[House Hearing, 109 Congress]
[From the U.S. Government Publishing Office]
HEARING ON VERIFICATION, SECURITY AND PAPER RECORDS FOR OUR NATION'S
ELECTRONIC VOTING SYSTEMS
=======================================================================
HEARING
before the
COMMITTEE ON HOUSE ADMINISTRATION
HOUSE OF REPRESENTATIVES
ONE HUNDRED NINTH CONGRESS
SECOND SESSION
----------
Hearing held in Washington, DC, September 28, 2006
----------
Printed for the use of the Committee on House Administration
HEARING ON VERIFICATION, SECURITY AND PAPER RECORDS FOR OUR NATION'S
ELECTRONIC VOTING SYSTEMS
HEARING ON VERIFICATION, SECURITY AND PAPER RECORDS
FOR OUR NATION'S ELECTRONIC VOTING SYSTEMS
HEARING
before the
COMMITTEE ON HOUSE ADMINISTRATION
HOUSE OF REPRESENTATIVES
ONE HUNDRED NINTH CONGRESS
SECOND SESSION
__________
Hearing Held in Washington, DC, September 28, 2006
__________
Printed for the Use of the Committee on House Administration
U.S. GOVERNMENT PRINTING OFFICE
31-270 WASHINGTON : 2007
_____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; (202) 512�091800
Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�090001
COMMITTEE ON HOUSE ADMINISTRATION
VERNON EHLERS, Chairman
ROBERT W. NEY, Ohio JUANITA MILLENDER-McDONALD,
JOHN L. MICA, Florida California,
CANDICE MILLER, Michigan Ranking Minority Member
JOHN T. DOOLITTLE, California ROBERT A. BRADY, Pennsylvania
THOMAS M. REYNOLDS, New York ZOE LOFGREN, California
------
Will Plaster, Staff Director
George Shevlin, Minority Staff Director
VERIFICATION, SECURITY AND PAPER RECORDS FOR OUR NATION'S ELECTRONIC
VOTING SYSTEMS
THURSDAY, SEPTEMBER 28, 2006
House of Representatives,
Committee on House Administration,
Washington, DC.
The committee met, pursuant to call, at 10:03 a.m., in room
1310, Longworth House Office Building, Hon. Vernon Ehlers
(chairman of the committee) presiding.
Present: Representatives Ehlers, Ney, Doolittle, Millender-
McDonald, Brady and Lofgren.
Also Present: Representative Holt.
Staff Present: Paul Vinovich, Counsel; Gineen Beach,
Counsel; Peter Sloan, Professional Staff; George F. Shevlin,
Minority Staff Director; Charles Tracy Howell, Minority Chief
Counsel; Thomas Hicks, Minority Elections Counsel; Mathew A.
Pinkus, Minority Parliamentarian, Janelle Rene Hu, Minority
Professional Staff; Teri A. Morgan, Legislative Director,
Office of Representative Brady; Stacey E. Leavandosky, Chief of
Staff, Office of Representative Zoe Lofgren; and Joel
Vanderver, Intern, Office of Representative Zoe Lofgren.
The Chairman. Good morning, ladies and gentlemen. The
Committee on House Administration will come to order. First I
would like to advise and request all members of our audience
here today that all cellular phones, pagers, and other
electronic equipment must be silent to prevent interruption of
our business. So I would appreciate it if you would turn these
devices off, as I have.
The committee is meeting today for a hearing on electronic
voting machines and related issues. The election that will
occur in just a few weeks will be the first general Federal
election conducted since the Help America Vote Act of 2002,
better known as HAVA, was fully implemented. That act, passed
by this Congress in response to the voting system weaknesses
exposed during the 2000 recount in Florida, set new standards
for voting systems that were meant to make our elections more
accurate and accessible.
Three billion dollars were appropriated by the Congress
pursuant to HAVA, with most of these moneys being dedicated to
new equipment purchases by jurisdictions, localities, counties,
cities, townships, et cetera, that wanted to improve their
voting systems. As a result many jurisdictions are using new
equipment for the first time this year. It is no surprise that
there have been a few problems.
Though HAVA did not require the adoption of any particular
kind of technology, many jurisdictions purchased electronic
voting systems because they felt these systems were best able
to meet the requirements of HAVA. Not surprisingly, some
jurisdictions using this equipment for the first time have
encountered some difficulties. Just two weeks ago, in nearby
Montgomery County, Maryland polls were not able to open on time
because poll workers were sent to their posts without the cards
necessary to start up the electronic machines.
In the wake of this episode a column appeared in the
Washington Post under the headline: If Paper Ballots Restore
Trust in Elections, Let's Switch. The column noted people trust
paper ballots because they are real. You can hold them in your
hand and count them again if you need to.
Indeed, before it had electronic voting systems, Montgomery
County used a punch system. Need we be reminded of the problems
we had with that system.
I direct your attention to the screen above. The audience
can look at that one, we will look at this one. This is a
reminder of what we saw in the 2000 election in Florida, images
of people with paper ballots. This one is a group of people
staring at paper punch cards trying to figure out if they
constitute a vote, and if so, for whom.
If you look at the second slide, you see how closely these
ballots were being examined by groups.
And the third slide shows the extreme: putting things under
the magnifying glass. You can see this man has got paper.
Now, I am not showing these to condemn paper, I am just
pointing out that punch cards with paper, rather thick paper at
that, have caused some serious problems. Simply saying ``Let's
use paper,'' as some people are saying, does not mean all the
problems go away. We have to consider all the different aspects
of it, and these pictures, as you can tell, were taken in
Florida during the 2000 recount. That will go down in history,
I am sure, because of the recount and the ramifications.
These images do not inspire trust and confidence either in
the punch card system or in voting systems in general. As we
look at this problem, it is worthwhile to remember the famous
words of H.L. Mencken who once said, ``For every complex
problem there is an answer that is clear, simple, and wrong.''
We would like to have answers that are clear and simple,
but we certainly do not want wrong answers, and so we are going
to proceed with this very thoroughly and deliberately to try to
make sure that we have good answers that are right.
Unfortunately, the problem some jurisdictions have experienced
with their new systems have caused some to suggest that we
should revert to a reliance on paper, the so-called ``paper
trail'' or ``paper tape.'' We know frompainful and bitter
experience that paper systems also can fail to deliver accurate results
and are susceptible to manipulation.
To ignore this reality and assert that paper somehow
ensures integrity or a correct result is simplistic and wrong.
In fact, no voting system by itself can guarantee election
integrity. The best system on earth will fail if not properly
maintained, deployed and operated, and that is the key point
that we have to remember.
Even though I am a physicist and I have used computers
since 1957, I am not saying by virtue of these comments that
paper is bad. Electronics, of course, is good. I have used that
for many years. I know that can fail too if not programmed or
operated properly.
I believe the important point is to design the best system
you can, but make sure you have auditability built in, whether
it is paper or some other electronic device.
Our hearing will examine a range of issues related to
electronic voting machines. We will hear about their problems
but also about their benefits. We will also hear about the
experience in one jurisdiction that tried to address the
security concerns of a paperless system by requiring the
machine to generate a paper trail.
This hearing is being held to educate the members and the
public about these complicated issues. I hope when the hearing
is over, we will have a better understanding of the problems
and benefits of these new technologies. I also hope that as we
look for solutions to these complicated problems, we resist the
temptation to settle on answers that are clear, simple and
wrong.
[The information follows:]
[GRAPHIC] [TIFF OMITTED] T1270A.001
[GRAPHIC] [TIFF OMITTED] T1270A.002
The Chairman. Now I would like to ask unanimous consent
that the gentleman from New Jersey, Representative Russ Holt,
who is the author of a bill dealing very much with one aspect
of this, be allowed to join us on the dais today and that he
may be permitted to ask questions of the witnesses and enter
his statement into the record. Without objection, so ordered.
[The information follows:]
[GRAPHIC] [TIFF OMITTED] T1270A.003
[GRAPHIC] [TIFF OMITTED] T1270A.004
[GRAPHIC] [TIFF OMITTED] T1270A.005
[GRAPHIC] [TIFF OMITTED] T1270A.006
[GRAPHIC] [TIFF OMITTED] T1270A.007
[GRAPHIC] [TIFF OMITTED] T1270A.008
[GRAPHIC] [TIFF OMITTED] T1270A.009
[GRAPHIC] [TIFF OMITTED] T1270A.010
[GRAPHIC] [TIFF OMITTED] T1270A.011
[GRAPHIC] [TIFF OMITTED] T1270A.012
[GRAPHIC] [TIFF OMITTED] T1270A.013
[GRAPHIC] [TIFF OMITTED] T1270A.014
[GRAPHIC] [TIFF OMITTED] T1270A.015
[GRAPHIC] [TIFF OMITTED] T1270A.016
[GRAPHIC] [TIFF OMITTED] T1270A.017
[GRAPHIC] [TIFF OMITTED] T1270A.018
[GRAPHIC] [TIFF OMITTED] T1270A.019
[GRAPHIC] [TIFF OMITTED] T1270A.020
[GRAPHIC] [TIFF OMITTED] T1270A.021
[GRAPHIC] [TIFF OMITTED] T1270A.022
[GRAPHIC] [TIFF OMITTED] T1270A.023
[GRAPHIC] [TIFF OMITTED] T1270A.024
[GRAPHIC] [TIFF OMITTED] T1270A.025
[GRAPHIC] [TIFF OMITTED] T1270A.026
[GRAPHIC] [TIFF OMITTED] T1270A.027
[GRAPHIC] [TIFF OMITTED] T1270A.028
[GRAPHIC] [TIFF OMITTED] T1270A.029
[GRAPHIC] [TIFF OMITTED] T1270A.030
[GRAPHIC] [TIFF OMITTED] T1270A.031
[GRAPHIC] [TIFF OMITTED] T1270A.032
[GRAPHIC] [TIFF OMITTED] T1270A.033
[GRAPHIC] [TIFF OMITTED] T1270A.034
[GRAPHIC] [TIFF OMITTED] T1270A.035
[GRAPHIC] [TIFF OMITTED] T1270A.036
[GRAPHIC] [TIFF OMITTED] T1270A.037
[GRAPHIC] [TIFF OMITTED] T1270A.038
[GRAPHIC] [TIFF OMITTED] T1270A.039
[GRAPHIC] [TIFF OMITTED] T1270A.040
[GRAPHIC] [TIFF OMITTED] T1270A.041
[GRAPHIC] [TIFF OMITTED] T1270A.042
[GRAPHIC] [TIFF OMITTED] T1270A.043
[GRAPHIC] [TIFF OMITTED] T1270A.044
[GRAPHIC] [TIFF OMITTED] T1270A.045
[GRAPHIC] [TIFF OMITTED] T1270A.046
[GRAPHIC] [TIFF OMITTED] T1270A.047
[GRAPHIC] [TIFF OMITTED] T1270A.048
[GRAPHIC] [TIFF OMITTED] T1270A.049
[GRAPHIC] [TIFF OMITTED] T1270A.050
[GRAPHIC] [TIFF OMITTED] T1270A.051
[GRAPHIC] [TIFF OMITTED] T1270A.052
[GRAPHIC] [TIFF OMITTED] T1270A.053
[GRAPHIC] [TIFF OMITTED] T1270A.054
[GRAPHIC] [TIFF OMITTED] T1270A.055
[GRAPHIC] [TIFF OMITTED] T1270A.056
[GRAPHIC] [TIFF OMITTED] T1270A.057
[GRAPHIC] [TIFF OMITTED] T1270A.058
[GRAPHIC] [TIFF OMITTED] T1270A.059
[GRAPHIC] [TIFF OMITTED] T1270A.060
[GRAPHIC] [TIFF OMITTED] T1270A.061
The Chairman. Welcome, Representative Holt. We are pleased
to have you here. This is one of the few times in the Congress
when you will find two physicists sitting at the front desk
listening to testimony.
At this time, I would like to recognize the Ranking Member,
Ms. Millender-McDonald, for any opening remarks she may have.
Ms. Millender-McDonald. Thank you, Mr. Chairman, and good
morning to you and all the witnesses and guests here this
morning. I would like to thank you, Mr. Chairman, for calling
this very important hearing on electronic voting machines. I am
sure that you have heard from your constituents and
constituents around the country, as I have heard, that folks
are wary about these voting machine apparatuses and they are
not sure whether or not they are working.
Let me also thank you, Mr. Chairman, for welcoming
Congressman Russ Holt to sit on the panel this morning. It was
just 6 years ago that the 2000 Presidential election brought to
light many problems with the elections process in our country.
We encountered a wide range of frustrations with the election
administration. Some of the most infamous problems involved
punch cards with all of the hanging chads that the Chairman has
just shown you. Others involved voters who were turned away
from the polls without the opportunity to cast a vote.
In response, this committee worked diligently and passed
the Help America Vote Act, which is HAVA, to rid the country of
outdated voting equipment and to ensure no eligible voter is
turned away from the polls without casting a vote. Despite the
passage of HAVA, however, many problems still remain, as we
witnessed during the 2004 election and in several primaries
this year.
Today I hope to hear about methods of addressing these
issues, even if we may not be able to implement suggested
recommendations before the November election. I also hope that
this oversight hearing will serve as a forum for the American
people to gain confidence in direct recording electronic voting
system machines.
After the 2000 election, DRE, as we call them, machines
were viewed as the answer to hanging chads and century-old
lever machines. DRE machines also allowed individuals with
disabilities to vote in private and without assistance for the
first time. They have also been supported by a number of civil
rights organizations, given the ease with which they are able
to be programmed to display ballots in foreign languages.
However, as we are aware, many concerns have been raised
about the integrity and the reliability of these DRE machines.
In fact, at times it may be seen that thesemachines have raised
many more questions than answers. For example, some have called for a
voter-verified paper audit trail for DRE machines. Some States already
require this function for DRE machines.
But even this similarly simple method raises numerous
concerns. For example, when mechanisms serve as the official--
what mechanism serves as the official record in a recount? That
is a question that has been raised often. What happens when the
printer jams? Would the votes which were properly recorded by
the DRE be thrown out if they are not similarly recorded on the
paper? Those are the questions that have been raised often.
I am also interested in hearing from our witnesses,
especially the local election officials, regarding their views
about the wisdom of imposing a Federal mandate which would
specify which type of election equipment should be used. These
decisions have mostly been left up to the State and local
officials throughout our country's history, and I would like to
know what the impact of a Federal mandate and a standard in
this area would be, what precedent it would set for future
election administration mandates on the States by the Federal
Government, and how these mandates would be funded.
In addition to discussing established concerns about DRE
machines, I hope the witnesses invited today will address the
security of all voting equipment. Only one-third of Americans
will cast ballots on DRE machines, and although that number is
growing, it still means that two-thirds of our voters will be
casting ballots using other methodologies. Are these machines
secure, are they reliable, are they subject to a suitable level
of scrutiny?
I am concerned that all of the media attention to voting
security will inadvertently discourage voters from going to the
polls, resulting in voter suppression. As we witnessed a few
weeks ago in Maryland, voting machine reliability, stability
and accuracy was not the inherent cause of mayhem. The lack of
poll-worker training and other human factors of election
administration caused problems and confusion at the polls for
both voters and poll workers. If we do not adequately address
all of these issues, voters may feel as if their votes will not
be counted and decide not to participate on election day.
This is one reason why I offered an amendment to double the
funding for the college poll-worker training program. This
program encourages college-age students to serve as poll
workers and to become more involved with the election
administration process.
The electoral process is not perfect, Mr. Chairman.
Improvements to the electoral process itself still need to be
made. Fortunately, the Help America Vote Act of 2002 is a solid
foundation upon which we can institute further electoral
improvements. HAVA made it easier for voters to cast a ballot
and harder for people to knowingly commit crime and fraud,
which is why we need to appropriate the remaining $800 million
balance which was authorized in title 2 of HAVA to fully fund
the States and give HAVA a chance to work.
As I have stated in the past, it is guaranteed that your
vote will be lost if you don't cast a ballot. I would encourage
every eligible voter to cast a ballot, no matter how harsh the
rhetoric about the November elections and no matter how that
ballot is cast: by DRE machines, absentee ballots, provisional
ballots or whatever. Americans need to get out in November with
the confidence that their vote will be counted correctly.
Exercising this precious right is more important than the
outcome of the elections, Mr. Chairman.
I hope we can convene additional hearings in the future to
examine any shortcomings in election administration and any
impediments that voters experience in exercising their
constitutional rights.
I look forward to working with the Chairman and other
members to continue to improve the voting process and I will
continue to seek full funding of the Election Assistance
Commission title 2 grants to ensure that the EAC can continue
its crucial work to improve the electoral process. Even if one
voter is disenfranchised, that is one voter too many. Thank
you, Mr. Chairman.
[The information follows:]
[GRAPHIC] [TIFF OMITTED] T1270A.062
[GRAPHIC] [TIFF OMITTED] T1270A.063
[GRAPHIC] [TIFF OMITTED] T1270A.064
The Chairman. I thank the Ranking Member for her comments,
and I especially want to reinforce something you said. Voting
in this nation has traditionally been controlled and operated
by the local municipalities, cities, townships, counties and by
the states. The only reason the federal government entered this
is because of the problems with a federal election of a
president in 2000, and we continue to have great respect for
the localities and the States which have the responsibilities
for implementation. We are simply trying to establish standards
only for the federal elections.
Ms. Lofgren, do you have an opening statement?
Ms. Lofgren. Thank you, Mr. Chairman. I am glad that we are
having this hearing today and delighted that we are joined by
our colleague, Mr. Holt, the author of H.R. 550. I am inclined
to think that Mr. Holt's approach is the right one, but I have
declined to be a coauthor of this bill until this hearing
because I wanted to try and keep an open mind on this subject
and listen to the witnesses, without being a coauthor of the
bill. But coming from Silicon Valley, you can imagine that I
have had considerable input from people who are quite skilled,
and I guess the question that needs to be answered is can this
election be hacked.
There are many issues, I am sure we will get into them
today, but the integrity of the election process isabsolutely
essential to the sustenance of a vigorous democracy. Elections do
count, as we know. And the direction that our country is going in will
be decided by elections. If we can't know for a certainty that that
process is not corrupted, then it really goes to the core of the spirit
of our Nation and our future as a democracy.
So I realize we are not in a markup mode here today, we are
here to get information. I am going to listen very carefully to
all the witnesses, but I am hopeful that we could take quick
action because this--my own State of California has already
moved in the direction that Mr. Holt is suggesting with the
verifiable paper audit trail. We need to be able to let the
voters of America know that their elections are on the up-and-
up and their vote really does count and the election has not
been hacked.
So with that, Mr. Chairman, I thank you for holding this
hearing and I will yield back because I am eager to hear a very
large panel of witnesses before we are called to vote. Thank
you very much.
The Chairman. Thank you for your statement.
Mr. Holt's statement will be entered into the record as we
mentioned earlier.
In setting up the panel for this hearing I was determined
to try to get the broadest representation possible. I would
have had to have 27 witnesses to totally accomplish that, but
the fact is that we have tried very hard, as indicated by the
large number of witnesses we do have.
I am very pleased with the quality of the witnesses who
agreed to appear and we now turn to Dr. Felten for his
testimony. He is a professor in the Department of Computer
Science at Princeton University, which also happens to be Mr.
Holt's district. He recently completed a study of an electronic
voting system and will give us a report on his findings. I also
understand you have a demonstration for us, Dr. Felten. You may
begin.
STATEMENT OF EDWARD W. FELTEN, PROFESSOR, DEPARTMENT OF
COMPUTER SCIENCE, PRINCETON UNIVERSITY
Mr. Felten. Thank you, Mr. Chairman, and members of the
committee for the opportunity to testify today----
Ms. Lofgren. Mr. Chairman, there are lights on that. Is
there a way--much better.
Mr. Felten. From a security standpoint what distinguishes
computerized voting systems from traditional systems is not
that computers are easier to compromise but that the
consequences of compromise can be so much more severe.
Tampering with an old-fashioned ballot box can affect a few
hundred votes at most, but injecting a virus into a single
computerized voting machine can potentially affect an entire
election.
Two weeks ago my colleagues, Ariel Feldman and Alex
Halderman, and I released a detailed security analysis of this
machine, the Diebold AccuVote-TS which was used in Maryland,
Georgia, and elsewhere. My written testimony summarizes the
findings of our study.
One main finding is the machines are susceptible to
computer viruses that spread from machine to machine and
silently transfer votes from one candidate to another. Such a
virus requires moderate computer programming skills to
construct. Launching it requires access to a single voting
machine for as little as 1 minute.
I will now demonstrate this using a virus we constructed in
our laboratory. We have set up here a simulated election for
President between George Washington and Benedict Arnold. It is
election day morning and we just opened the polls. No votes
have been cast yet. I will start by casting the first vote.
When I checked in at the polling place at the front desk, the
poll worker gave me this voter card which I now insert into the
machine. I press the start button and I choose to cast my vote
for George Washington. The machine asks me to confirm my choice
and I confirm my choice and cast my ballot.
The second vote is similar. I insert another voter card, I
choose George Washington again, and again I confirm and cast my
ballot. The third voter inserts another voter card and votes
again for George Washington. The correct vote count in this
election obviously is George Washington, three; Benedict
Arnold, zero.
Now it is the close of election day. A poll worker inserts
a special supervisor card into the machine, enters a PIN code,
and tells the machine to end the election and tally the votes.
The machine will now print out a paper tape summarizing the
ballot count. When I cast my votes earlier my choice of
candidate was recorded in the machine's electronic memory. This
record of my vote was invisible to me. I had no way of
verifying whether it was recorded correctly or whether it was
changed after it was recorded.
In this machine the records were modified by our virus.
This paper tape printed out by the machine reports the
elections result. It shows George Washington with one vote and
Benedict Arnold with two. Every record in the machine and
outside the machine is consistent with this fraudulent result.
Our technical report referenced in my written testimony
goes into considerable detail about this problem and explains
why existing election procedures are not sufficient to prevent
it. One lesson is that security depends on getting the
technical details right. Too often the designers of this
machine fail to get the details right. A good example is the
access door here on the side of the machine. It protects the
removable memory card that stores the votes, so the door should
be locked securely and access to the keys should be strictly
limited; but in fact tens of thousands of AccuVote machines can
all be opened with the very same key, and this very same key is
used widely in office furniture, jukeboxes and even hotel
minibars. It is easily purchased on the Internet. This one I
bought online from a jukebox supply shop and it does open the
machine.
The implications of our study go beyond just this machine
and reveal broader systemic problems. More worrisome than any
specific vulnerability is that this system, despite its many
problems, was certified, purchased and deployed by many States
and counties and has been used in important elections.
We can do more to improve the security of our e-voting. I
detail many recommendations in my study and written testimony,
but one important safeguard is a voter-verifiedpaper audit
trail. A well-designed paper trail can improve security and enhance
voter confidence without compromising accessibility. Certainly paper
records have their drawbacks, but they have different failure modes
than electronic records do and the combination of electronic and paper
records can be more robust against fraud than either one would be
alone.
Getting the details of voting right is difficult,
especially in today's high-tech polling place, but failure is
not an option. The stakes are too high and the risk of
malfunction or fraud too great to make our current course
tenable in the long run.
Election experts, accessibility experts, and computer
security experts all have a role to play in improving our
voting system. If we work together we can solve this problem
and give the American people the voting system they deserve.
Thank you for your time and attention.
The Chairman. Thank you very much for your testimony.
[The statement of Mr. Felten follows:]
[GRAPHIC] [TIFF OMITTED] T1270A.065
[GRAPHIC] [TIFF OMITTED] T1270A.066
[GRAPHIC] [TIFF OMITTED] T1270A.067
[GRAPHIC] [TIFF OMITTED] T1270A.068
[GRAPHIC] [TIFF OMITTED] T1270A.069
[GRAPHIC] [TIFF OMITTED] T1270A.070
[GRAPHIC] [TIFF OMITTED] T1270A.071
[GRAPHIC] [TIFF OMITTED] T1270A.072
[GRAPHIC] [TIFF OMITTED] T1270A.073
[GRAPHIC] [TIFF OMITTED] T1270A.074
The Chairman. Our second witness is Gary Smith. Mr. Smith
is the election director in Forsyth County, Georgia. Georgia
uses a paperless DRE system statewide, and for those who don't
know what DRE stands for it is direct recording electronic
computer. Basically it is a type of computer we have displayed
here.
Mr. Smith uses a Diebold system that was the subject of the
Princeton study. Mr. Smith also participated in the recount of
the Cuyahoga County primary conducted on a DRE system with a
paper audit trail. Mr. Smith, you are recognized.
STATEMENT OF GARY SMITH, ELECTION DIRECTOR, FORSYTH COUNTY, GA
Mr. Smith. Well, as was mentioned, my name is Gary Smith, I
reside----
The Chairman. Is your microphone on?
Mr. Smith. My name is Gary Smith and, as you mentioned, I
am the election director for Forsyth County, Georgia, a county
just north of Atlanta. It is quite a fast-growing county. We
have about 80,000 registered voters and we are one of the top
fastest-growing counties in the United States, so we have a lot
of issues that we have to deal with all the time.
One of the things I think that is important maybe is to
look at what those of us as election directors--how we come
about. I am actually appointed through a selection committee
that comes about where a grand jury is brought forth, they pick
a panel of people who have the background to be able to do
this. It is then sent up to the chief superior court judge and
then I am selected from that. I was selected from that process.
I am in my second term as the director of elections. It is
a term of 4 years, and it is a nonpartisan position. Prior to
coming into this position I spent most of my time working in
the private sector. I retired. I was running various companies,
and I have worked most of my life in industrial automation. So
I have a technical background. I have an undergraduate degree
in electrical engineering and I am a certified election
registration administrator from a program administered by
Auburn University.
As a director of elections, one of the things that I have
been privileged to do is to sit on a task force, several of
them. One has been from the Georgia task force, which allows me
to be able to participate and look at new processes and
equipment that we apply to elections in our county and State.
In addition to that, I served on a national task force for
election reform for 2004 where we looked at all the processes
across the country with regards to elections. In addition, I
think you just mentioned I did lead the manual recount for the
Cuyahoga County VVPAT so I have some practical experience with
that and I was happy to be able to do that. I spent a week at
it, as a matter of fact.
We have implemented the DREs. The one that you are looking
at right here, which is the Diebold-TS unit, my county and 158
counties in Georgia implemented this during the general
election of 2002. We have held, from what I heard was the last
count, something like 2,500 elections in our State. In addition
to that I have held elections on special elections, primaries,
general elections, run-offs and just about any kind of
election, and a municipal election as well. So, again, we have
a lot of experience with them.
One of the things that I think has been talked about a lot
and I think we have to deal with is how do you look at the
security and integrity of this kind of equipment. It starts,
obviously, with the vendor who builds the equipment, goes
through the independent testing laboratories that then look at
it to make sure what we are receiving has the technical
wherewithal to be able to provide us with a piece of equipment
that really meets what our needs are. Thirdly, we have in our
State, which I am very proud to talk about, the Center for
Election Systems, a program administered by Kennesaw State
University and Dr. Britt Williams, a well-known authority in
elections.
We do all of our creation of our ballot cards and that sort
of thing through this group, and so it is another level of
testing that we have that goes on.
Lastly, it is up to those of us who are election directors
to hold these elections, so I am tasked with a lot of the
things that Mr. Felten has talked about, which is maintain the
security and integrity of the process that goes on with
elections. I guess we are where the rubber meets the road as
much as anything.
So that is our job. I am not going to go through all the
details with regards to certification because it is certainly
going to take a lot more than a few minutes, but it is in my
paper and I hope that you will look at it. I think where we
pick it up is where we pick up the memory cards, as Mr. Felten
has mentioned, that come to us from the Center for Election
Systems, the process of making sure that they come to us under
the chain of custody manners, that we know that there is at
least more than one person that has access to what we are
talking about and they are looking at.
We go through a process called logic and accuracy testing.
This is when the process that he has talked about goes through
the first part, where we are taking the memory cards, we are
marrying them essentially to the voting machine, and then we
are taking them through the testingprocess, at which time then
we lock the machines up and we pass them on to the next level, which
really is the election poll worker himself.
And what I would like to do is to show you some of the
chain-of-custody forms and I think they are in front of you
too. If they are not, I am going to show you one actually that
is going to be--okay. It is as good as it can get up there but
I think most of you can probably see it.
What I am pointing out in it--is it okay if I stand up?
The Chairman. As long as you carry the microphone with you
so all the people in the overflow room can hear you too.
Mr. Smith. Can you hear me now?
The Chairman. Yes.
Mr. Smith. All right. I think what is critical about this,
I think this is one of the things maybe that because we are
doing it statewide, we have an awful lot of good chances to be
able to work the processes out. And I think Mr. Felten, one of
the things he said is you need to have good chain of custody in
these things. This actually is for the precinct Big Creek. This
is actually an actual form that we are using. It says here item
number 1, custodian certification form for the AccuVote-TS
units that are going to be used. Under point number 2 what I
have got here is the touch screen serial number, which has not
got a number in here, 116827.
Then across here what you are looking at is all of the
tests that we take individually to run on the machines. This
takes about 15 minutes per machine to run. It is a process that
is done under my direction, and we actually have done this for
500 machines for the upcoming election.
The next point that is important to look at is there is a
seal number that is right here. That seal number, what I am
going to show you is how it is carried forward to the process
where when we are holding the election at the precinct, what
happens with it. This machine then is sealed up, it has a wire
serial number on it. So there is no access to this machine once
the logic and accuracy test is done.
Now, the next form I am going to show you is right here.
This is a form then that is carried forward to the precinct
itself so that when the poll workers, poll manager and his
assistant, this is their responsibility; this is a form that is
signed in triplicate, one goes to the Secretary of State, one
goes to me and one goes to the clerk of the superior court. You
will notice again it is for precinct Big Creek 01. This is the
recap sheet that goes with it. Here again is the serial number.
If we had looked back before, we would find that that serial
number is the same one as here.
Here is the serial number that then shows up on--that is
transferred from the original L&A testing. Now what happens
with it is we open up the machines, we go through it, we do the
count number, and then at the end of the election, because this
is the recap sheet, the key part here is that there is another
mechanical low-tech seal put on it. It is a wired seal so it is
kept on there all the time.
That is the process that we go through. I wanted you to be
able to see that.
The Chairman. I am going to have to ask you to wrap up
because we have a lot of witnesses and a lot of discussion.
Mr. Smith. Okay. I am sorry.
The Chairman. Is that it?
Mr. Smith. The other part I wanted to talk about, and I
think this has to do with the comments that Ms. Millender-
McDonald said, is what is the confidence that people have in
it. I would like to at least respond to that at another time,
because we have done surveys in our county, too, which show
that 99 percent of the people feel that the process is an
excellent process. So there is a high level of confidence in
our equipment.
The Chairman. All right. We can defer that to the question
period.
Mr. Smith. Thank you very much.
The Chairman. Thank you.
[The statement of Mr. Smith follows:]
[GRAPHIC] [TIFF OMITTED] T1270A.075
[GRAPHIC] [TIFF OMITTED] T1270A.076
[GRAPHIC] [TIFF OMITTED] T1270A.077
[GRAPHIC] [TIFF OMITTED] T1270A.078
[GRAPHIC] [TIFF OMITTED] T1270A.079
[GRAPHIC] [TIFF OMITTED] T1270A.080
[GRAPHIC] [TIFF OMITTED] T1270A.081
[GRAPHIC] [TIFF OMITTED] T1270A.082
[GRAPHIC] [TIFF OMITTED] T1270A.083
[GRAPHIC] [TIFF OMITTED] T1270A.084
[GRAPHIC] [TIFF OMITTED] T1270A.085
[GRAPHIC] [TIFF OMITTED] T1270A.086
[GRAPHIC] [TIFF OMITTED] T1270A.087
[GRAPHIC] [TIFF OMITTED] T1270A.088
[GRAPHIC] [TIFF OMITTED] T1270A.089
The Chairman. As a reminder to those, I should have
mentioned it before, you have the little device in front of you
with the lights on it. Green means go, yellow means sum up, red
means you are in deep trouble. So please keep an eye on the
clock.
Next I am pleased to recognize Ms. Barbara Simons, past
president of the Association for Computing Machinery, and she
has done a lot of work on voting systems. Dr. Simons, you are
recognized.
STATEMENT OF BARBARA SIMONS, MEMBER, U.S. PUBLIC POLICY
COMMITTEE, ASSOCIATION FOR COMPUTING MACHINERY
Ms. Simons. Good morning, Mr. Chairman, members of the
committee. On behalf of the computing professionals that
constitute the Association for Computing Machinery I want to
thank you for the opportunity to testify today about e-voting
system security and the need for voter-verified paper trails.
Secure, reliable, usable and accessible voting systems are
critical toward assuring transparent, fair and inclusive
elections. These are not mutually exclusive goals. I shall
discuss aspects of both security and accessibility this
morning.
First, security. Because of the risks of software bugs,
malicious code or computer failure, we cannot trust that the
results in a paperless voting machine accurately reflect the
will of the voters. That is why voter-verified paper ballots or
audit trails (VVPATs, as we refer to them) are needed. VVPATs
are automatically produced by an optical scan system, since the
ballot is verified by the voter. Fortunately, 48 percent of
counties have optical scan systems so they already have VVPATs.
Optical scans can be used together with tactile ballot
sleeves or accessible marking devices for accessibility. Some
DREs have been retrofitted to produce VVPATs; in fact, all of
them for use in California, as Congresswoman Lofgren said.
Two years ago ACM, a leading computer society, issued a
statement calling for well-engineered voting machines that
allow every voter to verify his or her record has been
accurately cast by the inspection of a physical (e.g. paper)
record.
At its 2006 national convention, the League of Women Voters
passed a resolution calling for voter-verified paper ballots or
records to be used for audits and recounts. The League also
urged that routine random audits be conducted in every
election.
Both the ACM statement and the League's resolution can be
found in my written testimony.
In summary, as a defense against malicious or buggysoftware
we must have: reliable, well-engineered VVPATs, policies and procedures
that guarantee the integrity of the paper records; security storage and
delivery of machines and so on, mandatory random manual audits of
VVPATs; and a full manual recount if discrepancies are uncovered,
unless there is evidence that the VVPATs have been compromised.
I will now discuss accessibility.
People with disabilities should be able to vote privately
and independently and be able to verify their votes.
HAVA does not require the DREs be used for accessibility.
There is evidence that a number of people with disabilities are
finding that DREs are not meeting their accessibility needs.
Kelly Pierce, a nationally known advocate for the blind and
visually impaired, reviewed tactically discernable controls,
spoken prompts, visual display, poll worker assistance, volume
control and normalization, and ballot review for four voting
machines. In his report for Cook County State Attorney's
Office, Pierce concluded that if any one of the four machines
were to be deployed in Chicago or suburban Cook County, many
voters with disabilities, particularly blind voters, would not
be able to cast a ballot independently and privately.
Blind computer scientist Noel Runyan discussed his
frustration with his hour-long voting experience in the 2004
Presidential election, and I quote: It took me 30 minutes to
work my way through the ballots and make my selection. After
that I had quite a bit of trouble getting into the review mode
to get a full list of all my selections. When I did, it went on
and on for 23 minutes, like a long uncontrolled drink from a
firehose. The review function read each item and then at the
very end said my selection was for that item. It even threw in
details of what the fiscal impact would be and took forever.
``This is completely backwards.''
He went on to say: ``From the time I signed in and got my
voter smart card, it took 8 minutes to reboot the audio voting
machine; 30 minutes to make my choices; 23 minutes to review
and verify; and another 4 minutes to make a correction and
record my vote. Not counting the hour waiting in line, it took
me about 65 minutes to mark and record my ballot.''
We do not have to settle for inaccessible voting systems.
Old technologies such as text to audio devices, tactile ballot
sleeves, and ballot market and generating systems could be
combined with new technologies that make the entire voting and
verification process accessible, while remaining auditable.
Technology, if engineered and tested carefully and if
deployed with safeguards against failure, can reduce error
rate, provide more accessibility, increase accountability and
strengthen our voting system. However, the current state of e-
voting technology leaves us far short of these goals. We need
paper trails and manual audits to protect us against failures
and attacks. We need additional research to make voting
machines more usable, secure and accessible. And we need to
work together to achieve these goals. Thank you.
The Chairman. Thank you very much.
[The statement of Ms. Simons follows:]
[GRAPHIC] [TIFF OMITTED] T1270A.090
[GRAPHIC] [TIFF OMITTED] T1270A.091
[GRAPHIC] [TIFF OMITTED] T1270A.092
[GRAPHIC] [TIFF OMITTED] T1270A.093
[GRAPHIC] [TIFF OMITTED] T1270A.094
[GRAPHIC] [TIFF OMITTED] T1270A.095
[GRAPHIC] [TIFF OMITTED] T1270A.096
[GRAPHIC] [TIFF OMITTED] T1270A.097
[GRAPHIC] [TIFF OMITTED] T1270A.098
[GRAPHIC] [TIFF OMITTED] T1270A.099
The Chairman. Next we turn to Mr. Keith Cunningham who is
the election director in Allen County, Ohio. He serves on the
board of advisors to the Election Assistance Commission and
also participated in the Cuyahoga County recount study
performed by the Election Science Institute.
Mr. Cunningham, you are recognized.
STATEMENT OF KEITH CUNNINGHAM, ELECTION DIRECTOR, ALLEN COUNTY,
OH
Mr. Cunningham. Thank you, Mr. Chairman, and let me say
what an honor it is for a guy from a small town in Ohio to be
sitting here before you today in this tremendous forum.
I am also the immediate past president of the Ohio
Association of Election Officials, and I want to say to you
before I begin, when I wake up in the morning and head for my
job I am feeling pretty good about it. I believe the job that I
am involved in, which is an elections director, has meaning and
has merit and is doing things to make our country and our
community better.
One thing I think we all agree on is that electronic voting
needs some type of verification system, some component that
allows it to be audited. And of course all systems need that,
but as my predecessors have said, a hard ballot system is
rather obvious how we audit those. Personally I do not have any
particular aversion to voter-verified paper audit trails.
However, in Ohio the system is that the voter-verified
paper audit trail becomes the official ballot of record for
recount purposes. I must say to you, clearly I am adamantly
opposed, based on the experience I have had in Cuyahoga County,
to that. I believe that program is setting election officials
up for failure at this point in time.
If the VVPAT was to be extended to voters as a courtesy by
which to check their votes, I have no problems with that. I
think statistics indicate voters don't even use it when it is
available to them. The studies on hand show that maybe less
than 10 percent of the people actually utilize that.
We looked at approximately 350 VVPAT tapes in Cuyahoga
County, and over and over and over we encountered tapes that
were missing, that were in some way compromised. You have the
numbers before you, so I won't bore you with the statistics,
but I think two of them are very important for you to remember.
Nearly 17 percent of the VVPAT tapes reviewed by that team--and
that team consisted of a lot of Ohio election officials that
came in to help participate--nearly 17 percent of those tapes
showed a vote discrepancy of one to five votes from the
electronic machine, and nearly 10 percent of those tapes were
either destroyed,blank, missing, taped together, or in some
other way compromised.
My point is this: that when you use the VVPAT at this point
in time as the official record of a recount vote, it actually
serves to disenfranchise the voter because votes are lost in
the VVPAT process. They are simply not there and cannot be
retrieved. We could have retrieved those votes by other means
from those machines, but in Ohio we are not allowed to because
the recount official ballot of record in a recount becomes the
VVPAT.
So I would submit to you that it was the paper that
actually caused the count to be in question. Additionally, and
we have some photographs here I would like to show you, there
is no reliable technology for which to recount VVPATs. To ESI's
credit they had a makeshift kind of crank thing that you could
put the tapes in and reel them up. These things are sort of
like wrestling octopuses.
As you can see--let's go to the next one, the next one.
These are some of my friends.
This is just kind of the scene. There you can see the
machine. I will tell you what I equate this to. We are pretty
agricultural in my part of Ohio. I equate this to planting
several hundred acres of wheat with a million-dollar planting
machine and harvesting it by hand like the Amish used to, and
stacking it up in the fields.
This was mind-numbing, to say the least. Now keep in mind
we went through 300-some tapes. There were probably near 4,000
tapes in Cuyahoga County. This took us two 10-hour days,
actually 2\1/2\ because the first half day was upsetting the
system.
Continue, please.
This is simply a tape with no record printed on it.
Continue again, please.
Same thing. This is the information that we are looking
through on the tapes trying to--and, remember, at least this is
Ohio's rule, that when you recount a race, you can't recount
any other race. You can only recount the race that is going to
be recounted. So if you have got 27 candidates on the ballot,
you have got to reel through all 27 to get to the race, maybe a
down ballot race.
This is an example of one that is taped together that has
obviously been in the machine, it accordioned in the machine. I
don't know, that black line probably represents 20 or 30 votes.
There was no way to reconcile that. There is another torn tape,
another shot of the crude machine we were using to do this.
I think they speak for themselves. I honestly don't have
any reason to believe DREs don't record votes accurately but I
understand the concerns and I do believe that we should have
some kind of audit system for it. I would say to you,
considering the size and scope of the deployment of voting
machines in the last 12 to 24 months in America, I think
election officials have done a pretty darn good job. We are
working on improving it.
Unfortunately, I believe--and I will wrap up here in just a
second--I believe it is the environment which is slowing our
pace of improvement. As a local election official I am going to
tell you, I feel like I am in a cross-fire, and I know many of
my colleagues do; and that cross-fire is a very, very polluted
conversation, and it is being polluted with political
interests, corporate interests and scientific one-upmanship.
And I often wish I had as many people helping me find the
solutions as I did identifying the problems. It would make my
job an awful lot easier.
I want to echo the remarks earlier, that I do believe we
should continue to fund HAVA. I think the underfunding of HAVA
sends a very inconsistent message to those of us out there
trying to do this on a daily basis. I would say to you also,
please allow us to finish what has been started and what is in
motion before we begin to tinker with this. We have been given
a set of tasks that are very, very hard to manage. And, again,
in the scope of the deployment that has taken place in this
country, I don't want to say there weren't problems in it, but
I think my colleagues have done a very good job and I would
hope that in the future when we do begin to debate and speak
about this, we can do it in on honest and direct terms, without
misrepresentations, half truths, and focus on what it is we
need to do to cure these problems and make America's
elections--give people confidence in them. I think it is too
far to--too much to expect any less than that.
Thank you for your time. I appreciate it.
The Chairman. Thank you.
[The statement of Mr. Cunningham follows:]
[GRAPHIC] [TIFF OMITTED] T1270A.100
[GRAPHIC] [TIFF OMITTED] T1270A.101
[GRAPHIC] [TIFF OMITTED] T1270A.102
[GRAPHIC] [TIFF OMITTED] T1270A.103
[GRAPHIC] [TIFF OMITTED] T1270A.104
[GRAPHIC] [TIFF OMITTED] T1270A.105
[GRAPHIC] [TIFF OMITTED] T1270A.106
The Chairman. We hear your cry for help; namely, leave us
alone, let us do it. I also want you to know that you are not
the only one who has crowds of people yelling at him for a
solution and offering no assistance. We experience that every
day of the week. So you have our sympathy.
Next, I am pleased to introduce, James Dickson, Vice
President of Government Affairs for the American Association of
People with Disabilities. He has been a very strong advocate
throughout this process of making certain that anyone with
disabilities is permitted to vote and has the sanctity of the
secret ballot which is essential to all of us and essential to
democracy.
Mr. Dickson, you are recognized.
STATEMENT OF JAMES DICKSON, VICE PRESIDENT OF GOVERNMENT
AFFAIRS, AMERICAN ASSOCIATION OF PEOPLE WITH DISABILITIES
Mr. Dickson. Thank you, Chairman Ehlers, members of the
committee. I have two disabilities: I am blind and I am blunt.
In these 5 minutes I am going to summarize some of the points
of my written testimony. First I want to thank the Members of
Congress who passed the Help America Vote Act. I voted secretly
and independently for the first time 2 years ago; for the
second time just a month ago. I cannotput into words the
glorious feeling and the pride that I had as an American, and I am
speaking for tens of millions of other Americans who have now the first
opportunity to vote privately and independently.
I have got a few stories to tell about the problems that I
faced and which millions of other voters face when not being
able to vote privately or independently. These happened to me,
but literally there are millions of stories like it. The very
first time I voted, the poll worker said to me, loud enough for
everybody in the polling place to hear: You want to vote for
who?
On another occasion I had a poll worker say to me: We are
very busy; nobody votes for state legislators and these other
races, so how about if we finish now?
On another occasion I had a poll worker say to me: These
referenda today are really confusing, most people don't vote on
them, so why don't we stop now?
On yet another occasion I had a poll worker say to me: This
print on the referenda is too small, I can't read it to you, so
can we be finished? That particular excuse did not get much
sympathy from me.
Touch screens are the best existing product we have that
offers accessibility to the greatest number of people. I
participated in the earlier work that was referenced, by Kelly
Pierce. The rest of the story is that after those initial
tests, the company was able to inexpensively and quickly make
changes to the access procedures so that the problems were
eliminated.
Touch screens--access is a continuum and we need to have
equipment designed so that as access increases it can be
cheaply, efficiently, and quickly installed on the equipment.
Touch screens are the only product available now that meets
those requirements. At AAPD we absolutely want secure,
accurate, recountable elections that are systems that are
accessible. The paper trail is not accessible.
This is a California ballot. Try recounting. I will leave
for the committee--this is the roll that was not able to be
counted in Ohio. Paper trail is a Rube Goldberg contraption. It
doesn't work, it is not accessible, you can't recount it. It
doesn't even offer verification. Not only do people not look at
the verification, in the tests done at the MIT where the
computers were set up so that votes were changed, MIT students
didn't find the changed vote when they looked at the
verification on paper. When the verification was done by audio,
listening through earphones, they found the changed votes.
I want to sum up with the following three points. Things
have to be accessible. Thank you for making that stand in HAVA.
The paper trail does not even do what the proponents want, and
the proponents are a very small group who speak very loudly.
There have been, over and over again, public opinion polls.
When voters use touch screens they trust them 80 percent; 80
percent when they use them. We shouldn't let a loud vocal
minority using fear determine what is going to happen in the
sanctity of the polling place.
The last point I want to make, and it is very, very
important, is the real problems in our voting system are human
factors, are human errors. And before we order something to be
done in the polling place, we need money to research and
document what the problems are and we need to test proposed
solutions in the reality of the polling place, not in a
laboratory. Put me in an empty room with a ballot box full of
paper, and I will hack into it in less than 60 seconds.
Thank you again. This discussion is very important. And I
would just ask you to remember that 80 percent of Americans who
vote on touch screens believe their vote is secure and
accurate.
The Chairman. Thank you, Mr. Dickson. Appreciate your
comments.
Thank you, Mr. Dickson, and we appreciate your comments
about showing why it was so worthwhile for us to insist that
all individuals be able to cast their ballot in secret. So
thank you.
Next I am pleased to introduce Michael Shamos. He is a
professor at Carnegie Mellon University and is also the
director of the Institute for Software Research. Dr. Shamos,
you are recognized.
STATEMENT OF MICHAEL I. SHAMOS, PROFESSOR, INSTITUTE FOR
SOFTWARE RESEARCH DIRECTOR, CARNEGIE MELLON UNIVERSITY
Mr. Shamos. Thank you, Mr. Chairman. I just want to make a
small correction to the record. I am not the director of the
Institute for Software Research, I am just a member of the
Institute for Software Research. But I am also an attorney
admitted to practice in Pennsylvania and before the United
States Patent Trademark Office. Since 1980 I have been an
examiner of electronic voting systems for various States. I am
currently an examiner for Pennsylvania and I have personally
performed 118 voting systems examinations. I am going to do my
119th examination next week.
I recall that, Mr. Chairman, you are a physicist,
Representative Holt is a physicist. I am a former physicist. My
proposal is we settle this issue like physicists, based on
scientific evidence and not on emotion.
I view electronic voting as primarily an engineering
problem that includes the design of processes and procedures.
Once the requirements for a voting system are agreed upon, it
is then a matter of developing and manufacturing the equipment
processes that meet these requirements. The question is whether
Congress should be setting technical performance guidelines and
engineering standards, as H.R. 550 would have it do, or whether
such guidelines should be left to this and the EAC, as HAVA has
already provided.
The proposed bill is based on three major assumptions, all
of which are false. First, it assumes that paper records are
somehow more secure than electronic ones, a proposition that
has been repeatedly shown to be wrong throughout history.
Second, it assumes that voting machines without voter-verified
paper trails are unauditable because they are claimed to be
paperless, which is also false; they are neither paperless nor
unauditable. Third, it assumes that paper trails actually solve
the problems exhibited by DRE machines, which is likewise
incorrect.
The reason that mechanical voting machines were introduced
over a century ago was to stop rampant fraudinvolving paper
ballots. H.R. 550 would restore us to the year 1890 when anyone who
wanted to tamper with an election needed to do no more than to
manipulate pieces of paper. The recent example in Cleveland, Ohio,
Cuyahoga County, is extremely instructive. That was the case we just
heard, that 10 percent of the paper trails could not be read. H.R. 550
provides that in the event of any inconsistency between electronic and
paper records, the paper records are irrebuttably presumed to be
correct. Attorneys like myself are always wary of irrebuttable
presumptions. Applying that provision to Cleveland would have resulted
in the disenfranchisement of 10 percent of the electorate because their
paper records could not be read.
I cannot believe that the numerous sponsors of this
legislation contemplated such an outcome. I did a review of the
U.S. elections starting in the year 1824 when the popular vote
began to be kept. I looked at the percentage of times that you
took 10 percent of the popular vote and subtracted it from the
winner and gave it to the loser, how often would the outcome
change; and the answer is, since 1854, 55 percent of our
Presidential elections would have been reversed if you couldn't
count 10 percent of the paper trail.
The argument is made that security problems with DRE voting
demand remediation of the type proposed in the bill. Indeed
Professor Felten at Princeton, Harri Hursti, and others have
done a great service by exposing security vulnerabilities in
voting systems. Some of these vulnerabilities are severe and
require immediate repair, but the point is that they are easily
remedied.
The question for the committee is what the proper response
to such discoveries ought to be. When tainted spinach was found
in California, Congress did not ban the eating or distribution
of leafy vegetables, even though at least one human life had
been lost. The appropriate reaction to the discovery of a
security flaw in a voting system is to repair it, not to outlaw
an entire category of voting machines with which we have a
quarter-century of experience.
It is claimed that observed reliability problems with DRE
machines will be alleviated by adding a paper trail. Field
experience has shown the opposite. The failure rate of paper-
trail DREs is double that of DREs without paper trails. It
should be obvious that adding a new device with moving
mechanical parts to an existing electronic machine cannot
improve its reliability.
The effect of H.R. 550 would be to ban electronic voting
entirely in Federal elections. I want to repeat that. It would
be to ban electronic voting entirely in Federal elections. The
reason is that the bill sets forth conditions that are not met
by any DRE system currently on the market in the United States.
If it were to pass in its present form there could be no more
electronic voting in this country, and Congress would be in the
position, after spending $3 billion on new voting equipment, of
spending billions more paying for what it just paid for. I
cannot believe that the numerous sponsors of this legislation
contemplated such on outcome.
Further, the bill as written mandates a system that would
violate constitutional and statutory provisions in more than
half the States. The secret ballot is regarded as an essential
component of American democracy. Each one of the DRE paper-
trail systems that are currently on the market either enables
voters to sell their votes or allows the government and the
public to discover precisely how each voter in a jurisdiction
has voted. I cannot believe that the numerous sponsors of this
legislation contemplated that outcome either.
I am in favor of voter verification. The proposed bill,
despite incorporating the phrase ``voter verified'' into its
title, does not come close to providing real voter
verification. While it shows the voter that her choices were
properly understood and recorded by the machine, it offers no
assurance whatsoever that her ballot was counted, that it ever
will be counted, or it will even be present in the event a
recount is demanded. Once the polls have closed, the voter not
only has no recourse or remedy, but is powerless to even
determine whether her vote is part of the final tally or
object, if she believes it isn't. That is not voter
verification, regardless how it may be denominated in the text
of the bill.
I submit that if Congress desires to enact a comprehensive
statute mandating voter verification, it ought to verify
whether the proposed legislation actually accomplishes that
goal. Numerous effective verification methods are known that
are not based on vulnerable paper records. These have not yet
been implemented in viable commercial systems. I understand
that scientists at NIST will soon announce another one.
If H.R. 550 is enacted there would be no point in
continuing research and development on any such system, since
the statute would prohibit any system that didn't use paper
records.
Professor Ronald Rivest of MIT has recently invented a
voting method that allows each voter to verify, after the
election is over, that her vote has actually been counted, a
feature that is absent from the systems contemplated by H.R.
550. Professor Rivest's system also allows any member of the
public to tabulate the results of the election for herself, so
it is not even necessary to trust the official count.
These discoveries demonstrate that voter verification is
now a ripe area of scientific research and it is far too early
to mandate by statute a bad nonsolution to a presumed problem.
My purpose here today is not simply to complain about the
bill but to offer a constructive alternative. As part of my
written testimony, I have included a complete markup for the
proposed legislation that retains its essential positive
feature such as voter verification but eliminates its ill-
advised provisions. I urge the committee not to report the bill
favorably in its present form, and I thank you for the
opportunity to be here today.
The Chairman. Thank you for your testimony.
[The statement of Mr. Shamos follows:]
[GRAPHIC] [TIFF OMITTED] T1270A.107
[GRAPHIC] [TIFF OMITTED] T1270A.108
[GRAPHIC] [TIFF OMITTED] T1270A.109
[GRAPHIC] [TIFF OMITTED] T1270A.110
[GRAPHIC] [TIFF OMITTED] T1270A.111
[GRAPHIC] [TIFF OMITTED] T1270A.112
[GRAPHIC] [TIFF OMITTED] T1270A.113
[GRAPHIC] [TIFF OMITTED] T1270A.114
[GRAPHIC] [TIFF OMITTED] T1270A.115
[GRAPHIC] [TIFF OMITTED] T1270A.116
[GRAPHIC] [TIFF OMITTED] T1270A.117
[GRAPHIC] [TIFF OMITTED] T1270A.118
[GRAPHIC] [TIFF OMITTED] T1270A.119
[GRAPHIC] [TIFF OMITTED] T1270A.120
[GRAPHIC] [TIFF OMITTED] T1270A.121
[GRAPHIC] [TIFF OMITTED] T1270A.122
[GRAPHIC] [TIFF OMITTED] T1270A.123
[GRAPHIC] [TIFF OMITTED] T1270A.124
[GRAPHIC] [TIFF OMITTED] T1270A.125
The Chairman. We will now turn to questions from the
committee, and I will begin and yield myself 5 minutes for that
purpose. And Dr. Shamos, since we just finished with you, let
me pursue one comment you made. I could pursue many, and I am
sure others will pursue those, but on the one you said paper
trails are no more accurate than any other method. Let me ask
if you would also include paper ballots which are then read by
a computer in that category.
Mr. Shamos. Oh, Mr. Chairman, I don't think I actually made
any comment about the accuracy of voting systems. I think I
said that paper systems weren't secure.
As far as accuracy, accuracy is a very poorly defined
concept in voting systems and extremely difficult to measure,
because we need to know in advance the voter's intent before
they go into the voting booth. Then we need to see through the
entire chain of custody of all the ballots at the end whether
the final tally really reflects how the voters intended to
vote. That is nearly unmeasurable except in small laboratory
experiments. So I actually haven't made a comment about
accuracy.
The Chairman. Okay. In general, your comments about paper
trails, do those also apply to paper ballots that are then
scanned electronically?
Mr. Shamos. Paper ballots that are scanned electronically
are certainly subject to the same kinds of tampering. In fact
it is easier in general to tamper with those because they are
cut sheet paper, individual pieces of paper. There are all
sorts of problems with optical scan voting but it is certainly
acceptable as a method of voting. We use it in Pennsylvania. It
is in widespread use around the country.
The Chairman. Let me just extend that one little bit. In
terms of recounting for--in case someone demands a recount,
isn't a paper ballot a good reliable method of recounting,
simply because the voters themselves have marked that
particular piece of paper?
Mr. Shamos. No. The problem is that once the voter has
marked the ballot and verified that the ballot is marked the
way she wants, she has no assurance that by the time the
recount occurs, that same piece of paper is going to be in the
hands of the recounters.
Ms. Lofgren from Silicon Valley might recall that in the
2004 election in San Francisco, 3 weeks after the election,
ballot boxes were found floating in San Francisco Bay with
ballots in them. And so we have not solved the problem,
security of paper ballots, in a widely distributed voting
system that we have in the United States, with a couple hundred
thousand precincts.
The Chairman. Thank you. I didn't realize we had that
problem since the LBJ election and Tammany Hall, Prendergast,
et cetera. Thank you.
And quickly I am turning to Mr. Felten, I am interested in
your comments. How easily could one access the voting machine
and insert a virus of the type you have commented? How long
does it take to actually get the virus in place? Would someone
need to access the machine for an appreciable amount of time?
Or is this something that a voter in a voting booth could do?
Mr. Felten. It takes about 1 minute of access to the
machine, and I can show you roughly what would be involved. It
would involve opening the door on the side of the machine,
which would require getting a key. As I said, those are for
sale on the Internet. There may be some security tape that
would need to be removed and might be missing already. Opening
up this door, putting in the memory card like this into the
side of the machine--the memory card would have been prepared
in advance with the computer virus on it--then pressing the red
power button and waiting about 30 seconds, and afterward
closing everything up and putting it back.
This is something that would be unlikely to be doable by a
voter in the polling place, but if the machine is not--if the
machine is not guarded with a very careful chain of custody
throughout its life cycle, it can be available to that. In my
polling place in Princeton, the DRE machines sit unattended
overnight, the night before the election, in an unlocked school
lobby.
The Chairman. How long would it take someone who had access
to the machine to figure out how to write the program?
Mr. Felten. It requires some information about how the
machine works. This is not a Manhattan Project. It requires a
moderate level of skill in computer programming and some
limited knowledge, probably the knowledge that has in this
case--that had leaked from the vendor to the Internet a few
years ago, would be nearly enough. And I think an unscrupulous
person would not have a problem getting the necessary
information.
The Chairman. So from the time you started looking at the
machine until you devised the virus, what sort of time was
involved?
Mr. Felten. We got the machine in May. At first we spent a
lot of time taking it apart to understand everything we could
about how it worked. We were interested not only in whether a
virus would be possible, but we really wanted to understand all
of the security mechanisms and we wanted to treat it very
carefully. From the time we started developing virus code until
we had a working virus, perhaps a few weeks.
The Chairman. Thank you very much. My time has expired. I
am pleased to recognize my Ranking Member, the gentlelady from
California.
Ms. Millender-McDonald. Thank you so much, Mr. Chairman,
and thank you again for this very interesting hearing.
The one thing I want to say about my friends in the Senate,
they have a bill out now, saying that every polling place
should have a large supply of emergency paper ballots that can
be used in emergency situations. That is just where we are.
That is what we think about voting now in this country of ours.
And so Senator Dodd and Senator Boxer and others have submitted
this bill.
But I have said all along that there is a security issue
here. There is a trust issue that we must come to bear in terms
of voters.
Mr. Felten spoke about when there aren't consequences,
there are compromises--or consequences bring compromises. And I
wanted him to expound a little bit on that. And he also said
that existing election procedures are not adequate for
elections. I want you to expound on that too, sir. And tell me,
if Mr. Dickson feels a paper trail is not adequate, especially
for disability, then you are suggesting, Mr. Felten, that paper
trails do cut down on voter fraud. So we have some imbalance
here. If you could just speak to that for me on those issues.
Mr. Felten. Certainly. The first issue had to do with
thethe consequences of the compromise being worse in an electronic
system. And in the example that we gave here, there is a computer virus
that will spread itself from one voting machine to others, and the
consequence is that if someone is able to compromise one machine, the
virus can spread to many machines and potentially affect all the votes
on all of those machines, as compared to fraud with an old-fashioned
ballot box where access to a ballot box only allows someone to tamper
with the votes that are in that ballot box, or maybe increase them by
some amount. Access to one cannot involve stealing tens of thousands of
votes as with an electronic system.
Ms. Millender-McDonald. But this virus, you say, can pass
from one machine or one voter to another. I think you stated
that. How can that be when I am told manufacturers do not give
out this so-called code, secure code they use, how can that
then be done with that?
Mr. Felten. Well, the way that the virus--the way that this
virus spreads is on these memory cards. The memory cards are
programmed before an election, usually at a central location,
and they are programmed with the list of races and the list of
candidates and so on for that election. Then they are
distributed out to the polling places and put into the voting
machines. That is a possible--that is a possible mode of travel
of the virus.
If the virus gets onto the memory card at that central
location, it will then be installed out into the voting
machine. After the election, the memory cards go in the
opposite direction to carry the votes back to the county clerk
or Board of Elections Office to tabulate them, and that allows
the virus to go in the other direction. So a virus in one
machine may hitch a ride on a memory card, after the election,
back to the election headquarters and then potentially spread
there onto many other cards that are then distributed, say, for
the next election.
This is much like the process by which older computer
viruses spread on floppy disks. If you put an infected floppy
disk into your PC, your PC would catch the virus and then it
would spread to any other disk that you put into your machine.
So it hitches a ride, opportunistically, on top of the flow of
these memory cards that happens in running an election
normally.
Ms. Millender-McDonald. How do we answer Mr. Dickson's
whole notion that paper trails are not acceptable to the
disabled and yet you say cut down on voter fraud?
Mr. Felten. Yes, I do believe it cuts down on voter fraud
and I do believe that a paper trail, well designed, can be just
as accessible. Mr. Dickson held up the roll of paper and
pointed out he could not view that or verify it or audit it.
But the DRE system that he is advocating stores his votes on
this, which neither he nor anyone else can simply look at and
read. The problem with these DREs and the security problem is
exactly the thing that Mr. Dickson is complaining about: the
inability of any voter to look at the machine and see their
vote recorded. So I don't believe that there is a conflict
between the use of a paper trail and accessibility.
Ms. Millender-McDonald. There are just so many questions
that I have just put all over the place here. The whole notion,
Mr. Cunningham, that you spoke of--and I see my red light is on
already. That is what I am saying, it is just so much in so
little time to talk.
The Chairman. We will have a second round.
Ms. Millender-McDonald. A second to go back?
The Chairman. Second round.
Ms. Millender-McDonald. My second round I will come back to
you, Mr. Cunningham and Mr. Shamos, because I do want to talk
with you. Thank you, Mr. Chairman.
The Chairman. Thank you. The Chair recognizes Mr. Brady,
the gentleman from Pennsylvania, for 5 minutes.
Mr. Brady. Thank you, Mr. Chairman. Mr. Chairman, I have a
point of inquiry. Will Mr. Holt have a chance to speak? Will he
have a chance to speak?
The Chairman. By unanimous consent, we will allow Mr. Holt
to speak.
Mr. Brady. Okay. I am just--I don't think voting is a
science. I think it is a people person thing. I think it is--I
think it is a human thing. And I think that anything we do
here, no matter what it may be, can be attacked, can be hacked
into, can be verified. Ballot boxes can be put in a river,
could not be shown. But I think what we are trying to show is
try to eliminate as best as possible all these things that can
possibly go wrong. And I don't understand why a receipt--
because that is what I look at a paper ballot as a receipt--
why, when you vote and you get your receipt and you have that
and you see what you voted for--and if you don't have that,
then you could--if you don't have that, then you can allow some
type of protest somewhere. If you have no receipt, you think
you voted, you don't know. It is up to now whatever tabulation
or whatever machine or mechanical or scientific tabulation
happens. And I don't understand why it would be a problem for
anybody having a receipt.
Mr. Shamos, you heard my statement and you have inspected
many times the voting machines, and from what I understand, you
had said that a malicious hacker could easily make the same
switch, allowing votes to be changed from one vote to thousands
of votes. Then if that is the case, why are these--we think
these systems aren't reliable and if that is the case, what
would be the problem with a verified paper trail? If I want to
vote and I want to vote for you, if I look at a paper and it
says I didn't vote for you, I can lodge a complaint right
there. If I walk out there with nothing, I don't know who I
actually voted for. I am in the hands of that machine, a hacker
or anybody who could probably get in to violate the voting
process. I don't understand why this should be a problem. No
matter what we do, there will still be a human factor
somewhere, someplace, somehow.
At least a voter has the confidence that he has or she has
a piece of paper stating that, yes, I did vote; yes, this is
who I voted for. And if there is a mistake, you may have a
chance to rectify it right there. That is my point.
I yield back the balance of my time. Thank you, Mr.
Chairman.
The Chairman. Any answers or any comments?
Mr. Shamos. I can say something. It is certainly true that
if a malicious hacker is able to gain access to a voting
machine and replace the software that is in there in such a way
that that change is not detected, then there are severe
problems. And that is what I say, when we find security
vulnerabilities, we have to find ways of plugging them.
For example, the vulnerability discovered by Professor
Felten's group at Princeton was known to us in Pennsylvania
back in March, right before our May primary. And we were forced
to make an emergency remediation in Pennsylvania to blunt the
effects of that discovered vulnerability, becausewe wanted to
be able to assure county election officials and voters that an
intrusion of the kind that was demonstrated here today was not
possible, or if it had happened, the effects of it would have been
reversed and so we remediated that. We also instructed the vendor that
the next time it comes back for a certification, it better have
remediation of its own so that we don't have to impose administrative
procedures to make sure that that vulnerability can't be exploited.
So I am not minimizing the possibility that people are out
there trying to hack things. My point is the response to the
hack is not to throw the machines in the ocean and go back to
what we were doing in 1890. If it is a technological problem,
we have a technological solution.
With respect to the receipt, a lot of people think of the
word ``receipt'' as meaning something that the voter can take
home with them and look at later at their leisure and show
maybe at some later time to an election official and say, see,
this is really how I voted.
It is not legal to give receipts of that kind because you
can't give a voter anything they can use to prove how they
voted, since they could then sell their vote. So the receipts
we are talking about, these voter-verified paper trail systems,
the voter has a chance to view the receipt on the machine and
then say yea or nay; yes, that truly represents my vote or not,
and then when they leave the polling place, they don't have a
piece of paper to take with them, and my point--the point that
I made in my earlier testimony is that it is nice enough to
show the voter that their vote was properly recorded. But,
again, there is no assurance that at the time the votes are
actually tallied later, or a recount was done, that that piece
of paper is even around or hasn't been replaced by something
else, and there are people who are working on the solution to
that problem and we are not there yet.
Mr. Brady. Mr. Chairman, if I can just answer, you are way
out there. You are talking about after voting, you are talking
about people manipulating receipts that they may or may not
get. I mean, now you are becoming human factor after human
factor after human factor, somebody is hell-bent on trying to
rig an election. That is not what we are talking about. We are
talking about voter confidence. That is what I am talking
about. I am not talking about a receipt you take home and say,
I want to change my vote or I made a mistake. Because people do
make mistakes. If you make a mistake on the voting machine, you
make a mistake. You can't rectify it after you validate it.
But I am saying, as you are saying, look, this is who I
voted for. This is what I wanted to do. Push the okay button,
push the vote button, whatever, close the curtain, open the
curtain. I don't think there is anything wrong with that. That
is what I am saying. I don't think there is nothing wrong with
our bill.
Mr. Shamos. If I told you that mechanism could be used to
discover how every voter in the precinct voted, that might
change your mind.
Mr. Brady. I learned that you people with this electronic
scientific, you show me anything I ever did in my entire life.
So that doesn't scare me.
The Chairman. That might make for an interesting episode.
Ms. Simons, quickly.
Ms. Simons. I just wanted to comment briefly on this whole
paper issue, because I think we are comparing apples and
oranges. One of the basic issues is how well engineered these
systems are. And somebody who was advocating for voter-verified
paper trails early on, fore the machines were retrofitted--I
have to say I was appalled by what the voting machine companies
came out with. They are bad.
I mean, Mr. Cunningham is right. Jim Dickson is right. The
continuous rolls of thermal printed paper have privacy issues,
as Michael Shamos says. But they are badly engineered. It is
bad technology. There is no reason why paper has to be--why
they have to be designed that way. They were the cheapest way
to do it. That was why it was done that way. I mean, banks deal
with paper all the time. They manage to count it. And I don't
think they make many counting mistakes. Other countries vote on
paper, and they don't have problems. We can do it, too, but we
have to do it right. If you do it wrong, it will fail.
The Chairman. And for the last quick word, Mr. Dickson.
Mr. Dickson. Chairman Ehlers, I wanted to respond to your
question about counting optical scan ballots by machines. We
have a lot of experience in this country with that. When you
have large numbers of ballots, hundreds of thousands, and you
have got a close race, every time the optical scan ballots have
been counted you get a different number. You get a different
number. We do not have the technology to accurately count large
pieces of paper.
The Chairman. Right. Thank you very much.
Next the Chair recognizes the gentlewoman from California,
Ms. Lofgren, for 5 minutes.
Ms. Lofgren. Thank you, Mr. Chairman. This is a very
helpful hearing, and as I am listening, it seems to me that the
point made by Ms. Simons needs to be emphasized: The fact that
we have a dysfunctional roll doesn't mean that that is the only
alternative available as an auditable trail.
You know, I spent more years on the board of supervisors in
Santa Clara County than I have so far in Congress, and in
California, the counties are the repository of the registrar of
voters, and in California the registrar of voters is acivil
service position. It is very nerdish, I guess is the best word you
could say, in Silicon Valley and very apolitical, and it wasn't really
until I got on the board of supervisors that I realized--I guess I
never really thought about it--that, you know, some of the votes get
lost.
People don't think about that, but we had the little punch
cards for a long time and it would jam up the machines on
election night, and some of the ones that got mangled didn't
get caught. And it didn't ever--at a time when the country was
less closely divided than it is today, nobody really noticed
because elections weren't that close. But of course now we have
close elections all the time, and we are paying more attention
to it. And so I do think that we need to make sure--you can't
have a perfect system, I suspect, but we need to have a system
where people do not question the integrity of it.
I remember going with a computer scientist in my district
who really said this: Yes, you can make a mistake, I mean, you
can take a ballot box and throw it out, but the difference with
hacking a machine is it is not random, the direction in which
those votes are going to be lost.
And so I am very enticed by Mr. Holt's bill. I would know
that in a standards setting, there has been discussion that
this would eliminate the privacy of individuals. But on page 3,
line 13, of his vote, it specifies that to comply with the act
that would not be permissible.
So I think, you know, part of what we do here in Congress
is to set standards and laws that need to be met, just as NIST
does from an engineering point of view.
I am wondering, Mr. Felten, Mr. Shamos said something to
the effect that you could verify other than by paper means. I
don't want to misquote you or something; it was something to
that effect. How would you do that with the virus that your lab
created? How would you do a verification without--would there
be a way?
Mr. Felten. Well, I think that the idea of nonpaper
verification is something that is not ready yet. It is an
active area of research. Mr. Shamos referred to Professor
Rivest's work, which, by the way, is an all-paper system. And
that is an interesting proposal, but I would not want to trust
an election to it tomorrow. I think that years from now we may
be in the position to have effective and useable nonpaper-based
systems, but I do not believe they are ready yet and I don't
think we can afford to wait.
Ms. Lofgren. Mr. Shamos, your testimony has been very
interesting, and thank you for your advocacy and your work on
assuring systems. One of the things that you suggested, that we
needed to make sure that vulnerabilities are protected again--
and no one would disagree against that--but one of the things I
learned in my prior life in local government was that
elections, they are not chaotic but they are--they are chaotic.
You have got, you know, PTA mothers and you have got
volunteers, and there are schools, and it is really--I love
election day, but it is not really tightly controlled and
cannot be, because that is not the way Americans hold
elections, unless we completely fund this and have full-time
paid people. And I don't think we are moving in that direction.
So how would we be able--even if we found this virus, I
know from Silicon Valley, I mean there are a million ways to
hack this stuff. Given the fact we have this chaotic system, we
have smart hackers everywhere, how do you protect against those
vulnerabilities in your judgment?
Mr. Shamos. Okay. So there are several ways. One is that we
are never going to achieve perfection, we are never going to
locate all vulnerabilities that exist in systems because we
don't know how clever people may be in the future to get around
the protections that we have built in. But this is true not
just in voting systems. In every kind of system that has ever
been made, there are later discovered vulnerabilities.
As I said in my testimony, I am in favor of voter
verification. Voter verification is a way of assuring that if a
vulnerablity has been exploited that we are going to know about
it.
I think you just asked about a potential nonpaper mechanism
for verification. I will give you a very simple one that the TS
unit over there has a touch screen that shows things to the
voter. The voter is not positive, however, that the marks that
she makes that are visible on the screen are actually getting
recorded by the machine. So all we have to do is have a second
screen, made by a different manufacturer, and we take an
electrical wire and we get a copy of whatever is on the first
screen to the second screen, and we attach a digital camera to
that and we make a record of what the screen showed. And if the
voter has any doubt it has been recorded correctly, she can
press a button that says ``replay'' and it will show her her
vote again on the screen. And that vote gets recorded on a CD
or DVD and prevents it from being tampered with later. That is
just a trivial example of a nonpaper verification mechanism.
The second way of doing it is through something called
parallel testing, which is used in at least 10 counties in
California. It is going to be used in Massachusetts in
November. It is used in several other States, where you
sequester a machine or machines during the election, during the
actual time of the election, and you have a team of people vote
on them, simulating the way they vote, except they vote
according to the predefined script so we know what the total
should be at the end. Then at the close of polls, we close that
machine and we see if the totals match. If they don't match,
then we know that there is a rat somewhere, and we do a
forensic examination to find out where the rat is.
The Chairman. The gentlewoman's time has expired. I am
pleased to recognize our guest, Representative Holt, for five
minutes.
Mr. Holt. I thank the Chairman and I am pleased to see that
we are holding--that you are holding this hearing, and I
welcome the opportunity to be with you. And I regret that the
hearing is being held the day before our target adjournment for
the year. But nevertheless, I think you have put together a
good panel of witnesses.
Let me just make two quick comments. One is, HAVA had the
unanticipated effect of motivating jurisdictions to go out and
buy devices for voting that are clear, simple, accessible, easy
to use and totally unverifiable. And it may be that there are
various future methods of verifying that are not yet thought of
or not yet developed, but right now we have a method of
verifying where each voter can verify her vote at the time of
voting, and that is a paper trail. And I do think it can be
made accessible for voters, for all voters.
Mr. Shamos just described a rather Rube Goldberg-ish CD
camera that was going to photograph another screen. Boy,paper
record sounds a whole lot easier to me.
But anyway, let me first go to Mr. Felten, Professor
Felten. How detectable would the virus that you devised, or
that someone might devise, be before, during, and after the
election?
And let me ask another question. I don't know whether you
are familiar enough with the kind of chain of custody and other
checklists that Mr. Smith puts his machines through. Do you
think a virus could be implanted in a system that had the kinds
of protections that Mr. Smith describes?
Mr. Felten. First the question of how detectable this would
be. There is a long-established cat-and-mouse game in the PC
world between virus writers and antivirus companies, and the
virus writers have proven very successful at making viruses
that are quite difficult to find, especially in advance. And I
would expect, or I suppose fear, that we would see the same
phenomenon here. We did not try to make this virus as stealthy
as we could. But I think that if someone used the same methods
that are used in the PC world to make viruses hide, it would be
very difficult indeed to find in advance.
Preelection logic and accuracy testing as has been
discussed here will not find the virus that we devised, because
it simply checks whether the machine is in logic and accuracy
testing mode or real election mode, and if it is in logic and
accuracy testing mode, the virus simply lies low. So I think it
might be quite difficult to find, and I certainly would not
have confidence that if it were implanted it could be found.
The second part of your question related to the procedures
that Mr. Smith described, and I think those sorts of procedures
are very valuable. They do help to close the gap, to close the
window of vulnerability, but we also have to recognize that
procedures are not perfect and are not always followed. Like
any other part of our election system, there will be gaps,
there will be errors. And I still worry, despite the best of
procedures, that the window of vulnerability opens enough that
a determined adversary can get through it.
Mr. Holt. Thank you Mr. Shamos.
Yes, Mr. Smith. If there will be another round of
questions, I would be happy----
Mr. Smith. I would like to respond to that, because I think
it really comes to the core of what we are trying to talk
about. I have listened to the situation with regards--I am the
only one here, by the way, who uses Diebolt TS units, and I am
the only election director I guess on the panel that does.
One of the things I have been listening to and have been
concerned about is how this virus would spread. I am an
engineer by background. I hold a double E degree so I have some
kind of technical capability in that.
First of all, if you took one and you corrupted this memory
card--can I see your card? If you took and corrupted this
memory card, and it is going to go into one machine, and that
one machine in my county is probably going to vote between 100
and 150 votes, that's all that's going to be counted on it, the
issue comes on this card supposedly then is it is going to be
corrupted; okay, we will lose 100 votes. That is not good, but
it is not like we are losing 50,000 votes that I have cast in
the general election, in the last one in 2004.
Now, this comes out, it goes back to the end of the
process, as Mr. Felten has said, it is only going to corrupt
one more machine. The machines are not interconnected. There is
not a possibility of corrupting the 500 machines that I am
going to put in place for the 2006 general election. That is,
you know, an issue. It is a tactic; it is not going to happen.
Now, there are a lot of other things that we do. I mean, we
have a lot of security in place. We follow it. I am very anal
about those types of things and I have talked to Mr. Felten
about it, and I think that he believes in our county we have a
good thing.
The last thing is, I would like to respond to what Ms.
Millender-McDonald said--and I think this is as important as
anything--is that the confidence people have in our equipment
is very important. I mean, I couldn't say anything more. We
take--and after every election we hand out a response card,
given out randomly to our people. We say, what do you think
about the process? You want to have, whatever, and I have got
in front of you--it is not a technical, you know, survey of the
type, but there are 715 responses. You can see the names, you
can see the precincts, you can see what the election was held
for; in addition, you can see their comments. 99.5 percent of
the people that responded to these things in my county said we
did an excellent job. There was only two people, only two that
requested a paper trail.
So I think we are doing a good job in Forsyth County,
Georgia. I think we are doing an excellent job in the entire
State of Georgia and I think that we need to be--I don't want
to say ``recognized'' for it, but hopefully--don't impose
things on us which are going to make our job much harder to do.
But I also will tell you that I agree with Mr. Felten with
regards to having verification, but I believe that we do not
need to eliminate the paper.
Mr. Holt. My time has expired. I hope Mr. Felten will get a
chance to reply, because on my visit to his laboratory it was
my understanding that the method of spreading the virus is
different than Mr. Smith seems to understand.
The Chairman. Very quickly could you give a brief response?
Mr. Felten. Sure. Well, without getting into a long
technical debate, let me just say that when this memory card
goes back to the central facility and is put into a so-called
accumulator machine which adds up the votes, if that
accumulator machine becomes infected it can then infect a very
large number of other memory cards that are subsequently put
into it, and it acts as a very serious carrier of the virus.
The Chairman. Thank you.
Just an announcement to my colleagues. I have received a
note that votes are expected between 12:00 and 12:15. I would
like to have a second round of questions. Let me suggest that
each of us tries to limit ourselves to three minutes. And I
will begin, and then recognize the minority leader or the
ranking member. Mr. Doolittle presumably will be settled in by
then and ready with his question.
We were just talking to Mr. Smith and I was wondering, Mr.
Smith, what kind of system did Georgia have before it adopted
the electronic system? Why did they see the need to change to
the current system, and what were some of the problems you
experienced with the previous system? Basically, is the new
system better than the previous one or not?
Mr. Smith. Okay. I think I can respond to that. Fortunately
I took over as director of elections prior to theintroduction
of the DRE machines. We had at that point in time the punch card
machines. By the way I would say the security level we had on the punch
cards is pretty miserable, now that I have gone through and listened to
all the technical dissertations that have gone on. Our punch card
machines were monitored by a computer as well. That computer sat in a--
it was an IBM 386 or something like that. It sat in a closet that we
kept, and in fact they downloaded software to it routinely, you know,
over the telephone lines. I would say that was highly unsecure, and I
was mortified at that when I saw it.
The changes, the changes that we had, 6 months prior to the
2002 election, Diebolt machines were introduced into Georgia.
We had 6 months in which to take this across the entire State,
and I would say that the secretary of state and the Center for
Election Systems from Kennesaw State University did an
outstanding job.
I tell you, I personally used to run major computer
projects. I didn't think they could do it. They have done an
outstanding job. We have continued to hold elections, and
people are very pleased with them in our State.
Are there problems? I think some of the things Ms.
Millender-McDonald brought up with regards to training poll
workers are very valid, and I appreciate the fact that she will
continue to fund it. I would like to ask if she would fund the
program also so it is part and parcel of a program that I have
introduced, which is called Forsyth First Vote, but we also use
high school students to do it. One-third of all my poll workers
are students. We have changed the entire complexion of the
people in our county. Maybe that is why we are running good
elections, I don't know, but I have got poll workers that we
turn away because we have a very good program, and I am very
pleased with it. Thank you.
The Chairman. Thank you very much.
Briefly, Mr. Cunningham, you mentioned that you grew up in
a small town in Ohio. I spent my high school years in an even
smaller town, I am sure, known as Celeryville, Ohio;
population, 200.
I have a question for you about the VVPAT technology, the
printing paper trail technology. It is relatively new. You have
described the problems that you have encountered with that in
Ohio. Do you believe improvements can be made to the VVPAT
printer technology to make it more reliable, to capture true
vote totals, to avoid the problems you have had; and then would
the added complexity brought to the system always increase the
likelihood of failure? Or do you think through sufficient
research and study, we could make them more reliable?
Mr. Cunningham. Thank you, Mr. Chairman. I have a personal
motto: I never buy the first model of anything. I always let
other people figure out what the problems are before I buy. I
think the fact of the matter is, when the Help America Vote Act
was passed, most of the touch-screen voting machines were, by
and large, prototypes and rushed into manufacture. I am not
taking any issue with any of the manufacturers, and I am not
making a comment on the reliability of any of their machines.
But I think what we have got on our hands here is the Model-T
Ford. We are in the early stages. Now, can it be improved?
Absolutely. I think throughout my comments I was very definite
to say these machines as they currently sit are not reliable.
My question back to you, though, in that regard is, who is
going to pay to fix it? Because one of the problems we have
right now is in the last 24 months, every election jurisdiction
in this country has spent the $3 billion we spoke about earlier
on new election equipment, and that is what is in place. So
without somebody stepping forward to fund that enterprise, I
don't know how we are going to improve them ourselves.
And if I could, Ms. Lofgren, I liken running an election to
throwing a package of BBs on your kitchen table, and while
somebody is on each leg moving the table, you are trying to
keep them all on the table all day long. That is my analogy of
election day.
The Chairman. Thank you for that discouraging analogy. Next
I recognize the Ranking Member for five minutes.
Ms. Millender-McDonald. Thank you, Mr. Chairman. And let me
again thank you so much for this hearing. This has been just
absolutely the most informative hearing, one of the great ones
we have had.
Mr. Cunningham, I thank you for saying that we all agree
that some type of verification system is needed, and at least
we have a consensus here for that. But you did speak of the
fact that you are adamantly opposed to any program such as
yours in your State which makes VVPAT the official ballot of
record for recount? If I am not mistaken, Ohio lost 10,000
ballots. And what happen here, given that you were not able to
recount because you can't reprint?
Mr. Cunningham. In Ohio--what election are you talking
about?
Ms. Millender-McDonald. It was my understanding that there
were 10,000 votes that were unable to be recounted because you
were unable to reprint.
Mr. Cunningham. You mean at the ESI?
Ms. Millender-McDonald. Yes.
Mr. Cunningham. Ten percent of the VVPATs counted, I forget
what the numbers were exactly. I believe the statement that I
made was that nearly 10 percent of the tapes were either
destroyed, blank, missing, taped together or otherwise
compromised in some way. I don't--I don't think that it would
be correct mathematically to say it was 10 percent of the
votes; but 10 percent of the VVPAT tapes, based on what we
reviewed, had some kind of compromise that made it very
difficult to ascertain what the real numbers were.
Ms. Millender-McDonald. But you make a valid point that
because of the VVPAT, one is unable to reprint; therefore
voters will be unable to discern whether or not their vote
counted in an election. Am I correct on that?
Mr. Cunningham. I am sorry; repeat that?
Ms. Millender-McDonald. Am I correct in saying that because
VVPAT is the official ballot record for recount purposes, that
if you should need a recount, you cannot go to a reprint to
discern whether or not those votes----
Mr. Cunningham. Right. That is exactly right, Madam. I
would submit to you that to reconcile and verify vote totals on
an electronic machine, there are better ways to do it in more
controlled environments than the election-day environment that
I just mentioned. And it is--for instance, when the machine
back in the office and other records that are stored in that
machine can be printed and otherwise looked at electronically,
you know, we work every day on this.
Ms. Millender-McDonald. I am sure.
Mr. Cunningham. We try--that is my job is to try
toreconcile those numbers at the end of the day, but trying to maintain
this contemporaneous record. And the current state that it is in, and I
think we have--I am just saying it is never going to match. And it is
only going to fuel this--this fire that voting systems don't work, and
I think Ohio has set itself in a very very dangerous situation.
If I may just go on with that, there has been a little talk
here about we are only concerned with Federal elections. You
know, the least frequent election I run is a Federal election.
We need to be very careful that one of the problems that has
occurred since the passage of HAVA was it put many State rules
and regulations in conflict with the Federal law.
Ms. Millender-McDonald. Absolutely.
Mr. Cunningham. And what we ended up with was these rules
apply in a Federal election and these rules apply in a local
election. That is a terrible situation. We cannot operate this
enterprise with two sets of standards.
Ms. Millender-McDonald. I couldn't agree with you more.
Mr. Cunningham. Please do not think in terms of only
Federal elections because it is a very problematic proposition.
Ms. Millender-McDonald. Because you know what, sir? In a
given election, you have three different laws that you perhaps
might have to implement.
Mr. Cunningham. Could have.
Ms. Millender-McDonald. Local, State and Federal. And you
know, my hat is off to all of you local elected ones who have
to balance between the trenches. It is just really problematic.
Ms. Simons, I will let you close me down because I wanted
to go to Mr. Shamos. But I just have a second here for you to
comment.
Ms. Simons. Yes. I wanted to remind the panel what happened
in Carteret County, North Carolina--I believe it was in 2004--
where paperless DREs were used and over 4,000 votes were lost.
There is a concern about being unable to reprint paper ballots
or VVPATs. When you lose votes in a DRE where there is no
paper, there is nothing you can do. And in fact there was a
statewide election for agricultural commissioner, where the
separation between the two candidates was such that the results
could have been reversed by those missing votes. And it went to
court. The State Board of Elections first tried to hold a vote
in just the county. That was thrown out by the court. Then the
Board of Elections attempted to hold a statewide vote. That was
thrown out by the court because we had no laws to deal with
what happens when DREs fail. Finally there were a number of
people who submitted subpoenas or petitions saying they voted
for one of the candidates; and based on those submissions, it
looked like the judge was going to declare that candidate the
winner. So the other candidate conceded, and so that was how
the election was decided.
This is not the way to hold elections in this country. This
is a problem with DREs, paperless DREs. This was a case of a
failure, but there are many other problems too. We haven't even
touched upon security problems such as, for example, the risk
of somebody malicious getting a job with the vendor or the
delivery service and inserting malicious code.
We know that all software is buggy. We don't know, for
example, if elections have been wrongly recorded because of
buggy software, forget malicious code.
There are so many basic problems that we just have no way
of verifying elections that were held on paperless voting
machines--we cannot verify them at this point.
The Chairman. The gentlewoman's time has expired.
Ms. Millender-McDonald. This is why the average voter now
is just so befuddled over elections.
The Chairman. And most of us are average voters.
I am pleased to recognize the gentleman from California,
Mr. Doolittle, for five minutes.
Mr. Doolittle. Thank you, Mr. Chairman.
Ms. Simons, your written statement said, quote: Unless
there is evidence that the VVPBs have been compromised, the
paper ballots should be used to determine the election results.
I wanted to ask, what sort of evidence of compromise were
you referring to?
Ms. Simons. Well, obviously, if you have the kind of mess
that Mr. Cunningham talked about, that would raise a lot of
concerns. I share his concern about that kind of technology
being deployed. We need to have good engineering, we need to
have high standards, and we have to hold vendors to high
standards. Vendors should not be allowed to produce machines
that can create this kind kind of mess.
Mr. Doolittle. Well, they are machines and I notice that
machines occasionally make messes.
Ms. Simons. You know, sometimes you get what you pay for.
You can buy printers that don't jam. You can buy printers that
don't have privacy issues. This is not rocket science. These
things exist now. These technologies exist now, and I think a
question that we have to ask ourselves is how much are we
willing to pay for our democracy, you know----
Mr. Doolittle. And our Republic.
Ms. Simons. And our Republic; yes, thank you.
Mr. Doolittle. Now I apologize, I should have been here,
and I couldn't be here earlier, so I missed the direct
testimony. But I think Mr. Cunningham is from Allen County,
right? But there was an incident in Cuyahoga County where there
was a problem.
I just wondered if you could tell us, Ms. Simons, do you
think this evidence of compromise was compromised in the
Cuyahoga recount?
Ms. Simons. Sir, that is what I was referring to, actually.
Mr. Doolittle. Oh, all right. Do you think the paper trail
should have been used as the official ballot in that case?
Because that is kind of----
Ms. Simons. Well, in that case it is a problem. It is a
real problem, just as the Carteret County failure is a real
problem. We can see problems with the paperless systems and
problems with the systems that have been retrofitted with
VVPATs. The underlying issue, which I believe everyone on this
panel would agree on, is we need to have well-engineered, well-
designed, robust systems. As Mr. Cunningham said, this is sort
of like the Model-T. These are first generations and they are
failing. That is not good.
Mr. Doolittle. Well, I understand the Model-T analogy, but
I don't think the members of this committee and the Congress in
general want to throw away hundreds of millions of dollars on
the Model-T.
Mr. Dickson, would you like to comment?
Mr. Dickson. Yes. There were two points. The loss of votes
is really, really, a terrible situation.
Mr. Doolittle. Is what, sir?
Mr. Dickson. The loss of any votes is really a terrible
situation. Votes get lost on paper too. The Carteret County
voting machine does not meet the current standards. If that
county had purchased an accessible voting machine, built to the
current standards, that problem would not have happened.
Mr. Dickson. The Carteret machine, a little red light comes
on with no words around, and it says, ``This machine is full.''
There was no explanation in the training for poll workers that
said this red light means the machine is full. On the other
machine, the machine reads, ``Screen full,'' and will not
accept new votes.
Mr. Doolittle. Sir, you said--when are you talking about--
are you talking about the one in Cuyahoga County?
Mr. Dickson. Carteret County in North Carolina where votes
were lost on a voting machine. That county administrator wanted
to buy new accessible voting equipment, and the purchase of it
was delayed because of the commotion about a paper trail. And
the problem was created because of the delay.
Mr. Doolittle. Well, I just wonder, in the Cuyahoga County
case I understand that the paper trail, which I think Mr.
Holt's bill is going to be the thing we go by if there is a
conflict--in that case the paper trail lost nearly 10 percent
of the votes, so it doesn't seem there would be real problems
in that instance at least. Hopefully that would be relatively
rare, but in that instance if we went by the paper trail, as
the bill called for, there would be problems.
Ms. Simons. Actually, there were many problems in that
county.I understand there were problems with the DREs; that the
redundant memories did not match in about 26 percent of the
cases. So if you are going to try to do a verification using
the redundant memories, there can be issues.
There were a great many problems, not just involving the
VVPATs. This just shows that we need to focus more on
technology, on policies and procedures. As Mr. Cunningham said,
running an election is a complicated thing, but just because
there were problems involving one technology doesn't mean that
that technology can't be implemented correctly. Banks deal with
money and paper ballots all the time. Canada holds its Federal
election with paper ballots, so does the U.K., and they manage.
Mr. Doolittle. In this case the paper trail didn't solve
the problem.
Ms. Simons. Because it was badly engineered.
Mr. Doolittle. The point is paper is not the ultimate
solution.
The Chairman. The gentleman's time is expired.
Mr. Brady, you are recognized for 5 minutes.
Mr. Brady. We are going through as I speak in my city and
county in Philadelphia a write-in candidate, as you had, and we
are doing that as we speak. We are in court now because the
candidate on the machine won. Then they had a paper they could
write on, and they are counting the write-in ballots, and that
person won, and they are going to decide it in court. So we at
least had the opportunity to do that.
I heard you have ways of rectifying or double-checking
votes by voting electronically and having a camera. A lot of
people don't have good faith in any kind of electronics, and
what we are trying to do here is the right thing. We are trying
to restore confidence and, most important, trying to restore
trust back into our process, and we are trying to figure out
the best way to do that.
I understand there is a financial problem, and I understand
there is always a financial issue, but like what you said,
there is never enough money. You can always find some money to
assure democracy, and I subscribe to that.
Thank you, Mr. Chairman.
The Chairman. Thank you.
The Chair recognizes the gentlewoman from California Ms.
Lofgren for five minutes.
Ms. Lofgren. Thank you, Mr. Chairman.
At the conclusion of my first set of questions, Mr. Shamos
had described alternative ways to verify the vote. I am
wondering if, Mr. Felten, do you have a comment on those
proposals, and also Ms. Simons?
Mr. Felten. If I recall correctly, he mentioned two
mechanisms, one involving a second screen and a video camera.
This seems to me more complicated, more expensive than a paper-
based verification system and probably not any more
trustworthy.
He also mentioned parallel testing, which involves taking
the machine aside and holding a simulated election. This is
something we discussed in some detail in our research paper,
and the bottom line is that that is a worthwhile mechanism, but
it is not completely effective, not 100 percent effective at
the problem. It raises the bar, makes it more difficult to make
a virus, for example, that will evade detection. We should do
it, but we should not believe that it is going to entirely fix
the problem.
Ms. Simon. To pick up on Ed's comments, the alternative
device that Professor Shamos mentioned makes it very difficult
to hold a recount. If you want to have public confidence in
elections, one way in which you do that is by audits and
recounts. I don't know how you would audit that screen. It
seems to me it would have the same problems as these long rolls
of paper that Mr. Cunningham showed you, someone to sit in
front and say, this one voted here, and this one voted there.
Ms. Lofgren. Mr. Smith, do you have a comment on it? I cut
you off, Barbara. I didn't mean to.
Ms. Simons. May I finish? The best way to count things is
the way you count money, you sort it into piles, and you count
each pile, and that can be transparently and with a TV camera
watching a count as a way in getting confidence in the results.
Regarding parallel testing, I think we agree parallel
testing is a good thing to do. But there is a big ``what if,''
and that ``what if'' is: What if you find a problem with the
parallel testing? Are you going to go back and rerun the
election? As we saw in Carteret County, that raises enormous
legal and technical problems.
Ms. Lofgren. Mr. Smith.
Mr. Smith. I would like to speak from the complexity of the
operation that you are trying to bring about. One of the things
we have got in Georgia is a more simple format, I think, for
running the election because we do not have voter-verifiable
paper trail. One of the issues--I was actually charged with
running the manual recount, so I have some experience with
that, too. I wanted to see it being done because it is being
talked about in our State.
One of the concerns I have, and I think we all should look
back to, is who are the people putting this stuff into
operation on election day? It is typical. We have done things,
you see it. We have part-time people who are volunteers who
really try to do things, but they have gotten up at 4:00 in the
morning, 5:00 in the morning. They have to open the machines
up, do all the other things.
In Ohio with the VVPAT for Cuyahoga County, they had to do
other things that we didn't have to do. They go through the
logic and accuracy testing essentially right there. They enter
the machines, they start them up, they do everything. They
bring the memory cards. Part of the problem was the memory
cards weren't seated properly. That was a problem. But the
other thing is they had to be responsible for these printers.
In some cases they put the paper in backwards.
Ms. Lofgren. Let me explore that, because I am taking as a
given that we are not going to completely change the way
America holds elections, I think that is true. And I can
remember voting when I was still at my parents' house, and you
go down to the corner, and Mrs. Lucky, who always ran it, and
it is retirees and people that volunteer, and it is a wonderful
thing, but that is the given.
A lot of States have these verifiable systems, California
among them. Ms. Simons, has any of them come up with a system
that actually works better than that silly tape that we have
seen?
Ms. Simons. I think precinct-based optical scan systems are
excellent. That gives the voter a chance to check for overvotes
and the absence votes. You put your ballot through the scanner,
and it tells you if there is a problem with it. Recounts and
audits are relatively easy. The voter verifies the ballot by
definition, because the voter can look at it.
There are ways for blind voters to verify an optical
scanballot. One possibility is the use of a hand-held device
that reads the ballot for a blind voter. We know that this
technology exists. Another is to allow blind voters to use
tactile ballots where they insert the blank ballot into a
sleeve envelope that is marked. The sleeve has holes that allow
a blind voter to mark the ballots. There is also a system being
marketed which allows a blind voter to verify his or her ballot
with a vibrating device.
Ms. Lofgren. I see my time has expired, but I would just
like to note that I think we may have in the future some other
way to verify, but I just ask Mr. Holt to put me on his bill
because I think we need to have some in between on this.
[Applause.]
The Chairman. No demonstrations.
I am now pleased to recognize Mr. Holt for five minutes.
Mr. Holt. Thank you, Mr. Chairman.
My questioning will be along a couple of lines. First of
all, Mr. Shamos, I am sorry I didn't have the exact transcript
here, but said something or other you hate to see us outlaw an
entire category of machines. This legislation doesn't outlaw
any particular kind of voting system except unverifiable ones.
And you said further, I think, that scare tactics by a
minority, you hate to see that disrupt the whole process. The
Brennan Center for Justice of New York University Law School
conducted a study with very distinguished people, Ron Rivest
from MIT, Howard Schmidt, an administration and corporate
security expert, and a number of others; and said it found,
quote, all three major types of voting systems have significant
security and reliability vulnerabilities that pose a real
danger to the integrity of national, State and local elections.
The League of Women Voters, not a scary minority, says they
support, quote, only voting systems that are designed so that
they employ a voter-verifiable paper ballot or other paper
record, said paper being the official record of the voter's
intent.
The report of the Carter-Baker Commission similarly called
for a voter-verified paper record, random audits and so forth.
Mr. Chairman, I would like to ask that the Brennan Center
report, the statement of the National League of Women Voters
and the Carter-Baker report be made a part of the record.
The Chairman. Without objection, so ordered.
Mr. Holt. Thank you. I want to make the point that a number
of organizations, very responsible organizations with computer
scientists involved and so forth, have taken a look at this
matter, and we would do well to take a look at that.
Ms. Simons, I would appreciate it if you would say a little
bit more about ACM and the subcommittee that is looking at
this.
Then also what I would like the witnesses to comment on, as
Mr. Dickson recounts and Mr. Smith and others, votes can be
lost in a lot of ways. They can be lost through manipulating
the registration list, intimidating voters. There are a lot of
things that we need to address: Restricting accessibility at
polling places or in the polling booth; memory cards may not be
seated properly; we may not recognize that the memory is full
before election day is over; and paper records, Mr. Doolittle,
might be illegible or torn or otherwise difficult to use. But
it has been determined at least as often that redundant
electronic memories show that there are problems with purely
electronic memory.
So what I would like to ask of the witnesses is would you
prefer to have a system where there is no possible way of
recovering what happened, in other words, where the electronic
vote, for whatever reason, a poorly seated memory card or
something else, is wrong, and there is no possibleway of
recovering it; or, as Ms. Simons points out, a well-designed system
with a paper audit trail where there is at least a reasonable chance of
being able to recapture, recover what the voters' intentions were?
So I would be happy to have a quick comment from the
witnesses, beginning with Ms. Simons.
Ms. Simons. You asked me about ACM. It is an 80,000-member
professional society of computer professionals. Like the APS,
(the American Physical Society), the ACM is the premier
computing society, I would say, in this country.
The statement that I referred to, which is in my written
testimony, was voted on by ACM Council, which is the elected
policy making body of ACM. But they did something unusual, not
typical for ACM. The statement was put on the Web site for
members to vote on. Of those who voted, 95 percent supported
the statement. Of the 5 percent who did not support the
statement, roughly half, based on written comments, objected to
the fact that it wasn't broad enough, that it didn't discuss
usability issues as well.
So I would say obviously you never get 100 percent
agreement, but in this case we are pretty close to consensus,
at least within ACM.
The Chairman. The gentleman's time has expired. Make brief
comments, please. Mr. Shamos, first.
Mr. Shamos. I want to respond to a couple of things. I
actually didn't make a comment about scare tactics, although I
believe there was another member of the panel that did. I just
said I don't think we should appeal to emotion on this issue.
I agree that H.R. 550 does not expressly outlaw any
particular type of voting equipment. My point was that the
practical effect of it is that it outlaws DRE machines, and the
reason it outlaws DRE machines is there is no current machine
on the market that meets the requirement of the bill and that
is usable in individual States along with their requirements.
For example, in Pennsylvania there is popular call for a
paper trail machine. Four vendors have come to Pennsylvania
with their paper trail machine. Not a single one has been able
to simultaneously offer a paper trail and meet Pennsylvania's
statutory and constitutional requirements. So we can't have one
even if we want one. The technology is just not there yet.
The Chairman. I think Mr. Felten had a comment.
Mr. Felten. The key issue, I think, is resiliency; things
go wrong, people make mistakes, and we need to have a system we
can trust even when things do go wrong. The combination of
paper plus electronic record is more resilient than either one
would be alone, and that, I think, is the strongest argument
for having a paper-based verification system.
Mr. Ehlers. I think Mr. Cunningham has the last answer.
Mr. Cunningham. I just wanted to make the point to
everybody that my experience is most votes are lost due to
voter error, not machine error, not election official error. I
don't know if you looked at my resume, but I have about 20
years in the printing business, and I have been around a lot of
printing machines and copy machines, and I can assure you
anything you put paper through will jam at some point in time.
E-voting, I want to say to you, I truly believe that in the
long-term interest of this country--we are still voting the
same way we did 150 years ago, as you mentioned, Ms. Lofgren,
down to your little poll at the corner and precinct. Our
society has changed. It is mobile, moving. The ability to
incorporate the vote centers as Scott Doyle in Colorado has
been working with as a convenience to voters, those types of
concepts are based on electronic voting.
Let's not throw the baby out with the bath water here. I
think, Mr. Brady, what is doing more damage to voter
confidence, quite frankly, is people like your distinguished
colleague Mr. Conyers publishing reports about the election in
Ohio that are factless and baseless; none of the accusations
have been proved.
We have got to quit this. We have got to get this
conversation back to an honest debate about, as I think the
whole panel has said, how do we work together and move this
thing forward and quit this sky is falling kind of thing. I
think elections, because given the magnitude of them--and I
have seen now 9 years' worth of them, two Presidential, couple
of gubernatorials--given what could happen and the magnitude of
the task, they are running pretty darn good in this country,
and I know people all over the country like myself and Mr.
Smith that are darn proud they are involved in it. And the net
effect is we are going to begin to drive those people out of
this, which is going to make the system more vulnerable than
you ever imagined.
Ms. Millender-McDonald. Mr. Cunningham, I sure hope that is
accurate, what you have said, because the voter is not there
yet. Even though you folks are and your experts, the voter is
not there yet. And that is the ultimate one that we must bring
trust, security to bear.
I would like for you to get for me whatever documentation
you have that suggests voter error is more than a paper error.
If you have that type of verification of that statement you
made, I would like to have it.
Mr. Cunningham. My point was that most voting error is
voter error.
The Chairman. I thank you for your comments. That is a good
wrap-up. We are going to have votes in just a few moments, and
I would just like to make a few closing comments.
First of all, I thank each and every one of you for being
here in the audience as well as at the witness table. You have
contributed immensely to this very important issue.
There is our votes.
I recognize very clearly, since I have served at the local
level, the state legislature and now here, that the states have
an important role, local governments have an important role,
and the federal government has an important role.
We often say here that the states are the experimental
apparatus that tests ideas, and then the federal government
should select from the best of what the states have discovered.
We did not take the time to do that in HAVA, and I think that
was a mistake. We also did not take the time to first set the
standards clearly and then allow manufacturers to develop
equipment to meet those standards. And I think that was a fatal
flaw which has, I believe, created much of the uncertainty that
we have.
I agree totally with the statement someone made: Never buy
the first model of anything. I bought the first model of one
automobile just because it precisely fit my needs, it was a
good manufacturer; a bad mistake, and I was franklyrelieved
when the car eventually got totaled and I got the insurance value
because I probably could never have sold it.
We have to recognize that there is a lot of work to be done
here yet, and the American public's confidence will return
because we will build a better system.
Finally, I want to comment that I always look at two
aspects here. We want to assure every voter that their vote
will be counted, be counted accurately, and that the system
will work that way. There is a second factor we must remember,
and that gets back to the viruses and other issues. We also
have to assure every voter that not only will the vote be
counted, but it will not be negated or diluted by other people
voting fraudulently or performing fraudulent acts such as
viruses, throwing ballot boxes away and so forth. I want to
make sure every voter is assured of both of those--an accurate
count of their vote and an assurance that no one else is going
to negate it through illegal activity.
So I am concentrating on those two not just in this
particular issue, but in other issues such as the photo ID bill
that we passed through the House a week ago, which I think will
also help.
Thank you very, very much. You have been an outstanding
panel. I appreciate all that you have done. We do have to go
vote, and I have a few things to read here. I ask unanimous
consent that Members and witnesses have seven calendar days to
submit material for the record, including additional questions
of the witnesses, and for those statements and materials to be
entered into the appropriate place in the record. And I assume
if we send you written questions, you will respond to those.
Without objection the material will be so entered.
The Chairman. I ask unanimous consent that staff be
authorized to make technical and conforming changes on all
matters considered by the committee at today's hearing. Without
objection, so ordered.
Ms. Millender-McDonald.
Ms. Millender-McDonald. I just wanted to concur with you. I
have served on the local, State and Federal level, and I do
think that we need to revisit HAVA because it was more or less
geared for the Federal. And we appreciate all of those who have
come today, those who serve on both the local, State and
Federal. Thank you, Mr. Chairman.
The Chairman. Thank you.
Having completed our business for today and for this
hearing, the committee is hereby adjourned.
[Whereupon, at 12:23 p.m., the committee was adjourned.]
[GRAPHIC] [TIFF OMITTED] T1270A.126
[GRAPHIC] [TIFF OMITTED] T1270A.127
[GRAPHIC] [TIFF OMITTED] T1270A.128
[GRAPHIC] [TIFF OMITTED] T1270A.129
[GRAPHIC] [TIFF OMITTED] T1270A.130
[GRAPHIC] [TIFF OMITTED] T1270A.131
[GRAPHIC] [TIFF OMITTED] T1270A.132
[GRAPHIC] [TIFF OMITTED] T1270A.133
[GRAPHIC] [TIFF OMITTED] T1270A.134
[GRAPHIC] [TIFF OMITTED] T1270A.135
[GRAPHIC] [TIFF OMITTED] T1270A.136
[GRAPHIC] [TIFF OMITTED] T1270A.137
[GRAPHIC] [TIFF OMITTED] T1270A.138
[GRAPHIC] [TIFF OMITTED] T1270A.139
[GRAPHIC] [TIFF OMITTED] T1270A.140
[GRAPHIC] [TIFF OMITTED] T1270A.141
[GRAPHIC] [TIFF OMITTED] T1270A.142
[GRAPHIC] [TIFF OMITTED] T1270A.143
[GRAPHIC] [TIFF OMITTED] T1270A.144
[GRAPHIC] [TIFF OMITTED] T1270A.145
[GRAPHIC] [TIFF OMITTED] T1270A.146
[GRAPHIC] [TIFF OMITTED] T1270A.147
[GRAPHIC] [TIFF OMITTED] T1270A.148
[GRAPHIC] [TIFF OMITTED] T1270A.149
[GRAPHIC] [TIFF OMITTED] T1270A.150
[GRAPHIC] [TIFF OMITTED] T1270A.151
[GRAPHIC] [TIFF OMITTED] T1270A.152
[GRAPHIC] [TIFF OMITTED] T1270A.153
[GRAPHIC] [TIFF OMITTED] T1270A.154
[GRAPHIC] [TIFF OMITTED] T1270A.155
[GRAPHIC] [TIFF OMITTED] T1270A.156
[GRAPHIC] [TIFF OMITTED] T1270A.157
[GRAPHIC] [TIFF OMITTED] T1270A.158
[GRAPHIC] [TIFF OMITTED] T1270A.159
[GRAPHIC] [TIFF OMITTED] T1270A.160
[GRAPHIC] [TIFF OMITTED] T1270A.161
[GRAPHIC] [TIFF OMITTED] T1270A.162
[GRAPHIC] [TIFF OMITTED] T1270A.163
[GRAPHIC] [TIFF OMITTED] T1270A.164
[GRAPHIC] [TIFF OMITTED] T1270A.165
[GRAPHIC] [TIFF OMITTED] T1270A.166
[GRAPHIC] [TIFF OMITTED] T1270A.167
[GRAPHIC] [TIFF OMITTED] T1270A.168
[GRAPHIC] [TIFF OMITTED] T1270A.169
[GRAPHIC] [TIFF OMITTED] T1270A.170
[GRAPHIC] [TIFF OMITTED] T1270A.171
[GRAPHIC] [TIFF OMITTED] T1270A.172
[GRAPHIC] [TIFF OMITTED] T1270A.173
[GRAPHIC] [TIFF OMITTED] T1270A.174
[GRAPHIC] [TIFF OMITTED] T1270A.175
[GRAPHIC] [TIFF OMITTED] T1270A.176
[GRAPHIC] [TIFF OMITTED] T1270A.177
[GRAPHIC] [TIFF OMITTED] T1270A.178
[GRAPHIC] [TIFF OMITTED] T1270A.179
[GRAPHIC] [TIFF OMITTED] T1270A.180
[GRAPHIC] [TIFF OMITTED] T1270A.181
[GRAPHIC] [TIFF OMITTED] T1270A.182
[GRAPHIC] [TIFF OMITTED] T1270A.183
[GRAPHIC] [TIFF OMITTED] T1270A.184
[GRAPHIC] [TIFF OMITTED] T1270A.185
[GRAPHIC] [TIFF OMITTED] T1270A.186
[GRAPHIC] [TIFF OMITTED] T1270A.187
[GRAPHIC] [TIFF OMITTED] T1270A.188
[GRAPHIC] [TIFF OMITTED] T1270A.189
[GRAPHIC] [TIFF OMITTED] T1270A.190
[GRAPHIC] [TIFF OMITTED] T1270A.191
[GRAPHIC] [TIFF OMITTED] T1270A.192
[GRAPHIC] [TIFF OMITTED] T1270A.193
[GRAPHIC] [TIFF OMITTED] T1270A.194
[GRAPHIC] [TIFF OMITTED] T1270A.195
[GRAPHIC] [TIFF OMITTED] T1270A.196
[GRAPHIC] [TIFF OMITTED] T1270A.197
[GRAPHIC] [TIFF OMITTED] T1270A.198
[GRAPHIC] [TIFF OMITTED] T1270A.199
[GRAPHIC] [TIFF OMITTED] T1270A.200
[GRAPHIC] [TIFF OMITTED] T1270A.201
[GRAPHIC] [TIFF OMITTED] T1270A.202
[GRAPHIC] [TIFF OMITTED] T1270A.203
[GRAPHIC] [TIFF OMITTED] T1270A.204
[GRAPHIC] [TIFF OMITTED] T1270A.205
[GRAPHIC] [TIFF OMITTED] T1270A.206
[GRAPHIC] [TIFF OMITTED] T1270A.207
[GRAPHIC] [TIFF OMITTED] T1270A.208
[GRAPHIC] [TIFF OMITTED] T1270A.209
[GRAPHIC] [TIFF OMITTED] T1270A.210
[GRAPHIC] [TIFF OMITTED] T1270A.211
[GRAPHIC] [TIFF OMITTED] T1270A.212
[GRAPHIC] [TIFF OMITTED] T1270A.213
[GRAPHIC] [TIFF OMITTED] T1270A.214
[GRAPHIC] [TIFF OMITTED] T1270A.215
[GRAPHIC] [TIFF OMITTED] T1270A.216
[GRAPHIC] [TIFF OMITTED] T1270A.217
[GRAPHIC] [TIFF OMITTED] T1270A.218
[GRAPHIC] [TIFF OMITTED] T1270A.219
[GRAPHIC] [TIFF OMITTED] T1270A.220
[GRAPHIC] [TIFF OMITTED] T1270A.221
[GRAPHIC] [TIFF OMITTED] T1270A.222
[GRAPHIC] [TIFF OMITTED] T1270A.223
[GRAPHIC] [TIFF OMITTED] T1270A.224
[GRAPHIC] [TIFF OMITTED] T1270A.225
[GRAPHIC] [TIFF OMITTED] T1270A.226
[GRAPHIC] [TIFF OMITTED] T1270A.227
[GRAPHIC] [TIFF OMITTED] T1270A.228
[GRAPHIC] [TIFF OMITTED] T1270A.229
[GRAPHIC] [TIFF OMITTED] T1270A.230
[GRAPHIC] [TIFF OMITTED] T1270A.231
[GRAPHIC] [TIFF OMITTED] T1270A.232
[GRAPHIC] [TIFF OMITTED] T1270A.233
[GRAPHIC] [TIFF OMITTED] T1270A.234
[GRAPHIC] [TIFF OMITTED] T1270A.235
[GRAPHIC] [TIFF OMITTED] T1270A.236
[GRAPHIC] [TIFF OMITTED] T1270A.237
[GRAPHIC] [TIFF OMITTED] T1270A.238
[GRAPHIC] [TIFF OMITTED] T1270A.239
[GRAPHIC] [TIFF OMITTED] T1270A.240
[GRAPHIC] [TIFF OMITTED] T1270A.241
[GRAPHIC] [TIFF OMITTED] T1270A.242
[GRAPHIC] [TIFF OMITTED] T1270A.243
[GRAPHIC] [TIFF OMITTED] T1270A.244
[GRAPHIC] [TIFF OMITTED] T1270A.245
[GRAPHIC] [TIFF OMITTED] T1270A.246
[GRAPHIC] [TIFF OMITTED] T1270A.247
[GRAPHIC] [TIFF OMITTED] T1270A.248
[GRAPHIC] [TIFF OMITTED] T1270A.249
[GRAPHIC] [TIFF OMITTED] T1270A.250
[GRAPHIC] [TIFF OMITTED] T1270A.251
[GRAPHIC] [TIFF OMITTED] T1270A.252
[GRAPHIC] [TIFF OMITTED] T1270A.253
[GRAPHIC] [TIFF OMITTED] T1270A.254
[GRAPHIC] [TIFF OMITTED] T1270A.255
[GRAPHIC] [TIFF OMITTED] T1270A.256
[GRAPHIC] [TIFF OMITTED] T1270A.257
[GRAPHIC] [TIFF OMITTED] T1270A.258
[GRAPHIC] [TIFF OMITTED] T1270A.259
[GRAPHIC] [TIFF OMITTED] T1270A.260
[GRAPHIC] [TIFF OMITTED] T1270A.261
[GRAPHIC] [TIFF OMITTED] T1270A.262
[GRAPHIC] [TIFF OMITTED] T1270A.263
[GRAPHIC] [TIFF OMITTED] T1270A.264
[GRAPHIC] [TIFF OMITTED] T1270A.265
[GRAPHIC] [TIFF OMITTED] T1270A.266
[GRAPHIC] [TIFF OMITTED] T1270A.267
[GRAPHIC] [TIFF OMITTED] T1270A.268
[GRAPHIC] [TIFF OMITTED] T1270A.269
[GRAPHIC] [TIFF OMITTED] T1270A.270
[GRAPHIC] [TIFF OMITTED] T1270A.271
[GRAPHIC] [TIFF OMITTED] T1270A.272
[GRAPHIC] [TIFF OMITTED] T1270A.273
[GRAPHIC] [TIFF OMITTED] T1270A.274
[GRAPHIC] [TIFF OMITTED] T1270A.275
[GRAPHIC] [TIFF OMITTED] T1270A.276
[GRAPHIC] [TIFF OMITTED] T1270A.277
[GRAPHIC] [TIFF OMITTED] T1270A.278
[GRAPHIC] [TIFF OMITTED] T1270A.279
[GRAPHIC] [TIFF OMITTED] T1270A.280
[GRAPHIC] [TIFF OMITTED] T1270A.281
[GRAPHIC] [TIFF OMITTED] T1270A.282
[GRAPHIC] [TIFF OMITTED] T1270A.283
[GRAPHIC] [TIFF OMITTED] T1270A.284
[GRAPHIC] [TIFF OMITTED] T1270A.285
[GRAPHIC] [TIFF OMITTED] T1270A.286
[GRAPHIC] [TIFF OMITTED] T1270A.287
[GRAPHIC] [TIFF OMITTED] T1270A.288
[GRAPHIC] [TIFF OMITTED] T1270A.289
[GRAPHIC] [TIFF OMITTED] T1270A.290
[GRAPHIC] [TIFF OMITTED] T1270A.291
[GRAPHIC] [TIFF OMITTED] T1270A.292
[GRAPHIC] [TIFF OMITTED] T1270A.293
[GRAPHIC] [TIFF OMITTED] T1270A.294
[GRAPHIC] [TIFF OMITTED] T1270A.295
[GRAPHIC] [TIFF OMITTED] T1270A.296
[GRAPHIC] [TIFF OMITTED] T1270A.297
[GRAPHIC] [TIFF OMITTED] T1270A.298
[GRAPHIC] [TIFF OMITTED] T1270A.299
[GRAPHIC] [TIFF OMITTED] T1270A.300
[GRAPHIC] [TIFF OMITTED] T1270A.301
[GRAPHIC] [TIFF OMITTED] T1270A.302
[GRAPHIC] [TIFF OMITTED] T1270A.303
[GRAPHIC] [TIFF OMITTED] T1270A.304
[GRAPHIC] [TIFF OMITTED] T1270A.305
[GRAPHIC] [TIFF OMITTED] T1270A.306
[GRAPHIC] [TIFF OMITTED] T1270A.307
[GRAPHIC] [TIFF OMITTED] T1270A.308
[GRAPHIC] [TIFF OMITTED] T1270A.309
[GRAPHIC] [TIFF OMITTED] T1270A.310
[GRAPHIC] [TIFF OMITTED] T1270A.311
[GRAPHIC] [TIFF OMITTED] T1270A.312
[GRAPHIC] [TIFF OMITTED] T1270A.313
[GRAPHIC] [TIFF OMITTED] T1270A.314
[GRAPHIC] [TIFF OMITTED] T1270A.315
[GRAPHIC] [TIFF OMITTED] T1270A.316
[GRAPHIC] [TIFF OMITTED] T1270A.317
[GRAPHIC] [TIFF OMITTED] T1270A.318
[GRAPHIC] [TIFF OMITTED] T1270A.319
[GRAPHIC] [TIFF OMITTED] T1270A.320
[GRAPHIC] [TIFF OMITTED] T1270A.321
[GRAPHIC] [TIFF OMITTED] T1270A.322
[GRAPHIC] [TIFF OMITTED] T1270A.323
[GRAPHIC] [TIFF OMITTED] T1270A.324
[GRAPHIC] [TIFF OMITTED] T1270A.325
[GRAPHIC] [TIFF OMITTED] T1270A.326
[GRAPHIC] [TIFF OMITTED] T1270A.327
[GRAPHIC] [TIFF OMITTED] T1270A.328
[GRAPHIC] [TIFF OMITTED] T1270A.329
[GRAPHIC] [TIFF OMITTED] T1270A.330
[GRAPHIC] [TIFF OMITTED] T1270A.331
[GRAPHIC] [TIFF OMITTED] T1270A.332
[GRAPHIC] [TIFF OMITTED] T1270A.333
[GRAPHIC] [TIFF OMITTED] T1270A.334
[GRAPHIC] [TIFF OMITTED] T1270A.335
[GRAPHIC] [TIFF OMITTED] T1270A.336
[GRAPHIC] [TIFF OMITTED] T1270A.337
[GRAPHIC] [TIFF OMITTED] T1270A.338
[GRAPHIC] [TIFF OMITTED] T1270A.339
[GRAPHIC] [TIFF OMITTED] T1270A.340
[GRAPHIC] [TIFF OMITTED] T1270A.341
[GRAPHIC] [TIFF OMITTED] T1270A.342
[GRAPHIC] [TIFF OMITTED] T1270A.343
[GRAPHIC] [TIFF OMITTED] T1270A.344
[GRAPHIC] [TIFF OMITTED] T1270A.345
[GRAPHIC] [TIFF OMITTED] T1270A.346
[GRAPHIC] [TIFF OMITTED] T1270A.347
[GRAPHIC] [TIFF OMITTED] T1270A.348
[GRAPHIC] [TIFF OMITTED] T1270A.349
[GRAPHIC] [TIFF OMITTED] T1270A.350
[GRAPHIC] [TIFF OMITTED] T1270A.351
[GRAPHIC] [TIFF OMITTED] T1270A.352
[GRAPHIC] [TIFF OMITTED] T1270A.353
[GRAPHIC] [TIFF OMITTED] T1270A.354
[GRAPHIC] [TIFF OMITTED] T1270A.355
[GRAPHIC] [TIFF OMITTED] T1270A.356
[GRAPHIC] [TIFF OMITTED] T1270A.357
[GRAPHIC] [TIFF OMITTED] T1270A.358
[GRAPHIC] [TIFF OMITTED] T1270A.359
[GRAPHIC] [TIFF OMITTED] T1270A.360
[GRAPHIC] [TIFF OMITTED] T1270A.361
[GRAPHIC] [TIFF OMITTED] T1270A.362
[GRAPHIC] [TIFF OMITTED] T1270A.363
[GRAPHIC] [TIFF OMITTED] T1270A.364
[GRAPHIC] [TIFF OMITTED] T1270A.365
[GRAPHIC] [TIFF OMITTED] T1270A.366
[GRAPHIC] [TIFF OMITTED] T1270A.367
[GRAPHIC] [TIFF OMITTED] T1270A.368
[GRAPHIC] [TIFF OMITTED] T1270A.369
[GRAPHIC] [TIFF OMITTED] T1270A.370
[GRAPHIC] [TIFF OMITTED] T1270A.371
[GRAPHIC] [TIFF OMITTED] T1270A.372
[GRAPHIC] [TIFF OMITTED] T1270A.373
[GRAPHIC] [TIFF OMITTED] T1270A.374
[GRAPHIC] [TIFF OMITTED] T1270A.375
[GRAPHIC] [TIFF OMITTED] T1270A.376
[GRAPHIC] [TIFF OMITTED] T1270A.377
[GRAPHIC] [TIFF OMITTED] T1270A.378
[GRAPHIC] [TIFF OMITTED] T1270A.379
[GRAPHIC] [TIFF OMITTED] T1270A.380
[GRAPHIC] [TIFF OMITTED] T1270A.381
[GRAPHIC] [TIFF OMITTED] T1270A.382
[GRAPHIC] [TIFF OMITTED] T1270A.383
[GRAPHIC] [TIFF OMITTED] T1270A.384
[GRAPHIC] [TIFF OMITTED] T1270A.385
[GRAPHIC] [TIFF OMITTED] T1270A.386
[GRAPHIC] [TIFF OMITTED] T1270A.387
[GRAPHIC] [TIFF OMITTED] T1270A.388
[GRAPHIC] [TIFF OMITTED] T1270A.389
[GRAPHIC] [TIFF OMITTED] T1270A.390
[GRAPHIC] [TIFF OMITTED] T1270A.391
[GRAPHIC] [TIFF OMITTED] T1270A.392
[GRAPHIC] [TIFF OMITTED] T1270A.393
[GRAPHIC] [TIFF OMITTED] T1270A.394
[GRAPHIC] [TIFF OMITTED] T1270A.395
[GRAPHIC] [TIFF OMITTED] T1270A.396
[GRAPHIC] [TIFF OMITTED] T1270A.397
[GRAPHIC] [TIFF OMITTED] T1270A.398
[GRAPHIC] [TIFF OMITTED] T1270A.399
[GRAPHIC] [TIFF OMITTED] T1270A.400
[GRAPHIC] [TIFF OMITTED] T1270A.401
[GRAPHIC] [TIFF OMITTED] T1270A.402
[GRAPHIC] [TIFF OMITTED] T1270A.403
[GRAPHIC] [TIFF OMITTED] T1270A.404
[GRAPHIC] [TIFF OMITTED] T1270A.405
[GRAPHIC] [TIFF OMITTED] T1270A.406
[GRAPHIC] [TIFF OMITTED] T1270A.407
[GRAPHIC] [TIFF OMITTED] T1270A.408
[GRAPHIC] [TIFF OMITTED] T1270A.409
[GRAPHIC] [TIFF OMITTED] T1270A.410
[GRAPHIC] [TIFF OMITTED] T1270A.411
[GRAPHIC] [TIFF OMITTED] T1270A.412
[GRAPHIC] [TIFF OMITTED] T1270A.413
[GRAPHIC] [TIFF OMITTED] T1270A.414
[GRAPHIC] [TIFF OMITTED] T1270A.415
[GRAPHIC] [TIFF OMITTED] T1270A.416
[GRAPHIC] [TIFF OMITTED] T1270A.417
[GRAPHIC] [TIFF OMITTED] T1270A.418
[GRAPHIC] [TIFF OMITTED] T1270A.419
[GRAPHIC] [TIFF OMITTED] T1270A.420
[GRAPHIC] [TIFF OMITTED] T1270A.421
[GRAPHIC] [TIFF OMITTED] T1270A.422
[GRAPHIC] [TIFF OMITTED] T1270A.423
[GRAPHIC] [TIFF OMITTED] T1270A.424
[GRAPHIC] [TIFF OMITTED] T1270A.425
[GRAPHIC] [TIFF OMITTED] T1270A.426
[GRAPHIC] [TIFF OMITTED] T1270A.427
[GRAPHIC] [TIFF OMITTED] T1270A.428
[GRAPHIC] [TIFF OMITTED] T1270A.429
[GRAPHIC] [TIFF OMITTED] T1270A.430
[GRAPHIC] [TIFF OMITTED] T1270A.431
[GRAPHIC] [TIFF OMITTED] T1270A.432
[GRAPHIC] [TIFF OMITTED] T1270A.433
[GRAPHIC] [TIFF OMITTED] T1270A.434
[GRAPHIC] [TIFF OMITTED] T1270A.435
[GRAPHIC] [TIFF OMITTED] T1270A.436
[GRAPHIC] [TIFF OMITTED] T1270A.437
[GRAPHIC] [TIFF OMITTED] T1270A.438
[GRAPHIC] [TIFF OMITTED] T1270A.439
[GRAPHIC] [TIFF OMITTED] T1270A.440
[GRAPHIC] [TIFF OMITTED] T1270A.441
[GRAPHIC] [TIFF OMITTED] T1270A.442
[GRAPHIC] [TIFF OMITTED] T1270A.443
[GRAPHIC] [TIFF OMITTED] T1270A.444
[GRAPHIC] [TIFF OMITTED] T1270A.445
[GRAPHIC] [TIFF OMITTED] T1270A.446
[GRAPHIC] [TIFF OMITTED] T1270A.447
[GRAPHIC] [TIFF OMITTED] T1270A.448
[GRAPHIC] [TIFF OMITTED] T1270A.449
[GRAPHIC] [TIFF OMITTED] T1270A.450
[GRAPHIC] [TIFF OMITTED] T1270A.451
[GRAPHIC] [TIFF OMITTED] T1270A.452