good morning ladies and gentlemen committee and house administration will come to order first i would like to advise and request all members of our audience here today that all started our phones pagers and other electronic equipment must be silen to prevent interruption of our business so i don't appreciate if you turn these devices off as i have the committee is meeting today for a hearing on electronic voting machines and related issues the election that will occur in just a few weeks will be the first general federal election conducted since the help america vote act of two thousand and two better known as hava was fully implemented that act passed by this congress in response to the voting system weaknesses s'posed during the two thousand recount in florida set new standards for voting systems that were meant to make our elections more accurate and accessible three billion dollars were appropriated by the congress pursuant to however with most of these monies being dedicated to new equipment purchases by jurisdictions localities counties cities townships et want to improve their voting systems as a result many jurisdictions are using new equipment for the first time this year it's no surprise that there have been a few problems though however did not require the adoption of any particular kind of technology many jurisdictions person purchased electronic voting systems because they felt the systems were best able to meet the requirements of not surprisingly some jurisdictions using  equipment for the first time have encountered some difficulties just two weeks ago in nearby montgomery county maryland polls were not able to open on time because poll workers were sent to their posts without the cards necessary to start up the electronic machines in the wake of this episode a column appeared in the washington post under the headline if paper ballots restore trust in elections let's switch the column noted people trust paper ballots because the real you can hold them in your hand and count them again if you need to indeed before it had electronic monitoring system voting systems montgomery county a punch card system need to be reminded of the problems we had with that system direct your attention to this to the screen above the audience can look at that when we look at this one  is a reminder of what we saw in the two thousand election in florida images of people with paper ballots this one is a group of people staring at paper punch cards trying to figure out if they constitute a vote and if so for whom if you look at the second slide you see how closely these ballots were being examined by a group in the third slideshows extreme putting things under the magnifying glass you can see this man has got paper now i'm not showing these to condemn paper i'm just pointing out that punch cards were paper thick paper at that and we got into problems with that simply saying let's use paper as some people are saying does not mean all the problems go away we have to consider all the different aspects of these pictures as you can tell we're taking in florida during the two thousand recount and that will go down in history i'm sure because of the recount and the ramifications these images do not expect exactly inspire trust and confidence either in the in the punch card system or in the voting systems in general as a way to look at this problem it's worthwhile remembering the famous words of h l mencken who once said for every complex problem there is an answer that is clear simple and wrong we would like to have answers that are clear and simple but we certainly do not want wrong answers and so we are going to proceed with this very thoroughly delivered deliberately to try to make sure that we have good answers that are right unfortunately the some problems some jurisdictions have experienced with their new systems have caused some to suggest that we should revert to a reliance on paper the so called paper trail or paper tape we know from painful and bitter experience that paper systems also can fail to deliver results and are susceptible to manipulation to ignore this reality and assert that paper somehow ensures integrity or a correct result is simplistic and wrong in fact no voting system by itself can guarantee election integrity the best system on earth will fail if not properly maintained deployed and operated and that's the key point that we have to remember and i'm not even though i'm a physicist and i've used computers since one nine hundred fifty seven i'm not saying by virtue of this these comments so far papers battle electronics of course is good i've used it for many years i know that can fail to it's not programmed properly or not operated properly i think i believe the important point is design the best system you can but make sure you have a lot of debility built and in some way whether it's paper or some other electronic device our hearing today will examine a range of issues related to electronic voting machines we will hear about their problems but also about their benefits we'll also hear about the experience in one jurisdiction that tried to address the security concerns of a paperless system by requiring the machine to generate a paper trail this hearing is being held to educate the members and the public about these complicated issues i hope when the hearing is over we will have a better understanding of the problems and benefits of these new technologies i also hope that look for solutions to these complicated problems we resist the temptation to settle on answers that are clear simple and wrong now i'd like to ask unanimous consent that the gentleman from new jersey new jersey percent of rush holt who is the author of a bill dealing very much with one aspect of this be allowed to join us and does today and that he may be permitted to ask questions of the witnesses and interest a minute to the director without objection so ordered welcome from the opening remark she may have thank you mr chairman and good morning to you and all of the witnesses and gets here this morning i would like to thank you mr chairman for calling this very important hearing on electronic voting machines i am sure that you have heard from your constituents and constituents around the country as i have heard that folks aware you about these voting machine apparatuses and they are just not sure whether or not they are working let me also thank you m welcoming congressman rush holt to sit on the panel this morning it was just six years ago that the two thousand presidential election brought to light many problems with the elections process in our country we encountered a wide range of frustrations and election administration with the i'd like should administration some of the most infamous problems involved punch cards with all of the hanging chads that the chairman has just shown you others involved voters who were turned away from the polls without the opportunity to cast a vote in response this committee worked diligently and passed the help america vote act which is hava trip the country of outdated voting to quit men enter ensure that no eligible voter is turned away from the polls without casting a vote despite the passage of hava however many problems still remain as we witnessed during the two thousand and four election and in several primaries this year today i hope to hear about methods of addressing these issues even if we may not be able to implement suggestive recommendations before the november election i also hope that this oversight hearing will serve as a forum for the american people to gain confidence in direct recording electronic voting system machines after the two thousand election deore as we call them machines were viewed as the answer to hanging chads and century old lever machines deore machines also allowed individuals with disabilities to vote in private and without assistance for the first time they have also been supported by a number of civil rights organizations given the ease with with which they are able to be programmed to display ballots in foreign languages however as we are aware many concerns have been raised about the integrity and the reliability of these story machines in fact at times it may be seen that these machines have raised many more questions than answers for example some have called for a voter verified paper audit trail for deore machines some states already required that function for deore machines but even this similarly simple math that raises numerous concerns for example when mechanism serves as the official what mechanism serves as the official record in a recount that's a question that has been raised often what happens when the printer jams with the voter which were proper with the votes which were properly recorded by the r e b thrown out if they are not similarly recorded on the paper those are the questions that have been raised often i am also interested in hearing from our witnesses expression all of the local election the fish shields regarding their views about the wisdom of imposing a federal mandate which would specify which type of election equipment should be used these decisions have mostly been left up to the state and local officials throughout our country's history and i would like to know what the impact of a federal mandate and a standard in this area would be what president it would set for future election administration mandates on the states by the federal government and how these mandates would be funded in addition to discuss to get stablished concerns about the arima chains i hope the witnesses invited today will address the security of all voting equipment only one third of americans will cast ballots on deore machines and although that number is growing it's still means that two thirds of our voters w be casting ballots using a methodology are these machines secure are they reliable are they subject to a suitable level of scrutiny i am concerned that all of the media attention to voting security will inadvertently discourage voters from going to the polls resulting in voter suppression as we witnessed a few weeks ago in maryland voting machine reliabilities security and accuracy with not the inherent cause of mayhem mayhem the lack of poll worker training another human factors of election administration created problems infusions at the polls for both voters and poll workers if we do not adequately address all of these issues voters may feel as if their votes will not be counted and decide not to participate on election day this is one reason why i offered an amendment to double the funding for the college poll worker training program this programming current just college age students to service poll workers and to become more involved with the election administer process the electoral process is not perfect mr chairman improvements to the electoral process itself still need to be made fortunately they help america vote act of two thousand and two is a solid foundation upon which we can institute further electoral improvements hava made it easier for voters to cast a ballot and harder for people to knowingly commit crime and fraud which is why we need to appropriate the remaining eight hundred million dollars balance which is authorized in title to a father to follow up on the states and give him a chance to work as i have stated in the past it is guaranteed that your vote will be lost if you don't cast a ballot i would encourage every eligible voter to cast a ballot no matter how harsh the rhetoric about the november elections and no matter how that ballot excuse cast by d b e machines absentee ballots provisional ballots whatever americans need to get out and vote in november with the confidence that their vote will be counted correctly exercise in this precious right is more important than the outcome of the elections mr chairman i hope we can convene additional hearings in the future to examine any shortcomings in election administration and any impediments that voters experience  exercising their constitutional rights i look forward to working with the chairman and other members to continue to improve the voting process and i will continue to seek full funding of the election assistance commission titles have grants to ensure that the ac can continue is crucial work to improving the electoral process even if one voter is disenfranchised that is one voter too many thank you mr chairman thank the ranking member for comments and i especially want to reinforce something your said voting in this nation has traditionally been controlled and operated by the law you know cities townships counties and by the states the only reason the federal government or this is because of the problems with the federal election of a president in two thousand and we continue to have great respect for the localities and the states which of the responsibility for implementation we are simply trying to stand stover standards only for the federal gov actions as well as can do you have an opening statement thank you mr chairman i am glad that we are having this hearing today and delighted that we're joined by our colleague mr holt the author of h r five five zero i am inclined to think that mr holt approach is the right one but i have declined to author of this bill until this hearing because i wanted to try and keep an open mind on the subject and listen to the witnesses without being a co author of the bill but coming from silicon valley you can imagine that i have had  considerable input from people who are quite skilled and i guess the question that needs to be answered is can this election be hacked there are many issues i'm sure we'll get into them today but the integrity of the election process is absolutely essential to the sustenance of a vigorous democracy elections to count as we know and the direction that our country is going in will be decided by elections and if we if we can't know for certainty that that process is not corrupted then it really goes to the core of the spirit of our nation and in our future as a democracy so i realize we're not in a mark up mode here today we're here to get information i'm going to listen very carefully to all the witnesses but i'm hopeful that we could take quick action because this  my own state of california has already moved in the direction that mr holder is suggesting with a verifiable paper audit trail we need to be able to let the voters of america know that this the before we are called to say thank you very much thank you for a statement and mr whole statement will be entered into the record as we mentioned earlier and setting up the panel for this hearing i was determined to try to get the bro representation possible i would have had to have twenty seven witnesses to totally accomplish that but the fact that we have tried very hard as indicated by the large number of witnesses we do have i'm very pleased with the quality of the witnesses who agreed to appear and we now turn to dr felton for his testimony he is a professor in the department of computer science at princeton university which also happens to be mr holt's district he recently completed a study of an electronic voting system will give us a report on his findings and i also understand you have a demonstration for us doctor for you maybe  better thank you from a security standpoint what distinguishes computer voting systems from traditional systems is not that computers are easier to compromise but that the consequences of compromise can be so much more severe tampering with an old fashioned ballot box can affect a few hundred votes at most but injecting a virus into a single computerized voting machine can potentially affect an entire election two weeks ago my colleagues halderman and i released a detailed security analysis of this machine the default actually vote ts which is used in maryland georgia and elsewhere my written testimony summarizes the findings of our study one main finding is that the machines are susceptible to computer viruses that spread from machine to machine and silently transfer votes from one candidate to another such a virus requires moderate computer programming skills to construct launching it requires access to a single voting machine for as little as one minute i will now demonstrate this using a virus we constructed in our laboratory we've set up here a simulated election for president between george washington and benedict arnold it's election day morning and we just opened the polls no votes have been cast yet i'll start by casting the first vote when i checked in at the polling place at the front desk the poll workers gave me this voter card which i now insert into the machine i press the start button and i choose to cast my vote for george washington the machine asks me to confirm my choice and i confirm my choice and cast my ballot and votes again for george washington the correct vote counted this election obviously is george washington three benedict arnold zero now it's the close of election day a poll worker inserts a special supervisor card into the machine and tells the machine to end the election and tally the votes this record of my vote was invisible to me i have i had no way of verifying whether it was recorded correctly or whether it was changed after it was recorded in this machine the records were modified by or virus this paper tape printed out by the machine reports the elections results and it shows george washington with one vote and benedict arnold with t machine and outside the machine is consistent with this fraudulent result our technical report referenced in my written testimony goes into considerable detail about this problem and explains why existing election procedures are not sufficient to prevent it one lesson is that security depends on getting the technical details right too often the designers of this machine fail to get the details right a good example is the access door here on the side of the machine it protects the removable memory card that stores the votes so the door should be locked securely and access to the keys should be strictly limited but in fact tens of thousands of accu vote machines can all be opened with the very same key and this very same key is used widely in office furniture juke boxes and even hotel mini bar keys and even hotel mini bars it's easily purchased on the internet this one i bought online from a jukebox supply shop and it does open the machine the implications of our study go beyond just this machine and reveal broader systemic problems more worrisome than any specific vulnerability is that this system despite its many problems was certified purchased and deployed by many states and counties and has been used in portland elections which we can do more to improve the security of our evolving i detail many recommendations in my study and written testimony but one important safeguard is a voter verified paper audit trail a well designed paper trail can improve security and enhanced voter confidence without compromising accessibility certainly paper records have their drawbacks but they have different failure modes than electronic records do and the combination of electronic and paper records together can be more robust against fraud than either one would be alone getting the details of voting right is difficult especially in today's high tech polling place but failure is not an option the stakes are too high and the risk of malfunction or fraud too great to make our current course tenable in the long run election experts accessibility experts and computer security experts all have a role to play in improving our voting system if we work together we can solve this problem and give the american people the voting system they deserve thank you for your time and attention thank you very much for your testimony our second witness is gary smith mr smith is the election computer basically it's a type of a computer we have displayed here mr smith uses a de bolt system that was the subject of the princeton study mr smith also participated in the recount of  primary that was conducted on idea or a system with a paper audit trail mr smith you are recognized as well as as much money as gary smith i reside in  microphone on that better yes we have an overflow room and people are very anxious to hear you all right well my name is gary smith as you match and then i am the election director for forsyth county georgia county just north of atlanta it's quite a fast growing county we have about eighty thousand registered voters and we are one of the top fastest growing counties the united states so we have a lot of issues that we have to deal with all the time one of the things i think that's important maybe is to look at the those of us as election directors how we come about i'm actually appointed through a selection committee that comes about we're a grand jury is brought forth they pick a panel of people who are at the background to be able to do this it's then sent up to the chief superior court judge and then i am selected from that i was selected from that process i'm in my second term as the director of elections it's a term of four years and it is a nonpartisan position prior to coming into this position i spent most of my time working in the private sector i retired i was running  various companies and i have worked most of my life in industrial automation so i have a technical background i have an undergraduate degree in electrical engineering and i'm also a certified election registration ministry or from a program that ministered by all burned university as the director of elections one of the things that i've been privileged to do is to be able to set on a task force several of them one has been from the georgia task force which allows me to be able to participate and look at new processes and equipment that we applied to elections in our county in our state in addition of that i served on a national taskforce for election reform for two thousand and four where we looked at all the processes across the country with regards to elections in addition i think you just mentioned is i did lead the manual recount for the cuyahoga county the pat so i have some practical experience with that and i was happy to be able to do that i did that or spent a weekend as a matter of fact we have implemented the d r he's the one that you're looking at right here which is the in fact my my county one hundred fifty eight counties in georgia implemented this during the general election of two thousand and two we have held from what i heard was the last count something like twenty five hundred elections in our state in addition to that i've held elections on special elections primaries and general elections runoff and just about any kind of election election as well so again we have a lot of experience with and one of the things that i've it has been talked about a lot and i think we have to deal with is you know how do you look at these the security and the integrity of this kind of equipment it starts with obviously with the vendor who builds equal amount goes through the end dependent testing laboratories that then look at to make sure that what we are receiving has the technical wherewithal to be able to provide us with a piece of equipment that really meets what our needs are thirdly we have in our state which i'm very proud to talk about is the center for election systems it's a program administered by councils state university and dr brant williams who's a well known authority in elections we do all of our creation or a ballot cards and that sort of thing through this group and so it's a it's a nother level of testing that we have that goes on lastly it's up to those of us who are election directors to hold these elections so i'm tasked with a lot of the things that mr felton is talked about which is maintain the security and integrity of the process that goes on in elections i guess word where the rubber meets the road as much as anything so those are that's our job i'm not going to go through all of the details with regards to certification because it's certainly going to take a lot more than a few amounts that i've got to talk about it but it is in my paper and i hope that you will look at it i think where we pick it up is where we pick up the memory cards is this developments mention that come to us from the center for election  systems the process of making sure that they come to us under the chain of custody manner so that we know that there is at least more than one person that has access to you know what we're talking about is they're looking at we go through a process called let logic and accuracy testing this is when the process that he has talked about goes through the fur we are taking the memory cards we are marrying and essentially to the voting machine and then we're taking them through the testing process at which time then we lock the machines up and we pass them on to the next level which really is the the election poll worker himself and what i'd like to do is to show you some of the chain of custody forms and i think they're in front of you too if they're not i'm going to show you the one actually that's coming that's going to be go in there so it's ok you know it's as good as it can get up there but i think all the people in the overflow crew room can hear you too can you hear me now yes all right i think what what is critical about this is and i think this is one of the things maybe that because we're doing it statewide we've had an awful lot of change good chances to be we're using it says here item number one it's a it's a custodian certification form for the accurate ts units are going to be used under point number two what i've got here is i've got actually the touchscreen serial number which is you got a number  it's eleven six eight two seven then across here what you're looking at is are all of the tests that we take individually to run on the machines this takes about fifteen minutes per machine to run  it's a process is done under my direction and we actually have done this for five hundred machines for the upcoming election the next the next point that's important to look at is that there's a seal number that is right here and that seal number what i'm going to show you is how it's carried forward to the process were when we're holding the election at the precinct what happens with the next thing ok this machine that is sealed up it has a wire serial number on it so there's no access to this machine once the logic and accuracy testing is done now the next and the next form i'm going to show you is right here this is a for then that is carried forward to the precinct itself so that when the poll workers the poll manager and his assistant this is their responsibility this is a form signed triplicate one she goes to the secretary of state one comes to me and one goes to the supreme court you'll notice again it's for precinct big creek zero one this is the recap sheet that goes with it here again is the serial number if we look back before we would find that that serial number is the same one is here now i think this cooperation and i think it's great here is the serial number that then shows up on the comes that is transferred from the original l n a testing now what happens with it is we open up the machines we go through we can we do the count number and then at the end of the end of the election because this is the recap sheet the key part here is that there's another mechanical low tech seal put on it it is a wired sealed so it's kept on there all the time but that's the process that we go through i wanted you to be able to see that ok and i'm going to have to ask you to wrap up because we have a lot of witnesses and a lot of discussion ok i'm sorry yeah is that it you know i you know one of the other part i think that we i want to talk about it and i think this has to do with the comments that miss me wonder mcdon what's the confidence that people have that and i'd like to hear it at least respond to that another time because we've done surveys in our county to show that ninety nine percent of the people feel that the process is an excellent process so there is a conflict high level of confidence in our equipment all right we can defer that to the question period so thank you very much thank you and  a reminder to those i should have mentioned before you have a little device in front of you with the lights on it green means go yellow means it's some up red manger in deep trouble so please keep an eye on the c you good morning mr chairman members of the committee on behalf of the computing professionals that constitute the association for computing machinery i want to thank you for the opportunity to testify today about evolving system security and the need for voter verified paper trail secure reliable usable and excess of all voting systems are critical towards ensuring transparent fair and inclusive elections these are not actually exclusive goals i shall discuss aspects of both security and accessibility this morning first security because of the risks of software bugs malicious code or computer failure we cannot trust that the results in a paperless voting machine accurately reflect the will of the voters that is why voter verified paper ballots or audit trails or the pads as we refer to them are needed the pads are automatically produced by an optical scan system since the ballot is verified by the voter when he marks it fortunately forty eight percent of counties have optical scan systems so they already have the pads optical scans can be used together with tactile ballots leaves or accessible marking devices for excess ability someday ari's have been retrofitted to produce the paths to the in fact all of them for use in california is a congresswoman lofgren said two years ago a c m a leading computer society issued a statement calling for well engineered voting machines that i will every voter to verify his or her record has been accurately cast by the inspection of a physical e g paper records at its two thousand and six national convention the league of women voters passed a resolution calling for voter verified paper ballots or records to be used for audit and recounts the league also urged that routine random audits be conducted in every election both the a c n statement and the league resolution can be found in my written testimony in summary as a defense against malicious or buggy software we must have reliable well engineered accessible via pats policies and procedures that guarantee the integrity of the paper records secure storage and delivery of machines and so on mandatory random manual audits of the pats and a full manual recount if discrepancies are uncovered unless there is evidence that the pads have been compromised on the discuss accessibility people's disability should be able to vote privately in a dependently and be able to verify their votes however does not require ease be used for accessibility there is evidence that a number of people with disabilities are finding the theories are not meeting their accessibility needs charlie pierce a nationally known advocate for the blind and visually impaired review tactically  controls spoken prompts visual display or worker assistance following him controlling normalisation and ballot review for four voting machines in his report for cook county state attorney's office pier concluded that if any one of the four machines were to be deployed in chicago or suburban cook county many voters with disabilities particularly blind voters would not be able to cast about independently and privately blind computer scientists know runyan discuss his frustration with his hour long voting experience in the two thousand and four presidential election and i quote it took me thirty minutes to work my way through the ballots and make my selection after that i had quite a bit of trouble getting into the review mo to get a full list of all my selections when i did it went on and on for twenty three minutes like a long uncontrolled drink from a fire hose review function read each item and then at the very end said my lecture selection was for that item it even threw in details of what the fiscal impact would be and took forever this is completely backwards he went on to say in the time i signed in and got my vote a smart card it took eight ministry bought the machine as an audio voting machine thirty minutes to make my choices twenty three ministry view and verify and another four minutes to make a correction and record my vote not counting the hour waiting in line it took me about sixty five minutes to mark and record my ballot and quote we do not have to settle for inaccessible voting systems all technologies such as text audio devices tactile ballots leaves and ballot marking and generating systems could be combined with new to knowledge is that make the entire voting and verification process accessible while remaining auditable technology engineers and tested success carefully and if deployed safeguards against failure can reduce error rate provide more accessibility increase accountability and strengthen our voting system however the current state of evolving technologies leaves us far short of these goals we need paper trails and manual audits to protect protect us against failures and attacks we need additional research to make voting machines more usable secure and accessible and we need to work together to achieve these goals thank you thank you very much next we turn leask cunningham who is the election director in allen county ohio he serves on the board of advisors to the election assistance commission and also participated in the  performed by the election science and says mr cunningham you are recognized thank you mr chairman and let me say what an honor it is for a guy from a small town in ohio to be sitting here before you today in this tremendous forum i am also the immediate past president of the ohio association of election officials and i want to say to you before i begin when i wake up in the morning and head for my job i i'm feeling pretty good about it i believe the job that i'm involved in which is election is director has meaning and has merit and is doing things to make our country and our community better one thing i think we all agree on is that electronic voting needs some type of verification system some component that allows it to be audited and of course all systems need that but as my predecessors have said hard ballot systems it's rather obvious how we audit those personally i do not have any particular aversion to voter fide voter verified paper audit trails however in ohio the system is that the voter verified paper audit trail becomes the official ballot of record for recount purposes i must say to you clearly i am adamantly opposed based on the experience i've had in cuyahoga county to that i believe that program is setting election officials up for failure at this point in time  if the v p that was to be extended to voters as a courtesy by which to check their votes i have no problem with that of course i think statistics indicate that voters don't even use it when it's available to them i think the the studies on hand show that maybe less than ten percent of the people actually utilized that we looked at approximately three hundred fifty tapes in cuyahoga county and over and over and over we encountered tapes that were missing that were in some way compromised you have the numbers before you so i won't bore you with the statistics but i think two of them are very important for you to remember nearly seventeen percent of the v pat tapes that were reviewed by that team and that team consisted of a lot of ohio election officials that came in to help participate nearly seventeen percent of those tapes showed a vote discrepancy of one to five votes from the electronic machine and there lee ten percent of those tapes were either destroyed blank missing tape together or in some other way compromised and my point is this that the when you use the v pad at this point in time as the official record of a reek of a recount it actually serves to disenfranchise the voter because votes are lost in the v p that process they're simply not there and cannot be retrieved and we could have retrieve those votes by other means from those machines but in ohio we're not allowed to because the recount official vote ballot of record in a recount becomes the v pat and so i would submit to you that it was the paper that actually caused the count to be in question additionally and we have some photographs hard like to show you there is no reliable technology for which to recount to be pat's size credit they had a makeshift kind of real crank thing that you could put the tapes in and  kind of the the scene there you can see the machine that you know i'll tell you what i equate this to were pretty agricultural in my part of ohio i equate this to planting several hundred acres of wheat with a million dollar planting machine and going out and harvesting it by hand like the amish used to and stacking it up in the fields to go on please with a lot you know this was mind numbing to say the least to sit and now keep in mind we went through three hundred and some tapes there were probably nearly four thousand tapes in cuyahoga county this took us to ten hour days actually two and a half was the first half a day it was setting a system continue please this is simply a tape with no record printed on it continue again please same same thing this is the information that we're looking through on the tapes trying to and remember at least this is ohio's rule that when a race you can't recount any other race you could only recount the race that is going to be recounted so if you've got twenty seven candidates on the ballot you've got a real through all twenty seven to get to the race maybe a down ballot race or something your county has gone please with size and this is exactly the one that's taped together that's obviously been in the machine accordion corti and up in the machine i don't know how many that black line probably represents twenty or thirty votes i don't know you know there was no way to themselves i honestly don't have any reason to believe the aries don't record votes accurately but i understand the concerns and i do believe that we should have some kind of audit system for it i would say to you considering the size and scope of the deployment of voting machines in the last twelve to twenty four months in america i think election officials have done a pretty darn good job we're working on improving it unfortunately i believe and we'll wrap up here in just a second i believe it is the environment which is slowing our pace of improvement as a local election official i'm going to tell you i feel like i'm in a crossfire and i know many of my colleagues do and that crossfire is a very very polluted conversation and it's being polluted with political interests and corporate interest and scientific one upmanship and i often wish i had as many people helping me find the solutions to these things as i did identifying the problems for me it would make my job an awful lot easier i want to echo the remarks earlier that i do believe we should continue to fund hava i think the underfunding of hava sends a very inconsistent message to those of us out there trying to do this on a daily basis i would say to you also  leave allow us to finish what has been started and what is in motion before we begin to tinker with this we have been given a set of tasks that are very very hard to manage and again in scope of the deployment that has taken place in this country i don't want to say there weren't problems in it but i think my colleagues have done a very good job and i would hope that in the future when we do begin to debate and speak about this we can do it in honest and direct terms without misrepresentations half truths and focus on what it is we need to do to cure these problems and make america's elections give people confidence in them and i think it's too far to expect too much to expect any less than that thank you for your time appreciate it thank you and we hear your cry for help last namely leave us alone let us do it but i also want to know you're not the only one who has crowds of people yelling at them for solutions and offering no assistance where experience that every day of the week so you have our sympathy the next person i'm pleased to introduce james dickson vice president of government affairs for the american association of people with disabilities he's been a very strong advocate throughout this process of making certain that anyone with disabilities is permitted to vote and has a sanctity of the secret secret ballot which is essential to all of us and essential to democracy mr dixon you are recognized thank you chairman ehlers member committee i have two disabilities i have two disabilities i'm blind and i'm blunt and in these five minutes i'm going to summarize some of the points in my written testimony first i want to thank the members of congress who passed to help and i voted secretly and independently for the first time two years ago for the second time just and i'm speaking for tens of millions of other americans who have now the first opportunity to vote privately and independently i've got a few stories to tell about the problems that i face and which millions of other voters face when not being able to vote privately or independently these happened to me but literally there are millions of stories like it the very first time i voted the poll worker said to me loud enough for everybody in the polling place to hear you want to vote for who on another occasion i had a poll worker say to me we're very busy nobody votes for a state legislator in these other races so how about if we finish now on another occasion i had a poll worker say to me these referenda are really confusing most people don't vote on them so why don't we start now on yet another occasion i had a poll worker say to me this print on the referenda is too small i can't read it to you so we'd be finished that particular excuse did not get much sympathy f me touchscreens the best existing product we have that offers accessibility to the greatest number of people i participated in the early work that was referenced by kelly pierce the rest of the story is that after those initial tests the company was able to inexpensively and quickly make changes to the access procedures so that the problems were of  touchscreens access is a continuum and we need to have equipment designed so that as access increases it can be cheaply efficiently and quickly installed on the equipment touchscreens are the only product available now that meets those requirements at a p d we absolutely want secure accurate recount the bull elections that are the systems that are accessible the paper trail is not accessible this is a california bal try recount a leave for the committee this is the row that was not able to be counted in ohio paper trail is a rule goldbrick contraption it doesn't work it's not accessible you can't recount it it doesn't even off the verification not only to people not look at the verification of the test done at m where the computers were set up so that votes were changed mit students didn't find the changed vote when they looked at the verification on paper when the verification mean was done audio listening through earphones they found the change votes i want to sum up with the following three points things have to be accessible thank you for making that stand  the paper trail does not even do what the proponents want and the proponents are a very small group who speak very loudly there have been over and over again public opinion polls when voters use touch screens they trust them eighty percent eighty percent when they use them we shouldn't let a loud vocal minority using fear determine what's going to happen in the sanctity of the polling place and the last point i want to make and it is very very important is the real problems in our voting system are human factors  human errors and before we order something to be done in the polling place we need money to research and document what the problems are and we need to test proposed solutions in the reality of the polling place not in a laboratory put me in an empty room with a ballot box full of paper and i will have hacked into it in less than sixty seconds thank you again this discussion is very important and i would just ask you to remember mellon university and is also the director of the institute for software research dr seamus you are recognized thank you mr chairman i just want to make a small correction to the record i'm not the director of the institute for softer research i'm just a member of the institute for software research but i'm also an attorney admitted to practice in pennsylvania and before the united states pad and trademark office since one nine hundred eighty i've been an examiner of voting systems electronic voting systems for various states i'm currently an examiner for pennsylvania and i've personally performed one hundred eighteen voting system examinations i'm going to do my hundred nine hundred six emanation next week i recall that mr chairman you're a physicist representative holt is a physicist i am a former physicist my proposal is that we settle this issue like physicists based on scientific evidence and not based on emotion i view electronic voting as primarily an engineering problem that includes the design of processes and procedures once the requirements for a voting system are agreed upon it's not a matter of developing and manufacturing equipment and processes that meet the requirements the question is whether congress should be setting technical performance guidelines and engineering standards as h r five fifty would have it do or whether such guidelines should be left to nist and the e a c as h already provided the proposed bill is based on three major assumptions all of which are false first it assumes that paper words are somehow more secure than electronic ones a proposition that has been repeatedly shown to be wrong throughout history second it assumes that voting machines without voter verified paper trails are an audit to bill because their claims to be paperless which is also false they are neither paperless nor  assumes that paper trails actually solve the problems exhibited by d r e machines which is likewise incorrect the reason that mechanical voting machines were introduced over a century ago was to stop rampant fraud involving paper ballots h r five fifty restore us to the year eight hundred ninety when anyone who wanted to tamper with an election needed to do no more than manipulate pieces of paper the recent example in cleveland ohio comic kiowa county is extremely  instructive that was the case we would we just heard that ten percent of the paper trails could not be read h r five fifty provides that in the event of any inconsistency between electronic and paper records the paper records are  correct attorney such as myself are always wary of your rebuttable presumption applying that provision to cleveland would have resulted in the disenfranchisement of ten percent of the electorate because their paper records could not be read i cannot believe that the numerous sponsors of this legislation contemplated such an outcome i did a review of u s elections starting in the year eight hundred twenty four when popular vote began to be kept and i looked at the percentage of times if you took ten percent of the popular vote and subtracted from the winner and gave it to the loser how often with the outcome change and the answer isn't eight hundred twenty four fifty five percent of our presidential elections would have been reversed if you couldn't count ten percent of the paper trail the argument is made that security problems with d r e voting demand remediation of the type proposed in the bill indeed professor felten at princeton hari her city and others have done a great service by exposing security vulnerabilities in voting systems some of these vulnerabilities are severe and require immediate repair but the point is that they are easily remedied the question for the committee is what the proper response to such discoveries ought to be when tainted spinach was found in california congress did not ban the eating or distribution of leafy vegetables even though at least one human life had been lost the appropriate reaction to the discovery of a security flaw in a voting system is to repair it not to outlaw an entire category of voting machine with which we have a quarter century of experience it's claimed that observed reliability problems with v r e machines would be alleviated by adding a paper trail the field experience has shown the opposite the failure rate of paper trail  double that of the areas without paper trails it should be obvious that adding a new device with moving mechanical parts to an existing electronic machine cannot improve its reliability the effect of h r five fifty would be to ban electronic voting entirely in federal elections i want to repeat that it would be to ban electronic voting entirely in federal elections the reason is that the bill sets forth conditions that are not met by any d r s system currently on the market in the united states if it were to pass in its present form there could be no more electronic voting in this country and congress would be in the position after having spent three billion dollars on new voting equipment of spending billions more to replace what it just paid for i cannot believe that the numerous sponsors of this legislation contemplated such an outcome further the bill as written mandates a system that would violate constitutional and statutory provisions in more than half the states the secret ballot is regarded as an essential component of american democracy each one of the v paper trail systems that are currently on the market either enables voters to sell their votes or allows the government and the public to discover precisely how each voter in a jurisdiction has a vote i cannot believe that the numerous sponsors of this legislation contemplated that outcome either i am in favor of voter verification the proposed bill despite incorporating the phrase voter verified into its title does not come close to providing real voter verification while it shows the voter that her choices were properly understood and recorded by the machine it offers no assurance whatsoever that her ballot was counted that it ever will be counted or that it will even be present in the event of a recall a recount is demanded once the polls have closed the voter not only has no recourse or remedy but is powerless to even determine whether her vote is part of the final tally or to object if she believes it isn't that is not voter verification regardless how it may be denominated in the text of the bill i submit that if congress desires to enact comprehensive statute mandating voter verification it ought to verify whether the proposed legislation actually accomplishes that goal numerous effective verification methods are known that are not based on vulnerable paper records these have not yet been implemented in viable commercial systems i understand that scientist at nist will soon announce another one if h r five fifty isn't acted there would be no point in continuing research and development in the such system since the statute would prohibit any system that didn't use paper records professor recently invented a voting method that allows each voter to verify after the election is over that her vote has actually been counted a feature that is absent from the systems contemplated by h r five fifty professor of a system also allows any member of the public to tabulate the results of the election for herself so it's not even necessary to trust the official count these discoveries demonstrate that voter verification is now a ripe area of scientific research and it is far too early to mandate by statute a bad non solution to a presumed problem my purpose here today is not simply to complain about the bill but to offer constructive alternative as part of my written testimony i've included a complete markup of the proposed legislation that retains its essential positive features such as voter verification but eliminates its ill advised provisions i urge the committee not to report the bill favorably in its present form and i thank you for the opportunity to be here today finished with you let me pursue one comment you made i could pursue many and i'm sure others will pursue but on the one the paper trails are no more accurate than any other method let me ask if you would also include paper ballots which are then read by a computer in that category mr chairman i don't think i actually made any comment about the accuracy of voting systems i think i said that paper systems weren't  secure as far as accuracy accuracy is a very poorly defined concept in voting systems and extremely difficult to measure because we need to know in advance the voter's intent before they go into the voting booth then we need to see through the entire chain of custody of all the ballots at the end whether the final tally really reflects how the voters intended to vote that's nearly unmeasurable except in small laboratory experiments so i actually haven't made a comment about accura general to tamper with those because they're cut sheets of paper their individual individual pieces of paper there are all sorts of problems with with optical scan voting but it's certainly acceptable as as a method of voting we we use it in pennsylvania it's used in widespread use around the country let me just explain that one little bit in terms of recounting for in the case someone demands a recount in the paper ballot  good reliable for a method of recounting simply because the voters themselves have marked that particular piece of paper no the problem is that once the voter has marked the ballot and verified that the  wants she has no assurance that by the time the recount occurs that same piece of paper is going to be in the hands of the re counters lofgren from silicon valley might recall that in the two thousand and four election in san francisco three weeks after the election ballot boxes were found floating in san francisco bay with ballots in and so we have not solved the problem security of paper ballots in a widely distributed voting system that we have in the united states with would someone need to access the machine for an appreciable amount of time or something that a voter and of in a voting booth could do it takes about one minute of access to the machine and i could show you roughly what would be involved it would involve opening the door on the side of the machine which would require getting a key as i said those are for sale on the internet there may be some security tape that would need to be removed and might be missing already opening up store putting in a memory card like this into the side of the machine the memory card would have been prepared in advance with the computer virus on it then pressing the red power button and waiting about thirty seconds and afterward closing everything up and putting it back this is something that would be unlikely to be doable by a voter in the in the polling place but if the machine is not if the machine is not guarded with very careful chain of custody throughout its life cycle  it can be available to that in my polling place in princeton the d r v machines sit on attended over night the night before the election in a locked school lobby and how long would it take someone to to actually get access to the machine to figure  or to write the program if it requires some information about how the machine works this is not a manhattan project it requires a moderate level of skill in computer programming and some limited knowledge probably the knowledge started looking at the machine to devise the virus were what sort of timers and we got the machine in may at first we spent a lot of time taking it apart to understand everything we could about how it worked we were interested not only in whether a virus would be possible but we really wanted to understand all of the security mechanisms and we wanted to treat it very carefully from the time we started developing virus code until we had a working virus perhaps a few weeks thank you very much my senate they have a bill out now saying that every polling place should have a large supply of emergency paper ballots that can be used in emergency situations that's just hair poor we are that's what we think about voting now in this country of ours and so senator dodd and senator boxer and others have to submit this bill but i have also i have said all along that there is a security issue here there's an issue that we must a trust issue that we must come to bear with in terms of voters mr felt and spoke about when there are when there are consequences there are compromises or compromise consequences bring compromises and i want him to expound a little bit on that and he also said that existing election procedures are not adequate for elections i want you to expound on that too sir and tell me if mr dixon feels that paper trail a paper trail is not adequate expression only for disability  then you are suggesting mr felton that paper trails do cut down on voter fraud so you know we have some imbalance here if you can just speak to that for me on those issues yes thank you the first for the first if you had to do with the consequences of of compromise being worse an electronic system and in the example that we gave here there is a computer virus that will spread itself from one voting machine to others and the consequence is that if someone is able to compromise one machine the virus can spread to many machines and potentially affect all the votes on all of those machines as compared to fraud with an old fashioned ballot box where access to a ballot box only allows someone to tamper with the votes that are in that ballot box or maybe increase them by some amount but what access to one cannot involve stealing tens of thousands of votes as with an electronic system but this virus as you say can pass from one machine or a one voter to the other i think use data that how can that be when i'm told that manufacturers do not give out this so called code a secure code that they use how can that then be done with that well the way that the virus was the way that this virus spreads is on these memory cards the memory cards are programmed before an election usually at a central location in the programmed with the list of rac the list of candidates and so on for that election and then they're distributed out to the polling places and put into the voting machines that's a possible that's a possible motive travel of the virus if the virus gets onto a memory card at that central location it will then be installed out into the voting machine after the election the memory cards go in the opposite direction to carry the votes back to the county clerk or board of elections office to tabulate them and that's that allows the virus to go in the other direction so a virus in one machine may hitch a ride on a memory card after an election back to the election headquarters and then potentially spread their on to many other cards which are then distributed say for the next election this is much like the process by which older computer viruses spread on floppy disks if you put an infected floppy disk into your p c your p c would catch the virus and then it would spread to any other disk that you put into your into your machine so it hitches a ride opportunistically on top of the the flow of these memory cards that happens in running an election normally how do we answer mr dixon's the whole notion that paper trail except old to the disabled and yet you say cut down on voter fraud yes i do believe it cuts down on voter fraud and i do believe that is that a paper trail well designed can be just as accessible mr dixon held up the role of paper and pointed out that he could not view that or verify it or audit it but the deore system that he is advocating stores his votes on this with which neither he nor anyone else can simply look at and read the problem with these eased and the security problem is exactly the thing mr dixon is complaining about the inability of any voter to look at the machine and see their vote recorded a so i don't believe that there's a conflict between the use of a paper trail and accessibility  there are just so many questions that i have just put all over the place here i am the whole notion mr cunningham that you spoke thing i think it's a i think it's a human thing and i think that anything we do here no matter what it may be can be attacked can be hacked into can be verified can be ballots boxes can be put in  river could not be shown but i think we're trying to do is try to eliminate as best as most as possible all these things that can possibly go wrong and i don't understand why a receipt because that's what i look as a paper ballot as a receipt why when you vote and you get your receipt and you have that and you see what you voted for and if you don't have that then you could if you don't have that then you can lodge some type of protest somewhere if you have no receipt you think you vote and you don't know and it's up to now whatever tabulation or whatever machine or mechanical or scientific tabulation happens and on the stand why there would be a problem for anybody you know having  and missed a shame if you are in my state and you have you have you have inspected many many times the voting machines and and from what i understand you had said that alicia's hacker could easily make the come in a vote and i want to vote for you and i get my paper and i says i didn't vote for you i can logic your plate right then and there if i walk out of it with nothing i don't know who actually voted for one of many hands or that machine that hacker or anybody could probably get in a vial of the voting process so i don't jim any answers for incumbents anyone well i can say mr shamus yes so it's certainly true that if a malicious hacker is able to gain access to a voting machine and replace the software that's in there in such a way that that change is not detected then there are severe problems and that's what i say when we have to when we find security vulnerabilities we have to find ways of plugging them for example the vulnerability discovered by  professor felton's group at princeton was known to us in pennsylvania back in march right before our may primary and we were forced to make an emergency remediation in pennsylvania  to blunt the effect of that discovered vulnerability because we wanted to be able to assure county election officials and voters that an intrusion of the kind that was demonstrated here today was not possible or if it had happened the effect of it would have been reversed and so we remediated that we also instructed the vendor that the next time it comes back for certification it better have a remediation of its own so that we don't have to impose administrative procedures to make sure that that vulnerab can't be exploited so i'm not minimizing the possibility that people are out there trying to hack things my point is that the response to the hack is not to throw the machines in the ocean and go back to what we were doing in eight hundred ninety there if it's a technological problem we have a technological solution with respect to the receipt a lot of people think of the word receipt as meaning something that the voter can take home with them and look at it later at their leisure and show up maybe at some later time to an election official and say see this is really how i voted it's not legal to give receipts of that kind because they could you can't give a voter anything that they could use to prove how they voted since they could then sell their vote so the receipts that we're talking about in these voter verified paper trail systems the voter has a chance to view the receipt on the machine and then yes that truly represents my vote or not and then when they leave the polling place they don't have a piece of paper to take with them and my point the point that i made in my earlier testimony was that it's nice enough to show the voter that their vote was properly recorded but again there's no assurance that at the time the votes are actually tallied later or recount is done that that piece of paper is even my make an interesting episode quickly in memory if i just wanted to comment briefly on this whole paper issue because i think we're comparing apples and oranges one of the basic issues is how well engineered these systems are as somebody who was advocating for voter verified paper audit trails early on before the machines were read well fitted i have to say i was appalled by what the voting machine companies came out with they are bad i mean mr cunning is right this is jim dixon is right these continuous rolls of thermal printed paper have privacy issues as michael shamus says but they're badly engineered it's bad technology there's no reason why people has to be paper  pads have to be designed that way they were the cheapest way to do it that was why it was done that way i mean banks deal with paper all the time they manage to count it and i don't think they make many counting mistakes other countries vote on paper and they don't have problems we can do it too but we have to do it right if you do it wrong it will fail then for the last quick word mr dixon chairman ehlers i wanted to respond to your question about counting optical scan ballots by machines we have a lot of experience in this country with that when you have large numbers of ballots hundreds of thousands and you've got a close race every time the obstacles and ballots have been counted you get a different number you get a different number we do not have the technology to accurately count the large pieces of paper all right thank you very much  simmons needs to be emphasized the fact that we have a dysfunctional role doesn't mean that that's the only old and of available as as it ought of the ball trail you know i spent more years on the board of supervisors in santa clara county than i have so far in congress and in california the counties are the repository of the registrar of voters in california the registrar of voters is a civil service position i mean it's very nerdish i guess is the best word you can say in silicon valley and very apolitical and it wasn't really until i got on the board of supervisors that i realized i guess i've never really thought about it that  the votes get lost people don't think about that but the we had a little punch cards for a long time and it would jam up the machines election night in and some of the ones that got mangled didn't get caught and it didn't ever at a time when the country was less closely divided than it is today it didn't nobody really noticed because elections weren't that close but of course now we have close elections all the time and we're paying more attention to it and so i do think that we need to make sure you can't have a perfect system i suspect but but we need to have a system where people do not question the integrity of it i remember going in with a computer  scientist in my district who really said this yes you can make a mistake i mean you can take a ballot box and throw it out but the difference with packing a machine is that it's all it's not random  the direction in which those votes are going to be lost and so i'm very enticed by mr holt's bill i would note that in standard setting there's been discussion that this would eliminate the privacy of individuals but on page three line thirteen of his vote it's perspective five says to comply with the act that would not be permissible so i think you know part of what we do here in congress is this is to set standards and laws that need to be met just business does from an engineering point of view i'm wondering mr felton mr seamus said something to the fact that you could verify other than by paper means i don't want to misquote you i think was something to that effect how would you do that with the virus that your lab created how would you do a verification without would there be a way well i think that the idea of non paper verification is something that's not ready yet it's an active area of research mr seamus referred to professor vest work which by the way is a is a an all paper system  the and that is an interesting proposal but i would not want to trust an election to it tomorrow i think that years from now we may be in a position to have effective and usable non paper based verification systems but i don't believe they're ready yet and i and i don't think we can afford to wait this seamus your testimony has been very interesting in thank you for your advocacy in your work on assuring systems one of the things that you've suggested that we need to make sure that vulnerabilities are protected against and no one would disagree with that but one of things i learned in my prior life on in local government a mothers and you've got volunteers and there's schools and it's really i love election day but it's not really a tightly controlled and cannot be because that's not the way americans hol elections unless we completely fund this and have full time paid people i don't think we're moving in that direction so how would we be able even if we found this virus i know from silicon valley i mean there's a million ways to hack this stuff how do you given the fact that we have this chaotic system we have smart hackers everywhere how do you protect against those vulnerabilities in your judgment ok so there are several ways one is that we're never going to achieve perfection we're never going to locate all vulnerabilities of existence systems because we don't know how clever people may be in the future to get around the protections that we've built in but this is true not just in voting systems in every kind of system that's ever been made there are there later discovered vulnerabilities so as i said in my testimony i'm in favor of voter verification voter verification is a way of assuring that if if a vulnerability has been exploited that we're going to know about it i think you just asked about a potential non paper mechanism for verification i'll give you a very simple one that the ts unit over there has a touch screen that shows things to the voter the voter is not positive however that the marks that she makes that are visible on the screen are actually getting recorded by the machine so all we have to do is have a second screen made by a different manufacturer and we take an electrical wire and we get a copy of whatever is on the first screen to the second screen and we attach a digital camera to that so it actually makes a record of what the screen showed and of the voter has any doubt that it's been recorded correctly she can press a button that says replay and it'll show or her vote again on the screen and that vote gets recorded on a cd or d v d and a right one smacked mechanism so it can't be tampered with later that's just a trivial example of a non paper verification mechanism the second way of doing it is through something called parallel testing which is used in at least ten counties in california it's going to be used in massachusetts in november and several other states where you sequester a machine or machines during the election during the actual time of the election and you have a team of people vote on them simulating the way real voters would vote except that they vote according to a predefined script so we know what the total should be at the end then at the close of polls we close that machine and we see if the totals match and if they don't match then we know that there is a rat somewhere and we do a forensic examination to find out where the rat is holding you are holding this hearing and i welcome the opportunity to be with you and i regret that the hearing has been held the day before our target adjournment for the year but nevertheless i think you put together a good panel of witnesses let me just make two quick comments one is how if i had the and and anticipated effect of motivating jurisdictions to go out and buy devices for voting that are clear simple accessible easy to use and totally on verifiable and it may be that there are various future methods of  verifying that would be that are not yet thought of her not yet developed but right now we have a a method of verifying where each voter can verify her vote at the time of voting and that is rather rube goldberg issue c c d camera that was going to photograph another screen the paper record sounds a whole lot easier to me but anyway let me  first go to to mr felton professor felten how detectable would the virus that you devised or that someone might devise be before during and after the election and let me ask another question i don't know whether you're familiar enough with the kind of of chain of custody and other checklists that mr smith puts his machine through do you think a virus could be implanted in a system that had the kinds of protections that mr smith describes first the question of how detectable this would be there is there is a long established cat and mouse game in the p c world between virus writers and antivirus companies and the virus writers have proven very successful at making viruses that are quite difficult to find especially in advance and i would expect  or i suppose fear that we would see the same phenomenon here we did not try to make this virus a stealthy as we could but but i think that if if if someone used the same methods that are used in the p c world to make viruses hide it  would be very difficult indeed to find in advance pre election logic and accuracy testing as has been discussed here will not you will not find device that we devised because it simply checks whether whether the machine is in logic and accuracy testing mode or real election mode and if it's a logic and accuracy testing though the virus simply lies low so i think it might be quite difficult to find and i certainly would not have confidence that if it were implanted it could be found the second part of your question related to the procedures that mr smith described and i think those sorts of procedures are very valuable they do help to close the gap to close the window of vulnerability but we also have to recognize that procedures are not perfect and are not always followed like any other part of our election system there will be gaps there will be errors and i still worry despite the best of procedures that the window of vulnerability opens enough that a determined adversary can get through it about i'd listen to the you know the situation with regards i'm the only one here by the way that uses deeble ts units and i'm the only election director i guess on the panel that does one of the things that i've been listening to and concerned about is how this virus would spread i am an engineer by background i'd hold a double a degree so i have some kind of technical capability and that first of all if you took one and you corrupted one of the get if you took and you corrupted this memory card it's going to go into one machine ok and that one machine and my county is probably going to vote between one hundred one hundred fifty votes that's all it's going to be counted on so the issue comes in is this card supposedly the hand is going to be corrupted ok we'll lose one hundred votes that's not good but it's not like we're losing fifty thousand votes that i have cast in a general election and the last one in two thousand and four now this comes out it goes back to that end of the process as mr felton has said it's only going to corrupt one more machine the machines are not interconnected there is not a possibility of corrupting the five hundred machines that i'm going to put in place for the two thousand and six general election that is a you know an issue is a tactic is not to happen now there are a lot of other things that we do i mean we we have a lot of security in place we follow but i'm very anal about those types of things and i've talked to mr felton about it and i think that he believes that in our county we have a good thing the last thing as i'd like to to respond to this the lender mcdonald said i think this was even as important as anything is that the confidence that people have in our equipment is very important i mean i i couldn't say anything more we taken after every election we hand out a response card given out randomly to our people we say you know what do you think about the process you wan have whatever and i've got in front of you prius not a technical you know survey of the type but there are seven hundred fifteen responses you can see the names you can see when they the precincts you can see the election was held for in addition you can see their comments ninety nine point five percent of the people that responded to these things in my county said we did an excellent job there was only two people only two the requested a paper trail so i think we're doing a good job and forsyth county georgia i think we're doing an excellent job and in the tire state of georgia and i think that we need to be i don't wan recognize work but hopefully don't don't impose things on us which are going to make our job much harder to do but i also tell you that i agree with mr felt with regards to having you know verification but i believe that we do not need to limit it to paper my time is expired i hope mr felton will get a chance to reply because on my visit to his laboratory it was my understanding that the message of spreading the virus that when this memory card goes back to the central facility and is put into a so called accumulator machine which adds up the votes if that accumulator machine becomes infected it can then in fact a very large number of other memory cards that are subsequently put into it  and it acts is as a as is a very very serious carrier of the of the virus thank you just an announcement to my colleagues received a note that votes are expected between twelve and twelve fifteen i would like to have a second round of questions let me suggest that each of us tries to limit ourselves to three minutes and i will begin then recognize minority leader of the ranking member mr little presumably will be settled in by then ready with his question let me we were just talking to mr smith and i was wondering  this is what kind of system to georgia have before it adopted the electronic system why do they see the need to change to the current system and what were some of the problems you experience with the previous system basically is a new system better than the previous one ok i think i can respond to that fortunately i took over as director of elections prior to the introduction of the evil deore machines we had at that point in time the punch card machines by the way i would say that the security level that we had on punch cards was pretty miserable now and i've gone through and listen to all of the you know the technique oh dissertations have gone on our punch card machines were monitored by a computer as well that computer said and i it was an i b m three eighty six or something like that is sad and i clause it that we kept and in fact they downloaded software to it routinely you know over the telephone lines i would say that was highly and secure and i was and i was mortified at that when i thought the changes made changes that we had six months prior to the two thousand and two election machines were introduced into georgia we had six months in which to take this across the entire state and i would say the secretary of state and the center for election systems from kansas all state university did an outstanding job i tell you i personally i used to run major computer projects i didn't think they could do it they did an outstanding job and we've done it we have continued to hold elections and people are very pleased with them in our state are their problems i think some of the things that miss them a lender mcdonald brought up with regards to training poll workers were very valid and i appreciate the fact that she's going to continue to fund it i would like to ask her if she would fund the program also so that is part and parcel of a program that i have introduced which is called foresight first vote but we also use high school students to do it one third of all of my poll workers are students we've changed the entire complection of the people in our county maybe that's why we're running good elections i don't know but i've got poll workers that we turn away because we have a very good program i'm very pleased with it thank you thank you very much and briefly  failure or do you think that through sufficient risk research and study we could make them more reliable well thank you mr chairman i have a personal motto i never buy the first model of anything i always let other people figure out what the problems are before i buy it and that's what i think we're in here as we are in the i think the fact of the matter is when the help america vote act was passed most of the touch screen voting machines were by and large prototypes and rushed in to manufacture i'm not taking any issue with any of the manufacturers and i'm not making a comment on the reliability of their machines but i think what we've got on our hands here is the model t ford we are in the early stages now can they be improved absolutely and i think throughout my comments i was very definite to say that these machines as they currently set not reliable my question back to you though in that regard is who's going to pay to fix it because right now one of the problems we have right now is in the last twenty four months every election jurisdiction in this country has spent the three billion dollars we spoke about earlier on new election equipment and that's what's emplace so  without somebody stepping forward to fund that that enterprise i don't know how we're going to improve them ourselves and if i could offer and i like in running an election to throw in a package of bibi's on your kitchen table and while somebody is on each leg moving the table you're trying to keep them all on the table all day long that's that's why analogy of elections thank you for that discouraging about well that's ranking member for five minutes thank you mr chairman and let me again thank you so much for this hearing this has been just absolutely the most informative hearing that one of the great ones we've had to counting him i thank you for saying that we all agree that some type of verification system is needed and at least we have a consensus here for that but you did speak of the fact that you are adamantly opposed to any program such as yours in your state which makes the pact the official ballot of record for recount what did you do if i'm not mistaken ohio lost ten thousand ballots and what happened here given that you were unable to recount because you can't reprint am i correct on that i'm not i mean in ohio what election are you talking about it was my understanding that there were ten thousand votes that were unable to be recount is that nearly ten percent of the tapes are either destroyed blank missing tape together or otherwise compromised in some way i don't i don't think that it would be correctly mathematically to say that it was ten percent of the vote percent of the v pat tapes based on what we reviewed had some kind of compromise that made it very difficult to ascertain what the real numbers were but to make a valid point that because of the v pac voters will be unable to discern whether or not their vote counted in an election am i correct on that i'm sorry repeat that i am i correct in saying that because the packed it's official ballot of records for recount purposes that if you should need a recount you cannot go to a reprint discern whether those votes that are exactly right and i  would submit to you that to reconcile and verify vote totals on an electronic machine there are better ways to do it and more controlled environments than the election day environment that i just unst for instance when the machine is back in the office and other records that are stored in that machine can be printed and otherwise looked at electronically you know we work every day on this try i mean that that is my job is to try and reconcile those numbers at the end of the day but trying to maintain this contemporaneous record in the current state that it's in and i think we've i'm just saying is it's never going to match and it's only going to fuel this this fire that voting systems don't work and i think ohio has set itself in a very very dangerous situation if i may just go along with that i know there has been a little talk here about we're only concerned with federal elections you know the least frequent election i run is federal election so we need to be very careful that one of the problems that has occurred since the passage of hava was it put many state rules and regulations in conflict with the federal law absolutely what we ended up with was these rules apply in a federal election and these rules apply to local election that's a terrible situation we cannot operate this enterprise with two sets of standards so i couldn't agree with you more please do not think in terms of only federal elections because it is a very problematic proposition because you know what sir in a given election you have three different laws that you perhaps might have to implement local  state and federal and you know my hat's off to all of you local elected ones who have to balance and balances between the trenches it is it is just really  problematic mr man's let you close me down because i wanted to go to this seamus but i just have second here for you to come in i wanted to remind when you lose votes in a deore which has no paper there is nothing you can do and in fact there was an election for the statewide election for agricultural commissioner where the separation between the two candidates was such that the results could have been reversed by those missing votes and it went to court it went to two different courts where they first tried to hold a recount just for card for the county itself that was thrown out then it went to four statewide recount and that was thrown out because we had no laws to deal with what happens when the armies fail and finally there were a number of people who submitted subpoenas petitions say they had voted for one of the candidates and based on those submissions it looked like the judge was going to declare that candidate the winner and so that was how the election was decided this is not a way to hold elections in this country and this is a problem with the auris no matt paperless d r ease this is a case of a failure but there are many other problems too we haven't even touched upon security problems such as for example the risk of of somebody malicious getting a job for the vendor or for the delivery service of some implanted malicious code that way we know that all software is buggy we don't know for example if elections have been wrongly recorded because of buggy software forget malicious code so so there are so many basic problems that we just have no way  unless there is evidence that the the v p b s have been compromised the paper ballots should be used to determine the election results and i want to ask what sort of evidence of compromise where you refer and well obviously if you have the kind of mess that mr cunningham talked about that that would raise a lot of concerns i mean when you don't have all of the v p pads and i i share his concern about that kind of technology and i think we just have to remember that that's not the way the pats or the p b s have to be done we need to have good engineering we need to have high standards and we have to hold vendors to high standards they should not be allowed to produce machines that can create this kind of mess well they are machines and i notice that machines occasionally make messes well but you know you sometimes you get what you pay for we know i mean you can buy printers that don't jam you can buy printers that the don't have privacy issues they're the me this is not rocket science these things exist now these technologies exist now and i think a question that we have to ask ourselves is how much are we willing to pay for our democracy should have been used as the official ballot in that case because that was that's kind of the obviously in that case it's a problem it's a real problem just as the card county example is a real problem too we can see problems with the paperless systems and problems with the systems that have been retrofitted with  pets and i think the underlying issue which i believe everyone on this panel would agree on is that we need to have well engineered well designed robust systems and as mr cunningham said this is sort of like the model t visa first generations and they failing that's not good well i understand the model t analogy but i don't think the members of this committee in the congress in general want to throw away hundreds of millions of dollars on the model t mr dixon would you like to comment yes there are two points the loss of votes is is really a terrible situation is really what's are the loss of any votes is a terrible situation thank you what's get lost on right county voting machine is does not meet the current standards if that county had purchased an excess above voting machine built to the current standards that problem would not have happened the cal you are at machine a little red light comes on with no words around it that says this machine is full there was no explanation in the training for poll workers that said this read like means the machine is for this automatic senate bill machines the screen reads machine for all that it will not accept new where votes were lost on a voting machine that county administrator wanted to buy accessible voting equipment and the purchase of it was delayed because of the motion about a paper trail and the problem was created because of a delay well i just wonder in that  county case i understand that the paper trail which is the i think mr holt bill is going to be the thing we go by if there's a conflict that in that case a paper trail lost nearly ten percent of the votes so it would seem that there'd be real problems in that instance at least hopefully that would be relatively rare but in that instance if we want by the paper trails the bill calls for we would be having a lot of problems with me oh actually there were many problems the redundant memories did not match in about twenty six percent of the cases so if you're going to try to do verification using the redundant memories there can be issues i mean there was so many problems i think i'm sure you would acknowledge that that it wasn't just  pads and this just shows that we need to to focus more on technology on policies and procedures and as mr cunningham said right in elections a complicated thing but because there were problems in one area doesn't mean that everything in that area can't be done as i said banks count banks deal with money with paper ballots all the time canada holds its federal election using paper ballots so does the u k and they manage well in this case the paper we went through we're going through as i speak in my city and county of philadelphia a write in ballot write in candidate as you head and we're doing that as we speak and we're in court now because the candidate on machine one then they had a paper that they can write know votes by people voting electronically than having a camera with a lot of people on a good faith in any kind of electronics and what we're trying to do here is the right thing we're trying to restore confidence and most importantly trying to restore trust back into our process and we're trying to figure out the best way to do that and i understand there's a financial problem and i understand it was a financial issue but i like what you said you know you know how much you know there's never enough money to  of my first set of questions mr shamus had described alternative ways to verify the vote i'm wondering if mr felt do you have a comment on those proposals and also on the  yes if i recall correctly he mentioned two mechanisms one involving a second screen and a video camera and so on and it seems to me more complicated more expensive than a paper based verification system and  probably not any more trustworthy he also mentioned parallel testing which involves taking the machine aside and holding a simulated election and this is something we discussed in some detail in our research paper and the bottom line is that that is a worthwhile mechanism but it's not completely effective not one hundred percent effective at finding the problem it raises the bar makes it more difficult to make a virus for example that will evade detection but it's not a complete solution we should do it but we shouldn't seamus mentioned makes it very difficult to hold a recount and i think when one is thinking about these things and when you talk about trying to get public confidence in elections one way in which you do that is by audits and recounts and i don't know how you would audit that screen it seems to me it would have the same problems that these long rules of paper that mr cunningham showed you've got someone who's going to sit in front of it and say well this one voted here and this one voted there was just smith do you have a comment oh i cut you off barbara i didn't watching the count as a way of getting confidence in the in the results the other thing as far as parallel testing goes i think we all agree parallel testing is a good thing to do but there's a big what ifs in that what if is what if you find a problem with the are you going to go back and rerun the election as we saw at catterick county that that raises enormous legal and technical problems mr smith you know i guess what i'd like to speak about is from the complexity of the operation you're trying to do to bring about one of the things that we've got in georgia is we have a more simple format i think for running the election because we do not have voted verifiable well one of the issues i actually was charged with running the manual recount so i have some experience with that too i want to see it being done because being talked about in our state one of the concerns that i have and i think we all should look back to is you know who are the people are going to be putting this stuff and operation on election day i mean you know it's typical we have done things you you see it we don't have we have part time people who are volunteers who really try to do things but they've gotten up at four o'clock in the morning five o'clock the morning had gotten there they have to open the machines up they have to do all the other things in ohio with the the path for they had to do other things that we didn't have to do they go through the logic and accuracy testing essentially right there they enter the machines they start him off they do everything they bring the memory cards are that part of the problem was is the memory cards weren't in weren't seated properly that was a problem but the other thing is they had to be responsible for these printers you know in some cases favoring backwards let's let me explore that because i'm taking as a given that we're not going to completely change the way america holds elections i think that's true and and i can remember you know voting when i was still at my parents house and you go down to the quarter and this is lucky who is always ran and you know and it's and it's  retiree's and it's people volunteers it's a wonderful thing but that's the given a lot of states have these verifiable systems california among the missing most as any of them come up with a system  receipt that actually works better than that silly tape that we've seen well i think precinct based optical scan systems are excellent that gives the photo a chance to check for over votes and no votes you you put your ballot through the scanner and  it tells you if there's a problem with it it makes recounts relatively easy or audits relatively easy the voter verifies the ballot by definition because you can look at it and there are ways for blind voters to verify it one possibility is getting some sort of handheld device that that will read it for a blind voter we know that this technology exists another is to allow blind voters to vote using tactile ballots where they insert the optical scan into  and where they can mark the ballots and there's a system out which actually allows them to verify it using a vibrating device which compete for them mr chairman i see my time's expired but i'd just like to note that i think we may have in the future some other way to verify but i just asked mr holt to put me on his bill because i think we need to have  first of all mr shamus refer i'm sorry i didn't have the exact transcript here but said something or other you hate to see outlaw an entire category of machines this legislation doesn't outlaw any particular kind of voting system except on verifiable ones and you said further i think that scare tactics by a minority you hate to see that disrupt the whole process the brennan center for justice new york university law school conducted a study with very distinguished people run revestive mit howard schmidt administration and corporate security expert a number of others said it found quote all three major types of voting systems have significant security and reliability vulnerabilities that pose a real danger to the integrity of national state and local elections the league of women voters not a scary minority says they support quote only voting systems that are designed so that they employ a voter verifiable paper ballot or other paper record said paper being the official record of the voter's intent the report of the or baker commission similarly called for a voter verified paper record random audits and so forth mr chairman i would like to mr chairman i would like to ask that the brennan center report the statement of the national league of women voters and the carter baker report be made a part of the record without objection so ordered thank you so  i would i want to make the point that a number of organizations very responsible organizations with computer scientists involved and so forth have taken a look at this matter and we would do well to look at that miss symons i would appreciate if you would say a little bit more about a c m and the  mr smith and others votes can be lost in a lot of ways they can be lost through minute delay doing the registration lists intimidating voters there are a lot of things that we need to address redo restricting your sensibility at polling places or in the polling booth you know memory cards may not be seated properly we may not recognize that the memory is full before election day is over and paper records mr do little might be illegible or torn or otherwise difficult to use but it has been determined at least as often that redundant electronic memories  have show that there are problems with purely electronic memory so what i would like to ask of the witnesses is would you prefer to have a system where there is no possible way of recovering what happened another is where the electronic vote for whatever reason a poorly seated memory card or something else is wrong and there is no possible way of recovering it or is miss him and points out a well designed system with a paper audit trail where there's at least a reasonable chance of being able to recapture recover what the voters intentions were so i'd be happy to have a quick comment from from the in this country and this statement that i referred to which is in my written testimony was voted on by a c m council passed by a c m council which is the elected ruling body of a c m but they did something unusual not typical for a c m we put the statement was put on the website for members to vote on of those who voted ninety five percent supported the statement of the five percent who would not positive roughly half based on written comments objected to the fact that it wasn't broad enough that it didn't discuss usability issues as well so i would say obviously you never get one hundred percent agreement whenever you get a room full of well i shouldn't say that but scientists often disagree but i would say in this case we're pretty pretty close to a consensus at least within a c m we have a gentleman's time has expired to make brief comments please mr seamus first i just want to respond to a couple of things i i actually didn't make a comment about scare tactics although i believe there was another member of the panel the did i i just said i don't think we should appeal to emotion on this issue i agree that h r five fifty does not expressly outlawed any particular type of voting equipment my point was that the practical effect of that is the outlaws deore machines and the reason that outlaws deore machines is there is no current machine on the market that meets the requirements of the bill and that is usable in individual states along with their requirements for example in pennsylvania there is popular call for a paper trail machine for vendors have come to pennsylvania with their paper trail machine not a single one of them has been able to simultaneously offer a paper trail and meet pennsylvania statutory and constitutional requirements so we can't have one even if we want one the technology is just not there yet  a key issue i think is resiliency things go wrong people make mistakes and we need to have a system that we can trust even when things do go wrong the combination of paper plus electronic records is more resilient than either one would be alone and that i think is the strongest argument for having a paper based verification system thank mr coming in as a last answer i want to make the point to everybody  that my experience is most votes are lost due to voter error not machine error not election official error and i don't know if you looked at my resume but i have about twenty years in the printing business and i've been around a lot of printing machines and copy machines and i can assure you that anything you put paper through will jam at some point in time a vote and i want to say to you i truly believe that in the long term interest of this country it we are still voting the same way we did one hundred fifty years ago you as you mentioned this often down to your little poll at the corner in your precinct our society has changed it's mobile it's around it's moving the ability to incorporate the vote centers ascott doyle in colorado has been working with as a convenience to voters those types of concepts are based on electronic voting you know let's not throw the baby out with the bathwater here and i think what is doing mr mr i think what is doing more damage to voter confidence quite frankly is to people like your distinguished colleague mr conyers publishing reports about the election in ohio that are  fact lists and baseless none of the accusations have been proved those you know we've got to quit this we've got to get this conversation back to an honest debate about this i think the whole panel said how do we work together and move this thing forward and quit the sky is falling kind of thing because i'm here to tell you i think elections given the magnitude of them and i've seen now nine years worth of them two presidential couple of  gubernatorial given what could happen and given the magnitude of this task to run and pretty darn good in this country and i know people all over the country like myself and mr smith that are darn proud they're involved in it and the net effect is we're going to begin to drive those people out of this which is going to make the system more vulnerable than you ever imagine mr cunningham and i sure hope that is accurate what you've said because the voter is not there yet understand the vote even though you folks are and your experts the voter is not there yet and that is the ultimate wand that we must bring truth security to bere i would like for you to get for me whatever documentation you have that suggests voter error is more than a paper error if you have that type of verification of that statement you made have a like too high my point was that most voting error is voter error i thank i thank you for a comment it's a good wrap up we are going to votes in just a few moments and i would just like to make a few closing comments a moment first of all i thank each and every one of you for being here in the audience as well as at the witness table you have contributed immensely to this very important issue there's i wrote and i recognize very clearly since i've served at the local level in the state legislature and now here that the states have an important role local governments have an important role and the federal government has an important role we often say here that the states  experimental apparatus that tests ideas and then the federal government should select from the best of what the states have discovered we did not take the time to do that in the hov and i think that was a mistake we also did not take the time to first set the standards clearly and then allow manufacturers to develop equipment to meet those standards and i think that was a fatal flaw which is i believe created much of the uncertainty that we have i agree totally with the statement someone made never buy the first model of anything but the first model of one automobile just because it precisely fit my needs was a good manufacturer a bad mistake and frankly relieved when the will return because we will build a better system finally i want to comment i've always looked at two aspects here we want to assure every voter that their vote will be counted be counted accurately and voted by other people voting fraudulent only or performing fraudulent acts such as viruses throwing ballot boxes away and so forth i want to make sure every voter is assured of both of those kind of their vote in the surance no one else is going to make it through illegal activity so i'm concentrating on those two not just in this particular issue but in other issues such as the photo id bill that we passed through the house a week ago which i think will also help thank you very much outstanding panel i appreciate all that you've done we do have to go vote and i have a few things to read here a moment i ask unanimous consent that members and witnesses have seven calendar days to submit material for the record including additional questions of the witnesses and for those statements and materials to be entered into the appropriate place in the record and i said if we send you written questions you will image i just wanted to concur with you i have served on the local state and federal level and i do think that we need to revisit haba because it was more or less geared for the federal and we appreciate all of those who have come today those who serve on both the local state and federal thank you mr chairman thank you and having completed our business for today and for this hearing the committee is hereby