Unfortunately, the County Solicitor has prevented that ordinance from going before County Council. OpenPittsburgh.Org, the Black Political Empowerment Project (B-PEP), and several individuals are currently parties to a legal action challenging his ruling. In the meantime, County Council appears to be sitting still on the issue.
City Council can now take the matter to another level by allowing the voters of Pittsburgh to require the County to replace the old, insecure, obsolete voting machines used in the City with new, secure voting machines. As a practical matter, the County cannot operate two separate voting systems and would be forced to provide the same new voting machines throughout the County. We could then be confident that if there would ever be any question of election results, people could independently recount the votes using their own eyes without needing special devices.
City Council can create a City referendum on the matter because the Pennsylvania Election Code provides that the voters in every township, borough, town, and city can determine their means of voting. City Council has scheduled a public hearing on such a proposed referendum. The public hearing will be this Wednesday at 2pm in City Council Chambers.
So far, City Council has seemed receptive to putting the referendum on the City ballot. It would cost the City nothing to get the new voting machines. They need to see there is support for the measure. After over a decade of effort, this is the best possibility for those working on the issue to finally succeed.
- Pennsylvania counties, as near as Indiana County, vote on paper ballots
- Entire states have given up on paperless electronic voting and switched to paper, such as Maryland in 2016.
- The touch screen technology of the County’s voting machines is obsolete and is the same as used on the old Palm Pilots. &nblp: It needs to be recalibrated each election and can go out of calibration during delivery to the polls, recording a different result than the voter intended.
- The software on the machines is not password protected and could be accessed and changed.
- In mid-2007 Steven M. Pearson of ES&S sent a letter to the Pennsylvania Secretary of the Commonwealth indicating that a back door in the iVotronic firmware was expected to be closed “later this year.” Ten years later our machines are still running exactly the same software. Every year of those ten years has seen more-sophisticated attacks on vulnerabilities like this one. If the vendor of these machines isn’t fixing admitted vulnerabilities, Allegheny Council should act to retire them.
- The Secretary of State of Ohio in 2007 hired a panel of computer security experts, who uncovered serious security flaws in the iVotronic software. Ohio decided those flaws were severe enough that it was necessary to add a paper trail.
- Machines (current and new) should be evaluated by credentialed computer security experts. The current machines never were.
- People all over the country - and around the world - understand that having a ballot cast on paper, regardless how it is counted initially, means that it can be recounted by hand in contested races, and that any amount of hacking of the computer systems doing the counting cannot change the final tally which is always available by counting the paper.
- The County Elections Division already prints enough paper ballots for more than the number of voters attending any election. They are held as "emergency ballots" in case the machines would fail and are not otherwise used. Afterwards they are then sent for recycling, effectively wasting their cost of printing when they could actually be used in an appropriate voting system without costing the County any more than they already spend to print them.
More talking points from Preamble to the proposed Allegheny County Ordinance
Whereas, Allegheny County voters have the right to know exactly how votes are processed, to have transparent elections, and to have computer scientists and cybersecurity experts analyze election software source code for malicious code which could manipulate elections; and
Whereas, the use of computer software that is proprietary can prevent concerned citizens who may have adequate expertise from checking the inner workings of the electronic vote counting hardware, denying them an ability to audit and verify the accuracy of the system; and
Whereas, Allegheny County's current voting system uses proprietary software which is not available for an independent security audit by outside computer and cybersecurity experts, leaving its public officials and citizens to assess the security of the system by relying upon presentations from the vendor’s representatives who have a vested interest in portraying the system as secure; and
Whereas, the Commonwealth of Pennsylvania has the authority to formally audit the proprietary source code of election systems which are approved and certified for use within the state, but after a decade of such systems being used by Pennsylvania’s counties, it has yet to do so; and
Whereas, the consensus of cybersecurity experts is that it is possible to hack into an electronic voting system and alter the vote, substantially changing vote totals in subtle ways that are difficult to detect; and
Whereas, studies and reports have demonstrated that these systems suffer from a number of security problems including a susceptibility to viruses and deliberately inserted back-doors; and
Whereas, the iVotronic voting machines used by Allegheny County have an infrared (IR) port that can be accessed by various devices that have an IR interface and are capable of connecting to transmit data and software; and
Whereas, in 2007, ES&S, the vendor that supplied Allegheny County’s current voting system, identified a security hole in its software which enables access into the iVotronic system software without a password and said it intended to fix the problem within a year, which now, a decade later, has yet to be corrected; and
Whereas, a majority of Pennsylvania counties use touch screen or push-button voting systems (DRE’s) such as the ES&S iVotronic used in Allegheny County, which systems do not provide voter-verifiable paper ballots or other independent record that allows the voter to verify a correctly cast vote, nor do they provide for meaningful audits or recounts to take place, and they lack adequate accessibility features for individuals with motor disabilities, which is particularly problematic for Pennsylvania's aging population; and
Whereas, analysis of data reported from each of the sixty-seven counties across the Commonwealth of Pennsylvania is inconsistent with regard to the number of registered voters, taken from three sources for the same time point – county website reports, the PA Department of State website, and its SURE database – with each of these sources reporting different values for what should be the exact same value at the same point in time; and
Whereas, the process used by Allegheny County to verify the integrity of the voting system operating software, while being the only county in the state to even perform such test, nonetheless has noteworthy limitations – the procedure prevents any machines that are tested from being used in the upcoming election; being constrained by the number of machines that can be taken out of service, the County checks a minimal, weakly random sample of machines, providing a cursory assurance that the code in the entire system has not been changed; and the method used in the verification to detect whether the software has been altered is the SHA-1 process, considered obsolete by Microsoft, Google, Apple, and Mozilla; and
Whereas, the hardware used by the County’s firmware integrity verification relies upon Windows XP, which is no longer supported by Microsoft; the tabulation system relies on obsolete Windows Software, and the consultant doing the verification has had to resort to using an old laptop in order to conduct it; and
Whereas, the separate parallel testing process which is used to test the system on election day as a verification of the county-wide system’s integrity has characteristics which could enable an invasive software alteration to identify that it is being tested and therefore not perform its manipulation during the test, a feature well demonstrated by Volkswagen as evading detection for a number of years; and
Whereas, the County’s reliance upon its voting system not being connected to the Internet as rendering it completely safe from contamination or breach can provide a false sense of security as shown by Stuxnet, a malicious computer worm used to sabotage the Iranian nuclear program even though the affected Iranian computer control systems were not connected to the Internet or other network; and
Whereas, aging voting technology is vulnerable to manipulation and decreased integrity of the election system; the voting system equipment and software now being used by Allegheny County is thirteen years old; and other Pennsylvania Counties have reported increasing breakdowns and problems, among which is that the aging touch screens are increasingly prone to calibration errors even after having been checked, re-calibrated, and delivered to the polling place – with the result of potentially casting a vote for a candidate other than the one intended by the voter and relying solely upon a voter recognizing the error and reporting it, which may not be noticed by the first voter for whom the switch has occurred; and
Whereas, 310 registered voters in Allegheny County filed notarized affidavits with the Division of Elections on Monday, November 28, 2016 – based on Pennsylvania Election Code, Title 25 P.S. Elections & Electoral Districts Chapter 14. Election Code Article XVII. Recounts and Contests (a) Recounts – in order to force a recount in their respective election districts and precincts because they mistrusted the voting machines; and
Whereas, available proven technology in the form of a voter-verifiable paper ballot for accurate post-election audits would allow voters to be sure their vote was properly entered; and
Whereas, the Commission on Federal Election Reform issued the following recommendation regarding voting machines: “Congress should pass a law requiring that all voting machines be equipped with a voter-verifiable paper audit trail and, consistent with HAVA, be fully accessible to voters with disabilities. This is especially important for direct recording electronic (DRE) machines for four reasons: (a) to increase citizens’ confidence that their vote will be counted accurately, (b) to allow for a recount, (c) to provide a backup in cases of loss of votes due to computer malfunction, and (d) to test - through a random selection of machines - whether the paper result is the same as the electronic result”; and
Whereas, the Report of the Commission on Federal Election Reform, issued in September of 2005, notes that as of August 2005, 25 states had already mandated voter-verifiable paper ballots for each voter before they confirm their selections, and another 14 had introduced legislation to do so; and
Whereas, in 2005, Council Member William Russell Robinson introduced Bill No. 2246-05, a motion urging the Chief Executive to select voting machines in accordance with the requirements of HAVA and which would allow for the creation of a voter-verifiable paper record for each voter, and supporting HB 2000 and SB 977; this bill passed on 12/6/2005 by a voice vote; and
Whereas, in 2006, Council President Rich Fitzgerald introduced Bill No. 2432-06, a resolution which contains the same language found in Mr. Robinson’s Bill No. 2246-05 but added that ballots should be randomly audited after each election to verify machine accuracy and performance; this bill passed 11-0 on 2/21/2006, and the Chief Executive signed this bill on 3/2/2006; and
Whereas, also in 2006, Council Member John DeFazio introduced Bill No. 2813-06, a resolution that also mirrors the language found in Mr. Robinson’s Bill No. 2246-05; this bill passed 15‑0 on 10/10/2006, and was signed by the Chief Executive on October 17; and
Whereas, the capital budget amendment outlined in Bill No. 2463-06, introduced by Council Member Gastgeb, which was enacted 3/27/2006, to transfer bond proceed appropriations from the HAVA Compliant Voting Machines project and established a new project entitled HAVA Compliant Voting Machines Paper Verification System Upgrade, with an appropriation in the amount of $3,000,000; Mr. Gastgeb’s amendment was intended to utilize county bond funds to establish a new project to provide for a system upgrade to the HAVA Voting Machines project to allow for paper ballots that leave an audit trail for voting verification, the $3 million to remain in the capital budget until the money is spent or transferred and which remains unspent; and
Whereas, on 3/6/2007, Council Member DeFazio introduced Bill No. 3083-07, a resolution urging Congress to approve HR 811 to amend HAVA, to require the creation of voter-verifiable paper records for each voter using an electronic voting machine, which passed 12-0 on 3/6/2007, and was signed by the Chief Executive, 3/15/2007; and
Whereas, in 2006 and 2007, County Council passed, and the Chief Executive signed, Bills No. 2432-06 and 2813-06 which urged the selection of voting machines with a voter-verifiable paper record for each voter, the former bill adding that it be randomly audited after each election to verify machine accuracy and performance, and Bill No. 3083-07 which urged Congress to require the creation of voter-verifiable paper records for each voter using an electronic voting machine; and
Whereas, having allocated the funds that would be necessary for retrofitting the County's system with such a capability, Allegheny County Council has also repeatedly urged the Commonwealth of Pennsylvania to adopt legislation that would require a voter-verifiable paper record for all electronic voting machines; and
Whereas, voter-verifiable paper ballots are more cost-effective – according to a study conducted in Miami-Dade County, Florida, they could provide an estimated savings of $13 million over five years, in addition to the potential for using local labor to produce the paper ballots; and
Whereas, cybersecurity is a highly specialized field about which even most computer scientists are not well versed and which learned experts in other fields frequently underestimate, failing to appreciate its concerns with disastrous results, as numerous instances of major breaches have demonstrated in recent years; and
Whereas, neither the Commonwealth of Pennsylvania’s certification of the voting machines approved for use within the state from 2005 to date, nor the selection of Allegheny County’s current voting system in 2006, has occurred with qualified cybersecurity experts among those making the decisions, and of those now insisting, asserting, and assuring the public that votes in Allegheny County are absolutely secure from any possible tampering or interference – remonstrating with all who are concerned and expostulating that there’s nothing about which anybody should be concerned – none has been qualified as a certified cybersecurity expert; and
Whereas, to date there has not been a formal security assessment conducted with the inclusion of cybersecurity experts to evaluate Allegheny County's voting system equipment and software or of the policies, practices, processes and procedures followed by the County Board of Elections in conducting and administering elections; and
Whereas, cybersecurity is not a static field but rather it is a highly dynamic arena wherein the landscape of threats is constantly changing, making it ever more challenging to protect any information system from being attacked and breached and rendering yesterday’s and today’s safe practices increasingly null and void as new avenues for entry are found that may be used by vandals determined to cause havoc or criminals out to steal data or, worse, oppositional state actors seeking to tip the outcome in the selection of our country’s leaders; and
Whereas, Allegheny County is home to Carnegie Mellon University with its Software Engineering Institute that has the world’s first CERT (originally standing for Computer Emergency Response Team) which is still considered the best and most respected cybersecurity agency in the world and, in part by its presence, the County has also gained status in the eyes of the majority of Pennsylvania’s 67 counties which rely either partly or in whole upon Allegheny County as setting the standard for voting system security considerations when making their own voting system selection and election security decisions; and
Whereas, in a representative democracy it is essential that the public have the greatest possible confidence and trust that their election process is open, above board, and not subject to undue influence, manipulation, vote tampering, or errors, and it is especially important for maintaining a commitment among both the candidates and voters on the losing side of elections that they proceed within the democratic process, in order that we avoid disgruntled individuals and masses of dissenting crowds who disregard the rule of law, who may seek to take matters into their own hands as vigilantees, or, worse, who could resort to armed insurrection, as we have seen happen in other countries with younger, less mature democracies; and
Whereas, there being a greater polarization across the population that is exacerbated by social media and Internet technologies which coalesce like-minded individuals in isolation from differing analyses and points of view, and there being increasingly entrenched partisanship among their elected representatives with a decrease in reasoned discourse as more and more money floods into campaigns bankrolled by those who would further their own interests to the detriment of the public good, these undermining the effectiveness of our mode of governance and, with that, the confidence and trust of the citizenry; and
Whereas, the presidential elections of 2000 and 2016 have pointedly illustrated for broad public consumption that there have been and remain major issues of concern about the integrity of some of the voting operations within our country – the former election having led to federal legislation that required replacement of voting systems across the nation and the latter election having raised public consciousness that not all of those that were installed provide a voter-verifiable, auditable, and re-countable means capable of confirming that the vote of each voter has been duly identified and tabulated into the vote total as that voter intended – in specific, the most recent experience in Pennsylvania has exposed the general public to the fact that the electronic recording of votes without a paper record makes it impossible to either audit or recount the ballots that were actually cast during an election; and
Whereas, it devolves to the states and their individual counties to take whatever measures they can to instill confidence and trust in our electoral democracy by at all times maintaining the integrity and credibility of the entire voting process – hardware, software, policies, practices, processes, and procedures – and ensuring it meets the highest possible standards; that it is fully assessed for equitable access and usability by all qualifiable voters; that it is unbiased and doesn’t influence a voter’s choices and that it passes the most rigorous physical, operating, and cybersecurity scrutiny; and
Whereas, the Pennsylvania Constitution and Pennsylvania Election Code both provide for the ability of the electorate of any Pennsylvania county to approve through referendum the acquisition of a new voting system, and, under Allegheny County’s Home Rule Charter provisions, it is possible for its registered voters to place an ordinance before County Council using Agenda Initiative and also for them to enact ordinances by referendum; now