:  And I think this touches on the key point here, how technology can complicate or even undermine people’s trust in what is already a very complicated system. Again, a lot of the conversations in the last election were about, has this been hacked? And how do we prove whether it has or it hasn’t been hacked? I know Verified Voting and EFF were very involved in the early effort to require paper records, a paper trail of digital voting technology, what we call voter verified paper records back in the 2000s. So can you just talk a little bit about where the role paper, of all things, plays in a more high tech voting system?

Pam:  It’s interesting to note when we got started back in 2004, there were only about eight states with a requirement to use paper and only about three had a requirement to check the paper later with an audit.

Danny:  And when you say paper here, it’s literally a printout. You vote and then there’s a paper record somewhere that you voted in a certain way.

Pam:  It’s a physical record that you get to check to make sure it was marked the way you intended it.

Danny:  Got it.

Pam:  You may be using an interface, a machine that prints that out, but you may be marking a physical ballot by hand as well. And it’s that physical record of your intent that is the evidence for the election. 

So here’s the thing about paper, you need to know that you can cast an effective ballot and that means you’re getting the right ballot, that it’s complete, there’s no missing candidates or contests on it, it’s feasible to mark. If you have to use an interface, that that interface is working, up and running, and that you have a way to check that physical ballot and cast it safely and privately. Then that ballot gets counted along with all the other ballots and you need a way to know it was counted correctly.

And that you can demonstrate that fact to the public to the satisfaction of those who are on the side of the losing candidate or issue, and that’s the key. If you have that… This is what was said about the 2020 elections, Chris Kreb, who was at the cybersecurity agency at DHS on elections and he called the 2020 election the most secure in American history. The leg he had to stand on for that was the fact that almost all jurisdictions were using paper, that almost all jurisdictions were doing some audit to check after fact. And that’s why it matters, you have to have that record.

Danny:  I know that some of the work that’s come out of what you’ve been doing then has been this idea of risk limiting audits.  I’m addressing this to both of you, because I know you both worked on this, but the risk limiting audits and how they work.

Pam:  Audits get done in a variety of industries, there are audits in banking, there’s all kinds of audits, the IRS might audit you. It’s not always seen as such an attractive word. But in elections, it’s really important. What it means is you are counting, you’re doing a hand to eye count, you’re visually looking at those paper ballots and doing a comparison of a count of a portion of those ballots with the machine count. So software can go wrong, it can be badly programmed, it could have been tampered with. But if you have that physical record that you can then count a portion of and check and make sure it’s matching up, and if it’s not figure out where the problem is. That’s what makes the system resilient.

A risk limiting audit is one that relies on the margin of victory to determine how much you have to count in order to have a strong sense of confidence that you’re not seating the wrong person in office. So it’s a little bit like polling. If you poll on a particular topic, you want to know how the public feels about something, you don’t have to ask every single person, you just ask a percentage of them. You make sure it’s a good cross section, you make sure it’s a well randomized sample. And all other things being equal, you’re going to know how people feel about that topic without having to ask every single person. And with risk limiting audits, it’s the same kind of science, it’s using a statistical method to determine how much to count.

Cindy:  We worked really hard to try to make sure that there was paper. And then we realized that we had to work really hard to make sure that the paper played the role that it needed to play when there are concerns. If you only do this when you’re worried that there’s a problem, you’re really not fixing the situation. It needs to be something that happens every time so people can build their trust in the things.

But also it needed to be lightweight enough that you could do it every single time and you don’t end up with these crazy debacles, like we saw in Arizona.  Can you give us an update? How’s it going trying to get risk limiting audits regularized in the law? I know this is an area where you guys do a lot of work.

Pam:  Well, this extremely geeky term, risk limiting audits, is actually getting wide traction. So it’s good news.

Danny:  Good.

Pam:  People I think are understanding it. And one of the things that we do is support election officials through the process. So maybe their state passes a law that says you’ll do risk limiting audits, we help them understand how to do it and answer all the questions that might come up when they’re doing it. They then use that to demonstrate to the public that it’s working right and it’s a tool that they are really adapting to and adopting well. There’s more to do. And I think what’s important to know is that really any audit is going to have some utility in telling you how your equipment’s working. Risk limiting audits are a more robust form of auditing. And they will let you not do as much work if the margin is wide and they will call for more work if the margin is very narrow, but you want that anyway. You might go to a full recount in a very tight margin, talking about Florida 2000, that margin would probably necessitate that full hand recount anyway. But doing a risk limiting audit, you can get to that kind of confidence.

Danny:  “How to Fix the Internet” is supported by The Alfred P. Sloan Foundation’s Program in Public Understanding of Science. Enriching people’s lives through a keener appreciation of our increasingly technological world and portraying the complex humanity of scientists, engineers, and mathematicians.

Cindy:  Let me flip to where I love to go, which is so What does it look like if we get this right? What are the values? What does it look like if we have a world in which we have technology in the right places, in our systems, but also that we can trust it.

Pam:  I think that getting it right means that voters know the election was fair because it was conducted securely. And they know how to know that. That they know where the ground truth is and how to figure it out, that they’re participating actively in watching, that they’re not being hindered by failed technology at whatever point that intersects with the election. Whether it’s registration or checking into the polling place or actually using a device to mark your ballot or the counting process, that nowhere along on the path they’re being hindered in that process. And that means more people can participate who want to participate. This doesn’t address things like voter suppression, that’s a separate different issue. And it’s an issue about security because elections really are only secure if everybody who wants to gets to participate and can cast an effective ballot.

Cindy:  Could you explain why we want to fix the internet, we want to make the world better, and why voting over the internet isn’t on the list of things that we think would make a better world?

Pam:  One of the things that we talked about is the importance of the paper. That the voter gets to check at the time they’re voting and make sure it represents what they meant to vote for. When you use the internet to transmit votes, you lose that. What arrives at the election’s office, if it arrives at the election’s office, may or may not represent what the voter thought they intended to vote for. And there’s no real way to control for of that right now. Maybe in some future on a different internet that was designed for security and not just for open communication, it’s possible to do. But you have all kinds of issues with internet voting that include things like voter authentication attacks, malware on the voter’s devices, not just in the election’s office, a denial of service attack, server penetration, spoofing, all kinds of things can go wrong.

Cindy:  And ballot privacy is tremendously important if you really want to make sure that people can vote freely for who they want. You don’t want them subjected to either their boss or the other people who live with them or their community, being able to see how they vote. That’s not a free vote, that can often be a coerced vote. So a secret ballot is just a piece of how elections work, not just in the US but in most places of the world for really good reason.

Pam:  The internet has other ways in which it’s hazardous to elections health. It can be used for attacks on election officials, which we’re seeing a lot these days, attacks on votes, attacks on voters’ registration. We saw in 2016 state databases being tampered with from afar. And other kinds of information hacks. Just really by way of disinformation, attacks on democracy and understanding how to know what you need to know. If we’re thinking of about what would the world look like if we got it right, election officials are protected, votes are secure, and voter registration is secure and there’s ways for people to check and make sure of that. And fail safes in case something happens last minute. So all of those kinds of things are really important. Fighting disinformation is probably as important as the rest.

Danny:  I thought it was very fascinating in the last couple of elections in the US, I was talking to the cybersecurity side of all of this, it’s very difficult to get to the bottom of these things. But one thing really stuck with me, which is that the officials I was talking to said, “Well, look, most people’s model of this is someone is hacking to change the results to favor a particular person. But in fact, if you want to introduce instability into a country, the best thing you can do is just undermine faith in the system itself. You don’t actually have to achieve a result, you just have to inject a sufficient amount of ambiguity into the result. Because once that trust is gone, then it doesn’t matter what the result is because the other side is going to assume something happened behind the scenes. So is part of this to make the whole system transparent in a way that the average person can understand what’s going on? 

Pam:  We don’t expect voters to have confidence, our mission has never been make voters feel confident, it’s not about that. It’s about giving them justified confidence that the outcome was right. And that’s different. 

Cindy:  But let’s just say I hear that there’s a problem in a critical place. What do I ask myself? And what do I look for to be able to tell whether this is a real problem or perhaps not a real problem that’s being overblown or just misunderstood?

Pam:  Well, I think you want to know what the election official says. There are rare exceptions, but nearly all the election officials I know they’re simply heroes frankly. They’re working with minimal budgets and doing very long hours on very tight deadlines that are unforgiving. But what they do is really to address problems, anticipate problems, avoid them, and if they come up, address them. So you need to know what the election official is saying. If it’s observable, go observe. If there’s a count happening that you can watch, go watch that count. But you can’t get your information, from somebody’s cousin on Facebook.

Cindy:  Give us an example of where there was a concern and we were able to put it to rest or there was a concern and it went forward.

Pam:  One of the things we’d hear on election day at election protection was we’d get a call from somewhere and they’d say, “I’ve marked my ballot and I wanted to go cast it in this scanner like I usually do. But they told me not to and they put it in a separate bin.” Why did they do that? Are they taking those ballots away? Are those not going to be counted? What’s happening there? And we are able to tell them that there is actually a legit reason for that.  What happens sometimes in a ballot scanner is that the bin gets full, that the ballots don’t fall in a straight line, and it may be jammed. And if it’s jammed, you don’t want the ballots to get destroyed by trying to keep feeding more and more in. That bin has actually got a name, it’s the auxiliary bin, it’s the extra bin for when this happens. And it is attached to the ballot box. And what happens is once they clear that jam, which they may not be able to do in the middle of the busiest time of voting, is to feed those through.

Danny:  All right.

Pam:  That actually is a real simple problem with a simple resolution. But when you can tell people, “This is how that works” it puts their mind at rest.

Danny:  Which brings me, I think, to something else that people often, both on the left and right, worry about, which is the companies behind these machines. How can we reassure people that there isn’t something being underhand in the very design of the technologies?

Pam:  We used to say that it shouldn’t matter if the devil himself designed your voting system, as long as there’s paper and you’re doing a robust check on the paper, you should be able to solve for that. That’s what makes it resilient and that’s why we want to make sure every voter, not just 90% or more, but all of the voters are living in a jurisdiction where that paper record is there for them to check
 

Cindy:  I just think overall, this is technology, it needs to be subjected to the same things we do in other technology to try to continue to make it better. And that includes a funding stream so that when new technology is available, local election officials can actually get it.

Pam:  Elections are woefully underfunded. And there’s a conference that happens in California every year that’s called New Laws. This is a conference that election officials hold so that they can examine all the new laws that have been passed that affect how they run elections. It happens every year. So they are constantly and continuously having to update what they do and make changes to what they do. Oftentimes there are unfunded mandates that have to do with what they do. Asking them to do additional things is hard, especially if you’re not going to pay for it. So it’s really important that there is federal funding for elections that gets down through to the states and to the counties to support good technology. But with things like internet voting, the most dangerous form of voting, that doesn’t have to go through any certification because no one’s been able quite yet to write standards for how you would do this securely.

Cindy:  Because you can’t right now.

Pam:  Because you can’t.

Cindy:  With our current internet.

Pam:  Not that we don’t want to, you just can’t.

Danny:  I have one more thing to throw in which people often, often say, “Oh, we should do it like this.” I’d love to know your opinion on it because our community is often like, “Well, we need an open source voting machine or a voting system. And that would fix a set of problems.” Certainly the idea is that would be more transparent and you would feel more confident about it. Do you think that’s an answer or part of the answer?

Pam:  I think it’s a very good thing. It’s what some people might call necessary but not sufficient. You still are going to need to do audits, you’re still are going to need paper, you still need a resilient system. But open source helps make sure that you can anticipate some of the issues right away because there are lots of eyes on the problem. With voting technology though, it gets tricky. It’s not quite the same as other kinds of open source because who’s responsible for what’s the most current iteration? This isn’t something that people can just keep applying fixes to randomly, there has to be a known version that’s being used in a particular election. So there has to be an organization or entity that governs how that’s being used.

Cindy:  Understanding how this technology works is tremendously important for all of our security. And it’s the classic security through obscurity doesn’t work, that our friend, Adam Savage just reminded us of this. This is a whole other wing of secure elections, but the only way you know something is secure is that a bunch of smart people have tried to break it and they can’t. 

Pam:  Don’t leave weak spots if you can help it because if somebody’s looking to tamper, they’re going to find the weakest point. So it really is crucial to try and secure all parts of our elections. 

Danny:  What’s the end game here? You’re clearly deeply in the trenches trying to incrementally improve these systems. But do you ever have a dream where you envisage a world where maybe we do have a solution to voting on the internet or we do use a new technology to make things better?

Pam:  Moving towards those options includes things like if you need to vote by mail, you can vote by mail. If you want to vote in person in a polling place, that’s available to you. If you need an accessible device, one that’s really, really accessible and usable, it’s available to you. And it works and it was set up before you got there so it’s readily available. I think knowing that every jurisdiction is using a system that’s resilient to any kind of failure, hurricane, power outage, anything, that there’s a physical ballot to mark, that it’s easy to check, it’s a usable ballot not confusing, so that you end up missing contest or anything like that. It’s designed well, ballot design is really important. All of those small pieces are only possible if there’s enough funding for elections. If we believe in our democracy and we believe in having good elections, then that means having good voting systems, good practices, and the resources to carry those out.

Right now, election officials really struggle to recruit enough poll workers for every election. Of course, that got a little harder with the pandemic going on. Many poll workers are of an older age cohort, so we need younger poll workers. And a lot of really smart programs have led to recruiting high school students to be poll workers and it’s been magical. So I think really getting everyone engaged, getting everyone to understand where they can find the ground truth about elections, and feeling the confidence that they need to really happily participate and celebrate being part of this democracy, that’s the most important thing. And that’s what I envision for our future.

Cindy:  Thank you so much for taking the time to talk to us. This has been a fascinating conversation. There’s so much talk about elections and election integrity right now. And it’s great to have a sane, stable voice that’s been here for a long time, which is you and Verified Voting on the case. So thanks.

Pam:  Thank you, Cindy. And thank you, Danny. Thanks for doing this.

Danny: It’s always good to talk to somebody like Pam, who has years of experience, especially when a topic is suddenly as controversial or in the public eye as election integrity. I did think given how controversial it is these days, Pam was reassuringly genial. She established that we need to get to a ground truth that everyone can agree on and we need to find ways, technological or not, to reassure voters that whatever the result, the rules were followed.

Cindy:  I especially appreciated the conversation about risk limiting audits as one of the tools that help us feel assured that the right person won the election, the right issue won the election. Especially that these need to be regularized. EFF is audited, lots of organizations are audited. That this is just somewhat built into the way we do elections so that the trust comes from the idea that we’re not doing anything special here, we always do audits and we scale them up depending on how close the election is. And that’s just one of the pieces of building trust that I think Verified Voting has really spearheaded.

The other thing I really liked was the ways that she helped us think about what we need to do when we hear those rumors of terrible things happening in elections far away. I appreciated that you start with the people who are there. Look for the election officials and the organizations who are actually on the ground in the place where you hear the rumors about looking to them first, but also looking to the election protection orgs, of which Verified Voting is one but not nearly the only one, that are really working year round and working in a nonpartisan way around election integrity.

Danny:  And another leg of the stool is transparency throughout all of this process. It’s key for resolving the ambiguity of it. I do appreciate that she pointed out that while open source code is great for giving some element of transparency, it’s necessary but not sufficient. You have to wrap it around a trusted system. You can’t just solve this by waving the free software license wand all over it.

Cindy:  I also appreciate Pam lifting up the two sides of thinking about the Internet’s involvement in our elections. First of all, the things that it’s good at, delivering information, making sure ballots get to people. But also what it’s not good for, which is actual voting and the fact that we can’t get ground truth in internet voting right now. And that part of the reason we can’t and what makes this different than doing your banking online is the need for ballot secrecy that has a tremendously long and important role in our elections.

Danny:  But that said, I do think that ultimately there was a positive thread going through all of this. That many things in this area, in the United States have got better. We have better machines, we have newer machines, we have less secrecy and proprietary barriers around those machines. Often people when we ask them about what their vision of the future is, they get a little bit thrown because it is hard to describe the positive side. But Pam was pretty specific but also pointed out perhaps why it’s such a challenge. Because she highlighted that what we want in our future is a diversity of solutions. And of course, that you need the correct financial and social support in the rest of society to make that vision happen.

Cindy:  Thanks so much to Pam Smith for joining us and giving us so much honestly hope for the future of our democracy and our voting systems.

Danny: If you like what you heard, follow us on your favorite podcast player and check out our back catalog for more conversations on how to fix the internet. Music for the show was created for us by Reed Mathis and Nat Keefe of BeatMower. This podcast is licensed Creative Commons Attribution 4.0 International, and includes music licensed under Creative Commons Attribution 3.0 unported licensed by their creators. You can find those creators names and links to the music in our episode notes or on our website at eff.org/podcast. How to Fix The Internet is supported by the Alfred P. Sloan Foundation’s program in public understanding of science and technology. I’m Danny O’Brien

Cindy:  And I’m Cindy Cohn. Thank you so much for joining us.