Vote machines a go

Judge rips security testing, but says it's too late to switch

Ann Imse, Rocky Mountain News

Published September 23, 2006 at midnight

Text size

More Airlines & Aerospace

More stories »

A Denver district judge ruled Friday that the secretary of state did an "abysmal" job of security testing on new computerized voting machines, but it's too late to bar them from the Nov. 7 election.

Unable to be certain the machines' software is safe from tampering that could distort the vote, Judge Lawrence Manzanares ordered the state to immediately devise detailed rules for counties to ensure that no one can get to the machines to reprogram them.

Plaintiffs showed malicious software could be installed with a screwdriver and a flash drive in as little as one minute on some machines, Manzanares noted.

He said the widely used voting machines, where voters cast ballots on a computer screen, "are certainly not perfect or immune from tampering." But he ruled that barring them roughly six weeks before the election, and four weeks before early voting, "could create more problems than it would solve."

Compared to the potential of tampering, "the potential for problems is probably greater" if counties must suddenly switch to a different voting system, the judge said in an oral ruling shortly after final arguments in the three-day trial.

Using all mailed or absentee ballots would violate another state law, he noted, because they could not be counted by precinct.

A nonpartisan voters group brought the lawsuit, asking for a ban on computer voting systems made by Diebold, Hart, ES&S and Sequoia. They are used in every county in Colorado to some degree, and extensively in many.

But devising serious security standards and then testing the machines again before November also is not realistic, the judge said. So he ordered the state to do that before the next statewide election, which could be as soon as November 2007.

State officials say they would be recertifying next year anyway, when the manufacturers update their software.

Both sides said they were pleased with the rulings.

Deputy Secretary of State Bill Hobbs was happy to not be scrambling to make major last-minute changes in the election.

Plaintiffs' attorney Paul Hultin was pleased that because the judge agreed that the state must do better security checks in the future.

Manzanares said the new security standards should be detailed, and the tests should be logged and repeatable.

"Good government requires those documents," he said.

"Measured by any security standard, the state has done an abysmal job of doing their tests" for security, he said.

In contrast, Secretary of State Gigi Dennis issued a statement saying she remains "confident with the state's certification process."

In a press release, she said, "I ask voters to ignore the political rhetoric by a few seeking to destroy that confidence."

The judge found other problems, but concluded he did not have the authority to rule on them, saying:

• He "absolutely" wished the state had found an expert more qualified to test the machines but the state law was too vague about the "expert" needed.

• Some non-security sections of the certification also were deficient - but not absent.

"The court can order the Secretary of State to comply with the law. The court cannot make the Secretary of State do a good job," Manzanares said.

• Some machines clearly failed to meet all requirements for voting by the disabled, but he did not bar them. "They are better than most other methods," he decided.

Because the judge ruled the secretary failed to demand adequate security plans from counties, he ordered the state to produce new security rules for the counties and share them with the plaintiffs' attorneys by noon Monday.

The two sides hope to agree on the new rules and submit them to the judge for approval shortly thereafter, Hultin, the plaintiffs' attorney, said.

Dennis at first said she would start work on the rules "first thing Monday." After she was told the judge gave her a noon deadline, she said, "We'll work through the weekend."

Her deputy, Hobbs, said the office already has ideas for the new rules and would look at practices in California and other states.

The plaintiffs also argue that results should never be transmitted by the Internet but it remains to be seen if that will be included.

The Democratic Party, and both the Democratic and Republican candidates for secretary of state, suggested that voters cast absentee ballots, which are on paper.

Dennis, a Republican who was appointed secretary of state and is not running, disagreed.

"I think that is absurd. County clerks and recorders have always done a very efficient job in collecting votes."

Her advice to citizens hoping to ensure their choice counts? Make sure they vote. And take identification to the polls, Dennis said.

Voting machines statewide

County clerks now must wait for the secretary of state to detail rules on how to prevent voting machine tampering. Here's what some said when asked what their own plans are:

• ADAMS COUNTY

Carol Snyder, clerk and recorder, said Adams County will do more extensive testing prior to the election than is required by law. Her office will make sure machines are tested in a "realistic" environment prior to the election. A number of security routines are completed before elections can begin, plus there's a post election audit - where the electronic vote results are compared with the paper audit trail of the ballots.

• ARAPAHOE COUNTY

Nancy Doty, clerk and recorder, said the county has used DRE's voting machines for 20 years and never has had a problem. "So I am not concerned about using them in the November election. I am providing additional, hands-on election judge training for our new Edge II machines to ensure those people are well equipped with the knowledge to help run a successful election."

• BOULDER COUNTY

Joshua Liss, elections coordinator, said all of Boulder's electronic voting machines have a voter-verifiable paper audit trail - a receipt that prints out of the machine, showing voters the selections they have made. They can verify these selections or make changes, and when they are ready to cast their ballot, the receipt stays with the machine. This receipt is used in post-election audits to ensure that the votes recorded on the machine match the votes verified by the voter on the paper. Liss said he believes a big concern now is trying to rebuild voter confidence: "Regardless of the court ruling, the most damaging affect of this case has been the seeds of doubt that may have planted in voters' minds about the electronic voting equipment."

• DENVER COUNTY

Alton Dillard, communications director, said the county uses Sequoia Advantage and Edge voting machines, which are stand-alone units that cannot be hacked. Plus, the machines are stored in a secure warehouse and are checked prior to the opening of the polls to make sure they contain zero votes, have security seals intact and that the voter verifiable paper audit printers are secure. Anyone working on the voting machines in Denver must pass a CBI background check.

• JEFFERSON COUNTY

Susan Miller, director of elections, stresses that Jeffco's equipment is completely "stand alone" and is not Web based. "Anyone who wanted to disrupt the election totals through a voting machine would have to go to all 324 precincts to physically access the machines," she said. "For the machines to be totally compromised - for the results to be lost or tampered with - the voter would have to take the machines apart and interfere with the internal workings of the machines. All of this would be in front of other voters and of course, the election judges."

imsea@RockyMountainNews.com or 303-954-5438

Subscribe to the Rocky Mountain News