[House Hearing, 109 Congress]
[From the U.S. Government Publishing Office]



 
  HEARING ON VERIFICATION, SECURITY AND PAPER RECORDS FOR OUR NATION'S
                       ELECTRONIC VOTING SYSTEMS

=======================================================================

                                HEARING

                               before the

                   COMMITTEE ON HOUSE ADMINISTRATION
                        HOUSE OF REPRESENTATIVES

                       ONE HUNDRED NINTH CONGRESS

                             SECOND SESSION

                               ----------                              

           Hearing held in Washington, DC, September 28, 2006

                               ----------                              

      Printed for the use of the Committee on House Administration

 HEARING ON VERIFICATION, SECURITY AND PAPER RECORDS FOR OUR NATION'S 
                       ELECTRONIC VOTING SYSTEMS


          HEARING ON VERIFICATION, SECURITY AND PAPER RECORDS
               FOR OUR NATION'S ELECTRONIC VOTING SYSTEMS


                                HEARING

                               before the

                   COMMITTEE ON HOUSE ADMINISTRATION
                        HOUSE OF REPRESENTATIVES

                       ONE HUNDRED NINTH CONGRESS

                             SECOND SESSION

                               __________

           Hearing Held in Washington, DC, September 28, 2006

                               __________

      Printed for the Use of the Committee on House Administration



                    U.S. GOVERNMENT PRINTING OFFICE
31-270                      WASHINGTON : 2007
_____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512ï¿½091800  
Fax: (202) 512ï¿½092250 Mail: Stop SSOP, Washington, DC 20402ï¿½090001

                   COMMITTEE ON HOUSE ADMINISTRATION

                        VERNON EHLERS, Chairman
ROBERT W. NEY, Ohio                  JUANITA MILLENDER-McDONALD, 
JOHN L. MICA, Florida                    California,
CANDICE MILLER, Michigan               Ranking Minority Member
JOHN T. DOOLITTLE, California        ROBERT A. BRADY, Pennsylvania
THOMAS M. REYNOLDS, New York         ZOE LOFGREN, California
                                 ------                                
                      Will Plaster, Staff Director
                George Shevlin, Minority Staff Director


 VERIFICATION, SECURITY AND PAPER RECORDS FOR OUR NATION'S ELECTRONIC 
                             VOTING SYSTEMS

                      THURSDAY, SEPTEMBER 28, 2006

                          House of Representatives,
                         Committee on House Administration,
                                                    Washington, DC.
    The committee met, pursuant to call, at 10:03 a.m., in room 
1310, Longworth House Office Building, Hon. Vernon Ehlers 
(chairman of the committee) presiding.
    Present: Representatives Ehlers, Ney, Doolittle, Millender-
McDonald, Brady and Lofgren.
    Also Present: Representative Holt.
    Staff Present: Paul Vinovich, Counsel; Gineen Beach, 
Counsel; Peter Sloan, Professional Staff; George F. Shevlin, 
Minority Staff Director; Charles Tracy Howell, Minority Chief 
Counsel; Thomas Hicks, Minority Elections Counsel; Mathew A. 
Pinkus, Minority Parliamentarian, Janelle Rene Hu, Minority 
Professional Staff; Teri A. Morgan, Legislative Director, 
Office of Representative Brady; Stacey E. Leavandosky, Chief of 
Staff, Office of Representative Zoe Lofgren; and Joel 
Vanderver, Intern, Office of Representative Zoe Lofgren.
    The Chairman. Good morning, ladies and gentlemen. The 
Committee on House Administration will come to order. First I 
would like to advise and request all members of our audience 
here today that all cellular phones, pagers, and other 
electronic equipment must be silent to prevent interruption of 
our business. So I would appreciate it if you would turn these 
devices off, as I have.
    The committee is meeting today for a hearing on electronic 
voting machines and related issues. The election that will 
occur in just a few weeks will be the first general Federal 
election conducted since the Help America Vote Act of 2002, 
better known as HAVA, was fully implemented. That act, passed 
by this Congress in response to the voting system weaknesses 
exposed during the 2000 recount in Florida, set new standards 
for voting systems that were meant to make our elections more 
accurate and accessible.
    Three billion dollars were appropriated by the Congress 
pursuant to HAVA, with most of these moneys being dedicated to 
new equipment purchases by jurisdictions, localities, counties, 
cities, townships, et cetera, that wanted to improve their 
voting systems. As a result many jurisdictions are using new 
equipment for the first time this year. It is no surprise that 
there have been a few problems.
    Though HAVA did not require the adoption of any particular 
kind of technology, many jurisdictions purchased electronic 
voting systems because they felt these systems were best able 
to meet the requirements of HAVA. Not surprisingly, some 
jurisdictions using this equipment for the first time have 
encountered some difficulties. Just two weeks ago, in nearby 
Montgomery County, Maryland polls were not able to open on time 
because poll workers were sent to their posts without the cards 
necessary to start up the electronic machines.
    In the wake of this episode a column appeared in the 
Washington Post under the headline: If Paper Ballots Restore 
Trust in Elections, Let's Switch. The column noted people trust 
paper ballots because they are real. You can hold them in your 
hand and count them again if you need to.
    Indeed, before it had electronic voting systems, Montgomery 
County used a punch system. Need we be reminded of the problems 
we had with that system.
    I direct your attention to the screen above. The audience 
can look at that one, we will look at this one. This is a 
reminder of what we saw in the 2000 election in Florida, images 
of people with paper ballots. This one is a group of people 
staring at paper punch cards trying to figure out if they 
constitute a vote, and if so, for whom.
    If you look at the second slide, you see how closely these 
ballots were being examined by groups.
    And the third slide shows the extreme: putting things under 
the magnifying glass. You can see this man has got paper.
    Now, I am not showing these to condemn paper, I am just 
pointing out that punch cards with paper, rather thick paper at 
that, have caused some serious problems. Simply saying ``Let's 
use paper,'' as some people are saying, does not mean all the 
problems go away. We have to consider all the different aspects 
of it, and these pictures, as you can tell, were taken in 
Florida during the 2000 recount. That will go down in history, 
I am sure, because of the recount and the ramifications.
    These images do not inspire trust and confidence either in 
the punch card system or in voting systems in general. As we 
look at this problem, it is worthwhile to remember the famous 
words of H.L. Mencken who once said, ``For every complex 
problem there is an answer that is clear, simple, and wrong.''
    We would like to have answers that are clear and simple, 
but we certainly do not want wrong answers, and so we are going 
to proceed with this very thoroughly and deliberately to try to 
make sure that we have good answers that are right. 
Unfortunately, the problem some jurisdictions have experienced 
with their new systems have caused some to suggest that we 
should revert to a reliance on paper, the so-called ``paper 
trail'' or ``paper tape.'' We know frompainful and bitter 
experience that paper systems also can fail to deliver accurate results 
and are susceptible to manipulation.
    To ignore this reality and assert that paper somehow 
ensures integrity or a correct result is simplistic and wrong. 
In fact, no voting system by itself can guarantee election 
integrity. The best system on earth will fail if not properly 
maintained, deployed and operated, and that is the key point 
that we have to remember.
    Even though I am a physicist and I have used computers 
since 1957, I am not saying by virtue of these comments that 
paper is bad. Electronics, of course, is good. I have used that 
for many years. I know that can fail too if not programmed or 
operated properly.
    I believe the important point is to design the best system 
you can, but make sure you have auditability built in, whether 
it is paper or some other electronic device.
    Our hearing will examine a range of issues related to 
electronic voting machines. We will hear about their problems 
but also about their benefits. We will also hear about the 
experience in one jurisdiction that tried to address the 
security concerns of a paperless system by requiring the 
machine to generate a paper trail.
    This hearing is being held to educate the members and the 
public about these complicated issues. I hope when the hearing 
is over, we will have a better understanding of the problems 
and benefits of these new technologies. I also hope that as we 
look for solutions to these complicated problems, we resist the 
temptation to settle on answers that are clear, simple and 
wrong.
    [The information follows:]

    [GRAPHIC] [TIFF OMITTED] T1270A.001
    
    [GRAPHIC] [TIFF OMITTED] T1270A.002
    
    The Chairman. Now I would like to ask unanimous consent 
that the gentleman from New Jersey, Representative Russ Holt, 
who is the author of a bill dealing very much with one aspect 
of this, be allowed to join us on the dais today and that he 
may be permitted to ask questions of the witnesses and enter 
his statement into the record. Without objection, so ordered.
    [The information follows:]

    [GRAPHIC] [TIFF OMITTED] T1270A.003
    
    [GRAPHIC] [TIFF OMITTED] T1270A.004
    
    [GRAPHIC] [TIFF OMITTED] T1270A.005
    
    [GRAPHIC] [TIFF OMITTED] T1270A.006
    
    [GRAPHIC] [TIFF OMITTED] T1270A.007
    
    [GRAPHIC] [TIFF OMITTED] T1270A.008
    
    [GRAPHIC] [TIFF OMITTED] T1270A.009
    
    [GRAPHIC] [TIFF OMITTED] T1270A.010
    
    [GRAPHIC] [TIFF OMITTED] T1270A.011
    
    [GRAPHIC] [TIFF OMITTED] T1270A.012
    
    [GRAPHIC] [TIFF OMITTED] T1270A.013
    
    [GRAPHIC] [TIFF OMITTED] T1270A.014
    
    [GRAPHIC] [TIFF OMITTED] T1270A.015
    
    [GRAPHIC] [TIFF OMITTED] T1270A.016
    
    [GRAPHIC] [TIFF OMITTED] T1270A.017
    
    [GRAPHIC] [TIFF OMITTED] T1270A.018
    
    [GRAPHIC] [TIFF OMITTED] T1270A.019
    
    [GRAPHIC] [TIFF OMITTED] T1270A.020
    
    [GRAPHIC] [TIFF OMITTED] T1270A.021
    
    [GRAPHIC] [TIFF OMITTED] T1270A.022
    
    [GRAPHIC] [TIFF OMITTED] T1270A.023
    
    [GRAPHIC] [TIFF OMITTED] T1270A.024
    
    [GRAPHIC] [TIFF OMITTED] T1270A.025
    
    [GRAPHIC] [TIFF OMITTED] T1270A.026
    
    [GRAPHIC] [TIFF OMITTED] T1270A.027
    
    [GRAPHIC] [TIFF OMITTED] T1270A.028
    
    [GRAPHIC] [TIFF OMITTED] T1270A.029
    
    [GRAPHIC] [TIFF OMITTED] T1270A.030
    
    [GRAPHIC] [TIFF OMITTED] T1270A.031
    
    [GRAPHIC] [TIFF OMITTED] T1270A.032
    
    [GRAPHIC] [TIFF OMITTED] T1270A.033
    
    [GRAPHIC] [TIFF OMITTED] T1270A.034
    
    [GRAPHIC] [TIFF OMITTED] T1270A.035
    
    [GRAPHIC] [TIFF OMITTED] T1270A.036
    
    [GRAPHIC] [TIFF OMITTED] T1270A.037
    
    [GRAPHIC] [TIFF OMITTED] T1270A.038
    
    [GRAPHIC] [TIFF OMITTED] T1270A.039
    
    [GRAPHIC] [TIFF OMITTED] T1270A.040
    
    [GRAPHIC] [TIFF OMITTED] T1270A.041
    
    [GRAPHIC] [TIFF OMITTED] T1270A.042
    
    [GRAPHIC] [TIFF OMITTED] T1270A.043
    
    [GRAPHIC] [TIFF OMITTED] T1270A.044
    
    [GRAPHIC] [TIFF OMITTED] T1270A.045
    
    [GRAPHIC] [TIFF OMITTED] T1270A.046
    
    [GRAPHIC] [TIFF OMITTED] T1270A.047
    
    [GRAPHIC] [TIFF OMITTED] T1270A.048
    
    [GRAPHIC] [TIFF OMITTED] T1270A.049
    
    [GRAPHIC] [TIFF OMITTED] T1270A.050
    
    [GRAPHIC] [TIFF OMITTED] T1270A.051
    
    [GRAPHIC] [TIFF OMITTED] T1270A.052
    
    [GRAPHIC] [TIFF OMITTED] T1270A.053
    
    [GRAPHIC] [TIFF OMITTED] T1270A.054
    
    [GRAPHIC] [TIFF OMITTED] T1270A.055
    
    [GRAPHIC] [TIFF OMITTED] T1270A.056
    
    [GRAPHIC] [TIFF OMITTED] T1270A.057
    
    [GRAPHIC] [TIFF OMITTED] T1270A.058
    
    [GRAPHIC] [TIFF OMITTED] T1270A.059
    
    [GRAPHIC] [TIFF OMITTED] T1270A.060
    
    [GRAPHIC] [TIFF OMITTED] T1270A.061
    
    The Chairman. Welcome, Representative Holt. We are pleased 
to have you here. This is one of the few times in the Congress 
when you will find two physicists sitting at the front desk 
listening to testimony.
    At this time, I would like to recognize the Ranking Member, 
Ms. Millender-McDonald, for any opening remarks she may have.
    Ms. Millender-McDonald. Thank you, Mr. Chairman, and good 
morning to you and all the witnesses and guests here this 
morning. I would like to thank you, Mr. Chairman, for calling 
this very important hearing on electronic voting machines. I am 
sure that you have heard from your constituents and 
constituents around the country, as I have heard, that folks 
are wary about these voting machine apparatuses and they are 
not sure whether or not they are working.
    Let me also thank you, Mr. Chairman, for welcoming 
Congressman Russ Holt to sit on the panel this morning. It was 
just 6 years ago that the 2000 Presidential election brought to 
light many problems with the elections process in our country. 
We encountered a wide range of frustrations with the election 
administration. Some of the most infamous problems involved 
punch cards with all of the hanging chads that the Chairman has 
just shown you. Others involved voters who were turned away 
from the polls without the opportunity to cast a vote.
    In response, this committee worked diligently and passed 
the Help America Vote Act, which is HAVA, to rid the country of 
outdated voting equipment and to ensure no eligible voter is 
turned away from the polls without casting a vote. Despite the 
passage of HAVA, however, many problems still remain, as we 
witnessed during the 2004 election and in several primaries 
this year.
    Today I hope to hear about methods of addressing these 
issues, even if we may not be able to implement suggested 
recommendations before the November election. I also hope that 
this oversight hearing will serve as a forum for the American 
people to gain confidence in direct recording electronic voting 
system machines.
    After the 2000 election, DRE, as we call them, machines 
were viewed as the answer to hanging chads and century-old 
lever machines. DRE machines also allowed individuals with 
disabilities to vote in private and without assistance for the 
first time. They have also been supported by a number of civil 
rights organizations, given the ease with which they are able 
to be programmed to display ballots in foreign languages.
    However, as we are aware, many concerns have been raised 
about the integrity and the reliability of these DRE machines. 
In fact, at times it may be seen that thesemachines have raised 
many more questions than answers. For example, some have called for a 
voter-verified paper audit trail for DRE machines. Some States already 
require this function for DRE machines.
    But even this similarly simple method raises numerous 
concerns. For example, when mechanisms serve as the official--
what mechanism serves as the official record in a recount? That 
is a question that has been raised often. What happens when the 
printer jams? Would the votes which were properly recorded by 
the DRE be thrown out if they are not similarly recorded on the 
paper? Those are the questions that have been raised often.
    I am also interested in hearing from our witnesses, 
especially the local election officials, regarding their views 
about the wisdom of imposing a Federal mandate which would 
specify which type of election equipment should be used. These 
decisions have mostly been left up to the State and local 
officials throughout our country's history, and I would like to 
know what the impact of a Federal mandate and a standard in 
this area would be, what precedent it would set for future 
election administration mandates on the States by the Federal 
Government, and how these mandates would be funded.
    In addition to discussing established concerns about DRE 
machines, I hope the witnesses invited today will address the 
security of all voting equipment. Only one-third of Americans 
will cast ballots on DRE machines, and although that number is 
growing, it still means that two-thirds of our voters will be 
casting ballots using other methodologies. Are these machines 
secure, are they reliable, are they subject to a suitable level 
of scrutiny?
    I am concerned that all of the media attention to voting 
security will inadvertently discourage voters from going to the 
polls, resulting in voter suppression. As we witnessed a few 
weeks ago in Maryland, voting machine reliability, stability 
and accuracy was not the inherent cause of mayhem. The lack of 
poll-worker training and other human factors of election 
administration caused problems and confusion at the polls for 
both voters and poll workers. If we do not adequately address 
all of these issues, voters may feel as if their votes will not 
be counted and decide not to participate on election day.
    This is one reason why I offered an amendment to double the 
funding for the college poll-worker training program. This 
program encourages college-age students to serve as poll 
workers and to become more involved with the election 
administration process.
    The electoral process is not perfect, Mr. Chairman. 
Improvements to the electoral process itself still need to be 
made. Fortunately, the Help America Vote Act of 2002 is a solid 
foundation upon which we can institute further electoral 
improvements. HAVA made it easier for voters to cast a ballot 
and harder for people to knowingly commit crime and fraud, 
which is why we need to appropriate the remaining $800 million 
balance which was authorized in title 2 of HAVA to fully fund 
the States and give HAVA a chance to work.
    As I have stated in the past, it is guaranteed that your 
vote will be lost if you don't cast a ballot. I would encourage 
every eligible voter to cast a ballot, no matter how harsh the 
rhetoric about the November elections and no matter how that 
ballot is cast: by DRE machines, absentee ballots, provisional 
ballots or whatever. Americans need to get out in November with 
the confidence that their vote will be counted correctly. 
Exercising this precious right is more important than the 
outcome of the elections, Mr. Chairman.
    I hope we can convene additional hearings in the future to 
examine any shortcomings in election administration and any 
impediments that voters experience in exercising their 
constitutional rights.
    I look forward to working with the Chairman and other 
members to continue to improve the voting process and I will 
continue to seek full funding of the Election Assistance 
Commission title 2 grants to ensure that the EAC can continue 
its crucial work to improve the electoral process. Even if one 
voter is disenfranchised, that is one voter too many. Thank 
you, Mr. Chairman.
    [The information follows:]

    [GRAPHIC] [TIFF OMITTED] T1270A.062
    
    [GRAPHIC] [TIFF OMITTED] T1270A.063
    
    [GRAPHIC] [TIFF OMITTED] T1270A.064
    
    The Chairman. I thank the Ranking Member for her comments, 
and I especially want to reinforce something you said. Voting 
in this nation has traditionally been controlled and operated 
by the local municipalities, cities, townships, counties and by 
the states. The only reason the federal government entered this 
is because of the problems with a federal election of a 
president in 2000, and we continue to have great respect for 
the localities and the States which have the responsibilities 
for implementation. We are simply trying to establish standards 
only for the federal elections.
    Ms. Lofgren, do you have an opening statement?
    Ms. Lofgren. Thank you, Mr. Chairman. I am glad that we are 
having this hearing today and delighted that we are joined by 
our colleague, Mr. Holt, the author of H.R. 550. I am inclined 
to think that Mr. Holt's approach is the right one, but I have 
declined to be a coauthor of this bill until this hearing 
because I wanted to try and keep an open mind on this subject 
and listen to the witnesses, without being a coauthor of the 
bill. But coming from Silicon Valley, you can imagine that I 
have had considerable input from people who are quite skilled, 
and I guess the question that needs to be answered is can this 
election be hacked.
    There are many issues, I am sure we will get into them 
today, but the integrity of the election process isabsolutely 
essential to the sustenance of a vigorous democracy. Elections do 
count, as we know. And the direction that our country is going in will 
be decided by elections. If we can't know for a certainty that that 
process is not corrupted, then it really goes to the core of the spirit 
of our Nation and our future as a democracy.
    So I realize we are not in a markup mode here today, we are 
here to get information. I am going to listen very carefully to 
all the witnesses, but I am hopeful that we could take quick 
action because this--my own State of California has already 
moved in the direction that Mr. Holt is suggesting with the 
verifiable paper audit trail. We need to be able to let the 
voters of America know that their elections are on the up-and-
up and their vote really does count and the election has not 
been hacked.
    So with that, Mr. Chairman, I thank you for holding this 
hearing and I will yield back because I am eager to hear a very 
large panel of witnesses before we are called to vote. Thank 
you very much.
    The Chairman. Thank you for your statement.
    Mr. Holt's statement will be entered into the record as we 
mentioned earlier.
    In setting up the panel for this hearing I was determined 
to try to get the broadest representation possible. I would 
have had to have 27 witnesses to totally accomplish that, but 
the fact is that we have tried very hard, as indicated by the 
large number of witnesses we do have.
    I am very pleased with the quality of the witnesses who 
agreed to appear and we now turn to Dr. Felten for his 
testimony. He is a professor in the Department of Computer 
Science at Princeton University, which also happens to be Mr. 
Holt's district. He recently completed a study of an electronic 
voting system and will give us a report on his findings. I also 
understand you have a demonstration for us, Dr. Felten. You may 
begin.

    STATEMENT OF EDWARD W. FELTEN, PROFESSOR, DEPARTMENT OF 
             COMPUTER SCIENCE, PRINCETON UNIVERSITY

    Mr. Felten. Thank you, Mr. Chairman, and members of the 
committee for the opportunity to testify today----
    Ms. Lofgren. Mr. Chairman, there are lights on that. Is 
there a way--much better.
    Mr. Felten. From a security standpoint what distinguishes 
computerized voting systems from traditional systems is not 
that computers are easier to compromise but that the 
consequences of compromise can be so much more severe. 
Tampering with an old-fashioned ballot box can affect a few 
hundred votes at most, but injecting a virus into a single 
computerized voting machine can potentially affect an entire 
election.
    Two weeks ago my colleagues, Ariel Feldman and Alex 
Halderman, and I released a detailed security analysis of this 
machine, the Diebold AccuVote-TS which was used in Maryland, 
Georgia, and elsewhere. My written testimony summarizes the 
findings of our study.
    One main finding is the machines are susceptible to 
computer viruses that spread from machine to machine and 
silently transfer votes from one candidate to another. Such a 
virus requires moderate computer programming skills to 
construct. Launching it requires access to a single voting 
machine for as little as 1 minute.
    I will now demonstrate this using a virus we constructed in 
our laboratory. We have set up here a simulated election for 
President between George Washington and Benedict Arnold. It is 
election day morning and we just opened the polls. No votes 
have been cast yet. I will start by casting the first vote. 
When I checked in at the polling place at the front desk, the 
poll worker gave me this voter card which I now insert into the 
machine. I press the start button and I choose to cast my vote 
for George Washington. The machine asks me to confirm my choice 
and I confirm my choice and cast my ballot.
    The second vote is similar. I insert another voter card, I 
choose George Washington again, and again I confirm and cast my 
ballot. The third voter inserts another voter card and votes 
again for George Washington. The correct vote count in this 
election obviously is George Washington, three; Benedict 
Arnold, zero.
    Now it is the close of election day. A poll worker inserts 
a special supervisor card into the machine, enters a PIN code, 
and tells the machine to end the election and tally the votes. 
The machine will now print out a paper tape summarizing the 
ballot count. When I cast my votes earlier my choice of 
candidate was recorded in the machine's electronic memory. This 
record of my vote was invisible to me. I had no way of 
verifying whether it was recorded correctly or whether it was 
changed after it was recorded.
    In this machine the records were modified by our virus. 
This paper tape printed out by the machine reports the 
elections result. It shows George Washington with one vote and 
Benedict Arnold with two. Every record in the machine and 
outside the machine is consistent with this fraudulent result.
    Our technical report referenced in my written testimony 
goes into considerable detail about this problem and explains 
why existing election procedures are not sufficient to prevent 
it. One lesson is that security depends on getting the 
technical details right. Too often the designers of this 
machine fail to get the details right. A good example is the 
access door here on the side of the machine. It protects the 
removable memory card that stores the votes, so the door should 
be locked securely and access to the keys should be strictly 
limited; but in fact tens of thousands of AccuVote machines can 
all be opened with the very same key, and this very same key is 
used widely in office furniture, jukeboxes and even hotel 
minibars. It is easily purchased on the Internet. This one I 
bought online from a jukebox supply shop and it does open the 
machine.
    The implications of our study go beyond just this machine 
and reveal broader systemic problems. More worrisome than any 
specific vulnerability is that this system, despite its many 
problems, was certified, purchased and deployed by many States 
and counties and has been used in important elections.
    We can do more to improve the security of our e-voting. I 
detail many recommendations in my study and written testimony, 
but one important safeguard is a voter-verifiedpaper audit 
trail. A well-designed paper trail can improve security and enhance 
voter confidence without compromising accessibility. Certainly paper 
records have their drawbacks, but they have different failure modes 
than electronic records do and the combination of electronic and paper 
records can be more robust against fraud than either one would be 
alone.
    Getting the details of voting right is difficult, 
especially in today's high-tech polling place, but failure is 
not an option. The stakes are too high and the risk of 
malfunction or fraud too great to make our current course 
tenable in the long run.
    Election experts, accessibility experts, and computer 
security experts all have a role to play in improving our 
voting system. If we work together we can solve this problem 
and give the American people the voting system they deserve.
    Thank you for your time and attention.
    The Chairman. Thank you very much for your testimony.
    [The statement of Mr. Felten follows:]

    [GRAPHIC] [TIFF OMITTED] T1270A.065
    
    [GRAPHIC] [TIFF OMITTED] T1270A.066
    
    [GRAPHIC] [TIFF OMITTED] T1270A.067
    
    [GRAPHIC] [TIFF OMITTED] T1270A.068
    
    [GRAPHIC] [TIFF OMITTED] T1270A.069
    
    [GRAPHIC] [TIFF OMITTED] T1270A.070
    
    [GRAPHIC] [TIFF OMITTED] T1270A.071
    
    [GRAPHIC] [TIFF OMITTED] T1270A.072
    
    [GRAPHIC] [TIFF OMITTED] T1270A.073
    
    [GRAPHIC] [TIFF OMITTED] T1270A.074
    
    The Chairman. Our second witness is Gary Smith. Mr. Smith 
is the election director in Forsyth County, Georgia. Georgia 
uses a paperless DRE system statewide, and for those who don't 
know what DRE stands for it is direct recording electronic 
computer. Basically it is a type of computer we have displayed 
here.
    Mr. Smith uses a Diebold system that was the subject of the 
Princeton study. Mr. Smith also participated in the recount of 
the Cuyahoga County primary conducted on a DRE system with a 
paper audit trail. Mr. Smith, you are recognized.

 STATEMENT OF GARY SMITH, ELECTION DIRECTOR, FORSYTH COUNTY, GA

    Mr. Smith. Well, as was mentioned, my name is Gary Smith, I 
reside----
    The Chairman. Is your microphone on?
    Mr. Smith. My name is Gary Smith and, as you mentioned, I 
am the election director for Forsyth County, Georgia, a county 
just north of Atlanta. It is quite a fast-growing county. We 
have about 80,000 registered voters and we are one of the top 
fastest-growing counties in the United States, so we have a lot 
of issues that we have to deal with all the time.
    One of the things I think that is important maybe is to 
look at what those of us as election directors--how we come 
about. I am actually appointed through a selection committee 
that comes about where a grand jury is brought forth, they pick 
a panel of people who have the background to be able to do 
this. It is then sent up to the chief superior court judge and 
then I am selected from that. I was selected from that process.
    I am in my second term as the director of elections. It is 
a term of 4 years, and it is a nonpartisan position. Prior to 
coming into this position I spent most of my time working in 
the private sector. I retired. I was running various companies, 
and I have worked most of my life in industrial automation. So 
I have a technical background. I have an undergraduate degree 
in electrical engineering and I am a certified election 
registration administrator from a program administered by 
Auburn University.
    As a director of elections, one of the things that I have 
been privileged to do is to sit on a task force, several of 
them. One has been from the Georgia task force, which allows me 
to be able to participate and look at new processes and 
equipment that we apply to elections in our county and State. 
In addition to that, I served on a national task force for 
election reform for 2004 where we looked at all the processes 
across the country with regards to elections. In addition, I 
think you just mentioned I did lead the manual recount for the 
Cuyahoga County VVPAT so I have some practical experience with 
that and I was happy to be able to do that. I spent a week at 
it, as a matter of fact.
    We have implemented the DREs. The one that you are looking 
at right here, which is the Diebold-TS unit, my county and 158 
counties in Georgia implemented this during the general 
election of 2002. We have held, from what I heard was the last 
count, something like 2,500 elections in our State. In addition 
to that I have held elections on special elections, primaries, 
general elections, run-offs and just about any kind of 
election, and a municipal election as well. So, again, we have 
a lot of experience with them.
    One of the things that I think has been talked about a lot 
and I think we have to deal with is how do you look at the 
security and integrity of this kind of equipment. It starts, 
obviously, with the vendor who builds the equipment, goes 
through the independent testing laboratories that then look at 
it to make sure what we are receiving has the technical 
wherewithal to be able to provide us with a piece of equipment 
that really meets what our needs are. Thirdly, we have in our 
State, which I am very proud to talk about, the Center for 
Election Systems, a program administered by Kennesaw State 
University and Dr. Britt Williams, a well-known authority in 
elections.
    We do all of our creation of our ballot cards and that sort 
of thing through this group, and so it is another level of 
testing that we have that goes on.
    Lastly, it is up to those of us who are election directors 
to hold these elections, so I am tasked with a lot of the 
things that Mr. Felten has talked about, which is maintain the 
security and integrity of the process that goes on with 
elections. I guess we are where the rubber meets the road as 
much as anything.
    So that is our job. I am not going to go through all the 
details with regards to certification because it is certainly 
going to take a lot more than a few minutes, but it is in my 
paper and I hope that you will look at it. I think where we 
pick it up is where we pick up the memory cards, as Mr. Felten 
has mentioned, that come to us from the Center for Election 
Systems, the process of making sure that they come to us under 
the chain of custody manners, that we know that there is at 
least more than one person that has access to what we are 
talking about and they are looking at.
    We go through a process called logic and accuracy testing. 
This is when the process that he has talked about goes through 
the first part, where we are taking the memory cards, we are 
marrying them essentially to the voting machine, and then we 
are taking them through the testingprocess, at which time then 
we lock the machines up and we pass them on to the next level, which 
really is the election poll worker himself.
    And what I would like to do is to show you some of the 
chain-of-custody forms and I think they are in front of you 
too. If they are not, I am going to show you one actually that 
is going to be--okay. It is as good as it can get up there but 
I think most of you can probably see it.
    What I am pointing out in it--is it okay if I stand up?
    The Chairman. As long as you carry the microphone with you 
so all the people in the overflow room can hear you too.
    Mr. Smith. Can you hear me now?
    The Chairman. Yes.
    Mr. Smith. All right. I think what is critical about this, 
I think this is one of the things maybe that because we are 
doing it statewide, we have an awful lot of good chances to be 
able to work the processes out. And I think Mr. Felten, one of 
the things he said is you need to have good chain of custody in 
these things. This actually is for the precinct Big Creek. This 
is actually an actual form that we are using. It says here item 
number 1, custodian certification form for the AccuVote-TS 
units that are going to be used. Under point number 2 what I 
have got here is the touch screen serial number, which has not 
got a number in here, 116827.
    Then across here what you are looking at is all of the 
tests that we take individually to run on the machines. This 
takes about 15 minutes per machine to run. It is a process that 
is done under my direction, and we actually have done this for 
500 machines for the upcoming election.
    The next point that is important to look at is there is a 
seal number that is right here. That seal number, what I am 
going to show you is how it is carried forward to the process 
where when we are holding the election at the precinct, what 
happens with it. This machine then is sealed up, it has a wire 
serial number on it. So there is no access to this machine once 
the logic and accuracy test is done.
    Now, the next form I am going to show you is right here. 
This is a form then that is carried forward to the precinct 
itself so that when the poll workers, poll manager and his 
assistant, this is their responsibility; this is a form that is 
signed in triplicate, one goes to the Secretary of State, one 
goes to me and one goes to the clerk of the superior court. You 
will notice again it is for precinct Big Creek 01. This is the 
recap sheet that goes with it. Here again is the serial number. 
If we had looked back before, we would find that that serial 
number is the same one as here.
    Here is the serial number that then shows up on--that is 
transferred from the original L&A testing. Now what happens 
with it is we open up the machines, we go through it, we do the 
count number, and then at the end of the election, because this 
is the recap sheet, the key part here is that there is another 
mechanical low-tech seal put on it. It is a wired seal so it is 
kept on there all the time.
    That is the process that we go through. I wanted you to be 
able to see that.
    The Chairman. I am going to have to ask you to wrap up 
because we have a lot of witnesses and a lot of discussion.
    Mr. Smith. Okay. I am sorry.
    The Chairman. Is that it?
    Mr. Smith. The other part I wanted to talk about, and I 
think this has to do with the comments that Ms. Millender-
McDonald said, is what is the confidence that people have in 
it. I would like to at least respond to that at another time, 
because we have done surveys in our county, too, which show 
that 99 percent of the people feel that the process is an 
excellent process. So there is a high level of confidence in 
our equipment.
    The Chairman. All right. We can defer that to the question 
period.
    Mr. Smith. Thank you very much.
    The Chairman. Thank you.
    [The statement of Mr. Smith follows:]
    [GRAPHIC] [TIFF OMITTED] T1270A.075
    
    [GRAPHIC] [TIFF OMITTED] T1270A.076
    
    [GRAPHIC] [TIFF OMITTED] T1270A.077
    
    [GRAPHIC] [TIFF OMITTED] T1270A.078
    
    [GRAPHIC] [TIFF OMITTED] T1270A.079
    
    [GRAPHIC] [TIFF OMITTED] T1270A.080
    
    [GRAPHIC] [TIFF OMITTED] T1270A.081
    
    [GRAPHIC] [TIFF OMITTED] T1270A.082
    
    [GRAPHIC] [TIFF OMITTED] T1270A.083
    
    [GRAPHIC] [TIFF OMITTED] T1270A.084
    
    [GRAPHIC] [TIFF OMITTED] T1270A.085
    
    [GRAPHIC] [TIFF OMITTED] T1270A.086
    
    [GRAPHIC] [TIFF OMITTED] T1270A.087
    
    [GRAPHIC] [TIFF OMITTED] T1270A.088
    
    [GRAPHIC] [TIFF OMITTED] T1270A.089
    
    The Chairman. As a reminder to those, I should have 
mentioned it before, you have the little device in front of you 
with the lights on it. Green means go, yellow means sum up, red 
means you are in deep trouble. So please keep an eye on the 
clock.
    Next I am pleased to recognize Ms. Barbara Simons, past 
president of the Association for Computing Machinery, and she 
has done a lot of work on voting systems. Dr. Simons, you are 
recognized.

    STATEMENT OF BARBARA SIMONS, MEMBER, U.S. PUBLIC POLICY 
         COMMITTEE, ASSOCIATION FOR COMPUTING MACHINERY

    Ms. Simons. Good morning, Mr. Chairman, members of the 
committee. On behalf of the computing professionals that 
constitute the Association for Computing Machinery I want to 
thank you for the opportunity to testify today about e-voting 
system security and the need for voter-verified paper trails. 
Secure, reliable, usable and accessible voting systems are 
critical toward assuring transparent, fair and inclusive 
elections. These are not mutually exclusive goals. I shall 
discuss aspects of both security and accessibility this 
morning.
    First, security. Because of the risks of software bugs, 
malicious code or computer failure, we cannot trust that the 
results in a paperless voting machine accurately reflect the 
will of the voters. That is why voter-verified paper ballots or 
audit trails (VVPATs, as we refer to them) are needed. VVPATs 
are automatically produced by an optical scan system, since the 
ballot is verified by the voter. Fortunately, 48 percent of 
counties have optical scan systems so they already have VVPATs.
    Optical scans can be used together with tactile ballot 
sleeves or accessible marking devices for accessibility. Some 
DREs have been retrofitted to produce VVPATs; in fact, all of 
them for use in California, as Congresswoman Lofgren said.
    Two years ago ACM, a leading computer society, issued a 
statement calling for well-engineered voting machines that 
allow every voter to verify his or her record has been 
accurately cast by the inspection of a physical (e.g. paper) 
record.
    At its 2006 national convention, the League of Women Voters 
passed a resolution calling for voter-verified paper ballots or 
records to be used for audits and recounts. The League also 
urged that routine random audits be conducted in every 
election.
    Both the ACM statement and the League's resolution can be 
found in my written testimony.
    In summary, as a defense against malicious or buggysoftware 
we must have: reliable, well-engineered VVPATs, policies and procedures 
that guarantee the integrity of the paper records; security storage and 
delivery of machines and so on, mandatory random manual audits of 
VVPATs; and a full manual recount if discrepancies are uncovered, 
unless there is evidence that the VVPATs have been compromised.
    I will now discuss accessibility.
    People with disabilities should be able to vote privately 
and independently and be able to verify their votes.
    HAVA does not require the DREs be used for accessibility. 
There is evidence that a number of people with disabilities are 
finding that DREs are not meeting their accessibility needs.
    Kelly Pierce, a nationally known advocate for the blind and 
visually impaired, reviewed tactically discernable controls, 
spoken prompts, visual display, poll worker assistance, volume 
control and normalization, and ballot review for four voting 
machines. In his report for Cook County State Attorney's 
Office, Pierce concluded that if any one of the four machines 
were to be deployed in Chicago or suburban Cook County, many 
voters with disabilities, particularly blind voters, would not 
be able to cast a ballot independently and privately.
    Blind computer scientist Noel Runyan discussed his 
frustration with his hour-long voting experience in the 2004 
Presidential election, and I quote: It took me 30 minutes to 
work my way through the ballots and make my selection. After 
that I had quite a bit of trouble getting into the review mode 
to get a full list of all my selections. When I did, it went on 
and on for 23 minutes, like a long uncontrolled drink from a 
firehose. The review function read each item and then at the 
very end said my selection was for that item. It even threw in 
details of what the fiscal impact would be and took forever.
    ``This is completely backwards.''
    He went on to say: ``From the time I signed in and got my 
voter smart card, it took 8 minutes to reboot the audio voting 
machine; 30 minutes to make my choices; 23 minutes to review 
and verify; and another 4 minutes to make a correction and 
record my vote. Not counting the hour waiting in line, it took 
me about 65 minutes to mark and record my ballot.''
    We do not have to settle for inaccessible voting systems. 
Old technologies such as text to audio devices, tactile ballot 
sleeves, and ballot market and generating systems could be 
combined with new technologies that make the entire voting and 
verification process accessible, while remaining auditable.
    Technology, if engineered and tested carefully and if 
deployed with safeguards against failure, can reduce error 
rate, provide more accessibility, increase accountability and 
strengthen our voting system. However, the current state of e-
voting technology leaves us far short of these goals. We need 
paper trails and manual audits to protect us against failures 
and attacks. We need additional research to make voting 
machines more usable, secure and accessible. And we need to 
work together to achieve these goals. Thank you.
    The Chairman. Thank you very much.
    [The statement of Ms. Simons follows:]

    [GRAPHIC] [TIFF OMITTED] T1270A.090
    
    [GRAPHIC] [TIFF OMITTED] T1270A.091
    
    [GRAPHIC] [TIFF OMITTED] T1270A.092
    
    [GRAPHIC] [TIFF OMITTED] T1270A.093
    
    [GRAPHIC] [TIFF OMITTED] T1270A.094
    
    [GRAPHIC] [TIFF OMITTED] T1270A.095
    
    [GRAPHIC] [TIFF OMITTED] T1270A.096
    
    [GRAPHIC] [TIFF OMITTED] T1270A.097
    
    [GRAPHIC] [TIFF OMITTED] T1270A.098
    
    [GRAPHIC] [TIFF OMITTED] T1270A.099
    
    The Chairman. Next we turn to Mr. Keith Cunningham who is 
the election director in Allen County, Ohio. He serves on the 
board of advisors to the Election Assistance Commission and 
also participated in the Cuyahoga County recount study 
performed by the Election Science Institute.
    Mr. Cunningham, you are recognized.

STATEMENT OF KEITH CUNNINGHAM, ELECTION DIRECTOR, ALLEN COUNTY, 
                               OH

    Mr. Cunningham. Thank you, Mr. Chairman, and let me say 
what an honor it is for a guy from a small town in Ohio to be 
sitting here before you today in this tremendous forum.
    I am also the immediate past president of the Ohio 
Association of Election Officials, and I want to say to you 
before I begin, when I wake up in the morning and head for my 
job I am feeling pretty good about it. I believe the job that I 
am involved in, which is an elections director, has meaning and 
has merit and is doing things to make our country and our 
community better.
    One thing I think we all agree on is that electronic voting 
needs some type of verification system, some component that 
allows it to be audited. And of course all systems need that, 
but as my predecessors have said, a hard ballot system is 
rather obvious how we audit those. Personally I do not have any 
particular aversion to voter-verified paper audit trails.
    However, in Ohio the system is that the voter-verified 
paper audit trail becomes the official ballot of record for 
recount purposes. I must say to you, clearly I am adamantly 
opposed, based on the experience I have had in Cuyahoga County, 
to that. I believe that program is setting election officials 
up for failure at this point in time.
    If the VVPAT was to be extended to voters as a courtesy by 
which to check their votes, I have no problems with that. I 
think statistics indicate voters don't even use it when it is 
available to them. The studies on hand show that maybe less 
than 10 percent of the people actually utilize that.
    We looked at approximately 350 VVPAT tapes in Cuyahoga 
County, and over and over and over we encountered tapes that 
were missing, that were in some way compromised. You have the 
numbers before you, so I won't bore you with the statistics, 
but I think two of them are very important for you to remember. 
Nearly 17 percent of the VVPAT tapes reviewed by that team--and 
that team consisted of a lot of Ohio election officials that 
came in to help participate--nearly 17 percent of those tapes 
showed a vote discrepancy of one to five votes from the 
electronic machine, and nearly 10 percent of those tapes were 
either destroyed,blank, missing, taped together, or in some 
other way compromised.
    My point is this: that when you use the VVPAT at this point 
in time as the official record of a recount vote, it actually 
serves to disenfranchise the voter because votes are lost in 
the VVPAT process. They are simply not there and cannot be 
retrieved. We could have retrieved those votes by other means 
from those machines, but in Ohio we are not allowed to because 
the recount official ballot of record in a recount becomes the 
VVPAT.
    So I would submit to you that it was the paper that 
actually caused the count to be in question. Additionally, and 
we have some photographs here I would like to show you, there 
is no reliable technology for which to recount VVPATs. To ESI's 
credit they had a makeshift kind of crank thing that you could 
put the tapes in and reel them up. These things are sort of 
like wrestling octopuses.
    As you can see--let's go to the next one, the next one. 
These are some of my friends.
    This is just kind of the scene. There you can see the 
machine. I will tell you what I equate this to. We are pretty 
agricultural in my part of Ohio. I equate this to planting 
several hundred acres of wheat with a million-dollar planting 
machine and harvesting it by hand like the Amish used to, and 
stacking it up in the fields.
    This was mind-numbing, to say the least. Now keep in mind 
we went through 300-some tapes. There were probably near 4,000 
tapes in Cuyahoga County. This took us two 10-hour days, 
actually 2\1/2\ because the first half day was upsetting the 
system.
    Continue, please.
    This is simply a tape with no record printed on it. 
Continue again, please.
    Same thing. This is the information that we are looking 
through on the tapes trying to--and, remember, at least this is 
Ohio's rule, that when you recount a race, you can't recount 
any other race. You can only recount the race that is going to 
be recounted. So if you have got 27 candidates on the ballot, 
you have got to reel through all 27 to get to the race, maybe a 
down ballot race.
    This is an example of one that is taped together that has 
obviously been in the machine, it accordioned in the machine. I 
don't know, that black line probably represents 20 or 30 votes. 
There was no way to reconcile that. There is another torn tape, 
another shot of the crude machine we were using to do this.
    I think they speak for themselves. I honestly don't have 
any reason to believe DREs don't record votes accurately but I 
understand the concerns and I do believe that we should have 
some kind of audit system for it. I would say to you, 
considering the size and scope of the deployment of voting 
machines in the last 12 to 24 months in America, I think 
election officials have done a pretty darn good job. We are 
working on improving it.
    Unfortunately, I believe--and I will wrap up here in just a 
second--I believe it is the environment which is slowing our 
pace of improvement. As a local election official I am going to 
tell you, I feel like I am in a cross-fire, and I know many of 
my colleagues do; and that cross-fire is a very, very polluted 
conversation, and it is being polluted with political 
interests, corporate interests and scientific one-upmanship. 
And I often wish I had as many people helping me find the 
solutions as I did identifying the problems. It would make my 
job an awful lot easier.
    I want to echo the remarks earlier, that I do believe we 
should continue to fund HAVA. I think the underfunding of HAVA 
sends a very inconsistent message to those of us out there 
trying to do this on a daily basis. I would say to you also, 
please allow us to finish what has been started and what is in 
motion before we begin to tinker with this. We have been given 
a set of tasks that are very, very hard to manage. And, again, 
in the scope of the deployment that has taken place in this 
country, I don't want to say there weren't problems in it, but 
I think my colleagues have done a very good job and I would 
hope that in the future when we do begin to debate and speak 
about this, we can do it in on honest and direct terms, without 
misrepresentations, half truths, and focus on what it is we 
need to do to cure these problems and make America's 
elections--give people confidence in them. I think it is too 
far to--too much to expect any less than that.
    Thank you for your time. I appreciate it.
    The Chairman. Thank you.
    [The statement of Mr. Cunningham follows:]

    [GRAPHIC] [TIFF OMITTED] T1270A.100
    
    [GRAPHIC] [TIFF OMITTED] T1270A.101
    
    [GRAPHIC] [TIFF OMITTED] T1270A.102
    
    [GRAPHIC] [TIFF OMITTED] T1270A.103
    
    [GRAPHIC] [TIFF OMITTED] T1270A.104
    
    [GRAPHIC] [TIFF OMITTED] T1270A.105
    
    [GRAPHIC] [TIFF OMITTED] T1270A.106
    
    The Chairman. We hear your cry for help; namely, leave us 
alone, let us do it. I also want you to know that you are not 
the only one who has crowds of people yelling at him for a 
solution and offering no assistance. We experience that every 
day of the week. So you have our sympathy.
    Next, I am pleased to introduce, James Dickson, Vice 
President of Government Affairs for the American Association of 
People with Disabilities. He has been a very strong advocate 
throughout this process of making certain that anyone with 
disabilities is permitted to vote and has the sanctity of the 
secret ballot which is essential to all of us and essential to 
democracy.
    Mr. Dickson, you are recognized.

   STATEMENT OF JAMES DICKSON, VICE PRESIDENT OF GOVERNMENT 
   AFFAIRS, AMERICAN ASSOCIATION OF PEOPLE WITH DISABILITIES

    Mr. Dickson. Thank you, Chairman Ehlers, members of the 
committee. I have two disabilities: I am blind and I am blunt. 
In these 5 minutes I am going to summarize some of the points 
of my written testimony. First I want to thank the Members of 
Congress who passed the Help America Vote Act. I voted secretly 
and independently for the first time 2 years ago; for the 
second time just a month ago. I cannotput into words the 
glorious feeling and the pride that I had as an American, and I am 
speaking for tens of millions of other Americans who have now the first 
opportunity to vote privately and independently.
    I have got a few stories to tell about the problems that I 
faced and which millions of other voters face when not being 
able to vote privately or independently. These happened to me, 
but literally there are millions of stories like it. The very 
first time I voted, the poll worker said to me, loud enough for 
everybody in the polling place to hear: You want to vote for 
who?
    On another occasion I had a poll worker say to me: We are 
very busy; nobody votes for state legislators and these other 
races, so how about if we finish now?
    On another occasion I had a poll worker say to me: These 
referenda today are really confusing, most people don't vote on 
them, so why don't we stop now?
    On yet another occasion I had a poll worker say to me: This 
print on the referenda is too small, I can't read it to you, so 
can we be finished? That particular excuse did not get much 
sympathy from me.
    Touch screens are the best existing product we have that 
offers accessibility to the greatest number of people. I 
participated in the earlier work that was referenced, by Kelly 
Pierce. The rest of the story is that after those initial 
tests, the company was able to inexpensively and quickly make 
changes to the access procedures so that the problems were 
eliminated.
    Touch screens--access is a continuum and we need to have 
equipment designed so that as access increases it can be 
cheaply, efficiently, and quickly installed on the equipment. 
Touch screens are the only product available now that meets 
those requirements. At AAPD we absolutely want secure, 
accurate, recountable elections that are systems that are 
accessible. The paper trail is not accessible.
    This is a California ballot. Try recounting. I will leave 
for the committee--this is the roll that was not able to be 
counted in Ohio. Paper trail is a Rube Goldberg contraption. It 
doesn't work, it is not accessible, you can't recount it. It 
doesn't even offer verification. Not only do people not look at 
the verification, in the tests done at the MIT where the 
computers were set up so that votes were changed, MIT students 
didn't find the changed vote when they looked at the 
verification on paper. When the verification was done by audio, 
listening through earphones, they found the changed votes.
    I want to sum up with the following three points. Things 
have to be accessible. Thank you for making that stand in HAVA. 
The paper trail does not even do what the proponents want, and 
the proponents are a very small group who speak very loudly. 
There have been, over and over again, public opinion polls. 
When voters use touch screens they trust them 80 percent; 80 
percent when they use them. We shouldn't let a loud vocal 
minority using fear determine what is going to happen in the 
sanctity of the polling place.
    The last point I want to make, and it is very, very 
important, is the real problems in our voting system are human 
factors, are human errors. And before we order something to be 
done in the polling place, we need money to research and 
document what the problems are and we need to test proposed 
solutions in the reality of the polling place, not in a 
laboratory. Put me in an empty room with a ballot box full of 
paper, and I will hack into it in less than 60 seconds.
    Thank you again. This discussion is very important. And I 
would just ask you to remember that 80 percent of Americans who 
vote on touch screens believe their vote is secure and 
accurate.
    The Chairman. Thank you, Mr. Dickson. Appreciate your 
comments.
    Thank you, Mr. Dickson, and we appreciate your comments 
about showing why it was so worthwhile for us to insist that 
all individuals be able to cast their ballot in secret. So 
thank you.
    Next I am pleased to introduce Michael Shamos. He is a 
professor at Carnegie Mellon University and is also the 
director of the Institute for Software Research. Dr. Shamos, 
you are recognized.

   STATEMENT OF MICHAEL I. SHAMOS, PROFESSOR, INSTITUTE FOR 
     SOFTWARE RESEARCH DIRECTOR, CARNEGIE MELLON UNIVERSITY

    Mr. Shamos. Thank you, Mr. Chairman. I just want to make a 
small correction to the record. I am not the director of the 
Institute for Software Research, I am just a member of the 
Institute for Software Research. But I am also an attorney 
admitted to practice in Pennsylvania and before the United 
States Patent Trademark Office. Since 1980 I have been an 
examiner of electronic voting systems for various States. I am 
currently an examiner for Pennsylvania and I have personally 
performed 118 voting systems examinations. I am going to do my 
119th examination next week.
    I recall that, Mr. Chairman, you are a physicist, 
Representative Holt is a physicist. I am a former physicist. My 
proposal is we settle this issue like physicists, based on 
scientific evidence and not on emotion.
    I view electronic voting as primarily an engineering 
problem that includes the design of processes and procedures. 
Once the requirements for a voting system are agreed upon, it 
is then a matter of developing and manufacturing the equipment 
processes that meet these requirements. The question is whether 
Congress should be setting technical performance guidelines and 
engineering standards, as H.R. 550 would have it do, or whether 
such guidelines should be left to this and the EAC, as HAVA has 
already provided.
    The proposed bill is based on three major assumptions, all 
of which are false. First, it assumes that paper records are 
somehow more secure than electronic ones, a proposition that 
has been repeatedly shown to be wrong throughout history. 
Second, it assumes that voting machines without voter-verified 
paper trails are unauditable because they are claimed to be 
paperless, which is also false; they are neither paperless nor 
unauditable. Third, it assumes that paper trails actually solve 
the problems exhibited by DRE machines, which is likewise 
incorrect.
    The reason that mechanical voting machines were introduced 
over a century ago was to stop rampant fraudinvolving paper 
ballots. H.R. 550 would restore us to the year 1890 when anyone who 
wanted to tamper with an election needed to do no more than to 
manipulate pieces of paper. The recent example in Cleveland, Ohio, 
Cuyahoga County, is extremely instructive. That was the case we just 
heard, that 10 percent of the paper trails could not be read. H.R. 550 
provides that in the event of any inconsistency between electronic and 
paper records, the paper records are irrebuttably presumed to be 
correct. Attorneys like myself are always wary of irrebuttable 
presumptions. Applying that provision to Cleveland would have resulted 
in the disenfranchisement of 10 percent of the electorate because their 
paper records could not be read.
    I cannot believe that the numerous sponsors of this 
legislation contemplated such an outcome. I did a review of the 
U.S. elections starting in the year 1824 when the popular vote 
began to be kept. I looked at the percentage of times that you 
took 10 percent of the popular vote and subtracted it from the 
winner and gave it to the loser, how often would the outcome 
change; and the answer is, since 1854, 55 percent of our 
Presidential elections would have been reversed if you couldn't 
count 10 percent of the paper trail.
    The argument is made that security problems with DRE voting 
demand remediation of the type proposed in the bill. Indeed 
Professor Felten at Princeton, Harri Hursti, and others have 
done a great service by exposing security vulnerabilities in 
voting systems. Some of these vulnerabilities are severe and 
require immediate repair, but the point is that they are easily 
remedied.
    The question for the committee is what the proper response 
to such discoveries ought to be. When tainted spinach was found 
in California, Congress did not ban the eating or distribution 
of leafy vegetables, even though at least one human life had 
been lost. The appropriate reaction to the discovery of a 
security flaw in a voting system is to repair it, not to outlaw 
an entire category of voting machines with which we have a 
quarter-century of experience.
    It is claimed that observed reliability problems with DRE 
machines will be alleviated by adding a paper trail. Field 
experience has shown the opposite. The failure rate of paper-
trail DREs is double that of DREs without paper trails. It 
should be obvious that adding a new device with moving 
mechanical parts to an existing electronic machine cannot 
improve its reliability.
    The effect of H.R. 550 would be to ban electronic voting 
entirely in Federal elections. I want to repeat that. It would 
be to ban electronic voting entirely in Federal elections. The 
reason is that the bill sets forth conditions that are not met 
by any DRE system currently on the market in the United States. 
If it were to pass in its present form there could be no more 
electronic voting in this country, and Congress would be in the 
position, after spending $3 billion on new voting equipment, of 
spending billions more paying for what it just paid for. I 
cannot believe that the numerous sponsors of this legislation 
contemplated such on outcome.
    Further, the bill as written mandates a system that would 
violate constitutional and statutory provisions in more than 
half the States. The secret ballot is regarded as an essential 
component of American democracy. Each one of the DRE paper-
trail systems that are currently on the market either enables 
voters to sell their votes or allows the government and the 
public to discover precisely how each voter in a jurisdiction 
has voted. I cannot believe that the numerous sponsors of this 
legislation contemplated that outcome either.
    I am in favor of voter verification. The proposed bill, 
despite incorporating the phrase ``voter verified'' into its 
title, does not come close to providing real voter 
verification. While it shows the voter that her choices were 
properly understood and recorded by the machine, it offers no 
assurance whatsoever that her ballot was counted, that it ever 
will be counted, or it will even be present in the event a 
recount is demanded. Once the polls have closed, the voter not 
only has no recourse or remedy, but is powerless to even 
determine whether her vote is part of the final tally or 
object, if she believes it isn't. That is not voter 
verification, regardless how it may be denominated in the text 
of the bill.
    I submit that if Congress desires to enact a comprehensive 
statute mandating voter verification, it ought to verify 
whether the proposed legislation actually accomplishes that 
goal. Numerous effective verification methods are known that 
are not based on vulnerable paper records. These have not yet 
been implemented in viable commercial systems. I understand 
that scientists at NIST will soon announce another one.
    If H.R. 550 is enacted there would be no point in 
continuing research and development on any such system, since 
the statute would prohibit any system that didn't use paper 
records.
    Professor Ronald Rivest of MIT has recently invented a 
voting method that allows each voter to verify, after the 
election is over, that her vote has actually been counted, a 
feature that is absent from the systems contemplated by H.R. 
550. Professor Rivest's system also allows any member of the 
public to tabulate the results of the election for herself, so 
it is not even necessary to trust the official count.
    These discoveries demonstrate that voter verification is 
now a ripe area of scientific research and it is far too early 
to mandate by statute a bad nonsolution to a presumed problem.
    My purpose here today is not simply to complain about the 
bill but to offer a constructive alternative. As part of my 
written testimony, I have included a complete markup for the 
proposed legislation that retains its essential positive 
feature such as voter verification but eliminates its ill-
advised provisions. I urge the committee not to report the bill 
favorably in its present form, and I thank you for the 
opportunity to be here today.
    The Chairman. Thank you for your testimony.
    [The statement of Mr. Shamos follows:]

    [GRAPHIC] [TIFF OMITTED] T1270A.107
    
    [GRAPHIC] [TIFF OMITTED] T1270A.108
    
    [GRAPHIC] [TIFF OMITTED] T1270A.109
    
    [GRAPHIC] [TIFF OMITTED] T1270A.110
    
    [GRAPHIC] [TIFF OMITTED] T1270A.111
    
    [GRAPHIC] [TIFF OMITTED] T1270A.112
    
    [GRAPHIC] [TIFF OMITTED] T1270A.113
    
    [GRAPHIC] [TIFF OMITTED] T1270A.114
    
    [GRAPHIC] [TIFF OMITTED] T1270A.115
    
    [GRAPHIC] [TIFF OMITTED] T1270A.116
    
    [GRAPHIC] [TIFF OMITTED] T1270A.117
    
    [GRAPHIC] [TIFF OMITTED] T1270A.118
    
    [GRAPHIC] [TIFF OMITTED] T1270A.119
    
    [GRAPHIC] [TIFF OMITTED] T1270A.120
    
    [GRAPHIC] [TIFF OMITTED] T1270A.121
    
    [GRAPHIC] [TIFF OMITTED] T1270A.122
    
    [GRAPHIC] [TIFF OMITTED] T1270A.123
    
    [GRAPHIC] [TIFF OMITTED] T1270A.124
    
    [GRAPHIC] [TIFF OMITTED] T1270A.125
    
    The Chairman. We will now turn to questions from the 
committee, and I will begin and yield myself 5 minutes for that 
purpose. And Dr. Shamos, since we just finished with you, let 
me pursue one comment you made. I could pursue many, and I am 
sure others will pursue those, but on the one you said paper 
trails are no more accurate than any other method. Let me ask 
if you would also include paper ballots which are then read by 
a computer in that category.
    Mr. Shamos. Oh, Mr. Chairman, I don't think I actually made 
any comment about the accuracy of voting systems. I think I 
said that paper systems weren't secure.
    As far as accuracy, accuracy is a very poorly defined 
concept in voting systems and extremely difficult to measure, 
because we need to know in advance the voter's intent before 
they go into the voting booth. Then we need to see through the 
entire chain of custody of all the ballots at the end whether 
the final tally really reflects how the voters intended to 
vote. That is nearly unmeasurable except in small laboratory 
experiments. So I actually haven't made a comment about 
accuracy.
    The Chairman. Okay. In general, your comments about paper 
trails, do those also apply to paper ballots that are then 
scanned electronically?
    Mr. Shamos. Paper ballots that are scanned electronically 
are certainly subject to the same kinds of tampering. In fact 
it is easier in general to tamper with those because they are 
cut sheet paper, individual pieces of paper. There are all 
sorts of problems with optical scan voting but it is certainly 
acceptable as a method of voting. We use it in Pennsylvania. It 
is in widespread use around the country.
    The Chairman. Let me just extend that one little bit. In 
terms of recounting for--in case someone demands a recount, 
isn't a paper ballot a good reliable method of recounting, 
simply because the voters themselves have marked that 
particular piece of paper?
    Mr. Shamos. No. The problem is that once the voter has 
marked the ballot and verified that the ballot is marked the 
way she wants, she has no assurance that by the time the 
recount occurs, that same piece of paper is going to be in the 
hands of the recounters.
    Ms. Lofgren from Silicon Valley might recall that in the 
2004 election in San Francisco, 3 weeks after the election, 
ballot boxes were found floating in San Francisco Bay with 
ballots in them. And so we have not solved the problem, 
security of paper ballots, in a widely distributed voting 
system that we have in the United States, with a couple hundred 
thousand precincts.
    The Chairman. Thank you. I didn't realize we had that 
problem since the LBJ election and Tammany Hall, Prendergast, 
et cetera. Thank you.
    And quickly I am turning to Mr. Felten, I am interested in 
your comments. How easily could one access the voting machine 
and insert a virus of the type you have commented? How long 
does it take to actually get the virus in place? Would someone 
need to access the machine for an appreciable amount of time? 
Or is this something that a voter in a voting booth could do?
    Mr. Felten. It takes about 1 minute of access to the 
machine, and I can show you roughly what would be involved. It 
would involve opening the door on the side of the machine, 
which would require getting a key. As I said, those are for 
sale on the Internet. There may be some security tape that 
would need to be removed and might be missing already. Opening 
up this door, putting in the memory card like this into the 
side of the machine--the memory card would have been prepared 
in advance with the computer virus on it--then pressing the red 
power button and waiting about 30 seconds, and afterward 
closing everything up and putting it back.
    This is something that would be unlikely to be doable by a 
voter in the polling place, but if the machine is not--if the 
machine is not guarded with a very careful chain of custody 
throughout its life cycle, it can be available to that. In my 
polling place in Princeton, the DRE machines sit unattended 
overnight, the night before the election, in an unlocked school 
lobby.
    The Chairman. How long would it take someone who had access 
to the machine to figure out how to write the program?
    Mr. Felten. It requires some information about how the 
machine works. This is not a Manhattan Project. It requires a 
moderate level of skill in computer programming and some 
limited knowledge, probably the knowledge that has in this 
case--that had leaked from the vendor to the Internet a few 
years ago, would be nearly enough. And I think an unscrupulous 
person would not have a problem getting the necessary 
information.
    The Chairman. So from the time you started looking at the 
machine until you devised the virus, what sort of time was 
involved?
    Mr. Felten. We got the machine in May. At first we spent a 
lot of time taking it apart to understand everything we could 
about how it worked. We were interested not only in whether a 
virus would be possible, but we really wanted to understand all 
of the security mechanisms and we wanted to treat it very 
carefully. From the time we started developing virus code until 
we had a working virus, perhaps a few weeks.
    The Chairman. Thank you very much. My time has expired. I 
am pleased to recognize my Ranking Member, the gentlelady from 
California.
    Ms. Millender-McDonald. Thank you so much, Mr. Chairman, 
and thank you again for this very interesting hearing.
    The one thing I want to say about my friends in the Senate, 
they have a bill out now, saying that every polling place 
should have a large supply of emergency paper ballots that can 
be used in emergency situations. That is just where we are. 
That is what we think about voting now in this country of ours. 
And so Senator Dodd and Senator Boxer and others have submitted 
this bill.
    But I have said all along that there is a security issue 
here. There is a trust issue that we must come to bear in terms 
of voters.
    Mr. Felten spoke about when there aren't consequences, 
there are compromises--or consequences bring compromises. And I 
wanted him to expound a little bit on that. And he also said 
that existing election procedures are not adequate for 
elections. I want you to expound on that too, sir. And tell me, 
if Mr. Dickson feels a paper trail is not adequate, especially 
for disability, then you are suggesting, Mr. Felten, that paper 
trails do cut down on voter fraud. So we have some imbalance 
here. If you could just speak to that for me on those issues.
    Mr. Felten. Certainly. The first issue had to do with 
thethe consequences of the compromise being worse in an electronic 
system. And in the example that we gave here, there is a computer virus 
that will spread itself from one voting machine to others, and the 
consequence is that if someone is able to compromise one machine, the 
virus can spread to many machines and potentially affect all the votes 
on all of those machines, as compared to fraud with an old-fashioned 
ballot box where access to a ballot box only allows someone to tamper 
with the votes that are in that ballot box, or maybe increase them by 
some amount. Access to one cannot involve stealing tens of thousands of 
votes as with an electronic system.
    Ms. Millender-McDonald. But this virus, you say, can pass 
from one machine or one voter to another. I think you stated 
that. How can that be when I am told manufacturers do not give 
out this so-called code, secure code they use, how can that 
then be done with that?
    Mr. Felten. Well, the way that the virus--the way that this 
virus spreads is on these memory cards. The memory cards are 
programmed before an election, usually at a central location, 
and they are programmed with the list of races and the list of 
candidates and so on for that election. Then they are 
distributed out to the polling places and put into the voting 
machines. That is a possible--that is a possible mode of travel 
of the virus.
    If the virus gets onto the memory card at that central 
location, it will then be installed out into the voting 
machine. After the election, the memory cards go in the 
opposite direction to carry the votes back to the county clerk 
or Board of Elections Office to tabulate them, and that allows 
the virus to go in the other direction. So a virus in one 
machine may hitch a ride on a memory card, after the election, 
back to the election headquarters and then potentially spread 
there onto many other cards that are then distributed, say, for 
the next election.
    This is much like the process by which older computer 
viruses spread on floppy disks. If you put an infected floppy 
disk into your PC, your PC would catch the virus and then it 
would spread to any other disk that you put into your machine. 
So it hitches a ride, opportunistically, on top of the flow of 
these memory cards that happens in running an election 
normally.
    Ms. Millender-McDonald. How do we answer Mr. Dickson's 
whole notion that paper trails are not acceptable to the 
disabled and yet you say cut down on voter fraud?
    Mr. Felten. Yes, I do believe it cuts down on voter fraud 
and I do believe that a paper trail, well designed, can be just 
as accessible. Mr. Dickson held up the roll of paper and 
pointed out he could not view that or verify it or audit it. 
But the DRE system that he is advocating stores his votes on 
this, which neither he nor anyone else can simply look at and 
read. The problem with these DREs and the security problem is 
exactly the thing that Mr. Dickson is complaining about: the 
inability of any voter to look at the machine and see their 
vote recorded. So I don't believe that there is a conflict 
between the use of a paper trail and accessibility.
    Ms. Millender-McDonald. There are just so many questions 
that I have just put all over the place here. The whole notion, 
Mr. Cunningham, that you spoke of--and I see my red light is on 
already. That is what I am saying, it is just so much in so 
little time to talk.
    The Chairman. We will have a second round.
    Ms. Millender-McDonald. A second to go back?
    The Chairman. Second round.
    Ms. Millender-McDonald. My second round I will come back to 
you, Mr. Cunningham and Mr. Shamos, because I do want to talk 
with you. Thank you, Mr. Chairman.
    The Chairman. Thank you. The Chair recognizes Mr. Brady, 
the gentleman from Pennsylvania, for 5 minutes.
    Mr. Brady. Thank you, Mr. Chairman. Mr. Chairman, I have a 
point of inquiry. Will Mr. Holt have a chance to speak? Will he 
have a chance to speak?
    The Chairman. By unanimous consent, we will allow Mr. Holt 
to speak.
    Mr. Brady. Okay. I am just--I don't think voting is a 
science. I think it is a people person thing. I think it is--I 
think it is a human thing. And I think that anything we do 
here, no matter what it may be, can be attacked, can be hacked 
into, can be verified. Ballot boxes can be put in a river, 
could not be shown. But I think what we are trying to show is 
try to eliminate as best as possible all these things that can 
possibly go wrong. And I don't understand why a receipt--
because that is what I look at a paper ballot as a receipt--
why, when you vote and you get your receipt and you have that 
and you see what you voted for--and if you don't have that, 
then you could--if you don't have that, then you can allow some 
type of protest somewhere. If you have no receipt, you think 
you voted, you don't know. It is up to now whatever tabulation 
or whatever machine or mechanical or scientific tabulation 
happens. And I don't understand why it would be a problem for 
anybody having a receipt.
    Mr. Shamos, you heard my statement and you have inspected 
many times the voting machines, and from what I understand, you 
had said that a malicious hacker could easily make the same 
switch, allowing votes to be changed from one vote to thousands 
of votes. Then if that is the case, why are these--we think 
these systems aren't reliable and if that is the case, what 
would be the problem with a verified paper trail? If I want to 
vote and I want to vote for you, if I look at a paper and it 
says I didn't vote for you, I can lodge a complaint right 
there. If I walk out there with nothing, I don't know who I 
actually voted for. I am in the hands of that machine, a hacker 
or anybody who could probably get in to violate the voting 
process. I don't understand why this should be a problem. No 
matter what we do, there will still be a human factor 
somewhere, someplace, somehow.
    At least a voter has the confidence that he has or she has 
a piece of paper stating that, yes, I did vote; yes, this is 
who I voted for. And if there is a mistake, you may have a 
chance to rectify it right there. That is my point.
    I yield back the balance of my time. Thank you, Mr. 
Chairman.
    The Chairman. Any answers or any comments?
    Mr. Shamos. I can say something. It is certainly true that 
if a malicious hacker is able to gain access to a voting 
machine and replace the software that is in there in such a way 
that that change is not detected, then there are severe 
problems. And that is what I say, when we find security 
vulnerabilities, we have to find ways of plugging them.
    For example, the vulnerability discovered by Professor 
Felten's group at Princeton was known to us in Pennsylvania 
back in March, right before our May primary. And we were forced 
to make an emergency remediation in Pennsylvania to blunt the 
effects of that discovered vulnerability, becausewe wanted to 
be able to assure county election officials and voters that an 
intrusion of the kind that was demonstrated here today was not 
possible, or if it had happened, the effects of it would have been 
reversed and so we remediated that. We also instructed the vendor that 
the next time it comes back for a certification, it better have 
remediation of its own so that we don't have to impose administrative 
procedures to make sure that that vulnerability can't be exploited.
    So I am not minimizing the possibility that people are out 
there trying to hack things. My point is the response to the 
hack is not to throw the machines in the ocean and go back to 
what we were doing in 1890. If it is a technological problem, 
we have a technological solution.
    With respect to the receipt, a lot of people think of the 
word ``receipt'' as meaning something that the voter can take 
home with them and look at later at their leisure and show 
maybe at some later time to an election official and say, see, 
this is really how I voted.
    It is not legal to give receipts of that kind because you 
can't give a voter anything they can use to prove how they 
voted, since they could then sell their vote. So the receipts 
we are talking about, these voter-verified paper trail systems, 
the voter has a chance to view the receipt on the machine and 
then say yea or nay; yes, that truly represents my vote or not, 
and then when they leave the polling place, they don't have a 
piece of paper to take with them, and my point--the point that 
I made in my earlier testimony is that it is nice enough to 
show the voter that their vote was properly recorded. But, 
again, there is no assurance that at the time the votes are 
actually tallied later, or a recount was done, that that piece 
of paper is even around or hasn't been replaced by something 
else, and there are people who are working on the solution to 
that problem and we are not there yet.
    Mr. Brady. Mr. Chairman, if I can just answer, you are way 
out there. You are talking about after voting, you are talking 
about people manipulating receipts that they may or may not 
get. I mean, now you are becoming human factor after human 
factor after human factor, somebody is hell-bent on trying to 
rig an election. That is not what we are talking about. We are 
talking about voter confidence. That is what I am talking 
about. I am not talking about a receipt you take home and say, 
I want to change my vote or I made a mistake. Because people do 
make mistakes. If you make a mistake on the voting machine, you 
make a mistake. You can't rectify it after you validate it.
    But I am saying, as you are saying, look, this is who I 
voted for. This is what I wanted to do. Push the okay button, 
push the vote button, whatever, close the curtain, open the 
curtain. I don't think there is anything wrong with that. That 
is what I am saying. I don't think there is nothing wrong with 
our bill.
    Mr. Shamos. If I told you that mechanism could be used to 
discover how every voter in the precinct voted, that might 
change your mind.
    Mr. Brady. I learned that you people with this electronic 
scientific, you show me anything I ever did in my entire life. 
So that doesn't scare me.
    The Chairman. That might make for an interesting episode. 
Ms. Simons, quickly.
    Ms. Simons. I just wanted to comment briefly on this whole 
paper issue, because I think we are comparing apples and 
oranges. One of the basic issues is how well engineered these 
systems are. And somebody who was advocating for voter-verified 
paper trails early on, fore the machines were retrofitted--I 
have to say I was appalled by what the voting machine companies 
came out with. They are bad.
    I mean, Mr. Cunningham is right. Jim Dickson is right. The 
continuous rolls of thermal printed paper have privacy issues, 
as Michael Shamos says. But they are badly engineered. It is 
bad technology. There is no reason why paper has to be--why 
they have to be designed that way. They were the cheapest way 
to do it. That was why it was done that way. I mean, banks deal 
with paper all the time. They manage to count it. And I don't 
think they make many counting mistakes. Other countries vote on 
paper, and they don't have problems. We can do it, too, but we 
have to do it right. If you do it wrong, it will fail.
    The Chairman. And for the last quick word, Mr. Dickson.
    Mr. Dickson. Chairman Ehlers, I wanted to respond to your 
question about counting optical scan ballots by machines. We 
have a lot of experience in this country with that. When you 
have large numbers of ballots, hundreds of thousands, and you 
have got a close race, every time the optical scan ballots have 
been counted you get a different number. You get a different 
number. We do not have the technology to accurately count large 
pieces of paper.
    The Chairman. Right. Thank you very much.
    Next the Chair recognizes the gentlewoman from California, 
Ms. Lofgren, for 5 minutes.
    Ms. Lofgren. Thank you, Mr. Chairman. This is a very 
helpful hearing, and as I am listening, it seems to me that the 
point made by Ms. Simons needs to be emphasized: The fact that 
we have a dysfunctional roll doesn't mean that that is the only 
alternative available as an auditable trail.
    You know, I spent more years on the board of supervisors in 
Santa Clara County than I have so far in Congress, and in 
California, the counties are the repository of the registrar of 
voters, and in California the registrar of voters is acivil 
service position. It is very nerdish, I guess is the best word you 
could say, in Silicon Valley and very apolitical, and it wasn't really 
until I got on the board of supervisors that I realized--I guess I 
never really thought about it--that, you know, some of the votes get 
lost.
    People don't think about that, but we had the little punch 
cards for a long time and it would jam up the machines on 
election night, and some of the ones that got mangled didn't 
get caught. And it didn't ever--at a time when the country was 
less closely divided than it is today, nobody really noticed 
because elections weren't that close. But of course now we have 
close elections all the time, and we are paying more attention 
to it. And so I do think that we need to make sure--you can't 
have a perfect system, I suspect, but we need to have a system 
where people do not question the integrity of it.
    I remember going with a computer scientist in my district 
who really said this: Yes, you can make a mistake, I mean, you 
can take a ballot box and throw it out, but the difference with 
hacking a machine is it is not random, the direction in which 
those votes are going to be lost.
    And so I am very enticed by Mr. Holt's bill. I would know 
that in a standards setting, there has been discussion that 
this would eliminate the privacy of individuals. But on page 3, 
line 13, of his vote, it specifies that to comply with the act 
that would not be permissible.
    So I think, you know, part of what we do here in Congress 
is to set standards and laws that need to be met, just as NIST 
does from an engineering point of view.
    I am wondering, Mr. Felten, Mr. Shamos said something to 
the effect that you could verify other than by paper means. I 
don't want to misquote you or something; it was something to 
that effect. How would you do that with the virus that your lab 
created? How would you do a verification without--would there 
be a way?
    Mr. Felten. Well, I think that the idea of nonpaper 
verification is something that is not ready yet. It is an 
active area of research. Mr. Shamos referred to Professor 
Rivest's work, which, by the way, is an all-paper system. And 
that is an interesting proposal, but I would not want to trust 
an election to it tomorrow. I think that years from now we may 
be in the position to have effective and useable nonpaper-based 
systems, but I do not believe they are ready yet and I don't 
think we can afford to wait.
    Ms. Lofgren. Mr. Shamos, your testimony has been very 
interesting, and thank you for your advocacy and your work on 
assuring systems. One of the things that you suggested, that we 
needed to make sure that vulnerabilities are protected again--
and no one would disagree against that--but one of the things I 
learned in my prior life in local government was that 
elections, they are not chaotic but they are--they are chaotic. 
You have got, you know, PTA mothers and you have got 
volunteers, and there are schools, and it is really--I love 
election day, but it is not really tightly controlled and 
cannot be, because that is not the way Americans hold 
elections, unless we completely fund this and have full-time 
paid people. And I don't think we are moving in that direction.
    So how would we be able--even if we found this virus, I 
know from Silicon Valley, I mean there are a million ways to 
hack this stuff. Given the fact we have this chaotic system, we 
have smart hackers everywhere, how do you protect against those 
vulnerabilities in your judgment?
    Mr. Shamos. Okay. So there are several ways. One is that we 
are never going to achieve perfection, we are never going to 
locate all vulnerabilities that exist in systems because we 
don't know how clever people may be in the future to get around 
the protections that we have built in. But this is true not 
just in voting systems. In every kind of system that has ever 
been made, there are later discovered vulnerabilities.
    As I said in my testimony, I am in favor of voter 
verification. Voter verification is a way of assuring that if a 
vulnerablity has been exploited that we are going to know about 
it.
    I think you just asked about a potential nonpaper mechanism 
for verification. I will give you a very simple one that the TS 
unit over there has a touch screen that shows things to the 
voter. The voter is not positive, however, that the marks that 
she makes that are visible on the screen are actually getting 
recorded by the machine. So all we have to do is have a second 
screen, made by a different manufacturer, and we take an 
electrical wire and we get a copy of whatever is on the first 
screen to the second screen, and we attach a digital camera to 
that and we make a record of what the screen showed. And if the 
voter has any doubt it has been recorded correctly, she can 
press a button that says ``replay'' and it will show her her 
vote again on the screen. And that vote gets recorded on a CD 
or DVD and prevents it from being tampered with later. That is 
just a trivial example of a nonpaper verification mechanism.
    The second way of doing it is through something called 
parallel testing, which is used in at least 10 counties in 
California. It is going to be used in Massachusetts in 
November. It is used in several other States, where you 
sequester a machine or machines during the election, during the 
actual time of the election, and you have a team of people vote 
on them, simulating the way they vote, except they vote 
according to the predefined script so we know what the total 
should be at the end. Then at the close of polls, we close that 
machine and we see if the totals match. If they don't match, 
then we know that there is a rat somewhere, and we do a 
forensic examination to find out where the rat is.
    The Chairman. The gentlewoman's time has expired. I am 
pleased to recognize our guest, Representative Holt, for five 
minutes.
    Mr. Holt. I thank the Chairman and I am pleased to see that 
we are holding--that you are holding this hearing, and I 
welcome the opportunity to be with you. And I regret that the 
hearing is being held the day before our target adjournment for 
the year. But nevertheless, I think you have put together a 
good panel of witnesses.
    Let me just make two quick comments. One is, HAVA had the 
unanticipated effect of motivating jurisdictions to go out and 
buy devices for voting that are clear, simple, accessible, easy 
to use and totally unverifiable. And it may be that there are 
various future methods of verifying that are not yet thought of 
or not yet developed, but right now we have a method of 
verifying where each voter can verify her vote at the time of 
voting, and that is a paper trail. And I do think it can be 
made accessible for voters, for all voters.
    Mr. Shamos just described a rather Rube Goldberg-ish CD 
camera that was going to photograph another screen. Boy,paper 
record sounds a whole lot easier to me.
    But anyway, let me first go to Mr. Felten, Professor 
Felten. How detectable would the virus that you devised, or 
that someone might devise, be before, during, and after the 
election?
    And let me ask another question. I don't know whether you 
are familiar enough with the kind of chain of custody and other 
checklists that Mr. Smith puts his machines through. Do you 
think a virus could be implanted in a system that had the kinds 
of protections that Mr. Smith describes?
    Mr. Felten. First the question of how detectable this would 
be. There is a long-established cat-and-mouse game in the PC 
world between virus writers and antivirus companies, and the 
virus writers have proven very successful at making viruses 
that are quite difficult to find, especially in advance. And I 
would expect, or I suppose fear, that we would see the same 
phenomenon here. We did not try to make this virus as stealthy 
as we could. But I think that if someone used the same methods 
that are used in the PC world to make viruses hide, it would be 
very difficult indeed to find in advance.
    Preelection logic and accuracy testing as has been 
discussed here will not find the virus that we devised, because 
it simply checks whether the machine is in logic and accuracy 
testing mode or real election mode, and if it is in logic and 
accuracy testing mode, the virus simply lies low. So I think it 
might be quite difficult to find, and I certainly would not 
have confidence that if it were implanted it could be found.
    The second part of your question related to the procedures 
that Mr. Smith described, and I think those sorts of procedures 
are very valuable. They do help to close the gap, to close the 
window of vulnerability, but we also have to recognize that 
procedures are not perfect and are not always followed. Like 
any other part of our election system, there will be gaps, 
there will be errors. And I still worry, despite the best of 
procedures, that the window of vulnerability opens enough that 
a determined adversary can get through it.
    Mr. Holt. Thank you Mr. Shamos.
    Yes, Mr. Smith. If there will be another round of 
questions, I would be happy----
    Mr. Smith. I would like to respond to that, because I think 
it really comes to the core of what we are trying to talk 
about. I have listened to the situation with regards--I am the 
only one here, by the way, who uses Diebolt TS units, and I am 
the only election director I guess on the panel that does.
    One of the things I have been listening to and have been 
concerned about is how this virus would spread. I am an 
engineer by background. I hold a double E degree so I have some 
kind of technical capability in that.
    First of all, if you took one and you corrupted this memory 
card--can I see your card? If you took and corrupted this 
memory card, and it is going to go into one machine, and that 
one machine in my county is probably going to vote between 100 
and 150 votes, that's all that's going to be counted on it, the 
issue comes on this card supposedly then is it is going to be 
corrupted; okay, we will lose 100 votes. That is not good, but 
it is not like we are losing 50,000 votes that I have cast in 
the general election, in the last one in 2004.
    Now, this comes out, it goes back to the end of the 
process, as Mr. Felten has said, it is only going to corrupt 
one more machine. The machines are not interconnected. There is 
not a possibility of corrupting the 500 machines that I am 
going to put in place for the 2006 general election. That is, 
you know, an issue. It is a tactic; it is not going to happen.
    Now, there are a lot of other things that we do. I mean, we 
have a lot of security in place. We follow it. I am very anal 
about those types of things and I have talked to Mr. Felten 
about it, and I think that he believes in our county we have a 
good thing.
    The last thing is, I would like to respond to what Ms. 
Millender-McDonald said--and I think this is as important as 
anything--is that the confidence people have in our equipment 
is very important. I mean, I couldn't say anything more. We 
take--and after every election we hand out a response card, 
given out randomly to our people. We say, what do you think 
about the process? You want to have, whatever, and I have got 
in front of you--it is not a technical, you know, survey of the 
type, but there are 715 responses. You can see the names, you 
can see the precincts, you can see what the election was held 
for; in addition, you can see their comments. 99.5 percent of 
the people that responded to these things in my county said we 
did an excellent job. There was only two people, only two that 
requested a paper trail.
    So I think we are doing a good job in Forsyth County, 
Georgia. I think we are doing an excellent job in the entire 
State of Georgia and I think that we need to be--I don't want 
to say ``recognized'' for it, but hopefully--don't impose 
things on us which are going to make our job much harder to do. 
But I also will tell you that I agree with Mr. Felten with 
regards to having verification, but I believe that we do not 
need to eliminate the paper.
    Mr. Holt. My time has expired. I hope Mr. Felten will get a 
chance to reply, because on my visit to his laboratory it was 
my understanding that the method of spreading the virus is 
different than Mr. Smith seems to understand.
    The Chairman. Very quickly could you give a brief response?
    Mr. Felten. Sure. Well, without getting into a long 
technical debate, let me just say that when this memory card 
goes back to the central facility and is put into a so-called 
accumulator machine which adds up the votes, if that 
accumulator machine becomes infected it can then infect a very 
large number of other memory cards that are subsequently put 
into it, and it acts as a very serious carrier of the virus.
    The Chairman. Thank you.
    Just an announcement to my colleagues. I have received a 
note that votes are expected between 12:00 and 12:15. I would 
like to have a second round of questions. Let me suggest that 
each of us tries to limit ourselves to three minutes. And I 
will begin, and then recognize the minority leader or the 
ranking member. Mr. Doolittle presumably will be settled in by 
then and ready with his question.
    We were just talking to Mr. Smith and I was wondering, Mr. 
Smith, what kind of system did Georgia have before it adopted 
the electronic system? Why did they see the need to change to 
the current system, and what were some of the problems you 
experienced with the previous system? Basically, is the new 
system better than the previous one or not?
    Mr. Smith. Okay. I think I can respond to that. Fortunately 
I took over as director of elections prior to theintroduction 
of the DRE machines. We had at that point in time the punch card 
machines. By the way I would say the security level we had on the punch 
cards is pretty miserable, now that I have gone through and listened to 
all the technical dissertations that have gone on. Our punch card 
machines were monitored by a computer as well. That computer sat in a--
it was an IBM 386 or something like that. It sat in a closet that we 
kept, and in fact they downloaded software to it routinely, you know, 
over the telephone lines. I would say that was highly unsecure, and I 
was mortified at that when I saw it.
    The changes, the changes that we had, 6 months prior to the 
2002 election, Diebolt machines were introduced into Georgia. 
We had 6 months in which to take this across the entire State, 
and I would say that the secretary of state and the Center for 
Election Systems from Kennesaw State University did an 
outstanding job.
    I tell you, I personally used to run major computer 
projects. I didn't think they could do it. They have done an 
outstanding job. We have continued to hold elections, and 
people are very pleased with them in our State.
    Are there problems? I think some of the things Ms. 
Millender-McDonald brought up with regards to training poll 
workers are very valid, and I appreciate the fact that she will 
continue to fund it. I would like to ask if she would fund the 
program also so it is part and parcel of a program that I have 
introduced, which is called Forsyth First Vote, but we also use 
high school students to do it. One-third of all my poll workers 
are students. We have changed the entire complexion of the 
people in our county. Maybe that is why we are running good 
elections, I don't know, but I have got poll workers that we 
turn away because we have a very good program, and I am very 
pleased with it. Thank you.
    The Chairman. Thank you very much.
    Briefly, Mr. Cunningham, you mentioned that you grew up in 
a small town in Ohio. I spent my high school years in an even 
smaller town, I am sure, known as Celeryville, Ohio; 
population, 200.
    I have a question for you about the VVPAT technology, the 
printing paper trail technology. It is relatively new. You have 
described the problems that you have encountered with that in 
Ohio. Do you believe improvements can be made to the VVPAT 
printer technology to make it more reliable, to capture true 
vote totals, to avoid the problems you have had; and then would 
the added complexity brought to the system always increase the 
likelihood of failure? Or do you think through sufficient 
research and study, we could make them more reliable?
    Mr. Cunningham. Thank you, Mr. Chairman. I have a personal 
motto: I never buy the first model of anything. I always let 
other people figure out what the problems are before I buy. I 
think the fact of the matter is, when the Help America Vote Act 
was passed, most of the touch-screen voting machines were, by 
and large, prototypes and rushed into manufacture. I am not 
taking any issue with any of the manufacturers, and I am not 
making a comment on the reliability of any of their machines. 
But I think what we have got on our hands here is the Model-T 
Ford. We are in the early stages. Now, can it be improved? 
Absolutely. I think throughout my comments I was very definite 
to say these machines as they currently sit are not reliable.
    My question back to you, though, in that regard is, who is 
going to pay to fix it? Because one of the problems we have 
right now is in the last 24 months, every election jurisdiction 
in this country has spent the $3 billion we spoke about earlier 
on new election equipment, and that is what is in place. So 
without somebody stepping forward to fund that enterprise, I 
don't know how we are going to improve them ourselves.
    And if I could, Ms. Lofgren, I liken running an election to 
throwing a package of BBs on your kitchen table, and while 
somebody is on each leg moving the table, you are trying to 
keep them all on the table all day long. That is my analogy of 
election day.
    The Chairman. Thank you for that discouraging analogy. Next 
I recognize the Ranking Member for five minutes.
    Ms. Millender-McDonald. Thank you, Mr. Chairman. And let me 
again thank you so much for this hearing. This has been just 
absolutely the most informative hearing, one of the great ones 
we have had.
    Mr. Cunningham, I thank you for saying that we all agree 
that some type of verification system is needed, and at least 
we have a consensus here for that. But you did speak of the 
fact that you are adamantly opposed to any program such as 
yours in your State which makes VVPAT the official ballot of 
record for recount? If I am not mistaken, Ohio lost 10,000 
ballots. And what happen here, given that you were not able to 
recount because you can't reprint?
    Mr. Cunningham. In Ohio--what election are you talking 
about?
    Ms. Millender-McDonald. It was my understanding that there 
were 10,000 votes that were unable to be recounted because you 
were unable to reprint.
    Mr. Cunningham. You mean at the ESI?
    Ms. Millender-McDonald. Yes.
    Mr. Cunningham. Ten percent of the VVPATs counted, I forget 
what the numbers were exactly. I believe the statement that I 
made was that nearly 10 percent of the tapes were either 
destroyed, blank, missing, taped together or otherwise 
compromised in some way. I don't--I don't think that it would 
be correct mathematically to say it was 10 percent of the 
votes; but 10 percent of the VVPAT tapes, based on what we 
reviewed, had some kind of compromise that made it very 
difficult to ascertain what the real numbers were.
    Ms. Millender-McDonald. But you make a valid point that 
because of the VVPAT, one is unable to reprint; therefore 
voters will be unable to discern whether or not their vote 
counted in an election. Am I correct on that?
    Mr. Cunningham. I am sorry; repeat that?
    Ms. Millender-McDonald. Am I correct in saying that because 
VVPAT is the official ballot record for recount purposes, that 
if you should need a recount, you cannot go to a reprint to 
discern whether or not those votes----
    Mr. Cunningham. Right. That is exactly right, Madam. I 
would submit to you that to reconcile and verify vote totals on 
an electronic machine, there are better ways to do it in more 
controlled environments than the election-day environment that 
I just mentioned. And it is--for instance, when the machine 
back in the office and other records that are stored in that 
machine can be printed and otherwise looked at electronically, 
you know, we work every day on this.
    Ms. Millender-McDonald. I am sure.
    Mr. Cunningham. We try--that is my job is to try 
toreconcile those numbers at the end of the day, but trying to maintain 
this contemporaneous record. And the current state that it is in, and I 
think we have--I am just saying it is never going to match. And it is 
only going to fuel this--this fire that voting systems don't work, and 
I think Ohio has set itself in a very very dangerous situation.
    If I may just go on with that, there has been a little talk 
here about we are only concerned with Federal elections. You 
know, the least frequent election I run is a Federal election. 
We need to be very careful that one of the problems that has 
occurred since the passage of HAVA was it put many State rules 
and regulations in conflict with the Federal law.
    Ms. Millender-McDonald. Absolutely.
    Mr. Cunningham. And what we ended up with was these rules 
apply in a Federal election and these rules apply in a local 
election. That is a terrible situation. We cannot operate this 
enterprise with two sets of standards.
    Ms. Millender-McDonald. I couldn't agree with you more.
    Mr. Cunningham. Please do not think in terms of only 
Federal elections because it is a very problematic proposition.
    Ms. Millender-McDonald. Because you know what, sir? In a 
given election, you have three different laws that you perhaps 
might have to implement.
    Mr. Cunningham. Could have.
    Ms. Millender-McDonald. Local, State and Federal. And you 
know, my hat is off to all of you local elected ones who have 
to balance between the trenches. It is just really problematic.
    Ms. Simons, I will let you close me down because I wanted 
to go to Mr. Shamos. But I just have a second here for you to 
comment.
    Ms. Simons. Yes. I wanted to remind the panel what happened 
in Carteret County, North Carolina--I believe it was in 2004--
where paperless DREs were used and over 4,000 votes were lost. 
There is a concern about being unable to reprint paper ballots 
or VVPATs. When you lose votes in a DRE where there is no 
paper, there is nothing you can do. And in fact there was a 
statewide election for agricultural commissioner, where the 
separation between the two candidates was such that the results 
could have been reversed by those missing votes. And it went to 
court. The State Board of Elections first tried to hold a vote 
in just the county. That was thrown out by the court. Then the 
Board of Elections attempted to hold a statewide vote. That was 
thrown out by the court because we had no laws to deal with 
what happens when DREs fail. Finally there were a number of 
people who submitted subpoenas or petitions saying they voted 
for one of the candidates; and based on those submissions, it 
looked like the judge was going to declare that candidate the 
winner. So the other candidate conceded, and so that was how 
the election was decided.
    This is not the way to hold elections in this country. This 
is a problem with DREs, paperless DREs. This was a case of a 
failure, but there are many other problems too. We haven't even 
touched upon security problems such as, for example, the risk 
of somebody malicious getting a job with the vendor or the 
delivery service and inserting malicious code.
    We know that all software is buggy. We don't know, for 
example, if elections have been wrongly recorded because of 
buggy software, forget malicious code.
    There are so many basic problems that we just have no way 
of verifying elections that were held on paperless voting 
machines--we cannot verify them at this point.
    The Chairman. The gentlewoman's time has expired.
    Ms. Millender-McDonald. This is why the average voter now 
is just so befuddled over elections.
    The Chairman. And most of us are average voters.
    I am pleased to recognize the gentleman from California, 
Mr. Doolittle, for five minutes.
    Mr. Doolittle. Thank you, Mr. Chairman.
    Ms. Simons, your written statement said, quote: Unless 
there is evidence that the VVPBs have been compromised, the 
paper ballots should be used to determine the election results.
    I wanted to ask, what sort of evidence of compromise were 
you referring to?
    Ms. Simons. Well, obviously, if you have the kind of mess 
that Mr. Cunningham talked about, that would raise a lot of 
concerns. I share his concern about that kind of technology 
being deployed. We need to have good engineering, we need to 
have high standards, and we have to hold vendors to high 
standards. Vendors should not be allowed to produce machines 
that can create this kind kind of mess.
    Mr. Doolittle. Well, they are machines and I notice that 
machines occasionally make messes.
    Ms. Simons. You know, sometimes you get what you pay for. 
You can buy printers that don't jam. You can buy printers that 
don't have privacy issues. This is not rocket science. These 
things exist now. These technologies exist now, and I think a 
question that we have to ask ourselves is how much are we 
willing to pay for our democracy, you know----
    Mr. Doolittle. And our Republic.
    Ms. Simons. And our Republic; yes, thank you.
    Mr. Doolittle. Now I apologize, I should have been here, 
and I couldn't be here earlier, so I missed the direct 
testimony. But I think Mr. Cunningham is from Allen County, 
right? But there was an incident in Cuyahoga County where there 
was a problem.
    I just wondered if you could tell us, Ms. Simons, do you 
think this evidence of compromise was compromised in the 
Cuyahoga recount?
    Ms. Simons. Sir, that is what I was referring to, actually.
    Mr. Doolittle. Oh, all right. Do you think the paper trail 
should have been used as the official ballot in that case? 
Because that is kind of----
    Ms. Simons. Well, in that case it is a problem. It is a 
real problem, just as the Carteret County failure is a real 
problem. We can see problems with the paperless systems and 
problems with the systems that have been retrofitted with 
VVPATs. The underlying issue, which I believe everyone on this 
panel would agree on, is we need to have well-engineered, well-
designed, robust systems. As Mr. Cunningham said, this is sort 
of like the Model-T. These are first generations and they are 
failing. That is not good.
    Mr. Doolittle. Well, I understand the Model-T analogy, but 
I don't think the members of this committee and the Congress in 
general want to throw away hundreds of millions of dollars on 
the Model-T.
    Mr. Dickson, would you like to comment?
    Mr. Dickson. Yes. There were two points. The loss of votes 
is really, really, a terrible situation.
    Mr. Doolittle. Is what, sir?
    Mr. Dickson. The loss of any votes is really a terrible 
situation. Votes get lost on paper too. The Carteret County 
voting machine does not meet the current standards. If that 
county had purchased an accessible voting machine, built to the 
current standards, that problem would not have happened.
    Mr. Dickson. The Carteret machine, a little red light comes 
on with no words around, and it says, ``This machine is full.'' 
There was no explanation in the training for poll workers that 
said this red light means the machine is full. On the other 
machine, the machine reads, ``Screen full,'' and will not 
accept new votes.
    Mr. Doolittle. Sir, you said--when are you talking about--
are you talking about the one in Cuyahoga County?
    Mr. Dickson. Carteret County in North Carolina where votes 
were lost on a voting machine. That county administrator wanted 
to buy new accessible voting equipment, and the purchase of it 
was delayed because of the commotion about a paper trail. And 
the problem was created because of the delay.
    Mr. Doolittle. Well, I just wonder, in the Cuyahoga County 
case I understand that the paper trail, which I think Mr. 
Holt's bill is going to be the thing we go by if there is a 
conflict--in that case the paper trail lost nearly 10 percent 
of the votes, so it doesn't seem there would be real problems 
in that instance at least. Hopefully that would be relatively 
rare, but in that instance if we went by the paper trail, as 
the bill called for, there would be problems.
    Ms. Simons. Actually, there were many problems in that 
county.I understand there were problems with the DREs; that the 
redundant memories did not match in about 26 percent of the 
cases. So if you are going to try to do a verification using 
the redundant memories, there can be issues.
    There were a great many problems, not just involving the 
VVPATs. This just shows that we need to focus more on 
technology, on policies and procedures. As Mr. Cunningham said, 
running an election is a complicated thing, but just because 
there were problems involving one technology doesn't mean that 
that technology can't be implemented correctly. Banks deal with 
money and paper ballots all the time. Canada holds its Federal 
election with paper ballots, so does the U.K., and they manage.
    Mr. Doolittle. In this case the paper trail didn't solve 
the problem.
    Ms. Simons. Because it was badly engineered.
    Mr. Doolittle. The point is paper is not the ultimate 
solution.
    The Chairman. The gentleman's time is expired.
    Mr. Brady, you are recognized for 5 minutes.
    Mr. Brady. We are going through as I speak in my city and 
county in Philadelphia a write-in candidate, as you had, and we 
are doing that as we speak. We are in court now because the 
candidate on the machine won. Then they had a paper they could 
write on, and they are counting the write-in ballots, and that 
person won, and they are going to decide it in court. So we at 
least had the opportunity to do that.
    I heard you have ways of rectifying or double-checking 
votes by voting electronically and having a camera. A lot of 
people don't have good faith in any kind of electronics, and 
what we are trying to do here is the right thing. We are trying 
to restore confidence and, most important, trying to restore 
trust back into our process, and we are trying to figure out 
the best way to do that.
    I understand there is a financial problem, and I understand 
there is always a financial issue, but like what you said, 
there is never enough money. You can always find some money to 
assure democracy, and I subscribe to that.
    Thank you, Mr. Chairman.
    The Chairman. Thank you.
    The Chair recognizes the gentlewoman from California Ms. 
Lofgren for five minutes.
    Ms. Lofgren. Thank you, Mr. Chairman.
    At the conclusion of my first set of questions, Mr. Shamos 
had described alternative ways to verify the vote. I am 
wondering if, Mr. Felten, do you have a comment on those 
proposals, and also Ms. Simons?
    Mr. Felten. If I recall correctly, he mentioned two 
mechanisms, one involving a second screen and a video camera. 
This seems to me more complicated, more expensive than a paper-
based verification system and probably not any more 
trustworthy.
    He also mentioned parallel testing, which involves taking 
the machine aside and holding a simulated election. This is 
something we discussed in some detail in our research paper, 
and the bottom line is that that is a worthwhile mechanism, but 
it is not completely effective, not 100 percent effective at 
the problem. It raises the bar, makes it more difficult to make 
a virus, for example, that will evade detection. We should do 
it, but we should not believe that it is going to entirely fix 
the problem.
    Ms. Simon. To pick up on Ed's comments, the alternative 
device that Professor Shamos mentioned makes it very difficult 
to hold a recount. If you want to have public confidence in 
elections, one way in which you do that is by audits and 
recounts. I don't know how you would audit that screen. It 
seems to me it would have the same problems as these long rolls 
of paper that Mr. Cunningham showed you, someone to sit in 
front and say, this one voted here, and this one voted there.
    Ms. Lofgren. Mr. Smith, do you have a comment on it? I cut 
you off, Barbara. I didn't mean to.
    Ms. Simons. May I finish? The best way to count things is 
the way you count money, you sort it into piles, and you count 
each pile, and that can be transparently and with a TV camera 
watching a count as a way in getting confidence in the results.
    Regarding parallel testing, I think we agree parallel 
testing is a good thing to do. But there is a big ``what if,'' 
and that ``what if'' is: What if you find a problem with the 
parallel testing? Are you going to go back and rerun the 
election? As we saw in Carteret County, that raises enormous 
legal and technical problems.
    Ms. Lofgren. Mr. Smith.
    Mr. Smith. I would like to speak from the complexity of the 
operation that you are trying to bring about. One of the things 
we have got in Georgia is a more simple format, I think, for 
running the election because we do not have voter-verifiable 
paper trail. One of the issues--I was actually charged with 
running the manual recount, so I have some experience with 
that, too. I wanted to see it being done because it is being 
talked about in our State.
    One of the concerns I have, and I think we all should look 
back to, is who are the people putting this stuff into 
operation on election day? It is typical. We have done things, 
you see it. We have part-time people who are volunteers who 
really try to do things, but they have gotten up at 4:00 in the 
morning, 5:00 in the morning. They have to open the machines 
up, do all the other things.
    In Ohio with the VVPAT for Cuyahoga County, they had to do 
other things that we didn't have to do. They go through the 
logic and accuracy testing essentially right there. They enter 
the machines, they start them up, they do everything. They 
bring the memory cards. Part of the problem was the memory 
cards weren't seated properly. That was a problem. But the 
other thing is they had to be responsible for these printers. 
In some cases they put the paper in backwards.
    Ms. Lofgren. Let me explore that, because I am taking as a 
given that we are not going to completely change the way 
America holds elections, I think that is true. And I can 
remember voting when I was still at my parents' house, and you 
go down to the corner, and Mrs. Lucky, who always ran it, and 
it is retirees and people that volunteer, and it is a wonderful 
thing, but that is the given.
    A lot of States have these verifiable systems, California 
among them. Ms. Simons, has any of them come up with a system 
that actually works better than that silly tape that we have 
seen?
    Ms. Simons. I think precinct-based optical scan systems are 
excellent. That gives the voter a chance to check for overvotes 
and the absence votes. You put your ballot through the scanner, 
and it tells you if there is a problem with it. Recounts and 
audits are relatively easy. The voter verifies the ballot by 
definition, because the voter can look at it.
    There are ways for blind voters to verify an optical 
scanballot. One possibility is the use of a hand-held device 
that reads the ballot for a blind voter. We know that this 
technology exists. Another is to allow blind voters to use 
tactile ballots where they insert the blank ballot into a 
sleeve envelope that is marked. The sleeve has holes that allow 
a blind voter to mark the ballots. There is also a system being 
marketed which allows a blind voter to verify his or her ballot 
with a vibrating device.
    Ms. Lofgren. I see my time has expired, but I would just 
like to note that I think we may have in the future some other 
way to verify, but I just ask Mr. Holt to put me on his bill 
because I think we need to have some in between on this. 
[Applause.]
    The Chairman. No demonstrations.
    I am now pleased to recognize Mr. Holt for five minutes.
    Mr. Holt. Thank you, Mr. Chairman.
    My questioning will be along a couple of lines. First of 
all, Mr. Shamos, I am sorry I didn't have the exact transcript 
here, but said something or other you hate to see us outlaw an 
entire category of machines. This legislation doesn't outlaw 
any particular kind of voting system except unverifiable ones.
    And you said further, I think, that scare tactics by a 
minority, you hate to see that disrupt the whole process. The 
Brennan Center for Justice of New York University Law School 
conducted a study with very distinguished people, Ron Rivest 
from MIT, Howard Schmidt, an administration and corporate 
security expert, and a number of others; and said it found, 
quote, all three major types of voting systems have significant 
security and reliability vulnerabilities that pose a real 
danger to the integrity of national, State and local elections.
    The League of Women Voters, not a scary minority, says they 
support, quote, only voting systems that are designed so that 
they employ a voter-verifiable paper ballot or other paper 
record, said paper being the official record of the voter's 
intent.
    The report of the Carter-Baker Commission similarly called 
for a voter-verified paper record, random audits and so forth.
    Mr. Chairman, I would like to ask that the Brennan Center 
report, the statement of the National League of Women Voters 
and the Carter-Baker report be made a part of the record.
    The Chairman. Without objection, so ordered.
    Mr. Holt. Thank you. I want to make the point that a number 
of organizations, very responsible organizations with computer 
scientists involved and so forth, have taken a look at this 
matter, and we would do well to take a look at that.
    Ms. Simons, I would appreciate it if you would say a little 
bit more about ACM and the subcommittee that is looking at 
this.
    Then also what I would like the witnesses to comment on, as 
Mr. Dickson recounts and Mr. Smith and others, votes can be 
lost in a lot of ways. They can be lost through manipulating 
the registration list, intimidating voters. There are a lot of 
things that we need to address: Restricting accessibility at 
polling places or in the polling booth; memory cards may not be 
seated properly; we may not recognize that the memory is full 
before election day is over; and paper records, Mr. Doolittle, 
might be illegible or torn or otherwise difficult to use. But 
it has been determined at least as often that redundant 
electronic memories show that there are problems with purely 
electronic memory.
    So what I would like to ask of the witnesses is would you 
prefer to have a system where there is no possible way of 
recovering what happened, in other words, where the electronic 
vote, for whatever reason, a poorly seated memory card or 
something else, is wrong, and there is no possibleway of 
recovering it; or, as Ms. Simons points out, a well-designed system 
with a paper audit trail where there is at least a reasonable chance of 
being able to recapture, recover what the voters' intentions were?
    So I would be happy to have a quick comment from the 
witnesses, beginning with Ms. Simons.
    Ms. Simons. You asked me about ACM. It is an 80,000-member 
professional society of computer professionals. Like the APS, 
(the American Physical Society), the ACM is the premier 
computing society, I would say, in this country.
    The statement that I referred to, which is in my written 
testimony, was voted on by ACM Council, which is the elected 
policy making body of ACM. But they did something unusual, not 
typical for ACM. The statement was put on the Web site for 
members to vote on. Of those who voted, 95 percent supported 
the statement. Of the 5 percent who did not support the 
statement, roughly half, based on written comments, objected to 
the fact that it wasn't broad enough, that it didn't discuss 
usability issues as well.
    So I would say obviously you never get 100 percent 
agreement, but in this case we are pretty close to consensus, 
at least within ACM.
    The Chairman. The gentleman's time has expired. Make brief 
comments, please. Mr. Shamos, first.
    Mr. Shamos. I want to respond to a couple of things. I 
actually didn't make a comment about scare tactics, although I 
believe there was another member of the panel that did. I just 
said I don't think we should appeal to emotion on this issue.
    I agree that H.R. 550 does not expressly outlaw any 
particular type of voting equipment. My point was that the 
practical effect of it is that it outlaws DRE machines, and the 
reason it outlaws DRE machines is there is no current machine 
on the market that meets the requirement of the bill and that 
is usable in individual States along with their requirements.
    For example, in Pennsylvania there is popular call for a 
paper trail machine. Four vendors have come to Pennsylvania 
with their paper trail machine. Not a single one has been able 
to simultaneously offer a paper trail and meet Pennsylvania's 
statutory and constitutional requirements. So we can't have one 
even if we want one. The technology is just not there yet.
    The Chairman. I think Mr. Felten had a comment.
    Mr. Felten. The key issue, I think, is resiliency; things 
go wrong, people make mistakes, and we need to have a system we 
can trust even when things do go wrong. The combination of 
paper plus electronic record is more resilient than either one 
would be alone, and that, I think, is the strongest argument 
for having a paper-based verification system.
    Mr. Ehlers. I think Mr. Cunningham has the last answer.
    Mr. Cunningham. I just wanted to make the point to 
everybody that my experience is most votes are lost due to 
voter error, not machine error, not election official error. I 
don't know if you looked at my resume, but I have about 20 
years in the printing business, and I have been around a lot of 
printing machines and copy machines, and I can assure you 
anything you put paper through will jam at some point in time.
    E-voting, I want to say to you, I truly believe that in the 
long-term interest of this country--we are still voting the 
same way we did 150 years ago, as you mentioned, Ms. Lofgren, 
down to your little poll at the corner and precinct. Our 
society has changed. It is mobile, moving. The ability to 
incorporate the vote centers as Scott Doyle in Colorado has 
been working with as a convenience to voters, those types of 
concepts are based on electronic voting.
    Let's not throw the baby out with the bath water here. I 
think, Mr. Brady, what is doing more damage to voter 
confidence, quite frankly, is people like your distinguished 
colleague Mr. Conyers publishing reports about the election in 
Ohio that are factless and baseless; none of the accusations 
have been proved.
    We have got to quit this. We have got to get this 
conversation back to an honest debate about, as I think the 
whole panel has said, how do we work together and move this 
thing forward and quit this sky is falling kind of thing. I 
think elections, because given the magnitude of them--and I 
have seen now 9 years' worth of them, two Presidential, couple 
of gubernatorials--given what could happen and the magnitude of 
the task, they are running pretty darn good in this country, 
and I know people all over the country like myself and Mr. 
Smith that are darn proud they are involved in it. And the net 
effect is we are going to begin to drive those people out of 
this, which is going to make the system more vulnerable than 
you ever imagined.
    Ms. Millender-McDonald. Mr. Cunningham, I sure hope that is 
accurate, what you have said, because the voter is not there 
yet. Even though you folks are and your experts, the voter is 
not there yet. And that is the ultimate one that we must bring 
trust, security to bear.
    I would like for you to get for me whatever documentation 
you have that suggests voter error is more than a paper error. 
If you have that type of verification of that statement you 
made, I would like to have it.
    Mr. Cunningham. My point was that most voting error is 
voter error.
    The Chairman. I thank you for your comments. That is a good 
wrap-up. We are going to have votes in just a few moments, and 
I would just like to make a few closing comments.
    First of all, I thank each and every one of you for being 
here in the audience as well as at the witness table. You have 
contributed immensely to this very important issue.
    There is our votes.
    I recognize very clearly, since I have served at the local 
level, the state legislature and now here, that the states have 
an important role, local governments have an important role, 
and the federal government has an important role.
    We often say here that the states are the experimental 
apparatus that tests ideas, and then the federal government 
should select from the best of what the states have discovered. 
We did not take the time to do that in HAVA, and I think that 
was a mistake. We also did not take the time to first set the 
standards clearly and then allow manufacturers to develop 
equipment to meet those standards. And I think that was a fatal 
flaw which has, I believe, created much of the uncertainty that 
we have.
    I agree totally with the statement someone made: Never buy 
the first model of anything. I bought the first model of one 
automobile just because it precisely fit my needs, it was a 
good manufacturer; a bad mistake, and I was franklyrelieved 
when the car eventually got totaled and I got the insurance value 
because I probably could never have sold it.
    We have to recognize that there is a lot of work to be done 
here yet, and the American public's confidence will return 
because we will build a better system.
    Finally, I want to comment that I always look at two 
aspects here. We want to assure every voter that their vote 
will be counted, be counted accurately, and that the system 
will work that way. There is a second factor we must remember, 
and that gets back to the viruses and other issues. We also 
have to assure every voter that not only will the vote be 
counted, but it will not be negated or diluted by other people 
voting fraudulently or performing fraudulent acts such as 
viruses, throwing ballot boxes away and so forth. I want to 
make sure every voter is assured of both of those--an accurate 
count of their vote and an assurance that no one else is going 
to negate it through illegal activity.
    So I am concentrating on those two not just in this 
particular issue, but in other issues such as the photo ID bill 
that we passed through the House a week ago, which I think will 
also help.
    Thank you very, very much. You have been an outstanding 
panel. I appreciate all that you have done. We do have to go 
vote, and I have a few things to read here. I ask unanimous 
consent that Members and witnesses have seven calendar days to 
submit material for the record, including additional questions 
of the witnesses, and for those statements and materials to be 
entered into the appropriate place in the record. And I assume 
if we send you written questions, you will respond to those.
    Without objection the material will be so entered.
    The Chairman. I ask unanimous consent that staff be 
authorized to make technical and conforming changes on all 
matters considered by the committee at today's hearing. Without 
objection, so ordered.
    Ms. Millender-McDonald.
    Ms. Millender-McDonald. I just wanted to concur with you. I 
have served on the local, State and Federal level, and I do 
think that we need to revisit HAVA because it was more or less 
geared for the Federal. And we appreciate all of those who have 
come today, those who serve on both the local, State and 
Federal. Thank you, Mr. Chairman.
    The Chairman. Thank you.
    Having completed our business for today and for this 
hearing, the committee is hereby adjourned.
    [Whereupon, at 12:23 p.m., the committee was adjourned.]

    [GRAPHIC] [TIFF OMITTED] T1270A.126
    
    [GRAPHIC] [TIFF OMITTED] T1270A.127
    
    [GRAPHIC] [TIFF OMITTED] T1270A.128
    
    [GRAPHIC] [TIFF OMITTED] T1270A.129
    
    [GRAPHIC] [TIFF OMITTED] T1270A.130
    
    [GRAPHIC] [TIFF OMITTED] T1270A.131
    
    [GRAPHIC] [TIFF OMITTED] T1270A.132
    
    [GRAPHIC] [TIFF OMITTED] T1270A.133
    
    [GRAPHIC] [TIFF OMITTED] T1270A.134
    
    [GRAPHIC] [TIFF OMITTED] T1270A.135
    
    [GRAPHIC] [TIFF OMITTED] T1270A.136
    
    [GRAPHIC] [TIFF OMITTED] T1270A.137
    
    [GRAPHIC] [TIFF OMITTED] T1270A.138
    
    [GRAPHIC] [TIFF OMITTED] T1270A.139
    
    [GRAPHIC] [TIFF OMITTED] T1270A.140
    
    [GRAPHIC] [TIFF OMITTED] T1270A.141
    
    [GRAPHIC] [TIFF OMITTED] T1270A.142
    
    [GRAPHIC] [TIFF OMITTED] T1270A.143
    
    [GRAPHIC] [TIFF OMITTED] T1270A.144
    
    [GRAPHIC] [TIFF OMITTED] T1270A.145
    
    [GRAPHIC] [TIFF OMITTED] T1270A.146
    
    [GRAPHIC] [TIFF OMITTED] T1270A.147
    
    [GRAPHIC] [TIFF OMITTED] T1270A.148
    
    [GRAPHIC] [TIFF OMITTED] T1270A.149
    
    [GRAPHIC] [TIFF OMITTED] T1270A.150
    
    [GRAPHIC] [TIFF OMITTED] T1270A.151
    
    [GRAPHIC] [TIFF OMITTED] T1270A.152
    
    [GRAPHIC] [TIFF OMITTED] T1270A.153
    
    [GRAPHIC] [TIFF OMITTED] T1270A.154
    
    [GRAPHIC] [TIFF OMITTED] T1270A.155
    
    [GRAPHIC] [TIFF OMITTED] T1270A.156
    
    [GRAPHIC] [TIFF OMITTED] T1270A.157
    
    [GRAPHIC] [TIFF OMITTED] T1270A.158
    
    [GRAPHIC] [TIFF OMITTED] T1270A.159
    
    [GRAPHIC] [TIFF OMITTED] T1270A.160
    
    [GRAPHIC] [TIFF OMITTED] T1270A.161
    
    [GRAPHIC] [TIFF OMITTED] T1270A.162
    
    [GRAPHIC] [TIFF OMITTED] T1270A.163
    
    [GRAPHIC] [TIFF OMITTED] T1270A.164
    
    [GRAPHIC] [TIFF OMITTED] T1270A.165
    
    [GRAPHIC] [TIFF OMITTED] T1270A.166
    
    [GRAPHIC] [TIFF OMITTED] T1270A.167
    
    [GRAPHIC] [TIFF OMITTED] T1270A.168
    
    [GRAPHIC] [TIFF OMITTED] T1270A.169
    
    [GRAPHIC] [TIFF OMITTED] T1270A.170
    
    [GRAPHIC] [TIFF OMITTED] T1270A.171
    
    [GRAPHIC] [TIFF OMITTED] T1270A.172
    
    [GRAPHIC] [TIFF OMITTED] T1270A.173
    
    [GRAPHIC] [TIFF OMITTED] T1270A.174
    
    [GRAPHIC] [TIFF OMITTED] T1270A.175
    
    [GRAPHIC] [TIFF OMITTED] T1270A.176
    
    [GRAPHIC] [TIFF OMITTED] T1270A.177
    
    [GRAPHIC] [TIFF OMITTED] T1270A.178
    
    [GRAPHIC] [TIFF OMITTED] T1270A.179
    
    [GRAPHIC] [TIFF OMITTED] T1270A.180
    
    [GRAPHIC] [TIFF OMITTED] T1270A.181
    
    [GRAPHIC] [TIFF OMITTED] T1270A.182
    
    [GRAPHIC] [TIFF OMITTED] T1270A.183
    
    [GRAPHIC] [TIFF OMITTED] T1270A.184
    
    [GRAPHIC] [TIFF OMITTED] T1270A.185
    
    [GRAPHIC] [TIFF OMITTED] T1270A.186
    
    [GRAPHIC] [TIFF OMITTED] T1270A.187
    
    [GRAPHIC] [TIFF OMITTED] T1270A.188
    
    [GRAPHIC] [TIFF OMITTED] T1270A.189
    
    [GRAPHIC] [TIFF OMITTED] T1270A.190
    
    [GRAPHIC] [TIFF OMITTED] T1270A.191
    
    [GRAPHIC] [TIFF OMITTED] T1270A.192
    
    [GRAPHIC] [TIFF OMITTED] T1270A.193
    
    [GRAPHIC] [TIFF OMITTED] T1270A.194
    
    [GRAPHIC] [TIFF OMITTED] T1270A.195
    
    [GRAPHIC] [TIFF OMITTED] T1270A.196
    
    [GRAPHIC] [TIFF OMITTED] T1270A.197
    
    [GRAPHIC] [TIFF OMITTED] T1270A.198
    
    [GRAPHIC] [TIFF OMITTED] T1270A.199
    
    [GRAPHIC] [TIFF OMITTED] T1270A.200
    
    [GRAPHIC] [TIFF OMITTED] T1270A.201
    
    [GRAPHIC] [TIFF OMITTED] T1270A.202
    
    [GRAPHIC] [TIFF OMITTED] T1270A.203
    
    [GRAPHIC] [TIFF OMITTED] T1270A.204
    
    [GRAPHIC] [TIFF OMITTED] T1270A.205
    
    [GRAPHIC] [TIFF OMITTED] T1270A.206
    
    [GRAPHIC] [TIFF OMITTED] T1270A.207
    
    [GRAPHIC] [TIFF OMITTED] T1270A.208
    
    [GRAPHIC] [TIFF OMITTED] T1270A.209
    
    [GRAPHIC] [TIFF OMITTED] T1270A.210
    
    [GRAPHIC] [TIFF OMITTED] T1270A.211
    
    [GRAPHIC] [TIFF OMITTED] T1270A.212
    
    [GRAPHIC] [TIFF OMITTED] T1270A.213
    
    [GRAPHIC] [TIFF OMITTED] T1270A.214
    
    [GRAPHIC] [TIFF OMITTED] T1270A.215
    
    [GRAPHIC] [TIFF OMITTED] T1270A.216
    
    [GRAPHIC] [TIFF OMITTED] T1270A.217
    
    [GRAPHIC] [TIFF OMITTED] T1270A.218
    
    [GRAPHIC] [TIFF OMITTED] T1270A.219
    
    [GRAPHIC] [TIFF OMITTED] T1270A.220
    
    [GRAPHIC] [TIFF OMITTED] T1270A.221
    
    [GRAPHIC] [TIFF OMITTED] T1270A.222
    
    [GRAPHIC] [TIFF OMITTED] T1270A.223
    
    [GRAPHIC] [TIFF OMITTED] T1270A.224
    
    [GRAPHIC] [TIFF OMITTED] T1270A.225
    
    [GRAPHIC] [TIFF OMITTED] T1270A.226
    
    [GRAPHIC] [TIFF OMITTED] T1270A.227
    
    [GRAPHIC] [TIFF OMITTED] T1270A.228
    
    [GRAPHIC] [TIFF OMITTED] T1270A.229
    
    [GRAPHIC] [TIFF OMITTED] T1270A.230
    
    [GRAPHIC] [TIFF OMITTED] T1270A.231
    
    [GRAPHIC] [TIFF OMITTED] T1270A.232
    
    [GRAPHIC] [TIFF OMITTED] T1270A.233
    
    [GRAPHIC] [TIFF OMITTED] T1270A.234
    
    [GRAPHIC] [TIFF OMITTED] T1270A.235
    
    [GRAPHIC] [TIFF OMITTED] T1270A.236
    
    [GRAPHIC] [TIFF OMITTED] T1270A.237
    
    [GRAPHIC] [TIFF OMITTED] T1270A.238
    
    [GRAPHIC] [TIFF OMITTED] T1270A.239
    
    [GRAPHIC] [TIFF OMITTED] T1270A.240
    
    [GRAPHIC] [TIFF OMITTED] T1270A.241
    
    [GRAPHIC] [TIFF OMITTED] T1270A.242
    
    [GRAPHIC] [TIFF OMITTED] T1270A.243
    
    [GRAPHIC] [TIFF OMITTED] T1270A.244
    
    [GRAPHIC] [TIFF OMITTED] T1270A.245
    
    [GRAPHIC] [TIFF OMITTED] T1270A.246
    
    [GRAPHIC] [TIFF OMITTED] T1270A.247
    
    [GRAPHIC] [TIFF OMITTED] T1270A.248
    
    [GRAPHIC] [TIFF OMITTED] T1270A.249
    
    [GRAPHIC] [TIFF OMITTED] T1270A.250
    
    [GRAPHIC] [TIFF OMITTED] T1270A.251
    
    [GRAPHIC] [TIFF OMITTED] T1270A.252
    
    [GRAPHIC] [TIFF OMITTED] T1270A.253
    
    [GRAPHIC] [TIFF OMITTED] T1270A.254
    
    [GRAPHIC] [TIFF OMITTED] T1270A.255
    
    [GRAPHIC] [TIFF OMITTED] T1270A.256
    
    [GRAPHIC] [TIFF OMITTED] T1270A.257
    
    [GRAPHIC] [TIFF OMITTED] T1270A.258
    
    [GRAPHIC] [TIFF OMITTED] T1270A.259
    
    [GRAPHIC] [TIFF OMITTED] T1270A.260
    
    [GRAPHIC] [TIFF OMITTED] T1270A.261
    
    [GRAPHIC] [TIFF OMITTED] T1270A.262
    
    [GRAPHIC] [TIFF OMITTED] T1270A.263
    
    [GRAPHIC] [TIFF OMITTED] T1270A.264
    
    [GRAPHIC] [TIFF OMITTED] T1270A.265
    
    [GRAPHIC] [TIFF OMITTED] T1270A.266
    
    [GRAPHIC] [TIFF OMITTED] T1270A.267
    
    [GRAPHIC] [TIFF OMITTED] T1270A.268
    
    [GRAPHIC] [TIFF OMITTED] T1270A.269
    
    [GRAPHIC] [TIFF OMITTED] T1270A.270
    
    [GRAPHIC] [TIFF OMITTED] T1270A.271
    
    [GRAPHIC] [TIFF OMITTED] T1270A.272
    
    [GRAPHIC] [TIFF OMITTED] T1270A.273
    
    [GRAPHIC] [TIFF OMITTED] T1270A.274
    
    [GRAPHIC] [TIFF OMITTED] T1270A.275
    
    [GRAPHIC] [TIFF OMITTED] T1270A.276
    
    [GRAPHIC] [TIFF OMITTED] T1270A.277
    
    [GRAPHIC] [TIFF OMITTED] T1270A.278
    
    [GRAPHIC] [TIFF OMITTED] T1270A.279
    
    [GRAPHIC] [TIFF OMITTED] T1270A.280
    
    [GRAPHIC] [TIFF OMITTED] T1270A.281
    
    [GRAPHIC] [TIFF OMITTED] T1270A.282
    
    [GRAPHIC] [TIFF OMITTED] T1270A.283
    
    [GRAPHIC] [TIFF OMITTED] T1270A.284
    
    [GRAPHIC] [TIFF OMITTED] T1270A.285
    
    [GRAPHIC] [TIFF OMITTED] T1270A.286
    
    [GRAPHIC] [TIFF OMITTED] T1270A.287
    
    [GRAPHIC] [TIFF OMITTED] T1270A.288
    
    [GRAPHIC] [TIFF OMITTED] T1270A.289
    
    [GRAPHIC] [TIFF OMITTED] T1270A.290
    
    [GRAPHIC] [TIFF OMITTED] T1270A.291
    
    [GRAPHIC] [TIFF OMITTED] T1270A.292
    
    [GRAPHIC] [TIFF OMITTED] T1270A.293
    
    [GRAPHIC] [TIFF OMITTED] T1270A.294
    
    [GRAPHIC] [TIFF OMITTED] T1270A.295
    
    [GRAPHIC] [TIFF OMITTED] T1270A.296
    
    [GRAPHIC] [TIFF OMITTED] T1270A.297
    
    [GRAPHIC] [TIFF OMITTED] T1270A.298
    
    [GRAPHIC] [TIFF OMITTED] T1270A.299
    
    [GRAPHIC] [TIFF OMITTED] T1270A.300
    
    [GRAPHIC] [TIFF OMITTED] T1270A.301
    
    [GRAPHIC] [TIFF OMITTED] T1270A.302
    
    [GRAPHIC] [TIFF OMITTED] T1270A.303
    
    [GRAPHIC] [TIFF OMITTED] T1270A.304
    
    [GRAPHIC] [TIFF OMITTED] T1270A.305
    
    [GRAPHIC] [TIFF OMITTED] T1270A.306
    
    [GRAPHIC] [TIFF OMITTED] T1270A.307
    
    [GRAPHIC] [TIFF OMITTED] T1270A.308
    
    [GRAPHIC] [TIFF OMITTED] T1270A.309
    
    [GRAPHIC] [TIFF OMITTED] T1270A.310
    
    [GRAPHIC] [TIFF OMITTED] T1270A.311
    
    [GRAPHIC] [TIFF OMITTED] T1270A.312
    
    [GRAPHIC] [TIFF OMITTED] T1270A.313
    
    [GRAPHIC] [TIFF OMITTED] T1270A.314
    
    [GRAPHIC] [TIFF OMITTED] T1270A.315
    
    [GRAPHIC] [TIFF OMITTED] T1270A.316
    
    [GRAPHIC] [TIFF OMITTED] T1270A.317
    
    [GRAPHIC] [TIFF OMITTED] T1270A.318
    
    [GRAPHIC] [TIFF OMITTED] T1270A.319
    
    [GRAPHIC] [TIFF OMITTED] T1270A.320
    
    [GRAPHIC] [TIFF OMITTED] T1270A.321
    
    [GRAPHIC] [TIFF OMITTED] T1270A.322
    
    [GRAPHIC] [TIFF OMITTED] T1270A.323
    
    [GRAPHIC] [TIFF OMITTED] T1270A.324
    
    [GRAPHIC] [TIFF OMITTED] T1270A.325
    
    [GRAPHIC] [TIFF OMITTED] T1270A.326
    
    [GRAPHIC] [TIFF OMITTED] T1270A.327
    
    [GRAPHIC] [TIFF OMITTED] T1270A.328
    
    [GRAPHIC] [TIFF OMITTED] T1270A.329
    
    [GRAPHIC] [TIFF OMITTED] T1270A.330
    
    [GRAPHIC] [TIFF OMITTED] T1270A.331
    
    [GRAPHIC] [TIFF OMITTED] T1270A.332
    
    [GRAPHIC] [TIFF OMITTED] T1270A.333
    
    [GRAPHIC] [TIFF OMITTED] T1270A.334
    
    [GRAPHIC] [TIFF OMITTED] T1270A.335
    
    [GRAPHIC] [TIFF OMITTED] T1270A.336
    
    [GRAPHIC] [TIFF OMITTED] T1270A.337
    
    [GRAPHIC] [TIFF OMITTED] T1270A.338
    
    [GRAPHIC] [TIFF OMITTED] T1270A.339
    
    [GRAPHIC] [TIFF OMITTED] T1270A.340
    
    [GRAPHIC] [TIFF OMITTED] T1270A.341
    
    [GRAPHIC] [TIFF OMITTED] T1270A.342
    
    [GRAPHIC] [TIFF OMITTED] T1270A.343
    
    [GRAPHIC] [TIFF OMITTED] T1270A.344
    
    [GRAPHIC] [TIFF OMITTED] T1270A.345
    
    [GRAPHIC] [TIFF OMITTED] T1270A.346
    
    [GRAPHIC] [TIFF OMITTED] T1270A.347
    
    [GRAPHIC] [TIFF OMITTED] T1270A.348
    
    [GRAPHIC] [TIFF OMITTED] T1270A.349
    
    [GRAPHIC] [TIFF OMITTED] T1270A.350
    
    [GRAPHIC] [TIFF OMITTED] T1270A.351
    
    [GRAPHIC] [TIFF OMITTED] T1270A.352
    
    [GRAPHIC] [TIFF OMITTED] T1270A.353
    
    [GRAPHIC] [TIFF OMITTED] T1270A.354
    
    [GRAPHIC] [TIFF OMITTED] T1270A.355
    
    [GRAPHIC] [TIFF OMITTED] T1270A.356
    
    [GRAPHIC] [TIFF OMITTED] T1270A.357
    
    [GRAPHIC] [TIFF OMITTED] T1270A.358
    
    [GRAPHIC] [TIFF OMITTED] T1270A.359
    
    [GRAPHIC] [TIFF OMITTED] T1270A.360
    
    [GRAPHIC] [TIFF OMITTED] T1270A.361
    
    [GRAPHIC] [TIFF OMITTED] T1270A.362
    
    [GRAPHIC] [TIFF OMITTED] T1270A.363
    
    [GRAPHIC] [TIFF OMITTED] T1270A.364
    
    [GRAPHIC] [TIFF OMITTED] T1270A.365
    
    [GRAPHIC] [TIFF OMITTED] T1270A.366
    
    [GRAPHIC] [TIFF OMITTED] T1270A.367
    
    [GRAPHIC] [TIFF OMITTED] T1270A.368
    
    [GRAPHIC] [TIFF OMITTED] T1270A.369
    
    [GRAPHIC] [TIFF OMITTED] T1270A.370
    
    [GRAPHIC] [TIFF OMITTED] T1270A.371
    
    [GRAPHIC] [TIFF OMITTED] T1270A.372
    
    [GRAPHIC] [TIFF OMITTED] T1270A.373
    
    [GRAPHIC] [TIFF OMITTED] T1270A.374
    
    [GRAPHIC] [TIFF OMITTED] T1270A.375
    
    [GRAPHIC] [TIFF OMITTED] T1270A.376
    
    [GRAPHIC] [TIFF OMITTED] T1270A.377
    
    [GRAPHIC] [TIFF OMITTED] T1270A.378
    
    [GRAPHIC] [TIFF OMITTED] T1270A.379
    
    [GRAPHIC] [TIFF OMITTED] T1270A.380
    
    [GRAPHIC] [TIFF OMITTED] T1270A.381
    
    [GRAPHIC] [TIFF OMITTED] T1270A.382
    
    [GRAPHIC] [TIFF OMITTED] T1270A.383
    
    [GRAPHIC] [TIFF OMITTED] T1270A.384
    
    [GRAPHIC] [TIFF OMITTED] T1270A.385
    
    [GRAPHIC] [TIFF OMITTED] T1270A.386
    
    [GRAPHIC] [TIFF OMITTED] T1270A.387
    
    [GRAPHIC] [TIFF OMITTED] T1270A.388
    
    [GRAPHIC] [TIFF OMITTED] T1270A.389
    
    [GRAPHIC] [TIFF OMITTED] T1270A.390
    
    [GRAPHIC] [TIFF OMITTED] T1270A.391
    
    [GRAPHIC] [TIFF OMITTED] T1270A.392
    
    [GRAPHIC] [TIFF OMITTED] T1270A.393
    
    [GRAPHIC] [TIFF OMITTED] T1270A.394
    
    [GRAPHIC] [TIFF OMITTED] T1270A.395
    
    [GRAPHIC] [TIFF OMITTED] T1270A.396
    
    [GRAPHIC] [TIFF OMITTED] T1270A.397
    
    [GRAPHIC] [TIFF OMITTED] T1270A.398
    
    [GRAPHIC] [TIFF OMITTED] T1270A.399
    
    [GRAPHIC] [TIFF OMITTED] T1270A.400
    
    [GRAPHIC] [TIFF OMITTED] T1270A.401
    
    [GRAPHIC] [TIFF OMITTED] T1270A.402
    
    [GRAPHIC] [TIFF OMITTED] T1270A.403
    
    [GRAPHIC] [TIFF OMITTED] T1270A.404
    
    [GRAPHIC] [TIFF OMITTED] T1270A.405
    
    [GRAPHIC] [TIFF OMITTED] T1270A.406
    
    [GRAPHIC] [TIFF OMITTED] T1270A.407
    
    [GRAPHIC] [TIFF OMITTED] T1270A.408
    
    [GRAPHIC] [TIFF OMITTED] T1270A.409
    
    [GRAPHIC] [TIFF OMITTED] T1270A.410
    
    [GRAPHIC] [TIFF OMITTED] T1270A.411
    
    [GRAPHIC] [TIFF OMITTED] T1270A.412
    
    [GRAPHIC] [TIFF OMITTED] T1270A.413
    
    [GRAPHIC] [TIFF OMITTED] T1270A.414
    
    [GRAPHIC] [TIFF OMITTED] T1270A.415
    
    [GRAPHIC] [TIFF OMITTED] T1270A.416
    
    [GRAPHIC] [TIFF OMITTED] T1270A.417
    
    [GRAPHIC] [TIFF OMITTED] T1270A.418
    
    [GRAPHIC] [TIFF OMITTED] T1270A.419
    
    [GRAPHIC] [TIFF OMITTED] T1270A.420
    
    [GRAPHIC] [TIFF OMITTED] T1270A.421
    
    [GRAPHIC] [TIFF OMITTED] T1270A.422
    
    [GRAPHIC] [TIFF OMITTED] T1270A.423
    
    [GRAPHIC] [TIFF OMITTED] T1270A.424
    
    [GRAPHIC] [TIFF OMITTED] T1270A.425
    
    [GRAPHIC] [TIFF OMITTED] T1270A.426
    
    [GRAPHIC] [TIFF OMITTED] T1270A.427
    
    [GRAPHIC] [TIFF OMITTED] T1270A.428
    
    [GRAPHIC] [TIFF OMITTED] T1270A.429
    
    [GRAPHIC] [TIFF OMITTED] T1270A.430
    
    [GRAPHIC] [TIFF OMITTED] T1270A.431
    
    [GRAPHIC] [TIFF OMITTED] T1270A.432
    
    [GRAPHIC] [TIFF OMITTED] T1270A.433
    
    [GRAPHIC] [TIFF OMITTED] T1270A.434
    
    [GRAPHIC] [TIFF OMITTED] T1270A.435
    
    [GRAPHIC] [TIFF OMITTED] T1270A.436
    
    [GRAPHIC] [TIFF OMITTED] T1270A.437
    
    [GRAPHIC] [TIFF OMITTED] T1270A.438
    
    [GRAPHIC] [TIFF OMITTED] T1270A.439
    
    [GRAPHIC] [TIFF OMITTED] T1270A.440
    
    [GRAPHIC] [TIFF OMITTED] T1270A.441
    
    [GRAPHIC] [TIFF OMITTED] T1270A.442
    
    [GRAPHIC] [TIFF OMITTED] T1270A.443
    
    [GRAPHIC] [TIFF OMITTED] T1270A.444
    
    [GRAPHIC] [TIFF OMITTED] T1270A.445
    
    [GRAPHIC] [TIFF OMITTED] T1270A.446
    
    [GRAPHIC] [TIFF OMITTED] T1270A.447
    
    [GRAPHIC] [TIFF OMITTED] T1270A.448
    
    [GRAPHIC] [TIFF OMITTED] T1270A.449
    
    [GRAPHIC] [TIFF OMITTED] T1270A.450
    
    [GRAPHIC] [TIFF OMITTED] T1270A.451
    
    [GRAPHIC] [TIFF OMITTED] T1270A.452
    
