Brunner declares Ohio's voting systems vulnerable

All counties should use paper ballots counted at a central location, secretary of state says


Friday,  December 14, 2007 3:45 PM

By Mark Niquette



The report


    * Evaluation & Validation of Election-Related Equipment, Standards & Testing report (pdf)


All of the voting systems used in Ohio have “critical security failures” that make them vulnerable to tampering and should be replaced with paper ballots counted at a central location, Secretary of State Jennifer Brunner concluded after a top-to-bottom review of the systems.


The findings, released this morning, apply both to the electronic touch-screen machines used in 57 of Ohio’s 88 counties as well as the systems using paper ballots counted in precincts.


The $1.9 million study found risks ranging from minor to severe and concluded that while higher levels of sophistication were needed in some cases to compromise vote results, “fairly simple techniques” sometimes could be used.


For example, it’s possible to use a magnet and a personal digital assistant to tamper with some machines, Brunner said.


“The results underscore the need for a fundamental change in the structure of Ohio’s election system to ensure ballot and voting system security while still making voting convenient and accessible to all Ohio voters,” Brunner said.


Brunner made a series of recommendations to Gov. Ted Strickland and the legislature for improving the security of the voting systems but stopped short of decertifying any machines.


She did, however, recommend that touch-screen and optical-scan systems that tabulate votes at the precinct level should be eliminated, and that the state should move away from touch-screens to optical-scan systems.


Brunner also proposes changing the current system of having voters go to precincts and instead create centrally located voting centers containing multiple precincts. She also wants to extend voting to up to 15 days before an election.


She said she’d like to have that done by next fall’s election.


But Brunner also acknowledges that funding sources are limited and that although security experts may consider her recommendations less than optimum, they would improve the security of the systems as currently configured.


Brunner said she would like to see a bipartisan panel created including representatives of Gov. Ted Strickland, legislative leaders, her office, and county election officials to craft legislation she would like to have passed by mid-April.


House Speaker Jon Husted, R-Kettering, attended a press conference Brunner held this morning as a way to show there will be a bipartisan approach to reviewing and taking any action on the study.


But Husted said he has not had time to review the findings yet and wants to consult with county election officials before reaching any conclusions.


Neither Brunner nor Husted would put a price tag on the proposed changes, but Brunner said the state could find the funding if it considers the changes a priority. Husted also said the $1 billion rainy day fund could be an option.


It may be too late to make major changes immediately with the March 4 primaries looming, but Brunner said she would like to have counties with touch-screen systems offer a paper ballot to voters who want one in the primary.


She made it clear she thinks state voting needs to be overhauled before the eyes of the world once again are expected to be on Ohio for the fall presidential election.


“In an era of computer-based voting systems, voters have a right to expect that their voting system is at least as secure as the systems they use for banking and communication,” she said.


Brunner made a separate recommendation for Cuyahoga County, the state’s largest, saying funding is available to replace the touch-screens used there with optical-scan units for the March primary at a cost of up to $2.5 million.


Her office has administrative oversight over the county’s elections, but Brunner said she would prefer to let the board of election members she appointed there make the decision.


Cuyahoga and 46 other counties including Fairfield and Licking use touch-screens made by Premier Election Solutions, formerly Diebold Election Systems.


Premier issued a statement saying many of the risks identified in Brunner’s report had already been identified, and that the company’s new systems now being certified address those issues.


“We should also not lose sight of the very real improvements in voting accuracy that have been achieved with the deployment of modern touch screen systems, or that, in every jurisdiction where touch-screen voting has been implemented, voters have overwhelmingly expressed their satisfaction with their voting experience,” the company said.


Brunner ordered the thorough review of all voting systems used in Ohio this fall to address any voter concerns about the security and reliability of the machines.


Ohio uses systems from three vendors: Premier Election Solutions; Election Systems and Software; and Hart InterCivic.


The review focused both on the “hackability” of the units, as well as what security procedures are in place to restrict unauthorized access to them. A team of 12 county election officials also reviewed the findings.


The researchers didn’t address the issue of probability of hacking the systems, leaving that to the determination of state and local officials, Brunner said.


But the researchers concluded that because the “lack of technical measures in voting system design,” the security of the systems “is provided purely by the integrity and honesty of election officials,” the report said.


“It’s a testament to our state’s boards of elections officials that elections on the new (federally) mandated voting systems have gone as smoothly as they have in light of these findings,” Brunner said.


Researchers who studied how the voting systems were set up at polling places for elections found risks such as the use of materials like memory storage and printer paper that had not been certified by the voting system manufacturers; a lack of standardized equipment testing; and that revisions to voting system software for all systems and counties were not documented or tracked, the review said.


The recommendations:


    * Eliminating points of entry creating unnecessary voting system risk by moving to central counting of ballots at boards of elections or other locations.

    * Eliminating use of direct recording electronic and precinct-based optical scan voting machines that tabulate votes at polling locations.

    * Utilizing the AutoMark voting machine for voters with disabilities. This machine uses a touch-screen that produces a paper ballot that can be scanned.

    * Requiring all ballots be optical scan ballots for central tabulation and effective voter verification.

    * Maintaining “no fault” absentee voting while establishing early (15 days prior to the election) and Election Day Vote Centers (of the size of 5 to 10 precincts), eliminating voting at individual precincts or polling places of less than five precincts.

    * Requiring all special elections (issues only) held in August 2008 to be voted by mail (no in-person voting, except at the board of elections, for issue-only elections held in August 2008).


Ohio has spent more than $100 million in federal Help America Vote Act funds since 2004 to replace all of its punch cards and other, older voting systems in the wake of the controversy over the 2000 presidential election in Florida.


But some activists had continued to argue that the machines can be hacked or aren't reliable, and reports from tests in other states have raised concerns about the vulnerabilities of certain voting systems.


California and other states also have problems with some of the same voting systems used in Ohio but have caused controversy by moving immediately to decertify and replace those units.


The Ohio Controlling Board waived competitive bidding in September to spend federal grant money for Columbus-based MicroSolved Inc., SysTest Labs of Denver and a consortium of academic subcontractors to do the testing. Battelle in Columbus managed the project.


©2008, The Columbus Dispatch