Ellen J. Stone

Overview of Testimony before the NYC Board of Elections

November 21, 2006

My name is Ellen Stone and I have been writing programs for computers for almost .50 years.

I started working for IBM in 1960, and for the last 30+ years have specialized in Store Systems. Currently I have my own company and I do specialized computer programs for supermarkets. Store systems are similar to those used for elections: a PC-type system tailored for a specific set of markets, distributed to all the store’s markets in an area, with a central system to accumulate the data. Preventing errors is hard; I know that, because that’s what I do.

Several new computer systems have been submitted for New York State certification. We cannot depend on these computer systems to work correctly because they are too new to be bug-free. Every large program has lots of bugs. For example, Microsoft still updates Windows every two weeks to correct bugs in it.

Frequently used systems are easier to debug. Yet Windows is used by millions of people each day and with all the error reports that are submitted by users around the world and all the corrections that have been made, it is still not bug-free. An election system is used infrequently, and consequently will never be bug-free.

Moreover, election systems cannot be made accurate since the external conditions of elections are too variable and even candidates can change up to the day before an election.

Election systems will never go through the professional process of correcting the system because of certification requirements (every change requires re-certification), and the Board of Elections does not have the staff or mandate or legal permission to correct or perfect your own system.

This is the wrong technology for elections, because you cannot control your own systems in a professional and safe manner.

To point out telling example, in Sarasota County, Florida, Supervisor of Elections Kathy Dent has now totally changed her mind, and will comply with the newly passed referendum demanding a return to paper ballots in light of the embarrassingly large number of ‘undervotes’ in Sarasota County.

As the contemporary playwright Tom Stoppard, who was born in Czechoslovakia during the rise of the Nazis, said in a recent Broadway play, “It’s not the voting that’s democracy, it’s the counting.”

Here’s how computers are used in a professional environment.

IBM Store Systems are used in modern supermarkets and retail stores. This computer system operates the cash registers and what goes on behind that. This system was excellent to begin with. But when you are dealing with people’s money, you can’t make any mistakes, and everyone checks your numbers. In fact, since machines, especially in the early years, had many unanticipated bugs; most supermarket chains gave away for free the products that were incorrectly priced in the computer system. (We gave away a lot of free chickens when the system thru a bug rang up each of them for $40.95!)

This is what we do to install IBM store systems and get them running for each client after every improvement.

1. After development, where the programmers test their software code on a continuous basis, the software is turned over to Quality Assurance.
   
   
2. The code is tested using pre-determined scripts and ad hoc sequences, and is then corrected and retested repeatedly until it is determined that no errors are detected.
   
   
3. The code is then released to a single store in a single division, where it is used and audited continuously in a live environment for a period of at least a week. The location of that ‘pilot’ store is generally near to the corporate headquarters. This choice of location is critical so that in the event of an emergency (the cash register locks up, the customer is being overcharged, the customers’ credit cards are not recognized, incorrect prices are used by the computer, coupons and frequent-customer cards are not recognized or incorrectly credited, taxes are incorrectly calculated, food stamp eligibility is incorrectly assessed, etc.) the proper resources can be deployed to invoke a predetermined disaster recovery scenario. If the software test is successful in the pilot store, we go on to the next step.
   
   
4. The new code is then released to an expanded pilot group of about 5 stores, all in separate divisions (in case some divisions have different store procedures and might exercise different sections of the code.) This generally takes several weeks. If that test is successful, we go on to the next step.
   
   
5. The code is then released to 100 or so stores, and if all goes well, rolled out to the rest of the chain.

This process takes about 6 months if no modifications to the code are needed. If any errors require a code change, the process is restarted from the beginning.

One reason that this system works, is that the environment of the places using the equipment is under control of the chain, and the users of the system are trained. Where the users are not trained (with ATM’s for example) the systems undergo an even stricter testing.

Professional systems like IBM Store Systems do not go through a process of certification like voting systems because in real life, no one does that.

In real life here’s what happens.

1. Every customer checks their cash register receipt

2. Every customer who uses a credit card is going to get a statement from their credit card company, and the data that store systems sends out to the credit card company has to be correct.

3. Every store that uses IBM Store Systems audits the numbers on a continuous basis. They have whole departments and computerized and hand-used tools set up to do this. The registers had to be balanced at the end of the day. If any mistakes were made, if the customer didn’t find them, the store found them. The corporate auditing department also audited the data on a continuous basis. Other problems were found at that time.

4. The most important point is that these systems were DESIGNED TO BE AUDITED.

Here’s what is wrong with electronic voting systems.

I’m not even going to talk about paperless electronic voting systems, which cannot be independently audited at all, except to say that the fact that such voting systems have been designed and sold and purchased and used is a red flag to alert us that something is wrong with our election administration in this country.

Electronic voting systems with a voter-verified paper printout are sold with the idea that Board of Elections can recount the votes from a small percentage of machines, and if that comes out ok, then you can believe that the rest of the machines worked fine. NY state law requires the votes on paper from 3% of the machines to be counted, but does not require the paper count and machine count to be the same.

This whole concept is wrong because each voting machine can have different errors and be subject to different tampering. If I have 100 cash registers, and I balance 3 of them, that doesn’t mean that the other 97 are also balanced.

The fact that these voting systems have been sold with this false promise is a red flag that should warn us that something is wrong. We should not use electronic voting systems unless we intend to perform 100% independent recounts. These systems were designed NOT TO BE AUDITED.

Recounting can be made easy, but these machines with their little paper strips make it difficult. That is another red flag that should warn us not to use them.

If we switch to PBOS, and vote on voter-marked paper ballots, we start out with votes that are easy to handle, easy to recount, easy to guard. Election observers don’t need to be computer experts to understand what they are observing.

We urge our Board of Elections not to purchase such computerized voting equipment, and if computerized voting is used, the computers should be 100% audited like all other computer systems in professional use.