(1)

ELECTRONIC VOTING SYSTEM SECURITY 

WEDNESDAY, JULY 7, 2004

HOUSE OF REPRESENTATIVES, 

COMMITTEE ON HOUSE ADMINISTRATION, 

Washington, DC. 

The committee met, pursuant to call, at 11:00 a.m., in room 

1310, Longworth House Office Building, Hon. Robert W. Ney 

(chairman of the committee) presiding. 

Present: Representatives Ney, Ehlers, Mica, Larson, MillenderMcDonald, and Brady. 

Also Present: Representatives Hoyer and Holt. 

Staff Present: Paul Vinovich, Staff Director; Matt Petersen, 

Counsel; Payam Zakipour, Professional Staff Member; George 

Shevlin, Minority Staff Director; Charlie Howell, Minority Chief 

Counsel; Matt Pincus, Minority Professional Staff Member; Catherine Tran, Minority Professional Staff Member; Thomas Hicks, 

Minority Professional Staff Member; and Kellie Cass-Broussard, 

Minority Professional Staff Member. 

The CHAIRMAN. The committee will come to order. I am going to 

begin my opening statement. Mr. Larson is on his way and we have 

Mr. Ehlers. The committee is meeting today to discuss electronic 

voting system security, an issue that has garnered extensive media 

attention and produced impassioned opinions on all sides in recent 

months. Hopefully, this committee hearing will be able to shed 

some light on a matter that has certainly generated plenty of intense heat across the Nation. After the controversial presidential 

election of 2000, in which the term ‘‘hanging chad’’ became part of 

the national lexicon, Congress enacted and President Bush signed 

the Help America Vote Act, known as HAVA, to help restore the 

American public’s confidence in the Federal electoral process. The 

goals of HAVA are simple: to ensure that all eligible Americans 

have an equal opportunity to vote and have their votes counted, to 

protect against legal votes being cancelled out by illegal votes, basically making it easier to vote and harder to cheat. 

To accomplish these objectives, HAVA established new voter 

rights providing for second-chance voting, provisional ballots and 

enhanced access for individuals with disabilities; specifies new voting standards, requires each State to implement a computerized 

statewide voter registration database; and requires each polling 

place to publicly post certain voting information, such as sample 

ballots, instructions regarding provisional ballots and polling place 

hours. To address issues relating to the security of voting technologies, HAVA creates the Technical Guidelines Development 

Committee (TGDC) chaired by the director of the National Institute 

2

of Standards (NIST) to aid the Election Assistance Commission in 

crafting standards and guidelines to ensure the integrity of computer technology being used in current voting systems. Furthermore, HAVA provides for the testing and certification of voting system hardware and software in accredited laboratories. 

Following HAVA’s passage, many jurisdictions began making 

plans to replace outmoded voting machines with the latest and 

most technologically advanced electronic voting equipment. These 

direct recording electronic (DRE) voting systems have been widely 

touted as easier for voters to use, thus resulting in fewer spoiled 

ballots, and, unlike most other voting systems, are capable of allowing individuals with disabilities to vote in a private and independent manner, sometimes for the first time in their lives. 

Not everyone is excited about the prospect of widespread electronic voting, however. Over the last year, several technology specialists, concerned citizens, and media outlets have raised serious 

concerns about the security of DRE voting systems. These critics 

contend that DREs contain insufficient safeguards to protect 

against potential efforts by malicious software programmers or 

computer hackers to skew the results of an election. Moreover, the 

critics argue that DRE malfunctions or technical glitches could result in scores of votes being lost without any possibility of retrieval. 

To address concerns surrounding the security of electronic voting, 

a number of different bills have been introduced this Congress that 

would require DRE voting systems to produce a voter verified 

paper record—a paper receipt listing the choices made by the voter. 

I have not supported any legislative proposal as of today that 

would amend HAVA to require DREs to produce paper receipts. As 

I expressed in a Dear Colleague letter co-signed by my friend Congressman Steny Hoyer and by Senators Mitch McConnell and 

Christopher Dodd, I believe it would be premature to amend HAVA 

at this time before the new law has been fully implemented. Doing 

so could undermine the process established by HAVA for the EAC 

to develop standards and guidelines for voting systems security. 

My reservations about amending HAVA to require paper receipts, however, in no way lessens my interest in assuring that 

DRE voting systems meet the most rigorous security and operational standards. The American people demand and deserve a voting process in which they can have full confidence, and I will do 

everything in my power to guarantee that they do. 

For this reason, the committee has called today’s hearing to hear 

from a wide range of technology specialists and election administrators to learn more about the issues relating to voting system security. Over the course of the hearing, we will gain a greater understanding about the security measures that DRE voting systems 

currently have in place and whether they are sufficient to protect 

against hackers and technical malfunctions. In addition, we hope

3

to learn more about whether voter verified paper trails are necessary to protect the integrity of the voting process or whether 

there are other alternatives that can be used. So I look forward to 

hearing from the witnesses and I will yield to our ranking member. 

[The statement of Mr. Ney follows:]

4


Insert graphic folio 6 97366A.001
5


Insert graphic folio 7 97366A.002
6

Mr. LARSON. Thank you, Mr. Chairman. I would like to thank 

you for calling this second of two hearings on a very important 

topic of elections. The 2000 presidential elections brought to light 

many problems with the elections process. We heard reports of 

wide range of voting frustrations, most common were punch cards 

with hanging and pregnant chads and voters who were turned 

away from the polls without being given the opportunity to cast a 

ballot. 

This committee has worked tirelessly to enact the Help America 

Vote Act as a solution to these and other election concerns. As a 

result of HAVA, $650 million was provided to the States to replace 

lever and punch card machines for more modern voting equipment. 

HAVA does not mandate the type of voting equipment a jurisdiction must use. The decision is left to the States. A few States have 

opted to require, as the chairman has pointed out, direct recording 

electronic machines to replace lever and punch card voting equipment. DREs have been in use for elections for over 20 years. According to the 2001 MIT Cal Tech study, DRE machines have a 

lower residual rate than punch card, lever and optical scan machines. DREs are also fully accessible to disabled voters and they 

can be modified to the language of voters who may not be proficient 

in English. An increase ballot font-sized component of the machines 

can assist voters with vision difficulties as well. 

Although some view DRE machines as a panacea for Election 

Day problems, several computer scientists and advocates have 

called for a return to paper ballots. I am interested in hearing the 

witnesses’ thoughts on the practicality of implementing a paper 

trail, and if they believe there is a security problem with DRE machines; and if so, is a paper trail the best answer. 

In addition, I would like them to discuss if human factors are 

being addressed within DRE machines. Is the answer to most of 

these perceived problems better training for poll workers? I read 

about the unplugged machines and inadequate training for the 

process involved in restarting the machinery. But the bigger issue 

to explore is if electronic voting system security is the most significant problem facing this election or is there a more pressing issue 

facing us in this election. The MIT Cal Tech study also stated that 

difficulties with registration were the number one problem with the 

2000 elections. 

Between 1.5 and 3 million voters were turned away from the 

polls without casting a ballot on Election Day 2000. I would like 

the second panel of today’s witnesses to highlight the steps that are 

being taken to ensure that all aspects of HAVA are being followed 

in order for the American people to have the best election possible 

this November. My concern is that all of the attention that is being 

given to voting security will inadvertently suppress voters coming 

to the polls if they feel their votes will not count; what steps election officials are taking to fix registration problems; will they have 

enough provisional ballots for the voters. 

Two-thirds of the public will vote on the same type of equipment 

they used in the year 2000. I would like the second panel to review 

what is being done to ensure that all the voting equipment is secure; what steps are being taken to inform the public that DRE 

machines are counting ballots correctly. I am also interested in 

7

hearing the witnesses’ assessment of the New York Times’ editorials calling into question the views and actions of the Senior 

Senator from Connecticut and one of the chief authors, Chris Dodd 

and Jim Dickson, the Vice President of Governmental Affairs for 

the American Association of People with Disabilities who are trying 

diligently to improve the election process. 

Mr. Chairman, I want to thank you and also note that we have 

two distinguished colleagues joining us today, both the co-author 

with you of the HAVA bill here in the House, my distinguished 

leader Steny Hoyer, and probably one of the most knowledgeable 

people in the House, and I dare say the country, with respect to 

the issue of electronic voting and paper ballots, Rush Holt, a scientist and physicist, as Mr. Ehlers likes to point out, and a fivetime jeopardy winner as well. 

So we are graced by their presence and I thank the panelists as 

well because this is such an important and critical issue to each 

and every one of us here today. 

[The statement of Mr. Larson follows:]

8


Insert graphic folio 12 97366A.003
9


Insert graphic folio 13 97366A.004
10

The CHAIRMAN. I guess the ranking member Congress is insinuating that Congress is a little bit like jeopardy? 

Mr. Ehlers. 

Mr. EHLERS. Thank you, Mr. Chairman. And thank you for having this hearing on a very important topic. It has reached the popular press. There is an article in PC World this month entitled ‘‘Is 

E-voting Safe?’’ so obviously, people are beginning to worry about 

it and their conclusion is, as many of us have concluded, not totally 

safe. We clearly have to do a better job of ensuring the security, 

reliability, usability and verifiability of electronic computers in voting. And I don’t want to go into all the details, but I am very concerned as someone who has programmed computers and who understands how one could hack these or change results or flip votes, 

as the case may be. 

This clearly is an area of concern. The closed source code is one 

of the problems, because something may have been inserted in the 

source code, which would allow a flipping of votes. But there are 

many other problems and issues that have to be addressed as well. 

So I thank you for holding this important hearing. I look forward 

to hearing from the witnesses, some of whom I have heard from before. And I hope that we learn something from it. Let me add one 

other factor. One of the biggest disappointments in HAVA to me 

has been the lack of funding for the National Institute of Standards 

and technology to set the standards. And once again, we are going 

to have a bill on the floor today, which does not provide funding 

for the National Institute of Standards and Technology to set the 

standards and make—and to me that is one of the most important 

things we should be doing because we have to be concerned that 

these machines work properly, that they are not tinkered with, 

that there is no fraud, either intentional or accidental that is taking place. 

And so I hope with the assistance of Mr. Hoyer, who is on the 

Appropriations Committee and some of my other friends, that we 

can change this as the appropriations bill goes through the process 

and provide adequate funds for the National Institute of Standards 

and Technology to lend its expertise to this issue. I yield back the 

balance of my time. 

The CHAIRMAN. I would note the gentleman, Mr. Hoyer—and we 

set this last hearing on the overall issue—has been diligent. And 

when we put this bill together—I am speaking we, everybody—we 

didn’t want an unfunded mandate. And we have had parts of the 

funding due to Mr. Hoyer’s diligence and the Speaker and other 

people who have been active on this, such as Senator Dodd and 

Senator McConnell. But there is more to do. And as we said at the 

last hearing, it has to happen. It just absolutely has to happen. Mr. 

Brady. 

Mr. BRADY. Thank you, Mr. Chairman. I do want to recognize 

and thank our leader, Steny Hoyer for being here and keeping up 

his participation and his interest. And it is also enlightening to accommodate a fellow member, Mr. Rush Holt that asked to speak, 

but I also have to respect our chairman and ranking member who 

would have this place filled up with 430-some of us that all want 

to talk on this issue. I have to recognize the knowledge that you 

have in this field and also the bill you have in front of us and you 

11

experienced it firsthand in your election. And I do appreciate your 

participation and your interest. Thank you, Mr. Chairman. 

The CHAIRMAN. Mr. Mica. 

Mr. MICA. Thank you, Mr. Chairman, and I thank you for holding this hearing. Our Committee on House Administration has an 

important responsibility to see that our election system works. 

Quite frankly, I am a bit frustrated by our continuing to throw 

money at some of these problems. I have always viewed the elections responsibility as that of State and local with Federal participation where we can assist. One of the things we don’t have any 

problem with in Congress is throwing huge amounts of money at 

problems. And I think we started off with $3.9 billion for this program. And we have adopted some systems, for example, electronic 

voting and also optical readers replacing punch cards that were 

used in Florida and other places and lever voting equipment. With 

new technology like cell phones—— 

The CHAIRMAN. Was that the President? 

Mr. MICA. Actually, I have very strict instructions. It could have 

been the President. But it wasn’t, it could be the Secretary of 

Transportation. I am heavily involved with issues there. But the 

most important person is my septic tank operator. 

The CHAIRMAN. We will move on with the topic. 

Mr. MICA. In our business you have to put things in priority. 

But, again, we spent a lot of money. I did not support this, the act 

or the huge amount of money that we threw at the problem. In 

Florida, I participated in some of the recount. And I saw that in 

one of my counties, we had optical readers which we are spending 

a portion of this billions of dollars to replace punch cards and also 

lever, old lever equipment, which actually don’t work that badly 

when you look at some of the problems we have seen with the newest equipment. But I remember looking through hundreds of ballots. And the optical reader is a very simple thing. It has an arrow 

like this and you just fill in this little space here. 

Now that seems like a pretty darn simple thing to do. And I am 

telling you, hundreds of people—they circled entire areas. They x’d 

down through. They destroyed a ballot. Unfortunately, I think 

what you need is a more intelligent electorate. So we are replacing 

this equipment—we are replacing this equipment now and there is 

less than 1 percent error rate improvement in putting these machines in, and we have got the electronic equipment that this hearing is about. We found now we are buying this very expensive electronic equipment. And I think it was in Virginia, the dummies 

didn’t plug the machines in. So now we have to pay for training 

courses to plug these in. 

My cell phone just went off and having been in the communications and cellular business, I know all the problems you can have 

with electronic equipment. And I can tell you we will be back here 

to fund auxiliary power units to ensure that the backup to run the 

paper trail or the electronic equipment that was to replace the 

equipment that we just spent other money on. So I would like to 

see the system work. Some of the best equipment is actually the 

lever equipment, the most primitive, but some of the most accurate 

that was ever produced and we are replacing it, again, at great expense. 

12

So I am discouraged that we have spent a lot of money on a system that doesn’t work. I think we have got to do a much better job 

of educating people. And no matter what system you put in place, 

you are going to have problems in the future. And there will be 

people who will use that equipment, whatever we put in and misuse it and their vote will not be counted. It has been that way. It 

is that way. And it will be that way. So I thank you for holding 

this hearing and I hope without spending too much hard earned 

taxpayer money, we can find some solutions that work. Thank you. 

The CHAIRMAN. Thank the gentleman. On the first panel, we 

have Dr. Avi Rubin, Professor of computer science at Johns Hopkins University; Dr. Brit Williams, professor of computer science 

and information technology at Kennesaw State University; 

Tadayoshi Kohno, computer security expert with the computer 

science and engineering department at the University of California 

at San Diego; and Dr. Michael Shamos, Professor in the School of 

Computer Science at Carnegie Mellon University. I want to welcome all of you to the Hill. 

STATEMENTS OF AVI RUBIN, PROFESSOR OF COMPUTER 

SCIENCE, JOHNS HOPKINS UNIVERSITY; DR. BRIT WILLIAMS, 

PROFESSOR OF COMPUTER SCIENCE AND INFORMATION 

TECHNOLOGY, KENNESAW STATE UNIVERSITY; TADAYOSHI 

KOHNO, COMPUTER SECURITY EXPERT, COMPUTER 

SCIENCE AND ENGINEERING DEPARTMENT, UNIVERSITY OF 

CALIFORNIA AT SAN DIEGO; AND DR. MICHAEL SHAMOS, 

PROFESSOR, THE SCHOOL OF COMPUTER SCIENCE AT CARNEGIE MELLON UNIVERSITY 

The CHAIRMAN. And Dr. Rubin, we will start with you. 

STATEMENT OF AVI RUBIN 

Mr. RUBIN. Good morning, Chairman Ney, Ranking Member 

Larson, and members of the committee. My name is Avi Rubin and 

I am a computer science professor at Johns Hopkins University. I 

am going to start with two things that may surprise you in order 

to highlight the points that I think are important. I am not fundamentally against electronic voting. The second is that a DRE retrofitted with a paper trail is not necessarily the best kind of voting 

machine that we can have. There are ways to design and build systems so that those who make and those who administer the machines will have a tough time cheating. 

Today, DREs are not being produced this way. The advantages 

of a well-designed system is that they do not require complex procedures in order to ensure security. They take control of the outcome out of the hands of the manufacturers and the vendors and 

they take into account the needs of users including special needs 

users. The elements of such a system are transparency in the form 

of open code, so people can see what is going on inside of a machine. Independent audit, that is an audit that is not controlled by 

the designers of the system peer review, which is fundamental to 

computer security and usability system to make sure everybody 

who needs to use the machine can use it and it is designed appropriately. There are many attractive features of DREs that are often 

touted: Accessibility for those who do not speak English as the priVerDate jul 14 2003 04:20 Jan 25, 2005 Jkt 097366 PO 00000 Frm 00012 Fmt 6633 Sfmt 6602 E:\HR\OC\A366P2.XXX A366P2
13

mary language or for blind people; user friendliness of the machines; the ability to catch undervotes and warn the voter and the 

ability to prevent overvotes and the results are available immediately. 

If I were given these requirements and asked to design a voting 

machine with these properties, it would not be like today’s DREs. 

My focus is always security, but you can achieve all of the properties that I just mentioned much more securely. 

Here is how I would design a voting machine. The machine 

would be as accessible as a DRE. It would be as user friendly. It 

would warn about undervotes. It would prevent overvotes. But 

there would be some big differences. Meaningful recounts would be 

possible, it would be incredibly difficult for a vendor to rig the election, and voters would be able to have confidence in how their vote 

was recorded. 

Now the interface, as far as a voter is concerned, would be the 

same as a DRE, but I would name the machine a ballot preparation machine. You walk up to the machine, and you have exactly 

the same experience you would with a DRE. You touch all your selections, but at the very end of the experience, instead of ‘‘cast 

vote,’’ you would push ‘‘print ballot,’’ and the machine would output 

a card maybe similar to a boarding pass you would get at the airport these days or, if there were a lot of choices, maybe it would 

be an 8-by-10 card and that would be the ballot. 

The voter would review the ballot to see if their markings and 

their choices corresponded to what they intended; and, if it did not, 

there would be a shredder available to shred that and they could 

do it again. Perhaps they made a mistake or perhaps something 

was wrong with the machine. In either case, it would be good to 

know that. 

Now we have a separate problem on our hand, a completely separate issue, which is how do we count the ballots. Some places say, 

well, we have these paper ballots. We have had a simple election. 

Let us count them by hand. Other places may say our ballots are 

too complicated. What we can do is feed them into a completely different unit which would be an optical scanning unit that could read 

it in and count the votes. 

You may say, well, that is a computer, too. I would respond I am 

not opposed to electronic voting. The difference is if you optically 

scan these things, you are dealing with a much simpler machine. 

It could be several hundreds lines of codes, could be open source 

and at the end of the day you have the ballots. 

Let me stress the big difference between a DRE with a—versus 

the kind of machine that I am describing. In the kind of machine 

I am describing, there is only one authoritative ballot, and that is 

that piece of paper. In a DRE that you retrofit with a verifiable 

paper trail, which is better than a DRE without it, but you have 

the issue of having two different votes. Do you count the electronic 

ones? Do you count the paper ones? I think there should only be 

an authoritative paper ballot, but we can utilize computers to create that ballot, and we can utilize computers in order to count 

those ballots and utilize the paper to check that count. 

I am quickly running out of time, so let me draw an analogy, and 

I started about 10 seconds late. The grading system we use to turn 

14

in our grades at Johns Hopkins is done over the Internet, but it 

was done with security in mind. And I am perfectly happy at the 

end of the semester uploading my grades to a central server at 

Johns Hopkins, even though, considering you have a bunch of computer science students who might try to hack the system, it is a 

lot less work to do that than to work for a grade in all your classes. 

Why am I willing to do this? Because the following semester, direct from the Registrar’s Office, hand walked to me by the secretary, is a paper with grades on it that were recorded; and I get 

to compare them to the grades that I submitted and say, did anybody alter these grades, have they been tampered with? And I 

know that, if they have, I will catch that. 

In DREs, we don’t have a catch like that. The only point at 

which we can perform an audit which the voter can verify that the 

vote was recorded correctly is when they are voting and they have 

to have an ability to look at the actual ballot and say that is how 

I voted. Thank you. 

The CHAIRMAN. Thank you, Doctor. 

[The statement of Mr. Rubin follows:]

15


Insert graphic folio 27 97366A.005
16


Insert graphic folio 28 97366A.006
17

The CHAIRMAN. Dr. Williams. 

STATEMENT OF BRIT WILLIAMS 

Mr. WILLIAMS. As you mentioned in your remarks, after the 2000 

election, a group of political activists began to attack the direct recording systems, claiming that they are totally unsecure, that they 

can’t be made secure and the only way you can make them secure 

is with the addition of a verified paper ballot. When this was 

picked up by some of my fellow computer scientists, it gained attraction in the media. 

The claim is that we cannot build a secure voting system. Now 

a DRE voting system—or any voting system, for that matter—but 

a DRE voting system is one of the simplest computer applications 

you can imagine. The main line is to recognize a touch on a particular location on a screen and add one to the appropriate register. 

That is it. It doesn’t do any complex computations, doesn’t take the 

logarithm or the trigometric functions of anything. It doesn’t do 

square roots, doesn’t multiply or divide. And to claim that we can’t 

build a secure accurate system just flies in the face of the way we 

live our lives. We fly on airplanes that are controlled by computers. 

Our sailors go under the ice cap on submarines controlled by computers. We have been to the moon and back on spacecraft controlled by computers. On a less grandiose scale, our cars, our 

microwaves, our watches are controlled by computers. 

I am not saying we should not attempt to improve our computer 

systems. We should. And I like Dr. Rubin’s system and I look forward to it, but we have to deal in the short term with what we 

have on the shelf right now. And there are many dimensions to a 

voting system other than just security. We have to look at availability, reliability, maintainability, usability and even affordability. 

Any change to the voting system, particularly something as drastic 

as adding paper receipts or paper ballots, needs to be evaluated in 

terms of the total voting system, not just the security aspects of it. 

Now this—your HAVA legislation created the Election Assistance 

Commission system and gave them the resources and the authority 

to approach this in a very orderly and systematic manner, and I 

sincerely hope they will be allowed to do that. 

Now we don’t believe that we are in imminent danger. We think 

in Georgia that our voting system is both accurate and secure. We 

have measures in place to ensure that the voting system components, the computer components are as accurate and secure as current computer technology permits. We have physical security measures and the essential ingredients in DRE systems in place to compensate for the remaining vulnerabilities in the system. These are 

discussed in our written report, and I won’t go into them here. 

We have a Center For Election Systems at Kennesaw State University that provides technical assistance and training to our 159 

counties. Before any piece of equipment can be used in an election 

in Georgia, it has to be examined by members from this center. 

And, in addition to this testing, we now, out of the center, offer 

training for election managers, for new election poll workers and 

for board members, election board members. 

So let me close by pointing out that we do not live in an absolute 

world, that everything we do contains a certain amount of uncerVerDate jul 14 2003 04:20 Jan 25, 2005 Jkt 097366 PO 00000 Frm 00017 Fmt 6633 Sfmt 6602 E:\HR\OC\A366P2.XXX A366P2
18

tainty. When we fly on an airplane, we know there is a remote possibility that we won’t live to reach our destination. When we drive 

our cars, we know there is a possibility we won’t reach our destination. We evaluate the risk and the advantages, and we make a decision. 

Now we do the same thing with our election in Georgia. We know 

when we conduct an election that there is a remote possibility that 

someone has altered that election in an attempt to defraud or disrupt the election. But we also know the diligence with which we 

maintain and protect the system and we know that we reduce that 

risk to a miniscule level. 

In our written report, we point out that we think that we can detect an alteration of that system with a chance of less than one in 

one billion. So with that kind of a risk, we are willing to go ahead 

and hold our election with a voting system that allows a business 

person to vote on their lunch hour very quickly and easily, that 

provides the elderly and infirm with a voting interface that does 

not require difficult manipulation, that allows a non-English-speaking voter to vote in their native language, that allows disabled voters to vote unassisted, many of them for the first time, that reduces 

the rate of incorrectly marked ballots by a factor of five and provides a level of accuracy that exceeds any voting system that has 

previously been used in the State of Georgia. 

Now no one that is involved in elections would come before you 

and claim that the current systems are the best that can be devised 

or suggest that we can’t make improvements. We have a culture of 

continuous improvement, and we applaud people who offer reasonable, well-reasoned criticism and who have carefully considered recommendations for improvement. 

I thank you for this opportunity to speak to you, and may God 

bless America. 

The CHAIRMAN. Thank you. 

[The statement of Mr. Williams follows:]

19


Insert graphic folio 34 97366A.007
20


Insert graphic folio 35 97366A.008
21


Insert graphic folio 36 97366A.009
22


Insert graphic folio 37 97366A.010
23


Insert graphic folio 38 97366A.011
24


Insert graphic folio 39 97366A.012
25


Insert graphic folio 40 97366A.013
26


Insert graphic folio 41 97366A.014
27


Insert graphic folio 42 97366A.015
28


Insert graphic folio 43 97366A.016
29


Insert graphic folio 44 97366A.017
30


Insert graphic folio 45 97366A.018
31


Insert graphic folio 46 97366A.019
32

The CHAIRMAN. Mr. Kohno. 

STATEMENT OF TADAYOSHI KOHNO 

Mr. KOHNO. Thank you, Chairman Ney and Ranking Member 

Larson and members of the committee, for holding this hearing 

today and for inviting me to speak on the topic of electronic voting 

security. My name is Tadayoshi Kohno, and I am a computer security expert with the University of California at San Diego’s Department of Computer Science; and prior to joining the University of 

California for Doctor studies, I was a cryptography and computer 

security expert with two of the top cryptography and security consulting firms in the Nation. 

Last summer, together with three other colleagues, I identified 

a number of security problems with Diebold’s Accuvote TS electronic voting system. But I think that the most important result of 

our discoveries was that it concretely shows the existing certification processes are unable to identify security problems with electronic voting machines, and what this means is we have no reason 

to believe that other vendors’ electronic voting machines are any 

more secure. 

But what I would like to talk about with you today is why I, as 

a computer security expert, am deeply concerned about the use of 

existing paperless electronic voting systems. I want to emphasize 

that I am talking about existing paperless electronic voting machines because, you know, there might be the possibility of having 

secure enough paperless electronic voting machines in the future. 

I say ‘‘secure enough’’ because there is no such thing as absolute 

security. We don’t have those machines today and won’t have them 

by November, and let me expand on this. There are several reasons 

for this. 

First, many people have suggested patching the existing systems, 

maybe by changing the software slightly or instituting new procedures. But this is not sufficient. 

First, an analogy I always like to make is that spot treating security problems is like spot treating termites. You can never be sure 

that you have gotten rid of them all. And this is particularly important because when you hire a security analyst to look at the security of a system, you typically contract them for a limited period 

of time, and in that limited period of time they might only uncover 

the most obvious security problems. And while addressing the obvious security problems might raise the bar for an attacker, it doesn’t 

mean you have addressed all the important problems. 

Another thing that I want to point out is that unless all the components of the revised system, including the software and the revised procedures, are open to the public for public scrutiny and review, the public will have no reason to believe that the spot treatment actually succeeded in addressing the security problems; and 

I think this is illustrated most beautifully by the evolution of 

Diebold’s Accuvote TS system. It is the system that we know the 

most about because it is the one that was analyzed publicly. 

In response to our analysis, the State of Maryland hired SAIC 

and then RABA to conduct independent analyses of Diebold systems; and in both ours and SAIC’s analyses we found that the 

Diebold system found a security problem in the way that the 

33

Diebold voting terminals communicate with a back end server. 

Diebold tried to fix this problem. And then, in RABA’s subsequent 

analysis, RABA found that Diebold’s fix was insufficient. 

I think the important lesson from this is that there are two 

points: One is that if Maryland had not commissioned RABA to 

conduct a subsequent analysis of Diebold’s supposed fixes to our report, no one except for maybe an attacker would have uncovered 

Diebold’s insufficient fix of the problems we identified. And I think, 

at a higher level, the thing I want to say, this begs the question. 

First, for systems the public cannot openly review and inspect, how 

or when can we know that a security problem has been accurately 

addressed? 

I think in the remaining minute or so that I have that I would 

like to talk—I would like to advocate the following general principle; and that is, from a security perspective, the minimum requirement we should have for any new voting technology, it doesn’t 

have to be computer technology, but the minimum requirement for 

any new voting technology is that it must be at least as secure as 

the technology that it is replacing. It is for this reason that our 

computer security experts are advocating the use of a voterverifiable paper ballot, where we have the voting machines produce 

a paper ballot that the voter will look at and verify that it is correct and deposit it into the ballot box and that becomes the official 

record. 

People have said that, you know, this has problems, too, because, 

you know, the ballot box could be stuffed, the ballots could be destroyed. But the point is that these are the problems that we already have with traditional paper-based voting mechanisms. By 

adding a voter-verifiable paper trail, we have not made things 

worse. Unfortunately, as a security expert, I cannot say the same 

thing about the use of existing paperless electronic voting machines 

in elections. 

That is all the technical stuff I wanted to point out, but I wanted 

to thank the committee for focusing on this critical issue, and I 

think that the dialogue we are having today will move us forward 

towards addressing all of the security concerns. 

The CHAIRMAN. I thank the gentleman for your testimony and 

the previous two witnesses. 

[The statement of Mr. Kohno follows:]

34


Insert graphic folio 53 97366A.020
35


Insert graphic folio 54 97366A.021
36


Insert graphic folio 55 97366A.022
37


Insert graphic folio 56 97366A.023
38

The CHAIRMAN. Dr. Shamos. 

STATEMENT OF MICHAEL I. SHAMOS 

Mr. SHAMOS. Mr. Chairman and members of the committee, my 

name is Michael Shamos. I have been a faculty member in the 

School of Computer Science at Carnegie Mellon University in Pittsburgh since 1975. I am an attorney admitted to practice in Pennsylvania and before the U.S. Patent and Trademark Office. 

From 1980 to 2000, I was statutory examiner of computerized 

voting systems for the Commonwealth of Pennsylvania. From 1987 

until 2000, I was statutory examiner of computerized voting systems for the State of Texas. During those 20 years, I examined over 

100 different voting systems. These were used to count over 11 percent of the popular vote in the United States during the 2000 election. 

I view electronic voting as primarily an engineering problem to 

be solved through traditional scientific methods. Once standards 

are set for the degree and type of risk we are willing to accept in 

such systems, engineers can determine whether a particular system meets those standards. The tolerable risk can never be reduced 

to zero. No system of any kind ever developed for any purpose has 

been completely free of risk. The issue is not to eliminate it but to 

quantify and control it. It may be a difficult pill for the voters of 

the United States to swallow, but it is true nonetheless and always 

will be that some votes are lost, miscounted or never are cast in 

every election and this will always be so. 

There are many types of DRE machines, and it is incorrect to 

lump them together in a single category. DRE voting is not new. 

It has been used in the United States for over 25 years and has 

been successful, though not perfect, during that time. Many brands 

of DRE systems have exhibited problems, including failure to start, 

freezing up during voting, displaying incorrect candidate names. 

Some possess identified security weaknesses, such as according the 

wrongdoer the opportunity to vote more than once during an election. 

Of course, machines that do not work and are not suitable for 

use in an election should not be used in an election, but this country has no systematic process by which such machines can be pinpointed and kept from the polling place. We need one. Voting machines, like every other machine we rely on in society can be tested 

to determine whether they are reliable. We need such procedures. 

A completely different sort of allegation that is made against 

DRE machines is they can be tampered with undetectably or may 

contain malicious software that no testing procedure or examination would ever reveal. Even the venerable New York Times declared erroneously on April 24 of this year that, quote, it is not 

hard to program a computer to steal an election. It is very hard. 

In fact, there has never been a verified incident in which a DRE 

machine was manipulated to alter the outcome of an election. DRE 

opponents respond, how do you know? Maybe the alteration was 

done so well that we will never find out. That response is completely unscientific. It asks us to believe that which has never been 

seen and which by hypothesis can never be seen. It is a pure article 

39

of faith, which every person is free to accept or reject, but it cannot 

serve as the basis for logical debate. 

I have asked DRE opponents exactly how they would modify a 

machine to influence an election without being detected. This of 

course must be done in such a way that the machine passes all 

tests with flying colors, yet performs its dirty work only during the 

actual election and, furthermore, does so in a way that leaves no 

trace and does not raise undue suspicion, given the political demographic of a particular precinct or jurisdiction. In short, it would 

be the perfect crime. No one has ever come close to giving a credible method by which this could be done. 

When challenged, the response of the opponents is to say, we are 

not obliged to show you how to do it. You have to prove that it can’t 

be done. 

That is not the law. The various States require voting systems 

be safe for use, accurate and resistant to tampering. None of the 

requirements is absolute, and they require judgments to be made 

by responsible officials and bodies. Administrative action is never 

required to be accompanied by a proof that the action is perfect. If 

there were such a requirement, then government would grind to a 

halt. 

The proposal has been made that the variety of problems exhibited by DRE machines can be solved by adding a device that will 

print out a piece of paper containing the voter’s choices so she may 

verify that they correspond to her desired selection. If anything 

goes wrong, the voter has the chance to try again before her vote 

is officially cast. If all is well, the piece of paper is dropped or deposited into a box inside the machine. This proposal is embodied 

in several bills before Congress and at least one that is currently 

before this committee, Representative Holt’s bill, H.R. 2239. 

The argument goes that we receive paper receipts when we buy 

things, use an ATM machine or play the lottery, so why should voting be any different? The answer is simple. In commercial transactions, the paper is simply a piece of evidence. It is not an incontestable, self-proving document. Even a lottery ticket will not be 

awarded a prize if it does not match the electronic records of the 

central lottery computer. The H.R. 2239 proposal is to make the 

paper records supreme, something that we do not do in the commercial world. 

If paper were in any way safer than electronic methods, then the 

whole bill might make sense. But it is not safer or better. This is 

a case in which the cure is worse than the disease. This country 

has a long and sorry history of vote tampering involving paper ballots. Since 1852, the New York Times has published over 4,000 articles detailing numerous methods of altering results of elections 

through physical manipulation of paper ballots. On average, one 

article has appeared in the Times every 12 days since it began publishing in 1851. Mechanical and electronic voting machines were 

introduced specifically to eliminate this problem. Any proposal to 

make paper ballots official once again ignores history and therefore 

dooms us to repeat it. 

Adding a paper trail that can be viewed by the voters solves one 

problem and one problem only. It assures the voter that her choices 

were correctly noticed by the machine. It provides no guarantee 

40

that the vote was counted or ever will be counted correctly or the 

paper viewed by the voter will even be in existence at the time a 

recount is conducted. And the paper trail surely does nothing to increase the reliability of a voting machine. If a device won’t start on 

Election Day, then adding a printer does not increase its chances 

of working. 

Paper trail proponents have not bothered to list the problems 

with DRE machines in an attempt to explain how the paper trail 

would solve them because they cannot do so. They have not explained why the paper trail would not be vulnerable to well-known 

and well-documented methods of tampering the paper ballots, for 

they cannot do so. All of the problems with DRE machines have solutions. None of the solutions requires a paper trail. I have given 

specific alternatives in my rather lengthy testimony, and I thank 

you for the opportunity to speak today. 

The CHAIRMAN. We will accept the gentleman’s testimony as all 

other individuals appearing here today for the record. Very frankly, 

fascinating testimony by I think all four of you. 

[The statement of Mr. Shamos follows:]

41


Insert graphic folio 63 97366A.024
42


Insert graphic folio 64 97366A.025
43


Insert graphic folio 65 97366A.026
44


Insert graphic folio 66 97366A.027
45


Insert graphic folio 67 97366A.028
46


Insert graphic folio 68 97366A.029
47


Insert graphic folio 69 97366A.030
48


Insert graphic folio 70 97366A.031
49


Insert graphic folio 71 97366A.032
50


Insert graphic folio 72 97366A.033
51


Insert graphic folio 73 97366A.034
52


Insert graphic folio 74 97366A.035
53


Insert graphic folio 75 97366A.036
54


Insert graphic folio 76 97366A.037
55


Insert graphic folio 77 97366A.038
56


Insert graphic folio 78 97366A.039
57


Insert graphic folio 79 97366A.040
58


Insert graphic folio 80 97366A.041
59


Insert graphic folio 81 97366A.042
60


Insert graphic folio 82 97366A.043
61


Insert graphic folio 83 97366A.044
62


Insert graphic folio 84 97366A.045
63


Insert graphic folio 85 97366A.046
64


Insert graphic folio 86 97366A.047
65


Insert graphic folio 87 97366A.048
66


Insert graphic folio 88 97366A.049
67

The CHAIRMAN. One point I would like to make. Historically 

speaking, any time there has been manipulation or suggested manipulation of a voting system, it has involved paper ballots. You basically suggested that the paper receipts will not, in fact, bring 

forth the security that their advocates promise. Do you have any 

details about what you believe would be the shortcomings of paper 

receipts in trying to resolve the DRE security-related issues? 

Mr. SHAMOS. The issue with paper receipts and my problem with 

them is that there is no guaranteed chain of custody from the moment the voter looks at the piece of paper and says, yes, this is my 

vote. From that moment until the time that piece of paper has to 

be touched or reviewed by other people, there is no way of assuring 

that the pieces of paper have not been removed from the box, new 

pieces of paper have been added to the box, that the pieces of paper 

have not been altered, et cetera. And it is impractical with 1.4 million poll workers we have in this country, most of them volunteers, 

to have any kind of systematic system where we can ensure that 

from the time the voter sees the piece of paper until the time it 

is reviewed that nothing has happened to it. That is the problem 

we have had when there is a physical paper ballot of any kind, 

whether it is punched card or paper. 

The CHAIRMAN. Dr. Rubin, the chairman of the EAC and other 

groups such as Brennan Center For Justice have issued recommendations for ensuring the security of the DREs, as you know. 

You are involved with the Brennan study, I am told. 

Mr. RUBIN. I was asked to read, review it and comment on it, 

yes. 

The CHAIRMAN. Do you have any further comments on that study 

or can you describe more about the security practices and how they 

protect the process? 

Mr. RUBIN. I was asked to comment on this and then to participate in a press conference to publicly comment on it. Initially, I 

hesitated to do that, because I was worried about an endorsement 

of these recommendations appearing to—or being misconstrued to 

be an endorsement of paperless DREs. What in fact was intended 

was that, no matter what I say or anyone else says, there are people going to be voting on paperless DREs in November. And for 

those election officials, what advice can we offer? Rather than just 

saying everyone is in trouble, can we do something constructive? 

And under those assumptions, they came up with recommendations 

that I think are very good: hiring security reviews, setting up a 

group that would supervise the security reviews, some ideas for 

testing; and, you know, the recommendations are available for the 

public. 

I think that while I would strongly advocate against using 

paperless DREs, I am not going to be naive enough to ignore the 

people that are using them. So I would recommend that those recommendations be followed in those cases. 

The CHAIRMAN. Just one question. Probably not a perfect question for you, but does anybody here believe—that one should be 

able to take those with you out of the—— 

Mr. RUBIN. Take what? 

The CHAIRMAN. A copy of the paper receipt with you out of the 

voting area. 

68

Mr. RUBIN. Absolutely not. The problem with that is that two 

things could happen. One is you have the opportunity to sell your 

vote if you can show someone how you voted, and the other is you 

could be coerced to vote a certain way. The idea behind the paper 

is that you have some tangible record of how the person voted, but 

if you take it out of the polling place with you, you haven’t actually 

voted. 

Mr. SHAMOS. Mr. Chairman, there are systems in which the 

voter is given some form of receipt but that receipt cannot be used 

to prove how he voted. It is possible for him to verify that that particular ballot was actually counted in the election. In general, it is 

not possible to remove from the booth any piece of evidence that 

you would be able to use to prove how you voted. 

The CHAIRMAN. Anybody else have any concerns still about the 

issue of your vote being secret? That is a huge issue or being able, 

frankly, to vote in secrecy. But out comes the paper—because, Dr. 

Shamos, you mentioned something interesting, a chain of custody. 

What happens with that? Dr. Rubin, would you like to respond? 

Mr. RUBIN. I will say one thing about the secrecy. I believe it is 

the property of secrecy that makes this problem so hard. When we 

talked earlier about commercial transactions and all different kinds 

of transactions where we have paper, the difference between voting 

is that imagine trying to audit somebody’s bank account without 

knowing which person performed which transaction. In an election, 

we have a secret ballot, and it is a privilege, and we decouple the 

voter from their vote. That makes auditing a lot harder than it is 

in any other application that we know because the very information we keep, which is logging who did what and when, you can’t 

do in an election. 

The CHAIRMAN. You can’t go back and say that this ballot was 

John Smith or Susan Smith’s ballot. 

Mr. KOHNO. If I may extend comments. There are two main requirements of voting machines. One is that the result has the correct integrity, and the other is the privacy. And when people are 

talking about electronic voting machines, the focus has been—most 

people have been focusing on the integrity. 

One of the results of our analysis is that with these electronic 

voting machines it could be the case where an election official or 

a poll worker—I am assuming that most of them are not malicious—but an election official or poll worker could look at the results, the files stored—the results filed on these Diebold terminals 

and figure out who voted for whom if they are watching the voting 

process all day. So I think that, you know, I wanted to throw that 

in as being another problem that I see with electronic voting. 

Mr. WILLIAMS. Not true. The ballot files in that system are randomized. So even if you had your numbered list of voters and you 

knew the order that people voted, you couldn’t correlate that to the 

ballots on the file. And even if they were, it wouldn’t be a one-toone correspondent because, although you may check into the polling place ahead of me, I might cast my ballot before you cast yours. 

So that is not going to be a one-to-one correspondent, regardless. 

Mr. KOHNO. I think we are taking the discussion away from the 

main focus of this hearing, and we can talk about this off line. But 

I think that the important thing—you know, I don’t want to focus 

69

on Diebold, because, unfortunately for them, they are the ones that 

were publicly analyzed. There is a random serial number stored 

with the ballots when they were added and specifically for randomizing them for reporting at the end. But the problem is on the files 

themselves, they were stored in the order they were created. But 

I think, like I said, this is an issue that hasn’t been seen very 

much; and the focus here I think is on preserving on the integrity. 

Mr. WILLIAMS. The problem he is referring to has been changed. 

That was true of the version that they looked at. In the SAIC report in Maryland, one of their recommendations was that those 

files be randomized, and that has been done. 

The CHAIRMAN. I think I not do disagree with you. I think it is 

appropriate—basically what you said is appropriate to the hearing. 

What the gentleman, Dr. Williams, answered is also appropriate. 

Mr. WILLIAMS. The problem that secret ballot creates is that you 

cannot—the voter cannot verify their ballot. There is no way once 

the voter walks away from that voting booth that they can go back 

to that collection of ballots and pull out a ballot and say that is 

mine, because that would violate the secrecy of the ballot. The 

whole concept of a voter-verified ballot is questionable. 

You say, what do we do in a recount? Let us look at lever machines for a minute. When you recount on a lever machine, there 

is nothing to recount. What you are doing is verifying that the machine is operating properly; and the assumption is that if the machine is operating properly, then the count is accurate. Same thing 

with the DRE machine. There is nothing to recount, and you are 

not technically doing a recount in the sense of a traditional recount. What you are doing is that you are verifying that this machine is operating properly. If the machine is operating properly, 

then the assumption is that the results are accurate. 

Mr. RUBIN. I believe that DRE have managed to replicate the 

worse property of lever machines, which is that a meaningful recount is not possible. That is why I was never comfortable with 

lever machines. The nice thing about having the paper ballot, when 

it is time for a recount we know at the very least the thing that 

is being recounted was seen by the voter. We don’t know the order. 

The CHAIRMAN. On that point, I will let you finish. 

Mr. RUBIN. The idea behind a meaningful recount is that the 

things that are being counted are ballots that were seen by the voters, and that is where the term voter verifiable comes in. I don’t 

think it is important whether or not the voter can reach into the 

pile of ballots being recounted and verify theirs. They have to have 

some confidence in the procedures, just like they do in any election. 

But without those paper ballots existing, there is no hope of any 

recount; and I don’t think the solution to hanging or pregnant 

chads is to throw away all the ballots. 

The CHAIRMAN. I want to open this up to questions from other 

members, but you just made a point. The voter sees it, verifies, but 

how does the voter know it was counted? When you are dealing 

with paper, you could stuff a ballot box. Where is the chain of custody of the item? Who is watching all that? I mean, historically in 

this country, any problems we have had have been on the paper. 

If you are saying, wow, the voter gets this and there is my vote and 

I walk away, where did that paper ballot go? 

70

Mr. RUBIN. I believe the chain of custody problem does not go 

away with electronic tallying. We should look at constantly improving the security and not deploying a system that is less secured 

than the one we had before. 

The difference between lever machines and automated computerized machines is that software, if there is a problem with the software, either intentional or accidental—and anyone who has dealt 

with software knows the accidental ones happen all the time—that 

problem is in tens of thousands of machines. And when you program a lever machine, if you make a mistake, that is that one machine. And that is one of the differences between electronic systems 

and mechanical or paper systems, is that the problems are more localized. 

The CHAIRMAN. If we are talking about rigging—that is what we 

are talking about—rigging an election either by manipulating 

paper ballots or by electronic manipulation, you would have to have 

the ability of someone to put a chip or something in every single 

machine and pull it back and put it in the next election and next 

election. 

Mr. RUBIN. Not necessarily. 

The CHAIRMAN. Because it is not like you can hack into these 

things. 

Mr. RUBIN. The biggest concern that I have always had ever 

since our initial report came out is that the person writing the software who is putting together the machine, not that I think they 

are going to do something, but I think they are in a position to.

The CHAIRMAN. For a particular election. They would have to rewrite the software then. 

Mr. RUBIN. Not necessarily. Perhaps they favor a particular 

party. 

One thing I find, if we get mired in a particular attack, if I get 

asked, how would you attack a voting machine, and I come up with 

an answer for that. Then someone says yes, but we could put this 

procedure in place that would prevent it. For every single individual attack I may come up with, someone could have a 

counterargument, but it is hard to design a system that would inherently block all the different attacks one might be able to come 

up with. 

I believe that the difficulty of analyzing software is one thing, 

and I have talked at length about that, but a bigger problem is the 

software isn’t being analyzed. There is no way that the software in 

the Diebold machine that we analyzed was analyzed before it was 

deployed or they never would have deployed that system. 

The CHAIRMAN. Was that system corrected? 

Mr. RUBIN. I don’t know, because they won’t let me have a look 

at it. I believe—they claim that many of the problems that we 

found in the machines have been fixed, but I think, without public 

scrutiny, there is no way to know if that is true. 

The CHAIRMAN. We went from not correcting the machines to an 

issue of paper ballots. I think some people are sincere in this. I 

think some people have made absolutely incredible statements that 

smack of politics. There are conspiracy theoricists, people have 

done this for political purposes and are using this issue, while others are sincere on this issue. But I think the whole thing, frankly, 

71

has gotten clouded because of one company or one statement. I just 

think it has gotten quite clouded. At least today I feel we are hearing a reasonable debate on some of the issues. 

Mr. RUBIN. Let me rephrase the statement, which I think that 

if we have the capability of building voting systems where the vendor does not have an opportunity to rig it, that is better to do it 

than ones where they do have the opportunity, whether or not we 

think they are going to do it. 

Mr. SHAMOS. Mr. Chairman, it is precisely the property of the 

software that is resident in all the machines that makes it feasible 

to test them. If someone plucks one machine out of a polling place 

and alters it, then unless we specifically test that machine we are 

not going to find the alteration. But if the vendor has inserted the 

alteration into every machine that it has manufactured, then we 

can use the same kinds of procedures that we use with airplanes 

and nuclear weapons and other systems that have the capability of 

killing people. We can use those analytical methods to test these 

machines and determine whether or not they have been altered. 

The allegation is made, as I mentioned in my testimony, that no, 

no, there is no amount of testing that will ever reveal every flaw 

in the system. That is quite correct. We don’t insist that every flaw 

in every system be found. We would never have systems if we insisted upon that. 

Mr. KOHNO. If I may add to his comments, I think that—I guess 

I want the committee to be careful about analogies that are made. 

You find many people make analogies, ‘‘we do testing for airplanes 

and we do testing for cars,’’ et cetera. I think the important thing 

to keep in mind is, when you are testing these things, you don’t 

plan to put them in an environment where there is someone actually trying to actively attack them. You can be flying in the air in 

a normal airplane and you want to make sure in turbulence that 

things will be okay, but for these voting systems there is an active 

attacker. This active attacker will try to not play by the rules. It 

is this that makes voting systems or security so difficult. 

I just kind of wanted to point that out. 

The CHAIRMAN. I understand that, but what makes the paper so 

much more secure? The State of Maryland, Ohio, Texas, any State, 

Georgia, they are smart enough in these States, and they don’t 

want fraudulent elections—not one person wants fraudulent elections, but they are smart enough to randomly pull machines in and 

test them because someone, as you say, is trying to attack these 

systems. But they are smart enough to be able to do that. 

But why all of a sudden is everyone saying the paper is so much 

more secure, when paper could be crumpled—once you look at your 

vote, it could be crumpled and thrown away. Fraudulent paper ballots could be stuffed in the ballot box. What makes you so convinced that the paper is so secure? Paper to me is 100 times more 

unsecure than any machine that we could randomly test, that the 

States could test. 

Mr. KOHNO. I still think that the thing I tried to convey in my 

testimony was that paper still is not perfect. Paper can be crumpled, thrown away, all this stuff can happen to paper, but at least 

that is what we are used to now. We are not going backwards. The 

problem now is with electronic voting machines, like Professor 

72

Rubin said, the public is not able to go in and analyze them and 

verify that the problems have actively been corrected. 

The CHAIRMAN. The States could do that. Everybody in this room 

knows how to crumple a ballot up and toss it away or stuff a ballot 

box. Everybody in this room could be knowledgeable about that. I 

doubt maybe four, two or one of you could actually go in and be 

able to fix and manipulate those machines. You would have to have 

a conspiracy theory that they are sitting out there and manipulating these machines that we can’t ever find out about. 

Mr. RUBIN. As someone—I have been working with computers 

my entire career. One of the feelings that I have is that, one, something could go wrong and you just wouldn’t know it. It might be 

easier to detect some number of missing ballots than some bits in 

a computer that were flipped. If you look at the system as a whole, 

if you look at the magnetic cards in the machines that have the tallies on them; and the thought that all of the votes are being kept 

in a medium that inherently has glitches and inherently has flaws 

and can often be undetectable, that makes me nervous. I will not 

say that paper is great, but, right now, I think computers are not 

ready for this important responsibility. 

The CHAIRMAN. I think they could be. 

I am going to move on to our ranking member. One question and 

I am going to move on, although this has been interesting I think 

for everybody. On that note, we don’t know. Let’s talk about something we do know, though, Dr. Williams, about the undervote in 

the elections. Wasn’t there an amazing undervote when it came 

down to nonelectric machines? 

Mr. WILLIAMS. In the 2000 election, Georgia had actually a higher percentage of undervotes than Florida. We sat there and 

watched the goings on in Florida and thought, wow, there but for 

a close election goes us. That, in fact, is what led us to switch to 

the DRE machines. With the DRE machines, we reduced our 

undervote at the top of the ticket from something over 4 percent 

to less than 1 percent, a factor of five. 

The CHAIRMAN. The gentleman from Connecticut. 

Mr. LARSON. Thank you very much, Mr. Chairman. 

Let me also say I really appreciate this line of questioning, and 

I think the debate and the dialogue that is ensuing is oftentimes 

best between the participants which I would broadly categorize as 

individuals who believe in trust and verify and those that believe 

that scientifically and from an engineering perspective that we 

have to analyze the risk, then solve the problem. 

I have an overarching question that deals with the practicality 

of implementation and a more technical question that deals with 

encryption and how that would coincide with Mr. Rubin’s proposal. 

But my esteemed colleague, Rush Holt, who, as has been mentioned by several of you, is a proponent of the bill before us has 

asked me to ask these two questions; and I think they cut to the 

heart of what we are trying to get at. I am going to direct them 

at Dr. Shamos and Dr. Williams, but I would appreciate a response 

from Mr. Rubin and Mr. Kohno as well in the process. 

Mr. Holt’s question is, if a vote is a record of an intended preference of a voter, isn’t a recount an attempt to revisit and recount 

the records of those intentions? If so, after a voter casts a secret 

73

ballot on the electronic DRE machine and leaves the polling place 

and the polls close, is there any way, without a voter-verified audit 

record, that election officials or manufacturers or programmers can 

determine what was the intention of the voter? Is it possible to 

have a meaningful recount on a DRE? Question number one. 

Question number two, which is a follow-up, what is the possibility that a problem in software, whether it be an inadvertent bug 

or a deliberate, malicious doctoring of software could go undetected? 

Dr. Shamos, I will start with you. 

Mr. SHAMOS. The first question was quite lengthy. I think I remember it. I actually dislike the phrase ‘‘meaningful recount’’ because I don’t know what it means. The legal purpose of a recount 

is not to do a revote. The legal purpose of a recount is to ensure 

that the vote totals that were reported by the individual machines 

in the jurisdiction were correctly reported and correctly added up. 

Mr. LARSON. Could you elaborate on that? Because I think this 

is a confusing item to a lot of people, the difference between a recount and a revote. 

Mr. SHAMOS. Yes. We never use the phrase ‘‘revote’’ unless we 

are talking about holding the election all over again, but I think 

a lot of people believe that the word ‘‘recount’’ means that we go 

back and look at the original intention of the voter. That is generally not what is done in a recount, and that is not what is required by the State statutes for recounts. 

The problem is, if you look at the procedure for vote totaling in 

this country, voting is exceptionally local. It occurs on individual 

machines in individual polling places. The number of precincts in 

the United States is over 170,000. The number of voting machines 

is much larger than that. We must take the individual totals from 

all of those machines and eventually gather them together into 

some central place where they are totaled for the entire Nation in 

the case of a Presidential election or in the county in the case of 

a sheriff’s election. 

The process by which the totals are transmitted to this central 

place is error prone. It is done by human beings, often writing 

numbers on a piece of paper. So what a recount consists of is going 

and looking at those totals to make sure that they have been added 

correctly. 

Where there is a physical record in the case of, for example, a 

mark sense or optical scan ballot, it is possible to rerun the ballots 

through the machine, in effect creating what you would refer to as 

a recount, count them again and then report those totals. The problem is, if they have been counted twice, then which is the total that 

we really should be reporting? 

In the case of mark sense machines, you can get some pretty reproducible results. In the case of punch cards, you can’t take 10,000 

punch card ballots, read them through a card reader twice and get 

the same results, because the process of actually reading the cards 

changes the cards. 

In the case of the DRE machine, the way you assure that the 

vote that the voter saw before she left the voting booth is actually 

recorded, right now the process is you test the machine. We don’t 

74

test these machines enough. There aren’t established procedures 

for doing it, but it is doable. 

There are any number of ways of creating an additional record. 

For example, one could display the voter’s choices on a screen, just 

as they are done now; and one could take a digital photograph 

using equipment not manufactured by the same voting machine 

vendor, take a digital photograph of exactly what was on the screen 

at the time the voter left the booth. That would constitute, if it 

were properly encrypted and stored, an unalterable audit trail of 

what went on in the voting booth. 

There are many such solutions that don’t involve the use of 

paper. It is not that I have anything against the wood pulp industry. It is that anytime you have a specific piece of paper that 

human beings can touch, it becomes losable, augmentable or 

alterable. When you have properly encrypted computer records, 

written in write ones memory so that nobody can change them, you 

don’t have that problem. 

The other question I think was with respect to software. How do 

we know that the software hasn’t been altered? The same as we 

know with all other systems, we test them. That is the way we find 

out whether machines work or not. 

Mr. LARSON. Would you agree with the New York Times or are 

you familiar with the New York Times article that they did recently comparing the testing of machines that occurs in Las Vegas 

in the gaming industry versus, say, our polling booths across the 

country? 

Mr. SHAMOS. Yes, I am. I am very familiar with the New York 

Times article. I think they have had to add a new guy to the mail 

room to respond to my letters that I write to them. 

I haven’t agreed with anything the New York Times has said 

about voting during 2004 except that specific editorial to which you 

refer, and I agree with everything in it. The point was made there 

that the Nevada Gaming Commission carefully vets every software—every piece of software and every chip that goes into every 

slot machine in Las Vegas. It is essential for that huge industry 

for people to be able to rely on machines to pay off when you win, 

and it is essential that casinos—for them to not pay off when you 

lose. So there is a huge amount of money available to do this kind 

of vetting and testing. I agree that, if the money were available, 

precisely the same kind of thing should be done with voting machines. 

Mr. LARSON. How much money would that require, in your estimation? 

Mr. SHAMOS. I don’t have an estimate. 

Mr. LARSON. If the other panelists could respond. 

Mr. WILLIAMS. We do a significant amount of testing in Georgia 

directed toward just exactly that thing. We get our software directly from the ITA. We do not get it from the vendor. So that we 

know that what we have is what the ITA qualified, not necessarily 

what the vendor would like for us to have. So we get the software 

directly from the vendor; and then, before it is ever used in the 

State, we run about 6 weeks of testing on it. Some of it is designed 

toward the use of the system, but some of it is designed toward seVerDate jul 14 2003 04:20 Jan 25, 2005 Jkt 097366 PO 00000 Frm 00074 Fmt 6633 Sfmt 6602 E:\HR\OC\A366P2.XXX A366P2
75

curity, to try to wake up any Trojan horses that might be present 

and things like that. 

Once we are satisfied with the system, we freeze it, so to speak, 

and we take a digital signature of it, and the digital signature that 

we use is the exact same digital signature that NIST uses to validate law enforcement software. Then periodically, anytime that one 

of our staff is out in a county, they can run that signature against 

the county system and verify that that system has not been 

changed. 

Mr. LARSON. Dr. Rubin. 

Mr. RUBIN. I would like a chance to respond to your three questions, the last one being of the gambling example. 

In terms of meaningful recounts, the important thing I think is 

the question, what happens when something goes wrong? Sometimes it is really visible. There was a case of hundreds of thousands of votes being tabulated by an electronic voting machine in 

a place where fewer people had actually voted. What do you do 

when something goes wrong? 

Things go wrong all the time. I worked as an election judge in 

Baltimore County. At the end of the day, the totals that we got off 

the machine did not match the totals that came in the door. It was 

one or two people. So we got out all the books and we got out all 

cards and we sat there for about an hour and a half and counted 

everything up until we found the error. 

What do you do if something goes wrong inside a DRE? You get 

a result that doesn’t make sense. There is nothing you can do. But 

if you have a voter-verified paper ballot trail, a box full of paper 

ballots, you can at least count them. You have some recourse for 

something to do if something goes wrong. 

That is my response to the first question. 

The second one, I have a very simple answer. I do not believe 

that it is possible to detect malicious code when it is hidden well 

inside of other code. I have done experiments with that, with 40 

graduate students hiding code and then trying to find code. It is 

just an intuition. I don’t have scientific proof, but I find that when 

I travel to computer science conferences and the only thing they 

want me to talk about these days is electronic voting, when the 

topic of hiding code comes up, that seems to be the consensus that 

I find, is that it is much, much easier to hide code than it is to find 

it. 

Finally, the question about the editorial about the gambling machines and the Gaming Commission. I don’t know if you are familiar with the case of Rob Harris who worked for the Nevada Gaming 

Board. He was one of the testers of the slot machines. He wrote 

some malicious code that he put on a testing device which would 

download to one of the slot machines and then somebody could 

come in and put in a particular sequence of coins into that machine, it would turn it into a winning machine for a while. So his 

conspirators would go around and play those machines and win a 

lot of money. The way he got caught was that one of his relatives 

won a big slot and didn’t have an ID on him, so the security escorted him back to his room where Rob Harris was in his room, 

and they started investigating. But they didn’t catch it any other 

way. 

76

The point I am making is that insider threat happens. Even with 

all the stringent controls on the gambling machines, he was getting 

away with that for a long time and would not have been caught 

if he hadn’t have been careless. 

I think the insider threat in anything electronic will be caught 

through some out-of-band mechanism like not having your ID, but 

there is nothing inherent about software that makes it easy to 

catch these things. 

Mr. LARSON. Dr. Shamos mentioned encryption. We heard testimony in previous committee hearings as well about that being the 

way to go. What you talked about earlier seemed like a method of 

encryption, though I profess not to be either an attorney, a scientist 

or a physicist, but I am interested in that line of questioning and 

would ask if the panelists want to further respond to one another. 

Mr. RUBIN. I would start off by saying that encryption is a valuable tool in the security arsenal. It has specific purposes, namely 

to hide information from an adversary, so governments use it to 

send information out to spies in the field. It is not something that 

can be blindly applied to a system to make it secure. You can’t 

sprinkle encryption dust on a computer and make it secure. 

Encryption is a tool. When there is something that needs to be 

done to maintain confidentiality, you can encrypt it with a key, but 

then the problem reduces to protecting that key. So the biggest 

value of encryption is in taking a lot of information that you need 

to protect and reducing it to a small amount of information that 

you need to protect like a key which can then be put on a smart 

card or protected some other way. But, in and of itself, encryption 

is not going to give you secure voting. 

Mr. KOHNO. I would also like to add to that in the fact—so 

encryption, like you said, is a specific tool, but I think lots of people 

confuse encryption with the science of cryptography. Cryptography 

is a much broader science with many different goals in mind. 

I think one of the things that as a cryptographer I have seen 

often mistaken is that encryption provides—protects—if you take 

some data and you encrypt it, you protect both the privacy and the 

authenticity. That actually turns out not to be true. 

I don’t know how technical in the details you want me to get, 

but, essentially, if you talk to a cryptographer, encryption is the 

process of taking some message, applying a transformation to it, 

typically using a key. You get some ciphertext. The ciphertext—an 

adversary looking at the ciphertext will not be able to figure out 

what the original message was. So this might protect the privacy 

of the vote, assuming all the other things like key management are 

in place, but this doesn’t mean that you can’t actually controllably 

flip a number of bits. 

The example that I might—by flipping bits, I mean change the 

contents of the message. So an example that I might give is that 

you have several different messages that you want to be sending: 

sequences of ‘‘yeses’’ or ‘‘noes.’’ You encrypt each of these individually. I take my message ‘‘yes,’’ I am going to encrypt it, take my 

message ‘‘no’’ and encrypt it, and take the next message ‘‘yes’’ and 

encrypt it, send these over separately. This doesn’t prevent an adversary from taking the ‘‘yes’’ messages, preventing the delivery of 

77

my messages and kind of shuffling the order of these messages I 

sent. 

I am hoping that this analogy is getting across the fact that 

encryption doesn’t provide authentication. It is a powerful tool in 

the arsenal, but isn’t a be-all, end-all solution. 

Mr. LARSON. Most of the testimony I have heard over the last 

couple of weeks really points out the complexity of the issue, that 

really when—the further you look into it and the more you peel 

away each layer of veneer, you find that there doesn’t exist a true 

simple answer to this, and what the voters are looking for is a very 

simple solution. It seems to me, at least in listening to the testimony we have heard over the last several weeks, that it is a more 

complex issue. I tend to agree with Dr. Shamos, that I think we 

have got to analyze the risk and then come up with the best possible solution. I also would think that the four of you could probably get into a room and come out with a solution. 

My question is, given the practicality of facing elections in November and wanting to assure the public, and this is a concern that 

the chairman raised and I think many people on the committee 

feel, we don’t want the message to go out to the general public that 

their vote doesn’t count or if they are voting on a specific machine 

that the machine might in fact alter the election in such a manner 

or have been altered in such a manner that their vote doesn’t 

count. How do we, in the short period of time that we have, 

produce the best possible result? 

Mr. SHAMOS. I can start with that one. 

First, on the issue of can machines be tested adequately, I find 

myself in the rare position of agreeing with Dr. Rubin on a few 

points that he just made. It is true there are always going to be 

insider attacks. We will develop countermeasures, and some new 

insider will find a new and better attack the next time, and the 

battle never ends. It is notable that after the discovery of the Harris debacle in Nevada, they didn’t stop the slot machines from spinning. You can still play the slots in Las Vegas, even though there 

was an insider attack. If we insist on perfection, if we insist on zero 

defect, there is never any kind of system we are ever going to be 

able to deploy. 

With respect to what to do between now and November, the only 

answer at this point seems to be test, test, test and train, train, 

train. Many of the problems that have arisen with DRE machines 

can be ascribed to first-time use. Poll workers who have never seen 

the machines before were asked to follow procedures that didn’t 

even exist in written form. So training is required there. 

If it is believed that the security vulnerabilities in these machines can be exploited in order to alter the results of an election, 

then security measures must be taken to ensure that that doesn’t 

happen. You don’t leave the machines around, for example, where 

outsiders get an opportunity to play with them. You watch what 

people are doing when they are going into the polling place. I don’t 

see any alternative to those two steps before November, which is, 

I believe, 120 days from now. 

Mr. WILLIAMS. I agree with that. 

To get back to the Brennan report that supposedly is recommendations for things to do for 2004, it can’t be done. The 

78

things that are in that report: to start today and go out and try 

to hire a consultant, bring that consultant in, evaluate your voting 

system, get the recommendations, implement those recommendations and hold an election 120 days from now, you can’t do it. It 

is a catch-22 situation. If you try to do it, you are going to wind 

up running your election with an uncertified system, and you are 

going to get criticized for that. So if you don’t do it you are going 

to get criticized for not doing it. So that Brennan report puts us 

in a real catch-22 type situation. 

Mr. RUBIN. I believe that if there is a vulnerability out there, it 

is better to know it than not to know it. Hiring security consultants 

to come in and review the system and produce a report and if they 

find something, then at least you know about it and then we can 

figure out what to do about it. It is better than not knowing about 

it. 

When we analyzed the Diebold system a year ago, it was a year 

and a half left until the election. We asked ourselves, will we do 

more damage or good by going public with this? One of the things 

we said, well, there is not an election coming up. We have a year 

and a half before the election, plenty of time to fix the things we 

are talking about and design perhaps and provide better voting 

systems. We did go public with it. 

Right now, we are coming up to the election. We need to do everything we can. Unfortunately, I think there are places that are 

going to be used, equipment that I don’t believe in, that I don’t believe is secure enough. Should I sit back and say, well, in order to 

preserve the confidence of the voter in something I think is insecure, do I sit back and keep quiet? I don’t think that is a good idea. 

That is why I have been speaking out about this. 

Mr. LARSON. Would you agree with Dr. Shamos that what we 

should do then, given the shortness, is test, test, test? Is that a reasonable alternative? 

Mr. RUBIN. I think that I do believe in parallel testing, and I believe we should maximize the testing but not in place of external 

review. I think you can test and review at the same time. 

Mr. LARSON. The review that you are indicating would be the review that you laid out in your testimony? 

Mr. RUBIN. No, the review that the Brennan Center and SSCR 

recommends in their recommendations that came out last week. 

Mr. WILLIAMS. Which is based on the assumption that we don’t 

already know the vulnerabilities in our voting system and we need 

somebody else to tell us about them, and we don’t agree with that. 

Mr. RUBIN. No, but that is one of the assumptions. 

The CHAIRMAN. Mr. Mica. 

Mr. MICA. Thank you, Mr. Chairman.

We have got a couple of experts that have looked at the overall 

picture here. What percentage of our voting will be done in 2004 

by electronic means? 

Mr. SHAMOS. It was estimated originally at about 32 percent. The 

estimates have been falling to somewhere in the 20s, which is 

somewhere between two and three times the percentage that voted 

under the early machines in the year 2000. 

Mr. MICA. Basically, the machines that are out there, do any of 

them have a paper trail capacity? 

79

Mr. SHAMOS. Many of them have a paper trail, one that is not 

viewed by the voter, however. Most DRE machines—at least when 

I was involved in certification, most DRE machines have an internal paper trail that records in random order a complete ballot 

image of every vote cast. In that sense, they have a paper trail. 

Mr. RUBIN. That is not what the Diebold machines do, though. 

They print out the totals at the end of the day on a printer, but 

they only maintain an electronic total. 

Mr. MICA. But that is an electronic total, not as everyone votes? 

Mr. SHAMOS. It is as everyone votes. Not in Diebold. 

Mr. MICA. It is just adding a number as opposed to sort of a continual tab on how each one has voted? 

Mr. SHAMOS. Yes. I am in the enviable position of never having 

reviewed the Diebold system for certification purposes, so it can’t 

be blamed on me. 

Mr. RUBIN. These machines do not print anything throughout the 

day until the end of the day when they print totals. They do not 

print anything as people vote. 

Mr. MICA. Then I heard the dilemma, if we have a discrepancy 

in a paper trail versus an electronic trail, how would that be resolved? 

Mr. RUBIN. There isn’t a paper trail in the Diebold machines. 

Mr. WILLIAMS. That is not entirely true. As you know, the HAVA 

legislation requires that the system have the capability to print 

ballot images. The Diebold system can do that. As a matter of fact, 

it can print them in a format that can be read on an optical scan 

machine if you want to. I have never known anybody to actually 

do that, but the capability is there. 

Mr. RUBIN. That would be a pretty useless thing to do. 

Mr. MICA. Hey, join the club up here. We do a lot of useless 

things and spend a lot of money doing it, too. That is part of my 

point. 

Okay, everyone has agreed that there is no way to verify the vote 

of an individual. 

Mr. SHAMOS. With the current systems that are deployed, that 

is correct. 

Mr. MICA. And we have no way of really changing—everyone 

agrees that before this election basically there is no way to add any 

other security checks or enhancements to existing machines, that 

what we have got is what we are going to go with, basically? 

Mr. WILLIAMS. That is right. We talk about November, but November is not really the date. You have got to send out your absentee ballots 45 days ahead of time. So, actually, you have got to put 

your election to bed 45 days before November 2. 

Mr. MICA. I am trying to get a glimpse of the 2004 election. I 

think you are providing that. 

I don’t mind spending Federal money to make certain that an 

election improves voter participation and accuracy and security. 

However, I am concerned the way we spent money here, I think we 

did it by a formula, and each State got, based on population of voters, a distribution. Is that the right way? What should the Federal 

role be in this process? 

Traditionally, you heard my comments at the beginning, the 

State and locals really run the show, and you have got a mass—

80

someone said 1.4 million volunteers. These aren’t people that we 

are taking in and giving computer technical training and operations. These are folks that will get a little course here and there. 

To get the biggest bang for the Federal buck—and, also, what is 

our Federal responsibility in this process? Maybe we could go 

down—that will be a major question. What is our best role with our 

money and our position to make this work in a cost-effective manner and that gets us the best results? 

Mr. SHAMOS. Until recently, I believed that the best role for Federal Government in elections was hands off. Unfortunately, what 

has happened is that the States’ attitude has also been hands off. 

The States have one by one been abdicating their responsibility for 

testing and certifying voting systems. What they have done is to 

rely instead on the Independent Testing Authority process and the 

voluntary FEC standards, which are now known as the FVSS. The 

idea there is that there are some standards voluntarily proposed by 

a body and there are independent testing authorities who supposedly test the machines to those standards and they produce a 

letter that says——

Mr. MICA. When you say ‘‘machines,’’ are you just talking about 

electronic? Or all machines? 

Mr. SHAMOS. There is computerized voting and then there is 

DRE voting. I am including anything that involves a computer. The 

Independent Testing Authority produces a letter that says we tested this system to the Federal voting system standards and it 

passes. In many States, that is sufficient. The States themselves 

don’t do any subsequent evaluation of the machine. They just accept that letter at face value. 

It is obvious that there is something wrong with that process, because all of these systems that have been found to have security 

flaws, particularly the system examined by Dr. Rubin and his colleagues, they were all ITA certified. And so it raises the question 

exactly what are these ITAs doing and are the standards adequate. 

I have looked at the standards. They are 300 pages long, and I 

have them with me. Many of the concerns we have discussed today 

received no attention or one or two sentences’ worth of attention in 

these standards. So I don’t believe the standards should be voluntary. 

I think that in elections for Federal offices there should be mandated Federal standards these systems should have to obey, and 

there has to be some serious attention given to updating the standards and keeping them updated. As new attacks and new modes 

of attack are discovered, there have to be new standards to attempt 

to respond to those. We don’t have such a system right now. 

Mr. MICA. Anyone else? 

Mr. WILLIAMS. We don’t have the system, but you have put in 

place the mechanism. The EAC is the organization to address these 

problems. It has been slow getting off the ground, but with all of 

the problems that we know are in the HAVA legislation, I think 

basically it is doggone good legislation.

I have worked with the NASED program, the FEC program since 

its inception in 1986; and it has been an entire volunteer effort. 

That shows. With things that Mike is talking about here, there are 

problems with it. The problems are primarily—it is not because we 

81

didn’t know better. It is just because we didn’t have the resources. 

But now with the HAVA legislation, we have got the resources. 

The Technical Development Committee is meeting for the first 

time Friday. They have 9 months to produce a preliminary standard. Things are beginning to happen. I think the best thing that 

this committee can do right now is to give the HAVA legislation a 

chance to work. 

Mr. SHAMOS. The problem I see there is, even after the EAC does 

its work, the standards that it develops or the standards that it developed under its leadership will still be completely voluntary 

standards. It will not be mandated for the States to follow. 

Mr. WILLIAMS. Yes, but I would like to not say a priori that those 

are going to be the law. Let’s develop them, look at them and decide whether or not they are good enough to be the law. Let’s let 

people like sitting here at this table take a look at those standards. 

Mr. MICA. You are saying the standards will be sort of an evolving set? 

Mr. KOHNO. I would like to comment on that. 

Someone made an argument to update the standards as we find 

new attack modes. That kind of hints at what concerns me most 

as a computer security expert. These machines are still new. The 

assumption is that we are going to expect to keep finding new attack modes. That I think is a very scary idea, because it means 

that we are at a state where we don’t know what all the attacks 

are. We are going to be finding new ones and evolving the standards over time. I don’t want to be using something that is standardized, and the standardization says this is what we know now, 

but it is not perfect. There might be attacks discovered in the future, so we are going to revise these standards. 

But the first question you raised was along the lines what can 

the government do. I am a computer security person, not a person 

in the government. I don’t know what is within the limitations of 

me to allow for you to legislate, et cetera. But I think that one 

thing I believe is very important is for the voting process to be very 

open. 

I think Ranking Member Larson asked a question earlier or was 

talking about—there are two different issues going on. One is, are 

the elections themselves going to be secure? The other issue is, will 

the public believe that the elections are secure? I think these are 

two different things, and I believe one important thing we need to 

think about in the future, you have to weigh the importance of 

these two things. Do we want a system that is secure but the public doesn’t have faith in for various reasons? To me, I believe it is 

important for the public to believe the election was secure. Toward 

this end, I believe developing a model where the public can look at 

and verify for themselves that the voting systems are secure and 

reliable is very important. 

Mr. MICA. Dr. Rubin is the only one that didn’t comment. 

Mr. RUBIN. I think the best thing the Federal Government could 

do is put independent back into the Independent Testing Authority. 

They should be the ones hiring the testers and the certifiers, as opposed to the vendors who are making the machines. 

Mr. MICA. Thank you. 

The CHAIRMAN. The gentlewoman from California. 

82

Ms. MILLENDER-MCDONALD. Thank you, Mr. Chairman. From 

the testimony this morning and if the public is looking and listening, they have absolutely validated that there is no assurance that 

there is security in their voting. This is what members in the minority community grapple with all the time, that their vote will not 

count because there is no verification that their vote is being counted. But the one thing I suppose we can all agree to, that there is 

no such thing as a risk-free system. Am I correct, gentlemen? 

Mr. SHAMOS. Yes. 

Ms. MILLENDER-MCDONALD. Secondly, whether there is a paper 

trail or not a paper trail, there is never a means for a complete or 

verification accuracy count, am I correct on that? Is that a correct 

assumption? 

Mr. WILLIAMS. Not as long as we have secret ballots. 

Mr. SHAMOS. In the currently deployed systems, that is correct. 

There are proposals for systems that would remedy that defect. 

Ms. MILLENDER-MCDONALD. Let me ask you, for the umpteen 

years that I have voted—and I do not care to tell you those number 

of years—when you go to the polls to vote, you have a ballot that 

is given to you. The ballot has a top part that is detached from 

when you finish and complete your ballot, and they put that larger 

ballot into a box, and they give you this little detached piece saying 

that I have voted or whatever it says, but it carries a number. That 

number cannot be verified if there is a recount? You can never go 

into that box? Assumedly, that is the box you voted from—or is 

that the operative word? ′′assumedly,′′ that is the box you voted—

your ballot went down in, to compare that from that stub that you 

get, compare it to the ballot that is put into the box? 

Mr. SHAMOS. No, because the number is on the stub only. It is 

not on the ballot. 

Ms. MILLENDER-MCDONALD. I see. 

Mr. SHAMOS. It is a privacy problem. 

Mr. WILLIAMS. In most States, by law you cannot have any identifying mark on the ballot that could be identified back to the voter. 

Ms. MILLENDER-MCDONALD. In other words, then it is true that 

we do not—the position is not there or the system is not set up for 

recounting to be done accurately then? Is that a fair statement? 

Mr. RUBIN. The idea behind the meaningful recount concept of 

voter-verifiable ballots is that if you have a box full of ballots that 

voters looked at and put them into that box, then while you won’t 

know which ballot corresponds to which person, it is the best effort, 

best hope you have of counting the voter’s intent. 

Ms. MILLENDER-MCDONALD. Absolutely true. 

Mr. RUBIN. That is why I and many others have been advocating 

voter-verifiable paper ballots, so that you have something to go 

back and count. 

Ms. MILLENDER-MCDONALD. Yet we don’t have to bring up Florida again. Because Florida indicated that, even with a paper ballot, 

that was not an assurance that that could be a count that was accurate in the sense of accuracy. 

Mr. RUBIN. The ideological difference is that I think the way to 

improve Florida is to design better paper ballots where you won’t 

have hanging chads or be confused about which hole to punch. You 

can accomplish that with a system I described in my initial testiVerDate jul 14 2003 04:20 Jan 25, 2005 Jkt 097366 PO 00000 Frm 00082 Fmt 6633 Sfmt 6602 E:\HR\OC\A366P2.XXX A366P2
83

mony where you have all the benefits of a DRE for vote casting but 

you have all the benefits of paper for vote counting. 

Ms. MILLENDER-MCDONALD. Dr. Williams, in your testimony you 

indicate that you do have your DRE now in place for Georgia, the 

State of Georgia. It has been replaced by all other systems that you 

have once used. 

Then I see an article by the California Secretary of State Shelley 

who says in this article, a number of failures, including touch 

screen machines in Georgia, Maryland and California, has spurred 

serious questioning of the technology. Of course, as you know, our 

Secretary of State has banned to some degree the use of the 

Diebold system, although in one of my cities in my district we do 

use it, and he has not banned that one. But he is kind of contradicting what you have said in your statement, or is that a contradiction? 

Mr. WILLIAMS. I have no idea what he is talking about. We installed that system—we first used it in November of 2002, and we 

have right now held over 500 elections using that system, and we 

have not had a problem yet that we could attribute to the system 

per se. We have had problems, but they have all been typical 

human-type problems that you have with any system.

Ms. MILLENDER-MCDONALD. So this article that is dated May of 

this year really does not speak to your testimony and especially 

that that I have dated April, 2003? 

Mr. WILLIAMS. That is correct. There is a learning curve on anything. The first time we used the system, there were some problems in some of the precincts, but these are mostly training issues 

and so forth. 

We haven’t talked much about training, but if you asked me 

what is the one thing you can do to improve your elections, the answer is, train your poll workers. And I don’t care what kind of voting system you have got. A well-trained poll worker can overcome 

a lot of problems in a voting system; and, conversely, a poorly 

trained poll worker can cause you a lot of problems, no matter 

what your voting system. 

Ms. MILLENDER-MCDONALD. I think it was Dr. Shamos who said 

test, test, test, train, train, train, or one of you said that. Who 

would be the most reliable training source to train persons, especially in the minority communities? Because they really still do not 

believe that their vote counts and that there is a reliable system 

that really speaks to their having security in voting. 

Mr. WILLIAMS. In Georgia, we have a Center For Election Systems at Kennesaw State University. We provide training to county 

election superintendents, all 159 of them; and we do not train poll 

workers directly, but we train the people who train the poll workers. That is a huge effort that is ongoing. 

Ms. MILLENDER-MCDONALD. I would think it is because you are 

training the persons who train the poll workers which you are not 

sure the poll workers are being trained, given the trainers that you 

have training them. If that is not a convoluted type statement, 

what else is? It is frustrating to sit here and hear this and to know 

those folks who are out there in the heartland and in the other 

part of our country are really frustrated about this whole voting 

system. 

84

Mr. WILLIAMS. We have got hard statistics to demonstrate that 

we have greatly reduced the number of spoiled ballots in the predominantly minority districts. 

Ms. MILLENDER-MCDONALD. Is that right? I would like to get 

that, if you can give me a copy of that. 

Mr. WILLIAMS. Be happy to. 

Ms. MILLENDER-MCDONALD. Is there anyone on this panel outside Dr. Rubin who thinks that the ballot, the paper ballot, is the 

best way to go? Is there anyone else here who thinks that, over and 

above the DRE? 

Mr. KOHNO. I agree with that, especially in terms of between 

now and November. 

I think the thing that I was trying to make before—the statement I was trying to make before is, the systems we know—we 

know the system we analyzed had serious security problems. We 

know that the certification processes don’t address these security 

problems. So I think the thing to do in the short term definitely 

is that we need to—yes, to answer your question I think I do. 

But I think I also wanted to—you were talking a lot about testing. I think one important thing to address is whether testing—I 

am sorry—not testing, you are talking about adding procedures, 

training people for procedures. I think the important thing to address is whether your having poll workers trained for election day 

is going to be sufficient enough. 

One analogy I kind of like to think about was that we know that 

the systems right now may have a lot of security vulnerabilities. 

You are trying to rely on people and procedures to help protect the 

systems. An analogy you might want to talk about is like a bank 

saying, I know our safe doesn’t work or I don’t have a safe, but I 

am going to assume that no one is going to steal money because 

I have a lot of people walking around and following the procedures 

I have outlined. 

One thing to keep in mind, the people implementing the procedures may be the adversaries as well. 

Another thing, I was recently at a meeting at the Kennedy 

School of Government on electronic voting. One of the election officials there made a very interesting point. Her observation was that 

when people—anytime anyone starts a new job, you kind of expect 

them to make mistakes on their first day. That is not an unreasonable assumption. But the concern is that, for elections, every election day may be the first and only day for the people that are volunteering or being paid to work the polls that day. 

These are two things to keep in mind, I think. 

Ms. MILLENDER-MCDONALD. Let me ask one more question here. 

With the AAPD, the American Association of People with Disabilities, which one of these systems will best address their needs or 

if any of these will? A paper ballot? Braille? 

Mr. RUBIN. I think the needs of the disabled community definitely need to be addressed with voting, and what has happened 

is we have taken in the design of the machines that are being used 

today like the Diebold machines, we have taken that as the predominant property to address. And it has been addressed. I think 

that it is possible to build systems that address those needs equally 

well and also address security. That hasn’t happened yet. Having 

85

a machine that allows a blind person to vote but also allows some 

malicious person to change the entire outcome of the election is not 

anything that anyone desires, not even a blind person. I think that 

we cannot ignore security. 

Mr. SHAMOS. I don’t agree exactly with that characterization. It 

is not a choice of one or the other. The disabled rightly argue that 

if there is going to be voter verifiability then they ought to be able 

to participate in that also. There are means of offering voter 

verifiability without the requirement of having a piece of paper 

which they cannot read. 

So I am not against voter verifiability in any way. I am against 

attempting to accomplish it with paper where that paper becomes 

the official ballot. If you want to print out a piece of paper to convince the voter that her choices were correctly heard by the machine, there is nothing wrong with that. I just don’t want that piece 

of paper to become the official ballot, because we have 150 years 

of history in which people with no training or education at all have 

been able to successfully manipulate those things. 

It is true that there is no centralized manipulation possible with 

paper. The manipulations are only local. Whereas there is centralized manipulation possible with software, but it is the very centralization that makes it easier to detect. 

Again, safes are not safe. Many banks have had safes broken 

into. That doesn’t mean that we have disbanded the banking system. It may mean that it is necessary to hire more security guards 

and install video cameras to watch the safes. 

But I disagree with the concept that perfection is required and 

as soon as someone points to some vulnerability we must shut 

down the entire system. There are security flaws of all kinds in 

these DRE systems, some much worse than others. Some are really 

excellent. Because there are security flaws, that doesn’t mean that 

the election will necessarily be tampered with. It doesn’t even necessarily mean that the probability will be high that the election 

will be tampered with. It means we have 25 years of history of 

using DRE machines and no one has been able to demonstrate that 

any election ever was tampered with, despite the fact that there 

have been numerous problems of all kinds, not necessarily related 

to security. So it is not a choice of one or the other. Paper certainly 

doesn’t help the disabled, though. 

Ms. MILLENDER-MCDONALD. Mr. Chairman, thank you so much 

for such an interesting and absolutely—although very thorough by 

the experts here, still very convoluted type of concern that we have, 

especially when we are preparing for the largest election in this 

country. 

I note my dear friend and colleague Congressman Holt is here. 

He had a statement to submit for the record. By unanimous consent, may we have that? 

The CHAIRMAN. The Congressman can submit it for the record, 

without objection. 

Ms. MILLENDER-MCDONALD. Thank you, Mr. Chairman. 

[The statement of Mr. Holt follows:]

86


Insert graphic folio 136 97366A.050
87


Insert graphic folio 137 97366A.051
88 

The CHAIRMAN. Mr. Larson, the Ranking Member, has another 

question, but, on the point, I think this discussion needs to be— 

everybody knows there is politics in this building, but this discussion really needs to—that is the way it has gone today—to rise 

above the political. There was a maligning editorial, I think a disgusting editorial on this whole issue—I mentioned this 2 weeks 

ago—really maligning people, especially people that are out there 

fighting for persons that have some form of disabilities. So there 

is the political side of this, the emotional side of this, but I think 

this type of hearing is a better way to look at the issue. 

But, also, within the civil rights community and within the community of people that have some form of disability, they have genuine concerns about the paper ballots. I do not think it is just so 

clear-cut that you are either the good people if you are for the 

paper ballot or bad people if you question the merits of a paper 

trail. I don’t think it is a clear-cut issue. I think there is some 

science to look at here and also the evolution of our elections. But 

the one thing for sure is we don’t want people disenfranchised. 

That is the most important thing to consider. 

Six years ago, Georgia’s system had a high undervote rate. Dr. 

Williams answered 4.8 percent was the ballot error rate. In 2002, 

after deployment of the new systems that they have in Georgia, it 

was 0.87 percent, a fivefold reduction in undervoting. There were 

71,000 votes in 2000 that no one voted at the top of the ticket; and 

now, under their system, it has been drastically reduced—if you 

hear 4.8 percent, that doesn’t sound big, but 71,000 in that election 

was a lot of people. So am I correct in understanding that the 

undervote rate is down to 0.87, is that correct? 

Mr. WILLIAMS. That is correct. We are not willing to give that up 

for concerns that have never occurred, for pure conjectures, when 

we have never yet had the first hint of problems. We have been 

using computer-based systems in Georgia since 1964. DeKalb and 

Fulton County were the first jurisdictions in the United States to 

count ballots on computers. In that whole period we have not once 

had anybody attack the computer system. 

Ms. MILLENDER-MCDONALD. Mr. Chairman, just as a follow-up to 

what you are saying, Dr. Williams, what I am interested in is seeing in the minority community the reduction of the problems that 

have occurred since you are using DRE. If there is a comparison 

on your report that you are going to submit to me, I would like to 

see that as well. 

Mr. WILLIAMS. The figures he is quoting are State averages. In 

some of the communities, those undervote rates were much higher 

than that. They went up to much higher numbers in some communities. What he is quoting is the average. 

Ms. MILLENDER-MCDONALD. Mr. Chairman, in the City of Carson 

where we have a DRE, those voters, seems to me, that that electronic voting is much more secure than the paper voting, given the 

Florida’s issue. However, since the whole notion of paper trail has 

come about, now they are concerned as to whether or not there is 

reliability. I suppose no matter how you cut this there will always 

be the chances of voters being concerned about the whole notion of 

whether their vote has been counted. 

89

Mr. SHAMOS. Much recent analysis has gone into looking at the 

security of electronic voting systems, and it should. I completely 

agree with the notion that we need as complete a list as we possibly can have of the vulnerabilities. We also need transparency in 

these systems. 

I am not aware of any recent studies where people have looked 

again at paper ballots, looked at the physical handling procedures 

for paper ballots to try to develop a list of vulnerabilities there. 

This country over a long period of time discarded paper ballots to 

the point where they are used in less than 1 percent—to cast less 

than 1 percent of the vote in this country. We have gone over to 

various other systems to eliminate chicanery. 

When the lever machine was introduced in 1892, its inventor 

said of it that its purpose was to protect the voter mechanically 

from ‘‘rascaldom,’’ an interesting new term. I had never heard that 

before. I think it is pretty clear what rascaldom is, however. And 

that is because of rampant—once every 12 days since 1852—rampant stories of all kinds of tampering with paper ballots. So I think 

somebody should do a new study looking at whether paper is more 

or less secure than the voting systems that we know have security 

vulnerabilities. 

Ms. MILLENDER-MCDONALD. I think that would only be fair, 

given that we have arguments on both sides, that we should look 

both places for that type of reliability. 

The CHAIRMAN. The gentleman from Connecticut. 

Mr. LARSON. Thank you. I thank the chairman for the great latitude that we have had this morning in exploring these issues because it is so important. 

I would note this past Friday, in fact, we marked the 40th anniversary of the signing of the Civil Rights Act of 1964; and the gravity of this, of course, comes home today. Many people fought and 

gave their lives for the right to vote and how serious this is. I think 

across this panel and across this Nation, people are very much concerned. I think that is heartening to see. 

Again, I want to commend the chairman, Mr. Hoyer and others 

for HAVA, because I do think—although I disagree with Mr. Mica, 

I think that it is important to have a funded mandate. For so long 

the States have had to bear an unfunded Federal mandate in handling all of our Federal elections. This provides an opportunity for 

them to receive the appropriate kind of money. 

I want to go back because I think, as I listened to the testimony 

and hear the arguments put forward, Dr. Shamos, you said that if 

we strive for perfection, we can’t get there given there has been no 

system designed to date that will allow for that. So, within that 

context, we have to look and see what the risk is and what was 

the risk analysis and what we can arrive at in terms of the best 

system. 

It seems we have two goals in front of us. One ongoing, to continue to strive towards perfection as we project out into the future 

and the other a more immediate goal in terms of the November 

election whose backdrop is the election of 2000 and the concerns 

that have been raised. 

I would add and it seems at least—and I don’t want to put words 

in anyone’s mouth—that there was a general consensus that in the 

90

short term testing, testing, testing, training, training, training, 

testing with the Rubin corollary of independent sources is a very 

logical remedy, though I think Dr. Kohno would prefer that there 

be a paper trail that would go along with that, or as Peter Finley 

Dunn would say, trust everyone but cut the cards. But it seems to 

me at least in the short run that those seem to be goals that we 

could accomplish as the debate still goes on between whether or not 

the idea of trust and verify, of the paper trail being the best possible alternative for us to go to, the most secure alternative to go 

is further explored. Is that a fair statement? And how would you 

respond to that? 

Mr. KOHNO. I guess I will respond since I was singled out as 

maybe disagreeing, but I actually don’t disagree. I think that I 

would prefer to go back to the voter-verifiable paper ballot if we 

can, but it sounds like there are various procedures and various 

things that might prevent that. In that case I agree. You want to 

do the best you can to raise the bar in an attack. If that means 

you have to do more testing and do more secure analyses and 

changing the procedures, if that is actually the best you can implement, then I say you should at least do that. 

Mr. SHAMOS. And I think paper has some use. It certainly has 

use in commercial transactions. One of its uses is to point out errors. So my belief is that if a voting machine is making a record 

and it is making a simultaneous record that the voter can see and 

there is some discrepancy between the machine record and the one 

that the voter sees, that is the starting point for investigation. 

Forensic experts come in, they tear the thing apart, and they 

find out what is wrong with it. They don’t propose that it is the 

right thing to do, to take the piece of paper and make that the official ballot, any more than it is right to take the electronic record 

and make it the official ballot if there is something wrong with it 

unless we can have adequate handling. 

Mr. RUBIN. I am very impressed with your ability to extract all 

the points of agreement and consensus and I agree with your summary of our positions. 

Mr. LARSON. Thank you. 

The CHAIRMAN. I want to thank all four witnesses. I think it was 

a very, very fascinating hearing and I want to thank you for coming to the Capitol. 

We will move on to the second panel. I want to thank the second 

panel for waiting a period of time. We have Linda Lamone, Administrator of the Maryland State Board of Elections; and Kathy Rogers, Director of Elections Administration, Office of the Georgia Secretary of State; and Jill Lavine, Registrar, Sacramento County, 

California. I want to thank all three of you for coming. 

STATEMENTS OF LINDA H. LAMONE, ADMINISTRATOR, MARYLAND STATE BOARD OF ELECTIONS; KATHY ROGERS, DIRECTOR OF ELECTIONS ADMINISTRATION, OFFICE OF THE 

GEORGIA SECRETARY OF STATE; AND JILL LAVINE, REGISTRAR, SACRAMENTO COUNTY, CALIFORNIA 

The CHAIRMAN. If we could, Ms. Lamone. 

91

STATEMENT OF LINDA H. LAMONE 

Ms. LAMONE. Thank you very much, Mr. Chairman, and members of the committee. I am more than pleased to be here today. 

A lot of the discussion on the previous panel focused on the voting equipment, and I want to emphasize to you all that voting is 

not only the voting system; that it has many other components, 

and they involve people and procedures and those other components are equally important to the whole process. 

The other thing that has been stressed this morning is testing. 

I think I can safely say that both Georgia and the State of Maryland test this equipment beyond what anybody ever expected or 

what we thought we would have to do. We have at least four 

preelection testing procedures that the equipment must survive 

successfully before it can be used in an election. That does not include the ITA or independent testing laboratories that do the testing to meet the Federal standards. 

We also, when we do the testing in Maryland having anything 

to do with the software, we always involve two other entities besides my staff, and that is a quality assurance firm and something 

called an independent validation and verification. These are firms 

that we contract separately. They all have security clearances and 

the other credentials necessary. 

So we have very high competence in Maryland that when we test 

this equipment, we are testing it to the highest standards and 

highest quality possible. We also do other testing, that Dr. Williams mentioned, in Georgia; and that is to make sure there are 

no Trojan horses or other malicious code. And I would think that 

since the Diebold—which we both use—voting equipment code has 

been in the public domain for a year, if there was malicious code 

or otherwise in that system, it would have certainly been discovered by all the hot-shot ITA people or information technology people that claim to know all about elections all of a sudden. 

In Maryland, we have also had our voting system analyzed by 

two independent securities firms. One was the first one, SAIC, and 

the second one was done by a company out in Columbia, Maryland. 

We have had both firms report to us the risk assessments, the mitigations that they thought we should take and Diebold should take, 

and both of them assured me in their written reports that the voting equipment counted, recorded, and tabulated the votes 100 percent accurately. And again, that gave us a great deal of satisfaction 

and confidence in our voting system. 

In addition, the SAIC also thoroughly investigated the work that 

was produced by Professor Rubin, and they made four recommendations to us, all four of which have been implemented in 

Maryland. One was to have the ability to protect the—or create the 

passwords on the voter access cards; two, the same thing with the 

activation cards or the memory chips on the voting equipment; 

three, randomize the votes; four, use encryption for any modem of 

the unofficial votes on election night. All four of those recommendations were implemented in Maryland prior to the March 2004 primary. 

I think another interesting thing is that the computer scientists 

have all these things—conjecture could happen. It is conjecture 

that someone is going to be able to go out there and mass-reproVerDate jul 14 2003 04:20 Jan 25, 2005 Jkt 097366 PO 00000 Frm 00091 Fmt 6633 Sfmt 6602 E:\HR\OC\A366P2.XXX A366P2
92

duce the voter access cards so they can have access to the voting 

units and manipulate the election. They also say they are going to 

be able to do the same thing with the memory cards. Yet again, the 

source code has been in the public domain for a year and no one 

has successfully done that. No one. And I would suggest to the 

committee that if it were possible to have done so, they would have 

come forward to let the world know, because they like to tell people 

how well they can do things like that. 

We are doing an upgrade of the system now, and we will do another whole security analysis this summer. I have three full-time 

employees on my staff that are devoted to nothing but security 

issues. We have developed with, again, another independent outside security firm for an entire information security plan for the office, not only on the voting system but on every aspect of the process of conducting elections, including voting registration. 

A lot of the issues this morning also talked about the paper trail. 

And I understand, Congressman Larson, I appreciate your characterization of the positions because I think they accurately reflect 

mine and everyone else in the Nation who has to deal with the 

issue and who cares very deeply about having a secure and safe 

election. 

But let me just show you what a paper trail would look like for 

one voter from Baltimore County, Maryland in the March 2, Super 

Tuesday primary. This is 10 feet long, one voter; and it took us 41⁄2

minutes to print it out. Granted, we had to shut down the election 

to print the thing out because the system isn’t geared right now to 

printing a contemporaneous paper trail. But that is a lot of paper 

per voter. You look at the turnout in the November primary or November general election, probably 80 percent in Maryland, it is 

going to be a lot of paper we are going to have to have. 

And let me ask you, how are your constituents going to react 

when the printer paper jams and they say, Mr. Technician, will you 

come over here and help me unjam this paper trail, because the 

machine won’t let you cast your ballot until you print this paper. 

When that technician walks over, he or she is going to be looking 

at a live ballot on the voting equipment. And for those of you who 

have optical scan balloting in your jurisdiction in the past, you 

know how protective the voters are. They don’t want the poll workers to see their ballots. We use privacy screens to try to protect 

them. On the DRE, before you cast your ballot, your review ballot 

screen is live. It shows how the voter has voted, and that is what 

the technician is going to look at. 

And I think you need to know that the printer engineering community at IEEE is convinced that the printers that the voting vendors are now producing are not going to meet the standards we 

need to have to have a safe and reliable election. Mr. Rubin had 

an experience as an election judge in Maryland, and he said when 

they went to close the election they had a discrepancy between the 

number of votes on the DRE units and the number of votes that 

they had checked in. I suggest to the committee that the reason 

was human error. The machines were correct. The people handling 

the pieces of paper, the voting authority cards, the poll books, had 

made a mistake. 

93

And that is exactly what we are trying to get away from with the 

electronic voting equipment, aside from all of the other attributes 

that you have discussed here already. 

The other thing that really, really irritates me and my colleagues 

around the country is the irresponsibility of the way the press has 

handled this issue. They start with one problem, and all of a sudden it is attributable to the voting units. Let me give you an example. In Maryland, right down the street from my office, they delivered the wrong encoders. That is the device that puts the ballot on 

the voter access card. They delivered the wrong encoders to a single precinct. It was human error. They simply mixed them up. And 

when they went to program the cards and the voter put them in 

the voting unit, it wouldn’t pull up a ballot because it was the 

wrong encoder for the wrong voting units. It worked as it was supposed to work. I had international press at that precinct reporting 

that as an equipment failure, and that got perpetrated over and 

over and over again, that that was a major problem in Maryland. 

It wasn’t a major problem. We didn’t have any major problems in 

Maryland with the voting equipment. 

Everything that happened that went wrong was attributable to 

human error. And that is because now we are boosting our training 

and voter education. We are spending millions of dollars on security, on training, on voter education, and we still get nailed in the 

press. 

You asked what we are doing to get the word out. We can’t get 

our word printed. We put out all this good stuff that we are doing. 

When we sit down to educate a reporter and finally teach him or 

her everything we do, they go in and say, wow, I had no idea you 

did that stuff. 

CBS news was in Maryland a week ago Monday, and when my 

staff finished explaining to them everything we go through, they 

were convinced. We will see if they will actually broadcast that, 

which will be on this Sunday morning on Sunday morning news. 

The other thing that the New York University Brennan report 

came out with is a lot of issues about each State should have a security analysis done like we have done in Maryland. Let me suggest that I think that we would have a lot better economy of scale 

if NIST or someone like that did it on each voting unit and provided it to the States so we could use our management and other 

procedures to then implement it and control it. 

I see my time is up. I thank the committee for the opportunity 

to appear today. 

The CHAIRMAN. As they always say, they don’t report when the 

planes land, you know. 

[The statement of Ms. Lamone follows:]

94


Insert graphic folio 154 97366A.052
95


Insert graphic folio 155 97366A.053
96


Insert graphic folio 156 97366A.054
97


Insert graphic folio 157 97366A.055
98


Insert graphic folio 158 97366A.056
99

The CHAIRMAN. Ms. Rogers. 

STATEMENT OF KATHY ROGERS 

Ms. ROGERS. Thank you very much. As you know, the 2002 general election was a milestone in Georgia history as we became the 

very first State in the Nation to implement a statewide uniform 

electronic system of voting. On that one day on November 2, 2002, 

many concerns and fears were laid to rest. The elderly did not have 

trouble voting on Election Day and voters were not afraid of the 

new technology. For the very first time, every voter was afforded 

an opportunity to vote on the same equipment, using the same 

interface as their neighbor in the next county. 

That fact seems to be forgotten today. By upgrading our voting 

system platform, Georgia corrected a problem which was very close 

to being a disaster. And in the almost 2 years since that very first 

successful election, Georgia counties have conducted over 450 individual elections using the statewide uniform electronic voting system. Georgia voters have expressed their approval in not one but 

two independent studies which were conducted by the University 

of Georgia. These studies found that Georgians overwhelmingly 

prefer electronic voting to any other means. More than 70 percent 

of the respondents reported they were very confident that their 

vote was accurately counted, and some 97 percent reported that 

they experienced no difficulties whatsoever when using electronic 

voting. These numbers have already been thrown out, but I don’t 

think it hurts to reiterate them again. 

Six years ago on our antiquated voting platforms, the top of the 

ballot of the U.S. Senate race was a 4.8 percent undervote rate of 

total ballots cast. Of enormous concern to us was also our analysis 

of 90 minority precincts in which we showed an extremely high 

undervote rate that in some cases topped 10 percent in predominantly African Americans precincts. After 2002 and the deployment 

of our new system, the undervote rate in the top of the ticket ballot 

was reduced to a mere .87 percent. That is a fivefold reduction in 

undervoting. 

The paper receipt debate has generated a great deal of inaccurate, false, and misleading information by those who are calling 

for its very hurried implementation. Conspiracy theories do 

abound. No system, as has been stated earlier, whether electronic, 

mechanical, or paper based, can be made 100 percent invulnerable 

to attack; but the facts are the current system of voting is more secure than any type of voting that has ever been used in the history 

of Georgia elections. 

We in the State of Georgia did not sign a contract with our vendor and simply walk away from the process. Rather, we have provided oversight and direction to our counties through every step of 

implementation and we continue to do so to date. 

Let us consider the practical realities of paper receipt for just a 

moment. We have discussed how would each receipt be collected, 

how does the voter view it. You saw the prototype from Maryland. 

Georgia has created one that is about 31 inches long. It brings into 

question how you would store the paper for some 4 million voters 

in the State of Georgia and the voiding and the spoiling of the ballots. 

100

I heard mentioned earlier the possibility of a paper shredder. I 

am not sure we want paper shredders in our polling places on Election Day. There is also the question of what is the official record 

of the election? I have heard a lot of controversy about which would 

be the official. If it is the paper, what happens if so much as one 

piece of that paper were to become mangled or destroyed? Have 

you then called your entire election into question? 

If even 1 percent of Georgia precincts were to experience problems implementing a paper trail on Election Day, that would translate to 30 polling places in the State of Georgia. I can assure you 

if that were to happen, it would no doubt be portrayed as a catastrophic failure by the public and by the press. 

We also find it very remarkable that even as many activists are 

calling for this hurried implementation of paper receipts, these 

same critics express no concern whatsoever over the 30 million 

Americans who will be voting on a punch-card system this November. We can be certain that hundreds upon thousands of Americans 

will be disenfranchised by these punch-card voting systems which 

have been proven to be far more inaccurate than our current system of voting. And yet we hear no impassioned pleas from journalists or the activists that these systems must be decertified before 

November, and we have to ask the question, Why? 

We agree, as do all election officials, that we must continue to 

embrace a concept of continuous improvement in election security 

and we recognize that much of the debate has been healthy. And 

some of it has surfaced significant shortcomings which needed to 

be addressed. 

We in Georgia cannot overstate the value of having an independent, technically competent center like the Kennesaw Center 

for Election Assistance which is staffed with elections-oriented computer scientists who are equipped to audit and test voting systems. 

Every day we continue to review our security practices. And over 

the last 18 months, we have strengthened our procedures and our 

practices a great deal. 

I applaud the interest of this distinguished committee in the important public policy issue, and we stand ready from Georgia to assist you in any way that we can. Thank you. 

The CHAIRMAN. Thank you for your testimony. 

[The statement of Ms. Rogers follows:]

101


Insert graphic folio 164 97366A.057
102


Insert graphic folio 165 97366A.058
103


Insert graphic folio 166 97366A.059
104


Insert graphic folio 167 97366A.060
105


Insert graphic folio 168 97366A.061
106


Insert graphic folio 169 97366A.062
107


Insert graphic folio 170 97366A.063
108


Insert graphic folio 171 97366A.064
109


Insert graphic folio 172 97366A.065
110


Insert graphic folio 173 97366A.066
111


Insert graphic folio 174 97366A.067
112


Insert graphic folio 175 97366A.068
113


Insert graphic folio 176 97366A.069
114

The CHAIRMAN. And we will move on to the last witness. 

STATEMENT OF JILL LAVINE, REGISTRAR, SACRAMENTO 

COUNTY, CALIFORNIA 

Ms. LAVINE. Thank you. I am Jill Lavine and I am from Sacramento, California. And Sacramento County was the first jurisdiction in the United States that has conducted any portion of an election using touch-screen technology that was incorporated in a 

voter-verified paper audit trail. Ours was a very limited early voting project which is described in detail in my written report. The 

equipment for this pilot was the Vote Trakker system provided to 

Sacramento County by Avante International Technology, Incorporated. The pilot was authorized by the Voting Systems and 

Standards Procedure panel within the Office of the California Secretary of State. Additional authorization was provided by the Sacramento County Board of Supervisors. 

This project involved early voting in six locations for a period of 

11 days prior to the November 5, 2002 election. Voters from anywhere in Sacramento County were permitted to vote at any one of 

the six locations. There were a total of 246 variations of the ballot 

for this election. The voting units were accessible for blind voters, 

to voters with disabilities, and each voter was able to choose a language: Spanish or English. A total of 1,612 valid ballots were cast 

at these early voting locations. 

This experiment with the voter-verified paper audit trail was 

conducted under very controlled conditions. Each of the early voting sites was staffed with various personnel from our office and a 

technician provided by Avante. The equipment and the system met 

our requirements and expectations. We considered the project a 

success. The reaction to the equipment was mostly positive. Comments and observations from the poll workers, voters in the poll, 

and the others are contained in my written report. 

In the interest of time, I will limit my time to the use of the 

printed ballot and the challenges it presented. Some of the voters 

did not want to see the ballot and fled before the ballot was able 

to print. There are approximately 20 of these voters. This could be 

a major problem. If a voter walks away before approving the paper 

version of the ballot, is the ballot counted? Some voters wanted to 

take the copy with them. We called the printed copy a receipt, 

which implied they could take it with them. This is obviously a 

mistake and is easy to change. The printed ballot jammed. This 

caused the machine to be taken out of service until the problem 

was corrected. In order to remove the jammed ballots, we had to 

use anything that was handy. For example, a back-scratcher and 

a windshield wiper blade were used to pull the ballots out. Voters 

complained that the printed copy of the ballot was hard to read because of the size and lightness of the print and because of the location of the shield which protected the printed copy. These problems 

are easy to correct. 

Voters also complained that the length of the ballot made it difficult to check, which will continue to be a problem when the ballot 

is long. 

Voters wanted to remove the printed ballot before it went back 

in the machine. This is not possible, of course, because a voter 

115

could remove the ballot without being detected. Some of the voters 

were concerned that other voters would see his or her ballot. This 

was a placement problem that can be corrected. The location of the 

shield that protected the printed ballot made it difficult for a seated voter to see his or her ballot. Again, this is fairly easy to correct. 

The storage area for the printed ballot was too small and needed 

to be emptied during the day. This is obviously unacceptable and 

must be corrected. 

After the voter verified his or her ballot on the screen, the printed version was produced. If the voter changed his or her mind, or 

didn’t agree with what was printed, it was too late to be corrected. 

This has been corrected, but it is still potentially problematic. 

Only ballots approved by the voters should be counted. At the 

same time, there must be no way to connect the ballot with a voter. 

During the canvass of the vote, we manually recounted one of the 

early voting places. The precinct selected had 114 ballots. Because 

of the complexity of the ballot and the fact there were 246 different 

ballot types, it took 1271⁄2 hours to recount. The machine count and 

the count on the paper ballots did match. Following this demonstration project, Avante made numerous changes to the equipment, addressing most if not all of the concerns expressed. 

In conclusion, while a voter-verified paper trail may increase a 

voter’s confidence in the use of electronic ballots, it is not without 

concern. While many of the concerns I have identified can and have 

been resolved, there still remain concerns that may not be fixable. 

For example at the polling place, the problem with fleeing voters, 

printing jams, the length of time necessary for a voter to verify his 

or her ballot. After the election, there would be significant delays 

in providing official election results from the manual counting of 

paper ballots in case of a recount or a challenged election. These 

issues remain unresolved. 

Thank you. 

The CHAIRMAN. Thank you for your testimony.

[The statement of Ms. Lavine follows:]

116


Insert graphic folio 182 97366A.070
117


Insert graphic folio 183 97366A.071
118


Insert graphic folio 184 97366A.072
119


Insert graphic folio 185 97366A.073
120


Insert graphic folio 186 97366A.074
121


Insert graphic folio 187 97366A.075
122


Insert graphic folio 188 97366A.076
123


Insert graphic folio 189 97366A.077
124


Insert graphic folio 190 97366A.078
125


Insert graphic folio 191 97366A.079
126


Insert graphic folio 192 97366A.080
127


Insert graphic folio 193 97366A.081
128


Insert graphic folio 194 97366A.082
129


Insert graphic folio 195 97366A.083
130


Insert graphic folio 196 97366A.084
131


Insert graphic folio 197 97366A.085
132


Insert graphic folio 198 97366A.086
133


Insert graphic folio 199 97366A.087
134


Insert graphic folio 200 97366A.088
135


Insert graphic folio 201 97366A.089
136


Insert graphic folio 202 97366A.090
137


Insert graphic folio 203 97366A.091
138


Insert graphic folio 204 97366A.092
139


Insert graphic folio 205 97366A.093
140


Insert graphic folio 206 97366A.094
141


Insert graphic folio 207 97366A.095
142


Insert graphic folio 208 97366A.096
143


Insert graphic folio 209 97366A.097
144


Insert graphic folio 210 97366A.098
145


Insert graphic folio 211 97366A.099
146


Insert graphic folio 212 97366A.100
147


Insert graphic folio 213 97366A.101
148


Insert graphic folio 214 97366A.102
149


Insert graphic folio 215 97366A.103
150


Insert graphic folio 216 97366A.104
151


Insert graphic folio 217 97366A.105
152


Insert graphic folio 218 97366A.106
153


Insert graphic folio 219 97366A.107
154


Insert graphic folio 220 97366A.108
155


Insert graphic folio 221 97366A.109
156


Insert graphic folio 222 97366A.110
157


Insert graphic folio 223 97366A.111
158


Insert graphic folio 224 97366A.112
159


Insert graphic folio 225 97366A.113
160


Insert graphic folio 226 97366A.114
161


Insert graphic folio 227 97366A.115
162


Insert graphic folio 228 97366A.116
163


Insert graphic folio 229 97366A.117
164


Insert graphic folio 230 97366A.118
165


Insert graphic folio 231 97366A.119
166


Insert graphic folio 232 97366A.120
167


Insert graphic folio 233 97366A.121
168


Insert graphic folio 234 97366A.122
169


Insert graphic folio 235 97366A.123
170


Insert graphic folio 236 97366A.124
171


Insert graphic folio 237 97366A.125
172


Insert graphic folio 238 97366A.126
173


Insert graphic folio 239 97366A.127
174


Insert graphic folio 240 97366A.128
175


Insert graphic folio 241 97366A.129
176


Insert graphic folio 242 97366A.130
177


Insert graphic folio 243 97366A.131
178


Insert graphic folio 244 97366A.132
179


Insert graphic folio 245 97366A.133
180


Insert graphic folio 246 97366A.134
181


Insert graphic folio 247 97366A.135
182


Insert graphic folio 248 97366A.136
183


Insert graphic folio 249 97366A.137
184


Insert graphic folio 250 97366A.138
185


Insert graphic folio 251 97366A.139
186


Insert graphic folio 252 97366A.140
187


Insert graphic folio 253 97366A.141
188


Insert graphic folio 254 97366A.142
189


Insert graphic folio 255 97366A.143
190


Insert graphic folio 256 97366A.144
191


Insert graphic folio 257 97366A.145
192


Insert graphic folio 258 97366A.146
193


Insert graphic folio 259 97366A.147
194


Insert graphic folio 260 97366A.148
195


Insert graphic folio 261 97366A.149
196


Insert graphic folio 262 97366A.150
197


Insert graphic folio 263 97366A.151
198


Insert graphic folio 264 97366A.152
199


Insert graphic folio 265 97366A.153
200


Insert graphic folio 266 97366A.154
201


Insert graphic folio 267 97366A.155
202


Insert graphic folio 268 97366A.156
203


Insert graphic folio 269 97366A.157
204


Insert graphic folio 270 97366A.158
205

The CHAIRMAN. This was also shown. This is from Maryland. 

And this was the printout from it. And I would note that I did see 

the name Hoyer nine times, so I thought I would mention that. 

Mr. HOYER. Mr. Chairman, if I could, I want to apologize to Attorney General Lamone—that was some years ago—for missing her 

testimony, although I have a reliable report that it was excellent 

and right on point. And I thank you as well, the two of you who 

have not the theoretical discussion but the practical problem of 

confronting hundreds, indeed thousands, of voters and ensuring 

that they are processed in a way that gives them confidence and 

does not discourage them from voting and has voting occur in a 

time frame that can handle a large number of people. 

Let me say, Dr. Rubin is also here. Mr. Kohno, the graduate student, is here as well. I think Mr. Williams and Dr. Shamos have 

left. 

Mr. Chairman, you and I have had this discussion. This is not 

an adversarial proceeding. This committee worked together—Mr. 

Ney and I, Mr. Larson was very helpful as well, Mr. Dodd and Mr. 

McConnell—to try to facilitate voting and to give voters a greater 

degree of confidence that they could vote accurately and that it 

would be counted. We did not mandate a technology. We purposely 

did not mandate a technology. 

We did mandate that you could not use Federal dollars to replace 

a lever machine or the punch cards because, A, the leverage machines have essentially gone out of business with no replacement 

parts; and secondly, the punch cards have proved to be one of the 

least reliable systems; although, as all of us know, paper ballots 

themselves are very high up on the list. If you had just the paper 

ballot system, they are higher up on the list of mistakes as well. 

We all want to get to the same place, and that is a system where 

the voter has confidence, the jurisdiction, whether it be a county, 

a State, or a country, has confidence that as a result that is what 

the voters intended the result to be. 

I think we can do that. I will tell you, I don’t think we can do 

it between now and November in terms of the technology that will 

be available. 

So what the Chairman was saying and I think what Mr. Larson 

said as well—and I apologize. I apologize. I give a press briefing 

every week. But we want to make sure that no voter in America 

this year is discouraged from voting. We don’t want to undermine 

their confidence. 

My problem as, Dr. Rubin, you have probably read, and Senator 

Dodd’s problem is not with the analysis, because you are an expert 

and we are not, and we ought to make sure that whatever technology we use is not subject to being manipulated and is accurate 

and fair; but that the debate that is occurring concerns a number 

of people, not just those with disabilities, who are concerned that 

we will go to a system that does not provide them as for the first 

time in history they have been provided with a mechanism to vote 

secretly. 

Mr. Dixon was in the room, as you know. Mr. Dixon is blind. He 

is a wonderful person, a bright, knowledgeable, able person, and he 

like every other American wants to go into a ballot booth and vote, 

206

and he wants to know how he votes, and nobody else, unless he 

wants to tell them. 

Mr. Ney, myself, Mr. Larson, and Senator Dodd and Senator 

McConnell were pleased that we mandated that that happen. This 

technology, DRE technology, is one of the ways both from a visual 

and/or audible standpoint that allows that to happen. 

What I am hopeful, Mr. Chairman, is that we proceed in a manner which will give Americans confidence that we are pursuing the 

best technology we can possibly find, using all the expert advice 

and counsel. But at the same time, while we are evolving towards 

whatever system we arrive at—and my presumption is that this 

process will always be evolving because we will get better technology and better security and better ways to do things, and that 

is progress—but that we not get so animated in our debate that we 

undermine citizens’ confidence. That would not be a result that I 

know any of us seek. 

So I apologize, Linda, that I didn’t hear your testimony. I will 

read it. 

And, Ms. Rogers, thank you very much for what you and Georgia 

have done. Georgia and Maryland were two of the leading States 

in terms of trying to adopt technology. 

I want to say, Mr. Chairman, in closing, that—Mr. Ehlers unfortunately has left, and I didn’t want to interject at that point in 

time—we do need more money for NIST. I would like to offer an 

amendment, adding $2.8 million, which is what NIST says it needs, 

to the NIST budget in the Commerce, State, Justice. You and I 

have had that discussion. The budget is so tight. I would like to 

have them—they get 300-plus million; 2.8 million of that I would 

like them to use in the short term, because this is an immediate 

problem and this could be helpful to us. And Mr. Ehlers was primarily responsible for NIST being a part of HAVA. And I think Mr. 

Ney and I both believe that that was a very positive suggestion. 

But perhaps we can work on that because, again, this is not an 

adversary relationship. Everybody wants the same objective. Everybody. And in that context, as I was telling my good friend Rush 

Holt, in that context, people of goodwill, experts and practical appliers of technology, we ought to be able to get together and figure 

out how we can do this, but in the interim do the very best we can, 

which in my opinion is going to be far better than 2000. 

There are a lot of other things in HAVA: second-chance voting, 

provisional ballots. We are not there yet. But when we get to online statewide registration, interfacing with local precincts, that is 

probably going to take us the longest time and be most expensive 

in the long run, probably, but that is a wonderful reform: accessibility of all polling places. 

There are some wonderful things in HAVA which do not deal directly with the technology question, but giving jurisdictions the 

ability to afford—Mr. Mica, I disagree with Mr. Mica very fundamentally. The Federal Government has been on the State dole 

since 1789, which means that for over 200 years, we have not contributed a nickel to the running of Federal elections; $3.9 billion is 

a small sum for us to help 55 jurisdictions, 50 States, the District 

of Columbia, in doing what they have had trouble doing, because 

so often they were the last people considered in the budget process, 

207 

because elections just seem to be, well, we are working and we are 

stumbling along. HAVA was an attempt to try to empower the 

States to bring our elections up to date and to utilize the technology available to make sure that we accomplished the objectives 

stated. 

And, Mr. Chairman, I know you and I are in 100 percent agree- ment that $3.9 billion is a small sum, relatively speaking. It is how 

much money we will spend in Iraq. I supported the authority and 

I believe our mission in Iraq, if accomplished, will be a very positive accomplishment. But it is more money than we spend—it is 

less money than we spend in Iraq in 25 days to make America’s 

democracy work better. A good investment. 

The CHAIRMAN. Thank the gentleman. And I want to ask some 

questions, but I do want to make a statement first, too. You know, 

the Help America Vote Act went way beyond the hanging chads. 

And I will be frank with you, and I know that Congressman Hoyer 

heard this, I heard it; many asked, why do you want to do something? Let it go. We can’t afford it. We shouldn’t do it. We shouldn’t 

change the system. 

And I didn’t know this until the Bush-Gore election, that 1,800- 

some votes weren’t counted in my own congressional race. Now, it 

didn’t matter because the margin was so big. But if it had been 

close, there would have been 1,700 individuals that would not have 

been in the process, would have been disenfranchised. So I think 

something had to happen. 

HAVA wasn’t done on a whim. We would have liked it to have 

passed faster. But the process took time. And that is the way 

things run. But we reached out also in that bill, Carter—the FordCarter Commission, they contributed to it. We talked to the 

NAACP, we talked to election officials, and we reached out to others. We didn’t do it in a vacuum or behind a closed door, and we 

especially talked to people on the front line, like all of you. You are 

on the front line. You can do good research or people can do science 

projects when it comes to these issues. But the fact remains that 

you are out there and you see how the voting system actually 

works. 

That doesn’t mean we take this issue lightly or take the bill 

lightly. And we don’t take the lack of funding lightly either. And 

I am hoping within one of these bills—and I think what Congressman Hoyer said is completely correct and accurate—we will work 

toward fully funding HAVA. 

As far as the money goes, when this started we went to Speaker 

of the House Hastert, and then Leader Gephardt, and sat down 

with both the Speaker and Leader Gephardt. Money was not an 

issue. We spend $5 billion helping blossoming democracies around 

the world, and that is great. So I don’t think $3.9 billion is too 

much to spend on improving our democracy here at home. 

And what the Congressman wants to do is critical to securing 

that money, at least here in the house. And frankly, I don’t think 

any of us will rest, and that includes our Senate colleagues, until 

we get all of the money; because you should have some resources, 

which the Federal Government has never before provided. 

I think I am going to ask a question. Unfortunately, this whole 

debate, and I think most all of you pointed this out, there is some 

208

unfortunate twisting that has happened. A lot of things have been 

overshadowed. Comments have been made about individuals who 

run these voting system companies who have supported a Presidential candidate. That is unfortunate that ever happened. We 

have to move beyond that and look at what is going on. And the 

Election Commission can try to devise ways to look at the security 

of these systems. 

I know the paper ballots weren’t working. And, again, the main 

problems our election system has faced throughout the history of 

this country have involved paper. But I know the intentions of election officials—and you did watch in your States for situations, and 

you did monitor your respective election systems. And I think a lot 

of you have been maligned unfairly, frankly. It has been twisted. 

There are people involved in this debate for the right reasons who 

are doing good research. And there are people in the front line. I 

think that is why this hearing helps, and helps get issues out on 

both sides of this issue. 

Mr. HOYER. Mr. Chairman, would you yield a minute? One of the 

things I mentioned, registration. One of the statistics that was 

brought before us when we had the hearings on HAVA was that 

many more millions of people lost their vote because of registration 

issues and technology issues by far, by a multiple of maybe 3 or 

4. I don’t think there is a precise number obviously, but significant. 

And we ought to keep that in mind, because as the Chairman said, 

HAVA has done a lot of things in addition to this and this is getting all the attention. 

But I am hopeful we get voters—I know the election officials 

are—but you run the system with 95 percent volunteers on one 

day, it is tough not to make mistakes because it is a human factor. 

But second-chance voting is essentially new, and provisional ballots 

are new, and there are paper ballots and they have to be set aside 

and have to be checked to see whether or not the voter actually 

is—and I am concerned, Mr. Chairman, there are different State 

laws. In HAVA, we were focused on not empowering the States and 

not limiting the States, but I am not so sure we didn’t make a mistake by having State law apply; because some States say if you 

don’t live in that precinct, even if you may be voting for all the 

same people as voting in the next precinct, you can’t have a provisional ballot. I think that is unfortunate. 

I don’t what the law is in Georgia and I don’t know what our law 

is on that, Linda. But in any event, registration is one of the huge 

problems that we are not as focused on because we are so focused 

on technology, and many more millions lost the opportunity to vote 

because of registration issues than because of technology, hanging 

chads, or other technology issues. 

Thank you, Mr. Chairman. 

The CHAIRMAN. Two quick questions. I know the Ranking Member will want to ask questions. What potential unintended consequences could result from mandating that all DREs be equipped 

with a paper trail? 

Ms. ROGERS. I would be happy to share with you myself, and I 

believe Jill as well, I began my career in elections as an elections 

worker in the polls way back in the early eighties. And I can tell 

you through all my years I worked in the polls with lever machines 

209

and I worked with optical scan equipment, I firmly believe that the 

introduction of paper into the polling place on a busy Election Day 

is going to cause mass confusion. It is going to upset voters who 

don’t want attention called to them if there is a problem. Voters 

like the ability to stand at a unit, review their ballots, such as they 

do with electronic voting. It shows them what they have voted prior 

to touching cast ballot, and they do that in private. 

When you vote on an optical scan-based system and you walk 

over to put it into the machine, if that ballot has been overloaded, 

it kicks it back and might read on the little LCD, and it might say 

‘‘overvoted race 10.’’ Well, you have got a line of voters standing behind you and you, the voter—the poll worker says, Would you like 

to take this over and correct it? Correct what? It is intimidating to 

the voters. 

I am very afraid the paper receipt such as you saw in the demonstration a little while ago would be mass intimidation to voters, 

and I believe the very same to poll workers just based upon—and 

that is based upon my own experience as an elections official. The 

introduction of paper is going to cause a great deal of heartache 

and headache. 

The CHAIRMAN. Just a scenario here, because it comes to mind 

when you are talking. If I get my receipt and I am in the privacy 

of the booth, I take that receipt, right? I would have to go outside. 

Ms. ROGERS. You would actually take the receipt and then deposit it into a box on your way out the door. Now, that scenario 

gives me a lot of concern, because what is going to happen when 

the voter says, You are not having this receipt? What does the poll 

worker do then? In other systems, it sort of sucks it back up into 

the machine. And given the length of what you saw, I have seen 

some that develop that is a 4-inch window plexiglass. This roll of 

paper would move behind the glass and it does 4 seconds where 

you see the 4 inches at one time. So the voter would have to quickly view that as it is going around, and then it would have to not 

get caught or jammed in the system. But there are two different 

components: one you would drop in the box, and one would stay behind glass. 

The CHAIRMAN. If I get that in the privacy of the booth and I 

come up and you say, Where is your receipt? And I say, It didn’t 

spit one out. And you say, It had to. And I say No, it didn’t; are 

you calling me a liar? And I put it in my pocket. 

Ms. ROGERS. Which could easily happen. That is one of our greatest concerns over paper receipt. 

The CHAIRMAN. The other question is, do you believe the mandatory paper trail would increase the system security? Does it add 

anything to security itself? 

Ms. LAMONE. No, it doesn’t in my estimation. I think what Dr. 

Shamos said earlier was that testing, testing, testing. And his idea 

of having standards that are well thought out and not voluntary, 

I think is the way to go. Maryland law requires us to adhere to the 

Federal standards. I have no choice, and I do not rely on the ITA 

report solely for our security analysis. I think it would add more 

trouble than, frankly, what it is worth. 

There is emerging technology out there, whether it involves a 

piece of paper that the voter can then go and verify post-election 

210 

that their vote was accurately counted, but it is all encoded, it 

doesn’t have names on it. And there is also some electronic technology that is coming about that would provide us with a better opportunity to audit the election and make sure that the equipment 

was performing. 

The CHAIRMAN. You know, I remember speaking with one of the 

companies that produces voting systems. This company doesn’t 

produce a receipt and they don’t want to produce a receipt. But one 

of the companies that I saw in a meeting told me, Look, we can 

produce a receipt. We don’t think it ought to be used though. We 

don’t think that that gives the security that people believe it will. 

And so therefore, that is why I think we should take this seriously and we should have some ability to check machines to see if 

there is fraud, which you all have done, including in Maryland, 

where you haven’t gotten credit for it, but you have done it. But 

we should do that, because the movement now has been towards, 

well, forget machines, this should be all paper. 

Isn’t it true, too, if you could manipulate the machine, you could 

manipulate the paper? If you fix the machine, the paper comes out. 

So it is still an issue, the machine’s integrity, which we should take 

seriously. 

And wrapping up my questions I have for Ms. Lavine, just about 

that pilot which Sacramento County used, the DREs, which produced a voter-verified paper trail. The pilot took place during early 

voting prior to Election Day. 

Ms. LAVINE. Yes, it did. 

The CHAIRMAN. Would the conditions have been different if it 

had been an Election Day, do you think? 

Ms. LAVINE. We were going to just to try the system. We didn’t 

want to do a full rollout in every single polling place. We wanted 

to keep it controlled. That is why we only had it for early voting 

in certain locations. We were able to have an authorized technician 

from Avante at each single polling place. And if we had done a full 

rollout on Election Day, there was no way we could have had a 

technician at every one of our polling places. 

The CHAIRMAN. You had six polling places, so you could have six 

technicians? 

Ms. LAVINE. Yes. 

The CHAIRMAN. How many polling places do you have in the 

county? 

Ms. LAVINE. Normally over 800. 

The CHAIRMAN. You couldn’t have 800 technicians. 

Ms. LAVINE. And we wouldn’t have had that many experienced 

personnel either. We staffed from our office to make sure we had 

someone there that knew the ins and outs. 

The CHAIRMAN. How much longer did it take to vote in these six 

polling places? 

Ms. LAVINE. It didn’t take that much longer to vote. It was the 

verifying of the receipts. But most voters who were in a hurry— 

many voters didn’t want to stay, and left. So they just said, No, I 

am not interested, go ahead and do whatever you want to do with 

it. 

The CHAIRMAN. You said 127 hours? 

211

Ms. LAVINE. One hundred twenty-seven and a half hours to 

verify. We did the manual recount verifying what was the paper 

versus the electronic. And when you pull out those long pieces of 

paper, they start curling like Goldilocks’ curls, and you are holding 

down both ends. We did them in teams of two to verify the electronic count. To read back and forth and no way to quickly read 

the paper ballot, it took that long to verify only 114 of the ballots. 

We didn’t do the entire project. 

The CHAIRMAN. How many ballots were included in the six polling places? 

Ms. LAVINE. One thousand six hundred twelve ballots. 

The CHAIRMAN. What would you have on an Election Day? 

Ms. LAVINE. Close to 300,000. 

The CHAIRMAN. Why was the system not adopted? 

Ms. LAVINE. There are many things. At that point, the Secretary 

of State had not come out with his decision on whether it was necessary to have the paper verified, voter-verified paper audit trail. 

We cancelled the RFP that we were in the process of, and we were 

waiting for things to settle down a little bit to see which way the 

wind was blowing. 

The CHAIRMAN. If you had a thousand ballots, it took 127 hours. 

Statistically, it would take how long? Just a guesstimate. 

Ms. LAVINE. I didn’t figure that one out. 

The CHAIRMAN. I would assume a long time. 

Ms. LAVINE. Longer than the 30 days that we have to verify an 

election. 

The CHAIRMAN. For a thousand ballots—how many ballots do you 

normally get? 

Ms. LAVINE. I am sorry. 

The CHAIRMAN. You have a thousand ballots. 

Ms. LAVINE. Only 114 ballots that we counted. 

The CHAIRMAN. And it took 127 hours? If you add 3,000 it could 

take months. 

Ms. LAVINE. We have 300,000. 

Ms. LAVINE. Years. 

The CHAIRMAN. Years. 

The CHAIRMAN. Mr. Larson. 

Mr. LARSON. Let me thank you for your enlightening testimony. 

And before I ask just a couple of rudimentary questions as they relate to the monies, I want to go back and emphasize something 

that our distinguished leader said, Mr. Hoyer, that in looking at 

this issue, it is especially intriguing from a scientific and technological aspect but equally compelling in terms of the practicality of 

putting these things into practice. 

I want to commend Dr. Rubin. He said in his testimony in weighing what we have all been discussing this morning, his duty and 

responsibility to speak out, and I commend him for that because 

I think that is what enriches our process. That is what allows us 

to get to the heart of the matter. 

And the first panelists—the goal was, from my perspective, was 

to lead people towards a practical consensus. I think it has been 

further enhanced by your testimony this morning. My questions 

deal specifically with the monies that you are receiving and have 

been appropriated under HAVA. Have they been fully utilized and 

212

are they helpful and how will they relate to what we talked about 

before in terms of training—which, Mr. Hoyer called you Attorney 

General Lamone—but how do they relate to how you have been 

able to—you gave elaborate examples of everything that Maryland 

has done and I assume Georgia has done. I am concerned how this 

money—and of course, I share with Leader Hoyer and our distinguished Chairman the concern about getting additional monies out 

there to accomplish what I believe was the consensus of the first 

panel, that what we need is testing, testing, testing, training, 

training, training. But conceptually, I had thought about when we 

were talking about a paper ballot, I thought we were talking about 

a card, something that was readily available and handy. And obviously your demonstration of about a 10-foot long paper ballot and 

all the ensuing problems that that creates is a compelling visual 

demonstration that deals away from the common idea; because you 

know, we have been comparing this verbally to receiving a receipt 

from an ATM machine, which is quite different when you contrast 

this. Not that I don’t think technologically that could be overcome 

in the future, but we are dealing with the practicality of a November election. 

So my questions are: One, the monies that you are receiving; how 

are they being expended? Are you utilizing them? I have a special 

question for California, because we did have the opportunity to 

meet with Secretary of State Shelley, and Leader Pelosi arranged 

everything. Mr. Hoyer and myself were able to go to that. And I 

know there was a question of decertification, but Mr. Shelley went 

to great lengths to say that, yes, but he did that so there would 

be an opportunity to correct the—what was wrong, what they had 

detected as being wrong with machines. And I want to know how 

that process has gone. 

We also heard some indication from Georgia that some of the 

monies that were coming down from HAVA might be used by the 

State to address Medicare issues. And I want to know if that was 

something that was misreported. But I do think—especially given 

the scarcity of funds and the need for us to focus on this issue, how 

that is all taking place. If you care to respond. 

Mr. HOYER. Thank you for allowing me to participate. Unfortunately, I have to leave, but I want to thank you and Mr. Larson 

for your leadership on this issue. And I think these hearings are 

important to see what we have done and what we are doing and 

what we need to continue to do to accomplish the objectives. And 

I want to thank all of the witnesses, who I think were all very good 

witnesses. Good information, and we will digest it and take such 

action as we deem to be appropriate. 

[The statement of Mr. Hoyer follows:]

213


Insert graphic folio 290 97366A.159
214

The CHAIRMAN. If it wasn’t for your perseverance, we wouldn’t 

have the bill. 

Ms. LAMONE. I will go with the first question. I think I can state 

for every jurisdiction in the country and the territories that the 

money is more than welcome, but it is not enough. The unintended 

consequences of what is going on with this discussion about security and training, testing, and so forth, at least in Maryland, I am 

expected to use the Federal money first. So here we have got all 

these other things we have got to do under HAVA, 13 different 

mandates, and I am sapping, I am draining the money, the HAVA 

money off to do all this other stuff that I don’t think anybody anticipated a year and a half ago. That is not to say it is not important, but it is unfortunate because I still have major projects to do, 

namely the voter registration system. 

There is going to be a time of reckoning, if there are no more 

Federal dollars appropriated, when the State is going to have to 

cough up additional funds. 

Mr. LARSON. And the voter registration problem is one that Mr. 

Hoyer points out where the greatest number of people ended up 

being turned away from voting; is that not correct? 

Ms. LAMONE. Yes. Nationally, that was correct. I am not sure 

that that is the case in Maryland. But we do think differently in 

Maryland than some of the other jurisdictions. 

But to answer your question, we got a lot of money and it is not 

going to be enough anyway, and we are being forced to use it for 

unintended expenditures. 

Mr. LARSON. If I could play devil’s advocate and be Mr. Mica for 

a second, what is enough money in your estimation? What would 

Maryland need? 

Ms. LAMONE. I think the Department of Legislative Services, 

which is the advisory group for our Maryland General Assembly, 

estimated between 100 million to 130 million for Maryland to complete all the tasks and make the payments in the outyears. It is 

a little bit over twice of what we have gotten. 

Mr. LARSON. Would the same be true for Georgia? 

Ms. ROGERS. We believe if we were to receive the full funding 

that HAVA initially allotted, we would be able to cover all the 

mandates of HAVA. 

Mr. LARSON. What about the commingling of funds? Is this a 

temptation of States to use—you are smiling, so I take it—— 

Ms. ROGERS. I read the same article that you did. In Georgia, our 

State legislature okayed $54 million in bond funding prior to 

HAVA ever being enacted. We reimbursed—when we got this last 

bit of money, we reimbursed our State Treasury. Now they are 

going to use that money, I assume they are going to use that 

money to pay down the bond debt. But a great deal of that bond 

debt had already been paid. It leaves a chunk of money that the 

Treasury then has. 

I believe what you read may have been how the State is going 

to use the reimbursement once they already pay the bond funding. 

Ms. LAVINE. I work on the county level so I am not sure how 

much the State would need. We also—in California we were able 

to pass a voter bond that allowed us to have some money in our 

county and throughout the State. So we have been fortunate that 

215

we have got—I don’t want to say enough money—but we probably 

have more than some of the other States have. 

Mr. LARSON. Pretty much unanimous consent amongst the three 

of you that if we were to put technologically a draft on the DREs’ 

paper trail, that that is realistically not something that would—

that is going to fulfill the mission come this election in November; 

is that fair to say? 

Ms. ROGERS. In Georgia we have determined that it would cost us $16 million to retrofit our equipment for the addition of a paper 

trail to do that statewide. We don’t think that is a good use of our 

HAVA dollars. And we don’t have $16 million of HAVA money left 

at this point to do so. 

Mr. LARSON. I seem to garner from your testimony that you 

thought that the problems that were raised—not the least of which 

is the potential for the machine clogging, people reviewing, the 

time that could be allotted, people just walking away because that 

is what they are used to after they cast their vote because they 

have got to get back to work or whatever—becomes more problematic. Is that a fair assessment to say? 

Ms. ROGERS. I think so. 

Mr. LARSON. What about the decertification issue? 

Ms. LAVINE. Because of the decertification, since Sacramento 

County did not have a DRE in March, we are not allowed to even 

purchase one in December. We are going to go to an optical-scan 

system for November. With all the legislation that is being passed, 

until there is a system with a paper, accessible voter-verified paper 

audit trail, we are not even allowed to purchase one. 

Mr. LARSON. You may have heard Dr. Rubin’s testimony earlier 

where he seemed to come up with a process that was different than 

the ones that you have testified to. And again, I am not a scientist. 

I am not someone who—what Professor Negroponte used to call one 

of the digitally homeless in many respects. So I don’t want to mischance what he said. But it seemed to me he had a more compact 

and precise way of using that, though I think he testified that that 

is something that wouldn’t be ready for this election cycle. I am 

wondering if you heard that and what your reaction might be long 

term with respect to the—at the heart of this argument, it is hard 

to deny when I face groups and they say, Well, what is the matter 

with trust but verify, or trust everyone but cut the cards, and being 

able to have that, know that you voted for that. And of course, it 

is a very logical assumption until you meet—come face to face with 

the practicality of its implementation and then all the ensuing fallout that has been mentioned, whether it is the disability community or others. 

Mr. Shamos testified that he thought there would be a way to 

do that down the road, but it doesn’t seem as though—clearly, it 

is not possible for November. But what is your sense about where 

we need to go for the future, and are these practical ways? 

Ms. ROGERS. Well, let me first address what I heard Dr. Rubin 

talk about in that—you would. Instead of seeing that paper receipt, 

there is a possibility of printing it out. It probably would be an 18-

inch-long ballot. These are just concepts. No one has developed 

anything like this. It might have like, if you voted on an optical 

scan, an 18-inch piece of paper. I have seen a prototype where this 

216

would come up at the same time you are viewing your ballot on an 

electronic machine, and then you would look at it, as you looked 

at this side, you look at this side, and once you verify it, you would 

hit print and it might print out on card-stock paper. Understand 

that card-stock paper that you are currently printing an opticalscan ballot on goes for about $0.35 a piece. Each voter would have 

this card-stock paper. It would come out. They would verify it and 

then they would take it to an optical-scan tabulator and vote, putting it into the tabulator, which gets back into the same scenario 

we talked about a little while ago. You have one of those per every 

precinct, versus having one voting booth with electronic capability 

for each voter. That in itself is two separate voting systems with 

two separate problems. 

And what I have heard knocked around is these need to be from 

different vendors as well. You may not want them to be the same 

vendor. You have to get two vendors to work together for their software to integrate together, and there is a lot of proprietary concerns over that. But the biggest problem, one I don’t think this 

money is growing on trees, and that is a whole lot of money. 

Mr. LARSON. Do you ever feel that when all of these proposals 

are being made, that maybe what we ought to do is convene you 

all first? 

Ms. ROGERS. We would appreciate that. 

Mr. LARSON. My final question has to deal with this New York 

Times article that I think makes an awful lot of sense. 

[The information follows:]

217


Insert graphic folio 298 97366A.160
218


Insert graphic folio 299 97366A.161
219


Insert graphic folio 300 97366A.162
220


Insert graphic folio 301 97366A.163
221


Insert graphic folio 302 97366A.164
222

Mr. LARSON. You heard Dr. Shamos refer to it. The article, 

though you may not have read it, essentially said we ought to 

make sure when it comes to voting that we are going procedurally 

from a security standpoint and from testing, et cetera, that we provide the voters with the same kind of security that is provided in 

the casino industry for the integrity of slot machines. We ought to 

make sure that the security is there as well. 

I am gathering from your testimony that you wouldn’t disagree 

with that but what you need for that is the money in the independent verification. Is that fair to say? 

Ms. LAMONE. And we need—for the country to be comfortable, we 

need to have standards that everybody must follow and we need to 

have somebody looking at the software, like I mentioned before, in 

establishing a baseline for the security issues, telling the States 

what risks were identified and maybe how to mitigate them, just 

like we did in Maryland with those two reports. 

Last year it was just a fun-filled year with all the security reports coming out. Election officials don’t have that expertise. We 

know how to run an election but we are not security experts, which 

is why I now have security people on my staff. And then you would 

have some assurance that the country using X vendor system is all 

addressing the same issues and hopefully around the same ways. 

Mr. LARSON. You would agree with Mr. Rubin that they should 

be independently evaluated also, not evaluated by the vendors 

themselves? 

Ms. LAMONE. No, no. I think NIST is an appropriate vehicle. And 

I for one am so glad HAVA was enacted and glad that NIST is involved in the process, because it does provide us with a lot of weapons that we never had before. 

Mr. LARSON. I want to thank you all. I think you have been terrific. And I thank the Chairman again for his leadership on this 

important issue. He rarely takes the bows that he richly deserves, 

but he has been a leader in this area in passing what I believe is 

historic and landmark legislation; like all legislation, not ones that 

we can’t further perfect as we go along, but given the circumstances and the times and trying to put this in order and having to buck a trend, he deserves an enormous amount of credit. 

And thank you for providing these hearings and providing people 

with the opportunity to voice their concerns so we can better implement the laws of HAVA. 

The CHAIRMAN. Thank you. I want to thank my cousin in the 

back of the room applauding for me. I want to thank you. And I 

want to thank all the people across the country that worked on this 

and gave the input to get HAVA to where it is today. I thank our 

witnesses who worked hard to prepare for the hearing. We had two 

great panels. 

I thank Congressman Larson for his diligence and his staff, and 

the members and other members of the committee and their staffs, 

for their work on this. 

I ask unanimous consent that members and witnesses have 7 

legislative days to submit material into the record, and those statements and materials be entered in the appropriate place in the 

record. Without objection, the material will be entered. 

223

I ask unanimous consent that staff be authorized to make technical and conforming changes on all matters considered by the committee today. Without objection, so ordered. 

And, having completed our business, the hearing is adjourned. 

[Whereupon, at 2:15 p.m., the committee was adjourned.] 

(224)

Chairman Ney’s Response to the New York Time Editorial of June 

11, 2004

In a recent editorial (‘‘The Disability Lobby and Voting,’’ Jun. 11, 

2004), the New York Times disgraced itself by making slanderous 

attacks against representatives of the disability community who 

have opposed legislation that would require electronic voting systems to produce a voter-verified ‘‘paper trail.’’ The editorial states 

that this opposition, which the New York Times believes is disproportionately influential, is most likely due to contributions that 

groups like the National Federation of the Blind (NFB) and the 

American Association of People with Disabilities (AAPD) have received from voting equipment manufacturers. In other words, the 

New York Times is more or less alleging that the representatives 

of these groups are selling out their own constituents as well as the 

American electorate in exchange for a pay-off. 

This is simply outrageous. As a principal author of the Help 

America Vote Act of 2002 (HAVA), I had the opportunity to work 

closely with both NFB and AAPD as this legislation was being developed. Thus, I know from first-hand experience of their commitment to improving the election process not only for those they directly represent but for all Americans as well. Their input added 

greatly to a landmark piece of legislation that will substantially 

improve our nation’s voting system for generations to come. 

People of good will have honest disagreements about the advisability of requiring electronic voting systems to produce voterverified paper records. Groups like NFB and AAPD, as well as 

many other respectable voices in the technology and election administration communities, have legitimate concerns about whether 

such a requirement would compromise the privacy and independence of voters, add unnecessary expense to the process, and do 

nothing to buttress the integrity of the election system. 

Unfortunately, the New York Times refuses to even acknowledge 

that reasonable opponents of a paper-trail requirement even exist. 

Instead, it implies that only those who have corrupt motives or 

have been bought off could possibly oppose such a requirement. 

The editorial also smears my good friend, Senator CHRISTOPHER

DODD, by implying that there is something untoward about him appointing Jim Dickson, head of AAPD, to the Advisory Board of the 

Election Assistance Commission after the AAPD had awarded the 

Senator with its Justice for All Award. This perception of a conspiracy around every corner is beginning to descend into the paranoid depths occupied by Oliver Stone and Michael Moore. This is 

unbecoming of an institution as venerable as the New York Times, 

and the American public deserves better. 

The whole issue of electronic voting system security is extremely 

important and very complex, and the committee I chair will continue to examine it closely. Thus, there is a need for a healthy deVerDate jul 14 2003 04:20 Jan 25, 2005 Jkt 097366 PO 00000 Frm 00224 Fmt 6604 Sfmt 6604 E:\HR\OC\A366P2.XXX A366P2
225

bate on this issue. However, that debate is impoverished when a 

voice of prominent as the New York Times’ slurs opponents of its 

positions with outlandish speculation and unfounded charges. What 

is needed is more reasoned dialogue and less character assassination.

Æ